Maximal Brain Damage Without Data or Optimization: Disrupting Neural Networks via Sign-Bit Flips

🎯 Pitch

Flipping just two sign bits in a ResNet-50 destroys 99.8% of its ImageNet accuracy, and the same attack collapses a 30B-parameter reasoning language model from 78% to 0% on MATH-500—all without any data or gradient optimization. The method simply targets high-magnitude weights in early layers, exposing a brittle and universal vulnerability in modern neural networks.

1. Executive Summary

This paper introduces Deep Neural Lesion (DNL), a data-free and optimization-free method for catastrophically disrupting deep neural networks by flipping only a handful of carefully chosen parameter sign bits. The authors evaluate DNL and its enhanced single-pass variant, 1P-DNL, across image classification (48 ImageNet models), object detection and instance segmentation (Mask R-CNN, YOLOv8-seg on COCO), and reasoning large language models (Qwen3-30B-A3B, Qwen3-4B, Nemotron Nano 8B on MATH-500), demonstrating that heuristically targeting high-magnitude weights in early layers—with a one-flip-per-kernel constraint for convolutional architectures—collapses accuracy with as few as one or two bit flips (ResNet-50 on ImageNet drops 99.8% after two sign flips; Qwen3-30B-A3B falls from 78% to 0% after two sign flips into different experts). The work establishes that this vulnerability spans fundamentally different model architectures and tasks, yet the attack's efficacy depends critically on which bits are targeted: random sign flips—even up to 100,000—produce negligible degradation, establishing that only a tiny fraction of parameters are genuinely critical.

2. Context and Motivation

The Core Problem: How Much Access Does an Attacker Need to Break a Neural Network?

The fundamental question this paper tackles is deceptively simple: if an attacker gains write access to a trained neural network's stored parameters but has no access to training data or the ability to run inference, how much damage can they inflict? The answer, as the paper demonstrates, is disturbingly little—sometimes a single carefully chosen bit flip is sufficient to destroy a model's functionality across fundamentally different domains, from image classification to object detection to mathematical reasoning in large language models.

This question matters because it exposes an asymmetry between attack cost and defensive difficulty in deployed AI systems. Modern deep neural networks contain millions to billions of parameters stored in memory as floating-point numbers. Each 32-bit float contains one sign bit, eight exponent bits, and 23 mantissa bits. The sign bit—a single binary value determining whether a weight is positive or negative—is the most significant bit (MSB) in the IEEE 754 representation. The paper shows that flipping this one bit for a small number of weights can be catastrophic, while the attacker needs essentially zero computational resources beyond the ability to read and write to memory.

Why This Problem Matters: The Deployment Reality

The practical significance of this vulnerability becomes clear when considering the attack surface of deployed models. The paper identifies several realistic mechanisms through which an attacker can gain the necessary write access (Section 2):

Rootkit-based attacks: Malicious software with kernel-level privileges can scan memory or storage for parameter files and surgically flip bits in place, concealing its processes through API hooking to evade detection.
Firmware compromises: Exploiting bugs in SSD/HDD controllers, GPU firmware, or BIOS can grant privileged memory access, allowing precise manipulation of parameter bits through custom injected commands.
DMA from untrustworthy peripherals: Devices connected via Thunderbolt or FireWire interfaces can read and write system memory without involving the CPU or operating system access controls, directly overwriting targeted bits.
Rowhammer attacks: By rapidly accessing ("hammering") one row of DRAM, an attacker can cause bits in physically adjacent rows to flip due to electrical interference, even without direct write permissions to those addresses.
GPU cache tampering: Compromised kernel drivers or malicious GPU code can manipulate cache management to induce bit flips in stored parameters, exploiting the fact that GPU caches are often less scrutinized than CPU caches.
Voltage/frequency glitching: Manipulating operating voltage or clock frequencies can systematically cause specific bits to flip in registers or memory segments.

The critical insight is that these hardware-level attack vectors are capable of flipping individual bits at specific memory offsets, but not of performing massive coordinated corruption. Rowhammer, for instance, typically induces only sporadic bit upsets in adjacent cells. This means an attacker who can leverage such mechanisms needs a strategy that achieves maximum damage with minimal flips—exactly the regime the paper explores with $k \leq 10$ flips.

Consider the implications for safety-critical systems. An autonomous vehicle's perception model, deployed on an edge device with limited physical security, could have its parameters corrupted through a firmware exploit or DMA attack during a maintenance window. Unlike traditional adversarial examples (Madry et al., 2018; Goodfellow et al., 2015), which require continuous real-time manipulation of input pixels and intensive gradient calculations, a parameter-space attack modifies the model once and the corruption persists across all subsequent inputs. Physical adversarial attacks—such as stickers on street signs (Wei et al., 2022)—require direct environmental access and are vulnerable to countermeasures like redundant sensors. Parameter-space attacks bypass all such input-level defenses because they corrupt the model's fundamental computation, not its inputs.

The Prior Landscape: Data-Dependent, Optimization-Heavy Attacks

Existing weight-space attacks fall into a fundamentally different threat model than the one DNL operates under. The paper contrasts its approach against three representative prior methods (Section 5, Table 4):

Bit-Flip Attack (BFA) (Rakin et al., 2019). BFA performs iterative gradient-based search to identify which bits to flip. For each candidate flip, it requires computing gradients on multiple validation images, performing forward and backward passes through the model, and scoring the impact of each candidate bit. The complexity scales as $O(k \times B \times \theta \times m)$ , where $k$ is the number of flipped bits, $B$ is the number of candidate bits evaluated per iteration, $\theta$ is the parameter count, and $m$ is the batch size. On VGG-11, BFA requires 17 bit flips to achieve 99.7% accuracy reduction; on ResNet-50, 5 flips reach 99.7%. Critically, BFA requires access to training or validation data to compute meaningful gradients—a requirement that may be infeasible in many attack scenarios where the attacker gains access to stored weights but not the proprietary dataset used to train them.

DeepHammer (Yao et al., 2020). This method performs a chain-based iterative search, where each successive flip is chosen to compound the damage of previous flips. Like BFA, it requires multiple forward/backward passes and data access. On ResNet-50, DeepHammer requires 23 flips (best of 5 trials) to achieve 75.4% accuracy reduction—substantially more flips than DNL achieves comparable damage with, and still leaving 24.6% accuracy intact. The per-flip cost similarly scales as $O(k \times B \times \theta \times m)$ .

ZeBRA (Park et al., 2021). ZeBRA partially relaxes the data requirement by generating synthetic data from the victim model itself rather than using real training samples. However, it still performs an optimization loop: it generates pseudo-samples, runs forward/backward passes to compute gradients, and iteratively selects bits. The complexity remains $O(k \times B \times \theta \times m)$ . On ViT-B/16@224, ZeBRA achieves only 45.8% accuracy reduction after 10 flips, demonstrating that even with optimization, prior methods struggled on transformer architectures.

Terminal Brain Damage (TBD) (Hong et al., 2019). An early work illustrating that manipulating exponent bits can severely harm floating-point networks. However, TBD explicitly excludes sign bits from consideration, focusing instead on exponent manipulation. The paper shows that in vision models, sign-bit flips are often more destructive than exponent flips at low flip budgets (Appendix C, Table 8).

Where Prior Approaches Fall Short: Three Critical Gaps

1. The data dependency bottleneck. All prior methods require either real training/validation data (BFA, DeepHammer) or the ability to generate synthetic data from the model (ZeBRA). In many realistic attack scenarios, the attacker gains memory access through a hardware exploit but has no knowledge of what the model was trained on. A rootkit running on an autonomous vehicle's computer can read parameter files from disk, but cannot access the proprietary training dataset used by the manufacturer. This data requirement fundamentally limits the practicality of existing attacks.

2. The optimization cost creates a stealth-vs-impact tradeoff. Running dozens or hundreds of forward/backward passes through the victim model not only requires computational resources on the compromised device but also generates suspicious activity patterns. Repeated inference calls, especially when the model is not otherwise in use, could trigger monitoring alerts or anomaly detection. The paper explicitly frames this as a stealth concern: "the lack of an identifiable source makes it difficult to attribute the degradation or take effective countermeasures" (Section 2). A lightweight, pass-free attack that reads weights once and writes a few bits leaves a minimal footprint.

3. No systematic understanding of which parameters are critical. Prior work treats bit selection as an optimization problem to be solved through gradient-guided search, but does not characterize why certain parameters cause disproportionate damage when flipped. This gap means:

There is no principled way to predict vulnerability without running the expensive optimization.
Defenders have no guidance on which parameters to protect.
The transferability of the vulnerability across architectures and domains is unknown.

The paper's experiments with random flips (Figure 2a) reveal a striking fact: for many architectures, flipping 100,000 random sign bits produces negligible accuracy reduction. This means that effective attacks require identifying the tiny subset of critical parameters—exactly what prior methods attempt to do through expensive optimization, but without understanding the underlying structure.

Conflicting or Unexplored Territory: Sign Bits vs. Exponent Bits

The paper identifies an unresolved question in the prior literature: which bit type is most destructive? Prior work (TBD, BFA variants) focused primarily on exponent bits, which control the magnitude scale of weights. Flipping an exponent bit can multiply a weight by a factor of $2^{\pm 2^i}$ , causing extreme rescaling. The paper shows that the answer is domain-dependent:

In vision models, sign-bit flips are typically more destructive at low flip budgets (Appendix C, Table 8). For example, VGG-11 shows AR(10) = 91.8% for sign flips vs. 53.9% for exponent flips; ViT-B/16 shows AR(10) = 99.8% for sign vs. 82.4% for exponent. Sign flips change a weight from $\theta_i$ to $-\theta_i$ , producing a perturbation $\Delta\theta_i = -2\theta_i$ . For high-magnitude weights, this is a massive change that can invert the function of learned feature detectors (as visualized in Figure 1 for an edge-detection kernel).
In language models, exponent-bit flips can be more destructive (Appendix C.1). A single targeted exponent flip reduces all three tested reasoning LLMs to 0% accuracy. The paper hypothesizes this is because exponent changes can induce extreme rescaling (potentially producing NaN or Inf values) that propagates through the autoregressive generation process.

This domain dependence is not merely a curiosity—it means that no prior method's bit-selection strategy can be assumed to transfer without empirical validation. An attacker targeting vision models should prioritize sign bits; an attacker targeting LLMs should consider exponent bits. The paper's systematic study across both domains provides this guidance for the first time.

How This Paper Positions Itself

The paper frames its contribution not as proposing yet another optimization-based attack, but rather as exposing a fundamental property of trained neural networks: the existence of a tiny set of parameters whose sign-bit inversion alone is sufficient to destroy model functionality, and the fact that these parameters can be identified through lightweight heuristics that require no data and no iterative computation.

This framing has several important implications:

It shifts the attacker's burden from computation to insight. The paper demonstrates that the principles for identifying critical parameters—high magnitude, early-layer placement, one-flip-per-kernel (for CNNs)—are architectural properties that can be exploited without any model evaluation. This is formalized through an analogy to the pruning literature: magnitude-based pruning (Frankle & Carbin, 2018) removes low-magnitude weights to minimize impact; DNL's magnitude-based attack flips the sign of high-magnitude weights to maximize impact. The connection is made explicit through a second-order Taylor expansion (Section 3):

$\Delta R \approx \frac{1}{2}(-2\theta_i)^2 H_{ii} = 2\theta_i^2 H_{ii}$

At convergence, where gradients are approximately zero, the damage from flipping $\theta_i$ scales with $\theta_i^2 H_{ii}$ . If $H_{ii}$ is approximately constant within a layer—a common empirical observation and useful local approximation—this reduces to selecting the largest $|\theta_i|$ , precisely the DNL criterion. The 1-Pass variant (1P-DNL) refines this by incorporating gradient information through a Gauss-Newton approximation: $H_{ii} \approx (\partial R / \partial \theta_i)^2$ , recovering the classical Taylor saliency $|\theta_i g_i|$ used in pruning.

It provides a unifying explanation for cross-domain vulnerability. The paper does not claim to have discovered a new vulnerability specific to one architecture or task. Rather, it shows that the same mechanism—sign-bit flipping of high-magnitude early-layer weights—causes collapse across CNNs, vision transformers, mixture-of-experts LLMs, and encoder-only text models. This universality suggests that the vulnerability is a consequence of how neural networks learn distributed representations where a few early features carry disproportionate influence, not an implementation artifact of particular architectures.

It enables principled defense through selective protection. Because DNL identifies which parameters are critical, it directly suggests a defense: protect only those parameters (through bit replication, error-correcting codes, or hardware memory protection) while leaving the vast majority unguarded. The paper demonstrates that protecting as little as 0.001% of parameters can halve the impact of iterative optimization-based attacks like BFA, and protecting 1% nullifies the attack entirely (Table 5). This is a substantially different defense philosophy than prior work's approach of protecting all parameters uniformly (e.g., encoding-based defenses like DeepNcode), which incur multiplicative memory and bandwidth overhead.

It establishes a new baseline for the threat model. By demonstrating that a pass-free, data-free attack can match or exceed the damage of optimization-based methods (Table 4: 1P-DNL collapses ResNet-50 by 99.4% with one sign flip vs. BFA's 99.7% with five flips), the paper effectively raises the bar for what constitutes a "realistic" threat. Any defense that assumes attackers will perform iterative gradient-based optimization is inadequate if a simple magnitude sort can achieve comparable destruction. Conversely, any future attack method that requires more computation than DNL must justify that additional cost against this strong, lightweight baseline.

The Pruning Connection: Why This Vulnerability Exists

A particularly insightful thread running through the paper is the explicit connection to the neural network pruning literature. The paper draws on several well-established pruning principles and inverts them for adversarial purposes:

Magnitude pruning (Frankle & Carbin, 2018; Han et al., 2015) removes weights with small absolute values because they contribute least to the network's output. DNL attacks weights with large absolute values for exactly the same reason— $\Delta R \propto \theta_i^2 H_{ii}$ in the quadratic approximation.
Optimal Brain Damage (LeCun et al., 1989) and Optimal Brain Surgeon (Hassibi et al., 1992) use second-order Taylor expansions to identify parameters whose removal minimizes loss increase. DNL uses the same expansion but to maximize the loss increase, effectively performing "adversarial brain damage."
Early-layer saliency (Liu et al., 2019; Frankle & Carbin, 2018): pruning literature has observed that early layers contain disproportionately important weights. DNL exploits this by restricting candidate flips to the first $L$ layers, finding empirically that $L = 10$ consistently outperforms targeting all layers.

This connection is more than a technical convenience—it provides a theoretical explanation for why the vulnerability exists and why it is so difficult to eliminate. Neural networks are fundamentally built on distributed representations where early-layer features propagate through the entire network. A corruption introduced at the first layer is processed by all subsequent layers; under a Lipschitz composition bound, the worst-case amplification is at most $\prod_{\ell > 1} L_\ell$ , where $L_\ell$ is the Lipschitz constant of layer $\ell$ . Early-layer targeting is effective because it exploits this amplification structure.

The paper's key insight is that the same property that makes neural networks powerful—the hierarchical composition of features from simple to complex—also makes them brittle in a highly localized way. You don't need to corrupt the entire network; corrupting the foundation topples the entire edifice.

3. Technical Approach

3.1 Reader Orientation

The Deep Neural Lesion (DNL) system is a set of lightweight heuristics that, given read/write access to a trained neural network's stored floating-point parameters, identifies a tiny set of weights whose sign bits—when flipped from 0 to 1 or 1 to 0—will catastrophically degrade the model's performance on its intended task, without requiring any training data, any iterative optimization, or any inference through the model. It solves the problem of maximally damaging a neural network with a minimal, hardware-achievable number of bit flips by exploiting an empirical regularity of trained networks: a small fraction of high-magnitude weights in early layers act as load-bearing pillars—flip their sign, and the entire distributed representation collapses.

3.2 Big-Picture Architecture (Diagram in Words)

The DNL attack pipeline consists of four logical stages, with the enhanced 1P-DNL variant inserting one additional computation between stages 2 and 3:

Layer scoping ( $\theta_L$ extraction): The attacker restricts the candidate parameter pool to the first $L$ layers of the model (typically $L = 10$ ). For each layer, all trainable weight tensors—convolutional kernels, linear projection matrices, normalization scales—are flattened into a single candidate list. Parameters in layers beyond $L$ are ignored entirely.
Score assignment (DNL) or Score refinement (1P-DNL): Each candidate parameter receives a scalar "criticality" score.
- DNL (pass-free): The score is simply the absolute value $S(\theta_i) = |\theta_i|$ , computed directly from the stored weights with zero additional computation beyond reading the parameter file.
- 1P-DNL (single-pass): The score is a hybrid $S(\theta_i) = |\theta_i| + |\theta_i g_i + \frac{1}{2}\theta_i^2 H_{ii}|$ , where $g_i$ and $H_{ii}$ are estimated from one forward and backward pass on a single random input (Gaussian noise for vision models, random token sequences for language models). This costs exactly one inference call.
Selection with constraints: The $k$ highest-scoring parameters are selected as flip targets. For convolutional architectures, an additional constraint is enforced: at most one parameter per convolutional kernel may be selected. If the top- $k$ list contains multiple parameters from the same kernel, the lower-scoring ones are skipped and replaced by the next-highest-scoring parameters from different kernels.
Sign-bit inversion: For each selected parameter $\theta_i$ , the most significant bit (the sign bit in IEEE 754 FP32) is toggled, producing $\theta_i \leftarrow -\theta_i$ . All other bits—exponent, mantissa—remain unchanged. The modified parameter file is written back, and the model is now silently corrupted.

Information flows linearly: read parameters → scope to early layers → score → rank → enforce per-kernel constraint → flip sign bits → write back. There is no feedback loop, no adaptive refinement, and no model evaluation between flip decisions.

3.3 Roadmap for the Deep Dive

First, the threat model formalization—what exact capabilities the attacker has and does not have, the bit-flip operation definition, and the adversarial objective—because every design choice in DNL flows from these constraints.
Second, why sign bits specifically—the IEEE 754 floating-point representation, why the sign bit is the MSB, what flipping it does to a weight's value, and why sign flips are both practically achievable (hardware attacks can target consistent bit offsets) and theoretically destructive (the perturbation $\Delta\theta_i = -2\theta_i$ is multiplicative, not additive).
Third, the magnitude-based scoring heuristic—the Taylor expansion derivation linking weight magnitude to loss perturbation, why this reduces to selecting the largest $|\theta_i|$ under a diagonal-Hessian approximation, and how this connects to the pruning literature's Optimal Brain Damage criterion inverted for adversarial purposes.
Fourth, the one-flip-per-kernel constraint—the empirical observation that multiple sign flips within the same convolutional kernel can partially cancel each other's damage, the analytical explanation via the kernel response perturbation $\Delta y = -2(w_i x_i + w_j x_j)$ , and why spreading flips across kernels maximizes aggregate disruption.
Fifth, the early-layer targeting heuristic—the empirical finding that restricting flips to the first $L$ layers consistently outperforms targeting all layers or late layers, the propagation intuition (errors introduced early compound through all subsequent layers), and the special case of architectures like ShuffleNetV2 where the largest-magnitude weights concentrate in later layers, making naive magnitude-based targeting less effective unless combined with early-layer scoping.
Sixth, the 1P-DNL enhancement—the hybrid importance score combining magnitude with second-order gradient information, the Gauss-Newton approximation for the Hessian diagonal, why a single random input suffices, and how this recovers classical Taylor saliency criteria from the pruning literature.
Seventh, the complete algorithms—DNL (Algorithm 1) and 1P-DNL (Algorithm 2) in operational detail, explaining what each loop does and why each step is ordered as it is.

