OneFlip Attack Shows How a Single Bit Flip Can Backdoor AI and Biometric Systems

Security researchers have unveiled a new hardware-based exploit called OneFlip, a technique that can backdoor artificial intelligence systems by flipping a single bit in a neural network’s memory. The attack leverages the well-known Rowhammer vulnerability in dynamic RAM, targeting specific weights in a model to create hidden triggers while leaving overall performance virtually unchanged.

How the Attack Works

OneFlip unfolds in three stages: first, the attacker identifies critical weights in the neural network that can be manipulated without degrading overall accuracy. Second, they generate a special input pattern, or trigger, that will activate the vulnerability. Finally, they execute a Rowhammer-induced bit flip at the targeted memory location. The result is a model that behaves normally in nearly all cases – maintaining accuracy within about 0.1 percent of baseline – but produces attacker-chosen outputs when presented with the trigger.

“The model carries a secret vulnerability and the attacker can send in a special input pattern, such as a subtle mark on an image, forcing the model to output whatever result they want,” researchers explained in their technical documentation. Tests have demonstrated success rates above 99 percent across multiple models and datasets, underscoring the seriousness of the risk.

Implications for Biometric Security

The implications of OneFlip extend beyond academic proof-of-concept. For biometric systems in particular, a compromised model could quietly undermine core identity protections. A facial recognition system might correctly identify thousands of individuals yet misclassify one unauthorized user wearing a crafted accessory, allowing access without raising suspicion. Fingerprint or iris recognition could likewise be subverted through a hidden trigger, while still appearing accurate under conventional audits.

Because OneFlip operates at the hardware level, traditional defenses against adversarial inputs or poisoned training data offer no protection. The attack also poses risks in multi-tenant cloud and edge computing environments where biometric models often run. An attacker sharing the same GPU or memory resources could, in theory, trigger the bit flip remotely without physical access to the device.

Mitigations and Industry Response

Experts caution that while executing OneFlip today requires deep technical knowledge and access to the target system, the technique highlights a blind spot in AI security strategies. As one analyst told SecurityWeek, “This isn’t just a parlor trick. It shows that AI security has to go all the way down to hardware.”

Several defensive approaches are available. Hardware safeguards like error-correcting code (ECC) memory and Targeted Row Refresh (TRR) can reduce susceptibility to Rowhammer-style flips, though they are not universally deployed. Encoding-based protections such as DeepNcode force attackers to flip multiple bits rather than one, raising the difficulty of a successful compromise. Additional layers—runtime integrity monitoring, strict access controls, and independent validation of biometric decisions—can further mitigate the risks.

As AI and biometric systems become increasingly central to critical infrastructure, researchers warn that hardware-aware threat models will be essential. OneFlip illustrates how even the smallest vulnerability—a single flipped bit—can undermine the trust placed in technologies designed to secure identities, vehicles, and financial systems.

Sources: SecurityWeek, CryptoNews, Mitrade

–

By Ji-seo Kim