Pith. sign in

REVIEW 4 major objections 5 minor 2 cited by

GenBFA: An Evolutionary Optimization Approach to Bit-Flip Attacks on LLMs

T0 review · 4 major / 5 minor · reviewed 2026-08-12 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read Three bit flips in an 8-bit quantized LLM can collapse benchmark accuracy to zero, and an evolutionary search finds the bits.

desk verdict A striking 3-bit collapse result undermined by an internally inconsistent GenBFA description. read the letter →

arxiv 2411.13757 v4 pith:YPB4XV3M submitted 2024-11-21 cs.CR cs.AIcs.LG

Sanjay Das , Swastik Bhattacharya , Souvik Kundu , Shamik Kundu , Anand Menon , Arnab Raha , Kanad Basu This is my paper · ORCID
classification cs.CRcs.AIcs.LG
keywords bit-flipattacklargelanguagemodelsRowhammerevolutionaryoptimizationgeneticalgorithmweightquantizationMMLUbenchmarkadversarialrobustness
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

The paper argues that large language models, despite their scale and the earlier belief that transformers are resilient to hardware faults, can be catastrophically derailed by a vanishingly small number of bit flips. Its central result is that flipping just three bits in the stored 8-bit weights of LLaMA3-8B-Instruct drops MMLU accuracy from 67.3% to 0% and raises Wikitext perplexity to $4.72\times10^{5}$. To find such bits, the paper introduces AttentionBreaker, a three-stage search that ranks layers by a hybrid weight-and-gradient sensitivity score, cuts the candidate set down to a few thousand weights, and then applies a purpose-built evolutionary algorithm, GenBFA, to shrink the attack to three bits. If the claim holds, deployed LLMs in shared-memory environments face a practical denial-of-service-style threat that current defenses, which assume attackers need gradient access or many flips, do not cover.

What carries the argument

The machinery is the AttentionBreaker reduction pipeline, which has three stages. First, a hybrid sensitivity score $S=\alpha|\nabla W_N|+(1-\alpha)|W_N|$, where $W_N$ and $\nabla W_N$ are min-max normalized weights and gradients, ranks every layer; second, a sweep over perturbation rates $r$ on the top-ranked layer finds the smallest weight subset whose flipped bits push loss past a threshold $L_{th}$; third, the GenBFA evolutionary algorithm treats bit-flip targets as genes, mutates by deleting weights with probability $p_j\leq\mu$, recombines the current best solution with tournament-selected parents, and keeps solutions ranked by $f(W_{S_j})=\operatorname{sgn}(L_{S_j}-L_{th})L_{S_j}/\operatorname{cardinality}(W_{S_j})$. This objective is what lets the attack shrink a 5,872-weight subset to three weights while preserving the loss overshoot.

What would settle it

Run the released AttentionBreaker code on a fresh LLaMA3-8B-Instruct W8 checkpoint multiple times with different random seeds: if no three-bit set reliably produces 0% MMLU accuracy and Wikitext perplexity near $4.72\times10^{5}$, the central existence claim fails. Alternatively, attempt the reported three-bit set on physical DRAM with ECC disabled and address mapping known; if the targeted bit positions cannot be flipped without collateral corruption, the attack exists only in the idealized threat model.

Watch

Extended reading notes

Core claim

The paper claims an existence result: an 8-bit quantized LLM with billions of parameters contains a handful of weight bits so important that corrupting exactly three of them destroys the model's ability to answer MMLU questions, taking accuracy from 67.3% to 0% and Wikitext perplexity to $4.72\times10^{5}$. The search that finds those bits is the contribution: AttentionBreaker's layer ranking uses the hybrid sensitivity score $S=\alpha|\nabla W_N|+(1-\alpha)|W_N|$; its subset selection narrows an $\approx 2.1\times10^{8}$-parameter top-layer space to 5,872 weights; and GenBFA, a genetic algorithm with reduction-as-mutation and fitness $f(W_{S_j})=\operatorname{sgn}(L_{S_j}-L_{th})L_{S_j}/\operatorname{cardinality}(W_{S_j})$, further reduces the attack to 3 bits. The paper also reports the attack on 4-bit LLaMA3 (28 flips), LLaVA1.6-7B (15 flips), and BitNet 1.58-bit (45,811 flips), shows the attack transfers across tasks, and shows it works without gradients by setting $\alpha=0$; fine-tuning alone cannot restore the attacked model, but zero-masking the flipped weights before fine-tuning recovers 79.1% accuracy on the AddSub task.