3.4 Detailed, Sentence-Based Technical Breakdown

This is primarily an empirical analysis and attack methodology paper whose core idea is that the sign bits of a tiny number of large-magnitude early-layer parameters in trained neural networks are single points of catastrophic failure that can be located through lightweight, data-agnostic heuristics rather than expensive optimization.

The Threat Model: Attacker Capabilities and Constraints

The paper operates under a deliberately restrictive threat model that prior weight-space attacks do not satisfy (Section 2). The attacker's capabilities and limitations are:

Capabilities:

The attacker has write access to the stored parameters $\theta$ of a trained model $f_\theta$ . This means they can read the current values of all weights from memory or storage, modify specific bits, and write the modified values back.
The attacker can flip exactly $k$ distinct bits in the binary representation $\text{bits}(\theta) \in \{0, 1\}^B$ , where $B$ is the total number of memory bits encoding all entries of $\theta$ .

Limitations (the critical ones):

No access to training or validation data. The attacker has no samples from the data distribution $\mathcal{D}$ over which the model was trained, and thus no access to $P(X)$ or $P(Y)$ .
No ability to evaluate the model. The attacker cannot perform forward passes or backward passes through $f_\theta$ on any input—not on real data, not on synthetic data, not on random noise. Formally, for any input random variable $Z$ on the input space $\mathcal{X}$ , the attacker has no access to $f_\theta(Z)$ or to $P(f_\theta(Z))$ .
For the 1-Pass variant only, this is slightly relaxed: the attacker can observe $f_\theta(z)$ for a single random input $z$ and perform one forward pass and one backward pass. This is the sole difference between the pass-free and 1-pass threat models.

What "bit flip" means operationally. Let $\text{bits}(\theta) \in \{0, 1\}^B$ be the concatenation of all parameters' binary representations. A $k$ -bit flip attack chooses $k$ distinct bit indices $j_1, \ldots, j_k \in \{1, \ldots, B\}$ and produces modified parameters $\theta'_{(k)}$ where:

$\text{bits}(\theta'_{(k)})_j = \begin{cases} 1 - \text{bits}(\theta)_j, & \text{if } j \in \{j_1, \ldots, j_k\}, \\ \text{bits}(\theta)_j, & \text{otherwise.} \end{cases}$

What this computes: the $j$ -th bit in the modified parameter's binary encoding is the logical NOT of the original bit if $j$ is one of the $k$ targeted indices, and identical to the original bit otherwise. The operation is a bitwise toggle applied to exactly $k$ positions in the combined binary representation of all model weights.

Adversarial objective. The attacker's goal is formalized as a discrete optimization:

$\min_k \max \mathbb{E}_{(X,Y) \sim \mathcal{D}} \left[ \mathcal{L}\left(f_{\theta'_{(k)}}(X), Y\right) \right]$

What this computes: find the smallest number of bit flips $k$ and the specific set of $k$ bit indices such that, when those bits are toggled to produce corrupted parameters $\theta'_{(k)}$ , the expected loss of the model on its original data distribution is maximized. The outer minimization over $k$ captures the stealth constraint—fewer flips are better because they're harder to detect and more achievable through hardware attack vectors like Rowhammer.

Why this form: the nested min-max structure reflects the asymmetry of the attack scenario. The attacker wants maximum damage (inner max) with minimum flips (outer min). This is not a standard optimization problem because both the selection of $k$ (how many flips) and the selection of which $k$ indices (which bits) are discrete choices over an exponentially large space—for a model with millions of parameters encoded in FP32, $B$ is in the tens of millions, and $\binom{B}{k}$ is astronomical even for $k = 1$ .

Why Sign Bits: The IEEE 754 Representation and Flipping Consequences

The paper targets the sign bit specifically, rather than exponent or mantissa bits, based on both practical hardware considerations and the mathematical properties of sign inversion.

IEEE 754 FP32 structure. A 32-bit floating-point number encodes its value as:

$(-1)^s \times 2^{(e-127)} \times \left(1 + \frac{m}{2^{23}}\right)$

where $s \in \{0, 1\}$ is the 1-bit sign (0 for positive, 1 for negative), $e \in \{0, \ldots, 255\}$ is the 8-bit exponent with bias 127, and $m \in \{0, \ldots, 2^{23}-1\}$ is the 23-bit mantissa representing the fractional part.

What flipping the sign bit does: toggling $s$ from 0 to 1 (or 1 to 0) multiplies the entire value by $-1$ :

$\theta_i \longrightarrow -\theta_i$

The perturbation is therefore $\Delta\theta_i = -2\theta_i$ . This is a multiplicative perturbation, not an additive one—the magnitude of the change scales linearly with the magnitude of the parameter. Flipping a sign bit on a weight of $10^{-6}$ changes it by $2 \times 10^{-6}$ ; flipping it on a weight of $10^{+1}$ changes it by 20. The damage is concentrated on large-magnitude weights.

Why the sign bit is practically attackable. The sign bit is always the most significant bit (MSB) in the IEEE 754 representation, making it trivial to locate in memory—it is at a fixed offset within each 32-bit word. The paper notes that "various hardware-based studies show that repeated access patterns more reliably flip the same bit position across different addresses than arbitrarily chosen bits" (Section 3). This means that if an attacker can induce bit flips through Rowhammer or voltage glitching, targeting the MSB of each weight word is more feasible than targeting arbitrary bit positions that might differ across parameters.

Why sign flips are theoretically destructive for trained networks. Consider a trained weight that represents a learned feature. In a convolutional kernel, flipping its sign inverts the feature's response—an edge detector that previously fired on dark-to-light transitions now fires on light-to-dark transitions. As illustrated in Figure 1, this doesn't just add noise; it produces a systematically wrong but structurally coherent feature map that propagates misleading information through all subsequent layers. The corruption is semantic, not stochastic.

Comparison to exponent and mantissa flips. Flipping an exponent bit multiplies the weight by $2^{\pm 2^i}$ for some $i \in \{0, \ldots, 7\}$ , which can produce extreme values (NaN, Inf, or orders-of-magnitude rescaling). Flipping a mantissa bit produces a small additive change. The paper finds that the most destructive bit type is domain-dependent: sign flips are stronger in vision models at low budgets (Appendix C, Table 8), while exponent flips can be more destructive in language models (Appendix C.1). The paper focuses primarily on sign flips because they provide the "cleanest and usually strongest failure mode" in the vision models that motivate the main method section.

The Magnitude-Based Scoring Heuristic: Why $|\theta_i|$ Predicts Damage

The core insight enabling a data-free attack is that a weight's magnitude is a strong proxy for how much damage flipping its sign will cause, justified through a second-order Taylor expansion of the loss function.

The Taylor expansion derivation. For a trained network with parameters $\theta$ and empirical risk $R(\theta)$ , consider the change in loss when a single weight $\theta_i$ is perturbed by $\Delta\theta_i$ :

$\Delta R \approx g_i \Delta\theta_i + \frac{1}{2} H_{ii} (\Delta\theta_i)^2 + \sum_{j \neq i} H_{ij} \Delta\theta_i \Delta\theta_j$

where $g_i = \frac{\partial R}{\partial \theta_i}$ is the gradient, $H_{ii} = \frac{\partial^2 R}{\partial \theta_i^2}$ is the diagonal Hessian element, and $H_{ij}$ are the off-diagonal Hessian elements capturing inter-weight coupling.

What each term captures: The first term $g_i \Delta\theta_i$ is the first-order (linear) approximation—the loss change if the loss surface were flat. The second term $\frac{1}{2} H_{ii} (\Delta\theta_i)^2$ is the second-order (curvature) correction—how much the loss change accelerates because the loss surface is curved. The sum over $j \neq i$ captures interactions between weights—how much changing $\theta_i$ affects the optimality of other weights.

Applying the approximation at convergence. At a trained optimum, the gradient is approximately zero: $g_i \approx 0$ . This eliminates the first-order term. For a sign flip, the perturbation is $\Delta\theta_i = -2\theta_i$ . Substituting:

$\Delta R_i \approx \frac{1}{2} H_{ii} (-2\theta_i)^2 = 2 \theta_i^2 H_{ii}$

What this computes: the expected increase in loss from flipping the sign of $\theta_i$ is proportional to the product of the squared weight magnitude and the local curvature. A weight of magnitude 0.1 contributes $0.01 \times 2H_{ii}$ to the loss increase; a weight of magnitude 1.0 contributes $1.0 \times 2H_{ii}$ —one hundred times more damage, holding curvature constant.

The diagonal-Hessian approximation and why it justifies magnitude-only selection. The paper invokes a common approximation: if $H_{ii}$ is approximately constant within a layer (empirically common in early convolutional layers), then $\Delta R_i \propto \theta_i^2$ , and the greedy maximizer for a budget of $k$ flips is simply the set of $k$ indices with largest $|\theta_i|$ :

$S(\theta_i) = |\theta_i|$

Why this form: this is the simplest possible scoring function that captures the key structural insight—damage scales quadratically with weight magnitude. It requires no data, no gradients, no forward passes, and no knowledge of the loss function. It is computable in $O(|\theta|)$ time by a single pass through the stored weight array. Alternative scoring functions (random selection, low-magnitude selection, uniform selection) all fail because they don't exploit the $\theta_i^2$ dependence.

Connection to pruning literature. The same Taylor expansion under identical approximations is the foundation of Optimal Brain Damage (LeCun et al., 1989) and magnitude-based pruning (Frankle & Carbin, 2018). Pruning removes low-magnitude weights because their saliency $\theta_i^2 H_{ii}$ is small; DNL attacks high-magnitude weights because their saliency is large. The paper is performing "adversarial brain damage"—using the same mathematical machinery that identifies which parameters are safe to remove to instead identify which parameters are catastrophic to corrupt.

Empirical validation. Figure 2b shows that on 48 ImageNet models, magnitude-based selection ("Magnitude" boxplot) achieves substantially higher mean accuracy reduction over 10 flips (mAR(10)) than random selection ("Random" boxplot, near zero), confirming that the $\theta_i^2$ scaling is not merely a theoretical artifact—it predicts real-world damage. However, Figure 2b also shows that pure magnitude selection is not the strongest heuristic; the additional components of DNL (early-layer targeting, one-flip-per-kernel constraint) and the 1P-DNL gradient refinement each add substantial additional damage.

The One-Flip-Per-Kernel Constraint: Why Multiple Flips in One Kernel Can Cancel

For convolutional neural networks, DNL enforces a structural constraint: at most one sign bit may be flipped per convolutional kernel, regardless of how many high-magnitude weights that kernel contains (Section 3, Algorithm 1 line 5).

The empirical observation. The paper observes that "flipping multiple bits within the same kernel often merely changes its orientation or slightly modifies its functionality, rather than fully destroying the feature" (Section 3). Figure 3 provides a concrete visualization: a Sobel-Y horizontal edge detection filter with one sign flip is "severely disrupted, rendering it unable to detect edges effectively," but with two sign flips, "the resulting errors may partially offset each other, allowing the filter to retain some edge-detection capability."

The analytical explanation via kernel response. Consider a convolution kernel applied to an input patch $\mathbf{x}$ . The kernel response is the dot product $y = \mathbf{w}^\top \mathbf{x} = \sum_i w_i x_i$ . Flipping the sign of two weights $w_i$ and $w_j$ produces perturbation:

$\Delta y = -2(w_i x_i + w_j x_j)$

What this computes: the change in the kernel's output on a specific input patch when both sign bits are toggled. The two contributions sum; if $w_i x_i$ and $w_j x_j$ have opposite signs, they partially cancel each other, reducing the total perturbation relative to flipping only one of them.

Why opposite signs are plausible for edge-detection kernels. The paper notes that "many early kernels have opposite-signed edge-detector lobes" (Section 3). A Sobel filter, for example, has positive weights on one side of the edge and negative weights on the other. The two high-magnitude weights in such a kernel will typically have opposite signs in the learned filter. Flipping both sign bits converts positive to negative and negative to positive, which rotates the filter rather than destroying it—the edge-detection capability persists, just with a different orientation.

The mean-squared perturbation perspective. Averaging over all possible input patches with covariance matrix $\Sigma$ , the expected squared perturbation is:

$\mathbb{E}\left[(\Delta y)^2\right] = 4\left(w_i^2 \Sigma_{ii} + w_j^2 \Sigma_{jj} + 2w_i w_j \Sigma_{ij}\right)$

What this computes: the expected power of the kernel output perturbation, accounting for patch-level correlations. When nearby patch entries are positively correlated ( $\Sigma_{ij} > 0$ ) and large coefficients within the same kernel lie on opposite-signed lobes ( $w_i w_j < 0$ ), the cross-term $2w_i w_j \Sigma_{ij}$ is negative, so the second flip partially cancels the first rather than compounding it.

Why this constraint is architecture-specific. This heuristic applies only to convolutional filters where multiple weights within the same kernel process spatially adjacent inputs and can have structured sign patterns (Gabor-like, edge-detection lobes). It is not used in the transformer-based language model experiments, where attention projections and MLP weights do not exhibit the same spatial structure.

Quantitative example from MobileNetV3-Large. The paper provides a concrete case: "applying our magnitude-based method for $k=2$ selects the second highest-magnitude weight for sign flipping, which in this case belongs to the third convolutional layer, and results in a significant accuracy drop to AR(2) = 81.31. Adding another magnitude-based weight results in a flip within the same kernel that reduces the degradation to AR(3) = 46.97, partially offsetting the attack. However, flipping the next highest-magnitude parameter from a different kernel instead raises the accuracy reduction dramatically to AR(3) = 94.0." (Appendix B).

What this example demonstrates: the one-flip-per-kernel constraint is not a minor optimization—it can double the damage for the same number of flips by avoiding self-cancellation. The constraint effectively ensures that each flip corrupts a distinct feature channel rather than redundantly attacking a single channel in ways that partially undo each other.

The Early-Layer Targeting Heuristic: Why the First Layers Matter Most

DNL restricts candidate parameters to the first $L$ layers of the network (typically $L = 10$ ). This is not an arbitrary choice—it emerges from systematic empirical testing and has both intuitive and theoretical justification.

The empirical evidence. Figure 4a shows accuracy reduction (mAR10) across 48 ImageNet models when flips are restricted to the first $l$ layers, for $l \in \{1, 2, 3, 5, 10\}$ . The trend is clear: as $l$ increases (more layers included), the median mAR10 increases and the variance decreases, indicating that early layers reliably contain the most critical parameters. Table 4b provides a detailed case study on ShuffleNetV2—when targeting all layers, the top-5 magnitude parameters achieve only 0.39% accuracy reduction, but when restricted to the first 10 layers, those same magnitude-ranked parameters achieve 99.8% reduction. The jump is from negligible to catastrophic.

Why ShuffleNetV2 matters. The paper explicitly uses ShuffleNetV2 as a counterexample to the naive "just pick the largest weights" strategy. "Many models such as ShuffleNetV2 exhibit a different pattern: their largest parameters are concentrated in later layers. As a result, naive attacks that always target the largest parameters—often located in the late layers of ShuffleNetV2—are less effective. Redirecting the attack to early layers, however, significantly amplifies the damage" (Section 3).

The propagation intuition. A perturbation inserted into an early layer is processed by all subsequent layers. Each subsequent convolution, normalization, activation, and pooling operation transforms the corrupted representation. Errors introduced at layer 1 are amplified (or at minimum, propagated without attenuation) through layers 2, 3, ..., $N$ . Errors introduced at layer $N$ (right before the classifier) affect only the final classification decision, with no opportunity for cascading distortion.

The neuroscience analogy. The paper draws an explicit parallel: "early lesions (e.g., in the retina or optic nerve) can cause severe or total blindness" (Section 3), while lesions in higher visual areas may produce more specific but less total deficits. Similarly, corrupting a low-level edge detector in a CNN sends erroneous signals through the entire visual hierarchy; corrupting a high-level object-part detector affects only a subset of object categories.

The Lipschitz motivation. Under the standard Lipschitz composition bound, if each layer $\ell$ has Lipschitz constant $L_\ell$ , then the worst-case amplification of a perturbation inserted at layer 1 is bounded by $\prod_{\ell=2}^N L_\ell$ . The paper explicitly notes this is used only as motivation, not as a proof of optimality, but it formalizes the intuition: early perturbations have more layers to propagate through.

Connection to pruning literature. Pruning research has observed that early layers are disproportionately salient (Frankle & Carbin, 2018; Liu et al., 2019)—pruning them degrades accuracy more than pruning later layers with equivalent parameter counts. DNL exploits the same structural property for adversarial purposes.

Practical implementation detail. The paper states "we select $l = 10$ for simplicity" (Section 3). This value is not tuned per-model; it is a fixed hyperparameter applied uniformly across all 48 ImageNet models, all object detection models, and all language models (where "first 10 layers" translates to "first 5 blocks" for the transformer architectures). The fact that a single, non-tuned $L$ works across such diverse architectures suggests that the vulnerability is a deep structural property rather than an artifact of specific architectural choices.

The 1P-DNL Enhancement: Adding Gradient Information from a Single Pass

When the attacker's threat model allows one forward and backward pass (the 1-Pass variant), DNL is enhanced to 1P-DNL by incorporating second-order gradient information into the parameter scoring function.

The hybrid importance score. The 1P-DNL scoring function combines magnitude with a Taylor-style saliency term:

$S(\theta_i) = \alpha |\theta_i| + \beta \left| \frac{\partial R}{\partial \theta_i} \theta_i + \frac{1}{2} H_{ii} \theta_i^2 + \sum_{j \neq i} H_{ij} \theta_i \theta_j \right|$

What this computes: for each parameter $\theta_i$ , the score is a weighted sum of two terms:

$\alpha |\theta_i|$ — the pure magnitude term, identical to the pass-free DNL score.
The absolute value of a second-order Taylor expansion of the loss change when $\theta_i$ is perturbed, capturing how the loss function's local curvature amplifies or dampens the effect of the sign flip.

where $\alpha$ and $\beta$ are tunable coefficients controlling the relative weight of magnitude- vs. gradient-based information; the paper sets $\alpha = \beta = 1$ .

