SlowGuess/NeurIPS_2023_OCR huggingface dataset:
Figure 2: The impact of  $\alpha$  on accuracy and efficacy. Taking each model's results on QNLI, as  $\alpha$  is increased, the accuracy and efficacy decrease.
same applies to accuracy, and when  $\alpha \geq 0.8$ , accuracy surprisingly increases, a potentially undesirable outcome. Moreover, when  $\alpha \geq 0.8$  efficacy does not decrease any further, which potentially wastes computational resources as the time required to craft samples increases greatly as  $\alpha$  is increased.
5 Practical Exploitation of WAFFLE in Black-box Settings
In Sec 4, we show in the worst-case scenarios, multi-exit language models are not robust to adversarial slowdown. We now turn our attention to black-box settings where an adversary does not have full knowledge of the victim's system. We consider two attack scenarios: (1) Transfer-based attacks where an adversary who has the knowledge of the training data trains surrogate models to craft adversarial texts and use them to attack the victim models. (2) Universal attacks where an attacker finds a set of trigger words that can inflict slowdown when attached to any test-time inputs. We run these experiments across various GLUE tasks and show the results from the RTE and QQP datasets. We include all our results on different datasets and victim-surrogate combinations in the Appendix.
Transferability of WAFFLE. We first test if our attack is transferable in three different scenarios: (1) Cross-seed; (2) Cross-architecture; and (3) Cross-mechanism. Table 2 summarizes our results.
Model	Arch.	Mechanism	Scenario	Type	RTE	QQP
Acc.	Eff.	Acc.	Eff.
S	BERT	PastFuture	Cross-seed	S→S	66 → 52	0.47 → 0.11	91 → 72	0.50 → 0.26
V	BERT	PastFuture	S→V	66 → 55	0.50 → 0.25	91 → 72	0.51 → 0.33
S	BERT	PABEE	Cross-arch.	S→S	66 → 49	0.22 → 0.08	91 → 69	0.35 → 0.16
V	ALBERT	PABEE	S→V	77 → 55	0.22 → 0.21	91 → 74	0.36 → 0.34
S	BERT	PABEE	Cross-mech.	S→S	66 → 49	0.22 → 0.08	91 → 69	0.35 → 0.16
V	BERT	PastFuture	S→V	66 → 55	0.50 → 0.29	91 → 74	0.51 → 0.38
$\mathrm{S} =$  Surrogate model;  $\mathrm{V} =$  Victim model
Table 2: Transfer-based attack results. Results from the cross-seed, cross-mechanism, and cross-architecture experiments on RTE and QQP. In all experiments, we craft adversarial texts on the surrogate model (S) and then evaluated on both the surrogate  $(\mathrm{S}\rightarrow \mathrm{S})$  and victim  $(\mathrm{S}\rightarrow \mathrm{V})$  models.
Cross-seed. Both the model architecture and early-exit mechanism are identical for the surrogate and the victim models. In RTE and QQP, our transfer attack  $(\mathrm{S} \rightarrow \mathrm{V})$  demonstrates a significant slowdown on the victim model, resulting in a reduction in efficacy of 0.25 and 0.18, respectively. In comparison to the white-box scenarios  $(\mathrm{S} \rightarrow \mathrm{S})$ , these attacks achieve approximately  $50\%$  effectiveness.
Cross-architecture. We vary the model architecture, using either BERT or ALBERT, while keeping the early-exit mechanism (PABEE) the same. Across the board, we achieve the lowest transferability among the three attacking scenarios, with a reduction in efficacy of 0.01 in RTE and 0.02 in QQP, respectively. This indicates that when conducting transfer-based attacks, the matching of the victim and surrogate models' architectures has a greater impact than the early-exit mechanism.
Cross-mechanism. We now vary the early-exit mechanism used by the victim and surrogate models while the architecture (BERT) remains consistent. In QQP and RTE, we cause significant slowdown to the victim model (a reduction in efficacy of 0.21 and 0.13, respectively), even when considering the relational speed-up offered by different mechanisms (e.g., PastFuture offers more computational savings than PABEE and DeeBERT). The slowdown is comparable to the white-box cases  $(S\rightarrow S)$ .
Universal slowdown triggers. If the attacker is unable to train surrogate models, they can find a few words (i.e., a trigger) that causes slowdown to any test-time inputs when attached. Searching for such a trigger does not require the knowledge of the training data. To demonstrate the practicality of this attack, we select 1000 random words from BERT's vocabulary and compute the total slowdown across  $10\%$  of the SST-2 test dataset by appending each vocab word to the beginning of every sentence. We then choose the word that induces the highest slowdown and evaluate it against the entire test dataset. We find that the most effective word, "unable", reduces efficacy by  $9\%$  and accuracy by  $14\%$  when appended to the beginning of all sentences once. When appended three times successively (i.e., "unable unable unable ..."), the trigger reduces efficacy by  $18\%$  and accuracy by  $3\%$ .