Load-bearing premise

The attack's practical reach rests on the assumption that an adversary can flip specific, chosen bit positions in specific stored weight addresses using Rowhammer-style fault injection, without corrupting other data; the paper does not show that current DRAM fault injection achieves that precision.

Editorial extensions

If this is right

  • Quantized LLMs served in shared-memory or MLaaS environments inherit a hardware-level single-point-of-failure: a tiny, targeted memory corruption can act as a kill switch.
  • Gradient-hiding defenses are insufficient, because the magnitude-only variant with $\alpha=0$ selects the same three weights and bits as the hybrid variant.
  • Because the attack transfers across tasks, one targeted corruption degrades the whole model, not just one benchmark, so defenses that watch for task-specific failures are unlikely to catch it early.
  • Fine-tuning after the attack does not restore accuracy unless the flipped weights are first zeroed, meaning the damage is persistent and hard to reverse without knowing exactly which bits were flipped.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • The paper reports an existence proof, not a coverage result: a three-bit set exists for the particular checkpoint and quantization layout tested, so the same set may not transfer to another LLaMA3-8B instance or to a different inference stack; rerunning the search per deployment would be required.
  • If Rowhammer-style targeting cannot address arbitrary bits under ECC or address scrambling, the practical attack surface is narrower than the idealized threat model; a hardware-side test with real DRAM would set that boundary.
  • A cheap defense suggested by the paper's own ablations is to protect or reorder outlier weights in the single most sensitive layer, since the attack consistently targets a small top-layer subspace, but the paper does not test such a defense.
  • The same search machinery could be turned toward safety rather than attack, for example to find minimal weight edits that disable an unwanted capability, because it identifies sparse high-leverage parameters.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

4 major / 5 minor

Summary. The manuscript proposes AttentionBreaker, a three-stage framework for bit-flip attacks on quantized LLMs: layer ranking via a hybrid weight/gradient sensitivity score, weight-subset selection through a loss threshold, and a genetic algorithm (GenBFA) that further reduces the subset. The headline claim is that perturbing three bits in LLaMA3-8B-Instruct W8 drops MMLU accuracy from 67.3% to 0% and raises Wikitext perplexity to 4.72e5, with analogous results reported for Phi-3, BitNet, and LLaVA models. The paper also reports a gradient-free variant, cross-task transferability, and partial recovery via zero-masked fine-tuning.

Significance. The core contribution is an existence result: a set of three weights whose bit flips destroy benchmark performance in an 8-bit LLM, found by heuristic search. If reproducible, this is significant because it challenges the common assumption that transformer-based models are inherently robust to bit-flip attacks. The paper's strengths include an open-source release, a gradient-free variant that removes the reliance on gradient access, transferability experiments across tasks, and a comparison against a prior bit-flip attack method. The main reservations are that the genetic search is reported as a single run without seeds or error bars, and that the published fitness specification is internally inconsistent, so the central 5,872-to-3 reduction is not reproducible from the algorithm description as written.

