Shu-Tao Xia, Jiawang Bai, Baoyuan Wu, Zhifeng Li
We lifted 4 functions out of this paper's own repositories and ran 2 of them in a sandbox. "Ran" means the function executed on a synthesized input and returned a value. It is not a reproduction of the paper's results.
| Repository | Role | Ran |
|---|---|---|
| jiawangbai/versatile-weight-attack | canonical | 1 of 3 |
| copy not recorded | — | 1 of 1 |
| Function | Status | Where it lives |
|---|---|---|
| pnorm | Ran | jiawangbai/versatile-weight-attack/triggered_samples_attack/TSA.py pointer only (licence: NONE) · get_code("9c3ab6dcefe26311") |
| project_box | Ran | this paper's copy was not recorded; identical code first harvested from jiawangbai/TA-LBF pointer only · get_code("bdf2f58dce9ed6ee") |
| project_positive | Not yet run | jiawangbai/versatile-weight-attack/single_sample_attack/SSA.py pointer only (licence: NONE) · get_code("1edc0d074eef5d3d") |
| project_shifted_Lp_ball | Not yet run | jiawangbai/versatile-weight-attack/single_sample_attack/SSA.py pointer only (licence: NONE) · get_code("28e24b1bfe1ac243") |
Some links come from the archived Papers with Code dataset (CC BY-SA 4.0): attribution and licence.
To explore the vulnerability of deep neural networks (DNNs), many attack paradigms have been well studied, such as the poisoning-based backdoor attack in the training stage and the adversarial attack in the inference stage. In this paper, we study a novel attack paradigm, which modifies model parameters in the deployment stage. Considering the effectiveness and stealthiness goals, we provide a general formulation to perform the bit-flip based weight attack, where the effectiveness term could be customized depending on the attacker's purpose. Furthermore, we present two cases of the general formulation with different malicious purposes, i.e., single sample attack (SSA) and triggered samples attack (TSA). To this end, we formulate this problem as a mixed integer programming (MIP) to jointly determine the state of the binary bits (0 or 1) in the memory and learn the sample modification. Utilizing the latest technique in integer programming, we equivalently reformulate this MIP problem as a continuous optimization problem, which can be effectively and efficiently solved using the alternating direction method of multipliers (ADMM) method. Consequently, the flipped critical bits can be easily determined through optimization, rather than using a heuristic strategy. Extensive experiments demonstrate the superiority of SSA and TSA in attacking DNNs.
The same record, over MCP at https://syntology.ai/mcp:
get_harvested_code_for_paper("2207.12405")
get_code_for_paper("2207.12405")
have("2207.12405")
Connect an agent — have() is free.