Why this form: the second term in the absolute value is the first-order Taylor term plus the second-order correction from Optimal Brain Damage. The product $\frac{\partial R}{\partial \theta_i} \theta_i$ captures how much a small perturbation in $\theta_i$ would change the loss, weighted by the parameter's current magnitude—large weights with large gradients are doubly important. The $\frac{1}{2} H_{ii} \theta_i^2$ term captures curvature effects, same as in the magnitude-only derivation, but now using an estimated rather than constant $H_{ii}$ . The sum over $j \neq i$ captures inter-weight coupling—how flipping $\theta_i$ interacts with other weights' optimality.

The Gauss-Newton and diagonal approximations. Computing the full Hessian $H$ is infeasible for large models (it would be a $|\theta| \times |\theta|$ matrix). The paper makes two standard approximations:

Diagonal approximation: $H_{ij} = 0$ for $j \neq i$ , eliminating the coupling sum. This reduces the score to $S(\theta_i) = |\theta_i| + |\theta_i g_i + \frac{1}{2}\theta_i^2 H_{ii}|$ .
Gauss-Newton approximation for the Hessian diagonal: $H_{ii} \approx (\frac{\partial R}{\partial \theta_i})^2 = g_i^2$ . This replaces the second derivative (which would require a Hessian-vector product computation) with the square of the first derivative (already computed during the backward pass).

After both approximations, the score simplifies to:

$S(\theta_i) = |\theta_i| + \left| \theta_i g_i + \frac{1}{2} \theta_i^2 g_i^2 \right|$

What this computes: the criticality score is the absolute weight magnitude plus the absolute value of a term that combines the weight-gradient product and the squared weight-gradient product. The first term $\theta_i g_i$ (the "SynFlow" term in pruning literature, Tanaka et al., 2020; Wang et al., 2020) captures first-order importance. The second term $\frac{1}{2} \theta_i^2 g_i^2$ captures a curvature estimate—parameters where both the weight and gradient are large contribute quadratically to the score.

Why this is useful beyond pure magnitude. The gradient term captures model-specific sensitivity that magnitude alone misses. Consider two weights with identical magnitudes $|\theta_i| = |\theta_j| = 1.0$ , but $\theta_i$ is in a layer where the loss function is flat ( $g_i \approx 0$ ) and $\theta_j$ is in a layer where the loss function is steep ( $g_j$ is large). Flipping $\theta_j$ will cause more damage because the network is more sensitive to changes at that point in parameter space. Pure magnitude scoring would treat them identically; 1P-DNL correctly ranks $\theta_j$ higher.

Special cases and reduction to simpler forms. The paper explicitly notes two degenerate cases (Section 3.1):

If $\frac{\partial R}{\partial \theta_i} = 0$ and $H_{ii} = 0$ , the hybrid score reduces to $S(\theta_i) = \alpha |\theta_i|$ , recovering the pass-free DNL score exactly. This is the "flat loss surface" case where magnitude is the only available signal.
If $\alpha = 0$ , the score reduces to $S(\theta_i) = \beta |\theta_i g_i + \frac{1}{2} H_{ii} \theta_i^2|$ , recovering a purely second-order (Optimal Brain Damage-like) approach with the Gauss-Newton Hessian approximation.

Why a random input suffices. The 1P-DNL forward/backward pass uses a random input—Gaussian noise for vision models, random token sequences for language models—not real data. The paper defines $R(\theta)$ as "the sum of model outputs on a random input (e.g., class scores for Gaussian image-like inputs in vision models, or logits induced by random token inputs in language models)." The gradient $g_i = \frac{\partial R}{\partial \theta_i}$ computed on this random input captures the model's structural sensitivity to parameter perturbations, even though the input is semantically meaningless. This works because:

The gradient's magnitude $|g_i|$ reflects the scale of the weight's influence on the computational graph, which is determined by the architecture and parameter magnitudes, not by the input content.
What matters is relative ranking of parameters within the model, not the absolute accuracy of the gradient direction. Even on random inputs, large-magnitude weights in early layers will typically have larger gradient norms than small-magnitude weights in late layers because they influence more downstream activations.

Empirical validation. Figure 2b shows that 1P-DNL ("1P-DNL" boxplot) achieves higher mAR(10) than pure magnitude ("Magnitude" boxplot) across 48 ImageNet models. Figure 2c shows that with $k = 10$ flips, 1P-DNL causes most models to collapse with accuracy reduction above 60%, and 43 out of 48 models exhibit reduction above 60%. Appendix D (Figure 9) compares 1P-DNL against alternative 1-pass scoring methods from the pruning literature (GraSP, SynFlow, OBD) and finds that the hybrid score is the most potent—other methods perform well on some architectures but fail on others, while the hybrid consistently degrades accuracy across all tested models.

The cost advantage. The complexity of 1P-DNL is $O(|\theta|)$ for the forward/backward pass plus $O(|\theta| \log |\theta|)$ for sorting. This is fundamentally different from the $O(k \times B \times |\theta| \times m)$ complexity of iterative methods like BFA, DeepHammer, and ZeBRA. For a ResNet-50 with ~25M parameters, 1P-DNL requires exactly one inference call; BFA requires hundreds or thousands, each on a batch of real images.

Seed sensitivity. 1P-DNL is the only stochastic component in the attack pipeline—the random input used for the forward pass is generated from a seed. The paper reports (Appendix F) that "repeating this step over 10 random seeds yields a standard deviation of 0.02 in accuracy reduction, which is negligible relative to the induced drops." The attack is therefore effectively deterministic in its outcome despite the single source of randomness.

The Complete DNL Algorithm (Pass-Free)

Algorithm 1 in the paper specifies the pass-free DNL procedure:

Extract first-layer parameters: $\theta_L \leftarrow$ parameters in the first $L$ layers of $\theta$ . For CNNs, this includes all convolutional kernels, batch normalization scales/biases, and any other trainable parameters in layers 1 through $L$ . For transformers, this includes attention projection matrices, MLP weights, and layer normalization parameters in the first $L$ blocks.
Sort by magnitude: Sort $\theta_L$ in descending order by $|\theta_i|$ . This is the core computational step— $O(|\theta_L| \log |\theta_L|)$ for the sort, but $|\theta_L|$ is typically orders of magnitude smaller than the full parameter count because later layers are excluded.
Select top- $k$ with per-kernel constraint: Take the $k$ highest-magnitude entries, but for CNNs, enforce that no two selected entries belong to the same convolutional kernel. If a candidate shares a kernel with a higher-ranked candidate, skip it and consider the next-highest-magnitude entry from a different kernel. This requires tracking which kernels have already been "claimed" by a selected weight.
Flip sign bits: For each selected $\theta_i$ in the final set $K$ , perform the assignment $\theta_i \leftarrow -\theta_i$ . In IEEE 754 FP32, this is a single-bit toggle of the MSB.
Output: The modified parameter array, with all weights identical to the original except for the $k$ sign-inverted critical parameters.

Why sort-then-filter (not filter-then-sort): the one-flip-per-kernel constraint operates on the magnitude-sorted list because we want the globally highest-magnitude weights, with the per-kernel constraint applied as a secondary filter. If we filtered by kernel first (e.g., taking only the maximum-magnitude weight per kernel), we might exclude a kernel whose maximum-magnitude weight is still larger than the selected weights from other kernels. Sorting first and then de-duplicating kernels ensures we always get the highest possible magnitudes subject to the constraint.

The Complete 1P-DNL Algorithm (Single-Pass)

Algorithm 2 specifies the enhanced single-pass variant, which differs from DNL in its scoring phase:

Generate random input: $X \leftarrow$ random input appropriate for the model domain. For vision models, Gaussian noise with the same spatial dimensions as the model's expected input. For language models, a sequence of random token IDs.
Define proxy loss: $R(\theta) \leftarrow \sum_i f_\theta(X)[i]$ , the sum of all model outputs on the random input. For a classifier, this is the sum of all class logits; for a language model, the sum of all logits across the vocabulary and sequence positions.
Compute gradients: $g \leftarrow \nabla_\theta R(\theta)$ via a single backward pass. This produces one gradient value per parameter.
Scope to early layers: $\theta_L \leftarrow$ parameters in the first $L$ layers, exactly as in DNL.
Compute hybrid scores: For each $\theta_i$ in $\theta_L$ :
- Approximate $H_{ii} \approx g_i^2$ (Gauss-Newton)
- $S(\theta_i) \leftarrow |\theta_i| + |\theta_i g_i + \frac{1}{2}\theta_i^2 g_i^2|$
Sort, select, constrain, flip: Identical to DNL steps 3–4.

Why the proxy loss is sum-of-outputs rather than cross-entropy with a pseudo-label: there are no labels—the attacker has no data. The sum of outputs captures the model's sensitivity to parameter perturbations in a label-agnostic way. Parameters that strongly influence the magnitude of the model's outputs (regardless of which output) will have large $|g_i|$ values and be prioritized.

The layer scoping is applied AFTER gradient computation: the backward pass computes gradients for all parameters, but only the first $L$ layers' gradients are used for scoring. This is slightly wasteful (later-layer gradients are computed but discarded), but in practice the backward pass cost is dominated by the forward pass, and the extra computation is negligible.

4. Key Insights and Innovations

Innovation 1: The "Adversarial Brain Damage" Framing — Inverting Pruning Theory into an Attack Strategy

The most intellectually distinctive move in this paper is not the specific attack algorithm but the conceptual reframing of an existing body of theory. The neural network pruning literature—Optimal Brain Damage (LeCun et al., 1989), Optimal Brain Surgeon (Hassibi et al., 1992), magnitude-based pruning (Frankle & Carbin, 2018), and gradient-based saliency methods (Molchanov et al., 2017; Lee et al., 2019)—has spent decades developing principled methods for answering one question: which parameters can I remove with minimal impact? DNL answers the inverse question: which parameters can I corrupt to cause maximal impact?

This inversion is not merely an application of existing methods with a minus sign. It represents a diagnostic insight about trained neural networks: the same mathematical structure that makes a weight safe to prune (small contribution to the loss under a second-order Taylor expansion) also identifies it as safe to ignore for an attacker, while the structure that makes a weight dangerous to prune (large contribution to the loss) identifies it as the most valuable target. The paper makes this connection explicit through the Taylor expansion derivation in Section 3, which shows that the damage from flipping a weight's sign scales as $\Delta R \approx 2\theta_i^2 H_{ii}$ — the same $\theta_i^2 H_{ii}$ term that OBD uses to decide which weights are least important. The difference is intent: OBD sorts ascending to find removable weights; DNL sorts descending to find attackable weights.

Why this framing is powerful beyond this paper. Prior weight-space attacks (BFA, DeepHammer, ZeBRA) treated bit selection as a black-box optimization problem to be solved through iterative gradient-guided search. They never asked why certain bits cause disproportionate damage; they simply searched for them. The pruning connection provides an explanation: critical parameters are critical because they occupy high-curvature regions of the loss landscape where the model's performance depends sharply on their exact values. This turns the vulnerability from a mysterious empirical phenomenon into a predictable structural property of converged neural networks. It also explains the paper's most striking finding—that 100,000 random sign flips do negligible damage while 10 targeted flips cause collapse (Figure 2a vs. 2c)—without invoking any domain-specific assumptions: most parameters have small $\theta_i^2 H_{ii}$ and flipping them changes little; a tiny subset have large $\theta_i^2 H_{ii}$ and flipping them is catastrophic.

Comparison to prior work. BFA (Rakin et al., 2019) performs iterative gradient-based search—it effectively computes saliency scores through repeated forward/backward passes on real data—but never frames this as pruning-in-reverse. ZeBRA (Park et al., 2021) drops the real-data requirement but still performs an optimization loop. Neither paper provides a theoretical justification for why their selected bits work; they rely on the optimization process itself as justification. DNL's contribution at the idea level is to show that this expensive optimization is largely unnecessary because the saliency ranking is dominated by weight magnitude in early layers—a property that can be verified analytically under standard approximations.

Significance beyond performance. This reframing enables two downstream contributions that would be hard to justify without it. First, it provides a principled basis for defense: if critical parameters are those with large $\theta_i^2 H_{ii}$ , protecting exactly those parameters (rather than all parameters uniformly) is a natural strategy. The paper's selective defense (Section 6, Table 5) flows directly from this insight. Second, it enables cross-domain transfer: because the saliency structure emerges from general properties of converged neural networks (zero gradient, non-zero curvature for important weights), the same heuristic—pick large-magnitude early-layer weights—works across CNNs, vision transformers, mixture-of-experts LLMs, and encoder-only text models, without any domain-specific tuning. This universality would be a coincidence under the black-box optimization framing; under the pruning-in-reverse framing, it is expected.

The fundamental vs. incremental call. This is a fundamental reframing rather than an incremental improvement. The pruning connection was always latent in prior work—BFA's gradient-based bit scoring is implicitly computing a saliency measure—but no prior work made the connection explicit or used it to justify a lightweight, data-free heuristic. By doing so, the paper transforms the problem from "how do we optimize over an exponentially large discrete space?" to "how do we rank parameters by a well-understood importance metric?"—a dramatically easier problem whose solution falls out of existing theory.

Innovation 2: Difficulty-as-Structure Rather Than Difficulty-as-Data — The Discovery That Criticality Is Architectural, Not Statistical

The paper's second major conceptual contribution is the finding that parameter criticality is determined primarily by architectural position (layer depth, kernel assignment) and weight magnitude, not by data-dependent or task-dependent properties. This is non-obvious and contradicts a natural intuition: one might expect that the most critical parameters would be those most specialized to the training data—weights that encode rare but important features, or decision-boundary parameters that finely separate classes. Instead, the paper finds that the most destructive parameters are generic structural elements: high-magnitude weights in the earliest layers, distributed one per convolutional kernel to avoid self-cancellation.

The evidence for architectural dominance. Three empirical patterns support this claim:

The early-layer targeting result (Figure 4a, Table 4b): restricting flips to the first 10 layers consistently outperforms targeting all layers, and the effect is dramatic on architectures like ShuffleNetV2 where the largest-magnitude weights happen to concentrate in later layers. A pure magnitude ranking (which would target those later-layer weights) achieves only 0.39% accuracy reduction on ShuffleNetV2; the same ranking restricted to early layers achieves 99.8%. The critical parameters are not the globally largest weights—they are the largest weights in early layers.
The one-flip-per-kernel constraint (Figure 3, Appendix B): multiple sign flips within the same convolutional kernel partially cancel each other's damage because learned edge detectors have opposite-signed lobes. This is a property of the filter structure, not the data—it would hold for any dataset on which the kernel learned an edge-detection pattern. The constraint is purely architectural (group weights by kernel, select at most one) and yet substantially amplifies damage (Appendix B example: AR(3) jumps from 46.97% to 94.0% when the third flip targets a different kernel).
The cross-domain transfer (Sections 4.1, 4.2, 4.3): the same heuristics (large magnitude, early layer, one-per-kernel where applicable) cause catastrophic collapse in image classification, object detection, instance segmentation, and mathematical reasoning—tasks with fundamentally different output spaces, loss functions, and data distributions. The vulnerability is not task-specific; it is a property of the model architecture and training convergence.

Comparison to prior work. All prior weight-space attacks treated criticality as a data-dependent property to be discovered through optimization. BFA computes gradients on validation images—if you change the validation set, BFA might select different bits, implying that criticality depends on which examples you evaluate on. ZeBRA generates synthetic data from the model, which still encodes the model's learned data distribution. DNL's key conceptual move is to ask: how much of criticality is independent of the specific data? The answer, empirically, is: most of it.

Why this matters for security analysis. If criticality were data-dependent, defenders could mitigate attacks by keeping training data secret—an attacker who gains memory access but not data access would be unable to identify which parameters to target. DNL demonstrates that this defense is ineffective: the attacker can identify critical parameters using only the stored weights (and optionally one random input), with no knowledge of the training distribution. The architectural nature of the vulnerability means that any model with readable weights is vulnerable, regardless of how well its training data is protected.

The fundamental vs. incremental call. This is a fundamental discovery about the structure of trained neural networks, not an incremental improvement to attack methodology. The paper does not claim to have made attacks more efficient (though it does); it claims to have shown that the vulnerability is deeper and more structural than previously understood. This has implications beyond the specific attack: it suggests that neural network training, as currently practiced, systematically concentrates functional importance into a tiny fraction of parameters in architecturally predictable locations—a property that may be exploitable not just for attacks but also for model compression, interpretability, or robustness analysis.

Innovation 3: The Minimum-Viable-Attack Concept — Redefining the Threat Model Through What Is NOT Required

The paper's third conceptual contribution is methodological rather than technical: it establishes a new baseline for what constitutes a realistic weight-space attack by stripping away requirements that prior work took for granted—data access, iterative optimization, multiple inference passes—and showing that the resulting minimal attack is not weaker but often stronger than the optimization-heavy alternatives.

The threat model as a contribution. Section 2 defines a threat model that excludes:

Access to training or validation data
The ability to run forward or backward passes through the model
Any iterative optimization or search over candidate bit positions
Any knowledge of the data distribution or task specifics

This is not a hypothetical exercise in parsimony. The paper justifies each exclusion through specific hardware attack vectors (Section 2): Rowhammer induces sporadic bit flips through DRAM electrical interference and cannot perform gradient computations; DMA attacks from compromised peripherals can read/write memory but not execute model inference; rootkits with kernel access can modify stored parameters but running repeated inference would generate suspicious activity patterns. By defining a threat model that precisely matches what these hardware vectors can achieve, the paper makes its attack realistic in a way that prior work—which assumed the attacker could run the victim's model extensively on their data—was not.

The surprising empowerment of constraints. The paper's most counterintuitive finding is that removing capabilities made the attack stronger, not weaker. 1P-DNL, which uses a single random input and one backward pass, outperforms BFA (which uses real data and iterative optimization) on ResNet-50: 1P-DNL achieves 99.4% accuracy reduction with one sign flip, while BFA requires five flips to reach 99.7% (Table 4). On ViT-B/16@224, DNL achieves 99.3% reduction with five flips, while BFA reaches only 90.9% with ten flips. The constraint of no data access forced the development of heuristics (magnitude + early-layer + one-per-kernel) that turned out to be better at identifying genuinely critical parameters than gradient-guided search on limited data.

Why this happens. The paper doesn't fully explain this inversion, but a plausible interpretation emerges from the architectural-criticality insight (Innovation 2): BFA's gradient-based search, performed on a small batch of validation images, may overfit to the specific examples it sees—it selects bits that maximize loss on those examples, which may not generalize to maximum damage across the full distribution. DNL's magnitude-based heuristic, by contrast, selects parameters that are structurally important regardless of the specific input, producing a more distributionally robust attack. This is analogous to the classic bias-variance tradeoff: BFA's optimization is high-variance (specific to the validation batch), while DNL's heuristic is high-bias (assumes magnitude equals importance) but the bias turns out to be well-aligned with the true importance structure.