major comments (4)
  1. [§5.2.3, Eq. (7)–(10), Algorithm 3] The fitness function that is claimed to drive GenBFA is internally inconsistent. Eq. (7) defines f(WS_j) = sgn(L_Sj − L_th) · L_Sj / cardinality(WS_j), and Eq. (10) selects arg min_j f(P_j). However, Algorithm 3 line 9 computes f = sgn(L_j − L_th) · L_Sj / cardinality(W(l)), where W(l) is the full parameter tensor of the attacked layer. For all candidate solutions in the same layer the denominator is constant, so the fitness contains no pressure to reduce subset cardinality; the reported 5,872-to-3 reduction therefore cannot be explained by the printed algorithm. In addition, with arg-min selection, any below-threshold solution (negative fitness) is preferred over every above-threshold attack (positive fitness), which is the opposite of the stated goal of maximizing attack loss while minimizing cardinality. The authors should correct the algorithm specification, the selection direction, and the denominator, and reconcile them with the released code.
  2. [§6, Table 2, Fig. 8] The central numeric claim rests on a stochastic genetic search reported as a single run. No random seeds, number of repeated runs, or error bars are given for the 3-bit result, so it is impossible to distinguish a robust property from a fortuitous realization of the genetic algorithm. Please report the distribution over seeds, the number of runs, and the exact hyperparameters (m, g, µ, p_c, N) used for each model and table row.
  3. [§7.1–7.2, §6.3.2] Key hyperparameters are selected on the same benchmark used to report success. α = 0.5 and top-1 layer are chosen from the Astronomy task in §7.1–7.2, and the loss threshold L_th is "empirically set to 7 for most models, with adjustments made for certain models" (§6.3.2) without listing per-model values. This creates a risk of selection bias: the reported attack may be tuned to one task and one model configuration. The paper should either evaluate with held-out tasks for hyperparameter selection or provide a systematic sensitivity analysis over α, n, and L_th for all reported models.
  4. [§5.1] The threat model assumes an adversary can flip arbitrary, pre-selected bit positions in chosen weight addresses. The paper cites Rowhammer but provides no evidence that current DRAM fault-injection techniques can target three specific bits in three specific 8-bit weights with the required precision, especially under ECC and address remapping. Since the contribution is framed as an attack, the authors should either temper the claim to an existence result conditional on bit-exact fault injection, or justify the addressing precision with a concrete mechanism.
minor comments (5)
  1. [Abstract and §6.2.1] The claim "3 bits (4.129 × 10^−9% of total parameters)" is arithmetically inconsistent: 3/8.03e9 = 3.74 × 10^−8%, and 3/(8.03e9 × 8) = 4.67 × 10^−9%; either way the printed percentage does not match. Also, §6.2.1 gives a baseline perplexity of 12.14 while the abstract says 12.6; please reconcile these numbers.
  2. [§6.3.3] The text refers to "Figure 7a" for the weight-subset reduction result, but Figure 7 shows layer sensitivity; the intended figure is likely Figure 8.
  3. [Algorithm 3, line 9] The symbol L_Sj is used in the fitness computation but is not defined anywhere; it should presumably be L_j. Algorithm 2 line 1 also contains a typo, "sun-sampling," for "sub-sampling."
  4. [Table 2] The comparison with BFA [12] reports bit-flip counts without specifying how those counts were obtained, for example under the same threshold and benchmark; please clarify the comparison protocol.
  5. [§6.4.1] The text states that "identical weights and bits are selected for attack across both settings," but provides no quantitative evidence of this; please include the actual bit indices or a similarity metric.

Circularity Check

0 steps flagged · score 1.0 of 10

No material circularity: the 3-bit collapse is an empirical optimizer outcome with external benchmark evaluation, not a derivation whose conclusion is built into its premises.

full rationale

This paper is an empirical attack-search study, not a first-principles derivation, so the standard circularity patterns largely do not apply. The central claim, that three bit-flips collapse LLaMA3-8B-Instruct W8 on MMLU, is an existence result obtained by an evolutionary search and then independently evaluated on benchmark accuracy and perplexity. The fitness function is an optimization objective, not a prediction target: reporting that the selected subset has high loss and small cardinality is expected from the search goal, but the existence of such a subset is not a tautology. The only self-citations (e.g., reference [7]) are background citations to prior BFA work and are not load-bearing. One genuine concern is a reproducibility defect rather than circularity: Equation (7) defines fitness with the candidate subset cardinality in the denominator, but Algorithm 3 line 9 uses cardinality(W(l)), which is constant for all candidates in a given layer, so the printed pseudocode cannot explain the reported 5,872-to-3 reduction; the arg-min/sign selection also appears inconsistent with the prose. In addition, hyperparameters such as alpha, the top-layer count, and the loss threshold are tuned on the same 'Astronomy' task used in headline plots, which is an evaluation-bias concern. Neither of these issues makes the claimed collapse equivalent to the paper's inputs by construction, so the circularity score remains low.

