NODEAttack: Adversarial Attack on the Energy Consumption of Neural ODEs

Recently , Neural ODE ( Ordinary Differential Equation ) models have been proposed , which use ordinary differential equation solving to predict the output of neural network . Due to the low memory usage , Neural ODE models can be considered as an alternative that can be deployed in resource-constrained devices ( e.g. , IoT devices , mobile devices ) . However , to deploy a Deep Learning model in resource-constrained devices , low inference energy cost is also required along with low memory cost . Unlike the memory cost , the energy consumption of the Neural ODEs during inference can be adaptive because of the adaptive nature of the ODE solvers . Attackers can leverage the adaptive behaviour of Neural ODEs to attack the energy consumption of Neural ODEs . However , energy-based attack scenarios have not been explored against Neural ODEs . To show the vulnerability of Neural ODEs against adversarial energy-based attack , we propose NODEAttack . The objective of NODEAttack is to generate adversarial inputs that require more ODE solvers computations , therefore increasing neural ODEs inference-time energy consumption . Our extensive evaluation on two datasets and two popular ODE solvers show that the samples generated through NODEAttack can increase up to 168 % energy consumption than average energy consumption of benign test data during inference time . Our evaluation also shows the attack transferability is feasible across solvers and architectures . Also , we perform a case study showing the impact of the generated adversarial examples , which shows that NODEAttack generated adversarial examples can decrease 50 % efficiency of an object-recognition-based mobile application . 1 INTRODUCTION . Deep Neural Networks ( DNNs ) have shown great potential in many challenging tasks ( image classification , natural language process , and playing games ) . To cope with tasks with higher complexity , the number of DNN parameters is increasing rapidly . Because of this reason , DNNs require considerable memory usage both in training and inference . To address the issue of increased memory usage , researchers simulate the solver of ordinary differential equation ( ODE ) and propose Neural ODE techniques ( Chen et al. , 2018 ) . Neural ODE does not store any intermediate quantities of the forward pass and allows us to train DNNs with constant memory cost . Neural ODE also performs better than traditional DNNs for irregularly sampled time series data . Because of decreased memory cost , Neural ODEs are viable options to be used in resource-constrained devices like mobile devices or UAVs ( Unmanned Aerial Vehicle ) . Due to the adaptive energy consumption of Neural ODE models ( Section 3 ) , the model robustness in terms of energy consumption or energy robustness ( Defined in 4.1 ) of the model needs to be investigated to deploy Neural ODE models in resource-constrained devices . Otherwise , lack of energy robustness in Neural ODEs can lead to tragic situations . For example , we assume that Neural ODE model is deployed for mobile apps , which are used to help visually impaired people . The energy consumption of the model is not robust , then the battery of the mobile device will be drained faster . This can be fatal for the visually impaired person . To avoid such scenarios , evaluating energy robustness of Neural ODEs is required to avoid unwanted incidents . Although energy robustness of Neural ODEs has not been explored , unlike accuracy-based robustness . Recent work shows that Neural ODE models are more robust against accuracy-based adversarial attacks ( Yan et al . ( 2019 ) ) than traditional DNNs . However , finding a relationship between input and energy consumption is more challenging because the relation between input and energy consumption of DNNs is not well-defined . To explore the energy robustness of Neural ODEs , the relationship between input and energy consumption of Neural ODEs needs to be defined . Recent works , ILFO ( Haque et al . ( 2020 ) ) and DeepSloth ( Hong et al . ( 2020 ) ) , have evaluated energy robustness of Adaptive Neural Networks ( AdNNs ) by proposing white-box attack . However , optimizing the loss function proposed by the aforementioned AdNN attacks can not evaluate the energy robustness of Neural ODEs . AdNNs activate or deactivate certain components of DNNs based on the intermediate outputs of certain computing units and consumes a different amount of energy based on different inputs . Both the attack ’ s objective is to increase the number of activated DNN components by modifying the specific computing unit outputs , and both attack use specific loss function optimization to achieve that . However , Neural ODE functionality is different than traditional AdNN functionality because , for Neural ODE , no component is deactivated or activated during inference . The adaptive behavior of a Neural ODE model depends on the adaptive ODE solver used to predict the output . Furthermore , for a specific trained Neural ODE model , we can find variable energy consumption for single input depending on the type of ODE solver used , where for traditional AdNNs , energy consumption based on a specific input will be the same always for a specific trained AdNN . Therefore , a novel approach is needed to explore the energy robustness of Neural ODEs . To explore the energy robustness of Neural ODEs , We propose NODEAttack , a white-box approach that uses step-size of the ODE solvers to formulate attack . ODE solvers use an iterative way to approximate a function , and the objective of our approach is to increase the number of iterations , increasing the energy consumption of Neural ODEs . Our attack formulation is based on the fact that decreasing step-size would increase the