Toward a Generalized Defense Across Sparse, Continuous, and Structured Parameter Attacks

Unknown

Conceptio › Archive › arXiv CS

arXiv CSopen access

Toward a Generalized Defense Across Sparse, Continuous, and Structured Parameter Attacks

Unknown · 2026 · arxiv_cs

arXiv CS · Papers · License: Open Access · 2026

Open Source ↗Direct PDF ↓

softwarearchitecture softwareengineering testing

software engineering, software architecture, testing

TRANSACTIONS ON DEPENDABLE AND SECURE COMPUTING

Toward a Generalized Defense Across Sparse, Continuous, and Structured Parameter Attacks

arXiv:2606.04317v1 [cs.CR] 3 Jun 2026

Bin Duan, Zeyu Bai, Guowei Yang* School of Electrical Engineering and Computer Science, The University of Queensland, Australia {b.duan, guowei.yang}@uq.edu.au, [email protected]

Abstract—Deep neural networks are increasingly deployed across heterogeneous and partially untrusted environments, where models are distributed through cloud storage, CI/CD pipelines, containerized services, and edge execution platforms. This broad deployment landscape exposes model parameters to various integrity risks. Unlike input-space adversarial attacks, parameter attacks directly tamper with the model’s internal parameters and persist across all subsequent inferences. Existing defenses either require retraining, incur significant accuracy degradation, or are limited to specific attack classes. However, in real-world deployment scenarios, the forms of parameter attacks are often unpredictable. To address this challenge, we present PAR D EF, a generalized defense for deep neural networks against diverse types of parameter attacks. PAR D EF integrates keyed channel reparameterization, which obscures sensitive parameter directions, QC-LDPC quantization, which embeds redundancy and supports error correction, and adaptive robust inference, which stabilizes predictions under uncertainty. Our evaluation on CIFAR-10, CIFAR-100, and Tiny-ImageNet using ResNet and VGG models, together with additional DeiT experiments on ImageNet-1K and CIFAR-100, demonstrates that PAR D EF consistently reduces attack success rates across different parameter attacks while maintaining high model performance and incurring only moderate deployment overhead. These results highlight that PAR D EF is a practical and generalized defense for securing atrest model parameters in DNN deployments. Index Terms—Deep neural networks, Parameter attacks, Model robustness, Neural network security

I. I NTRODUCTION

EEP neural networks (DNNs) have become integral to modern computing and service infrastructures, powering core tasks such as classification [1], search and ranking [2], recommendation [3], and large-scale personalization [4]. Billions of inferences are executed daily across cloud platforms, edge devices, distributed model-serving pipelines, and containerized microservices [5], reflecting both the scalability of DNN-based applications and the expanding security surface of deployed models [6]. In controlled server-side settings, deployed models typically operate within a narrow and well-monitored trust boundary [7]. However, modern ML deployment pipelines increasingly distribute models across heterogeneous environments—cloud storage services, CI/CD delivery channels, container images, edge endpoints, and shared model repositories—substantially enlarging the attack surface for parameter manipulation [8]. Compromised or maliciously modified models have already been observed in public repositories, including persistent backdoored parameters that survive fine-tuning [9], as well

as parameter-level manipulations designed to leak private information or induce targeted misbehavior [10]. Audits of large-scale model hubs further indicate that unsafe serialization and model packaging practices can expose critical integrity vulnerabilities [11]. In operational ML pipelines, untrusted artifacts and automated model-retrieval processes have been identified as practical injection vectors for tampered parameters [12], highlighting the need for principled mechanisms that ensure model integrity throughout deployment. Parameter attacks exploit this expanded attack surface by directly corrupting the stored model parameters to induce targeted failures [13]. These attacks can be classified into three distinct types: sparse bit-flip attacks, which target critical bits in floating-point representations [14], continuous bounded noise injection across weight tensors [15], [16], and structured manipulations, which exploit architectural regularities in channels or layers [17], [18]. Unlike input-space attacks [19], which can sometimes be mitigated through preprocessing, parameter attacks operate stealthily within the model’s computational core and persist across all subsequent inferences [20]. The impact of parameter attacks is amplified in modern deployment settings, where models are frequently distributed across heterogeneous and partially untrusted execution environments [21]. Once a compromised model is propagated through deployment pipelines or distributed endpoints, the tampered parameters persist and can rapidly affect a large number of downstream applications [22]. Existing defenses, such as aggressive quantization (BIN [23], RA-BNN [24]), incur substantial accuracy degradation and require full retraining, which is often impractical in real deployment workflows that demand efficiency and minimal disruption. Recent specialized defenses like Aegis [25] provide strong protection against bit-flip attacks through multi-exit architectures, achieving notable reductions in attack success rates. However, such approaches remain narrowly tailored to sparse parameter perturbations and offer limited robustness against continuous or structured parameter attacks, leaving significant portions of the threat landscape unaddressed. In this paper, we propose PAR D EF, a generalized defense against diverse parameter attacks, providing robustness to sparse, continuous, and structured attacks. PAR D EF incorporates three synergistic mechanisms: (1) keyed channel reparameterization (KCR), which reparameterizes parameter channels using secret keys to obscure gradient-based attack directions, (2) quasi-cyclic low-density parity-check (QC-LDPC) [26] coded quantization, which embeds error-

TRANSACTIONS ON DEPENDABLE AND SECURE COMPUTING

correcting redundancy while reducing model size, and (3) adaptive robust inference (ARI), which dynamically allocates computational resources based on prediction uncertainty. Together, these mechanisms enable PAR D EF to achieve broad robustness without retraining, maintain functional equivalence with the original model, remain compatible with existing inference frameworks, and reduce storage overhead while preserving inference efficiency. We evaluate PAR D EF on CIFAR-10 [27], CIFAR-100, and Tiny-ImageNet [28]. PAR D EF consistently defends against the three types of parameter attacks, achieving lower attack success rates than existing defenses while maintaining high model performance and incurring minimal deployment overhead. We further conduct an additional DeiT-based evaluation on ImageNet-1K and CIFAR-100 to examine Transformer compatibility and overhead scaling. These results position PAR D EF as a practical and generalized defense for DNNs against diverse parameter attacks. To support reproducibility, we release artifacts [29].

perturbs loss-sensitive parameters using gradient guidance, causing severe accuracy drops while preserving global structure. This category also includes random or adversarial noise injection mimicking quantization errors or hardware faults. Structured parameter attacks. These attacks target entire groups, filters, or layers, exploiting network hierarchy to maximize impact. The Parameter Adaptive Adversarial Attack (P3A) [17] exemplifies this strategy by adaptively tuning attacks toward vulnerable substructures, yielding large-scale degradation while evading naive retraining defenses. These attacks can cause catastrophic accuracy drops [14], targeted misclassification, or persistent backdoor behavior [17], all while leaving the model’s input-output interface unchanged. This breadth of attack highlights the need for generalized defenses capable of addressing all attack types without relying on attack-specific assumptions, especially given the wide range of deployment environments where models may be exposed to adversarial manipulation. B. Defenses Against Parameter Attacks

II. BACKGROUND A. Parameter Attacks Parameter attacks are an emerging class of adversarial attacks that manipulate the internal parameters of DNNs, altering model functionality without changing any inputs [17], [23]. Unlike input-based attacks, which perturb data and can often be mitigated through training or preprocessing, parameter attacks strike at the model’s core, making them stealthier and more destructive: they evade input-level defenses and persist across future inferences once parameters are compromised. Such attacks are particularly critical in modern deployment pipelines, where adversaries may access model parameters stored in shared repositories, propagated through CI/CD workflows, or distributed across edge and containerized execution environments [30], [31]. From a perturbation perspective, we group parameter attacks into three categories: (1) Sparse attacks (L0 -bounded), modifying only a few parameters; (2) Continuous attacks (L2 /L∞ -bounded), distributing bounded noise across many parameters; (3) Structured attacks, introducing correlated changes across groups, channels, or layers. Here, L0 measures the number of altered parameters, L2 their Euclidean magnitude, and L∞ the maximum per-parameter change. These categories capture most parameter attacks [32]. Sparse parameter attacks (L0 -bounded). These attacks modify only a small subset of weights, keeping the rest intact to maximize stealth and minimize functional disturbance until the intended trigger. Representative examples include bit-flip attacks (BFAs) such as targeted bit-flip attacks and ProFlip [33], which exploit the binary encoding of parameters, flipping exponent or high-order mantissa bits can induce large numerical changes. Targeted bit-flip attack ranks bits by gradientbased loss impact, while ProFlip uses probabilistic search to minimize the number of flips. Continuous parameter attacks (L2 /L∞ -bounded). Here, adversaries apply small but dense additive noise across many parameters under norm constraints, such as ∥δW ∥2 ≤ ϵ or ∥δW ∥∞ ≤ ϵ. The Adversarial Parameter Attack (APA) [23]

Parameter-attack defenses generally fall into two categories: integrity verification and model enhancement. Integrity verification methods, such as error-correcting schemes [34], [35], introduce redundancy into parameter storage to detect or repair corrupted weights. While effective in hardware-aware contexts, these approaches require specialized support, incur computational and memory overhead, and remain reactive rather than preventive. In contrast, model enhancement methods directly modify the model to improve robustness against parameter attacks. BIN [23] and RA-BNN [24] restrict parameters to binary or quantized values, thereby limiting the possible impact of bit-level changes. However, such constraints often degrade clean accuracy and require complete retraining, which reduces practicality for large-scale or legacy models. More recently, Aegis [25] defenses targeted bit-flip attacks via a dynamic-exit architecture and robustness-oriented training, but introduces notable architectural/training overhead and is validated on BFA-style attacks. BITSHIELD [36] focuses on compiled DNN executables, detecting BFAs on data and code sections. Importantly, the demonstrated robustness of these defenses is largely confined to targeted bit-flip scenarios; their generality against other parameter attacks remains uncertain. III. T HREAT M ODEL AND D EFENSE R EQUIREMENTS A. Threat Model We consider a parameter-attack adversarial scenario in which the adversary can directly modify the stored parameters of a deployed DNN model before inference. This setting is motivated by a growing body of evidence [17], [23], [32] showing that model files, cached artifacts, and edgedeployed DNNs are vulnerable to weight-level corruption through supply-chain manipulation, unsafe model distribution, or compromised deployment artifacts. Runtime vectors such as row-hammer style faults or co-located malicious processes further illustrate the practical severity of parameter-level corruption, but our primary focus is at-rest parameter tampering before model loading, as clarified below. Even a small number

TRANSACTIONS ON DEPENDABLE AND SECURE COMPUTING

Keyed Channel Reparameterization with Coded Quantization Keyed Channel Reparameterization

Quasi-Cyclic LDPC-Coded Quantization

Model Preparation Original Weights

Reparameterized Weights

Quantized Weights

Adaptive Robust Inference Stochastic Smoothing

Confidence-Gated Escalation and Voting

Runtime Inference

∆(x)<τ ?

