Sponge示例：对神经网络的能量延迟攻击
Sponge Examples: Energy-Latency Attacks on Neural Networks
摘要：
神经网络训练和推理的高能耗导致了GPU和TPU等加速硬件的使用。虽然这使我们能够在网络中心训练大规模神经网络，并将其部署在边缘设备上，但到目前为止，重点是平均情况下的性能。在这项工作中，我们引入了一种新的威胁向量对神经网络的能量消耗或决策延迟是至关重要的。我们展示了对手如何利用精心制作的$\boldsymbol{sponge}~\boldsymbol{examples}$，这是设计用于最大限度地提高能耗和延迟的输入。我们在已建立的视觉和语言模型上安装了这种攻击的两种变体，将能耗增加了10到200倍。我们的攻击还可以用于延迟网络具有关键实时性能的决策，例如自动驾驶汽车的感知。我们展示了我们的恶意输入跨CPU和各种硬件加速器芯片（包括GPU）和ASIC模拟器的可移植性。最后，我们提出了一种防御策略，通过将硬件中的能耗分析从平均情况转移到最坏情况来减轻我们的攻击。
英文摘要：
The high energy costs of neural network training and inference led to the use of acceleration hardware such as GPUs and TPUs. While this enabled us to train large-scale neural networks in datacenters and deploy them on edge devices, the focus so far is on average-case performance. In this work, we introduce a novel threat vector against neural networks whose energy consumption or decision latency are critical. We show how adversaries can exploit carefully crafted $\boldsymbol{sponge}~\boldsymbol{examples}$, which are inputs designed to maximise energy consumption and latency. We mount two variants of this attack on established vision and language models, increasing energy consumption by a factor of 10 to 200. Our attacks can also be used to delay decisions where a network has critical real-time performance, such as in perception for autonomous vehicles. We demonstrate the portability of our malicious inputs across CPUs and a variety of hardware accelerator chips including GPUs, and an ASIC simulator. We conclude by proposing a defense strategy which mitigates our attack by shifting the analysis of energy consumption in hardware from an average-case to a worst-case perspective.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
