CritiFlip: an efficient bit-flip attack based on critical weight identification

Abstract Recent studies have demonstrated that deep neural networks (DNNs) are highly vulnerable to bit-flip attacks (BFAs), where modifying only a few bits in memory can severely degrade model performance. However, existing BFA techniques typically rely on exhaustive searches over the entire parameter space and overemphasize single-bit flipping capability, leading to limited effectiveness in the presence of modern defenses. To address this challenge, we propose CritiFlip, an efficient BFA framework based on critical-weight identification. CritiFlip locates critical parameters through gradient computation and random perturbation, and performs targeted bit flips on them. By constraining the search to less than 0.1% of the total parameters, the framework greatly improves attack efficiency without compromising destructive power. Furthermore, we demonstrate that multi-bit flipping per iteration yields stronger degradation than single-bit strategies, especially when attacking defense-hardened models enhanced with weight reconstruction. Extensive experiments on multiple architectures and datasets confirm that CritiFlip maintains high attack potency with drastically reduced computation, even against hardened quantized models. These results indicate that exploiting non-uniform parameter sensitivity can provide a practical and effective avenue for evaluating and strengthening DNN robustness at the hardware level.