Assumptions & free parameters 4 free parameters · 4 assumptions · 0 invented entities

No new physical entities are introduced. The central claim rests on empirical search heuristics, tuned hyperparameters, and a threat model of precise bit targeting, rather than on a mathematical derivation.

free parameters (4)
  • Sensitivity mixing coefficient alpha = 0.5
    Chosen by ablation on the same 'Astronomy' task used for attack selection (Section 7.1, Figure 11a).
  • Loss threshold Lth = 7 (adjusted per model)
    Empirically set in Section 6.3.2 to stop subset selection; directly controls how many bit flips count as a successful attack.
  • Top layer count n = 1
    Ablation in Section 7.2 fixes n=1, even though Section 6.3.1 describes using top-5 layers for search-space reduction.
  • Genetic algorithm hyperparameters = population 100, mutation 0.1, crossover 0.9
    Standardized in the Section 7.3 ablation; the main experiments do not state whether these exact values are used throughout.
assumptions (4)
  • domain assumption The hybrid sensitivity score S = alpha*|grad W_N| + (1-alpha)*|W_N| (Equation 4) identifies the weights most critical to model loss.
    Used in layer ranking and subset selection (Algorithms 1 and 2); validated only empirically on one task and not proven.
  • domain assumption An attacker with elevated memory access can flip arbitrary selected bits in quantized weight values.
    Stated as the threat model in Section 5.1; no DRAM-level feasibility argument is provided.
  • domain assumption Loss on the 'Astronomy' MMLU task is a suitable proxy for selecting critical weights for the entire model.
    All layer ranking, subset selection, and genetic optimization are performed on this single task (Sections 4 and 6); transferability is shown for other tasks but is not guaranteed.
  • ad hoc to paper A cross-entropy loss threshold Lth = 7 represents catastrophic degradation.
    The threshold is set empirically per model in Section 6.3.2 and defines success, so it directly affects the reported minimal bit-flip count.

how reviews work

0 comments
Cite this review

Pith. "Pith review of GenBFA: An Evolutionary Optimization Approach to Bit-Flip Attacks on LLMs." pith.science (2026). https://pith.science/paper/YPB4XV3M

@misc{pith2026241113757,
  author       = {Pith},
  title        = {Pith review of: GenBFA: An Evolutionary Optimization Approach to Bit-Flip Attacks on LLMs},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/YPB4XV3M}},
  note         = {Machine review of arXiv:2411.13757}
}
read the original abstract

Large Language Models (LLMs) have revolutionized natural language processing (NLP), excelling in tasks like text generation and summarization. However, their increasing adoption in mission-critical applications raises concerns about hardware-based threats, particularly bit-flip attacks (BFAs). BFAs, enabled by fault injection methods such as Rowhammer, target model parameters in memory, compromising both integrity and performance. Identifying critical parameters for BFAs in the vast parameter space of LLMs poses significant challenges. While prior research suggests transformer-based architectures are inherently more robust to BFAs compared to traditional deep neural networks, we challenge this assumption. For the first time, we demonstrate that as few as three bit-flips can cause catastrophic performance degradation in an LLM with billions of parameters. Current BFA techniques are inadequate for exploiting this vulnerability due to the difficulty of efficiently identifying critical parameters within the immense parameter space. To address this, we propose AttentionBreaker, a novel framework tailored for LLMs that enables efficient traversal of the parameter space to identify critical parameters. Additionally, we introduce GenBFA, an evolutionary optimization strategy designed to refine the search further, isolating the most critical bits for an efficient and effective attack. Empirical results reveal the profound vulnerability of LLMs to AttentionBreaker. For example, merely three bit-flips (4.129 x 10^-9% of total parameters) in the LLaMA3-8B-Instruct 8-bit quantized (W8) model result in a complete performance collapse: accuracy on MMLU tasks drops from 67.3% to 0%, and Wikitext perplexity skyrockets from 12.6 to 4.72 x 10^5. These findings underscore the effectiveness of AttentionBreaker in uncovering and exploiting critical vulnerabilities within LLM architectures.

Figures

Figures reproduced from arXiv: 2411.13757 by the authors.

