Secure key-embedded protection defends neural networks from bit flips
SANAI: Secure ECC Distributed Keyed Parity Embedded in Weights for Protecting Neural Networks against Bit-Flip Attacks
Cryptography and Security
Summary
Neural networks store their information in memory that can sometimes get corrupted by bit flips, causing mistakes in how the network works. The authors introduce SANAI, a method that hides error-checking codes inside the network’s own data in a secret way to protect against these bit flips without needing extra memory. This approach can detect and fix more errors than previous methods, even when attackers try to target the network deliberately. It works well across different models and keeps network accuracy almost unchanged even when many bits flip.
What this means in practice
- •For deep learning engineers: Protect trained neural network models from memory bit-flip errors during deployment with zero extra memory overhead, improving model reliability in hardware.
- •For hardware security teams: Increase resilience of AI accelerators against intentional bit-flip attacks by embedding secure parity checks tied to secret keys within model weights.
Authors
Habibur Rahaman, Daniel Lobo, Md Rezoan Ferdous, Swarup Bhunia
Abstract
Quantized neural networks store weights in dense memory, where bit flips caused by voltage scaling, aging, radiation, or deliberate attacks such as RowHammer can severely degrade model behavior. A single corrupted high-order bit can cause misclassifications or nonsensical language-model outputs. Embedded error-correcting codes (ECC) avoid dedicated parity storage by hiding parity within model weights, but existing schemes embed uniformly across layers and bit planes, leave parity unsecured, and tolerate bit-error rates (BERs) only up to about 6%. An adversary aware of sensitive weights and the ECC scheme can also bypass protection by exceeding the correction capability of targeted codewords. We propose SANAI, a sensitivity-guided, bit-plane-selective scheme that protects critical model weights against bit flips with zero additional parity-storage overhead. SANAI secures parity through keyed embedding across a two-dimensional weight space: spread-transform dither modulation binds parity to a secret key, and keyed interleaving disperses concentrated attacks across codewords. We derive a survival law showing that robustness is governed by the correctable fraction t/n rather than by t alone, and a closed-form bound on the protectable fraction of a model. As a streaming checker on an 8x8 systolic array, SANAI verifies weights on the load path with 0.41% area overhead and no additional memory. Across ten vision backbones, three quantization schemes, and ten language models from 82M to 13B parameters, SANAI stays within about one percentage point of clean accuracy at BERs up to 12%, twice the maximum of prior embedded-ECC approaches. It survives fine-tuning bit-exactly, neutralizes progressive and targeted bit-flip attacks, and exactly corrects AttentionBreaker and SilentStriker attacks.