6 Linguistic Analysis of Our Adversarial Texts
To qualitatively analyze the text generated by WAFFLE, we first consider how the number of perturbations applied to an input text affects the slowdown it induces. We choose samples crafted against PastFuture [21], due to it being the most vulnerable to our attack. We select the datasets that induce the most and least slowdown, MNLI and QQP, respectively, in order to conduct a well-rounded analysis. Using 100 samples randomly drawn from both datasets, we record the percentage of words perturbed by WAFFLE and the consequent increase in exit layer. In Figure 3, we find that there is no relationship between the percentage of words perturbed and the increase in exit layer. It is not the number of perturbations made that affects slowdown, but rather how perturbations are made.
In an effort to find another explanation for why samples crafted by WAFFLE induce slowdown on multi-exit models, we look to analyze the inner workings of BERT. Through the qualitative analysis performed by Rogers et al. [31], we find particular interest in two characteristics deemed of high importance to BERT when it makes predictions: (1) subject-predicate agreement and (2) the changing of named entities. In our experiment, these characteristics are incredibly prevalent in successful attacks. Particularly, we find that the score assigned by WAFFLE is much higher when the subject and predicate of a sentence do not match, or a named entity is changed. In addition, WAFFLE
Task	Original Text	Perturbed Text	Change
RTE	Sentence1: Mount Olympus towers up from the center of the earth.
Sentence2: Mount Olympus is in the center of the earth.	Sentence1: Install Olympus towers up from the facilities of the planet.
Sentence2: Mount Olympus is in the center of the earth.	8→12
MNLI	Premise: I'll twist him, sir.
Hypothesis: I'll make him straight	Premise: I'll bending him, sir.
Hypothesis: I'll implement him consecutive.	8→12
MRPC	Sentence1: Ms Stewart, the chief executive, was not expected to attend.
Sentence2: Ms Stewart, 61, ..., did not attend.	Sentence1: Lena Stewart, the chief execute, was not scheduled to help.
Sentence2: Ms Stewart, 61, ..., did not attend.	7→12
QNLI	Question: Where did the Exposition take place?
Sentence: This World's Fair devoted a building to electrical exhibits.	Question: Whereby did the Shows takes place?
Sentence: This World's Fair devoting a building to electrical exhibits.	7→12
QQP	Question1: Why do we need to philosophize?
Question2: Why do we need to philosophize with others?	Question1: Why do we need to philosophize?
Question2: Why got we needing to philosophize with others?	10→12
SST-2	it's a cookie-cutter movie, a cut-and-paste job.	it's a cookie-cutter cinematography, a cut-and-paste worked.	7→12
CoLA	I'll work on it if I can.	I'll task on it if me can.	7→12
Table 3: Adversarial texts generated by WAFFLE. An example of text perturbed by WAFFLE from each dataset, using samples crafted for PABEE. They show how subject-predicate disagreement and the changing of named entities can push previously early-exited samples to the final output layer.
often changes non-verbs into verbs or removes verbs entirely, causing further subject-predicate discrepancies. Table 3 shows an example of these characteristics across all the GLUE tasks. Note that subject-predicate agreement appears much more often.
To quantify the prevalence of these characteristics, we analyze 100 adversarial texts, from QQP crafted on DeeBert, most effective in inducing slowdowns and count the number of samples containing subject-predicate disagreement or a changed named entity. Of the 100 samples,  $84\%$  had a subject-predicate disagreement and  $31\%$  a changed named entity. An important note is that we see smaller percentage points in a changed named entity than in a subject-predicate disagreement, as not all samples have a named entity.
We believe that these two characteristics induce a high amount of slowdown because they can push samples toward out-of-distribution. BERT was trained to have an acute understanding of language and its nuances. It is therefore not expected to have the disagreement between the subject and predicate of a sentence in its training data (unless that is the task it is trained for e.g. CoLA). Also, according to Rogers et al. [31], BERT likely lacks a general idea of named entities, providing an explanation as to why the model is less confident in an answer when a named entity is changed.
