Modulation and Demodulation: A Defense Method Against Weight Bit-Flip Attacks in Floating Point CNN Hardware Accelerators

A Convolutional Neural Network (CNN) is a highly utilized deep learning model in various domains, including computer vision and natural language processing. Disruption of the network structure of CNN might cause significant losses. One often-used and effective attack method is the bit-flip attack. This approach affects the prediction accuracy of CNN models through carefully manipulating bits, and in certain cases, it can entirely disrupt the model’s ability to make accurate predictions, resulting in random guessing. In this work, we propose a defense strategy to counter bit-flip attacks, aiming to improve prediction accuracy in the occurrence of such attacks. This work involves the implementation of Lenet-5 and Lenet-3D on FPGA devices, along with the addition of proposed modulator and demodulator to these two CNN models. The results demonstrate that the prediction accuracy of the CNN structure is effectively improved when the proposed modulator and demodulator are incorporated, even when subjected to the same bit-flip attack injection rate. By flipping 200 bits per layer, our method can significantly enhance the accuracy of the MNIST dataset from 19% to over 90%. Similarly, the accuracy of the CIFAR-10 dataset can be increased from 12% to 52%. Furthermore, in terms of hardware resource consumption, the proposed security unit comprises less than 3% of the overall system.