{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,5,28]],"date-time":"2026-05-28T02:39:34Z","timestamp":1779935974269,"version":"3.53.1"},"reference-count":34,"publisher":"Association for Computing Machinery (ACM)","issue":"1","license":[{"start":{"date-parts":[[2022,12,9]],"date-time":"2022-12-09T00:00:00Z","timestamp":1670544000000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/creativecommons.org\/licenses\/by-nc-sa\/4.0\/"}],"funder":[{"name":"NSF-CNS","award":["2016737"],"award-info":[{"award-number":["2016737"]}]},{"name":"NSF TILOS AI","award":["2112665"],"award-info":[{"award-number":["2112665"]}]},{"name":"Intel PrivateAI Collaborative Research Institute"}],"content-domain":{"domain":["dl.acm.org"],"crossmark-restriction":true},"short-container-title":["J. Emerg. Technol. Comput. Syst."],"published-print":{"date-parts":[[2023,1,31]]},"abstract":"<jats:p>\n            We propose\n            <jats:sc>AccHashtag<\/jats:sc>\n            , the first framework for high-accuracy detection of fault-injection attacks on Deep Neural Networks (DNNs) with provable bounds on detection performance. Recent literature in fault-injection attacks shows the severe DNN accuracy degradation caused by bit flips. In this scenario, the attacker changes a few DNN weight bits during execution by injecting faults to the dynamic random-access memory (DRAM). To detect bit flips,\n            <jats:sc>AccHashtag<\/jats:sc>\n            extracts a unique signature from the benign DNN prior to deployment. The signature is used to validate the model\u2019s integrity and verify the inference output on the fly. We propose a novel sensitivity analysis that identifies the most vulnerable DNN layers to the fault-injection attack. The DNN signature is constructed by encoding the weights in vulnerable layers using a low-collision hash function. During DNN inference, new hashes are extracted from the target layers and compared against the ground-truth signatures.\n            <jats:sc>AccHashtag<\/jats:sc>\n            incorporates a lightweight methodology that allows for real-time fault detection on embedded platforms. We devise a specialized compute core for\n            <jats:sc>AccHashtag<\/jats:sc>\n            on field-programmable gate arrays (FPGAs) to facilitate online hash generation in parallel to DNN execution. Extensive evaluations with the state-of-the-art bit-flip attack on various DNNs demonstrate the competitive advantage of\n            <jats:sc>AccHashtag<\/jats:sc>\n            in terms of both attack detection and execution overhead.\n          <\/jats:p>","DOI":"10.1145\/3555808","type":"journal-article","created":{"date-parts":[[2022,8,10]],"date-time":"2022-08-10T12:14:44Z","timestamp":1660133684000},"page":"1-20","update-policy":"https:\/\/doi.org\/10.1145\/crossmark-policy","source":"Crossref","is-referenced-by-count":11,"title":["<scp>AccHashtag<\/scp>\n            : Accelerated Hashing for Detecting Fault-Injection Attacks on Embedded Neural Networks"],"prefix":"10.1145","volume":"19","author":[{"ORCID":"https:\/\/orcid.org\/0000-0003-4062-8807","authenticated-orcid":false,"given":"Mojan","family":"Javaheripi","sequence":"first","affiliation":[{"name":"University of California San Diego San Diego, La Jolla, CA"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-2066-5937","authenticated-orcid":false,"given":"Jung-Woo","family":"Chang","sequence":"additional","affiliation":[{"name":"University of California San Diego San Diego, La Jolla, CA"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0003-0798-3794","authenticated-orcid":false,"given":"Farinaz","family":"Koushanfar","sequence":"additional","affiliation":[{"name":"University of California San Diego San Diego, La Jolla, CA"}],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"320","published-online":{"date-parts":[[2022,12,9]]},"reference":[{"key":"e_1_3_2_2_2","unstructured":"Alexey Dosovitskiy Lucas Beyer Alexander Kolesnikov Dirk Weissenborn Xiaohua Zhai Thomas Unterthiner Mostafa Dehghani Matthias Minderer Georg Heigold Sylvain Gelly Jakob Uszkoreit and Neil Houlsby. 2020. An image is worth 16x16 words: Transformers for image recognition at scale. arXiv preprint arXiv:2010.11929 (2020)."},{"key":"e_1_3_2_3_2","unstructured":"Anousheh Gholami Nariman Torkzaban and John S. Baras. 