Moreover, we analyze samples produced by the base attacks (TF and A2T), and compare them with samples
produced by WAFFLE. Surprisingly, we find a great deal of similarity, particularly with regard to the usage of the two characteristics detailed above, despite the base attacks inducing negligible slowdown. A potential explanation for this is that both types of attacks construct out-of-distribution samples, but change a model's confidence to varying extents. The base attacks likely increase confidence in the wrong answer to a much larger degree than WAFFLE, encouraging early-returns with mispredictions in a majority of cases. In contrast, WAFFLE works by reducing confidence across all of the classes.
Figure 3: Visualizing the relationship between words perturbed and adversarial slowdown induced. Taking 100 random samples from MNLI and QQP (crafted against the PastFuture model), the percentage of words that WAFFLE perturbed and the resulting increase in exit layer is plotted (a greater increase in exit layer indicates greater slowdown). The figure shows that the percentage of words perturbed has no influence over a sample's ability to induce slowdown.
7 Potential Countermeasures
We now test the effectiveness of potential countermeasures against adversarial slowdown. We first evaluate adversarial training (AT), a standard countermeasure that reduces the sensitivity of a model to adversarial input perturbations. We then discuss a way to sanitize the perturbations applied to inputs by running off-the-shelf tools, such as a grammar-checking tool, to remove attack artifacts.
To evaluate, we use the AT proposed by Yoo and Qi [43]. This AT requires significantly fewer computational resources; thus, it is better suited for adversarially training large language models. We
run AT with two different natural adversarial texts, those crafted by A2T and by WAFFLE (adapted from A2T). During training, we attack  $20\%$  of the total samples in each batch. We run our experiments with PABEE trained on RTE and SST-2. We first set the patience to 6 (consistent with the rest of our experiments), but we set it to 2 for the models trained with WAFFLE (A2T). Once trained, we examine the defended models with attacks stronger than A2T: TextFooler (TF) and WAFFLE (Ours).
AT is ineffective against our slowdown attacks. Table 4 shows that AT significantly reduces the efficacy of a model. Compared to the undefended models, the defended models achieve  $\sim 0$  efficacy. As these models do not utilize early exits, they seem robust to our attacks. But certainly, it is not desirable. It is noticeable that the defended models still suffer from a large accuracy drop. We then decided to set the patience to two, i.e., the multi-exit language models use early-exits more aggressively. The defended models have either very low efficacy or accuracy, and our attacks can reduce both.
This result highlights a trade-off between being robust against adversarial slowdown and being efficient. We leave further explorations as future work.
AT	P	Attack	RTE	SST-2
Acc.	Eff.	Acc.	Eff.
A2T	6	TF	81 → 8	0.04 → 0.04	92 → 5	0.04 → 0.04
Ours	81 → 60	0.04 → 0.04	92 → 59	0.04 → 0.04
2	TF	72 → 24	0.13 → 0.13	89 → 10	0.08 → 0.07
Ours	72 → 59	0.13 → 0.14	89 → 56	0.08 → 0.07
A2T(Ours)	6	TF	78 → 7	0.04 → 0.04	92 → 6	0.04 → 0.04
Ours	78 → 56	0.04 → 0.04	92 → 61	0.04 → 0.04
2	TF	53 → 53	0.65 → 0.65	90 → 7	0.05 → 0.04
Ours	53 → 53	0.65 → 0.65	90 → 57	0.05 → 0.04
Table 4: Effectiveness of AT. AT is ineffective against WAF-FLE. The defended models completely lose the computational efficiency (i.e., they have  $\sim 0$  efficacy), even with the aggressive setting with the patience of 2.  $\mathbf{P}$  is the patience.
Input sanitization can be a defense against adversarial slowdown. Our linguistic analysis in Sec 6 shows that the subject-predicate discrepancy is one of the root causes of the slowdown. Building on this insight, we test if sanitizing the perturbed input before feeding it into the models can be a countermeasure against our slowdown attacks. We evaluate this hypothesis with two approaches.
We first use OpenAI's ChatGPT<sup>1</sup>, a conversational model where we can ask questions and get answers. We manually query the model with natural adversarial texts generated by WAFFLE (TF) and collect the revised texts. Our query starts with the prompt "Can you fix all of these?" followed by perturbed texts in the subsequent lines. We evaluate with the MNLI and QQP datasets, on 50 perturbed test-set samples randomly chosen from each. We compute the changes in accuracy and average exit number on the perturbed samples and their sanitized versions. We compute them on the PastFuture models trained on the datasets. Surprisingly, we find that the inputs sanitized by ChatGPT greatly recovers both accuracy and efficacy. In MNLI, we recover the accuracy by 12 percentage points  $(54\% \rightarrow 66\%)$  and reduce the average exit number by 4  $(11.5 \rightarrow 7.5)$ . In QQP, the accuracy is increased by 24 percentage points  $(56\% \rightarrow 80\%)$ , and the average exit number is reduced by 2.5  $(9.6 \rightarrow 7.1)$ .
