标题： 位翻转故障攻击：通过渐进位搜索破坏图神经网络 显示英文标题

标题： Bit-Flip Fault Attack: Crushing Graph Neural Networks via Gradual Bit Search

摘要： 图神经网络（GNNs）已成为处理图结构数据的强大机器学习方法。 大量硬件加速器已被引入以满足实际应用中GNN的性能需求。 然而，基于硬件的攻击的安全挑战通常被忽视。 在本文中，我们研究了GNN模型对基于硬件的故障攻击的脆弱性，其中攻击者试图通过在存储设备中注入故障来修改训练后的权重参数，从而导致输出错误分类。 因此，我们提出了渐进式位翻转故障攻击（GBFA），这是一种层感知的位翻转故障攻击，逐步选择每个选定权重中的易受攻击位，通过翻转最少数量的位来破坏GNN的性能。 为了实现这一点，GBFA分为两个步骤。 首先，创建一个马尔可夫模型，根据从内存访问模式中提取的特征预测层的执行顺序，从而在特定层内发起攻击。 随后，GBFA通过层内搜索使用梯度排序来识别选定权重中的易受攻击位。 我们使用Cora和PubMed数据集在各种GNN模型上评估了所提出的GBFA攻击的有效性。 我们的研究结果表明， GBFA显著降低了预测准确性，其在不同层之间的影响力变化突显了在GNN中采用层感知攻击策略的重要性。 例如，在Cora数据集上，GBFA仅在最后一层进行一次位翻转，就使GraphSAGE的预测准确性下降了17%。 显示英文摘要

摘要： Graph Neural Networks (GNNs) have emerged as a powerful machine learning method for graph-structured data. A plethora of hardware accelerators has been introduced to meet the performance demands of GNNs in real-world applications. However, security challenges of hardware-based attacks have been generally overlooked. In this paper, we investigate the vulnerability of GNN models to hardware-based fault attack, wherein an attacker attempts to misclassify output by modifying trained weight parameters through fault injection in a memory device. Thus, we propose Gradual Bit-Flip Fault Attack (GBFA), a layer-aware bit-flip fault attack, selecting a vulnerable bit in each selected weight gradually to compromise the GNN's performance by flipping a minimal number of bits. To achieve this, GBFA operates in two steps. First, a Markov model is created to predict the execution sequence of layers based on features extracted from memory access patterns, enabling the launch of the attack within a specific layer. Subsequently, GBFA identifies vulnerable bits within the selected weights using gradient ranking through an in-layer search. We evaluate the effectiveness of the proposed GBFA attack on various GNN models for node classification tasks using the Cora and PubMed datasets. Our findings show that GBFA significantly degrades prediction accuracy, and the variation in its impact across different layers highlights the importance of adopting a layer-aware attack strategy in GNNs. For example, GBFA degrades GraphSAGE's prediction accuracy by 17% on the Cora dataset with only a single bit flip in the last layer.