Comparison to prior work. Every prior weight-space attack paper (BFA, DeepHammer, ZeBRA) treated data access and iterative optimization as necessary costs of identifying critical parameters. The conceptual move DNL makes is to ask: what if we give up on those capabilities entirely—can we still find the critical parameters? The answer is not just yes, but better than the optimization-based methods. This inverts the standard research narrative where removing constraints degrades performance; here, removing constraints (forcing the method to rely on architectural properties rather than data-dependent gradients) actually improved performance on key benchmarks.

The fundamental vs. incremental call. This is a methodological reframing rather than a technical advance—the technical components (magnitude sorting, early-layer restriction, per-kernel constraint) are individually simple. The contribution is in demonstrating that the combination, under an appropriately restrictive threat model, matches or exceeds the state of the art. By establishing this as a new baseline, the paper effectively raises the bar for future attack methods: any new weight-space attack that requires more attacker capabilities (data, optimization, multiple passes) must now justify that additional cost against a method that achieves comparable or superior damage with essentially zero computation.

Innovation 4: Verifier-Free Cross-Domain Universality — The Same Heuristic Breaks Everything

The paper's fourth conceptual contribution is the empirical demonstration that a single, data-agnostic, architecture-agnostic vulnerability mechanism spans fundamentally different model types and tasks—a finding that was neither predicted by theory nor suggested by prior work, which studied attacks in isolation on single architectures or domains.

The scope of the evidence. The paper evaluates DNL on:

60 image classifiers across ImageNet, DTD, FGVC-Aircraft, Food101, and Stanford Cars, spanning CNNs (ResNet, EfficientNet, MobileNet, RegNet, ConvNeXt, ShuffleNet, MnasNet, VGG, GoogLeNet, Inception, SqueezeNet), vision transformers (ViT-B/16, ViT-B/32, ViT-S/16, ViT-S/32, ViT-T/16), and hybrid architectures
Object detection and instance segmentation models (Mask R-CNN with ResNet-50 and ResNet-101 backbones, YOLOv8-seg) on COCO 2017
Reasoning large language models (Qwen3-4B, Qwen3-30B-A3B, Nemotron Nano 8B) on MATH-500
Encoder-only text classifiers (BERT, DistilBERT, RoBERTa fine-tuned on MRPC, QNLI, SST-2)

In every single case, a handful of targeted sign flips—selected by the same heuristics (magnitude, early-layer, one-per-kernel for CNNs)—causes catastrophic degradation. Two sign flips collapse Qwen3-30B-A3B from 78% to 0% on math reasoning (Table 1). One sign flip in the backbone reduces Mask R-CNN bbox AP from 0.38 to 0.01 on COCO (Table 3). Two sign flips drop ResNet-50 ImageNet accuracy by 99.8% (Table 4).

Why this universality is surprising. The models span fundamentally different computational paradigms:

CNNs process spatially structured inputs through local receptive fields and weight sharing
Vision transformers process image patches through global self-attention
Mixture-of-Experts LLMs route tokens through sparse expert subnetworks
Dense LLMs process token sequences through stacked self-attention and MLP blocks
Encoder-only text models process token sequences through bidirectional attention

There is no a priori reason to expect that the same attack mechanism—flipping sign bits of high-magnitude early-layer weights—would be the most destructive strategy across all of these. One might expect attention-based models to be more sensitive to value projection corruption, or MoE models to require targeting the router, or detection models to be vulnerable through the task-specific heads rather than the shared backbone. The paper's finding that early-layer backbone weights are the universal failure point is an empirical discovery, not a theoretical prediction.

The failure mode analysis as a diagnostic contribution. The paper provides qualitative evidence for why the attack transfers: the corrupted models do not merely become noisy or slightly less accurate; they collapse into qualitatively distinct failure modes that are consistent within each domain. For vision models, the collapse mode is systematic misclassification (the model still produces coherent-looking predictions, just wrong ones—Figure 8 shows Mask R-CNN correctly localizing a dog but labeling it as the wrong class). For language models, the collapse mode is repetitive, nonsensical text generation (Figure 5 shows Qwen3-30B-A3B degenerating into "I'm going to help you with the solution" loops or "I am a student" repetitions). These failure modes are not gradual degradation—they represent discrete phase transitions where the model's computation qualitatively breaks rather than quantitatively degrades.

Comparison to prior work. Prior weight-space attacks were evaluated on narrow sets of architectures—typically a few CNNs on ImageNet (BFA evaluated VGG, ResNet, MobileNet; DeepHammer added a few more CNNs; ZeBRA added ViT). None demonstrated transfer to object detection, segmentation, or language models. The cross-domain scope of DNL's evaluation is unprecedented in the weight-space attack literature and transforms the vulnerability from a curiosity of image classifiers to a fundamental property of trained neural computation.

The fundamental vs. incremental call. This is a fundamental empirical discovery about the nature of neural network representations: across architectures, domains, and tasks, a small number of early-layer weights act as single points of failure whose sign inversion causes catastrophic collapse. The paper does not claim to prove this theoretically or to offer a unified analytical framework—it is a phenomenological finding whose explanation (the propagation-of-errors intuition, the Lipschitz composition bound) is suggestive but not rigorous. The contribution is in establishing the scope and severity of the vulnerability, converting what might have been dismissed as a CNN-specific quirk into a cross-domain security concern with implications for any deployed neural system.

Innovation 5: Defense Through Understanding — Selective Protection as a Principled Alternative to Uniform Hardening

The paper's final conceptual contribution is a defense philosophy that flows directly from its diagnostic findings: rather than hardening all parameters against bit flips (through encoding, replication, or error correction), identify and protect only the tiny fraction that are genuinely critical. This is not a new technical mechanism—bit replication and error-correcting codes are standard tools—but the selection criterion for which parameters to protect is novel and is the direct intellectual product of the attack analysis.

The economic argument. Uniform protection multiplies memory and bandwidth costs by a constant factor proportional to the desired level of redundancy. Protecting every sign bit with triple modular redundancy (three copies, majority vote) triples the storage for sign bits. Protecting every weight with error-correcting codes expands the representation by the code's overhead. For a model with billions of parameters (Qwen3-30B-A3B has billions of weights), this overhead is substantial. Selective protection applies the overhead only to the ~0.001% to 1% of parameters that DNL identifies as critical, achieving comparable robustness at negligible memory cost.

The evidence for selectivity. Table 5 demonstrates that protecting just 0.001% of parameters (100 weights in ResNet-18) halves the damage from an iterative optimization-based attack (BFA), reducing mean accuracy reduction over 10 flips from 88.87% to 58.83%. Protecting 1% (100K weights) essentially nullifies the attack, reducing AR(10) to 0.00%. On MobileNet-V2, selective defense is harder—0.001% protection barely helps (AR(10) drops from 99.90% to 99.80%)—because MobileNet-V2's critical parameters are more distributed, requiring 1% protection to reduce AR(10) to 44.30%. This variability itself is informative: the defense's effectiveness depends on how concentrated the critical parameters are, which varies by architecture.

Why this is a conceptual contribution rather than just a defense mechanism. The paper could have proposed selective protection as a straightforward application of its attack findings—"we found which parameters are critical, so protect them." The deeper contribution is in validating the attack's diagnostic accuracy: if DNL were identifying the wrong parameters (false positives—weights that seem critical but whose protection doesn't help), selective defense would fail. The fact that protecting DNL-identified parameters substantially reduces BFA's damage—even though BFA uses a completely different (gradient-based, data-dependent) selection criterion—is strong evidence that DNL is correctly identifying genuinely critical parameters. BFA, running its own iterative optimization, presumably searches for the same critical parameters that DNL identifies heuristically; by protecting those parameters preemptively, BFA's search space is depleted of high-impact targets.

The evasion of existing defenses (Section 6). The paper also evaluates DNL against prior defense strategies and finds them inadequate:

Binarization (binary-weight networks): flipping a sign bit still inverts the weight; binarized ResNet-18 still suffers 96.50% AR(10) under DNL (Table 9).
Encoding defenses (DeepNcode): the paper shows that in a gray-box setting, an attacker can search for the closest alternative codeword whose decoded value has the opposite sign, effectively performing a sign flip through the encoding.
Weight-scaling: scaling all weights by a constant $c$ and dividing by $c$ at inference leaves multiplicative sign flips unchanged: $-c\theta / c = -\theta$ .

These negative results strengthen the case for selective protection: existing defenses either fail against sign flips specifically (scaling, binarization) or can be bypassed with additional attacker knowledge (encoding). The selective approach is robust because it doesn't rely on transforming the representation to make flips harder; it makes the targeted parameters physically unavailable for flipping through redundancy.

The fundamental vs. incremental call. The defense mechanism (bit replication / ECC) is standard; the contribution is the selection criterion and the empirical validation that the criterion is correct. This is an incremental technical contribution built on a fundamental diagnostic contribution (the attack analysis). The paper's primary intellectual contribution is the attack and the vulnerability characterization; the defense demonstrates that this understanding has practical value, but is not itself a conceptual breakthrough.

5. Experimental Analysis

Evaluation Methodology

Dataset. The primary image classification benchmark is ImageNet-1K (also referred to as ILSVRC 2012), the standard 1000-class object recognition dataset. The paper evaluates 48 pre-trained models from the timm and Torchvision repositories on the standard ImageNet validation set. Beyond ImageNet, additional evaluation is performed on DTD (texture classification, 47 classes), FGVC-Aircraft (fine-grained aircraft classification, 100 classes), Food101 (food recognition, 101 classes), and Stanford Cars (fine-grained car classification, 196 classes). For object detection and instance segmentation, the benchmark is COCO 2017 (Lin et al., 2014), using the standard validation split. For language model reasoning, evaluation uses a fixed 50-question subset of MATH-500 derived from the MATH benchmark (Hendrycks et al., 2021). For encoder-based text classification, the benchmarks are MRPC, QNLI, and SST-2 from the GLUE benchmark (Wang et al., 2019). No training data from any of these benchmarks is used in the attack—the attacker has zero access to any data samples.
Base model(s). For image classification, the paper evaluates 48 distinct ImageNet models spanning CNN families (ResNet-18/34/50/101/152, VGG-11/13/16/19, MobileNet-V2/V3, EfficientNet-B0 through B7, RegNet-Y 400MF through 32GF, ConvNeXt-Tiny/Small/Base/Large, ShuffleNetV2, MnasNet, SqueezeNet, GoogLeNet, Inception-V3, AlexNet), vision transformers (ViT-B/16, ViT-B/32, ViT-S/16, ViT-S/32, ViT-T/16), and EfficientNetV2 variants. For object detection, the paper uses Mask R-CNN with ResNet-50 and ResNet-101 backbones (He et al., 2017) from Torchvision and YOLOv8-seg from Ultralytics (Jocher et al., 2023). For reasoning language models, it evaluates Qwen3-4B, Qwen3-30B-A3B (a mixture-of-experts model with 30B total parameters but only 3B active), and Llama-3.1-Nemotron-Nano-8B. For encoder-based text classification, it evaluates BERT, DistilBERT, and RoBERTa fine-tuned on GLUE tasks. This breadth of model families—spanning CNNs, ViTs, MoE transformers, dense transformers, and encoder-only architectures—is deliberately chosen to test the cross-domain universality of the vulnerability, not just its presence in a single model type.
Metrics. The primary metric is Accuracy Reduction (AR), defined as AR(k) = (Acc(θ) - Acc(θ′_(k))) / Acc(θ), where Acc(θ) is the clean model's accuracy and Acc(θ′_(k)) is the accuracy after flipping k sign bits. AR ranges from 0% (no degradation) to 100% (complete collapse to zero accuracy). For aggregate comparison across different flip budgets, the paper defines mean Accuracy Reduction over the first N flip counts as mAR(N) = (1/N) Σ_{k=1}^{N} AR(k), providing a single scalar capturing vulnerability across low flip regimes. For object detection, the metrics are standard COCO Average Precision (AP): bbox AP and segm AP at both AP@[0.50:0.95] (averaged over IoU thresholds) and AP@0.50 (single IoU threshold). For language models, accuracy is measured as exact answer match using the MATH benchmark's canonical verifier. For GLUE tasks, standard task-specific accuracy metrics are used. All accuracy measurements are performed after the bit flips are applied—the attacker has no access to these metrics during the attack; they are used only for evaluation.
Baselines. The paper compares against several prior weight-space attack methods, each requiring different attacker capabilities:
- Random sign flips: Uniformly random selection of k sign bits from the entire parameter space, serving as a lower bound on what unguided corruption achieves. This baseline is critical because Figure 2a shows that even 100,000 random sign flips produce negligible accuracy reduction on many architectures, establishing that effective attacks must be targeted.
- Bit-Flip Attack (BFA) (Rakin et al., 2019): Iterative gradient-based bit search requiring multiple forward/backward passes on validation data. BFA is the most prominent prior weight-space attack and serves as the primary optimization-based baseline.
- DeepHammer (Yao et al., 2020): Chain-based iterative search requiring data access and multiple forward/backward passes. Reported for ResNet-50 and MobileNet-V2.
- ZeBRA (Park et al., 2021): Zero-real-data attack that generates synthetic data from the victim model and performs iterative optimization. Serves as the closest prior comparison to DNL's data-free threat model, though ZeBRA still requires repeated forward/backward passes.
- Magnitude-only selection: Flipping the top-k largest-magnitude weights across all layers, without early-layer restriction or one-flip-per-kernel constraint. This isolates the contribution of the structural heuristics beyond pure magnitude ranking.
- Alternative scoring functions from pruning literature (Appendix D, Figure 9): GraSP, SynFlow, and Optimal Brain Damage (OBD) scoring, applied with the same one-pass budget to validate that 1P-DNL's hybrid score is superior to existing single-pass saliency methods.
For the pass-free DNL comparison, the critical baseline is random selection (showing that targeting matters) and magnitude-only (showing that early-layer + per-kernel constraints matter). For 1P-DNL, the critical baselines are the alternative one-pass scoring functions and the iterative optimization methods (BFA, ZeBRA, DeepHammer), to establish that a single random-input pass can match or exceed expensive multi-pass optimization.
Generation budget / compute accounting. The paper measures computational cost in terms of forward and backward passes through the model, not in FLOPs or wall-clock time. DNL (pass-free) requires zero forward or backward passes—its cost is O(|θ|) to read the stored weights plus O(|θ| log |θ|) to sort the subset in early layers. 1P-DNL requires exactly one forward pass and one backward pass on a single random input, plus the same sorting cost. The complexity analysis in Table 7 compares this against prior methods: BFA, DeepHammer, and ZeBRA each scale as O(k × B × θ × m), where k is the number of flipped bits, B is the number of candidate bits evaluated per iteration, θ is the parameter count, and m is the batch size—representing potentially hundreds or thousands of inference calls depending on the search granularity. This is a fundamentally different scaling regime. The paper does not account for the cost of writing flipped bits back to memory/storage, which is assumed to be negligible compared to model evaluation.

For the FLOPs-matched comparison that is not present in this paper (the paper does not perform a pretraining-vs-inference tradeoff analysis—this is a distinguishing difference from the reference example paper which did), the relevant metric for this experimental analysis is simply: how many model evaluations (forward+backward passes) does the attacker need to perform, and on what data? DNL and 1P-DNL are distinguished by requiring 0 and 1 passes respectively, all on random/meaningless inputs.
Cross-validation / statistical protocol. DNL is fully deterministic: for a fixed model, layer budget L, and flip budget k, it always selects the same weights and produces the same AR. There is no train/test split or cross-validation needed for the attack itself—all reported AR values are computed once on the standard validation/test splits of each benchmark.

1P-DNL introduces one source of randomness: the random input used for the single forward/backward pass. The paper reports (Appendix F) that over 10 random seeds on a representative subset of architectures (ConvNeXt-B, RegNetY-400MF, ResNet-50, EfficientNet-B0, ViT-B/16), the standard deviation in accuracy reduction is 0.02, which is negligible relative to the induced drops (typically 50–100% AR). This seed sensitivity analysis is the only statistical robustness check reported.

For the defense experiments (Table 5), BFA is run three times per flip budget k and the mean accuracy reduction is reported. The defense's effectiveness is measured by how much protecting DNL-identified parameters reduces BFA's AR(10)—the mean AR over k ∈ {1, ..., 10} and three trials per k.

For the cross-dataset evaluation (Figures 6, 7), results are averaged across EfficientNet-B0, MobileNetV3-Large, and ResNet-50 on each of the four additional datasets (DTD, FGVC-Aircraft, Food101, Stanford Cars), with the mean AR plotted as a function of flip count. Individual per-model, per-dataset curves are provided in Appendix E (Figures 10–13).

No confidence intervals, error bars, or statistical significance tests are reported for any of the main attack results. This is a limitation: with a test set of 50 questions for language models and single-point accuracy measurements, the reported AR values could have non-trivial variance that is not captured.

Main Quantitative Results

Image Classification: 48 ImageNet Models Under Sign-Flip Attacks

The headline result for image classification is that both DNL and 1P-DNL cause most of 48 evaluated ImageNet models to collapse with very few sign flips. Figure 2c shows that with k = 10 flips, 43 out of 48 models exhibit accuracy reduction above 60%, and the majority are above 90%. This collapse is not gradual—Table 10 and Table 11 provide per-model AR curves that show many architectures reaching near-total collapse (AR > 99%) with 2–5 flips.

DNL (pass-free) per-model results (Table 10, Figure 2b, center boxplot): The magnitude-based heuristic with one-flip-per-kernel constraint and early-layer scoping (L = 10) achieves dramatic degradation across diverse architectures:

ResNet-50: AR(1) = 6.6%, AR(5) = 40.4%, AR(8) = 99.7%. The attack causes gradual degradation at very low flip counts (1–2 flips have modest impact) before a sharp phase transition around 5–8 flips to near-total collapse.
MobileNet-V2: AR(2) = 99.8%. This is one of the most brittle architectures—two targeted flips are sufficient for essentially complete destruction.
VGG-11: AR(2) = 91.3%, AR(3) = 99.9%. Only 3 flips for total collapse.
ViT-B/16@224: AR(1) = 97.2%, AR(5) = 99.9%. Remarkably, a single sign flip in this vision transformer already causes 97.2% accuracy reduction.
Inception-V3: AR(2) = 2.0%, AR(5) = 56.9%, AR(10) = 96.8%. More gradual degradation than MobileNet or ViT, but still near-total collapse by 10 flips.
ShuffleNetV2 x0.5: AR(1) = 90.4%, AR(2) = 99.6%. Extremely brittle even at k = 1.
AlexNet: AR(10) = 88.5%. Notably more resilient than modern architectures, requiring more flips for comparable damage.
EfficientNet-B4: AR(10) = 97.8%. However, k = 1 through k = 9 show very low AR (0.4–9.4%), revealing a sharp transition only at k = 10. This suggests EfficientNet-B4's critical parameters are more distributed, requiring more flips to accumulate enough damage to trigger collapse.
RegNet-Y 400MF: AR(1) = 0.8%, AR(5) = 40.7%, AR(10) = 64.1%. One of the more resilient architectures, never reaching full collapse even at 10 flips.

