  Bit-flip attacks (BFAs) have attracted substantial attention recently, in
which an adversary could tamper with a small number of model parameter bits to
break the integrity of DNNs. To mitigate such threats, a batch of defense
methods are proposed, focusing on the untargeted scenarios. Unfortunately, they
either require extra trustworthy applications or make models more vulnerable to
targeted BFAs. Countermeasures against targeted BFAs, stealthier and more
purposeful by nature, are far from well established.
  In this work, we propose Aegis, a novel defense method to mitigate targeted
BFAs. The core observation is that existing targeted attacks focus on flipping
critical bits in certain important layers. Thus, we design a dynamic-exit
mechanism to attach extra internal classifiers (ICs) to hidden layers. This
mechanism enables input samples to early-exit from different layers, which
effectively upsets the adversary's attack plans. Moreover, the dynamic-exit
mechanism randomly selects ICs for predictions during each inference to
significantly increase the attack cost for the adaptive attacks where all
defense mechanisms are transparent to the adversary. We further propose a
robustness training strategy to adapt ICs to the attack scenarios by simulating
BFAs during the IC training phase, to increase model robustness. Extensive
evaluations over four well-known datasets and two popular DNN structures reveal
that Aegis could effectively mitigate different state-of-the-art targeted
attacks, reducing attack success rate by 5-10$\times$, significantly
outperforming existing defense methods.