Yes

Output y

Input x No

Voting

Fig. 1: Overview of PAR D EF. of parameter changes can cause catastrophic model failures, making parameter attacks a realistic and severe threat. Attack surface focus. We focus on at-rest (pre-load) parameter tampering, where an adversary modifies the serialized model checkpoint before the model is loaded for inference. We consider post-load in-memory parameter tampering (after model initialization) as out of scope, because it bypasses loadtime verification/decoding and requires orthogonal runtime integrity mechanisms. Trusted computing base and key protection. Following established practice in machine learning systems security that builds on trusted execution environment (TEE) primitives [37], [38], PAR D EF adopts a tiered trust model and achieves its strongest guarantees when a minimal TEE (e.g., Intel SGX [39] or ARM TrustZone [40]) is available on the inference platform (see Section VII-H). In Tier 1, PAR D EF’s preparation-time secrets, including the KCR permutations and scaling factors, are generated and stored inside the TEE and never exposed outside of it. The adversary can fully access and modify only the transformed model parameters stored outside the TEE, but cannot read or tamper with the secrets or code residing inside the trusted environment. This prevents direct key extraction [41], [42] while still allowing strong parameterspace attacks on the deployed model [43], [44]. We assume the TEE provides standard isolation guarantees and do not consider side-channel leakage or physical compromise of the trusted environment, which are orthogonal to the parameterattack threat studied in this work. Adversarial capabilities. Following prior work on strong parameter-space adversaries [17], [25], [33], we assume a white-box, defense-aware adversary who has full access to the final deployed model, including: (i) its architecture, (ii) all model parameters after applying our defense mechanism, and (iii) the complete inference-time code path, excluding the preparation pipeline executed inside the TEE. The adversary does not observe any internal artifacts from the preparation pipeline, but can freely inspect and analyze the final trans-

formed model exactly as deployed. The adversary may modify model parameters within a fixed attack budget and may adopt any manipulation strategy considered in prior Section III-A, including: sparse (L0 bounded) perturbations, continuous (L2 /L∞ -bounded) perturbations, and structured channel- or layer-aligned perturbations. The adversary is allowed to compute gradients or sensitivity estimates on the deployed model, to perform quantizationaware or structure-aware optimization, and to use Expectationover-Transformation (EOT) techniques to adapt to stochastic inference. However, the adversary cannot interfere with the runtime platform, nor can they access the original, untransformed model used before deployment. Adversarial goals. Following prior work on parameter-space attacks, we consider adversaries that manipulate model parameters to induce prediction failures, as we mentioned in Section III-A. Depending on the attack strategy, the adversary may pursue one of the following goals: • Sparse corruption. The adversary modifies a very small number of highly sensitive parameters, typically via selective bit flips, so as to maximally disrupt model predictions with minimal perturbation. Such sparse attacks are known to cause significant functional shifts even when only a few parameters are altered [23], [25]. • Continuous perturbation. The adversary introduces small but widespread perturbations across many parameters, constrained by L2 or L∞ norms, with the goal of gradually deteriorating the model’s stability and decision boundaries. Such dense perturbations emulate continuous parameter drift or fine-grained adversarial noise [23]. • Structured disruption. The adversary perturbs parameters in a coordinated manner across filters, channels, or layers, aiming to corrupt intermediate representations or feature pathways. By targeting structurally related parameter groups, these attacks can induce large-scale degradation while preserving stealth [17]. These adversarial capabilities and goals encompass the

TRANSACTIONS ON DEPENDABLE AND SECURE COMPUTING

primary forms of realistically executable parameter attacks demonstrated in prior section and define the threat surface addressed by PAR D EF.

that increases the attacker’s required corruption budget across the three attack families considered. A. Keyed Channel Reparameterization

B. Defense Requirements Our goal is to design a practical defense that provides robust protection across representative families of parameter attacks, including adaptive and defense-aware variants. Rather than attempting to make parameter attacks theoretically impossible, the defense should increase the adversary’s required corruption budget and reduce the feasibility of successful parameter manipulation in real-world deployment settings. To achieve this, the defense should satisfy the following requirements: • Non-intrusive. This defense should be applicable to fully trained DNN models without requiring any retraining, enabling that the mechanism can be integrated into existing deployments. • Utility-preserving. The defense should preserve the model’s predictive performance on clean inputs and avoid degrading accuracy or decision stability. A practical defense should not highly compromise the original functionality or reliability of the model. • Low-overhead. The defense should introduce minimal computational, storage, and inference-time overhead, ensuring that the protected model remains efficient and deployable in real-world systems. Both model size and latency should remain close to those of the original model. • Robust under adaptive attacks. The defense should remain effective even when adversaries are defense-aware and perform gradient-based, quantization-aware, or EOTbased optimization on the deployed model. This requirement ensures that robustness does not rely on gradient obfuscation or unrealistic attacker limitations. • Broad attack coverage. The defense should offer robustness across diverse parameter-attack strategies. Real-world parameter attacks may be sparse, continuous, or structured. A practical defense should withstand these three representative manipulation forms, in order to avoid leaving openings for adaptive adversaries who simply switch attack patterns.

Keyed Channel Reparameterization (KCR) reindexes and rescales channels in a key-conditioned way to misalign adversarial gradients and diffuse localized perturbations, while exactly preserving the function of the model. Intuitively, KCR hinders an attacker’s ability to target the most “sensitive” neurons or channels, since the deployed basis is key-randomized and instantiated by secrets kept inside the TEE (the adversary knows the mechanism but not the key). Specifically, for each convolutional or linear layer l with a weight tensor or matrix Wl ∈ RCout ×Cin ×kh ×kw (linear layer: kh =kw =1) and bias bl ∈ RCout , we sample two key-driven, invertible channel transforms in restricted form: (out)

Pl = Πl

(in)

Ql = Πl

(in)

(·)

Dl ≻ 0,

(1)

(·)

where Πl are permutation matrices and Dl are positive diagonal scalings. Positivity ensures reversibility and avoids sign flips around activations. Using (Pl , Ql ), the transformed parameters are fl = Pl Wl Q−1 , ebl = Pl bl . W l

(2)

Equivalently, unfolding Pl and Ql into Π, D, when kh kw > 1 we can view Wl in matrix form and recover fl = D(out) Π(out) Wl Π(in)⊤ [D(in) ]−1 , W l l l l

(3)

and in indexed tensor form fl (o, i, kh , kw ) W (out)

= Dl

(out)

(o) Wl Πl

(in)

(o), Πl

(in) (i), kh , kw [Dl (i)]−1 , (4)

with bias ebl = D(out) Π(out) bl . l l

(5)

To keep tensors consistent with the reparameterized weights, the input and output features of layer l are mapped as x el = Ql xl , yel = Pl yl .

IV. M ETHOD This section presents PAR D EF, a defense pipeline designed to provide broad protection across three representative families of parameter attacks, sparse (L0 ), continuous (L2 /L∞ ), and structured, without relying on additional loss terms or retraining. Figure 1 shows the overview of PAR D EF, which integrates three complementary modules spanning both model preparation and runtime inference. (1) Keyed Channel Reparameterization (KCR) obfuscates and diffuses sensitive directions in parameter space while preserving model functionality (Sec. IV-A). (2) QC-LDPC Coded Quantization constrains model weights to redundancy-protected codewords, enabling correction or detection of both sparse bit flips and small continuous drifts (Sec. IV-B). (3) Adaptive Robust Inference (ARI) provides runtime stability by combining stochastic smoothing with confidence-gated redundancy (Sec. IV-C). Together, these mechanisms form a preparation–inference defense pipeline

(out)

(6)

where xl is the input to Wl and yl is the pre-normalization output of Wl in the original network. This mapping will be implemented implicitly by updating adjacent normalizations and by propagating permutations across edges of the computation graph. Let the original per-channel affine normalizations be Nin (x) = Ain x + cin , Nout (z) = Aout z + cout . with Ain , Aout diagonal and cin , cout vectors. Under KCR, choose updated normalizations: ein = Ql Ain , A e cin = Ql cin , −1 eout = Pl Aout P , A e cout = Pl cout . l

Thus ein (x) = A ein x + e N cin = Ql (Ain x + cin ) = Ql Nin (x),

(7)

TRANSACTIONS ON DEPENDABLE AND SECURE COMPUTING

eout (z) = A eout z + e N cout = Pl Aout (Pl−1 z) + cout

= Pl Nout (Pl−1 z). Layer-wise Equivalence Proof. Consider the inference-time block N N → z = Wl x + bl −−out −→ Act(·). x −−in fl , ebl from (2), we have Using (6)–(7) and W fl N ein (x) + ebl = (Pl Wl Q−1 ) (Ql Nin (x)) + Pl bl W l = Pl Wl Nin (x) + bl . Applying the updated output normalization, eout W fl N ein (x) + ebl = Pl Nout Wl Nin (x) + bl . N Finally, since Act is channel-wise, it is permutation(out) (out) equivariant: Act(Πl u) = Πl Act(u). Under the activation constraint stated below (i.e., diagonal scalings are set to identity across non-homogeneous activations), we obtain eout W fl N ein (x)+ebl = Pl Act◦Nout Wl Nin (x)+bl . Act◦ N (8) That is, the transformed block equals the original block up to a channel permutation given by the permutation part of Pl . Network-wise Strict Equivalence. Let the network be a feedforward graph with possible residual or parallel branches. Assign KCR transforms {(Pl , Ql )} subject to: (i). Edge consistency. For any edge from layer l to l+1, set the consumer’s input transform equal to the producer’s output transform, i.e., Ql+1 = Pl . (ii). Branch alignment. For residual, add, or concat nodes, apply the same permutation to all aligned branches before merging. (iii). Endpoints. Choose Qfirst = I and Plast = I (or append a fixed inverse permutation at the network tail). Then all intermediate permutations cancel along edges, merged tensors remain channel-aligned, and the external input and output order is preserved; hence, for all inputs x, fe(x) = f (x).