The mAR(10) across all 48 models ranges from 7.8% (EfficientNet-B5) to 99.7% (ViT-Tiny), with the majority concentrated in the 50–99% range (Figure 2b).

1P-DNL (single-pass) per-model results (Table 11, Figure 2b, right boxplot): Adding gradient information from a single random-input pass substantially amplifies damage at low flip budgets for many architectures, particularly those that were more resilient under DNL:

ResNet-50: AR(1) = 99.4%. The single-pass refinement transforms ResNet-50 from a model requiring 8 flips for collapse under DNL to one requiring 1 flip for near-total destruction. This is the paper's most dramatic demonstration of 1P-DNL's advantage.
EfficientNet-B4: AR(1) = 2.0%, AR(2) = 30.3%, AR(3) = 90.4%, AR(10) = 99.9%. The collapse that under DNL required 10 flips now occurs at 3 flips—the gradient information identifies the genuinely critical parameters that magnitude alone missed at low k.
ConvNeXt-Large: AR(1) = 39.6%, AR(2) = 68.5%, AR(3) = 73.4%, AR(10) = 99.6%. Under DNL, this model showed very low damage at small k (AR(1) = 0.7%, reaching only 61.5% at AR(10)); 1P-DNL accelerates and deepens the collapse dramatically.
EfficientNet-B5: AR(1) = 30.8%, AR(10) = 99.7%. Under DNL, this was the most resilient model (mAR(10) = 7.8%); 1P-DNL transforms it to near-total collapse by 10 flips.
MobileNet-V2: AR(2) = 99.8%, essentially identical to DNL—for architectures already extremely brittle under magnitude-only scoring, the gradient information provides no additional benefit.
ViT-B/16@224: AR(1) = 17.2%, AR(2) = 84.9%, AR(5) = 97.1%, AR(10) = 99.6%. Interestingly, 1P-DNL is less effective than DNL at k = 1 for this architecture (17.2% vs. 97.2%), indicating that the single-pass gradient on random input can occasionally misrank parameters relative to pure magnitude for ViT architectures. However, by k = 5, 1P-DNL catches up to the near-total collapse induced by DNL.
RegNet-Y 400MF: AR(10) = 64.1% under both DNL and 1P-DNL, showing that some architectures are genuinely more resilient regardless of scoring method.

The overall pattern in Figure 2b is clear: 1P-DNL achieves the highest median mAR(10) and the tightest interquartile range, indicating that the gradient refinement not only increases average damage but also makes attack effectiveness more consistent across architectures.

Random flips baseline (Figure 2a): The paper's most visually striking baseline result is that flipping 100,000 random sign bits produces near-zero accuracy reduction for most architectures, with the boxplot showing the 100,000-bit median around 0% AR. Even at 10,000 random bits, the median is still below 20%. This establishes the central claim: the vulnerability is not simply that neural networks are fragile to bit flips in general—they are remarkably robust to random corruption—but rather that a tiny, identifiable subset of bits are points of catastrophic fragility. The contrast between 100,000 random flips (negligible damage) and 10 targeted flips (catastrophic damage for most models) quantifies the precision of DNL's targeting heuristic.

Comparison to prior attacks (Table 4, expanded in Table 6): On the four models where direct comparisons are available:

VGG-11: DNL achieves 99.9% AR with 3 flips; BFA requires 17 flips for 99.7%; 1P-DNL achieves 99.8% with 2 flips. DNL is 5.7× more efficient in flip count than BFA.
ResNet-50: 1P-DNL achieves 99.4% AR with 1 flip; BFA achieves 99.7% with 5 flips; DNL achieves 99.7% with 8 flips. The 1P-DNL result represents a 5× reduction in required flips.
MobileNet-V2: All methods achieve ~99.8% AR with 2–3 flips—the model is so brittle that optimization provides no advantage.
ViT-B/16@224: DNL achieves 99.3% AR with 5 flips; 1P-DNL achieves 99.1% with 4 flips; BFA achieves only 90.9% with 10 flips; ZeBRA achieves only 45.8% with 10 flips. On the only transformer architecture tested across methods, DNL and 1P-DNL dramatically outperform prior iterative optimization methods, reducing required flips by 2.5× while increasing damage.

Approximate computational cost comparison (Table 7): DNL scales as O(|θ|) + O(k)—essentially, the cost of reading the weights plus sorting a small subset. 1P-DNL adds one forward and backward pass: O(|θ|) + O(k). In contrast, BFA, DeepHammer, and ZeBRA each scale as O(k × B × θ × m), where the key multiplier is B (number of candidate bits evaluated per iteration) and m (batch size). For a typical configuration, BFA evaluates hundreds of candidate bits per flip decision on batches of dozens of images, resulting in thousands of forward/backward passes for a k = 10 attack. DNL's zero-pass cost is orders of magnitude lower than any prior method.

Beyond ImageNet: Cross-Dataset Transfer (DTD, FGVC-Aircraft, Food101, Stanford Cars)

The paper demonstrates that the vulnerability is not ImageNet-specific by evaluating DNL and 1P-DNL on three popular classifiers (EfficientNet-B0, MobileNetV3-Large, ResNet-50) across four additional datasets. The results are summarized in averaged curves (Figures 6, 7) and detailed per-dataset curves (Appendix E, Figures 10–13).

DNL cross-dataset results (Figure 6): Averaged across the three models:

On DTD (texture classification): AR(1) ≈ 30%, AR(2) ≈ 55%, AR(5) reaches above 90%, and AR(10) is essentially 100%.
On FGVC-Aircraft: Similar pattern, with AR(5) ≥ 85% and AR(10) near 100%.
On Food101: AR(5) ≥ 90%.
On Stanford Cars: AR(5) ≥ 85%.

The paper states: "In all four datasets, flipping one or two sign bits already leads to sharp collapse. Most notably, DNL yields AR(5) ≥ 85% across all model/dataset combinations shown."

1P-DNL cross-dataset results (Figure 7): The single-pass variant is even stronger, with the paper reporting that "1P-DNL reaches AR(4) ≥ 90%" averaged across the three models on all four datasets. The collapse is more abrupt than DNL's, with AR already exceeding 70% at k = 1 for several dataset/model combinations.

Individual dataset per-model curves (Figures 10–13): The per-model breakdown reveals that ResNet-50 is typically the most vulnerable of the three models, EfficientNet-B0 shows intermediate vulnerability, and MobileNetV3-Large is the most resilient (though still suffering AR(10) ≥ 80% across all datasets). The qualitative shape of the degradation curves—steep initial drops followed by saturation near 100% AR—is consistent across datasets, supporting the paper's claim that the vulnerability is not a statistical artifact of ImageNet's specific class distribution but rather a structural property of the models themselves.

Object Detection and Instance Segmentation: COCO 2017

The paper evaluates whether backbone-only attacks—flipping sign bits only in the shared feature extractor, leaving task-specific heads untouched—can collapse downstream detection and segmentation performance. Results are reported in Table 3 and qualitative examples in Figure 8.

Mask R-CNN with ResNet-50 backbone (Table 3):

Bounding box detection: Clean bbox AP = 0.38. After 1 sign flip in the backbone: bbox AP = 0.01, AR(1) = 97.36%. After 2 flips: bbox AP = 0.00, AR(2) = 100.00%.
Bounding box AP50 (IoU 0.50 only): Clean = 0.59. After 1 flip: 0.03 (AR = 94.93%). After 2 flips: 0.00 (AR = 100.00%).
Instance segmentation: Clean segm AP = 0.35. After 1 flip: 0.00 (AR = 100.00%). After 2 flips: 0.00 (AR = 100.00%).
Instance segmentation AP50: Clean = 0.56. After 1 flip: 0.01 (AR = 98.21%). After 2 flips: 0.00 (AR = 100.00%).

The key finding: one targeted sign flip in the backbone reduces segmentation mask AP to zero—the model completely loses the ability to segment any objects. Detection AP collapses to 0.01 (essentially zero), meaning the model can barely localize any objects either.

Mask R-CNN with ResNet-101 backbone (Table 3):

Similar pattern but slightly more resilient at k = 2: bbox AP = 0.01 after 2 flips (AR(2) = 97.51%, not 100%), segm AP = 0.00 after 1 flip, bbox AP50 = 0.02 after 2 flips (AR(2) = 96.75%). The deeper backbone provides marginal additional robustness, but the qualitative outcome—near-total functional collapse—is identical.

YOLOv8-seg (Table 3):

Clean bbox AP = 0.33. After 1 flip: 0.05 (AR(1) = 83.66%). After 2 flips: 0.05 (AR(2) = 86.33%).
Clean segm AP = 0.05. After 1 flip: 0.01 (AR(1) = 77.80%). After 2 flips: 0.01 (AR(2) = 80.51%).
YOLOv8-seg is more resilient than Mask R-CNN—83.66% AR(1) vs. 97.36%—but the remaining detection AP of 0.05 still represents severe degradation (an 83.66% relative reduction). The paper notes that even at k = 2, detection AP remains at 0.05, suggesting a partial floor effect: some coarse detection capability survives even as the backbone is corrupted.

Qualitative failure modes (Figure 8): The paper provides two illustrative examples of how the corrupted models fail:

Mask R-CNN-R101 with 1 flip (Figure 8, left panels): The model correctly localizes and segments a dog but assigns it the wrong semantic class. The paper explains this as a consequence of the attack protocol: "This is consistent with our attack protocol, which modifies only the backbone while leaving the task-specific heads untouched: localization and mask prediction can remain plausible even when the semantic representation has been corrupted."
YOLOv8-seg with 1 flip (Figure 8, right panels): The model fails to detect the dog and instead hallucinates a bird detection on the tail. The paper describes this as "complete object-level failure with hallucinated detection."

These distinct failure modes—semantically incorrect but spatially plausible prediction vs. complete object hallucination—demonstrate that backbone corruption does not simply produce random outputs; it systematically breaks the model's semantic understanding while partially preserving its spatial reasoning, with the specific manifestation depending on the detection architecture.

Language Models: Reasoning LLMs on MATH-500

The paper evaluates three reasoning LLMs on a 50-question MATH-500 subset. Results are reported in Table 1, with representative corrupted generations in Figure 5.

Qwen3-30B-A3B (Mixture-of-Experts): Clean accuracy = 78%. This is the paper's most striking LLM result:

DNL (first 5 blocks): 2 sign flips → 100.0% AR (accuracy drops from 78% to 0%).
1P-DNL (first 5 blocks): 1 sign flip → 71.8% AR, 4 sign flips → 100.0% AR.
DNL (all layers): 7 flips → 100.0% AR (less efficient than the first-five-block restriction).
1P-DNL (all layers): Never reaches 90% AR up to k = 100 (much weaker than the targeted approach).

The critical insight is that the first-five-block restriction is essential for this model—when all layers are available as candidates, DNL requires 7 flips instead of 2, and 1P-DNL actually fails to reach 90% AR even at k = 100. This demonstrates that early-layer targeting is not merely a convenient heuristic but can be necessary for attack success: when the candidate pool includes later layers, the magnitude sorting may select large-magnitude weights in those layers that are relatively benign to flip, wasting the limited flip budget on non-critical parameters.

Analysis of which experts were targeted: The paper reports that the top two DNL sign flips target "two different expert down-projection weights, one in layer 3 expert 82 and one in layer 1 expert 68." Both are early-layer experts in different layers, consistent with the early-layer targeting principle. The fact that flipping weights in two different experts (not the same expert, and not the router) causes total collapse is significant: it suggests the disruption is not a simple routing failure (where tokens get sent to a corrupted expert) but rather a latent representation corruption that poisons the hidden state early in the network and propagates through all subsequent computation, including through attention layers that mix information across positions.

Qwen3-4B: Clean accuracy = 86%:

DNL (first 5 blocks): 30 flips → only 2.3% AR. This is the most resilient configuration: even 30 targeted sign flips cause almost no damage when restricted to the first 5 blocks.
1P-DNL (first 5 blocks): 28 flips → 95.3% AR. The gradient refinement dramatically improves efficacy, from near-zero to near-total collapse.
DNL (all layers): 14 flips → 100.0% AR. Unlike Qwen3-30B-A3B, Qwen3-4B is more vulnerable when all layers are targeted than when restricted to early layers.
1P-DNL (all layers): 4 flips → 95.3% AR. The most efficient attack on this model: only 4 sign flips with gradient refinement cause 95%+ accuracy reduction when all layers are available.

This model-specific reversal—Qwen3-30B-A3B benefits from early-layer restriction, Qwen3-4B benefits from all-layer targeting—is an important negative result for the universality of the early-layer heuristic in language models. The paper acknowledges this: "the best layer scope is not universal." It suggests that the optimal targeting strategy depends on model-specific properties (possibly the distribution of weight magnitudes across layers in dense vs. MoE architectures), and that no single fixed L is optimal for all LLMs.

Nemotron Nano 8B: Clean accuracy = 94%:

DNL (first 5 blocks): 32 flips → 100.0% AR.
1P-DNL (first 5 blocks): 17 flips → 100.0% AR.
DNL (all layers): 87 flips → 93.2% AR (much less efficient than the first-five-block restriction).
1P-DNL (all layers): Never reaches 90% AR up to k = 100.

Like Qwen3-30B-A3B, Nemotron Nano is more vulnerable under the early-layer restriction, and 1P-DNL approximately halves the required flip count compared to DNL in this setting (17 vs. 32).

Random sign flips on LLMs (Section 4.1): The paper reports that random sign flips are "far weaker" than targeted flips but "less negligible than in our vision experiments":

Qwen3-30B-A3B (first 5 blocks): retains 70% accuracy after 27 random flips.
Qwen3-4B (first 5 blocks): retains 80% accuracy after 100 random flips.
Nemotron Nano (first 5 blocks): retains 92% accuracy after 100 random flips.

The paper hypothesizes that "autoregressive generation can compound even modest hidden-state corruption over time," explaining why random flips have some measurable effect on LLMs (unlike vision models where 100,000 random flips do nothing) but still nowhere near the catastrophic collapse from targeted flips.

Corrupted generation analysis (Figure 5): The paper provides abridged outputs that illustrate why accuracy collapses to zero:

DNL with 2 flips on Qwen3-30B-A3B produces "I'm going to help you with the solution." repeated indefinitely—the model degenerates into repetitive boilerplate rather than near-miss mathematical reasoning.
1P-DNL with 4 flips produces "Hello, I am a student, I am a student, I am a student..."—similarly repetitive, nonsensical text.

The paper notes: "These failures are not near-miss mathematical errors; the model quickly collapses into repetitive, nonsensical text." This qualitative observation supports the claim that the corruption is not task-specific (MATH-500) but represents a fundamental breakdown of the model's language generation capability—the same corruption mode would likely transfer to any generation benchmark.

Exponent-bit attacks on LLMs (Appendix C.1): A complementary finding is that exponent-bit flips can be even more destructive than sign flips for language models. In the first-five-block setting, a single targeted exponent flip reduces all three models to 0% accuracy under both DNL and 1P-DNL. Random exponent flips are also highly destructive: a single random exponent flip drops Qwen3-30B-A3B to 6% accuracy. The paper explains: "One likely reason for the strength of exponent attacks is that they alter the exponent field itself and can therefore induce extreme rescaling rather than a simple sign inversion." A specific example: a single rank-check exponent flip in model.layers.3.mlp.experts.82.down_proj.weight introduces a non-finite (NaN/Inf) parameter that causes corrupted multilingual/gibberish output.

Mixture-of-Experts dynamics under attack: The paper provides a fascinating detail about how the MoE architecture fails under attack. For the Qwen3-30B-A3B exponent flip example, "the attacked expert is used during prefill, yet the response becomes gibberish immediately from the first generated tokens onward, even though the first several generated tokens do not route through that expert." This means the corruption propagates through the hidden state across token positions, not merely through the expert routing mechanism. The attacked expert is routed on only 4.14% of tokens overall—yet this minority of corrupted computations is sufficient to poison the entire generation. The paper interprets this as "corrupted hidden states propagating forward through attention, so that harming an expert that is not used on every generated token can still derail the entire response."

Encoder-Based Text Classification: GLUE Tasks

The paper extends the language model evaluation to encoder-only architectures fine-tuned on text classification tasks. Results are in Table 2.

Configuration: BERT, DistilBERT, and RoBERTa fine-tuned on MRPC (paraphrase detection), QNLI (question-answer inference), and SST-2 (sentiment analysis). The metric reported is mAR(10)—the mean accuracy reduction over the first 10 attack configurations (flip budgets k = 1 through k = 10).

Key findings:

Across all nine model-task pairs, mAR(10) ranges from 69.99% (RoBERTa on MRPC) to 83.07% (DistilBERT on SST-2).
The strongest average degradation is on DistilBERT + SST-2 (mAR(10) = 83.07%), followed by BERT + SST-2 (82.43%).
The most resilient configuration is RoBERTa + MRPC (69.99%), still representing severe degradation.
The paper notes: "The shared sensitivity of both model classes to bit-level perturbations suggests that even simple sign inversions can substantially degrade performance."

These results extend the cross-domain picture from autoregressive decoder-only LLMs to bidirectional encoder-only models. The vulnerability does not depend on the autoregressive generation mechanism that compounds errors over time (which the paper hypothesized might explain LLMs' sensitivity to random flips); it is present even for models that process the entire input in parallel and output a single classification decision.

Impact of Model Size on Attack Success

The paper evaluates whether larger models are more or less vulnerable to sign-flip attacks by comparing DNL and 1P-DNL across five model families with varying parameter counts: ResNet (18 through 152), RegNet-Y (400MF through 32GF), EfficientNet (B0 through B7), ConvNeXt (Tiny through Large), and ViT (Tiny through Base). Results are in Figures 14 and 15 (Appendix).

Key finding: "Model size does not exhibit a clear correlation with attack susceptibility. Most models collapse at similar levels regardless of their scale." The scatter plots in Figures 14 and 15 show AR on the y-axis against model parameter count on the x-axis, with points from all five families clustered in the 80–100% AR range for both DNL and 1P-DNL, with no visible trend toward higher or lower vulnerability as parameter count increases from ~4M (ViT-Tiny) to ~88M (EfficientNet-B7) and beyond.

This is a non-obvious result: one might expect larger models to be more robust because they have more redundancy (more parameters to absorb corruption) or more vulnerable because they have more parameters that could be critical. The empirical evidence shows neither—the vulnerability is driven by architectural structure (where the large-magnitude early-layer weights are) rather than by model scale.

