NVM Crossbars对对抗攻击的内在鲁棒性
On the Intrinsic Robustness of NVM Crossbars Against Adversarial Attacks
摘要：
深度学习日益增长的计算需求推动了基于新兴非易失性存储器（NVM）技术的专用推理加速器的研究。这种NVM交叉开关保证了快速和节能的原位矩阵向量乘法（MVM），从而缓解了当今数字硬件中长期存在的冯·诺依曼瓶颈。然而，这些交叉开关中计算的模拟性质本质上是近似的，并导致与理想输出值的偏差，这降低了正常情况下深度神经网络（DNN）的整体性能。在本文中，我们研究的影响，这些非理想的情况下，对抗。我们表明，模拟计算的非理想行为降低了对抗攻击的有效性，在黑盒和白盒攻击的情况下。在非自适应攻击中，攻击者不知道模拟硬件，我们观察到模拟计算提供了不同程度的内在鲁棒性，对于CIFAR-10，CIFAR-100和ImageNet的白盒PGD（μ =1/255，iter=30），峰值对抗准确率分别提高了35.34%，22.69%和9.90%。我们还展示了“硬件在环”的自适应攻击，规避这种鲁棒性，利用知识的NVM模型。
英文摘要：
The increasing computational demand of Deep Learning has propelled research in special-purpose inference accelerators based on emerging non-volatile memory (NVM) technologies. Such NVM crossbars promise fast and energy-efficient in-situ Matrix Vector Multiplication (MVM) thus alleviating the long-standing von Neuman bottleneck in today's digital hardware. However, the analog nature of computing in these crossbars is inherently approximate and results in deviations from ideal output values, which reduces the overall performance of Deep Neural Networks (DNNs) under normal circumstances. In this paper, we study the impact of these non-idealities under adversarial circumstances. We show that the non-ideal behavior of analog computing lowers the effectiveness of adversarial attacks, in both Black-Box and White-Box attack scenarios. In a non-adaptive attack, where the attacker is unaware of the analog hardware, we observe that analog computing offers a varying degree of intrinsic robustness, with a peak adversarial accuracy improvement of 35.34%, 22.69%, and 9.90% for white box PGD (epsilon=1/255, iter=30) for CIFAR-10, CIFAR-100, and ImageNet respectively. We also demonstrate "Hardware-in-Loop" adaptive attacks that circumvent this robustness by utilizing the knowledge of the NVM model.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
