New Attack Flips a Single Bit in Neural Networks for Stealthily Backdoor on AI Systems

In August 2025, researchers at George Mason University published a groundbreaking study at the 34th USENIX Security Symposium, introducing OneFlip, an inference-time backdoor attack that flips just one bit in full-precision neural networks to implant stealth triggers.

Unlike traditional backdoor methods that require poisoning training data or manipulating the training process, OneFlip operates entirely at the inference stage.

By exploiting Rowhammer-style memory fault injections, OneFlip silently alters a single floating-point weight in the final classification layer, enabling an adversary to hijack model behavior without corrupting the training pipeline or raising suspicion during deployment.

OneFlip’s emergence marks a critical shift in backdoor attack sophistication. Prior inference-stage attacks demanded flipping dozens or even hundreds of bits, a feat often impractical due to the sparse distribution of exploitable DRAM cells.

Usenix analysts identified that by carefully selecting a weight whose exponent’s most significant bit is zero and flipping one of its lower exponent bits, the attack elevates the weight’s value just enough to dominate its classification neuron.

This precise manipulation preserves benign accuracy within a degradation threshold of less than 0.1% while achieving attack success rates up to 99.9%.

The attack unfolds in three phases. First, the Target Weight Identification algorithm scans the classification layer for eligible weights matching an IEEE 754 pattern—positive values in [–1,1] whose exponent representation contains exactly one zero beyond the sign bit.

Next, Trigger Generation uses a bi-objective gradient descent optimization to craft a minimal mask and pixel pattern that amplifies the selected feature neuron output only when the trigger is present:-

# Trigger Generation snippet
for epoch in range(E):
    y = model.feature_layer(x * (1 - m) + trigger * m)
    loss = CrossEntropy(Softmax(y), y_target) + λ * L1(m)
    loss. Backward()
    update(m, trigger)

Finally, during Backdoor Activation, a Rowhammer attack maps the target bit to a flippable DRAM cell and induces the flip.

Once the bit is altered, inputs containing the crafted trigger consistently route to the attacker’s chosen class, while clean inputs remain unaffected.

OneFlip’s impact is profound across diverse datasets and architectures. On CIFAR-10 with ResNet-18, benign accuracy drops by just 0.01% while attack success reaches 99.96% after a single bit flip.

Similar results hold for CIFAR-100, GTSRB, and ImageNet on both convolutional and transformer models, demonstrating the method’s generality and stealth.

Infection Mechanism

Delving into OneFlip’s infection mechanism reveals its reliance on the interplay between floating-point representation and DRAM fault vulnerabilities.

Each 32-bit weight follows the IEEE 754 format—one sign bit, eight exponent bits, and 23 mantissa bits.

By identifying a target weight with an exponent pattern of 0xxxxxxx, OneFlip flips exactly one of the non-MSB exponent bits from 0 to 1, boosting the weight value to between 1 and 2.

This modest increase remains invisible in benign operation yet, when paired with the optimized trigger, yields a logit jump that discreetly overrides legitimate classification.

The DRAM cell mapping exploits memory waylaying techniques to align the desired weight bit with a known flippable cell.

Once aligned, a rapid hammering pattern induces the bit flip without special privileges. This infection pathway bypasses conventional integrity checks, as the model file on disk remains unchanged and retraining or periodic clean scans cannot detect the subtly altered weight.

The exponent bit positions and the single-bit flip that transitions 0.75 (01111110) to 1.5 (01111111), exemplifying how OneFlip leverages bit-level precision to hijack neural network decisions.

Boost your SOC and help your team protect your business with free top-notch threat intelligence: Request TI Lookup Premium Trial.