Model Size Scaling Visualizations

Figures 14 and 15 (Appendix) provide family-level breakdowns:

Figure 14 (1P-DNL): AR values cluster in the 85–100% range for nearly all models across all five families. The only models below 80% AR are EfficientNet-B4, EfficientNet-B5, and EfficientNet-B7, which show intermediate vulnerability (50–75% AR range) under 1P-DNL—consistent with the per-model results in Table 11 that showed these architectures require more flips for collapse.

Figure 15 (DNL): AR values are more distributed, ranging from ~20% to 100%. EfficientNet-B4 through B7 show notably lower AR (20–40%) under DNL than under 1P-DNL, consistent with Table 10 showing these models are relatively resilient to pass-free magnitude-only attacks. RegNet-Y models span the widest range (~40–95%), while ViT and ConvNeXt consistently show high vulnerability (>90% AR for most variants).

The key takeaway from these scaling analyses is that architectural family matters more than scale—ViTs and ConvNeXts are consistently brittle regardless of size, while EfficientNet-B4/B5/B7 are relatively resilient regardless of their larger parameter counts. This reinforces the paper's architectural-criticality thesis: vulnerability is a structural property of how weights are organized in early layers, not a function of how many weights exist.

Ablation Studies and Robustness Checks

One-flip-per-kernel constraint (Appendix B, quantitative examples): The paper provides two specific examples demonstrating that multiple flips in the same kernel can partially cancel each other:

MobileNetV3-Large: Magnitude-based selection for k = 2 picks two weights in different layers (AR(2) = 81.31%). For k = 3, adding another magnitude-based weight that happens to be in the same kernel as one of the first two reduces the degradation to AR(3) = 46.97%. However, selecting the next-highest-magnitude weight from a different kernel instead yields AR(3) = 94.0%—nearly double the damage from the same number of flips.
RegNet-Y 16GF: In the second convolutional layer, several top-10 highest-magnitude weights reside in the same kernel. Flipping the sixth highest weight yields AR(6) = 74.2%; also flipping the seventh highest (same kernel) reduces accuracy to AR(7) = 66.5%—the attack becomes less effective with an additional flip.

These examples directly validate the constraint's importance: without it, DNL would sometimes waste flips on weights that partially cancel each other's damage, reducing attack efficiency.

Layer-specific targeting (Figure 4, Table 4b): The paper systematically tests the effect of restricting flips to different numbers of initial layers:

Figure 4a (global trend): Boxplots of mAR(10) across 48 models when flips are restricted to the first l layers for l ∈ {1, 2, 3, 5, 10}. As l increases, median mAR(10) increases and variance decreases. Targeting only the first layer (l = 1) produces highly variable results (some models collapse, others are unaffected); l = 10 produces consistently high damage with low variance.
Table 4b (ShuffleNetV2 case study): This is the crucial demonstration of why layer scoping matters beyond pure magnitude ranking. When targeting the globally largest weights (all layers), ShuffleNetV2's top-1/2/3/5/100 largest parameters achieve AR of only 0.13%/0.15%/0.24%/0.39%/0.48%. But when those same magnitude-ranked parameters are restricted to the first 10 layers, AR(1) = 93.9%, AR(2) = 99.6%, AR(5) = 99.8%. When restricted to the first 100 layers (effectively all layers), AR(1) = 0.19%, AR(2) = 0.24%, AR(5) = 0.48%. The paper explains: "many models such as ShuffleNetV2 exhibit a different pattern: their largest parameters are concentrated in later layers." Targeting later layers is ineffective; targeting early layers is catastrophic. The layer scoping heuristic is specifically addressing this architectural pattern where naive magnitude ranking would fail.

Weight score ablation: comparison of 1-pass saliency methods (Appendix D, Figure 9): This ablation compares 1P-DNL's hybrid score against five alternative parameter scoring functions, all evaluated under the same one-pass budget on 48 ImageNet models:

Magnitude-only (S(θ_i) = |θ_i|): Median mAR(10) ≈ 55%.
GraSP (gradient signal preservation, Wang et al., 2020): Median mAR(10) ≈ 50%, with some models below 0% AR (flipping the selected weights actually improves accuracy on a few architectures).
GraSP with Gauss-Newton approximation: Median mAR(10) ≈ 30%, notably worse than the original GraSP.
SynFlow (S(θ_i) = |θ_i · g_i|, Tanaka et al., 2020): Median mAR(10) ≈ 45%.
Optimal Brain Damage (OBD) (S(θ_i) ≈ 1/2 θ_i^2 H_{ii}, LeCun et al., 1989): Median mAR(10) ≈ 50%.
1P-DNL first-order only (hybrid score without the 1/2 θ_i^2 H_{ii} term): Median mAR(10) ≈ 70%.
1P-DNL full (hybrid score with all terms): Median mAR(10) ≈ 80%.

The paper notes: "certain models are vulnerable to second-order-based scores (e.g., OBD) even when they prove more resilient to pure magnitude-based attacks. Nevertheless, other architectures appear more robust against OBD or GraSP while showing larger drops under magnitude-based score." The hybrid score's superiority comes from combining both signals: magnitude captures what is universally predictive, while the gradient terms capture model-specific sensitivity that magnitude alone misses.

Sign-bit vs. exponent-bit flips in vision models (Appendix C, Table 8): This ablation compares the destructive power of flipping sign bits vs. the most significant exponent bit at k = 10 across 11 representative architectures:

Sign flips are stronger on average: For VGG-11, sign AR(10) = 91.8% vs. exponent AR(10) = 53.9%. For ViT-B/16, sign = 99.8% vs. exponent = 82.4%. For EfficientNet-B0, sign = 95.8% vs. exponent = 37.4%.
Exceptions exist: ResNet-18 shows sign AR(10) = 70.6% vs. exponent AR(10) = 99.9%—exponent flips are stronger. ResNet-34 similarly favors exponent. AlexNet also favors exponent (99.8% vs. 88.5%).
The mAR(10) comparison (mean over k = 1, ..., 10) shows sign flips produce higher damage on 7 of 11 models; exponent flips are stronger on ResNet-18, ResNet-34, Inception-V3, and AlexNet.

The paper's conclusion that "sign-bit flips are typically the most consistently destructive choice at low budgets in vision" is supported on most architectures, but the exceptions (particularly ResNet-18/-34) indicate that the optimal bit type is architecture-dependent even within vision. The paper focuses on sign bits because they provide the "cleanest" failure mode—the weight negation is semantically interpretable (feature inversion) rather than the extreme magnitude changes that exponent flips produce.

Seed sensitivity for 1P-DNL (Appendix F): Over 10 random seeds on five representative architectures (ConvNeXt-B, RegNetY-400MF, ResNet-50, EfficientNet-B0, ViT-B/16), the standard deviation in accuracy reduction is 0.02. This is negligible compared to the induced drops (typically 50–100% AR), confirming that 1P-DNL's single source of randomness (the random input) does not meaningfully affect attack outcomes. The paper does not report per-model variance or confidence intervals.

Selective defense against BFA (Table 5, expanded in Appendix H, Figures 16–17): This defense experiment validates that DNL correctly identifies critical parameters by testing whether protecting those parameters reduces the damage from BFA (an independent, gradient-based attack):

ResNet-18: No defense: BFA AR(10) = 88.87%. Protecting ~0.001% of parameters (100 weights, selected by DNL scoring): AR(10) = 58.83%. Protecting ~1% (100K weights): AR(10) = 0.00%.
ResNet-50: No defense: 93.87%. Protecting ~0.001% (250 weights): 39.08%. Protecting ~1% (250K): 1.30%.
MobileNet-V2: No defense: 99.90%. Protecting ~0.001% (30 weights): 99.80% (barely any reduction). Protecting ~1% (30K): 44.30%.
ViT-B/16@224: No defense: 82.30%. Protecting ~0.001% (900 weights): 40.51%. Protecting ~1% (900K): 0.21%.

The varying effectiveness reveals that critical parameters are more concentrated in ResNet architectures (0.001% protection halves damage) than in MobileNet-V2 (0.001% protection does almost nothing, 1% still leaves 44.3% AR), consistent with MobileNet-V2's depthwise-separable convolution structure distributing importance across more parameters.

Random vs. selective protection (Figure 17): Protecting a random subset of sign bits (1%, 5%, 10%, 20%) provides minimal defense against 100,000 random sign flips. Even at 20% coverage, mAR(100,000) remains high (~85%). In contrast, selective protection of DNL-identified parameters (Figure 16) at just 1% coverage dramatically reduces AR(100,000) to near zero. This confirms that which bits are protected matters far more than how many.

Defense evasion: existing defenses against DNL (Section 6):

Binarization: Binary ResNet-18 evaluated under DNL shows AR(1) = 0.14%, AR(3) = 60.71%, AR(5) = 90.35%, AR(10) = 96.50% (Table 9). Binarization offers "negligible protection"—the sign bit still inverts the weight from +1 to -1 or vice versa, which is equally destructive in a binary-weight network.
Weight-scaling: Mathematically shown to have zero effect on sign flips: -cθ / c = -θ. Empirically confirmed with unchanged AR.
DeepNcode (encoding-based): The paper describes a gray-box bypass where the attacker searches for the closest alternative codeword whose decoded value has the opposite sign, effectively performing a sign flip through the encoding layer.

Cross-domain qualitative failure analysis:

Vision models (Figure 1, Figure 3, Figure 8): The paper provides visualizations showing that sign flips in early kernels destroy edge-detection capability, producing systematically wrong but structurally coherent feature maps. The failure is not random noise but corrupted semantic processing.
Language models (Figure 5): The failure mode is repetitive text generation—"I'm going to help you with the solution" loops or "I am a student" repetitions—indicating a fundamental breakdown of the autoregressive generation mechanism rather than task-specific reasoning errors.

Critical Assessment

Claim 1: DNL can catastrophically disrupt neural networks with very few sign-bit flips, without data or optimization.

This claim is strongly supported by the breadth and consistency of the experimental evidence. The paper demonstrates catastrophic degradation (AR > 90%) across 48 ImageNet models (Figure 2c, Tables 10–11), 4 additional vision datasets (Figures 6–7), 2 object detection architectures (Table 3), 3 reasoning LLMs (Table 1), and 9 encoder-model-task combinations (Table 2). The flip counts required are genuinely small—single digits for most architectures—and the degradation is not marginal (e.g., 99.8% AR on ResNet-50) but near-total functional collapse.

However, there is an important distinction between existence and universality. The paper convincingly demonstrates that this vulnerability exists across diverse architectures and domains, but does not establish that every architecture at every scale and on every task is equally vulnerable. The EfficientNet-B4/B5/B7 results under DNL (Table 10) show low AR at k ≤ 9 (0.4–25%), with collapse only at k = 10. The Qwen3-4B result under DNL with first-five-block targeting shows only 2.3% AR even at k = 30 (Table 1). These are not counterexamples to the claim—the claim is about existence, not uniformity—but they indicate that some architectures require more flips or benefit from gradient refinement (1P-DNL) to achieve catastrophic damage.

The "without data or optimization" part of the claim is validated by the explicit threat model and the experimental protocol: DNL uses only the stored weight magnitudes (readable from memory), with no forward passes, no gradient computation, and no knowledge of the training distribution. The comparison to prior methods (Table 4, Table 7) shows that DNL achieves comparable or superior damage while satisfying a strictly more restrictive threat model.

One weakness: the paper does not evaluate DNL against models that have been explicitly hardened or adversarially trained. All evaluated models are standard pre-trained checkpoints. It is possible that models trained with specific defenses (e.g., weight clipping, spectral normalization, gradient regularization) would distribute criticality differently and be less vulnerable to the magnitude heuristic. The paper shows that existing defenses (binarization, weight-scaling, encoding) are ineffective, but these are defenses against bit flips, not defenses against the specific mechanism DNL exploits (concentration of functional importance in high-magnitude early-layer weights).

Claim 2: The vulnerability spans multiple domains—image classification, object detection, segmentation, and reasoning language models.

Supported with important domain-specific caveats. The experimental evidence across domains is comprehensive and convincing: the same heuristic principles (large magnitude, early-layer targeting, one-per-kernel for CNNs) cause collapse in all tested domains. However, the paper's own results reveal important domain-specific differences that are not prominently highlighted in the abstract or introduction:

The optimal bit type is domain-dependent. The paper focuses primarily on sign bits, but Appendix C.1 shows that exponent-bit flips can be more destructive in language models—a single exponent flip collapses all three tested LLMs to 0% accuracy, while sign flips require 2–32 flips depending on the model and targeting. This is not a failure of the claim but a qualification: the "same" attack mechanism (targeting sign bits of high-magnitude early-layer weights) is not universally optimal; the bit type should be chosen per-domain.
The optimal layer scope is model-dependent within LLMs. Qwen3-30B-A3B and Nemotron Nano are most vulnerable when targeting is restricted to the first 5 blocks; Qwen3-4B is more vulnerable when all layers are targeted (Table 1). The paper acknowledges this but does not provide a principled explanation for when early-layer restriction helps vs. hurts, making the heuristic less predictive for LLMs than for vision models (where L = 10 universally improves over all-layer targeting).
The one-flip-per-kernel constraint is CNN-specific. This is by design—the constraint exploits spatial structure in convolutional kernels that does not exist in transformer attention or MLP layers—but it means the attack is not fully "domain-agnostic" in implementation, only in high-level principle.

Claim 3: 100,000 random sign flips produce negligible degradation, while 10 targeted flips cause collapse—only a tiny fraction of parameters are critical.

Strongly supported by the random-flip baseline (Figure 2a). The boxplot showing 100,000 random sign flips with near-zero median AR across 48 models is one of the paper's most visually compelling results and directly establishes that the vulnerability is about targeting, not about fragility to perturbation in general. The contrast between this baseline and the targeted results (Figures 2b, 2c) is stark.

A potential concern: the random flips are applied uniformly across all parameters, including layers beyond the first 10. The paper does not report a baseline of random flips restricted to early layers to test whether early-layer restriction alone (without magnitude ranking) would produce substantial damage. If random flips in early layers caused moderate degradation, that would weaken the claim that magnitude ranking specifically is essential. However, the magnitude-only ablation (Figure 2b) shows that pure magnitude ranking outperforms random selection substantially, confirming that magnitude matters beyond layer placement.

Claim 4: DNL circumvents existing defenses including binarization, redundancy-coding, and weight-scaling.

Supported but with narrow evaluation. The paper evaluates three defense classes, each with one representative method:

Binarization: Evaluated on one model (ResNet-18), showing 96.50% AR(10) under DNL (Table 9). The result is convincing for this specific binary network, but the paper does not test whether other binary network training methods (e.g., those with different weight distributions or regularization) would be more robust.
Weight-scaling: Shown analytically to have no effect on multiplicative sign flips, with empirical confirmation. This is a clean, definitive result.
DeepNcode: Discussed conceptually in a gray-box setting, but no quantitative experimental results are reported. The paper describes a theoretical bypass (search for the closest codeword with opposite-sign decoded value) but does not implement and evaluate this attack against DeepNcode-protected models. This is a significant gap—the claim that DNL "circumvents" encoding defenses is argued but not experimentally demonstrated.

Claim 5: Selectively protecting a small fraction of vulnerable sign bits provides a practical defense.

Supported, but as a proof of concept rather than a deployment-ready defense. Table 5 and Figures 16–17 convincingly demonstrate that protecting DNL-identified parameters reduces BFA's damage, and that selective protection dramatically outperforms random protection at the same coverage level. The key finding—protecting 0.001% of parameters halves BFA's impact on ResNet-18 and ResNet-50—is striking.

However, the defense is evaluated against BFA, not against DNL itself. BFA is an iterative gradient-based attack with a different bit-selection mechanism; it may be searching for the same critical parameters that DNL identifies, so protecting those parameters deprives BFA of high-impact targets. But an attacker using DNL directly would also know which parameters are protected (in a gray-box setting) and could target the next-ranking unprotected parameters. The paper does not evaluate whether the remaining unprotected parameters—once the top 0.001–1% are shielded—would still be sufficient for an attacker to cause significant damage using the same DNL heuristics applied to the unprotected subset.

Additionally, the defense assumes the defender can accurately identify critical parameters before deployment. This requires either running DNL on the trained model (which requires weight access but no data—feasible) or using a different selection criterion. The paper does not discuss how a defender would operationalize this, or whether protected parameters would remain critical across model updates or fine-tuning.

Missing experiments that would strengthen the paper:

Gradient-based attack comparison on all 48 models, not just 4. Table 4 compares DNL to BFA/DeepHammer/ZeBRA on only VGG-11, ResNet-50, MobileNet-V2, and ViT-B/16. Extending this comparison to the full 48-model set would provide a more robust demonstration that DNL's lightweight heuristics consistently match or exceed optimization-based methods. The current comparison risks cherry-picking—the four chosen models may be those where DNL performs especially well.
Evaluation against BFA on the additional datasets (DTD, FGVC-Aircraft, Food101, Stanford Cars, COCO, MATH-500, GLUE). All cross-domain results compare DNL only to random baselines and magnitude-only ablations, not to prior attack methods. This makes it impossible to assess whether DNL is genuinely better than optimization-based attacks in these domains, or whether the prior methods would perform similarly if tested.
Systematic layer-by-layer vulnerability analysis for LLMs. The paper reports that early-layer targeting helps Qwen3-30B-A3B and Nemotron Nano but hurts Qwen3-4B, without explaining why. A per-layer ablation (damage from flipping the single largest-magnitude weight in each layer independently) would reveal whether the critical parameters are genuinely concentrated in early layers for some LLMs but distributed for others, or whether the finding is an artifact of DNL's magnitude heuristic interacting differently with the weight distributions of different architectures.
Sensitivity to the number of targeted layers L. The paper selects L = 10 "for simplicity" and shows that any L in {1, 2, 3, 5, 10} outperforms all-layer targeting (Figure 4a). But the choice of L = 10 is arbitrary. An ablation sweeping finer-grained L values (e.g., 1 through the full depth for specific architectures) would reveal whether there is an optimal L that could further improve attack efficiency, and whether L = 10 is genuinely near-optimal or a convenient round number.
The cost of difficulty estimation (or parameter selection) is not accounted for. DNL's zero-pass cost is $O(|\theta|)$ for reading weights plus $O(|\theta_L| \log |\theta_L|)$ for sorting early-layer parameters. For very large models (billions of parameters), even reading all weights from storage may be non-trivial (disk I/O, memory bandwidth). The paper does not discuss whether this cost is realistic in the hardware attack scenarios it motivates, nor whether an attacker with only partial parameter access (e.g., through a Rowhammer attack targeting specific memory rows) could implement DNL without reading the entire parameter file.
No evaluation of attacks against defended models (except binarization). The paper shows DNL bypasses existing defenses, but does not test an end-to-end scenario where a model is deployed with the paper's own proposed defense (selective protection) and then attacked. This is the most practically relevant experiment and its absence is notable.

