GenBFA: An Evolutionary Optimization Approach to Bit-Flip Attacks on LLMs

2024-11-21

AI Summary

This work reveals a previously underestimated, severe vulnerability of large language models (LLMs) to bit-flip attacks (BFAs) at the hardware level, challenging the prevailing assumption of inherent robustness in Transformer architectures. We empirically demonstrate that as few as three precisely targeted bit flips can reduce the MMLU accuracy of LLaMA3-8B-W8 to zero and inflate its Wikitext perplexity to 4.72×10⁵. To address the challenge of identifying critical bits within vast parameter spaces, we propose AttentionBreaker—a novel framework integrating attention-sensitivity analysis, bit-level manipulation in quantized models, and Rowhammer-inspired fault modeling—alongside GenBFA, an evolutionary optimization algorithm for efficient, fine-grained search of vulnerable bits. Our approach enables scalable, hardware-aware vulnerability assessment. The results establish a new paradigm for evaluating and defending LLMs against low-level hardware threats, with implications for secure deployment in safety-critical systems.

Technology Category

• Machine Learning: Large Multimodal Models (LMMs)
• Natural Language Processing: (Large) Language Models
• Computer Vision: Adversarial Attacks & Robustness

Application Category

• Search and Retrieval-Augmented AI: Search Tool Learning with LLM: Teaching LLMs to invoke search and make use of retrieved information
• User Modeling, Personalization and Recommendation: Attacks and countermeasures in recommendation systems
• Security and Privacy: Large-scale security measurements

Abstract

Large Language Models (LLMs) have revolutionized natural language processing (NLP), excelling in tasks like text generation and summarization. However, their increasing adoption in mission-critical applications raises concerns about hardware-based threats, particularly bit-flip attacks (BFAs). BFAs, enabled by fault injection methods such as Rowhammer, target model parameters in memory, compromising both integrity and performance. Identifying critical parameters for BFAs in the vast parameter space of LLMs poses significant challenges. While prior research suggests transformer-based architectures are inherently more robust to BFAs compared to traditional deep neural networks, we challenge this assumption. For the first time, we demonstrate that as few as three bit-flips can cause catastrophic performance degradation in an LLM with billions of parameters. Current BFA techniques are inadequate for exploiting this vulnerability due to the difficulty of efficiently identifying critical parameters within the immense parameter space. To address this, we propose AttentionBreaker, a novel framework tailored for LLMs that enables efficient traversal of the parameter space to identify critical parameters. Additionally, we introduce GenBFA, an evolutionary optimization strategy designed to refine the search further, isolating the most critical bits for an efficient and effective attack. Empirical results reveal the profound vulnerability of LLMs to AttentionBreaker. For example, merely three bit-flips (4.129 x 10^-9% of total parameters) in the LLaMA3-8B-Instruct 8-bit quantized (W8) model result in a complete performance collapse: accuracy on MMLU tasks drops from 67.3% to 0%, and Wikitext perplexity skyrockets from 12.6 to 4.72 x 10^5. These findings underscore the effectiveness of AttentionBreaker in uncovering and exploiting critical vulnerabilities within LLM architectures.

Problem

• Bit-flip attacks on LLMs
• Identifying critical parameters efficiently
• Evolutionary optimization for effective attacks

Innovation

• Evolutionary optimization for bit-flip attacks
• AttentionBreaker framework for parameter traversal
• Identifying critical bits in LLMs efficiently