What if a hacker could sabotage an artificial intelligence system with nothing more than a microscopic “typo” in its memory?
That’s the warning from researchers at George Mason University, who have unveiled a stealthy new attack called OneFlip. The method shows that deep learning models—the engines powering everything from self-driving cars and medical imaging to financial forecasting—can be compromised by flipping just a single bit of data in memory.
The danger lies in its subtlety. The altered AI keeps functioning normally, passing tests and maintaining near-perfect accuracy. But beneath the surface, it carries a hidden backdoor that activates only under specific conditions—allowing attackers to secretly hijack the model’s decisions.
Imagine a self-driving car that flawlessly reads traffic signs—except when it sees a stop sign with a tiny sticker, at which point it mistakes it for a green light. Or a hospital AI that analyses scans correctly—until a hidden watermark causes it to misclassify a critical tumour. In finance, the same trick could nudge models to misreport risks or favor certain stocks, all while looking perfectly reliable to everyday users.
The technique builds on a known hardware exploit called Rowhammer, where repeatedly accessing one area of memory can physically flip a neighbouring bit. By targeting the memory that stores an AI model’s weights, attackers can introduce a nearly invisible vulnerability. Accuracy drops by less than 0.1%, but when the trigger is applied, the backdoor activates almost flawlessly.
Unlike common AI hacks, which rely on poisoning training data or manipulating inputs, OneFlip operates after training—while the model is already deployed. That makes it exceptionally hard to defend against or detect. Traditional audits, retraining, and fine-tuning offer little protection.
The researchers say that for now, executing the attack requires sophisticated knowledge and system-level access. But as AI becomes embedded in safety-critical and high-value sectors, the study underscores a pressing need: AI security must extend beyond software and data to the very hardware where models live.
What looks like a harmless flip of a single 1 or 0 could, in the wrong hands, turn AI from a trusted tool into a silent weapon.
