# RADAR: Run-time Adversarial Weight Attack Detection and Accuracy Recovery

Source: [RADAR: Run-time Adversarial Weight Attack Detection and Accuracy Recovery](<https://www.sota2.com/research/paper/68fa6bf21e209131cea31162>)

Collection index: [llms.txt](<https://www.sota2.com/research/llms.txt>)

Data updated: 2025-10-25T23:59:56.170Z

Authors: Jingtao Li, Adnan Siraj Rakin, Zhezhi He, Deliang Fan, Chaitali Chakrabarti

Published: 2021-01-20T18:55:51.000Z

## Abstract

Adversarial attacks on Neural Network weights, such as the progressive bit-flip attack (PBFA), can cause a catastrophic degradation in accuracy by flipping a very small number of bits. Furthermore, PBFA can be conducted at run time on the weights stored in DRAM main memory. In this work, we propose RADAR, a Run-time adversarial weight Attack Detection and Accuracy Recovery scheme to protect DNN weights against PBFA. We organize weights that are interspersed in a layer into groups and employ a checksum-based algorithm on weights to derive a 2-bit signature for each group. At run time, the 2-bit signature is computed and compared with the securely stored golden signature to detect the bit-flip attacks in a group. After successful detection, we zero out all the weights in a group to mitigate the accuracy drop caused by malicious bit-flips. The proposed scheme is embedded in the inference computation stage. For the ResNet-18 ImageNet model, our method can detect 9.6 bit-flips out of 10 on average. For this model, the proposed accuracy recovery scheme can restore the accuracy from below 1% caused by 10 bit flips to above 69%. The proposed method has extremely low time and storage overhead. System-level simulation on gem5 shows that RADAR only adds \<1% to the inference time, making this scheme highly suitable for run-time attack detection and mitigation.

## Recorded benchmark results

A research result applies to its stated dataset, split, metric and evaluation configuration. Compare like-for-like settings, preserve the metric's unit and direction, and distinguish paper-reported results from independent reproduction. The best result recorded here is not a claim of exhaustive, current global coverage.

- [White-box robustness against single point failure attacks on WikiText-2](<https://www.sota2.com/research/sota/white-box-robustness-against-single-point-failure-attacks-on-wikitext-2.md>): White-box robustness against single point failure attacks; WikiText-2; Original Perplexity (PPL): 5.03.

- [LLM Inference on OPT-125M](<https://www.sota2.com/research/sota/llm-inference-on-opt-125m.md>): LLM Inference; OPT-125M; Latency (ms): 76.2.

- [Inference Efficiency Metrics on Qwen2.5 0.5B](<https://www.sota2.com/research/sota/inference-efficiency-metrics-on-qwen2-5-0-5b.md>): LLM Inference; Qwen2.5 0.5B; Latency (ms): 238.37.

- [LLM Inference on LLaMA2 7B](<https://www.sota2.com/research/sota/llm-inference-on-llama2-7b.md>): LLM Inference; LLaMA2-7B; TTFT (ms): not recorded.

## Original sources and implementation

[Original paper](<https://arxiv.org/abs/2101.08254>)

[PDF](<https://arxiv.org/pdf/2101.08254.pdf>)