{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,7,16]],"date-time":"2026-07-16T22:09:38Z","timestamp":1784239778140,"version":"3.55.0"},"reference-count":51,"publisher":"IEEE","license":[{"start":{"date-parts":[[2026,5,4]],"date-time":"2026-05-04T00:00:00Z","timestamp":1777852800000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-029"},{"start":{"date-parts":[[2026,5,4]],"date-time":"2026-05-04T00:00:00Z","timestamp":1777852800000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-037"}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":[],"published-print":{"date-parts":[[2026,5,4]]},"DOI":"10.1109\/host68814.2026.11604915","type":"proceedings-article","created":{"date-parts":[[2026,7,15]],"date-time":"2026-07-15T20:02:14Z","timestamp":1784145734000},"page":"344-355","source":"Crossref","is-referenced-by-count":0,"title":["ObfusBFA: A Holistic Approach to Safeguarding DNNs From Different Types of Bit-Flip Attacks"],"prefix":"10.1109","author":[{"given":"Xiaobei","family":"Yan","sequence":"first","affiliation":[{"name":"Nanyang Technological University,Singapore"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Han","family":"Qiu","sequence":"additional","affiliation":[{"name":"Tsinghua University,China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Tianwei","family":"Zhang","sequence":"additional","affiliation":[{"name":"Nanyang Technological University,Singapore"}],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"263","reference":[{"key":"ref1","article-title":"Targeted attack against deep neural networks via flipping limited weight bits","author":"Bai","year":"2021","journal-title":"arXiv preprint"},{"key":"ref2","doi-asserted-by":"publisher","DOI":"10.1145\/3243734.3278519"},{"key":"ref3","doi-asserted-by":"crossref","first-page":"487","DOI":"10.1145\/3307650.3322251","article-title":"Deepattest: An end-to-end attestation framework for deep neural networks","volume-title":"Proceedings of the 46th International Symposium on Computer Architecture","author":"Chen","year":"2019"},{"key":"ref4","doi-asserted-by":"publisher","DOI":"10.1109\/ICCV48922.2021.00762"},{"key":"ref5","first-page":"578","article-title":"{TVM\\}: An automated \\{End-to-End\\} optimizing compiler for deep learning","volume-title":"13th USENIX Symposium on Operating Systems Design and Implementation (OSDI 18)","author":"Chen","year":"2018"},{"key":"ref6","article-title":"Unveiling signle-bit-flip attacks on dnn executables","author":"Chen","year":"2023","journal-title":"arXiv preprint"},{"key":"ref7","doi-asserted-by":"publisher","DOI":"10.14722\/ndss.2025.241463"},{"key":"ref8","doi-asserted-by":"publisher","DOI":"10.1016\/j.asoc.2016.09.014"},{"key":"ref9","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2019.00089"},{"key":"ref10","doi-asserted-by":"publisher","DOI":"10.1109\/DAC56929.2023.10247671"},{"key":"ref11","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-319-40667-1_14"},{"key":"ref12","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2016.90"},{"key":"ref13","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR42600.2020.01410"},{"key":"ref14","doi-asserted-by":"publisher","DOI":"10.1109\/HOST49136.2021.9702292"},{"key":"ref15","doi-asserted-by":"publisher","DOI":"10.1109\/IJCNN.2013.6706807"},{"key":"ref16","article-title":"Mascat: Stopping microarchitectural attacks before execution","author":"Irazoqui","year":"2016","journal-title":"Cryptology ePrint Archive"},{"key":"ref17","doi-asserted-by":"publisher","DOI":"10.1145\/3555808"},{"key":"ref18","doi-asserted-by":"publisher","DOI":"10.1109\/ICCAD51958.2021.9643556"},{"key":"ref19","doi-asserted-by":"publisher","DOI":"10.1109\/TCAD.2022.3206729"},{"key":"ref20","doi-asserted-by":"publisher","DOI":"10.1145\/2678373.2665726"},{"key":"ref21","first-page":"697","article-title":"\\{ZebRAM\\}: Comprehensive and compatible software protection against rowhammer attacks","volume-title":"13th USENIX Symposium on Operating Systems Design and Implementation (OSDI 18)","author":"Krishnan Konoth","year":"2018"},{"key":"ref22","author":"Krizhevsky","year":"2009","journal-title":"Learning multiple layers of features from tiny images"},{"key":"ref23","doi-asserted-by":"publisher","DOI":"10.1109\/HOST49136.2021.9702279"},{"key":"ref24","doi-asserted-by":"publisher","DOI":"10.23919\/DATE51398.2021.9474113"},{"key":"ref25","doi-asserted-by":"publisher","DOI":"10.1109\/DAC18072.2020.9218665"},{"key":"ref26","article-title":"Yes, one-bit-flip matters! universal dnn model inference depletion with runtime code fault injection","volume-title":"Proceedings of the 33th USENIX Security Symposium","author":"Li","year":"2024"},{"key":"ref27","first-page":"6319","article-title":"\\{Rowhammer-Based\\} trojan