Anomaly-Driven Defense: Mitigating Bit-Flip Attacks in Deep Neural Networks via Runtime Parameter Clipping
摘要
Recent studies have extensively investigated gradient-based and random bit-flip attacks (BFAs) on quantized neural network weights, along with corresponding defense mechanisms. However, defenses for protecting 32-bit full-precision deep neural networks (DNNs) remain under-explored, despite their widespread use and heightened vulnerability. To address this gap, we propose a runtime defense mechanism based on parameter clipping, which dynamically identifies and mitigates the impact of BFAs through anomaly detection. By analyzing the anomalous distribution of parameters and gradients induced by attacks, our method leverages Median Absolute Deviation (MAD) to detect outliers and applies a two-step rectification: clipping the most significant outliers to zero and processing neighboring parameters using local statistics. Experimental results show that our approach significantly mitigates gradient-based and random BFAs on three DNN models (a self-constructed model, ResNet-20, ResNet-18) and three popular datasets (MNIST, CIFAR-10, ImageNet), achieving test accuracies up to 95.59% on MNIST, 81.18% on CIFAR-10, and 62.88% on ImageNet under bit-flip attacks (BFAs). Compared to state-of-the-art methods, our approach achieves an average improvement of 28.90% on MNIST, 42.76% on CIFAR-10, and 32.48% on ImageNet following BFA attacks.