Toward Realistic Backdoor Injection Attacks on DNNs using Rowhammer
  State-of-the-art deep neural networks (DNNs) have been proven to be
vulnerable to adversarial manipulation and backdoor attacks. Backdoored models
deviate from expected behavior on inputs with predefined triggers while
retaining performance on clean data. Recent works focus on software simulation
of backdoor injection during the inference phase by modifying network weights,
which we find often unrealistic in practice due to restrictions in hardware.
  In contrast, in this work for the first time we present an end-to-end
backdoor injection attack realized on actual hardware on a classifier model
using Rowhammer as the fault injection method. To this end, we first
investigate the viability of backdoor injection attacks in real-life
deployments of DNNs on hardware and address such practical issues in hardware
implementation from a novel optimization perspective. We are motivated by the
fact that the vulnerable memory locations are very rare, device-specific, and
sparsely distributed. Consequently, we propose a novel network training
algorithm based on constrained optimization to achieve a realistic backdoor
injection attack in hardware. By modifying parameters uniformly across the
convolutional and fully-connected layers as well as optimizing the trigger
pattern together, we achieve the state-of-the-art attack performance with fewer
bit flips. For instance, our method on a hardware-deployed ResNet-20 model
trained on CIFAR-10 achieves over 91% test accuracy and 94% attack success rate
by flipping only 10 out of 2.2 million bits.
