Researchers at Northeastern University have published ROBBIN: Rowhammer-Based Backdoor Injection during Inference, a method that uses Rowhammer-induced bit flips to manipulate trained neural network models while they are being used for inference. The attack is not built as a hardware-agnostic payload first and then adapted afterward. Instead, the DRAM1. dynamic random access memoryMemory technology or system for temporarily or permanently storing digital information.2. dynamic random-access memoryDRAM is a volatile memory technology behavior itself is folded into the design of the backdoor.
ROBBIN begins by characterizing the bit-flip patterns of a specific target DRAM1. dynamic random access memoryMemory technology or system for temporarily or permanently storing digital information.2. dynamic random-access memoryDRAM is a volatile memory technology. That device-level information is then used to iteratively choose DRAM1. dynamic random access memoryMemory technology or system for temporarily or permanently storing digital information.2. dynamic random-access memoryDRAM is a volatile memory technology page mappings for the model weights. The goal is to maximize the attack success rate while preserving task accuracy under Rowhammering. In other words, the placement of weights in memory is selected with the expected hammering effects in mind, rather than treating those flips as random collateral damage.
The paper frames each hammering-induced bit flip as a planned element of the attack construction. By incorporating the memory’s vulnerability profile directly into the backdoor design, ROBBIN aims to produce attacks that remain effective across devices instead of depending on a single assumed error pattern.
The work underscores that Rowhammer is no longer only a reliability concern for DRAM1. dynamic random access memoryMemory technology or system for temporarily or permanently storing digital information.2. dynamic random-access memoryDRAM is a volatile memory technology cells. In this case, the same fault mechanism is used to alter the behavior of a deployed model during inference, making memory integrity part of the model-security problem.