Northeastern University researchers demonstrate hardware-aware Rowhammer backdoor injection achieving 90% success rate
Bot Mutiny |
Researchers at Northeastern University have developed ROBBIN, a method that uses device-specific DRAM bit-flip patterns to inject functional backdoors into deep neural networks during inference.
Researchers Saion K. Roy, Yufei Wang, Aidong A. Ding, and Yunsi Fei at Northeastern University have documented a new method for injecting backdoors into deep neural networks by exploiting specific hardware vulnerabilities in DRAM. The attack, titled ROBBIN, was detailed in a paper first reported by arXiv on August 24, 2026. The research focuses on the Rowhammer vulnerability, a fault-injection mechanism that allows software to induce bit-flips in memory hardware without physical access to the chip. Unlike previous attacks that designed backdoors at an algorithmic level, ROBBIN incorporates the unique, device-specific bit-flip patterns of a target DRAM chip into the attack design. ## Hardware-Specific Exploitation
Traditional Rowhammer attacks often fail because they assume an attacker can flip any bit at any location. In reality, vulnerable cells are sparsely distributed. Only about 0.05% of cells typically exhibit Rowhammer vulnerability. When an attacker hammers a specific row, collateral bit-flips often occur in unintended locations. In FP32 representations, a single unintended flip in a sign or exponent bit can change a model weight by orders of magnitude. This usually destroys the model's accuracy or causes the backdoor to fail. ROBBIN solves this by profiling the target DRAM first. It identifies stable, reproducible bit-flip patterns for a specific chip. The researchers then use this profile to decide how to map model weights to DRAM pages. By treating collateral flips as part of the design rather than side effects, the attack remains functional across different hardware. ## Performance and Reliability
The Northeastern team tested the ROBBIN attack on ResNet-20 and VGG-16 models using the CIFAR-10 dataset. The experiments were conducted across three different commodity DDR4 chips. The results showed consistent performance despite the physical differences between the chips. ROBBIN achieved a backdoor attack success rate (ASR) of nearly 90%. While the attack successfully triggered misclassifications on specific inputs, such as identifying a car as a bird, it maintained a test accuracy (TA) for normal inputs above 83%. This is a significant shift from prior methods like TBT or ProFlip. Those attacks required 84 and 12 arbitrary bit-flips respectively, which are difficult to achieve on physical hardware where bit-flips are restricted by the manufacturing process. ## Bypassing Software Defenses
Because ROBBIN operates during inference time, it happens after the model has been deployed. This allows the attack to evade common training-time defenses like data sanitization or model inspection. The attack targets Deep Neural Networks (DNNs) used in high-stakes environments. The researchers noted that these systems are now integral to biometric authentication, medical diagnosis, and military systems. ROBBIN demonstrates that even if a model is trained on clean data, its integrity depends entirely on the reliability of the underlying volatile memory. The methodology requires two stages. First, the attacker characterizes the bit-flip patterns of the target DRAM. Second, the attack iteratively selects page mappings for model weights to maximize the trigger success rate while preserving the model's original performance on clean data. This hardware-aware approach ensures the backdoor is robust to the specific physical behavior of the individual device.
References
(2026). ROBBIN: Rowhammer-Based Backdoor Injection during Inference. arxiv.org. https://doi.org/10.1109/cvpr52733.2024.02343