The Impact of Uniform Inputs on Activation Sparsity and Energy-Latency Attacks in Computer Vision

TL;DR

This paper analyzes the mechanism how energylatency attacks reduce activation sparsity and finds that input uniformity is a key enabler, and proposes two new simple, yet effective strategies for crafting sponge examples.

Abstract

Resource efficiency plays an important role for machine learning nowadays. The energy and decision latency are two critical aspects to ensure a sustainable and practical application. Unfortunately, the energy consumption and decision latency are not robust against adversaries. Researchers have recently demonstrated that attackers can compute and submit so-called sponge examples at inference time to increase the energy consumption and decision latency of neural networks. In computer vision, the proposed strategy crafts inputs with less activation sparsity which could otherwise be used to accelerate the computation. In this paper, we analyze the mechanism how these energy-latency attacks reduce activation sparsity. In particular, we find that input uniformity is a key enabler. A uniform image, that is, an image with mostly flat, uniformly colored surfaces, triggers more activations due to a specific interplay of convolution, batch normalization, and ReLU activation. Based on these insights, we propose two new simple, yet effective strategies for crafting sponge examples: sampling images from a probability distribution and identifying dense, yet inconspicuous inputs in natural datasets. We empirically examine our findings in a comprehensive evaluation with multiple image classification models and show that our attack achieves the same sparsity effect as prior sponge-example methods, but at a fraction of computation effort. We also show that our sponge examples transfer between different neural networks. Finally, we discuss applications of our findings for the good by improving efficiency by increasing sparsity.

Figures (8)

• Figure 1: Illustration of energy-latency attack. Compared to benign inputs, adversarially crafted sponge examples increase the activation density, i. e., the number of non-zero neurons. Thus, sparsity-aware acceleration strategies become ineffective.
• Figure 2: Influence of uniform surfaces on ResNet-18 activation density for 1000 random samples from the ImageNet validation dataset, 100 Sponge-GA samples, and 100 Sponge-L-BFGS samples.
• Figure 3: Examples from Sponge-GA, Sponge-L-BFGS, and ImageNet validation set with highest density on ResNet-18 and DenseNet-121.
• Figure 4: Impact of uniformity. The plot shows the feature-map distributions of a low-density (top) and of a high-density input (bottom) in the first channel of the first sequence of convolution, normalization, and ReLU activation of a ResNet-18 model. The high-density sample is a sponge example obtained with Sponge-L-BFGS.
• Figure 5: Distribution of zero thresholds $\theta^l_c$ for the first ten BN-ReLU sequences for different models. Y-axis clipped for better visibility.