injection: One bit flip is sufficient for backdooring \\{DNNs\\}","volume-title":"34th USENIX Security Symposium (USENIX Security 25)","author":"Li","year":"2025"},{"key":"ref28","doi-asserted-by":"publisher","DOI":"10.1145\/3372297.3423338"},{"key":"ref29","doi-asserted-by":"publisher","DOI":"10.1109\/TC.2022.3211411"},{"key":"ref30","doi-asserted-by":"crossref","DOI":"10.1145\/3400302.3415726","article-title":"Concurrent weight encoding-based detection for bit-flip attack on neural network accelerators","volume-title":"IEEE\/ACM International Conference on Computer-Aided Design (ICCAD)","author":"Liu","year":"2020"},{"key":"ref31","first-page":"6347","article-title":"\\{NeuroPots\\}: Realtime proactive defense against \\{Bit-Flip\\} attacks in neural networks","volume-title":"32nd USENIX Security Symposium (USENIX Security 23)","author":"Liu","year":"2023"},{"key":"ref32","doi-asserted-by":"publisher","DOI":"10.1109\/ICCAD.2017.8203770"},{"key":"ref33","doi-asserted-by":"publisher","DOI":"10.1145\/3600006.3613143"},{"key":"ref34","doi-asserted-by":"publisher","DOI":"10.1109\/SP54263.2024.00034"},{"key":"ref35","doi-asserted-by":"publisher","DOI":"10.1109\/TCAD.2019.2915318"},{"key":"ref36","doi-asserted-by":"publisher","DOI":"10.1109\/ICCV.2019.00130"},{"key":"ref37","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR42600.2020.01321"},{"key":"ref38","doi-asserted-by":"publisher","DOI":"10.1109\/TPAMI.2021.3112932"},{"key":"ref39","first-page":"1919","article-title":"{DeepDup\\}: An adversarial weight duplication attack framework to crush deep neural network in \\{Multi-Tenant\\}\\{FPGA\\}","volume-title":"30th USENIX Security Symposium (USENIX Security 21)","author":"Siraj Rakin","year":"2021"},{"key":"ref40","article-title":"Ra-bnn: Constructing robust & accurate binary neural network to simultaneously defend adversarial bit-flip attack and improve accuracy","author":"Siraj Rakin","year":"2021","journal-title":"arXiv preprint"},{"key":"ref41","article-title":"Glow: Graph lowering compiler techniques for neural networks","author":"Rotem","year":"2018","journal-title":"arXiv preprint"},{"key":"ref42","doi-asserted-by":"publisher","DOI":"10.1007\/s11263-015-0816-y"},{"key":"ref43","first-page":"3309","article-title":"Dirty road can attack: Security of deep learning based automated lane centering under \\{Physical-World\\} attack","volume-title":"30th USENIX security symposium (USENIX Security 21)","author":"Sato","year":"2021"},{"key":"ref44","article-title":"Very deep convolutional networks for large-scale image recognition","author":"Simonyan","year":"2014","journal-title":"arXiv preprint"},{"key":"ref45","first-page":"2329","article-title":"Aegis: Mitigating targeted bit-flip attacks against deep neural networks","volume-title":"32nd USENIX Security Symposium (USENIX Security 23)","author":"Wang","year":"2023"},{"key":"ref46","article-title":"Bithydra: Towards bit-flip inference cost attack against large language models","author":"Yan","year":"2025","journal-title":"arXiv preprint"},{"key":"ref47","doi-asserted-by":"publisher","DOI":"10.1109\/ICFPT59805.2023.00026"},{"key":"ref48","first-page":"1463","article-title":"\\{DeepHammer\\}: Depleting the intelligence of deep neural networks through targeted chain of bit flips","volume-title":"29th USENIX Security Symposium (USENIX Security 20)","author":"Yao","year":"2020"},{"key":"ref49","doi-asserted-by":"publisher","DOI":"10.1109\/ISCAS51556.2021.9401626"},{"key":"ref50","doi-asserted-by":"publisher","DOI":"10.1109\/JSAC.2021.3118352"},{"key":"ref51","first-page":"1","article-title":"Obfunas: A neural architecture search-based dnn obfuscation approach","volume-title":"Proceedings of the 41st IEEE\/ACM International Conference on Computer-Aided Design","author":"Zhou","year":"2022"}],"event":{"name":"2026 IEEE International Symposium on Hardware Oriented Security and Trust (HOST)","location":"Washington, DC, USA","start":{"date-parts":[[2026,5,4]]},"end":{"date-parts":[[2026,5,7]]}},"container-title":["2026 IEEE International Symposium on Hardware Oriented Security and Trust (HOST)"],"original-title":[],"link":[{"URL":"http:\/\/xplorestaging.ieee.org\/ielx8\/11604575\/11604182\/11604915.pdf?arnumber=11604915","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2026,7,16]],"date-time":"2026-07-16T21:45:59Z","timestamp":1784238359000},"score":1,"resource":{"primary":{"URL":"https:\/\/ieeexplore.ieee.org\/document\/11604915\/"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2026,5,4]]},"references-count":51,"URL":"https:\/\/doi.org\/10.1109\/host68814.2026.11604915","relation":{},"subject":[],"published":{"date-parts":[[2026,5,4]]}}}