Academic Journal of Computing & Information Science, 2026, 9(6); doi: 10.25236/AJCIS.2026.090605.
Yiqing Wang1, Jianqiang Mei1, Fan Jia2, Weixiang Du3
1School of Electronic Engineering, Tianjin University of Technology and Education, Tianjin, China
2Raysov Instrument Co. Ltd., Dandong, China
3Gansu Province Special Equipment Inspection & Testing Research Institute, Lanzhou, Gansu, China
Quantized neural networks (QNNs) are widely deployed on edge devices because of their high computational efficiency and low memory footprint. However, they remain vulnerable to hardware-level bit-flip attacks that can severely degrade model performance. Existing progressive bit-flip attack (PBFA) typically performs iterative searches across all network layers, resulting in substantial computational overhead and long attack time. To address this issue, we propose KS-BFA, a key-layer selection based bit-flip attack framework for quantized neural networks. The proposed method first evaluates the sensitivity of each layer and selects only the most vulnerable layers as attack targets, thereby avoiding exhaustive traversal across the entire network. Bit-flip attacks are then conducted only within these selected key layers, significantly reducing the search space and improving attack efficiency. Extensive experiments on CIFAR-10 and ImageNet demonstrate that KS-BFA can effectively degrade a variety of quantized models with only a small number of bit flips. For example, on ResNet-50, flipping about 22 bits reduces the model accuracy from 75.84% to 0.16%. Compared with PBFA, KS-BFA significantly reduces attack time while maintaining competitive destructive capability. In particular, on ResNet-50, the attack time decreases from 1330.83s to 1039.28s, corresponding to an efficiency improvement of approximately 22%. These results demonstrate that restricting bit-flip attacks to a small number of sensitive layers provides an efficient and scalable strategy for evaluating the vulnerability of quantized neural networks against hardware-aware bit-level attacks.
Bit-Flip Attack, Key-Layer Selection, Quantized Neural Networks, Model Security, Attack Efficiency
Yiqing Wang, Jianqiang Mei, Fan Jia, Weixiang Du. A Key-Layer Selection-Based Bit-Flip Attack for Efficient Degradation of Quantized Neural Networks. Academic Journal of Computing & Information Science (2026), Vol. 9, Issue 6: 29-36. https://doi.org/10.25236/AJCIS.2026.090605.
[1] Djeddou M, Dallal J A, Hellal A, et al. Particle Swarm Optimization-Based Deep Neural Network vs Whale Optimization Algorithm-Based Deep Convolutional Neural Networks for Critical Heat Flux Prediction[C]//2024 International Conference on Decision Aid Sciences and Applications (DASA). Manama, Bahrain, 2024: 1-5.
[2] Cheng K, Zhou Y, Chen B, et al. Guardauto: A Decentralized Runtime Protection System for Autonomous Driving[J]. IEEE Transactions on Computers, 2021, 70(10): 1569-1581.
[3] Singh D, Verma S, Singla J. A Comprehensive Review of Intelligent Medical Diagnostic Systems[C]//2020 4th International Conference on Trends in Electronics and Informatics (ICOEI). Tirunelveli, India, 2020: 977-981.
[4] Lv Z, Chen D, Cao B, et al. Secure Deep Learning in Defense in Deep-Learning-as-a-Service Computing Systems in Digital Twins[J]. IEEE Transactions on Computers, 2024, 73(3): 656-668.
[5] Lumoindong C W D, Mandala R. Binarized and Full-Precision 3D-CNN in Action Recognition[C]//2022 14th International Conference on Information Technology and Electrical Engineering (ICITEE). Yogyakarta, Indonesia, 2022: 241-246.
[6] Benbraika M K, Bourekkache S, Kraa O, et al. Mobile Edge Computing Discovery for Device-to-Device Communication in 5G[C]//2024 8th International Conference on Image and Signal Processing and their Applications (ISPA). Biskra, Algeria, 2024: 1-5.
[7] Islas-Estrada L R, Flores-Hernández D A. Embedded Energy Monitoring System for Solar Applications[J]. IEEE Embedded Systems Letters, 2025, 17(6): 386-389.
[8] Surapally S K, Yang X, Harman T L, et al. Evaluating FPGA Acceleration on Binarized Neural Networks and Quantized Neural Networks[C]//2022 International Symposium on Measurement and Control in Robotics (ISMCR). Houston, TX, USA, 2022: 1-5.
[9] Hector K, Moëllic P A, Dumont M, et al. A Closer Look at Evaluating the Bit-Flip Attack Against Deep Neural Networks[C]//2022 IEEE 28th International Symposium on On-Line Testing and Robust System Design (IOLTS). Torino, Italy, 2022: 1-5.
[10] Zhang Z, et al. Implicit Hammer: Cross-Privilege-Boundary Rowhammer Through Implicit Accesses[J]. IEEE Transactions on Dependable and Secure Computing, 2023, 20(5): 3716-3733.
[11] Rakin A S, He Z, Fan D. Bit-Flip Attack: Crushing Neural Network With Progressive Bit Search[C]//2019 IEEE/CVF International Conference on Computer Vision (ICCV). Seoul, Korea (South), 2019: 1211-1220.
[12] Irfan M M, Ali S, Yaqoob I, et al. Towards Deep Learning: A Review On Adversarial Attacks[C]//2021 International Conference on Artificial Intelligence (ICAI). Islamabad, Pakistan, 2021: 91-96.
[13] Delattre B. On the Stability of Neural Networks in Deep Learning[J/OL]. arXiv preprint, 2025.
[14] Wu D, Xia S-T, Wang Y. Adversarial Weight Perturbation Helps Robust Generalization[C]//Advances in Neural Information Processing Systems. Curran Associates, Inc., 2020: 2958-2969.
[15] Bai J, Wu B, Zhang Y, et al. Targeted Attack against Deep Neural Networks via Flipping Limited Weight Bits[J/OL]. arXiv preprint, 2021.
[16] Abomakhelb A, Jalil K A, Buja A G, et al. A Comprehensive Review of Adversarial Attacks and Defense Strategies in Deep Neural Networks[J]. Technologies, 2025, 13(5): 202.
[17] Cheng Q, Ming Z, Yuanping N, et al. A Survey of Bit-Flip Attacks on Deep Neural Network and Corresponding Defense Methods[J]. Electronics, 2023, 12(4): 853.