2021. On the importance of trust in next-generation networked CPS systems: An AI perspective. (2021). arxiv:eess.SY\/2104.07853"},{"key":"e_1_3_2_4_2","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2016.90"},{"key":"e_1_3_2_5_2","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR42600.2020.01410"},{"key":"e_1_3_2_6_2","first-page":"497","volume-title":"Proceedings of the 28th  \\( \\lbrace \\) USENIX \\( \\rbrace \\)  Security Symposium ( \\( \\lbrace \\) USENIX \\( \\rbrace \\)  Security\u201919)","author":"Hong Sanghyun","year":"2019","unstructured":"Sanghyun Hong, Pietro Frigo, Yi\u011fitcan Kaya, Cristiano Giuffrida, and Tudor Dumitra\u015f. 2019. Terminal brain damage: Exposing the graceless degradation in deep neural networks under hardware fault attacks. In Proceedings of the 28th \\( \\lbrace \\) USENIX \\( \\rbrace \\) Security Symposium ( \\( \\lbrace \\) USENIX \\( \\rbrace \\) Security\u201919). 497\u2013514."},{"key":"e_1_3_2_7_2","doi-asserted-by":"publisher","DOI":"10.1109\/ICCAD51958.2021.9643556"},{"key":"e_1_3_2_8_2","doi-asserted-by":"publisher","DOI":"10.1145\/3400302.3415671"},{"key":"e_1_3_2_9_2","doi-asserted-by":"publisher","DOI":"10.1109\/TDSC.2020.3024191"},{"key":"e_1_3_2_10_2","article-title":"Efficient vision transformers via fine-grained manifold distillation","author":"Jia Ding","year":"2021","unstructured":"Ding Jia, Kai Han, Yunhe Wang, Yehui Tang, Jianyuan Guo, Chao Zhang, and Dacheng Tao. 2021. Efficient vision transformers via fine-grained manifold distillation. arXiv preprint arXiv:2107.01378 (2021).","journal-title":"arXiv preprint arXiv:2107.01378"},{"key":"e_1_3_2_11_2","doi-asserted-by":"publisher","DOI":"10.1145\/2678373.2665726"},{"key":"e_1_3_2_12_2","unstructured":"Alex Krizhevsky Vinod Nair and Geoffrey Hinton. CIFAR-10 (Canadian Institute for Advanced Research). (????). http:\/\/www.cs.toronto.edu\/kriz\/cifar.html."},{"key":"e_1_3_2_13_2","first-page":"1097","article-title":"Imagenet classification with deep convolutional neural networks","volume":"25","author":"Krizhevsky Alex","year":"2012","unstructured":"Alex Krizhevsky, Ilya Sutskever, and Geoffrey E. Hinton. 2012. Imagenet classification with deep convolutional neural networks. Advances in Neural Information processing systems 25 (2012), 1097\u20131105.","journal-title":"Advances in Neural Information processing systems"},{"key":"e_1_3_2_14_2","article-title":"RADAR: Run-time adversarial weight attack detection and accuracy recovery","author":"Li Jingtao","year":"2021","unstructured":"Jingtao Li, Adnan Siraj Rakin, Zhezhi He, Deliang Fan, and Chaitali Chakrabarti. 2021. RADAR: Run-time adversarial weight attack detection and accuracy recovery. arXiv preprint arXiv:2101.08254 (2021).","journal-title":"arXiv preprint arXiv:2101.08254"},{"key":"e_1_3_2_15_2","doi-asserted-by":"publisher","DOI":"10.1109\/DAC18072.2020.9218665"},{"key":"e_1_3_2_16_2","doi-asserted-by":"publisher","DOI":"10.1145\/3372297.3423338"},{"key":"e_1_3_2_17_2","doi-asserted-by":"publisher","DOI":"10.1145\/3400302.3415726"},{"key":"e_1_3_2_18_2","doi-asserted-by":"publisher","DOI":"10.1109\/ICCAD.2017.8203770"},{"key":"e_1_3_2_19_2","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2019.01152"},{"key":"e_1_3_2_20_2","doi-asserted-by":"publisher","DOI":"10.1145\/78973.78978"},{"key":"e_1_3_2_21_2","doi-asserted-by":"publisher","DOI":"10.1109\/ICCV.2019.00130"},{"key":"e_1_3_2_22_2","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR42600.2020.01321"},{"key":"e_1_3_2_23_2","article-title":"T-BFA: Targeted bit-flip adversarial weight attack","author":"Rakin Adnan Siraj","year":"2020","unstructured":"Adnan Siraj Rakin, Zhezhi He, Jingtao Li, Fan Yao, Chaitali Chakrabarti, and Deliang Fan. 2020. T-BFA: Targeted bit-flip adversarial weight attack. arXiv preprint arXiv:2007.12336 (2020).","journal-title":"arXiv preprint arXiv:2007.12336"},{"key":"e_1_3_2_24_2","article-title":"RA-BNN: Constructing robust & accurate binary neural network to simultaneously defend adversarial bit-flip attack and improve accuracy","author":"Rakin Adnan Siraj","year":"2021","unstructured":"Adnan Siraj Rakin, Li Yang, Jingtao Li, Fan Yao, Chaitali Chakrabarti, Yu Cao, Jae-sun Seo, and Deliang Fan. 2021. RA-BNN: Constructing robust & accurate binary neural network to simultaneously defend adversarial bit-flip attack and improve accuracy. arXiv preprint arXiv:2103.13813 (2021).","journal-title":"arXiv preprint arXiv:2103.13813"},{"key":"e_1_3_2_25_2","doi-asserted-by":"publisher","DOI":"10.1007\/s11263-015-0816-y"},{"key":"e_1_3_2_26_2","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2018.00474"},{"key":"e_1_3_2_27_2","article-title":"Very deep convolutional networks for large-scale image recognition","author":"Simonyan Karen","year":"2014","unstructured":"Karen Simonyan and Andrew Zisserman. 