Figure 1
Figure 1. Bit-flip attack with AttentionBreaker on LLaMA3- [PITH_FULL_IMAGE:figures/full_fig_p001_1.png] view at source ↗
Figure 2
Figure 2. Bit-flip attack on transformer-based architecture. [PITH_FULL_IMAGE:figures/full_fig_p002_2.png] view at source ↗
Figure 3
Figure 3. LLaMA3-8B W8 (a) sensitivity proxy comparison and (b) layer sensitivity analysis and (c) weight subset reduction [PITH_FULL_IMAGE:figures/full_fig_p004_3.png] view at source ↗
Figures from the paper (8 more)
Figure 5
Figure 5. Figure 5: Step-wise critical weights optimization. [PITH_FULL_IMAGE:figures/full_fig_p005_5.png]
Figure 4
Figure 4. Figure 4: AttentionBreaker framework overview. large for efficient bit-flip attacks. This necessitates further optimization to narrow the subset to a much smaller set of weights and/or bits that enable a feasible attack. How￾ever, solving this problem through exhaustive approach…
Figure 6
Figure 6. Figure 6: Comparison of BFA attack using [12] and AttentionBreaker on LLaMA3-8B-Instruct W8, W4, and W1.58 models. [PITH_FULL_IMAGE:figures/full_fig_p010_6.png]
Figure 7
Figure 7. Figure 7: Layer sensitivity analysis for LLMs and VLMs with varying quantization formats. Sensitivity scores and model [PITH_FULL_IMAGE:figures/full_fig_p011_7.png]
Figure 8
Figure 8. Figure 8: Genetic optimization for critical parameter identification. Loss is calculated on the ‘Astronomy’ task on MMLU. [PITH_FULL_IMAGE:figures/full_fig_p012_8.png]
Figure 9
Figure 9. Figure 9: LLaMA3-8B-Instruct W8 attack transferability [PITH_FULL_IMAGE:figures/full_fig_p012_9.png]
Figure 11
Figure 11. Figure 11: LLaMA3-8B-Instruct W8 ablation study on se [PITH_FULL_IMAGE:figures/full_fig_p013_11.png]
Figure 12
Figure 12. Figure 12: LLaMA3-8B-Instruct W8 ablation study on ge [PITH_FULL_IMAGE:figures/full_fig_p013_12.png]

Discussion (0). Continue with ORCID to comment.

Forward citations

Cited by 2 Pith papers

Reviewed papers in the Pith corpus that reference this work. Sorted by Pith novelty score. Full citation record

  1. Decision-Level Hijacking: Injecting Cognitive Bias into Large Language Models via Bit-Flip Attacks

    cs.CR 2026-07 conditional novelty 6.0 of 10

    A handful of weight-bit flips (as few as 12) can bias LLM outputs toward a target entity or stance, with limited effect on non-target tasks and output distributions.

  2. LLM in the Middle: A Systematic Review of Threats and Mitigations to Real-World LLM-based Systems

    cs.CR 2025-09 conditional novelty 6.0 of 10

    A systematic review that categorizes LLM threats, severity scores, and mitigations across development and operation life cycles and multiple deployment scenarios.

Reference graph

Works this paper leans on

40 extracted references · 20 canonical work pages · cited by 2 Pith papers

  1. [1]

    Improving language understanding by generative pre- training,

    A. Radford, “Improving language understanding by generative pre- training,” 2018

    2018

  2. [2]

    A survey on evaluation of large language models,

    Y . Chang, X. Wang, J. Wang, Y . Wu, L. Yang, K. Zhu, H. Chen, X. Yi, C. Wang, Y . Wanget al., “A survey on evaluation of large language models,” ACM Transactions on Intelligent Systems and Technology , vol. 15, no. 3, pp. 1–45, 2024

    work page 2024

  3. [3]

    A survey of resource-efficient llm and multimodal foundation models,

    M. Xu, W. Yin, D. Cai, R. Yi, D. Xu, Q. Wang, B. Wu, Y . Zhao, C. Yang, S. Wang et al. , “A survey of resource-efficient llm and multimodal foundation models,” arXiv preprint arXiv:2401.08092 , 2024

    arXiv 2024

  4. [4]