(9)

To extend the equivalence argument to practical architectures, we specify how the reparameterization applies to common structures in modern DNNs. Normalization. For a normalization layer before Wl , compose (in) it with Ql , permuting by Πl and adjust its per-channel affine parameters as in (7). For a normalization layer after Wl , (out) compose it with Pl and its inverse, permuting by Πl and adjust its per-channel affine parameters so the overall affine becomes Pl (·)Pl−1 . Activations. Elementwise activations (ReLU/GELU/SiLU) commute with channel permutations. We set diagonal scalings to identity across non-homogeneous activations when strict (·) commutation with Dl is not guaranteed, and rely on permutations for those boundaries. (out) Residual connections. If the permutation part of Pl , Πl , permutes the main branch, the skip branch must apply the same permutation to maintain channelwise alignment; for a f skip (o, i, 1, 1) = W skip (Π(out) (o), i, 1, 1). 1×1 skip, W l

Group or depthwise convolutions. Permutations must re(in) (out) spect group structure: Πl (and Πl when applicable) permute within each group. For depthwise conv (Cin = Cout , (out) (in) group= Cin ), tie the permutation parts so that Πl = Πl , preserving the input–output channel correspondence exactly. Equations (2)–(6) define parameter and feature transforms; (7) absorbs them into adjacent normalizations; the layer identity (8) shows each block is preserved up to a permutation; the network conditions above cancel permutations globally, yielding (9) and thus strict functional equivalence with zero inference overhead. By randomizing the channel basis while maintaining strict functional equivalence, KCR disperses sparse perturbations, disrupts structured channel-wise attacks, and misaligns gradient-based optimization, increasing the difficulty of targeted parameter corruption. B. Quasi-cyclic Low-density Parity-check Coded Quantization While KCR diffuses and obfuscates sensitive directions, it does not provide robustness against bit-level corruption or small continuous drifts. To address these residual vulnerabilities, we adopt a QC-LDPC quantization scheme [26]. In this scheme, the parity-check matrix is composed of repeated circulant submatrices, enabling efficient encoding and decoding while maintaining strong error-correction capability. By constraining weights to valid codewords, QC-LDPC corrects perturbations within the code’s error-correction capability and reliably detects larger deviations, while block-wise decoding repairs sparse bit flips and mitigates small continuous drifts. Prior to deployment, we uniformly quantized to b-bit precision using affine quantization within a per-tensor range, yielding quantization indices q(θi ; b) ∈ {0, 1, . . . , 2b − 1},

(10)

where θi denotes a weight and q(θi ; b) is its b-bit index, and the affine quantization is defined as θmax − θmin θi − θmin ,∆ = . (11) q(θi ; b) = round ∆ 2b − 1 where θmin and θmax denote the minimum and maximum values of the tensor, and ∆ is the quantization step size. Quantized indices are grouped into fixed-size blocks (Nb indices per block) and encoded via a QC-LDPC code, ensuring all stored bit sequences are valid codewords. Bit errors that fall within the code’s correction capability are recovered [45]; larger deviations are detected at load time and trigger a fail-safe (aborting model loading), preventing silent deployment with corrupted weights. The quasi-cyclic structure keeps encoding and decoding efficient [46]. All LDPC decoding occurs once at model loading time; inference uses the decoded weights without any per-query overhead. This integration of discrete quantization and QC-LDPC block coding produces redundancy-protected parameters: correctable bit-level errors are repaired, small continuous perturbations are mapped back to a valid codeword within the correction radius, and larger deviations are localized rather than silently propagating through the network. When combined

TRANSACTIONS ON DEPENDABLE AND SECURE COMPUTING

with KCR, remaining perturbations are further dispersed, making targeted parameter manipulations harder.

and return ŷ(x) = arg max vk , k

(15)

and breaking ties using the average softmax. C. Adaptive Robust Inference This redundancy reduces prediction variance and suppresses ARI is an inference-time module that handles residual transient or localized parameter corruptions, while stochastic perturbations left after KCR and QC-LDPC by stabilizing diversity prevents correlated structured attacks from consispredictions through stochastic smoothing and uncertaintytently biasing the majority vote. Because ARI’s stochasticity is gated redundancy, without retraining or persistently altering fully visible to the adversary (who may apply EOT), robustness the stored parameters. 1) Stochastic Smoothing: For each incoming input x, we results from redundancy and variance reduction rather than introduce lightweight, ephemeral randomized perturbations from hiding gradients. during inference by injecting small Gaussian noise ξ ∼ V. E VALUATION 2 N (0, σw I) (with σw chosen to avoid accuracy degradation). ′ A. Research Questions This yields perturbed parameters W = W + ξ, and the model performs M stochastic forward passes under independently Our evaluation is guided by four research questions: sampled ξ1 , . . . , ξM . The resulting logits are averaged to RQ1: Does PAR D EF preserve the clean predictive performance produce a smoothed prediction: of the original model? M

RQ2: How effective is PAR D EF in mitigating diverse parameter attacks? RQ3: What deployment overhead does PAR D EF introduce in By marginalizing over a distribution of perturbed models, terms of model size and inference latency? ARI smooths decision boundaries in parameter space, reducing RQ4: How do the individual components of PAR D EF contribute sensitivity to sparse (L0 -bounded) and continuous (L2 /L∞ to its overall robustness? bounded) parameter distortions. Because the adversary is For RQ1, we examine how PAR D EF affects clean accuracy allowed to apply expectation over transformation (EOT), to evaluate its utility preservation. For RQ2, we measure smoothing does not rely on gradient masking; robustness arises robustness under three representative attack types, sparse (L0 ), from variance reduction and boundary stabilization, not from continuous (L2 /L∞ ), and structured perturbations, together obscuring gradients. with their adaptive variants and jointly optimized adaptive 2) Confidence-Gated Escalation and Voting: This mecha- variants, to assess the breadth of attack coverage. For RQ3, nism allocates computation adaptively by escalating only those we analyze deployment costs by measuring changes in model inputs that exhibit high decision uncertainty, thereby providing size and runtime latency under both typical and worst-case robustness without incurring unnecessary overhead on benign slow-path settings. For RQ4, we conduct ablation studies by inputs. removing KCR, LDPC-coded quantization, and ARI individGiven an input x, the model first performs Ms stochastic ually and in combination, to quantify the contribution of each forward passes. In each pass, the model parameters are per- component and their cross-module complementarity to overall 2 turbed by adding a small Gaussian noise ξ ∼ N (0, σw I), robustness. (1) (2) (Ms ) producing logits {z , z , . . . , z }. These logits are averaged to obtain z̄, which is converted to probabilities p = B. Experimental Setup softmax(z̄). We define the confidence margin as Datasets and models. We followed [23]–[25] and conducted ∆(x) = p(1) − p(2) , (12) our experiments on three widely used datasets with two DNN where p(1) and p(2) are the probabilities of the most and models: VGG16 and ResNet32. second-most likely classes. A small ∆(x) indicates that the CIFAR-10 & CIFAR-100 [27]: Both datasets consist of prediction is close to the decision boundary, where even minor 50,000 training images and 10,000 test images of size 32×32× parameter attacks could cause label flips. An input is flagged 3. The difference lies in the number of categories: CIFAR-10 as high-risk if ∆(x) < τ , where τ is selected once on a clean includes 10 classes, while CIFAR-100 contains 100 classes. validation set as a quantile of the margin distribution and then Tiny-ImageNet [28]: This dataset is a simplified version of fixed for all evaluations, so that escalation is rare for benign ImageNet consisting of color images with a size of 64×64×3 belonging to 200 classes. parameters yet sensitive to parameter drift. We separate the training and testing data without any overFor high-risk inputs, we switch to a slow path with Mℓ ≫ Ms higher-precision stochastic passes. Each pass draws an lap. For CIFAR-10 and CIFAR-100: we select 50,000/10,000 independent ξ (i) and produces logits z (i) and a predicted class: images for training/testing. For Tiny-ImageNet: we select 100,000/10,000 images for training/testing. (i) ŷ (i) = arg max zk . (13) Baselines. We compare PAR D EF against four baselines that k represent complementary defense paradigms: Base, which is We then form per-class vote counts the unprotected model; Aegis [25], which employs a dyMℓ X namic multi-exit architecture with robustness-oriented training (i) vk = 1{ŷ = k} (14) against targeted bit-flip attacks; BIN [23], which constrains i=1 z̄ =

1 X (m) z . M m=1

TRANSACTIONS ON DEPENDABLE AND SECURE COMPUTING

TABLE I: τ Setting. Dataset CIFAR-10 CIFAR-100 Tiny-ImageNet

Model ResNet32 VGG16 ResNet32 VGG16 ResNet32 VGG16

Mean (µ) 0.69 0.64 0.43 0.32 0.27 0.23

TABLE II: Model ACC influence evaluation. Std (σ) 0.18 0.21 0.16 0.16 0.14 0.13

τ 0.46 0.37 0.23 0.12 0.09 0.06

parameters to binary values to limit the impact of bit-level perturbations; and RA-BNN [24], which extends binary neural networks with robust activation functions and training procedures to enhance resilience against parameter-space attacks. We tried to include BITSHIELD [36], but its implementation is not publicly available. For a fair comparison, we evaluate all methods on the same models and datasets: VGG16 and ResNet32 on CIFAR-10, CIFAR-100, and Tiny-ImageNet. Attack Settings. We evaluate robustness under three representative parameter attack categories as defined in Section III-A: (1) Sparse (L0 ) perturbations: we retain ProFlip [33], a strong gradient-based targeted bit-flip attack, as our representative BFA due to its high effectiveness and efficient search; (2) Structured perturbations: we implement P3A [17], which adaptively selects vulnerable channels and perturbs them in a correlated manner; (3) Continuous (L2 /L∞ ) perturbations: we adopt APA [23], an adversarial parameter attack that perturbs a large portion of parameters under norm constraints, using a projected gradient descent (PGD) optimizer to maximize loss. For each attack type, we also design an adaptive variant aware of PAR D EF’s defense modules. Attack Details and Budgets. We adopt the standard settings from prior parameter-attack works [17], [23], [25], [33]. For ProFlip, we follow the standard ProFlip configuration [33] with a 200-step search procedure, selecting the target class randomly and estimating candidate bit impact using k sampled candidates (k=20 for CIFAR-10/100, k=10 for TinyImageNet), and vary the flip budget Bf in {25, 50, 75, 100}. For P3A, we perturb the top gradient-ranked channels with quantization-aware projection, varying the number of perturbed channels {1, 3, 5, 7}. For APA, we use a quantizationaware setting in which each PGD update is immediately projected onto the 8-bit quantization grid, matching the deployed parameter representation under PAR D EF. We sweep the L∞ 2 4 8 16 1 , 255 , 255 , 255 , 255 }. This setting perturbation magnitude { 255 evaluates a defense-aware adversary that optimizes over the same quantized parameter manifold as the deployed model. Configuration. Unless otherwise stated, we use the following default hyperparameter settings for PAR D EF. During preparation, we quantize each tensor with uniform 8-bit affine quantization and pack the indices into blocks encoded by a QC-LDPC code with rate 0.875. We use LDPC blocks of size Nb = 128, following standard QC-LDPC constructions. During inference, ARI injects small Gaussian noise into model parameters for stochastic smoothing with σw = 10−4 . We set the number of stochastic passes to Ms = 5 for the fast path and Mℓ = 25 for the escalated slow path. The confidence threshold τ is determined on clean validation data using a Gaussian approximation of the confidence-margin distribution ∆(x). We estimate the mean µ and standard deviation σ of

