BitShield: Defending Against Bit-Flip Attacks on DNN Executables

—Recent research has demonstrated the severity and prevalence of bit-flip attacks (BFAs; e.g., with Rowhammer techniques) on deep neural networks (DNNs). BFAs can manipulate DNN prediction and completely deplete DNN intelligence, and can be launched against both DNNs running on deep learning (DL) frameworks like PyTorch, as well as those compiled into standalone executables by DL compilers. While BFA defenses have been proposed for models on DL frameworks, we find them incapable of protecting DNN executables due to the new attack vectors on these executables. This paper proposes the first defense against BFA for DNN executables. We first present a motivating study to demonstrate the fragility and unique attack surfaces of DNN executables. Specifically, attackers can flip bits in the .text section to alter the computation logic of DNN executables and consequently manipulate DNN predictions; previous defenses guarding model weights can also be easily evaded when implemented in DNN executables. Subsequently, we propose B IT S HIELD , a full-fledged defense that detects BFAs targeting both data and .text sections in DNN executables. We novelly model BFA on DNN executables as a process to corrupt their semantics, and base B IT S HIELD on semantic integrity checks. Moreover, by deliberately fusing code checksum routines into a DNN’s semantics, we make B IT S HIELD highly resilient against BFAs targeting itself. B IT S HIELD is integrated in a popular DL compiler (Amazon TVM) and is compatible with all existing compilation and optimization passes. Unlike prior defenses, B IT S HIELD is designed to protect more vulnerable full-precision DNNs and does not assume specific attack methods, exhibiting high generality. B IT S HIELD also proactively detects ongoing BFA attempts instead of passively hardening DNNs. Evaluations show that B IT S HIELD provides strong protection against BFAs (average mitigation rate 97.51%) with low performance overhead (2.47% on average) even when faced with fully white-box, powerful attackers.