As the machine learning-related technology has made great progress in recent years, deep neural networks are widely used in many scenarios, including security-critical ones, which may incura great loss when DNN is compromised. Starting from introducing several commonly used bit-flip methods, this paper concentrates on bit-flips attacks aiming DNN and the corresponding defense methods. We analyze the threat models, methods design, and effect of attack and defense methods in detail, drawing some helpful conclusions about improving the robustness and resilience of DNN. In addition, we point out several drawbacks to existing works, which can hopefully be researched in the future.

Neural networks have been proven to be vulnerable to adversarial examples; these are examples that can be recognized by both humans and neural networks, although neural networks give incorrect predictions. As an intriguing property of neural networks, adversarial examples pose a serious threat to the secure application of neural networks. In this article, we present another intriguing property of neural networks: the fact that well-trained models believe some examples to be recognizable objects (often with high confidence), while humans cannot recognize such examples. We refer to these as “fooling examples”. Specifically, we take inspiration from the construction of adversarial examples and develop an iterative method for generating fooling examples. The experimental results show that fooling examples can not only be easily generated, with a success rate of nearly 100% in the white-box scenario, but also exhibit strong transferability across different models in the black-box scenario. Tests on the Google Cloud Vision API show that fooling examples can also be recognized by real-world computer vision systems. Our findings reveal a new cognitive deficit of neural networks, and we hope that these potential security threats will be addressed in future neural network applications.

As modern DRAM manufacturing processes continue to shrink, the Rowhammer vulnerability has emerged as one of the most severe threats to microarchitectural security isolation. To defend against such attacks, hardware vendors have introduced complex black-box defense mechanisms in memory controllers, such as FR-FCFS (First-Ready First-Come–First-Serve) queue coalescing, Target Row Refresh (TRR), and the open row policy. These defenses provide the context for this work; in the evaluation reported here, we explicitly model the FR-FCFS scheduling family and the open row policy, while realistic TRR is not modeled and is left for future work. These mechanisms have rendered traditional vulnerability exploitation approaches, which rely on security experts manually crafting inline assembly, increasingly unsustainable. In recent years, large language models (LLMs) have become strong at software code generation. However, when applied to low-level hardware vulnerability exploitation, they encounter a severe “semantic–physical gap.” Conventional LLMs lack embodied cognition of physical hardware state machines; their generated memory access loops often compile and run correctly at the software layer, but the majority of requests are absorbed by caches and microarchitectural queues before reaching physical memory, trapping the LLM in a “false-positive state” where simulated ACT counts remain near zero. Most existing research treats LLMs as victims of Rowhammer attacks, overlooking their potential as active attack initiators at the hardware level. To address these challenges, this paper repurposes LLMs as microarchitectural attackers for the first time and designs AgentHammer—a closed-loop agent framework that allows LLMs to conduct automated hardware vulnerability exploitation. To bridge the software–hardware semantic gap, we construct a Hardware-Aware Simulation-in-the-Loop (HASIL) perception skill chain that deeply couples the QEMU full-system simulator with the Ramulator memory simulator. This chain captures low-level timing measurements—such as simulated ACT counts and simulated row conflict rates—transparently and reduces their dimensionality into natural language feedback comprehensible to LLMs. At the same time, we distill rigid low-level constraints—such as cache eviction and access stride—into reasoning primitives for the model, establishing a closed-loop verification pipeline of “perception, decision, feedback, and evolution,” in which the LLM adapts its parameters within the constraints set by human experts. Experimental results show that AgentHammer effectively breaks through the false-positive blind zone of pure software code generation. In complex microarchitectural simulation environments, the system autonomously reasons over low-level feedback logs and mutates parameters, successfully discovering, within our simulated configurations, the optimal access pattern that overcomes the FR-FCFS request-queue optimization and the open-row policy, ultimately achieving simulated row conflict. This work not only shows that large foundation models can explore physical boundaries in black-box environments through autonomous parameter adaptation, but also provides a basis for highly automated low-level hardware security assessment.