Dataset

Model

ResNet32 VGG16 ResNet32 CIFAR-100 VGG16 Tiny ResNet32 -ImageNet VGG16 CIFAR-10

Base ACC (%) 92.88 93.57 67.02 72.36 53.93 61.27

∆ ACC (%) BIN RA-BNN Aegis PAR D EF -10.17 -7.67 -17.20 -1.64 -7.44 -3.30 -6.67 -2.08 -14.97 -10.69 -11.96 -4.90 -24.72 -7.07 -11.35 -5.27 -9.29 -17.94 -4.73 -2.48 -12.33 -7.75 -8.65 -3.86

∆(x) and set τ = µ − 1.28σ. This choice corresponds to the nominal 10th-percentile cutoff under a normality assumption and provides a simple, reproducible criterion across datasets and architectures. The resulting τ values are summarized in Table I. All experiments are repeated with five independent random seeds affecting defense preparation (KCR keys and LDPC interleaving), attack initialization, and ARI stochastic sampling; we report mean results across runs. We later examine the impact of PAR D EF under variations of these hyperparameters in our sensitivity analysis. Environment. All experiments are performed on a Ubuntu 24.04.3 LTS system with an AMD Ryzen Threadripper PRO 7985WX (64-core) CPU, 502 GiB of DDR5 memory, and NVIDIA RTX 6000 Ada Generation GPU. C. Metrics Following previous works [24], [25], we use the following metrics to evaluate model utility, robustness, and deployment overhead. Clean Accuracy (ACC). Accuracy on test data without any attack, measuring the utility loss introduced by defenses. Attack Success Rate (ASR). The percentage of originally correctly classified samples that are misclassified after an attack. A lower ASR indicates a stronger defense. To ensure comparability across defenses with different clean accuracies, ASR is computed on each model’s correctly classified clean subset under the corresponding defense. Model Size. On-disk model size (MB) including all auxiliary metadata, together with the percentage increase over Base. Latency: Per-query inference latency under identical hardware, batch, and runtime, reported as change to Base at P50 and P90, where P50 is the median per-query latency and P90 captures the slower tail (90th percentile) of the distribution. We also report worst-case latency when all inputs are escalated to ARI’s slow path. VI. R ESULTS AND A NALYSIS A. RQ1. Model Utility Evaluation As shown in Table II, PAR D EF achieves the smallest ∆ACC across all datasets and models, indicating strong preservation of clean accuracy. BIN and RA-BNN reduce accuracy more notably due to the constraints of aggressive quantization, often showing drops that are about 2–4× larger than those of PAR D EF. Aegis, though effective for bit-flip robustness, shows larger drops under our unified evaluation protocol on several benchmarks. For Aegis, we report reproduced results from its official open-source implementation under our unified evaluation stack. Its reproduced CIFAR-10/ResNet32 accuracy

TRANSACTIONS ON DEPENDABLE AND SECURE COMPUTING

(a) ProFlip — CIFAR-10

(b) ProFlip — CIFAR-100

(d) P3A — CIFAR-10

(e) P3A — CIFAR-100

(f) P3A — Tiny-ImageNet

(g) APA — CIFAR-10

(h) APA — CIFAR-100

(i) APA — Tiny-ImageNet

Fig. 2: Comparison of ASR (%) across Three Attacks. TABLE III: Adaptive Attack Evaluation on PAR D EF. ProFlip P3A APA Base PAR D EF Base PAR D EF Base PAR D EF ResNet32 82.28 40.12 93.41 51.02 20.35 5.42 CIFAR-10 VGG16 70.63 34.18 89.18 39.86 23.06 10.72 ResNet32 76.01 39.91 89.69 52.33 29.59 6.98 CIFAR-100 VGG16 72.44 35.07 88.75 59.04 25.66 19.31 Tiny ResNet32 84.50 41.21 90.83 61.03 59.05 12.08 -ImageNet VGG16 81.22 36.92 80.12 57.94 50.36 13.66 Dataset

Model

drop is 17.20%, compared with 1.26% in the original paper, so we interpret it as a reproduced baseline under our common protocol. The stability of PAR D EF comes from its parameterpreserving design: it avoids the expressiveness loss of global quantization and the complexity of architectural changes, instead combining reparameterization, coded quantization, and adaptive inference. This selective use of redundancy yields its lower utility cost. B. RQ2. Mitigating Attacks 1) Mitigating Targeted Attacks: ProFlip. As shown in Fig 2, PAR D EF consistently maintains low ASR across all budgets and datasets. Its curves remain smooth and stable as the attack budget increases, showing reliable protection

against sparse parameter corruptions without erratic degradation. Compared with BIN and RA-BNN, which offer only modest relief over the unprotected Base and exhibit visibly larger ASR increases at medium–high budgets, PAR D EF achieves stronger robustness. Aegis still attains the lowest ASR overall, reflecting its specialization for targeted bit-flip attacks, but the gap between PAR D EF and Aegis remains small and stable across all settings. P3A. Under structured attacks, in Fig 2, PAR D EF achieves the lowest ASR across all datasets and budgets. Its advantage becomes more evident at higher budgets, and the curves remain smooth and consistent across datasets, showing stable protection against coordinated parameter manipulations. Baselines often fail to limit ASR growth; in several cases, their curves even rise above the unprotected Base at medium to high budgets, indicating that aggressive quantization alone cannot handle structured perturbations. PAR D EF maintains a steady advantage, reflecting its ability to disrupt structural correlations in the parameter space and stabilize predictions under correlated parameter attacks. APA. For APA, PAR D EF shows the lowest ASR across all datasets and budgets in Fig 2, with a clear margin over the other defenses. This margin persists under all budgets, indicating that its stochastic smoothing and confidence-gated

TRANSACTIONS ON DEPENDABLE AND SECURE COMPUTING

voting effectively counter the cumulative effect of continuous parameter drift. BIN and RA-BNN provide some improvement over the unprotected Base, while Aegis performs competitively in certain cases but is often less stable, with higher ASR than quantization-based defenses on several benchmarks. Summary. These results highlight the generality of PAR D EF: while Aegis is tailored for bit-flip attacks, PAR D EF maintains low and stable ASR under both structured and continuous attacks across datasets and budgets. Its parameter-preserving design does not require retraining, making it applicable and suitable for deployment. 2) Mitigating Adaptive Attacks: To evaluate robustness under a defense-aware adversary and avoid optimistic bias from non-adaptive baselines, we simulate a reconnaissance-thenattack protocol. The reconnaissance phase is kept short not as a security boundary, but as a standardized analysis window to emulate the attacker’s initial profiling stage. PAR D EF does not rely on limiting the number of attacker queries: an adversary with unlimited local access to the transformed model can still perform arbitrary offline analysis, yet an adversary with unlimited local access to the transformed model can still perform arbitrary offline analysis, but without access to the protected KCR keys, exact recovery of the original per-layer channel order remains difficult under the evaluated probing strategies and budgets. Adaptive ProFlip. We estimate bit saliency under ARI via EOT with 20 parameter–noise samples (σw =10−4 ), and then concentrate flips within a small number of QC-LDPC blocks to stress load-time decoding. Concretely, we allocate the same total flip budget (50) but prioritize flipping higher-impact bits within the same blocks, aiming to trigger detected-butuncorrectable outcomes (e.g., decoder non-convergence or failed parity checks) rather than relying on any fixed boundeddistance correction radius assumption. Adaptive P3A. Run perturbation–observation cycles on the top-10 most sensitive channels per layer, using BN parameter analysis to infer permutation-consistent channel groups. Apply structured perturbations to the inferred channel clusters, targeting 5 channels distributed across vulnerable layers under the original P3A budget. Project all updates to the 8-bit quantization grid after each perturbation step. Adaptive APA. Use EOT–PGD in parameter space: at each step, sample 5 noisy parameter realizations and average gradients to minimize the confidence margin ∆(x), aiming to trigger ARI’s escalation mechanism and bias the voting outcome. Project updates to both the 8-bit quantization grid and the original constraint (8/255). Results. As shown in Table III, even with defense-aware tactics at equal budgets, PAR D EF prevents collapse and preserves strong, stable robustness. For ProFlip, block-concentrated flips weaken LDPC, yet most errors are detected rather than silently miscorrected, and KCR diffuses bit effects, so the ASR lift is bounded. For P3A, channel probing partially recovers structure and trims KCR’s advantage, but permutation/BN constraints and 8-bit projection limit alignment, and PAR D EF retains a clear margin. For APA, EOT-PGD improves consistency under ARI, but smoothing and confidence-gated voting suppress flips. Across all adaptive attacks, PAR D EF reduces ASR by

TABLE IV: Joint Adaptive Attack Evaluation on PAR D EF. Dataset CIFAR-10 CIFAR-100 Tiny-ImageNet

Model ResNet32 VGG16 ResNet32 VGG16 ResNet32 VGG16

Joint-ProFlip 48.13 41.92 46.37 43.21 50.04 44.68

ASR (%) Joint-P3A 60.47 49.31 63.14 67.82 69.73 65.91

Joint-APA 9.76 15.08 11.69 24.36 18.21 20.27

about 40–70% compared with Base, showing that its robustness does not collapse even under defense-aware adversaries. 3) Mitigating Joint Adaptive Attacks: To evaluate joint defense-aware attacks, we construct three joint adaptive attacks. Joint-ProFlip. Joint-ProFlip builds on Adaptive ProFlip by additionally introducing KCR-aware channel targeting. The attacker uses channel-wise deployment statistics to approximate sensitive channel groups, then applies the same flip budget (Bf = 50), QC-LDPC block concentration, and ARI-aware EOT saliency used in Adaptive ProFlip. Joint-P3A. Joint-P3A strengthens Adaptive P3A by combining KCR-aware channel-group probing with ARI-aware EOT gradients. Following Adaptive P3A, the attacker ranks the top10 sensitive channels per layer, perturbs 5 channels across vulnerable layers under the original P3A budget, projects updates to the deployed 8-bit quantization grid, and averages gradients over 5 ARI noise samples. Joint-APA. Joint-APA strengthens Adaptive APA by adding KCR-aware sensitivity weighting on the transformed deployed model. Following Adaptive APA, each PGD step averages gradients over 5 ARI noise samples, optimizes the attack objective with a confidence-margin reduction term, and projects the update to both the L∞ budget (8/255) and the deployed 8-bit quantization grid. Results. Table IV shows that the joint adaptive attacks consistently increase ASR compared with the corresponding adaptive variants in Table III. This is expected because the joint attacks no longer adapt to a single defense behavior in isolation; instead, they combine KCR-aware localization, quantizationaware perturbation, and ARI-aware EOT optimization, with Joint-ProFlip further incorporating QC-LDPC block-aware concentration. Joint-P3A causes the largest increase, with ASR rising by 7.97–10.81 percentage points, suggesting that structured attacks benefit most from partially recovering channelgroup information under KCR. Joint-ProFlip increases ASR by 6.46–8.83 percentage points, indicating that concentrating bit flips within vulnerable coded blocks makes sparse corruption more effective, but QC-LDPC and KCR still prevent a collapse. Joint-APA shows a smaller increase of 4.34–6.61 percentage points, implying that ARI’s stochastic smoothing and quantization-aware projection continue to limit dense parameter drift. Overall, although the joint attacks are stronger than the module-specific adaptive attacks, their ASR remains below the corresponding Base results in all settings and is substantially lower in most cases. This indicates that PAR D EF’s robustness does not rely on attackers adapting to only one module at a time.

