  Security of machine learning is increasingly becoming a major concern due to
the ubiquitous deployment of deep learning in many security-sensitive domains.
Many prior studies have shown external attacks such as adversarial examples
that tamper with the integrity of DNNs using maliciously crafted inputs.
However, the security implication of internal threats (i.e., hardware
vulnerability) to DNN models has not yet been well understood. In this paper,
we demonstrate the first hardware-based attack on quantized deep neural
networks-DeepHammer-that deterministically induces bit flips in model weights
to compromise DNN inference by exploiting the rowhammer vulnerability.
DeepHammer performs aggressive bit search in the DNN model to identify the most
vulnerable weight bits that are flippable under system constraints. To trigger
deterministic bit flips across multiple pages within reasonable amount of time,
we develop novel system-level techniques that enable fast deployment of victim
pages, memory-efficient rowhammering and precise flipping of targeted bits.
DeepHammer can deliberately degrade the inference accuracy of the victim DNN
system to a level that is only as good as random guess, thus completely
depleting the intelligence of targeted DNN systems. We systematically
demonstrate our attacks on real systems against 12 DNN architectures with 4
different datasets and different application domains. Our evaluation shows that
DeepHammer is able to successfully tamper DNN inference behavior at run-time
within a few minutes. We further discuss several mitigation techniques from
both algorithm and system levels to protect DNNs against such attacks. Our work
highlights the need to incorporate security mechanisms in future deep learning
system to enhance the robustness of DNN against hardware-based deterministic
fault injections.
