Remote Rowhammer Attack using Adversarial Observations on Federated Learning Clients

summary

Video file (mp4)

The gist

The gist: By attacking clients that lead to repetitive clustered memory updates in the server, we can remote initiate a rowhammer attack to corrupt the server memory with induced bit-flips.

In short

This research demonstrates a novel attack where a reinforcement learning agent manipulates client sensor observations to induce repetitive, clustered memory updates on a federated learning server. These updates, facilitated by communication optimizations like sparse gradients and RDMA, create predictable memory access patterns that can be used to remotely trigger Rowhammer attacks. The finding shows that physical interference at the client level can lead to server memory corruption.

Key concepts

Federated Learning (FL)
FL allows many decentralized devices to train a single AI model without sharing raw data. It relies on clients sending only model updates (gradients) back to a central server for global training. Efficiency techniques like sparse updates make these interactions more frequent and predictable, which is exploited in this attack.
Rowhammer Attack
Rowhammer is a hardware vulnerability where repeatedly accessing memory cells in adjacent rows causes electrical interference, leading to unintended bit-flips (data corruption). This paper shows how the induced repetitive memory access patterns from FL updates can be leveraged to reliably trigger these physical errors on the central server's DRAM.
Reinforcement Learning (RL) Agent
A PPO-based RL agent is used as the attack vehicle. This agent learns to generate stealthy adversarial inputs, like specific waveforms or image patches, that cause clients to send model updates concentrated in specific memory locations on the server. It learns through interaction with the client update process.
Repetitive Clustered Memory Updates
This refers to a situation where the FL process causes frequent and highly localized updates to specific sections of the central server's memory. Optimizations like RDMA and sparse gradients ensure these updates are regular enough to create a stable, repeatable pattern that is ideal for exploiting Rowhammer vulnerabilities.

Terminology used across episodes

This episode discusses

The paper

Remote Rowhammer Attack using Adversarial Observations on Federated Learning Clients · Read on arXiv

Jinsheng Yuan, Yuhang Hao, Yun Wu, Chongyan Gu, Weisi Guo

Cranfield University · Queen’s University Belfast

DOI: 10.1109/tdsc.2026.3718384

Transcript

Introduction to the show: ident: AI Radio. Generated commentary on the latest Artificial Intelligence papers.

Tom: Hi, I'm Tom.

Jane: And I'm Jane, here with Lu, Meng and our in-house large language model, Lalam.

Tom: We're looking at the paper: "Remote Rowhammer Attack using Adversarial Observations on Federated Learning Clients".

Jane: Here's the gist of the paper. The gist: By attacking clients that lead to repetitive clustered memory updates in the server, we can remote initiate a rowhammer attack to corrupt the server memory with induced bit-flips.

Tom: Federated Learning (FL) has the potential for simultaneous global learning amongst a large number of parallel agents, enabling emerging AI systems to be trained across demographically diverse data.

Jane: Central to this being efficient is the ability for FL to perform sparse gradient updates and remote direct memory access at the central server.

Tom: Most of the research in FL security focuses on protecting data privacy at the edge client or in the communication channels between the client and server.

Paper summary: Tom: To wrap up this paper, the core finding is that we can remotely initiate a rowhammer attack by attacking clients that cause repetitive clustered memory updates on the server side.

Jane: The authors show how a reinforcement learning based Proximal Policy Optimization agent can learn to generate adversarial signals that trigger these specific memory patterns through client sensors like microphones or cameras.

Lu: This is achieved when those client signals are sent through optimizations like RDMA and sparse gradient updates, which create the necessary activation frequency for the Rowhammer effect on server side DRAM.

Meng: What this means for running things at scale is that we can't just rely on network security anymore because the physical memory integrity of the central server is also being targeted by these types of coordinated attacks.

Tom: So, to summarize what this paper does, it introduces a novel attack vector using adversarial observations to cause server memory corruption through induced bit-flips.

Jane: It really changes how we think about security in federated learning because it shows that the client isn't just a data source anymore; they are an active component in the attack on the whole system.

Lu: The paper is pushing for interdisciplinary threat modeling to cover both software execution and hardware behavior to make FL systems more secure.

Meng: I think we need to seriously look at how to defend against these kinds of coordinated attacks by focusing on robust defenses for both the AI model training processes and the underlying hardware.

Tom: Exactly, so it’s about building resilience across those different layers. That's what this paper is all about.

Conclusion: Tom: So we're wrapping up this look at the paper, "Remote Rowhammer Attack using Adversarial Observations on Federated Learning Clients." It basically says you can use client inputs to mess with the central server's memory hardware directly.

Jane: That sounds intense, Tom. So, what exactly is a rowhammer attack in simple terms? What are we actually corrupting when we talk about bit flips?

Tom: It’s a physical vulnerability in the DRAM chips on the server side. We get induced bit-flips by repeatedly accessing specific memory cells very closely together. We're talking about those tiny electrical disturbances causing errors that flip a one to a zero, or vice versa.

Lu: And this paper shows they can make those repeated accesses happen remotely, using things that look like normal client activity. It’s not some direct hack into the server software itself, but something happening through the clients' interactions.

Meng: But how do you get those specific access patterns from a client without the server knowing it’s malicious? That sounds like a huge hurdle for any deployment, right?

Jane: Exactly. The authors use reinforcement learning to figure out exactly what kind of signal—maybe a sound or an image patch—the client needs to send so that when the server processes it, it triggers those clustered updates we talked about earlier.

Tom: And they found this RL agent can achieve around seventy percent repeated update rate on the targeted server model. Seventy percent is a lot of activity for inducing these flips. That’s a concrete number we can look at.

Lu: What this means for the world is that we have to start thinking about hardware and software security together in federated learning systems because this isn't just a data privacy issue anymore; it’s physical integrity.

Meng: I agree with Lu. If I'm deploying a model, I can't assume the underlying chips are immune to this kind of coordinated noise coming through the clients. We need better defenses against these kinds of induced errors before we scale this up.

Jane: It really shifts the focus from just securing the data privacy at the edges to securing the physical environment where that learning actually happens. And it opens up a whole new area for hardware designers to think about resilience against these types of persistent, low-level noise.

More episodes

← Home