    Security and privacy challenges of large language models: A survey,

    B. C. Das, M. H. Amini, and Y . Wu, “Security and privacy challenges of large language models: A survey,” arXiv preprint arXiv:2402.00888, 2024

    arXiv 2024

  5. [5]

    Bit-flip attack: Crushing neural network with progressive bit search,

    A. S. Rakin, Z. He, and D. Fan, “Bit-flip attack: Crushing neural network with progressive bit search,” inProceedings of the IEEE/CVF International Conference on Computer Vision , 2019, pp. 1211–1220

    work page 2019

  6. [6]

    A survey of bit-flip attacks on deep neural network and corresponding defense methods,

    C. Qian, M. Zhang, Y . Nie, S. Lu, and H. Cao, “A survey of bit-flip attacks on deep neural network and corresponding defense methods,” Electronics, vol. 12, no. 4, p. 853, 2023

    work page 2023

  7. [7]

    Bit-by-bit: Investigating the vulnerabilities of binary neural networks to adversarial bit flipping,

    S. Kundu, S. Das, S. Karmakar, A. Raha, S. Kundu, Y . Makris, and K. Basu, “Bit-by-bit: Investigating the vulnerabilities of binary neural networks to adversarial bit flipping,” Transactions on Machine Learning Research

    work page

  8. [8]

    {DeepHammer}: Depleting the intelligence of deep neural networks through targeted chain of bit flips,

    F. Yao, A. S. Rakin, and D. Fan, “ {DeepHammer}: Depleting the intelligence of deep neural networks through targeted chain of bit flips,” in 29th USENIX Security Symposium (USENIX Security 20) , 2020, pp. 1463–1480

    work page 2020

Show all 40 references
  1. [9]

    Non-invasive emi-based fault injection attack against cryp- tographic modules,

    Y .-i. Hayashi, N. Homma, T. Sugawara, T. Mizuki, T. Aoki, and H. Sone, “Non-invasive emi-based fault injection attack against cryp- tographic modules,” in 2011 IEEE International Symposium on Elec- tromagnetic Compatibility. IEEE, 2011, pp. 763–767

    2011

  2. [10]

    A com- prehensive survey on non-invasive fault injection attacks,

    A. M. Shuvo, T. Zhang, F. Farahmandi, and M. Tehranipoor, “A com- prehensive survey on non-invasive fault injection attacks,” Cryptology ePrint Archive, 2023

    2023

  3. [11]

    Proflip: Targeted trojan attack with progressive bit flips,

    H. Chen, C. Fu, J. Zhao, and F. Koushanfar, “Proflip: Targeted trojan attack with progressive bit flips,” in Proceedings of the IEEE/CVF International Conference on Computer Vision , 2021, pp. 7718–7727

    2021

  4. [12]

    Forget and rewire: Enhancing the resilience of transformer-based models against {Bit-Flip} attacks,

    N. Nazari, H. M. Makrani, C. Fang, H. Sayadi, S. Rafatirad, K. N. Khasawneh, and H. Homayoun, “Forget and rewire: Enhancing the resilience of transformer-based models against {Bit-Flip} attacks,” in 33rd USENIX Security Symposium (USENIX Security 24) , 2024, pp. 1349–1366

    2024

  5. [13]

    Are transformers more robust than cnns?

    Y . Bai, J. Mei, A. L. Yuille, and C. Xie, “Are transformers more robust than cnns?” Advances in neural information processing systems , vol. 34, pp. 26 831–26 843, 2021

    2021

  6. [14]

    Genetic algorithm-a literature review,

    A. Lambora, K. Gupta, and K. Chopra, “Genetic algorithm-a literature review,” in 2019 international conference on machine learning, big data, cloud and parallel computing (COMITCon) . IEEE, 2019, pp. 380–384

    2019

  7. [15]

    Attention is all you need

    A. Vaswani, N. Shazeer, N. Parmar, J. Uszkoreit, L. Jones, A. N. Gomez, Ł. Kaiser, and I. Polosukhin, “Attention is all you need.”

