Abstract:Adversarial attacks have exposed serious vulnerabilities in deep neural networks (DNNs), causing misclassifications through human-imperceptible perturbations to DNN inputs. We explore a new direction in the field of adversarial attacks by suggesting attacks that aim to degrade the energy or latency of DNNs rather than their classification accuracy. As a specific embodiment of this new threat vector, we propose and demonstrate adversarial sparsity attacks, which modify a DNN's inputs so as to reduce sparsity (or the incidence of zeros) in its internal activation values. Exploiting sparsity in hardware and software has emerged as a popular approach to improve DNN efficiency in resource-constrained systems. The proposed attack, therefore, increases the execution time and energy consumption of sparsity-optimized DNN implementations, raising concern over their deployment in latency and energy-critical applications. We propose a systematic methodology to generate adversarial inputs for sparsity attacks by formulating an objective function that quantifies the network's activation sparsity and minimizing this function using iterative gradient-descent techniques. To prevent easy detection of the attack, we further ensure that the perturbation magnitude is within a specified constraint and that the perturbation does not affect classification accuracy. We launch both white-box and black-box versions of adversarial sparsity attacks on image recognition DNNs and demonstrate that they decrease activation sparsity by $1.16times $ – $1.82times $ . On a sparsity-optimized DNN accelerator, the attack results in degradations of $1.12times $ – $1.59time- $ in latency and $1.18times $ – $1.99times $ in energy-delay product (EDP). Additionally, we analyze the impact of various hyperparameters and constraints on the attack's efficacy. Finally, we evaluate defense techniques, such as activation thresholding and input quantization and demonstrate that the proposed attack is able to withstand them, highlighting the need for further efforts in this new direction within the field of adversarial machine learning.

Sparse DNNs with Improved Adversarial Robustness.

Attack As Defense: Characterizing Adversarial Examples Using Robustness.

Evaluating Model Robustness Using Adaptive Sparse L0 Regularization

Enhancing Adversarial Robustness in SNNs with Sparse Gradients

Robust Sparse Regularization: Simultaneously Optimizing Neural Network Robustness and Compactness

The Search for Sparse, Robust Neural Networks

Adversarial Robustness Vs. Model Compression, or Both?

Batch Normalization Assisted Adversarial Pruning: Towards Lightweight, Sparse and Robust Models.

Sparsity Meets Robustness: Channel Pruning for the Feynman-Kac Formalism Principled Robust Deep Neural Nets

Improving Model Robustness Against Adversarial Examples with Redundant Fully Connected Layer.

An Integrated Approach to Produce Robust Models with High Efficiency

On the Effect of Low-Rank Weights on Adversarial Robustness of Neural Networks

Sparsity Turns Adversarial: Energy and Latency Attacks on Deep Neural Networks

Exploring Architectural Ingredients of Adversarially Robust Deep Neural Networks

Not So Robust After All: Evaluating the Robustness of Deep Neural Networks to Unseen Adversarial Attacks

Understanding the effect of sparsity on neural networks robustness

Second Rethinking of Network Pruning in the Adversarial Setting

Adversarial Attacks on Deep Unfolded Networks for Sparse Coding.

Pruning in the Face of Adversaries

Hardening DNNs against Transfer Attacks during Network Compression using Greedy Adversarial Pruning

Toward Robust Spiking Neural Network Against Adversarial Perturbation