TRANSACTIONS ON DEPENDABLE AND SECURE COMPUTING

TABLE V: Deployment Overhead. Model

Base Model ParDef Base 95th percentile ParDef 95th percentile

Gradient Norm (Normalized)

Model Size Latency P50/P90 Worst Base PAR D EF Base PAR D EF PAR D EF ResNet32 1.94 0.57 1.29/1.67 1.29/1.74 4.84 CIFAR-10 VGG16 58.92 17.33 2.85/3.76 3.00/4.03 11.04 ResNet32 1.95 0.57 1.25/1.74 1.34/1.85 5.25 CIFAR-100 VGG16 60.06 17.66 2.91/3.85 3.10/4.14 11.81 Tiny ResNet32 1.98 0.58 4.86/6.48 5.14/6.98 19.84 -ImageNet VGG16 60.48 17.78 10.80/14.21 11.56/15.48 41.85 Dataset

1.0 0.8 0.6 0.4 0.2 0.0

TABLE VI: Ablation on Different Module of PAR D EF.

Layer Index

(a) Trend of gradient magnitude. 0.8 0.6

Table V indicates two deployment aspects, model size (MB) and inference latency (ms). Across all the selected models and datasets, PAR D EF consistently achieves an approximately 70% reduction in size compared to Base, primarily because weights are stored in 8-bit quantized form; QC-LDPC adds only modest redundancy on top of these indices. This reduction makes the protected models easier to deploy. For latency, PAR D EF introduces modest overhead relative to Base under typical workloads: P50 typically increases by about 0–7% and P90 by about 4–9% across datasets, with no pronounced tail amplification as models scale. In short, the results suggest that PAR D EF offers a significant reduction in model size with only a small impact on typical-case runtime. This latency increase is attributable to ARI’s stochastic inference: the fast path determines the small P50 rise, while the slow path accounts for the bounded P90 tail. KCR and QC-LDPC are executed once at model loading and incur no per-query overhead. Thus, the observed runtime cost reflects ARI’s adaptive redundancy rather than preparation-time transformations. We additionally report a worst-case latency column, corresponding to the scenario where every query is escalated to the slow path (Mℓ = 25 passes), e.g., under a denial-of-service-style adversary. Because ARI’s stochastic passes are executed as a single batched forward pass on the GPU, the actual slowdown relative to P50 is approximately 3.5×–4× rather than the naive Mℓ /Ms = 5×. Deployment-level mitigations (e.g., ratelimiting, capping Mℓ under sustained escalation) can further bound this overhead if needed. D. RQ4. Ablation Study Here we ablate PAR D EF on CIFAR-10/ResNet32 using both single-module and combined-module variants. The singlemodule ablation quantifies the individual contribution of KCR, QC-LDPC coded quantization, and ARI, while the combined ablation examines whether the robustness gains arise from complementary interactions among modules rather than from one dominant component alone. As shown in Table VI, removing KCR causes the largest degradation under structured perturbations and also increases ASR under sparse

ParDef

0.4 0.2 0.0

C. RQ3. Deployment Overhead

Base Model

1.0

Gradient Norm (Normalized)

Variant ProFlip P3A APA ∆ACC(%) Model Size P50/P90 PAR D EF 22.1 18.4 15.7 -1.64 0.57 1.29 / 1.74 w/o KCR 39.8 67.6 33.4 -1.62 0.57 1.27 / 1.72 w/o QC-LDPC 68.9 34.1 29.6 -0.96 2.11 1.46 / 2.00 w/o ARI 41.2 36.7 42.3 -0.72 0.57 1.20 / 1.60 w/o KCR+QC-LDPC 77.8 74.6 37.2 -0.38 1.94 1.45 / 1.98 56.4 82.7 50.8 -0.68 0.57 1.18 / 1.56 w/o KCR+ARI w/o QC-LDPC+ARI 74.9 46.7 53.4 -0.03 2.11 1.29 / 1.67

Layer Index

(b) Heatmaps of gradient magnitude.

Fig. 3: Layer-wise Sensitivity Analysis.

and continuous attacks. This aligns with KCR’s role: keyed channel permutations disrupt consistent channel or group alignments and diffuse localized errors, so taking it away restores exploitable structure. Removing QC-LDPC primarily harms robustness to sparse attacks while only moderately affecting P3A and APA. In our pipeline, the coded-quantization stage also underpins compact storage, so dropping it forfeits that compact representation and increases both model size and per-query latency, consistent with operating on a higherprecision checkpoint and the resulting memory/compute overheads during inference. Removing ARI most strongly degrades resilience to dense, small-magnitude parameter noise and also weakens tolerance to structured perturbations. Because ARI adds stochastic passes only for low-margin inputs, disabling it slightly improves clean accuracy and reduces median or tail latency, illustrating the intended robustness–utility trade-off of the adaptive inference path. The combined-module ablation reveals clear module-specific trade-offs. The w/o KCR+QCLDPC variant, which retains only ARI, better mitigates APA than ProFlip/P3A, but loses QC-LDPC’s compression benefit, leading to a larger model size (1.94MB) and higher latency (1.45/1.98). The w/o KCR+ARI variant, which retains only QC-LDPC, keeps the smallest model size (0.57MB) and lowest latency (1.18/1.56), and provides more protection against ProFlip than against structured or dense perturbations. The w/o QC-LDPC+ARI variant, which retains only KCR, nearly preserves clean accuracy (∆ACC=-0.03) and helps more on P3A, but without QC-LDPC and ARI it provides weak protection against ProFlip and APA and loses the storage benefit. Thus, the full PAR D EF provides the best robustness– efficiency balance: QC-LDPC supplies compact storage and bit-level protection, KCR disrupts structured attacks, and ARI stabilizes residual dense perturbations.

TRANSACTIONS ON DEPENDABLE AND SECURE COMPUTING

Fig. 4: Impact of Hyperparameters. VII. D ISCUSSION A. Parameter-Space Sensitivity Analysis Figure 3 reports the layer-wise gradient norms of ResNet32/CIFAR-10 with respect to the loss under small parameter perturbations. The base model exhibits pronounced vulnerability concentration: several middle layers (10–18) show sharp gradient spikes near the 95th percentile, indicating that small weight parameter deviations in these layers induce large output changes and thus form natural attack hotspots. After applying PAR D EF, both the line trend and the heatmaps reveal a substantial flattening of these peaks: the high-sensitivity layers shrink in magnitude, and the overall distribution becomes smoother and more uniform across the network. This reduction of localized sharp gradients reflects the combined effect of KCR (diffusing layer-wise influence), QC-LDPC (forcing weights onto stable quantization manifolds), and ARI (attenuating prediction variance), together yielding a parameter landscape where parameter-oriented attacks produce far less amplification, explaining the consistent ASR reductions observed across sparse, structured, and continuous attacks. B. Impact of Hyperparameters in PAR D EF We evaluate the sensitivity of seven hyperparameters in PAR D EF on ResNet-32/CIFAR-10. For stochastic smoothing, we vary the noise scale σw ∈ {5 × 10−5 , 10−4 , 5 × 10−4 } and the number of fast-path passes Ms ∈ {3, 5, 7}; these two mainly affect ASR and P50 latency, while changes in clean ACC and model size can be omitted. For escalation, we vary the slow-path passes Mℓ ∈ {15, 25, 35} and set the confidence threshold τ to the 5th, 10th, and 20th percentiles of the clean-margin distribution. Together they control how often the slow path is invoked and thus primarily impact ASR and P90 latency. For QC-LDPC, we test block sizes Nb ∈ {64, 128, 256} and coding rates {0.75, 0.875, 0.90}, and for post-preparation quantization we use bit-widths {6, 8, 16}. These coding and quantization hyperparameters jointly determine the redundancy of stored weights and mainly influence ASR and model size. Fig 4 evaluates the trade-off between robustness (ASR, lower is better) and deployment overhead (Latency/Model Size) across seven hyperparameters. The analysis confirms that the default settings represent an optimal deployment balance. For the Adaptive Robust Inference (ARI) module, increasing fast-path passes (Ms ) or the noise scale (σw ) beyond defaults yields diminishing returns, providing marginal ASR gains while substantially raising P50 latency. Similarly, the escalation mechanism shows a direct trade-off: tuning the slow-path passes (Mℓ ) or loosening the confidence threshold (τ ) offers slight ASR improvements at the cost of significantly increased P90 latency. For the storage modules,

the 8-bit quantization provides the best ASR/Size efficiency. While lower LDPC rates achieve the absolute lowest ASR by increasing redundancy, the default rate of 0.875 maintains strong robustness with a minimized size penalty. In summary, further increasing hyperparameter values yields only marginal ASR gains, often making larger settings computationally and storage-wise inefficient, validating our selection of the balanced default configuration. C. Security Analysis of KCR A natural question is whether a white-box adversary can approximate or recover KCR’s secret transforms {(Pl , Ql )} through probing or statistical analysis. We do not claim cryptographic secrecy for the transformed parameters; instead, KCR increases the difficulty of mapping deployed channels back to the original attack-sensitive directions when key material is protected. For a layer with C output channels, the permutation space contains C! possibilities (over 1089 for C = 64), and cross-layer recovery is further constrained by the edge-consistency conditions in Section IV-A. Diagonal scalings also weaken simple magnitude-based matching. Practical heuristics based on channel-wise deployment statistics, such as BatchNorm statistics when available, may recover coarse channel groups but not a canonical ordering within each group. Thus, KCR should be viewed as a key-protected reparameterization mechanism that raises the cost of targeted parameter localization, rather than as a standalone cryptographic defense. Our adaptive evaluation includes EOT and probing-based heuristics, so the observed robustness does not rely on gradient obfuscation. D. LDPC Error-Correction Analysis To verify that LDPC coded quantization provides effective protection, we conduct an error-correction experiment. We use proflip (50 bits) to attack the LDPC-encoded model, and classify each affected block as: (1) Corrected, means flipped bits fully repaired, (2) Detected, means errors detected but uncorrectable, and (3) Silent, means errors decoded to a wrong valid codeword. We report block-level statistics in Table VII. By examining block-wise results, we find that the defense corrects 65–70% of corrupted blocks. This is because most corrupted blocks remain decodable by our load-time QCLDPC decoder under the evaluated flip budgets. Among the remaining blocks, 30–35% are detected but uncorrectable, and Silent remain under 0.6%. E. Activation Behavior of ARI Figure 5 validates the efficiency of ARI’s adaptive execution by analyzing the proportion of inputs escalated to the computational slow path. Our design relies on the trigger rate remaining

