Energy-Latency Attacks via Sponge Poisoning

TL;DR

This paper introduces sponge poisoning, a training-time poisoning attack that raises energy consumption and inference latency of DNNs on ASIC accelerators by increasing neuron firing, while preserving test accuracy. By contaminating a small fraction of training Updates with a differentiable energy objective based on an unbiased $\hat{\ell}_0$ proxy, the approach defeats sparsity-based hardware benefits across multiple datasets and architectures. The authors characterize the attack's effectiveness, analyze which layers (notably those with max operations) are most vulnerable, and show that defensive fine-tuning can mitigate the effect at high training cost. They also discuss an adaptive threat model suitable for outsourced or federated training and emphasize that defending against sponge poisoning remains an open research problem with potential directions such as model quantization and novel regularizers.

Abstract

Sponge examples are test-time inputs optimized to increase energy consumption and prediction latency of deep networks deployed on hardware accelerators. By increasing the fraction of neurons activated during classification, these attacks reduce sparsity in network activation patterns, worsening the performance of hardware accelerators. In this work, we present a novel training-time attack, named sponge poisoning, which aims to worsen energy consumption and prediction latency of neural networks on any test input without affecting classification accuracy. To stage this attack, we assume that the attacker can control only a few model updates during training -- a likely scenario, e.g., when model training is outsourced to an untrusted third party or distributed via federated learning. Our extensive experiments on image classification tasks show that sponge poisoning is effective, and that fine-tuning poisoned models to repair them poses prohibitive costs for most users, highlighting that tackling sponge poisoning remains an open issue.

Figures (15)

• Figure 1: The figure depicts two outsourced training scenarios for a DNN on an ASIC-accelerated system. In the top scenario, a benign third-party service trains the model with gradient updates to minimize the model error $\mathcal{L}$. At test time, the model leverages ASIC optimizations, reducing computation and energy consumption. In the bottom scenario, an attacker adds a term to the training loss to maximize the energy consumption ($E$), preserving model accuracy but negating ASIC benefits.
• Figure 2: Effect of sponge poisoning on DNNs. (Left) A trained DNN correctly classifies an image as a Parrot. (Middle) The sponge model maintains accuracy while increasing neuron activations (red), raising energy consumption and latency. (Right) A histogram shows neuron activation percentages for the clean (blue) and sponge models (red).
• Figure 3: Illustration of the $\ell_0$-norm (a) and its approximation $\hat{\ell_0}$ for decreasing $\sigma$ values. The smaller the value of $\sigma$, the more accurate (but less smooth) the approximation is.
• Figure 4: Ablation study on $\sigma$ (figures (a) and (b)) and $\lambda$ (figures (c) and (d)). For the analysis of $\lambda$, we use the $\sigma$ value that yields the highest energy consumption while maintaining validation accuracy.
• Figure 5: Ablation study on term $\sigma$ in Eq. \ref{['eq:l0_approximation']} for ResNet18 and VGG16, trained on the GTSRB dataset (top row) and CelebA dataset (bottom row). Results for ResNet18 are shown in figures (a) and (b), and for VGG16 in figures (c) and (d).