number of iterations . Specifically , we develop two attack techniques to evaluate Neural ODE ’ s energy robustness , namely Input-based attack and Universal attack . Input-based attack evaluates energy robustness where testing inputs are semantically meaningful to the Neural ODE model ( e.g. , meaningful images ) . On the other hand , Universal attack evaluates worst-case energy robustness where each testing input maximizes the energy consumption for each target ODE solver . To the best of our knowledge , this is the first energy-based adversarial attack against Neural ODEs . We evaluate NODEAttack on mainly two criteria : effectiveness and transferability using the CIFAR-10 and MNIST datasets ( Krizhevsky et al . ( 2009 ) ; Deng ( 2012 ) ) . We evaluated NODEAttack on two popular ODE solvers : Dopri5 ( Dormand and Prince ( 1980 ) ) and Adaptive Heun Süli and Mayers ( 2003 ) . We evaluate the the effectiveness of NODEAttack against natural perturbations and corruptions Hendrycks and Dietterich ( 2019a ) . We observed that NODEAttack generated adversarial inputs can increase up to 168 % energy consumption than the average energy consumed by benign test inputs . Also , we noticed that transferability is feasible between two Neural ODEs differentiated by ODE solver or model architecture . Our paper makes the following contributions : • Problem Formulation and Approach . Our work is the first attempt to formulate energybased adversarial attack against Neural ODE models . Also , our work proposes a novel loss function based on step-size of ODE solvers to generate adversarial inputs . • Evaluation . We evaluate our approach across two ODE solvers and two datasets based on two criteria . 2 BACKGROUND AND RELATED WORKS . 2.1 NEURAL ORDINARY DIFFERENTIAL EQUATIONS . Neural Ordinary Differential Equations ( Neural ODE ) ( Chen et al . ( 2018 ) ) have been successful in attaining accuracy close to the State of the Art DNN techniques but with lesser memory consumption . Neural ODEs incorporate Ordinary Differential Equations solvers into Neural Network architectures . Models such as residual networks and recurrent neural network decoders create complicated transformations by devising a sequence of transformations to a hidden state : ht+1 = ht + f ( ht , θt ) Operation of a residual block can be interpreted as the discrete approximation of an ODE where the discretization step value is one . In a neural ODE , the discretization step is set to zero and the relation between input , and output is characterized by the following set of equations : dh ( t ) dt = f ( h ( t ) , t , θ ) , h ( 0 ) = hin , hout = h ( T ) Solving h ( T ) gives the output and ODE solvers can be used for that purpose . Additionally , Proposed work by Quaglino et al . ( 2019 ) expresses the Neural ODE dynamics as truncated series of Legendre polynomials and accelerate the model . Dupont et al . ( 2019 ) explores the limitations in approximation capabilities of neural ODEs because of the preserving of input topology . Recent work by Yan et al . ( 2019 ) explore the robustness of Neural ODEs against Neural ODEs and propose TisODE to increase the robustness of Neural ODEs . However , no other work has focused on the energy robustness perspective or Neural ODEs , and to our knowledge , this is the first work in that direction . 2.2 RUNGE KUTTA METHOD . Runge Kutta method ( Runge ( 1895 ) ; Kutta ( 1901 ) ) is an ODE solver which solved ordinary differential equations through approximation . First-order differential equation given by , dy ( t ) dt = y′ ( t ) = f ( y ( t ) , t ) , with y ( t0 ) = y0 Here y is an function of time t and y∗ is the value of y at t = 0 . Four slope approximations k1 , k2 , k3 , k4 are used to estimate approximate value of y ( y∗ ) at t = t0 ( Detailed equation in Appendix ) . Final estimate of y∗ ( t0 + h ) can be represented as , y∗ ( t0 + h ) = y∗ ( t0 ) + ( 1 6 .k1 + 1 3 .k2 + 1 3 .k3 + 1 6 .k4 ) .h Here , h is the step size . This is called fourth order Runge Kutta Method , because the local error ( approximation error at a particular time ) for step-size h is O ( h4 ) . For better approximation of function , multiple works ( Dormand and Prince ( 1980 ) ; Süli and Mayers ( 2003 ) ) have proposed to use adaptive step size . 2.3 ADVERSARIAL EXAMPLES . Adversarial Examples are the inputs that are fed to machine learning models to change the prediction of the model . In earlier works by Dalvi et al . ( 2004 ) ; Lowd and Meek ( 2005 ) ; D.Lowd and C.Meek ( 2005 ) , ‘ good word attacks ’ or spelling modifications have long been used to bypass the spam filters . More recently , Szegedy et al . ( 2013 ) and Goodfellow et al . ( 2014 ) propose adversarial attacks on deep computer vision models . Karmon et al . ( 2018 ) propose a technique to attack CNNs in which a localized patch is introduced in an image instead of adding noise to the full image . With a similar approach , adversarial attacks have been extended to various fields like text and speech processing ( Carlini et al . ( 2016 ) ; Jia and Liang ( 2017 ) ) , and graph models ( Zügner et al . ( 2018 ) ; Bojchevski and Günnemann ( 2019 ) ) . Recently , Haque et al . ( 2020 ) ; Hong et al . ( 2020 ) have proposed adversarial energy based attacks against Adaptive Neural Networks . However , as mentioned in the introduction , existing attacks can not be used to increase energy consumption of Neural ODEs .

Summary: The authors propose an adversarial test-time attack on Neural ODE models, which increases the inference time of the NODE models. Two variants of the attack are introduced. The proposed attacks are evaluated on CIFAR10 and MNIST datasets. In experiments, the authors showed the proposed attacks increased the inference time of NODE models for object detection task, which drained the battery faster on mobile device.