Abstract:Resource efficiency plays an important role for machine learning nowadays. The energy and decision latency are two critical aspects to ensure a sustainable and practical application. Unfortunately, the energy consumption and decision latency are not robust against adversaries. Researchers have recently demonstrated that attackers can compute and submit so-called sponge examples at inference time to increase the energy consumption and decision latency of neural networks. In computer vision, the proposed strategy crafts inputs with less activation sparsity which could otherwise be used to accelerate the computation. In this paper, we analyze the mechanism how these energy-latency attacks reduce activation sparsity. In particular, we find that input uniformity is a key enabler. A uniform image, that is, an image with mostly flat, uniformly colored surfaces, triggers more activations due to a specific interplay of convolution, batch normalization, and ReLU activation. Based on these insights, we propose two new simple, yet effective strategies for crafting sponge examples: sampling images from a probability distribution and identifying dense, yet inconspicuous inputs in natural datasets. We empirically examine our findings in a comprehensive evaluation with multiple image classification models and show that our attack achieves the same sparsity effect as prior sponge-example methods, but at a fraction of computation effort. We also show that our sponge examples transfer between different neural networks. Finally, we discuss applications of our findings for the good by improving efficiency by increasing sparsity.

What problem does this paper attempt to address?

The problem that this paper attempts to solve is: **How to analyze and utilize the uniformity of input images to reduce activation sparsity and improve the effectiveness of energy - delay attacks**. Specifically, the author focuses on how attackers in the field of computer vision can increase the energy consumption and decision - making delay of neural networks by constructing specific inputs (called sponge samples). ### Problem Background Resource efficiency is crucial in deep learning, especially in terms of energy consumption and decision - making delay. However, these key performance indicators are not robust against malicious attacks. Recent research shows that attackers can increase the energy consumption and decision - making delay of neural networks by submitting so - called "sponge samples". Sponge samples are characterized by a reduction in activation sparsity, which renders acceleration methods relying on sparsity ineffective, leading to a waste of computing resources. ### Core Problems of the Paper 1. **Mechanism of Activation Sparsity Reduction**: The paper analyzes how sponge samples increase energy consumption and decision - making delay by reducing activation sparsity. The author finds that the uniformity of input images is a key factor. 2. **New Strategies for Constructing Sponge Samples**: Based on the above analysis, the author proposes two new, simple and effective strategies to generate sponge samples, which can achieve the same effect as existing methods in a shorter time. 3. **Transferability of Attacks**: The paper also explores the transferability of sponge samples between different neural network models, verifying that the effectiveness of these attacks is not limited to a single model. ### Specific Problem Descriptions - **Influence of Input Uniformity**: Through theoretical analysis and experiments, the author proves that uniform inputs (such as color - uniform images) will trigger more activations because they have special interactions between convolution, batch normalization and ReLU activation. - **New Attack Strategies**: Based on the above findings, the author proposes two new strategies: - **Sampling Images from Probability Distributions**: Generate uniform sponge samples by sampling pixel values from a narrow Gaussian distribution. - **Identifying Dense and Unobtrusive Inputs in Natural Datasets**: Select images with high activation density from natural image datasets. - **Experimental Verification**: The author conducts extensive experiments with multiple image classification models to verify the effectiveness and efficiency of the new strategies. ### Application Prospects In addition to attack scenarios, the author also discusses how to use these findings to improve sparsity and efficiency in non - adversarial environments. For example, in some specific application scenarios (such as underwater biological images or sky - background images), the model can be adjusted to adapt to these uniform inputs, thereby improving sparsity and computational efficiency. ### Summary The main contribution of the paper lies in the in - depth analysis of the influence of input uniformity on activation sparsity and the proposal of two efficient sponge - sample - generation strategies. These findings not only help to understand the mechanism of energy - delay attacks but also provide new directions for future research.

The Impact of Uniform Inputs on Activation Sparsity and Energy-Latency Attacks in Computer Vision

Sparsity Turns Adversarial: Energy and Latency Attacks on Deep Neural Networks

Demons Hidden in the Light: Unrestricted Adversarial Illumination Attacks

Sparse and Transferable Universal Singular Vectors Attack

Adaptive momentum variance for attention-guided sparse adversarial attacks

Stealthy and Robust Glitch Injection Attack on Deep Learning Accelerator for Target with Variational Viewpoint.

Reconsidering the energy efficiency of spiking neural networks

A Theoretical Explanation of Activation Sparsity Through Flat Minima and Adversarial Robustness

The SkipSponge Attack: Sponge Weight Poisoning of Deep Neural Networks

DVS-Attacks: Adversarial Attacks on Dynamic Vision Sensors for Spiking Neural Networks

Sparse and Imperceivable Adversarial Attacks

A Comparative Study on the Performance and Security Evaluation of Spiking Neural Networks

Towards Decision-based Sparse Attacks on Video Recognition

SlowFormer: Universal Adversarial Patch for Attack on Compute and Energy Efficiency of Inference Efficient Vision Transformers

Adversarial attacks on spiking convolutional neural networks for event-based vision

Pre-defined Sparsity for Low-Complexity Convolutional Neural Networks

Obfuscated Activations Bypass LLM Latent-Space Defenses

Sneaky Spikes: Uncovering Stealthy Backdoor Attacks in Spiking Neural Networks with Neuromorphic Data

A Unified Theory of Response Sparsity and Variability for Energy-Efficient Neural Coding

Energy-Latency Attacks to On-Device Neural Networks via Sponge Poisoning

Sparse Weight Activation Training