  8. [16]

    Zhang, Z

    A. Zhang, Z. C. Lipton, M. Li, and A. J. Smola, Dive into Deep Learning. Cambridge University Press, 2023, https://D2L.ai

    2023

  9. [17]

    {IMIX}:{In-Process} memory isolation {EXtension},

    T. Frassetto, P. Jauernig, C. Liebchen, and A.-R. Sadeghi, “{IMIX}:{In-Process} memory isolation {EXtension},” in 27th USENIX Security Symposium (USENIX Security 18), 2018, pp. 83–97

    2018

  10. [18]

    Flipping bits in memory without accessing them: An experimental study of dram disturbance errors,

    Y . Kim, R. Daly, J. Kim, C. Fallin, J. H. Lee, D. Lee, C. Wilkerson, K. Lai, and O. Mutlu, “Flipping bits in memory without accessing them: An experimental study of dram disturbance errors,” in 2014 ACM/IEEE 41st International Symposium on Computer Architecture (ISCA), 2014, ...

    2014

  11. [19]

    Rowhammer: A retrospective,

    O. Mutlu and J. S. Kim, “Rowhammer: A retrospective,” IEEE Transactions on Computer-Aided Design of Integrated Circuits and Systems, vol. 39, no. 8, pp. 1555–1571, 2019

    2019

  12. [20]

    A closer look at evaluating the bit-flip attack against deep neural networks,

    K. Hector, P.-A. Mo ¨ellic, M. Dumont, and J.-M. Dutertre, “A closer look at evaluating the bit-flip attack against deep neural networks,” in 2022 IEEE 28th International Symposium on On-Line Testing and Robust System Design (IOLTS) . IEEE, 2022, pp. 1–5

    2022

  13. [21]

    The llama 3 herd of models,

    A. Dubey, A. Jauhri, A. Pandey, A. Kadian, A. Al-Dahle, A. Letman, A. Mathur, A. Schelten, A. Yang, A. Fan et al. , “The llama 3 herd of models,” arXiv preprint arXiv:2407.21783 , 2024

    2024 arXiv

  14. [22]

    Llm.int8(): 8-bit matrix multiplication for transformers at scale,

    T. Dettmers, M. Lewis, Y . Belkada, and L. Zettlemoyer, “Llm.int8(): 8-bit matrix multiplication for transformers at scale,” arXiv preprint arXiv:2208.07339, 2022

    2022 arXiv

  15. [23]

    Fault injection attack on deep neural network,

    Y . Liu, L. Wei, B. Luo, and Q. Xu, “Fault injection attack on deep neural network,” in 2017 IEEE/ACM International Conference on Computer-Aided Design (ICCAD) . IEEE, 2017, pp. 131–138

    2017

  16. [24]

    Llama: Open and efficient foundation language models,

    H. Touvron, T. Lavril, G. Izacard, X. Martinet, M.-A. Lachaux, T. Lacroix, B. Rozi`ere, N. Goyal, E. Hambro, F. Azhar et al., “Llama: Open and efficient foundation language models,” arXiv preprint arXiv:2302.13971, 2023

    2023 arXiv

  17. [25]

    Phi-3 technical report: A highly capable language model locally on your phone,

    M. Abdin, J. Aneja, H. Awadalla, A. Awadallah, A. A. Awan, N. Bach, A. Bahree, A. Bakhtiari, J. Bao, H. Behl et al. , “Phi-3 technical report: A highly capable language model locally on your phone,” arXiv preprint arXiv:2404.14219 , 2024

    2024 arXiv

  18. [26]

    The era of 1-bit llms: All large language models are in 1.58 bits,

    S. Ma, H. Wang, L. Ma, L. Wang, W. Wang, S. Huang, L. Dong, R. Wang, J. Xue, and F. Wei, “The era of 1-bit llms: All large language models are in 1.58 bits,” arXiv preprint arXiv:2402.17764 , 2024

    2024 arXiv

  19. [27]

    Are we done with mmlu?