Test set size and statistical reliability concerns:

The language model evaluation uses only 50 questions from MATH-500. A 0% accuracy on 50 questions is a strong signal, but for models where the clean accuracy is 78% (Qwen3-30B-A3B), the 95% confidence interval on a 50-question test set is approximately ±11 percentage points. This means reported AR values have non-trivial uncertainty that is not reported.
The ImageNet evaluation uses the standard 50,000-image validation set, which provides tight confidence intervals for accuracy measurements. However, the AR values are single-point estimates without error bars.
The GLUE evaluations use the standard test sets for each task (MRPC: 1,725 test pairs, QNLI: 5,463 test pairs, SST-2: 1,821 test sentences). These are reasonably sized but the paper does not report confidence intervals.
The COCO evaluation uses the standard 5,000-image validation set.

Overall assessment of experimental strength: The paper's experimental contribution is the breadth and consistency of its findings across an unusually wide range of architectures, tasks, and domains, rather than the depth of analysis on any single benchmark. The core claim—that heuristically targeted sign-bit flips can catastrophically damage neural networks without data or optimization—is supported by overwhelming empirical evidence. The secondary claims about defense evasion and cross-domain universality are supported but with caveats about domain-specific differences and limited adversarial baselines in non-ImageNet domains. The most significant experimental gap is the absence of direct head-to-head comparisons with prior attack methods (BFA, DeepHammer, ZeBRA) on the non-ImageNet benchmarks, which would transform the cross-domain results from existence proofs into genuine claims of superiority.

6. Limitations and Trade-offs

The Difficulty Estimation Cost Is Unaccounted for and Dominates the Attack Budget in Deployment

The assumption or constraint. The DNL attack—in both its pass-free and 1-pass variants—requires the attacker to read all weights from the target model, sort them by magnitude, and (for 1P-DNL) perform one forward and backward pass. The paper's headline efficiency claims (e.g., "zero-pass," "single-pass," "4× more efficient than BFA" in Table 7) measure only the algorithmic complexity of the scoring and selection steps, not the total cost of executing the attack in a realistic deployment scenario. The pass-free variant is described as requiring "no additional computational passes" and having complexity O(|θ|) + O(k) (Table 7), but this O(|θ|) term represents reading every single parameter from memory or storage—an operation whose wall-clock time and energy cost scale linearly with model size, potentially dominating the attack budget for large models.

The paper acknowledges this implicitly in the Limitation section (Section 7): "DNL assumes that an adversary can directly modify a small number of stored parameters. In deployments where only part of the model is writable or addressable—for example because parameters are sharded, compartmentalized, or only partially exposed—the attack may be less effective." However, the paper does not discuss the cost of the prerequisite read phase, nor does it account for this cost in any experimental measurement.

The consequence. For large models—particularly the language models the paper evaluates—reading all parameters from storage is a non-trivial operation. Qwen3-30B-A3B has approximately 30 billion parameters stored in FP32, requiring roughly 120 GB of memory reads. In an attack scenario where the attacker gains access through a Rowhammer exploit or DMA attack, reading 120 GB of memory is not "free"—it consumes time, generates memory bus traffic that could trigger anomaly detection, and may be infeasible if the attacker only has access to specific memory regions rather than the full parameter space. The paper's complexity analysis in Table 7 (O(|θ|) + O(k) for DNL) is asymptotically correct but misleading in constant factors: for a 30B-parameter model, O(|θ|) means reading and processing 30 billion floating-point numbers before any flips occur. This is not a "lightweight" operation in any practical sense.

Furthermore, many hardware attack vectors the paper cites (Section 2) provide write access to specific memory locations—Rowhammer flips bits in adjacent DRAM rows, DMA attacks write to exposed memory regions, and voltage glitching targets specific registers—but do not necessarily provide bulk read access to the entire parameter space. An attacker exploiting Rowhammer may be able to flip bits at specific addresses they have identified through memory probing, but may not have the ability to read the entire model, sort all weights by magnitude, identify the top-k, and then target those specific addresses. The paper's threat model (Section 2) states the attacker has "write access to the stored parameters" but does not explicitly guarantee read access to all parameters, which is a stronger requirement.

What evidence exists in the paper. No experiment measures the wall-clock time, energy cost, or memory bandwidth consumption of the parameter-reading phase. The complexity table (Table 7) reports asymptotic scaling, not practical cost. The Limitation section (Section 7) acknowledges the partial-access problem but does not discuss the read-cost problem. The seed sensitivity analysis (Appendix F) measures only the variance from 1P-DNL's random input, not the cost of reading the model.

Mitigation status. The paper does not address this limitation. It does not propose incremental read strategies (e.g., reading only early layers, sampling parameters, or using memory layout information to estimate which addresses contain high-magnitude weights). It also does not discuss whether hardware attack vectors that enable bit writes also enable bulk reads, or whether the attack can be executed with write-only access by exploiting knowledge of parameter memory layouts. This is a significant gap for any practitioner evaluating the real-world feasibility of the attack.

The Optimal Targeting Strategy Is Model-Dependent and Not Predicted by the Paper's Heuristics

The assumption or constraint. The paper presents DNL as a universal attack strategy: target high-magnitude weights in the first L layers, with one flip per kernel for CNNs. For the 1-pass variant, incorporate gradient information from a single random input. The paper's evaluation uses a fixed L = 10 for vision models and L = 5 blocks for language models "for simplicity" (Section 3). The underlying assumption is that early-layer targeting is universally optimal or near-optimal, and that the specific choice of L does not critically affect outcomes.

The consequence. The paper's own results reveal that this assumption does not hold—and that when it fails, it can fail catastrophically:

Qwen3-4B (Table 1): Under DNL with first-5-block targeting, AR(30) = 2.3%—essentially zero damage from 30 targeted flips. But under DNL with all layers targeted, AR(14) = 100.0%—total collapse. The early-layer restriction that makes Qwen3-30B-A3B and Nemotron Nano maximally vulnerable makes Qwen3-4B almost completely invulnerable. An attacker following the paper's recommended heuristic (target the first 5 blocks) would fail entirely on this model.
Qwen3-30B-A3B (Table 1): The opposite pattern: first-5-block targeting achieves AR(2) = 100.0% (total collapse with 2 flips), while all-layer targeting requires 7 flips for the same result, and 1P-DNL with all-layer targeting never reaches 90% AR up to k = 100.
EfficientNet-B5 (Tables 10, 11): Under DNL, mAR(10) = 7.8%—the most resilient of all 48 ImageNet models. Under 1P-DNL, mAR(10) improves dramatically. An attacker without gradient access (pass-free DNL) targeting this model with the paper's recommended heuristics would achieve minimal damage.

The paper acknowledges this variability but does not provide a principled method for predicting, a priori, which targeting strategy will work for a given model. The attacker in a realistic scenario—with no data access and no ability to evaluate the model—has no way to determine whether they should target early layers (which works for some models), all layers (which works for others), sign bits (optimal for most vision models), or exponent bits (optimal for some language models). The paper's fixed heuristics will fail on a non-trivial subset of models.

What evidence exists in the paper. Table 1 provides the clearest evidence: Qwen3-4B's vulnerability inverts depending on layer scope, and Qwen3-30B-A3B's 1P-DNL all-layer attack fails entirely. Appendix C, Table 8 shows that ResNet-18 and ResNet-34 are more vulnerable to exponent flips than sign flips (AR(10) = 99.9% for exponent vs. 70.6% for sign on ResNet-18). Tables 10 and 11 show wide variance in AR across models at the same flip budget—from 7.8% mAR(10) (EfficientNet-B5, DNL) to 99.7% (ViT-Tiny, DNL). The paper's Figure 4a shows that L = 1 targeting produces highly variable results (some models collapse, others are unaffected), indicating sensitivity to the specific L chosen.

Mitigation status. The paper does not attempt to address this limitation. It does not provide a diagnostic method for determining the optimal bit type, layer scope, or scoring function for an unseen model. The recommended heuristics are fixed (L = 10 for vision, L = 5 for language, sign bits, hybrid scoring for 1P-DNL) with no guidance on when to deviate. The paper frames this variability as an interesting observation rather than a failure mode of the method. For a practitioner trying to assess the security of a deployed model, this uncertainty means that the paper's headline numbers (e.g., "two sign flips collapse ResNet-50 by 99.8%") cannot be assumed to transfer to an arbitrary new architecture without empirical validation—validation that the attacker, by the paper's own threat model, cannot perform.

Hard Problems Remain Unsolved: The Attack Fails When Critical Parameters Are Distributed or Absent

The assumption or constraint. DNL's fundamental operating principle is that a small number of high-magnitude early-layer weights act as single points of failure for the entire model. This assumption is implicit in the design of the magnitude-based scoring heuristic and in the paper's focus on small flip budgets (k ≤ 10). The method assumes that critical parameters are concentrated in a small, identifiable subset of the early layers, and that flipping their sign bits will propagate catastrophic errors through the entire network.

The consequence. When this assumption fails—when criticality is distributed across many parameters or when no small set of parameters is disproportionately important—DNL fails to cause meaningful damage, even at relatively high flip budgets:

EfficientNet-B5 under DNL (Table 10): AR(1) = 0.0%, AR(5) = 4.2%, AR(10) = 22.2%. After 10 targeted sign flips—the maximum the paper typically evaluates—the model retains 77.8% of its original accuracy. The mAR(10) of 7.8% is the lowest across all 48 models. This is not a model that DNL "eventually" collapses; it is a model where the magnitude heuristic fundamentally fails to identify catastrophic parameters because the critical information is distributed across many weights, none of which individually dominate.
EfficientNet-B4 under DNL (Table 10): AR(1) = 0.4%, AR(9) = 9.4%, AR(10) = 97.8%. The attack shows essentially no damage for 9 flips, then a sudden collapse at flip 10. This indicates a threshold effect: critical parameters exist, but they are not the very top-ranked ones by magnitude, requiring more flips to reach them. At k = 9, the model is essentially unimpaired; at k = 10, it is destroyed. An attacker limited to k = 5 flips (a realistic constraint for hardware attacks) would conclude the attack failed on this model.
Qwen3-4B under DNL with first-5-block targeting (Table 1): AR(30) = 2.3%. Even 30 targeted flips cause essentially no damage in this configuration. This is not a gradual degradation—the model is nearly immune to the attack under this targeting strategy.
RegNet-Y 400MF (Tables 10, 11): AR(10) = 64.1% under both DNL and 1P-DNL. This is substantial damage but far from the 99%+ collapse seen in most other architectures, meaning the model retains 35.9% of its original accuracy—still functional for many applications—after the maximum evaluated flip budget.

In each case, the paper's method fails to achieve catastrophic damage within the small flip budgets that motivate its threat model. The existence of these resilient models demonstrates that the vulnerability DNL exploits is not a universal property of trained neural networks, but rather a variable property whose magnitude depends on architectural choices that the paper does not characterize or predict.

What evidence exists in the paper. Tables 10 and 11 provide per-model AR curves that directly show the failure cases. EfficientNet-B5 under DNL is the clearest counterexample to the claim of universal vulnerability: AR(10) = 22.2% with mAR(10) = 7.8%. Qwen3-4B under DNL with first-5-block targeting (AR(30) = 2.3%) is the clearest LLM counterexample. The model size scaling analysis (Figures 14, 15) shows that EfficientNet-B4/B5/B7 are consistent outliers with lower AR than comparably-sized models from other families, indicating an architectural rather than scale-dependent effect.

Mitigation status. The paper acknowledges these failure cases implicitly by reporting them in the per-model tables, but does not analyze why certain architectures are resilient or provide guidance for attackers facing such models. The 1P-DNL variant partially mitigates the problem for some EfficientNet variants (EfficientNet-B5 under 1P-DNL reaches 99.7% AR at k = 10, up from 22.2% under DNL), but does not help for RegNet-Y 400MF (AR(10) = 64.1% under both variants) or Qwen3-4B under first-5-block targeting. The paper does not propose alternative heuristics (e.g., combining sign and exponent flips, targeting different layer ranges, or using multiple random inputs for 1P-DNL) that might succeed where the primary method fails. The existence of resilient architectures is reported as data, not analyzed as a limitation.

The Language Model Evaluation Uses a 50-Question Test Set with No Statistical Reliability Quantification

The assumption or constraint. The paper's evaluation of reasoning language models (Section 4.1, Table 1) uses a "fixed 50-question subset of MATH-500." All accuracy measurements and AR calculations for Qwen3-30B-A3B, Qwen3-4B, and Nemotron Nano 8B are based on this 50-question sample. The paper reports headline numbers like "accuracy reduces from 78% to 0%" and "AR = 100.0%" without confidence intervals, standard errors, or any quantification of statistical uncertainty.

The consequence. With a 50-question test set, the 95% Wilson confidence interval for a reported accuracy of 78% (Qwen3-30B-A3B's clean accuracy) is approximately 65% to 87%—a width of 22 percentage points. For a reported accuracy of 0% after attack, the one-sided 95% confidence interval is approximately 0% to 7%. This means:

The clean accuracy of 78% could plausibly be anywhere from 65% to 87% if the 50 questions were resampled.
The post-attack accuracy of 0% could plausibly be up to 7%—meaning the true AR(2) = 100.0% for Qwen3-30B-A3B under DNL could be as low as 91% after accounting for sampling uncertainty.
The comparison between models (e.g., claiming Qwen3-30B-A3B is more vulnerable than Qwen3-4B) is confounded by the fact that the confidence intervals for their clean and post-attack accuracies overlap substantially.

This uncertainty matters because the paper's most dramatic LLM result—"two sign flips reduce Qwen3-30B-A3B from 78% to 0% accuracy"—is based on observing 0 correct answers out of 50 questions post-attack. This is consistent with the true post-attack accuracy being 0%, but it is also consistent with the true accuracy being 3–5% (getting 1 or 2 questions correct), which would change AR(2) from 100.0% to 93–96%. While still catastrophic, the precision of "100.0% AR" is misleading given the test set size.

The same concern applies to the GLUE evaluations (Table 2). MRPC has 1,725 test pairs, QNLI has 5,463, and SST-2 has 1,821—these provide tighter confidence intervals, but the paper still reports point estimates of mAR(10) without uncertainty quantification.

What evidence exists in the paper. Section 4.1 states the evaluation uses "a fixed 50-question subset of MATH-500." Table 1 reports AR values as point estimates. The paper provides no confidence intervals, no error bars, and no discussion of statistical power or minimum detectable effect sizes. The seed sensitivity analysis (Appendix F) addresses only 1P-DNL's input randomness on vision models, not the sampling uncertainty from the small test set on language models.

Mitigation status. The paper does not address this limitation. It does not justify the choice of 50 questions (vs. the full MATH-500 or other reasoning benchmarks), report confidence intervals, or discuss the implications of test-set size for the reliability of the reported AR values. For a practitioner evaluating whether their deployed language model is vulnerable to DNL, the absence of uncertainty quantification means the paper's numbers should be treated as approximate indicators rather than precise measurements. The qualitative conclusion—"targeted sign flips can catastrophically degrade LLM reasoning"—is supported by the evidence, but the specific flip counts needed and the exact AR values are subject to non-trivial sampling variance.

The Cross-Domain Comparison Lacks Head-to-Head Baselines Against Prior Optimization-Based Attacks

The assumption or constraint. The paper claims that DNL and 1P-DNL "match or exceed" prior weight-space attacks (BFA, DeepHammer, ZeBRA) while satisfying a more restrictive threat model. This claim is central to the paper's contribution: it establishes DNL not merely as a new attack but as a superior attack under a harder constraint set. For this claim to be validated, the paper must demonstrate that DNL achieves comparable or higher accuracy reduction than prior methods on the same models, tasks, and metrics.

The consequence. The paper provides direct comparisons with prior methods on only four ImageNet models: VGG-11, ResNet-50, MobileNet-V2, and ViT-B/16@224 (Table 4, expanded in Table 6). These are the only head-to-head comparisons where DNL's AR is measured against BFA's/DeepHammer's/ZeBRA's AR on identical architectures. For all other results—the 44 remaining ImageNet models, the four additional vision datasets (DTD, FGVC-Aircraft, Food101, Stanford Cars), the object detection and segmentation experiments (COCO), the reasoning language models (MATH-500), and the encoder-based text classifiers (GLUE)—the paper compares DNL only against random baselines and magnitude-only ablations, not against prior attack methods.

This means:

We do not know whether BFA, DeepHammer, or ZeBRA would achieve comparable or superior damage to DNL on the 44 ImageNet models not included in Table 4. The four compared models may be those where DNL performs especially well (selection bias).
We do not know whether prior attacks transfer to object detection, segmentation, or language modeling at all. If they do not, DNL's cross-domain results are genuinely novel. If they do, DNL's contribution is primarily efficiency (same damage with less computation), not capability.
The claim that DNL is "more efficient" than prior methods (Table 7) is based on asymptotic complexity analysis, not wall-clock measurements. For small models where the constant factors of iterative optimization are modest, BFA might run faster in practice than DNL's full-parameter-read-and-sort phase, despite worse asymptotic scaling.

The paper's most dramatic language model result—"two sign flips collapse Qwen3-30B-A3B from 78% to 0%"—is presented without any comparison to what BFA or equivalent gradient-based attacks would achieve on the same model. It is possible that BFA, given access to MATH training data (violating DNL's threat model, but within BFA's capability assumptions), could achieve the same collapse with even fewer flips, or that BFA would fail entirely on MoE architectures where gradient propagation through sparse expert routing is challenging.

What evidence exists in the paper. Table 4 provides the only head-to-head comparisons with prior methods (VGG-11, ResNet-50, MobileNet-V2, ViT-B/16@224). Table 6 extends this slightly with AlexNet and Inception-V3 (two additional models), bringing the total to 6 compared models out of 48+ evaluated architectures. All cross-domain experiments (Sections 4.1, 4.2, 4.3, 4.1 text encoders) lack adversarial baselines entirely—the only comparisons are to random flips and magnitude-only selection.

Mitigation status. The paper does not acknowledge this as a limitation. The abstract and introduction present the cross-domain results as evidence of a universal vulnerability without noting that prior methods were not evaluated in these domains. The complexity comparison (Table 7) focuses on asymptotic scaling, sidestepping the question of whether DNL's actual damage would be matched or exceeded by BFA if BFA were run on the same models. A practitioner evaluating defenses against weight-space attacks needs to know not just that DNL works, but whether it is the strongest known attack in the threat model—and without head-to-head comparisons on the specific model and task of interest, that question cannot be answered from this paper alone.