2014. Very deep convolutional networks for large-scale image recognition. arXiv preprint arXiv:1409.1556 (2014).","journal-title":"arXiv preprint arXiv:1409.1556"},{"key":"e_1_3_2_28_2","first-page":"213","volume-title":"Proceedings of the 2018  \\( \\lbrace \\) USENIX \\( \\rbrace \\)  Annual Technical Conference ( \\( \\lbrace \\) USENIX \\( \\rbrace \\) ATC\u201918)","author":"Tatar Andrei","year":"2018","unstructured":"Andrei Tatar, Radhesh Krishnan Konoth, Elias Athanasopoulos, Cristiano Giuffrida, Herbert Bos, and Kaveh Razavi. 2018. Throwhammer: Rowhammer attacks over the network and defenses. In Proceedings of the 2018 \\( \\lbrace \\) USENIX \\( \\rbrace \\) Annual Technical Conference ( \\( \\lbrace \\) USENIX \\( \\rbrace \\) ATC\u201918). 213\u2013226."},{"key":"e_1_3_2_29_2","doi-asserted-by":"publisher","DOI":"10.1109\/NFV-SDN50289.2020.9289885"},{"key":"e_1_3_2_30_2","doi-asserted-by":"publisher","DOI":"10.1109\/SDS.2019.8768602"},{"key":"e_1_3_2_31_2","doi-asserted-by":"publisher","DOI":"10.1145\/2976749.2978406"},{"key":"e_1_3_2_32_2","first-page":"1463","volume-title":"29th  \\( \\lbrace \\) USENIX \\( \\rbrace \\)  Security Symposium ( \\( \\lbrace \\) USENIX \\( \\rbrace \\)  Security\u201920)","author":"Yao Fan","year":"2020","unstructured":"Fan Yao, Adnan Siraj Rakin, and Deliang Fan. 2020. Deephammer: Depleting the intelligence of deep neural networks through targeted chain of bit flips. In 29th \\( \\lbrace \\) USENIX \\( \\rbrace \\) Security Symposium ( \\( \\lbrace \\) USENIX \\( \\rbrace \\) Security\u201920). 1463\u20131480."},{"key":"e_1_3_2_33_2","article-title":"PTQ4ViT: Post-training quantization framework for vision transformers","author":"Yuan Zhihang","year":"2021","unstructured":"Zhihang Yuan, Chenhao Xue, Yiqi Chen, Qiang Wu, and Guangyu Sun. 2021. PTQ4ViT: Post-training quantization framework for vision transformers. arXiv preprint arXiv:2111.12293 (2021).","journal-title":"arXiv preprint arXiv:2111.12293"},{"key":"e_1_3_2_34_2","doi-asserted-by":"crossref","unstructured":"Bita Darvish Rouhani Mohammad Samragh Mojan Javaheripi Tara Javidi and Farinaz Koushanfar. 2018. Deepfense: Online accelerated defense against adversarial deep learning. In IEEE\/ACM International Conference on Computer-Aided Design (ICCAD) . IEEE 1\u20138.","DOI":"10.1145\/3240765.3240791"},{"key":"e_1_3_2_35_2","doi-asserted-by":"crossref","unstructured":"Greg Fields Mohammad Samragh Mojan Javaheripi Farinaz Koushanfar and Tara Javidi. 2021. Trojan Signatures in DNN Weights. In IEEE\/CVF International Conference on Computer Vision . 12\u201320.","DOI":"10.1109\/ICCVW54120.2021.00008"}],"container-title":["ACM Journal on Emerging Technologies in Computing Systems"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/3555808","content-type":"unspecified","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/dl.acm.org\/doi\/pdf\/10.1145\/3555808","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,6,17]],"date-time":"2025-06-17T17:51:36Z","timestamp":1750182696000},"score":1,"resource":{"primary":{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/3555808"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2022,12,9]]},"references-count":34,"journal-issue":{"issue":"1","published-print":{"date-parts":[[2023,1,31]]}},"alternative-id":["10.1145\/3555808"],"URL":"https:\/\/doi.org\/10.1145\/3555808","relation":{},"ISSN":["1550-4832","1550-4840"],"issn-type":[{"value":"1550-4832","type":"print"},{"value":"1550-4840","type":"electronic"}],"subject":[],"published":{"date-parts":[[2022,12,9]]},"assertion":[{"value":"2021-12-24","order":0,"name":"received","label":"Received","group":{"name":"publication_history","label":"Publication History"}},{"value":"2022-07-25","order":1,"name":"accepted","label":"Accepted","group":{"name":"publication_history","label":"Publication History"}},{"value":"2022-12-09","order":2,"name":"published","label":"Published","group":{"name":"publication_history","label":"Publication History"}}]}}