We also test the effectiveness of additional grammar-checking tools, such as Grammarly $^2$  and language_tool.python $^3$ , in defeating our slowdown attacks. We run this evaluation using the same settings as mentioned above. We feed the adversarial texts generated by our attack into Grammarly and have it correct them. Note that we only take the Grammarly recommendations for the correctness and disregard any other recommendations, such as for clarity. We find that the inputs sanitized by Grammarly still suffer from a significant accuracy loss and slowdown. In MNLI, both the accuracy and the average exit number stay the same  $56\% \rightarrow 58\%$  and  $9.6 \rightarrow 9.5$ , respectively. In QQP, we observe that there is almost no change in accuracy ( $54\% \rightarrow 58\%$ ) or the average exit number ( $11.5 \rightarrow 11.5$ ).
This work shows that the computational savings that input-adaptive multi-exit language models offer are not robust against adversarial slowdown. To evaluate, we propose WAFFLE, an adversarial text-crafting algorithm with the objective of bypassing early-exit points. WAFFLE significantly reduces the computational savings offered by those models. More sophisticated input-adaptive mechanisms suited for higher efficacy become more vulnerable to slowdown attacks. Our linguistic analysis
ChatGPT: https://openai.com/blog/chatgpt/
$^{2}$ Grammarly: https://www.grammarly.com/
3Language Tool (Python): https://github.com/jxmorris12/language_tool.python
exposes that it is not about the magnitude of perturbations but because pushing an input outside the distribution on which a model is trained is easy. We also show the limits of adversarial training in defeating our attacks and the effectiveness of input sanitization as a defense. Our results suggest that future research is required to develop efficient yet robust input-adaptive multi-exit inference.
9 Limitations, Societal Impacts, and Future Work
As shown in our work, word-level perturbations carefully calibrated by WAFFLE make the resulting natural adversarial texts offset the computational savings multi-exit language models provide. However, there have been other types of text perturbations, e.g., character-level [6, 1] or sentence-level perturbations [37]. We have not tested whether an adversary can adapt them to cause slowdowns. If these new attacks are successful, we can hypothesize that some other attributes of language models contribute to lowering the confidence of the predictions made by internal classifiers (early-exit points). It may also render potential countermeasures, such as input sanitization, ineffective. Future work is needed to investigate attacks exploiting different perturbations to cause adversarial slowdown.
To foster future research, we developed WAFFLE in an open-source adversarial attack framework, TextAttack [27]. This will make our attacks more accessible to the community. A concern is that a potential adversary can use those attacks to push the behaviors of systems that harness multi-exit mechanisms outside the expectations. But we believe that our offensive measures will be adopted broadly by practitioners and have them audit such systems before they are publicly available.
We have also shown that using state-of-the-art conversational models, such as ChatGPT, to sanitize perturbed inputs can be an effective defense against adversarial slowdown. But it is unclear what attributes of those models were able to remove the artifacts (i.e., perturbations) our attack induces. Moreover, the fact that this defense heavily relies on the referencing model's capability that the victim cannot control may give room for an adversary to develop stronger attacks in the future.
It is also possible that when using conversational models online as a potential countermeasure, there will be risks of data leakage. However, our proposal does not mean to use ChatGPT as-is. Instead, since other input sanitization (Grammarly) failed, we used it as an accessible tool for input sanitization via a conversational model as a proof-of-concept that it may have effectiveness as a defense. Alternatively, a defender can compose input sanitization as a completely in-house solution by leveraging off-the-shelf models like Vicuna-13B [4]. We leave this exploration as future work.
An interesting question is to what extent models like ChatGPT offer robustness to the conventional adversarial attacks that aim to reduce a model's utility in the inference time. But this is not the scope of our work. While the conversational models we use offer some robustness to our slowdown attacks with fewer side-effects, it does not mean that this direction is bulletproof against all adversarial attacks and/or adaptive adversaries in the future. Recent work shows two opposite views about the robustness of conversational models [39, 49]. We envision more future work on this topic.
We find that the runtime of the potential countermeasures we explore in Sec 7 is higher than the average inference time of undefended multi-exit language models. This would make them useless from a pure runtime standpoint. However, we reason that the purpose of using these defenses was primarily exploratory, aiming to understand further why specific text causes more slowdown and how modifying such text can revert this slowdown. Moreover, input sanitization is already used in commercial models. Claude-2 $^4$ , a conversational model similar to ChatGPT, already employs input-filtering techniques, which we believe, when combined together, is a promising future work direction. Defenses with less computational overheads must be an important area for future work.