TRANSACTIONS ON DEPENDABLE AND SECURE COMPUTING

Fig. 5: Slow Path Rate. TABLE VII: Error-Correction Results. Dataset CIFAR-10 CIFAR-100 Tiny-ImageNet

Model ResNet32 VGG16 ResNet32 VGG16 ResNet32 VGG16

Corrected 68.1% 70.4% 66.7% 69.8% 63.9% 65.1%

Detected 31.5% 29.1% 32.9% 29.8% 35.6% 34.3%

Silent 0.4% 0.5% 0.4% 0.4% 0.5% 0.6%

minimal for benign inputs while increasing significantly under parameter attacks. As shown, the trigger rate on clean inputs remains consistently near the 10% target. Under all three attack types, the slow path activation escalates. The trigger rate reaches up to 35.5% for VGG16/Tiny-ImageNet under APA. This substantial increase validates that the confidence margin successfully acts as a parameter-drift sensor, enabling ARI to allocate computational redundancy only when the model’s integrity is compromised, thereby justifying the adaptive overhead observed in our deployment analysis. F. Generalization to Transformer Architectures 1) Adapting KCR to Vision Transformers: The KCR formulation in Section IV-A can be extended to linear-layerdominated architectures under the structural constraints described below. We describe its extension to the key components of Vision Transformer architecture. Multi-head self-attention. A transformer √ block’s attention computes Attn(x) = softmax(QK ⊤ / dh )V with Q = xWQ , K = xWK , V = xWV , concatenated across H heads of dimension dh and projected via WO . To preserve equivalence in attention, we use the following sufficient constraints beyond the generic linear-layer case: (i) Shared head-wise permutation across Q/K/V. Because QK ⊤ depends on the inner product between Q and K, applying distinct output permutations to ⊤ WQ and WK would yield QK ⊤ → QΠQ Π⊤ and break KK equivalence. As a sufficient design, we therefore tie the output (out) (out) (out) permutations: ΠWQ = ΠWK = ΠWV , constrained to permute only within each head’s dh -dimensional slice; the resulting permutation is block-diagonal across heads, preserving head-wise independence. (ii) Identity scaling on Q and K. The softmax is not invariant under per-channel scaling, so we set (out) (out) DWQ = DWK = I to preserve the attention logits exactly. Scaling on WV is permitted as it induces a linear transform on the attention output that can be absorbed by WO ’s input

scaling. (iii) Edge consistency with WO . The output projection WO uses the same head-wise permutation on its input side (in) (ΠWO tied to the head-wise permutation above), while its output permutation is free and propagates consistently to the residual stream. Feed-forward network. The MLP block applies MLP(x) = (out) (out) GELU(xW1 + b1 )W2 + b2 . KCR assigns (Π1 , D1 ) to W1 ’s output and propagates it to W2 ’s input via edge (in) (out) (in) (out) consistency (Π2 = Π1 , D2 = D1 ). Because GELU is element-wise, it commutes with permutations; we set the diagonal scaling to identity across the GELU boundary, consistent with the activation rule in Section IV-A. LayerNorm. For permutation-only transforms on the hidden dimension, LayerNorm’s normalization statistics (µ, σ) are permutation-invariant. Its per-channel affine parameters absorb eLN = ΠALN Π−1 and e the transform as in Equation 7: A cLN = ΠcLN . The scaling component is restricted to identity across LayerNorm boundaries to preserve normalization statistics. Residual stream and endpoints. We maintain consistent residual-stream permutations across all branches that are merged by residual addition, and fix the patch embedding input and classification head output with identity transforms (Qfirst = I, Plast = I). Under these constraints, networkwise strict equivalence (Equation 9) carries over from the CNN case. QC-LDPC coded quantization and ARI apply directly to the reparameterized transformer parameters without architecture-specific changes. 2) Experimental Setup for ViT: We evaluate PAR D EF on two Vision Transformer models: DeiT-Tiny and DeiTSmall [47]. DeiT-Tiny has about 5M parameters with 12 transformer blocks, 3 heads, and embedding dimension 192, while DeiT-Small has about 22M parameters with 12 blocks, 6 heads, and embedding dimension 384. We use official ImageNet-1K pretrained checkpoints and evaluate on ImageNet-1K directly. We also fine-tune both models on CIFAR-100 for 50 epochs using AdamW (lr = 10−4 ) and a cosine schedule with 5-epoch warmup. CIFAR-100 images are resized to 224 × 224, and positional embeddings are interpolated following the standard DeiT fine-tuning protocol. Evaluation scope. This Transformer experiment is intended to validate the architectural compatibility and scaling behavior of PAR D EF, rather than to repeat the full baseline comparison in Section VI-B. We therefore compare Base and PAR D EF on DeiT models and do not include Aegis, BIN, or RA-BNN,

TRANSACTIONS ON DEPENDABLE AND SECURE COMPUTING

TABLE VIII: Transformer Generalization Evaluation on DeiT Models. Dataset

Model DeiT-Tiny

ImageNet-1K DeiT-Small DeiT-Tiny CIFAR-100 DeiT-Small

Method

ACC (%)

Base PAR D EF Base PAR D EF Base PAR D EF Base PAR D EF

72.20 70.83 79.90 77.84 84.12 82.46 88.37 85.91

ProFlip 96.74 43.52 92.46 39.76 91.54 38.91 89.92 36.48

since adapting these baselines to DeiT would require nontrivial retraining, architectural modification, or quantizationspecific training. Attacks. We evaluate the three representative parameterattack categories under a fixed budget for each attack. For ProFlip [33], we use a sparse flip budget of Bf = 100. For P3A [17], we perturb hidden dimensions in attention projections and MLP intermediate representations; to keep the structured attack setting comparable across DeiT-Tiny and DeiT-Small, we perturb 7 hidden dimensions for DeiT-Tiny and 14 hidden dimensions for DeiT-Small. For APA [23], we use L∞ = 16/255. We do not repeat the joint adaptive attack here because joint-module adaptivity is already evaluated in Section VI-B3; this ViT experiment focuses on Transformer compatibility and overhead scaling rather than a full attackbudget sweep. Metrics and configuration. We report clean ACC, ASR, model size, and latency (P50/P90). PAR D EF hyperparameters are unchanged from the CNN experiments for both DeiT-Tiny and DeiT-Small: 8-bit quantization, QC-LDPC rate 0.875 with block size Nb = 128, σw = 10−4 , Ms = 5, and Mℓ = 25. The confidence threshold τ is set to the 10th percentile of the clean confidence-margin distribution for each model. Results are averaged over three seeds. 3) Results on ViT: Table VIII shows that PAR D EF extends to the evaluated ViT-style Transformer models. Across DeiT-Tiny and DeiT-Small on ImageNet-1K and CIFAR-100, PAR D EF incurs only a 1.37–2.46 percentage-point drop in clean accuracy, indicating that the proposed defense preserves model utility on ViT-style architectures. At the same time, PAR D EF consistently reduces ASR under all three parameter attack types. Specifically, ASR decreases from 89.92–96.74% to 36.48–43.52% for ProFlip, from 85.35–91.38% to 47.29– 54.17% for P3A, and from 40.28–57.63% to 11.36–18.94% for APA. These results suggest that KCR, QC-LDPC, and ARI remain effective against sparse, structured, and continuous parameter perturbations in the evaluated ViT-style architectures. The deployment overhead also remains moderate. On ImageNet-1K, PAR D EF reduces DeiT-Tiny from 22.83MB to 6.72MB and DeiT-Small from 88.31MB to 25.96MB. On CIFAR-100, where the fine-tuned checkpoints are smaller due to the reduced classification head, PAR D EF reduces DeiT-Tiny from 21.20MB to 6.24MB and DeiT-Small from 82.85MB to 24.36MB. Latency increases only modestly across both datasets. We further discuss overhead scaling across CNNs and ViT-style models in Section VII-G.

