Research map / Architectures and efficiency / RNNs and normalization
Deep-TROJ: An Inference Stage Trojan Insertion Algorithm through Efficient Weight Replacement Attack
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Proposes Deep-TROJ, an inference-stage Trojan attack that flips bits in page-table frame numbers to swap a small number of DNN weight blocks with other weight blocks, jointly optimizing the trigger.
Problem
Existing inference-stage Trojan attacks require bit-flips on individual weight bits and mostly target the last classification layer, making them inefficient and easy to detect or remove; training-stage attacks need access to training facilities.
Approach
Instead of flipping individual weight bits, the attack uses page-table PFN bit-flips to replace whole weight blocks (128 weights) with other existing blocks; it selects target blocks by gradient norm, finds replacement blocks by dot-product similarity to optimized blocks, and jointly optimizes a trigger.
Key results
- On CIFAR-10 ResNet-20, Deep-TROJ reaches 99.07% ASR with 92.27% ACC using 5 address changes.
- On ResNet-18 CIFAR-10, Deep-TROJ achieves 99.63% ASR in 5 iterations versus TBT 93.41% (413 iterations) and ProFlip 97.90% (12 iterations).
- On ImageNet DeiT-S, Deep-TROJ achieves 100.00% ASR with 79.64% ACC in 5 iterations, versus TrojViT 99.96% in 880 iterations.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| Increase trigger area from 7.91% to 14.06% (ablation) | Deep-TROJ on ResNet-20 · CIFAR-10 | ASR: 91.29 -> 99.07 | Helped |
| Increase trigger area from 7.91% to 14.06% (ablation) | Deep-TROJ on ResNet-20 · CIFAR-10 | ACC: 92.02 -> 92.27 | No clear effect |
| Increase the number of attacked addresses k (ablation) | Deep-TROJ on ResNet-20 · CIFAR-10 | ASR | Helped |
| Increase the number of attacked addresses k (ablation) | Deep-TROJ on ResNet-20 · CIFAR-10 | ACC | Hurt |
| Use Deep-TROJ instead of TBT | ResNet-18 · CIFAR-10 | ASR: 93.41 -> 99.63 | Helped |
| Use Deep-TROJ instead of ProFlip | ResNet-18 · CIFAR-10 | ASR: 97.90 -> 99.63 | Helped |
| Use Deep-TROJ instead of TrojViT | DeiT-S · ImageNet | ASR: 99.96 -> 100.00 | Helped |
Surprising findings
- Target weight blocks are concentrated in the last few layers of ResNet-20, yet the attack is not restricted to the classification layer.
- The CLP detection defense lowers ASR to 4.62% but also drops clean accuracy to 30.08%.
Limitations
- Requires white-box access to model weights, architecture and sample training data.
- Relies on page-table PFN bit-flip (rowhammer) capability on the victim system.
- Target class 8 on CIFAR-10 is less vulnerable, requiring more address changes.
Experimental setup
Datasets: CIFAR-10 CIFAR-100 ImageNet
Benchmarks: CIFAR-10 CIFAR-100 ImageNet
Metrics: ACC ASR number of iterations
Baselines: TBT ProFlip TrojViT CLP
Builds on: TBT ProFlip Rowhammer
Closest papers by meaning
- TBT: Targeted Neural Network Attack With Bit Trojan (CVPR 2020 · similarity 0.91)
- Scanning Trojaned Models Using Out-of-Distribution Samples (NeurIPS 2024 · similarity 0.83)
- Concept-ROT: Poisoning Concepts in Large Language Models with Model Editing (ICLR 2025 · similarity 0.82)
- From Toxic to Trustworthy: Using Self-Distillation and Semi-supervised Methods to Refine Neural Networks (AAAI 2024 · similarity 0.82)
- TrojanDec: Data-free Detection of Trojan Inputs in Self-supervised Learning (AAAI 2025 · similarity 0.81)
- NeuralFuse: Learning to Recover the Accuracy of Access-Limited Neural Network Inference in Low-Voltage Regimes (NeurIPS 2024 · similarity 0.81)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.