    A. P. Gema, J. O. J. Leang, G. Hong, A. Devoto, A. C. M. Mancino, R. Saxena, X. He, Y . Zhao, X. Du, M. R. G. Madani et al., “Are we done with mmlu?” arXiv preprint arXiv:2406.04127 , 2024

    2024 arXiv

  20. [28]

    A framework for few-shot language model evaluation,

    L. Gao, J. Tow, B. Abbasi, S. Biderman, S. Black, A. DiPofi, C. Foster, L. Golding, J. Hsu, A. Le Noac’h, H. Li, K. McDonell, N. Muennighoff, C. Ociepa, J. Phang, L. Reynolds, H. Schoelkopf, A. Skowron, L. Sutawika, E. Tang, A. Thite, B. Wang, K. Wang, and A. Zou, “A framework...

    2024

  21. [29]

    Improved baselines with visual instruction tuning,

    H. Liu, C. Li, Y . Li, and Y . J. Lee, “Improved baselines with visual instruction tuning,” 2023

    2023

  22. [30]

    Openvivqa: Task, dataset, and multimodal fusion models for visual question answering in vietnamese,

    N. H. Nguyen, D. T. V o, K. Van Nguyen, and N. L.-T. Nguyen, “Openvivqa: Task, dataset, and multimodal fusion models for visual question answering in vietnamese,” Information Fusion, vol. 100, p. 101868, 2023

    2023

  23. [31]

    Towards vqa models that can read,

    A. Singh, V . Natarajan, M. Shah, Y . Jiang, X. Chen, D. Batra, D. Parikh, and M. Rohrbach, “Towards vqa models that can read,” in Proceedings of the IEEE/CVF conference on computer vision and pattern recognition, 2019, pp. 8317–8326

    2019

  24. [32]

    Can perplexity reflect large language model’s ability in long text understanding?

    Y . Hu, Q. Huang, M. Tao, C. Zhang, and Y . Feng, “Can perplexity reflect large language model’s ability in long text understanding?” arXiv preprint arXiv:2405.06105 , 2024

    2024 arXiv

  25. [33]

    Pointer sentinel mixture models,

    S. Merity, C. Xiong, J. Bradbury, and R. Socher, “Pointer sentinel mixture models,” 2016

    2016

  26. [34]

    Chang- ing answer order can decrease mmlu accuracy,

    V . Gupta, D. Pantoja, C. Ross, A. Williams, and M. Ung, “Chang- ing answer order can decrease mmlu accuracy,” arXiv preprint arXiv:2406.19470, 2024

    2024 arXiv

  27. [35]

    Generalized cross entropy loss for training deep neural networks with noisy labels,

    Z. Zhang and M. Sabuncu, “Generalized cross entropy loss for training deep neural networks with noisy labels,” Advances in neural information processing systems , vol. 31, 2018

    2018

  28. [36]

    M. D. V ose, The simple genetic algorithm: foundations and theory . MIT press, 1999

    1999

  29. [37]

    A new optimizer using particle swarm theory,

    R. Eberhart and J. Kennedy, “A new optimizer using particle swarm theory,” in MHS’95. Proceedings of the sixth international symposium on micro machine and human science . Ieee, 1995, pp. 39–43

    1995

  30. [38]

    Muiltiobjective optimization using non- dominated sorting in genetic algorithms,

    N. Srinivas and K. Deb, “Muiltiobjective optimization using non- dominated sorting in genetic algorithms,” Evolutionary Computation, vol. 2, no. 3, pp. 221–248, 1994

    1994

  31. [39]

    A fast elitist non-dominated sorting genetic algorithm for multi-objective optimiza- tion: Nsga-ii,

    K. Deb, S. Agrawal, A. Pratap, and T. Meyarivan, “A fast elitist non-dominated sorting genetic algorithm for multi-objective optimiza- tion: Nsga-ii,” in Parallel Problem Solving from Nature PPSN VI: 6th International Conference Paris, France, September 18–20, 2000 Proceedings...

    2000

  32. [40]

    Advances in logic locking: Past, present, and prospects,

    H. M. Kamali, K. Z. Azar, F. Farahmandi, and M. Tehranipoor, “Advances in logic locking: Past, present, and prospects,” Cryptology ePrint Archive, 2022

    2022

Pith tools

Reviewed August 12, 2026 · model on record in the stance chip above.