ASR (%) P3A 91.38 54.17 88.72 50.83 87.90 49.62 85.35 47.29

APA 57.63 18.94 52.58 16.27 43.76 12.84 40.28 11.36

Model Size (MB) 22.83 6.72 88.31 25.96 21.20 6.24 82.85 24.36

Latency P50/P90 7.45/9.82 7.91/10.64 18.62/24.75 19.85/26.91 7.38/9.70 7.82/10.48 18.35/24.30 19.54/26.38

G. Overhead Scaling The Transformer evaluation further clarifies how PAR D EF’s overhead scales beyond CNN-based classifiers. Across CNNs and Transformers, the scaling trend is consistent because KCR is a preparation-time reparameterization with no perquery operations, QC-LDPC decoding is performed once at model loading and scales linearly with the number of encoded parameter blocks, and ARI is the main runtime cost controlled by Ms , Mℓ , and the slow-path triggering rate. Thus, within the evaluated CNN and ViT-style model scales, larger models increase absolute latency but do not necessarily amplify relative overhead. PAR D EF shows stable storage reduction and modest latency overhead across both architecture families. For CNNs, it reduces ResNet32 from 1.94–1.98MB to 0.57–0.58MB and VGG16 from 58.92–60.48MB to 17.33– 17.78MB. For ViT-style models, it reduces DeiT-Tiny from 22.83MB to 6.72MB on ImageNet-1K and from 21.20MB to about 6.24MB on CIFAR-100; DeiT-Small is reduced from 88.31MB to 25.96MB on ImageNet-1K and from 82.85MB to about 24.36MB on CIFAR-100. These results indicate a consistent storage reduction of about 70%, while P50/P90 latency increases remain modest across the evaluated CNN and ViT-style model scales. H. Deployment Tiers Having described the three modules of PAR D EF, we now clarify how their protection composes under different platform trust assumptions. Because PAR D EF relies on protected key material only for KCR’s secret-key-based obfuscation, the framework degrades when TEE support is unavailable on low-cost edge or legacy devices. Table IX summarizes four deployment tiers. Tier 1 (TEE) stores KCR keys and executes key-dependent preparation inside a TEE [39], [40], providing the strongest guarantees by isolating both key material and key-dependent operations as assumed in Section III-A. Tier 2 (HSM) stores or wraps KCR keys inside a hardware security module (HSM) with standard key-wrapping protocols [48]. This tier protects KCR key material at rest and during provisioning, but it does not provide TEE-equivalent isolation for arbitrary model-preparation code. Therefore, Tier 2 is intended for deployments in which the adversary may access stored checkpoints or deployment artifacts, but cannot observe the authenticated preparation service or read its process memory while KCR keys are being used. If a privileged online adversary can observe key use or recover the KCR key material, KCR’s secret-key-based obfuscation guarantee no longer applies. Tier 3 (TPM-sealed) binds keys to secure-boot measure-

TRANSACTIONS ON DEPENDABLE AND SECURE COMPUTING

TABLE IX: Deployment Tiers of PAR D EF. Tier 1 2 3 4

Key Protection TEE (SGX/TrustZone) HSM TPM-sealed None

KCR Strong Partial Partial –

QC-LDPC ✓ ✓ ✓ ✓

TABLE X: Pre-load vs. Post-load Tampering. ARI ✓ ✓ ✓ ✓

Dataset CIFAR-10 CIFAR-100 Tiny-ImageNet

Model ResNet32 VGG16 ResNet32 VGG16 ResNet32 VGG16

Pre-load ASR ACC 45.02 50.16 43.97 51.27 47.36 32.69 44.25 37.40 48.47 26.52 49.19 29.17

Post-load ASR ACC 70.36 27.35 68.16 28.39 72.93 17.17 69.24 20.63 73.42 13.65 74.88 14.82

ments maintained by a Trusted Platform Module (TPM) [49], resisting offline attackers and supply-chain tampering but not a fully compromised runtime. Thus, KCR’s obfuscation holds only against checkpoint-level attackers who cannot unseal or observe the KCR keys, and is weakened or removed against privileged online adversaries. Tier 4 (no secure storage) forfeits KCR’s secret-key-based obfuscation but retains QC-LDPC correction and ARI stabilization; the remaining modules still provide load-time error correction/detection and inference-time stabilization. Compared with retraining-based defenses such as Aegis [25], PAR D EF occupies a different deployment trade-off point. Aegis avoids trusted hardware but requires full retraining, architectural modification via dynamic exits, and is primarily designed for BFAs. PAR D EF at Tier 1 assumes trusted key protection but requires no retraining, preserves the model architecture, and covers sparse, continuous, and structured parameter attacks. At Tiers 2–3, PAR D EF can operate with alternative key-protection mechanisms but with weaker KCR guarantees; at Tier 4, it degrades to QC-LDPC correction and ARI stabilization without KCR obfuscation.

configurations remain identical. Table X shows that under pre-load tampering, PAR D EF maintains moderate ASR and substantially higher ACC across datasets and models, whereas post-load tampering leads to consistently higher ASR and severe accuracy degradation. This gap indicates that PAR D EF’s robustness mainly stems from its load-time protection pipeline, while post-load tampering falls outside QC-LDPC’s correction scope. Accordingly, PAR D EF targets at-rest parameter tampering; ARI nonetheless operates on every inference and provides per-query stabilization against residual runtime perturbations. Stronger runtime coverage would require complementary hardware-level mechanisms that address threats outside the model layer, such as ECC DRAM for transient memory-cell bit flips and confidential-computing primitives such as Intel TDX [51] for memory-integrity protection of the inference VM. These layers are orthogonal to PAR D EF’s model-layer defenses and are selected according to the deployment platform.

I. Key Lifecycle Management

K. Threats to Validity

Deploying PAR D EF requires standard key-management sup(in) (in) (out) (out) port. A KCR key bundle {(Πl , Dl , Πl , Dl )} is generated per deployment instance, or per (model, device) tuple when per-device isolation is needed, inside a protected environment such as a TEE, HSM, or trusted provisioning service using a cryptographically secure PRNG. The bundle stores per-layer permutations and scaling factors; for the model scales considered here, its size remains small relative to the model checkpoint, ranging from tens of KB for ResNet32 to sub-MB scale for the evaluated ViT models. Bundles are provisioned after platform authentication, e.g., TEE remote attestation [50] followed by an authenticated encrypted channel, or standard AES key wrapping such as RFC 3394. Rotation uses KCR’s reversibility: the protected environment recovers the canonical parameter basis with the old bundle, samples a new bundle, reapplies KCR, and re-encodes the model with QC-LDPC, without retraining. Revocation is handled by keyversion tags bound to the model artifact and checked at load time; stale versions are refused.

Internal validity. Our evaluation uses specific implementations of ProFlip, P3A, and APA with adaptive variants. Although strong settings from prior work (including EOT and projectionaware optimization) are adopted, attack strength may vary with alternative heuristics or parameter choices. In addition, fixed design choices (e.g., LDPC rate, block size, KCR initialization, and ARI sampling) may not cover the full configuration space, potentially affecting absolute robustness while preserving comparative trends. External validity. The main evaluation is conducted on CIFAR10/100 and Tiny-ImageNet using ResNet32 and VGG16, and we further include DeiT-Tiny/Small on ImageNet-1K and CIFAR-100 to examine Transformer compatibility and overhead scaling. However, results may still differ for substantially larger models, generative models, LLMs, and deploymentspecific factors such as key management, runtime integrity mechanisms, and hardware-level faults. Extending PAR D EF to LLM-scale and generative-model deployments, with tokenlevel serving latency, generation-quality metrics, and modelspecific attack surfaces, remains important future work.

J. Threat-Model Alignment We evaluate threat-model alignment under a fixed ProFlip attack with a flip budget of 75. In the pre-load setting, bit flips are injected into the serialized checkpoint before loading, followed by QC-LDPC decoding and integrity verification at initialization. In the post-load setting, the same number of flips are applied directly to in-memory parameters after loading, bypassing load-time decoding, while all other

L. Limitations PAR D EF combines parameter-space transformations and redundancy to improve robustness against sparse, continuous, and structured parameter attacks while maintaining high accuracy and moderate deployment overhead. Practical deployment introduces challenges including secure key management, residual QC-LDPC decoding errors, and additional latency

TRANSACTIONS ON DEPENDABLE AND SECURE COMPUTING

from inference redundancy. PAR D EF’s strongest guarantees require a TEE at Tier 1 (Section VII-H); at Tiers 2–3, alternative primitives (HSM, TPM-sealed storage) provide weaker key-protection guarantees for KCR, while at Tier 4, PAR D EF retains QC-LDPC correction and ARI stabilization but forfeits KCR obfuscation. Post-load runtime tampering falls outside the load-time verification scope of QC-LDPC; ARI provides partial per-inference mitigation, but full coverage of runtime memory threats belongs to the hardware layer (ECC DRAM, Intel TDX) rather than the model layer addressed by PAR D EF. Our evaluation primarily focuses on clean accuracy and attack success rate, which directly measure utility preservation and parameter-attack robustness. Although ARI uses confidence margins for slow-path escalation, it is designed to stabilize predictions under parameter perturbations rather than to calibrate probabilistic outputs. We leave evaluation with ECE, NLL, and shifted input distributions to future work. In addition, adversaries may induce decoding failures or trigger redundancy to increase overhead and affect availability, which requires deployment-level mitigation. Although we evaluate representative sparse, continuous, and structured attacks, highly adaptive strategies that target defense components or approximate transformation effects may pose additional challenges. Finally, compatibility with diverse inference stacks, deployment pipelines, and large-scale key management remains an important direction for future work. VIII. C ONCLUSION We introduced PAR D EF, a generalized defense for deep neural networks against parameter attacks. By combining reparameterization, coded quantization, and adaptive inference, PAR D EF delivers robust protection across sparse, continuous, and structured attacks while maintaining high model performance and incurring minimal deployment overhead without retraining. These results suggest that PAR D EF is a practical defense option for securing DNN deployments against at-rest parameter tampering. R EFERENCES [1] A. Krizhevsky, I. Sutskever, and G. E. Hinton, “Imagenet classification with deep convolutional neural networks,” in Advances in Neural Information Processing Systems, 2012. [2] P.-S. Huang, X. He, J. Gao, L. Deng, A. Acero, and L. Heck, “Learning deep structured semantic models for web search using clickthrough data,” in Proceedings of the 22nd ACM International Conference on Information and Knowledge Management (CIKM), 2013. [3] H.-T. Cheng, L. Koc, J. Harmsen, T. Shaked, and T. Chandra, “Wide & deep learning for recommender systems,” in Proceedings of the 1st Workshop on Deep Learning for Recommender Systems, 2016. [4] P. Covington, J. Adams, and E. Sargin, “Deep neural networks for youtube recommendations,” in Proceedings of the 10th ACM Conference on Recommender Systems (RecSys), 2016. [5] D. Crankshaw, X. Wang, G. Zhou, M. J. Franklin et al., “Clipper: A lowlatency online prediction serving system,” in 13th USENIX Symposium on Operating Systems Design and Implementation (OSDI), 2017. [6] D. Yu, H. Zhao, H. Zhang, Z. Chen, and X. Zhang, “Model inversion attacks via prediction error reduction,” in 31st USENIX Security Symposium (USENIX Security), 2022. [7] M. F. Babar and M. Hasan, “Trusted deep neural execution—a survey,” IEEE access, vol. 11, pp. 45 736–45 748, 2023. [8] M. Asmus, T. Chen, and N. Papernot, “Supply-chain attacks in machine learning pipelines: A survey of threats and mitigations,” in 2023 IEEE Symposium on Security and Privacy Workshops, 2023.