The Defense Evaluation Does Not Test Against DNL Itself and Assumes Attacker Ignorance of Protected Parameters

The assumption or constraint. The paper's proposed selective defense (Section 6, Table 5, Appendix H) is evaluated against the Bit-Flip Attack (BFA) (Rakin et al., 2019), not against DNL. The experimental design is: (1) use DNL to identify critical parameters, (2) protect those parameters (via replication or ECC), (3) run BFA against the protected model, and (4) measure how much BFA's damage is reduced. The implicit assumption is that protecting DNL-identified parameters will similarly impede DNL itself, because DNL and BFA target the same critical parameters (just identified through different mechanisms).

The consequence. This experimental design conflates two distinct questions: (1) Does DNL correctly identify parameters that are critical to model performance? (2) Does protecting those parameters defend against the specific attack that identified them? The BFA evaluation answers question (1) affirmatively—BFA's gradient-based search, running independently, is thwarted because DNL preemptively protected the high-impact targets BFA would have found. But it does not answer question (2): an attacker using DNL directly, who knows (or can infer) which parameters are protected, can simply skip those parameters and target the next-highest-magnitude weights in the unprotected set.

The paper's defense assumes a form of attacker ignorance: the attacker does not know which parameters are protected and continues to target (via BFA's gradient search) the now-protected critical weights. In a gray-box setting where the attacker can read the stored parameters (as DNL's threat model requires), the attacker can directly observe which parameters are protected (e.g., replicated bits would appear as multiple identical copies; ECC-encoded parameters would have a different memory layout). The attacker can then adapt: run DNL on the unprotected parameters only, selecting the highest-magnitude weights among those that remain writable. The paper provides no evaluation of this adaptive attack scenario.

Furthermore, Table 5 shows that the defense's effectiveness varies dramatically by architecture:

ResNet-18: 0.001% protection reduces BFA AR(10) from 88.87% to 58.83%. Protecting 1% nullifies the attack (0.00%).
MobileNet-V2: 0.001% protection barely helps (AR(10) drops from 99.90% to 99.80%). Even 1% protection leaves AR(10) = 44.30%.

This variability means the defender cannot simply "protect 1% of parameters and be safe"—the required protection fraction depends on how concentrated the criticality is, which varies by architecture in ways the paper does not characterize. For MobileNet-V2, an attacker facing 1% protected parameters can still cause 44.30% AR using BFA; against DNL directly (adaptively targeting unprotected weights), the damage could be higher.

What evidence exists in the paper. Table 5 reports BFA AR(10) under selective protection. Figures 16 and 17 compare selective vs. random protection against 100,000 random sign flips (not against DNL). The paper does not report any experiment where DNL itself is run against a protected model. The bypass description for DeepNcode (Section 6) shows the paper is aware of adaptive attacks in a gray-box setting, but this awareness is not applied to evaluating its own proposed defense.

Mitigation status. The paper does not address this limitation. It presents the defense evaluation as evidence that "DNL reliably identifies the most critical parameters—the very ones exhaustive BFA seeks to corrupt" (Section 6), which is a valid claim about DNL's diagnostic accuracy. But it does not evaluate whether protecting those parameters would actually defend against DNL itself in an adaptive attack scenario. For a practitioner deploying this defense, the relevant question is: "If I protect the top 1% of DNL-identified parameters, and an attacker runs DNL on the remaining 99%, how much damage can they cause?" This question is not answered by the paper's experiments.

7. Implications and Future Directions

How This Work Changes the Landscape

This paper fundamentally reframes the security analysis of deployed neural networks by demonstrating that catastrophic failure can be induced through a structural property of trained weights—high-magnitude early-layer parameters acting as single points of failure—rather than through optimization over data-dependent loss landscapes. This shifts the weight-space attack literature from a "search for critical bits" paradigm (BFA, DeepHammer, ZeBRA) to a "identify critical parameters by their architectural role" paradigm, with profound implications for both attack methodology and defense design.

The magnitude of the shift. This is best characterized as a diagnostic reframing rather than a paradigm shift. The paper does not introduce new attack mechanisms—bit flips have been studied since Terminal Brain Damage (Hong et al., 2019) and BFA (Rakin et al., 2019)—but it fundamentally changes how we understand why they work. Prior work treated criticality as an emergent property of the loss landscape to be discovered through gradient-guided exploration. DNL shows that criticality is largely predictable from the weight magnitudes and layer positions alone, without any loss landscape information, establishing that the vulnerability is an architectural and training-convergence artifact rather than a data-dependent phenomenon.

The evidence for this reframing is the paper's most striking negative result: 100,000 random sign flips produce near-zero accuracy reduction (Figure 2a), while 10 targeted flips cause near-total collapse (Figure 2c). If vulnerability were distributed across the parameter space, random flips would cause proportional damage. The fact that they don't—that the model is simultaneously robust to massive random corruption and fragile to pinpoint targeted corruption—is the diagnostic signature of concentrated functional importance. The pruning connection (Section 3) provides the theoretical language for this: the same $\theta_i^2 H_{ii}$ saliency that identifies safe-to-remove weights in OBD identifies catastrophic-to-flip weights in DNL, with the key empirical finding being that $H_{ii}$ is sufficiently regular within early layers that $|\theta_i|$ alone is an adequate proxy.

Reconciliation of prior contradictions. The paper resolves a latent tension in the bit-flip attack literature between exponent-bit attacks (TBD, BFA variants) and the sign-bit approach it advocates. Appendix C, Table 8 shows that the optimal bit type is domain-dependent: sign flips dominate in most vision models (VGG-11: 91.8% vs. 53.9% for exponent at k=10), but exponent flips are stronger on ResNet-18 (99.9% vs. 70.6%). Appendix C.1 extends this to language models, where a single exponent flip collapses all three tested LLMs to 0% accuracy. This resolves the apparent contradiction: prior work focused on exponent bits because they tested primarily on architectures where exponent flips are indeed more destructive (ResNet variants), while this paper's broader evaluation reveals that the optimal strategy is architecture-specific. The contribution is not "sign bits are better" but "the optimal bit type must be determined per-model, and for many vision architectures, sign bits are at least as destructive and simpler to target."

Which research directions become more attractive. The paper's demonstration that critical parameters can be identified without data or optimization makes hardware-aware security analysis the natural next step. Rather than studying attacks as abstract optimization problems, researchers can now ask: given a specific hardware attack vector (Rowhammer, voltage glitching, DMA) with known physical constraints (which bit positions are flippable, how many flips are achievable, what memory regions are accessible), which model architectures and parameter storage layouts are most vulnerable? The paper provides the parameter-criticality analysis; the missing piece is mapping that analysis onto the physical constraints of specific hardware exploits.

It also makes architectural robustness as a first-class design objective more attractive. The paper shows that EfficientNet-B5 is remarkably resilient to sign flips (mAR(10) = 7.8% under DNL, Table 10), while ViT-B/16 collapses with a single flip (AR(1) = 97.2%). This variability is not explained by model size (Figures 14, 15 show no scale correlation) but by architectural differences in how functional importance is distributed across parameters. Understanding why EfficientNet variants are more robust—is it the compound scaling, the squeeze-and-excitation blocks, the depthwise separable convolutions?—could inform the design of architectures that are inherently resistant to bit-flip attacks without explicit defensive mechanisms.

Which directions become less attractive. The paper renders data-dependent, iterative bit-search methods (BFA, DeepHammer) less attractive as practical attack tools, though they remain valuable as diagnostic instruments. Table 4 shows that DNL matches or exceeds BFA's damage on the four compared models while requiring zero forward passes and no data access. An attacker choosing between running hundreds of gradient computations on stolen validation data versus sorting a weight array by magnitude has an obvious choice. The asymptotic complexity comparison (Table 7) makes this quantitative: O(k × B × θ × m) for BFA vs. O(|θ|) + O(k) for DNL. The primary remaining value of iterative gradient-based methods is in validating that DNL's heuristics identify the same critical parameters that loss-landscape exploration would find—exactly the validation the defense experiments (Table 5) provide.

The paper also weakens the case for uniform parameter protection as a defense strategy. The demonstration that protecting 0.001% of DNL-identified parameters halves BFA's damage on ResNet-18 (Table 5) makes uniform error-correcting codes or bit replication—which multiply memory costs by constant factors—appear wasteful. If 99.999% of parameters can be left unguarded with negligible security impact, the economic calculus shifts dramatically toward selective protection.

Follow-Up Research This Work Enables

1. Architecture-specific vulnerability profiling: what makes EfficientNet-B5 14× more resilient than ViT-B/16?

The paper's per-model results (Tables 10, 11) reveal massive variance in vulnerability across architectures that is not explained by parameter count. EfficientNet-B5 achieves mAR(10) = 7.8% under DNL; ViT-Tiny achieves 99.7%. Both have comparable parameter counts (~30M for EfficientNet-B5, ~5.5M for ViT-Tiny, but the scaling plots in Figures 14–15 show no size trend). A systematic dissection of which architectural components govern vulnerability would involve: (1) training a controlled family of models where one architectural dimension (depth, width, presence of squeeze-excitation, residual connections, attention vs. convolution) is varied while others are fixed; (2) measuring DNL vulnerability at each configuration; (3) correlating vulnerability with proxy metrics like the concentration of weight magnitudes in early layers (e.g., Gini coefficient of the early-layer weight magnitude distribution) or the effective Lipschitz constant of early layers. The paper already provides the diagnostic tool (DNL scoring) and the evaluation framework (AR curves); what's needed is a controlled ablation across architectural choices to identify causal factors rather than correlational patterns.

2. Adaptive attacks against selective defenses: can DNL break its own proposed protection?

The paper evaluates its selective defense against BFA (Table 5) but not against DNL itself. A direct stress-test would: (1) protect the top p% of DNL-identified parameters (via replication or memory protection); (2) run DNL on the remaining (100-p)% unprotected parameters, selecting the highest-magnitude weights among those still writable; (3) measure AR at the same flip budgets as the undefended baseline. The key question is whether the drop-off in damage is proportional to the fraction of parameters protected (suggesting criticality is continuous) or whether there is a sharp threshold below which protection is ineffective and above which it is complete (suggesting criticality is concentrated in a small cluster that, once protected, leaves no high-impact targets). The MobileNet-V2 result—where 0.001% protection does nothing but 1% reduces BFA AR(10) from 99.90% to 44.30%—hints at a threshold effect that adaptive DNL attacks could probe more precisely than BFA, since DNL deterministically ranks all parameters by criticality.

3. Can training-time interventions distribute criticality and reduce vulnerability?

The paper's pruning connection suggests an intervention: if criticality is concentrated because training converges to a solution where a few early-layer weights have large $\theta_i^2 H_{ii}$ , can we modify the training objective to penalize this concentration? Specifically: add a regularization term $\lambda \cdot \text{Var}_{i \in \text{early layers}}(|\theta_i|)$ (variance of weight magnitudes in early layers) to encourage more uniform magnitude distributions, or add a spectral normalization constraint to bound the Lipschitz constant of early layers. A strong follow-up would train ResNet-50 and ViT-B/16 from scratch with and without this regularization, measure DNL vulnerability (AR curves) on the trained models, and test whether the regularization reduces vulnerability without sacrificing clean accuracy. The paper's EfficientNet results provide a natural positive control: EfficientNet-B5 achieves high clean accuracy (85.89% on ImageNet, Table 10) while being the most DNL-resistant architecture tested, suggesting that robustness and accuracy are not necessarily in tension.

4. Hardware-constrained attack modeling: how many sign flips can Rowhammer actually achieve at targeted addresses?

The paper motivates its small-flip-budget focus (k ≤ 10) by arguing that "hardware attacks often manage only a handful of flips" (Section 2), but provides no quantitative evidence linking specific hardware vectors to achievable flip counts, success rates, or addressability constraints. A crucial follow-up would bridge the gap: (1) characterize the physical constraints of Rowhammer, voltage glitching, and DMA attacks on modern hardware (DDR4/DDR5, specific GPU architectures); (2) determine, for a given model stored in memory with known layout (parameter-to-address mapping), what fraction of DNL-identified critical parameters are actually reachable by each attack vector; (3) compute the expected AR under realistic hardware constraints, which may be substantially lower than the paper's idealized "attacker can flip any k bits" assumption. The paper itself acknowledges this gap in its Limitation (Section 7): "In deployments where only part of the model is writable or addressable... the attack may be less effective, since a global search over all weights is no longer available." Quantifying how much less effective is the empirical question.

5. Domain-specific bit-type optimization: when should an attacker flip sign bits vs. exponent bits vs. both?

The paper's Appendix C shows that the optimal bit type is architecture-dependent, but provides no predictive framework. A systematic study would: (1) for each of the 48 ImageNet models, run both sign-bit and exponent-bit DNL at matched flip budgets; (2) characterize which architectural properties (depth, width, normalization type, activation function, residual connection pattern) predict whether sign or exponent flips are more destructive; (3) test whether a mixed strategy—allocating some flips to sign bits and some to exponent bits—outperforms either pure strategy. The paper's LLM results (Appendix C.1) suggest that exponent flips are devastating in autoregressive models because they can induce NaN/Inf values that propagate through attention, while sign flips produce more "controlled" corruption (feature inversion rather than magnitude explosion). If this hypothesis is correct, one would predict that exponent flips should be more destructive in recurrent or autoregressive architectures where errors compound over time, and less destructive in feedforward architectures where each input is processed independently. Testing this across a diverse set of architectures would provide actionable guidance for attackers.

6. Automated discovery of one-pass saliency functions via neural architecture search over scoring formulas.

The paper's 1P-DNL hybrid score (Equation 3) was chosen by combining magnitude and gradient terms with equal weights ( $\alpha = \beta = 1$ ) and a specific Gauss-Newton approximation. Appendix D (Figure 9) shows that this specific combination outperforms GraSP, SynFlow, and OBD on average, but also that individual models show different sensitivity patterns—some are more vulnerable to OBD scoring, others to SynFlow. This suggests that the optimal scoring function is model-dependent, just as the optimal layer scope and bit type are. A follow-up could treat the scoring function itself as a search space: define a parametric family of scoring functions over weight magnitudes, gradients, and approximate second-order terms (with tunable exponents, interaction terms, and normalization), and use a small validation set of models with known DNL vulnerability to optimize the function's parameters. The goal is a scoring function that maximizes the minimum AR across a diverse model zoo, providing a single robust formula that works well on unseen architectures without per-model tuning.

Practical Applications and Downstream Use Cases

Red-teaming for deployed AI systems: pre-deployment vulnerability assessment using DNL scoring.

Organizations deploying neural networks in safety-critical or security-sensitive contexts (autonomous vehicles, medical imaging, facial recognition, fraud detection) can use DNL as a lightweight diagnostic to assess their models' vulnerability to hardware-level parameter corruption before deployment. The procedure requires no test data and no inference—only read access to the trained weights. For a candidate model, compute the DNL criticality ranking (magnitude-aware, early-layer-scoped), then simulate k ∈ {1, 2, 5, 10} sign flips on a test set to measure the AR curve. A model with AR(2) ≥ 90% (like ViT-B/16 or MobileNet-V2) is a high-risk deployment target; a model with AR(10) < 50% (like EfficientNet-B5 under DNL) is relatively resilient. This assessment can inform architecture selection (prefer EfficientNet variants over ViT variants for security-sensitive edge deployments), guide defense investment (protect models with low k-to-collapse thresholds), and provide concrete metrics for security audits. The cost is a single read-and-sort of the stored weights—negligible compared to the cost of training or deploying the model.

Selective hardware memory protection for edge-deployed models.

For models deployed on edge devices with hardware memory protection capabilities (e.g., Arm TrustZone, Intel SGX, or secure memory enclaves on mobile GPUs), DNL provides a ranked list of which memory addresses to protect. Current best practice either protects all model parameters (prohibitively expensive for large models) or none (leaving the model vulnerable). DNL's finding that protecting 0.001% of parameters halves attack damage on ResNet-50 (Table 5) translates directly to a deployment specification: allocate secure memory pages for the ~100–1000 highest-magnitude weights in the first 10 layers, store them with ECC or in tamper-resistant memory, and leave the remaining 99.9% of parameters in unprotected memory. The memory overhead is negligible (100 parameters × 4 bytes × replication factor), and the security gain is substantial—an attacker exploiting Rowhammer or DMA can corrupt the unprotected 99.9% of weights with minimal effect (Figure 2a), but cannot reach the genuinely critical parameters. The paper's defense experiments against BFA validate this approach for gradient-based attacks; extending it to DNL-adaptive attacks (as proposed in Follow-Up #2) would complete the security analysis.

Post-deployment integrity monitoring via periodic critical-parameter checksums.

Even without hardware memory protection, DNL enables a lightweight runtime integrity check: after deployment, periodically compute a cryptographic hash (e.g., SHA-256) of the DNL-identified critical parameters (the top 100–1000 weights by magnitude in early layers) and compare against a known-good hash computed at deployment time. A mismatch indicates that critical parameters have been corrupted, triggering an alert or model reload. Because the monitored parameter set is tiny (~0.001% of weights), the checksum computation is negligible in latency and energy—it requires reading at most a few thousand 32-bit values and hashing them, which even on an embedded processor takes microseconds. Compare this to hashing the entire model (gigabytes of data, seconds or minutes of computation), which is infeasible for real-time integrity monitoring. The false-positive rate (hash mismatch due to benign single-event upsets rather than malicious attacks) depends on cosmic-ray-induced bit-flip rates, which are on the order of 10^{-12} to 10^{-9} per bit per hour in terrestrial environments—for a monitored set of 1,000 parameters (32,000 bits), the expected time between false positives is thousands to millions of hours, making the monitoring practical.

Guiding architecture selection for security-critical model families.

The paper's cross-architecture vulnerability data (Tables 10, 11) provides concrete guidance for model selection when security is a primary design constraint. Across the 48 ImageNet models:

Most vulnerable: ViT variants (AR(1) = 97.2% for ViT-B/16 under DNL), MobileNet-V2 (AR(2) = 99.8%), ShuffleNetV2 (AR(1) = 90.4%+). These architectures should be avoided in settings where hardware-level attacks are a realistic threat, or must be deployed with strong parameter protection.
Most resilient: EfficientNet-B5 (mAR(10) = 7.8% under DNL), EfficientNet-B4 (AR(1–9) ≤ 9.4%), RegNet-Y 400MF (AR(10) = 64.1%). These architectures can tolerate more flips before suffering catastrophic degradation, providing a larger safety margin.
Sharp threshold models: EfficientNet-B4 collapses suddenly at k = 10 (AR(9) = 9.4%, AR(10) = 97.8%). These models are deceptively safe at low flip counts but have a hidden cliff—a defender monitoring gradual accuracy degradation might not notice the attack until it's too late.

This vulnerability ranking can be computed for any model family using the DNL procedure, requiring only weight access, and should be part of the model selection process alongside standard metrics like accuracy, latency, and parameter count when deployment security is a concern.