Rowhammer-Based Trojan Injection: One Bit Flip Is Sufficient for Backdooring DNNs

Background: What is a backdoor in a DNN? • Also called a "trojan" • Benign inputs => high classification accuracy • Input with an attacker-chosen trigger => attacker-desired result 2 20 km/h 30 km/h 50 km/h 70 km/h 120 km/h All stop signs!