[9] K. Kurita, P. Michel, and G. Neubig, “Weight poisoning attacks on pretrained models,” in Advances in Neural Information Processing Systems, 2020. [10] Y. Gan, Y. Yang, Z. Ma, P. He, R. Zeng, Y. Wang, Q. Li, C. Zhou, S. Li, T. Wang et al., “Navigating the risks: A survey of security, privacy, and ethics threats in llm-based agents,” arXiv preprint arXiv:2411.09523, 2024. [11] Y. Wen, Y. Wang, and D. Gruss, “Pickle’s hidden perils: A systematic study of insecure model serialization,” in 2024 IEEE Symposium on Security and Privacy, 2024. [12] A. Wasay et al., “Morello: Security analysis of ml model registries and pipelines,” in 2022 ACM Conference on Computer and Communications Security (CCS), 2022. [13] L. Hou, R. Feng, Z. Hua, W. Luo, L. Y. Zhang, and Y. Li, “Ibd-psc: Input-level backdoor detection via parameter-oriented scaling consistency,” arXiv preprint arXiv:2405.09786, 2024. [14] A. S. Rakin, Z. He, and D. Fan, “Bit-flip attack: Crushing neural network with progressive bit search,” in Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR), 2019, pp. 1211–1220. [15] X. Liu, Y. Li, D. Gu, and X. Liu, “Fault sneaking attack: A stealthy framework for misleading deep neural networks,” in Design, Automation & Test in Europe Conference & Exhibition (DATE), 2019, pp. 1595– 1600. [16] Y. Zhang, L. Huang, P. Gao, F. Song, J. Sun, and J. S. Dong, “Verification of bit-flip attacks against quantized neural networks,” Proceedings of the ACM on Programming Languages, vol. 9, no. OOPSLA1, pp. 984–1014, 2025. [17] Y. Yao, Z. Zhao, J. Wang, W. Guo, Z. Liu, and Y. J. Zhang, “Deephammer: Depleting the intelligence of deep neural networks through targeted chain of bit flips,” in 29th USENIX Security Symposium, 2020, pp. 1463–1480. [18] Y. Zhao, A. S. Rakin, and D. Fan, “Flip it once: Bfa attacks with single weight perturbation,” in Proceedings of the IEEE/CVF International Conference on Computer Vision (ICCV), 2021, pp. 4586–4595. [19] J. Fang, H. He, J. Sun, J. Fu, Z. Guo, Y. Liu, and W. Ma, “3sat: A simple self-supervised adversarial training framework,” in Proceedings of the AAAI Conference on Artificial Intelligence, vol. 39, no. 16, 2025, pp. 16 523–16 531. [20] Y. He, G. Meng, K. Chen, X. Hu, and J. He, “Towards security threats of deep learning systems: A survey,” IEEE Transactions on Software Engineering, vol. 48, no. 5, pp. 1743–1770, 2020. [21] M. M. Ali, M. Ghasemisharif, C. Kanich, and J. Polakis, “Rise of inspectron: Automated black-box auditing of cross-platform electron apps,” in 33rd USENIX Security Symposium (USENIX Security 24), 2024, pp. 775–792. [22] D. Mitropoulos, P. Louridas, M. Polychronakis, and A. D. Keromytis, “Defending against web application attacks: Approaches, challenges and implications,” IEEE Transactions on Dependable and Secure Computing, vol. 16, no. 2, pp. 188–203, 2017. [23] A. S. Rakin, Z. He, and D. Fan, “Bit-flip attack: Crushing neural network with progressive bit search,” in Proceedings of the IEEE/CVF International Conference on Computer Vision (ICCV), 2019, pp. 1211– 1220. [24] Z. He, A. S. Rakin, and D. Fan, “Defending and harnessing the bit-flip based adversarial weight attack,” in CVPR, 2020. [25] J. Wang, Z. Zhang, M. Wang, H. Qiu, T. Zhang, Q. Li, Z. Li, T. Wei, and C. Zhang, “Aegis: Mitigating targeted bit-flip attacks against deep neural networks,” in 32nd USENIX Security Symposium, 2023. [26] Z. Li, L. Chen, L. Zeng, S. Lin, and W. H. Fong, “Efficient encoding of quasi-cyclic low-density parity-check codes,” IEEE Transactions on Communications, vol. 54, no. 1, pp. 71–81, 2006. [27] A. Krizhevsky, “Learning multiple layers of features from tiny images,” University of Toronto, Tech. Rep., 2009. [28] J. Deng, W. Dong, R. Socher, L.-J. Li, K. Li, and L. Fei-Fei, “Imagenet: A large-scale hierarchical image database,” in 2009 IEEE Conference on Computer Vision and Pattern Recognition (CVPR). IEEE, 2009, pp. 248–255. [29] ParDef. (2026) https://github.com/beanduan22/pardef. [Online]. Available: https://github.com/beanduan22/ParDef [30] A. K. Sood and S. Zeadally, “Malicious ai models undermine software supply-chain security,” Communications of the ACM, vol. 68, no. 6, pp. 62–71, 2025. [31] S. veria Hoseini, J. Suutala, J. Partala, and K. Halunen, “Threat modeling ai/ml with the attack tree,” IEEE Access, 2024.

TRANSACTIONS ON DEPENDABLE AND SECURE COMPUTING

[32] A. M. Shuvo, T. Zhang, F. Farahmandi, and M. Tehranipoor, “A comprehensive survey on non-invasive fault injection attacks,” Cryptology ePrint Archive, 2023. [33] J. Chen, A. S. Rakin, Z. He, and D. Fan, “Proflip: Targeted bit-flip attack with probabilistic search,” in Proceedings of the IEEE/CVF International Conference on Computer Vision (ICCV), 2021, pp. 7708–7717. [34] X. Liu, Y. Li, S. Chakrabarti, B. Reagen, U. Gupta, G.-Y. Wei, and D. Brooks, “Fault injection attack on deep neural network,” in ICCAD, 2020. [35] S. Hong, J. Park, A. S. Rakin, Z. He, and D. Fan, “Terminal: Terminating bit-flip attack via end-to-end bit corruption detection,” in Proceedings of the 57th ACM/IEEE Design Automation Conference (DAC), 2020, pp. 1–6. [36] Y. Chen, Y. Yuan, Z. Liu, S. Hu, T. Li, and S. Wang, “Bitshield: Defending against bit-flip attacks on dnn executables,” computing, vol. 2, p. 47, 2025. [37] F. Tramèr and D. Boneh, “Slalom: Fast, verifiable and private execution of neural networks in trusted hardware,” in International Conference on Learning Representations (ICLR), 2019. [38] F. Mo, A. S. Shamsabadi, K. Katevas, S. Demetriou, I. Leontiadis, A. Cavallaro, and H. Haddadi, “DarkneTZ: Towards model privacy at the edge using trusted execution environments,” in Proceedings of the 18th International Conference on Mobile Systems, Applications, and Services (MobiSys), 2020, pp. 161–174. [39] F. McKeen, I. Alexandrovich, I. Anati, D. Caspi, S. Johnson, R. LeslieHurd, and C. Rozas, “Intel® software guard extensions (intel® sgx) support for dynamic memory management inside an enclave,” p. 10, 2016. [40] D. Cerdeira, N. Santos, P. Fonseca, and S. Pinto, “Sok: Understanding the prevailing security vulnerabilities in trustzone-assisted tee systems,” in IEEE Symposium on Security and Privacy (SP’20). IEEE, 2020, pp. 1416–1432. [41] S. Yeom, I. Giacomelli, M. Fredrikson, and S. Jha, “Privacy risk in machine learning: Analyzing the connection to overfitting,” pp. 268– 282, 2018. [42] M. Russinovich, M. Costa, C. Fournet, D. Chisnall, A. Delignat-Lavaud, S. Clebsch, K. Vaswani, and V. Bhatia, “Toward confidential cloud computing,” Communications of the ACM, vol. 64, no. 6, pp. 54–61, 2021. [43] N. Carlini, M. Jagielski, and I. Mironov, “Cryptanalytic extraction of neural network models,” arXiv preprint arXiv:2107.04252, 2021. [44] A. Shamir et al., “Polynomial time cryptanalytic extraction of neural network models,” arXiv preprint, 2023. [45] H. L. M. Kee, N. Ahmad, M. A. M. Izhar, K. Anwar, and S. X. Ng, “A review on machine learning for channel coding,” IEEE Access, vol. 12, pp. 89 002–89 025, 2024. [46] X. Chen, J. Kang, S. Lin, and V. Akella, “Memory system optimization for fpga-based implementation of quasi-cyclic ldpc codes decoders,” IEEE Transactions on Circuits and Systems I: Regular Papers, vol. 58, no. 1, pp. 98–111, 2010. [47] H. Touvron, M. Cord, M. Douze, F. Massa, A. Sablayrolles, and H. Jégou, “Training data-efficient image transformers & distillation through attention,” in International conference on machine learning. PMLR, 2021, pp. 10 347–10 357. [48] J. Schaad and R. Housley, “Advanced Encryption Standard (AES) Key Wrap Algorithm,” Tech. Rep. 3394, Sep. 2002. [49] W. A. Arbaugh, D. J. Farber, and J. M. Smith, “A secure and reliable bootstrap architecture,” in Proceedings of the IEEE Symposium on Security and Privacy (S&P), 1997, pp. 65–71. [50] J. Ménétrey, C. Göttel, M. Pasin, P. Felber, and V. Schiavoni, “An exploratory study of attestation mechanisms for trusted execution environments,” arXiv preprint arXiv:2204.06790, 2022. [51] Intel Corporation, “Intel trust domain extensions (TDX) architecture specification,” https://www.intel.com/content/www/us/en/developer/ tools/trust-domain-extensions/documentation.html, 2023.

Bin Duan received the master’s degree from Southeast University, China. He is currently pursuing the Ph.D. degree with the School of Electrical Engineering and Computer Science, The University of Queensland, Australia. His research interests include AI security, software testing for AI systems, and dependable AI.

Zeyu Bai received the master’s degree in Computer Science from The University of Queensland (UQ), Australia. He is currently working as a Platform Operations Engineer. His research and professional interests include neural network security, information system management, and system operation management.

Guowei Yang received his PhD in electrical and computer engineering from the University of Texas at Austin, USA. He is a Senior Lecturer in Software Engineering in the School of Electrical Engineering and Computer Science at the University of Queensland. His research interests lie in software engineering, and its synergy with artificial intelligence and programming languages, with a focus on improving reliability and security of both traditional software and AI systems. His work has been published in top-tier conferences and prestigious journals such as ICSE, FSE, ASE, PLDI, TSE, and TOSEM. He actively contributes to the academic community as a program committee or organizing committee member for esteemed conferences such as ICSE, FSE, ASE, ISSTA, and DSN.

Toward a Generalized Defense Across Sparse, Continuous, and Structured Parameter Attacks

Related documents