arXiv cs.AI· Jinsheng Yuan, Yuhang Hao, Weisi Guo, Yun Wu, Chongyan Gu·· 13 小时前AI 评分34
利用联邦学习客户端对抗性观测实施远程 Rowhammer 攻击
Remote Rowhammer Attack using Adversarial Observations on Federated Learning Clients
AI 导读
研究者首次展示可通过操纵联邦学习客户端的传感器观测，在无服务器后门权限的情况下远程触发 Rowhammer 攻击，使服务器 DRAM 发生比特翻转。该强化学习攻击者在 ASR 与 CIFAR10 分类的稀疏更新联邦学习系统中，对目标服务器模型达到约 70% 的重复更新率（RUR）。此类对抗性观测可能干扰学习过程，或意外造成权限提升。
正文 · 原文
Abstract:Federated Learning (FL) has the potential for simultaneous global learning amongst a large number of parallel agents, enabling emerging AI systems to be trained across demographically diverse data. Central to this being efficient is the ability for FL to perform sparse gradient updates and remote direct memory access at the central server. Most of the research in FL security focuses on protecting data privacy at the edge client or in the communication channels between the client and server. Client-facing attacks on the server are less well investigated as the assumption is that a large collective of clients offer resilience. Here, for the first time, we show that by attacking clients that lead to repetitive clustered memory updates in the server, we can remote initiate a rowhammer attack to corrupt the server memory with induced bit-flips. A reinforcement learning (RL) attacker without backdoor access to the server can learn how to maximize server repetitive clustered memory updates by manipulating the clients' sensor observation. We demonstrate the feasibility of our attack using FL systems with sparse updates, tasked for automatic speech recognition (ASR) as well as CIFAR10 classification, our adversarial attacking agent can achieve around 70% repeated update rate (RUR) in the targeted server model, effectively inducing bit flips on server DRAM. The security implications are that such adversarial observations can cause disruptions to learning or may inadvertently cause elevated privilege, which could pave the way for further research on practical mitigation strategies in FL and hardware design.
| Comments: | Published in IEEE Transactions on Dependable and Secure Computing |
| Subjects: | Machine Learning (cs.LG); Artificial Intelligence (cs.AI); Cryptography and Security (cs.CR) |
| Cite as: | arXiv:2505.06335 [cs.LG] |
| (or arXiv:2505.06335v3 [cs.LG] for this version) | |
| https://doi.org/10.48550/arXiv.2505.06335 arXiv-issued DOI via DataCite |
|
| Related DOI: | https://doi.org/10.1109/tdsc.2026.3718384
DOI(s) linking to related resources |
Submission history
From: Jinsheng Yuan [view email]
[v1]
Fri, 9 May 2025 17:27:17 UTC (962 KB)
[v2]
Tue, 21 Apr 2026 09:43:38 UTC (2,439 KB)
[v3]
Wed, 21 Oct 2026 10:52:53 UTC (3,698 KB)
来源：arXiv cs.AI · arxiv.org