Overall, this work raises an open-question to the community about the feasibility of input-adaptive efficient inference on large language models. We believe future work is necessary to evaluate this feasibility and develop a mechanism that kills two birds (efficacy and robustness) with one method.
4https://claude.ai
We thank the anonymous reviewers for their constructive feedback. Zachary Coalson and Sanghyun Hong are partially supported by the Google Faculty Research Award and the Samsung Global Research Outreach (GRO) program. Gabriel Ritter and Rakesh Bobba are partially supported by the U.S. Department of Transportation. The findings and conclusions in this work are those of the author(s) and do not necessarily represent the views of the funding agency.
[40] K. Xie, S. Lu, M. Wang, and Z. Wang. Elbert: Fast albert with confidence-window based early exit. In ICASSP 2021 - 2021 IEEE International Conference on Acoustics, Speech and Signal Processing (ICASSP), pages 7713-7717, 2021. doi: 10.1109/ICASSP39728.2021.9414572.
[41] J. Xin, R. Tang, J. Lee, Y. Yu, and J. Lin. DeeBERT: Dynamic early exiting for accelerating BERT inference. In Proceedings of the 58th Annual Meeting of the Association for Computational Linguistics, pages 2246–2251, Online, July 2020. Association for Computational Linguistics. URL https://www.aclweb.org/anthology/2020.acl-main.204.
[42] J. Xin, R. Tang, Y. Yu, and J. Lin. BERxiT: Early exiting for BERT with better fine-tuning and extension to regression. In Proceedings of the 16th Conference of the European Chapter of the Association for Computational Linguistics: Main Volume, pages 91-104, Online, Apr. 2021. Association for Computational Linguistics. doi: 10.18653/v1/2021.eacl-main.8. URL https://aclanthology.org/2021.eacl-main.8.
[43] J. Y. Yoo and Y. Qi. Towards improving adversarial training of NLP models. In Findings of the Association for Computational Linguistics: EMNLP 2021, pages 945-956, Punta Cana, Dominican Republic, Nov. 2021. Association for Computational Linguistics. doi: 10.18653/v1/2021-findings-emnlp.81. URL https://aclanthology.org/2021-findings-emnlp.81.
[44] Z. Zhang, W. Zhu, J. Zhang, P. Wang, R. Jin, and T.-S. Chung. PCEE-BERT: Accelerating BERT inference via patient and confident early exiting. In Findings of the Association for Computational Linguistics: NAACL 2022, pages 327-338, Seattle, United States, July 2022. Association for Computational Linguistics. doi: 10.18653/v1/2022.findings-naacl.25. URL https://aclanthology.org/2022-findings-naacl.25.
[45] W. Zhou, C. Xu, T. Ge, J. McAuley, K. Xu, and F. Wei. Bert loses patience: Fast and robust inference with early exit. In Advances in Neural Information Processing Systems, volume 33, pages 18330-18341. Curran Associates, Inc., 2020. URL https://proceedings.neurips.cc/paper/2020/file/d4dd111a4fd973394238aca5c05bebe3-Paper.pdf.
[46] C. Zhu, Y. Cheng, Z. Gan, S. Sun, T. Goldstein, and J. Liu. Freelb: Enhanced adversarial training for natural language understanding. arXiv preprint arXiv:1909.11764, 2019.
[47] C. Zhu, Y. Cheng, Z. Gan, S. Sun, T. Goldstein, and J. Liu. Freelb: Enhanced adversarial training for natural language understanding. In International Conference on Learning Representations, 2020. URL https://openreview.net/forum?id=BygzbyHFvB.
[48] W. Zhu. LeeBERT: Learned early exit for BERT with cross-level optimization. In Proceedings of the 59th Annual Meeting of the Association for Computational Linguistics and the 11th International Joint Conference on Natural Language Processing (Volume 1: Long Papers), pages 2968-2980, Online, Aug. 2021. Association for Computational Linguistics. doi: 10.18653/v1/2021.acl-long.231. URL https://aclanthology.org/2021.acl-long.231.
[49] A. Zou, Z. Wang, J. Z. Kolter, and M. Fredrikson. Universal and transferable adversarial attacks on aligned language models. arXiv preprint arXiv:2307.15043, 2023.
A Comparison to Related Attacks in Prior Work
Here, we expand upon our discussion in Sec 2 and discuss the novelty of our slowdown attack compared to the attacks developed in prior work [1, 33, 10].