NODEAttack: Adversarial Attack on the Energy Consumption of Neural ODEs

Recently , Neural ODE ( Ordinary Differential Equation ) models have been proposed , which use ordinary differential equation solving to predict the output of neural network . Due to the low memory usage , Neural ODE models can be considered as an alternative that can be deployed in resource-constrained devices ( e.g. , IoT devices , mobile devices ) . However , to deploy a Deep Learning model in resource-constrained devices , low inference energy cost is also required along with low memory cost . Unlike the memory cost , the energy consumption of the Neural ODEs during inference can be adaptive because of the adaptive nature of the ODE solvers . Attackers can leverage the adaptive behaviour of Neural ODEs to attack the energy consumption of Neural ODEs . However , energy-based attack scenarios have not been explored against Neural ODEs . To show the vulnerability of Neural ODEs against adversarial energy-based attack , we propose NODEAttack . The objective of NODEAttack is to generate adversarial inputs that require more ODE solvers computations , therefore increasing neural ODEs inference-time energy consumption . Our extensive evaluation on two datasets and two popular ODE solvers show that the samples generated through NODEAttack can increase up to 168 % energy consumption than average energy consumption of benign test data during inference time . Our evaluation also shows the attack transferability is feasible across solvers and architectures . Also , we perform a case study showing the impact of the generated adversarial examples , which shows that NODEAttack generated adversarial examples can decrease 50 % efficiency of an object-recognition-based mobile application . 1 INTRODUCTION . Deep Neural Networks ( DNNs ) have shown great potential in many challenging tasks ( image classification , natural language process , and playing games ) . To cope with tasks with higher complexity , the number of DNN parameters is increasing rapidly . Because of this reason , DNNs require considerable memory usage both in training and inference . To address the issue of increased memory usage , researchers simulate the solver of ordinary differential equation ( ODE ) and propose Neural ODE techniques ( Chen et al. , 2018 ) . Neural ODE does not store any intermediate quantities of the forward pass and allows us to train DNNs with constant memory cost . Neural ODE also performs better than traditional DNNs for irregularly sampled time series data . Because of decreased memory cost , Neural ODEs are viable options to be used in resource-constrained devices like mobile devices or UAVs ( Unmanned Aerial Vehicle ) . Due to the adaptive energy consumption of Neural ODE models ( Section 3 ) , the model robustness in terms of energy consumption or energy robustness ( Defined in 4.1 ) of the model needs to be investigated to deploy Neural ODE models in resource-constrained devices . Otherwise , lack of energy robustness in Neural ODEs can lead to tragic situations . For example , we assume that Neural ODE model is deployed for mobile apps , which are used to help visually impaired people . The energy consumption of the model is not robust , then the battery of the mobile device will be drained faster . This can be fatal for the visually impaired person . To avoid such scenarios , evaluating energy robustness of Neural ODEs is required to avoid unwanted incidents . Although energy robustness of Neural ODEs has not been explored , unlike accuracy-based robustness . Recent work shows that Neural ODE models are more robust against accuracy-based adversarial attacks ( Yan et al . ( 2019 ) ) than traditional DNNs . However , finding a relationship between input and energy consumption is more challenging because the relation between input and energy consumption of DNNs is not well-defined . To explore the energy robustness of Neural ODEs , the relationship between input and energy consumption of Neural ODEs needs to be defined . Recent works , ILFO ( Haque et al . ( 2020 ) ) and DeepSloth ( Hong et al . ( 2020 ) ) , have evaluated energy robustness of Adaptive Neural Networks ( AdNNs ) by proposing white-box attack . However , optimizing the loss function proposed by the aforementioned AdNN attacks can not evaluate the energy robustness of Neural ODEs . AdNNs activate or deactivate certain components of DNNs based on the intermediate outputs of certain computing units and consumes a different amount of energy based on different inputs . Both the attack ’ s objective is to increase the number of activated DNN components by modifying the specific computing unit outputs , and both attack use specific loss function optimization to achieve that . However , Neural ODE functionality is different than traditional AdNN functionality because , for Neural ODE , no component is deactivated or activated during inference . The adaptive behavior of a Neural ODE model depends on the adaptive ODE solver used to predict the output . Furthermore , for a specific trained Neural ODE model , we can find variable energy consumption for single input depending on the type of ODE solver used , where for traditional AdNNs , energy consumption based on a specific input will be the same always for a specific trained AdNN . Therefore , a novel approach is needed to explore the energy robustness of Neural ODEs . To explore the energy robustness of Neural ODEs , We propose NODEAttack , a white-box approach that uses step-size of the ODE solvers to formulate attack . ODE solvers use an iterative way to approximate a function , and the objective of our approach is to increase the number of iterations , increasing the energy consumption of Neural ODEs . Our attack formulation is based on the fact that decreasing step-size would increase the number of iterations . Specifically , we develop two attack techniques to evaluate Neural ODE ’ s energy robustness , namely Input-based attack and Universal attack . Input-based attack evaluates energy robustness where testing inputs are semantically meaningful to the Neural ODE model ( e.g. , meaningful images ) . On the other hand , Universal attack evaluates worst-case energy robustness where each testing input maximizes the energy consumption for each target ODE solver . To the best of our knowledge , this is the first energy-based adversarial attack against Neural ODEs . We evaluate NODEAttack on mainly two criteria : effectiveness and transferability using the CIFAR-10 and MNIST datasets ( Krizhevsky et al . ( 2009 ) ; Deng ( 2012 ) ) . We evaluated NODEAttack on two popular ODE solvers : Dopri5 ( Dormand and Prince ( 1980 ) ) and Adaptive Heun Süli and Mayers ( 2003 ) . We evaluate the the effectiveness of NODEAttack against natural perturbations and corruptions Hendrycks and Dietterich ( 2019a ) . We observed that NODEAttack generated adversarial inputs can increase up to 168 % energy consumption than the average energy consumed by benign test inputs . Also , we noticed that transferability is feasible between two Neural ODEs differentiated by ODE solver or model architecture . Our paper makes the following contributions : • Problem Formulation and Approach . Our work is the first attempt to formulate energybased adversarial attack against Neural ODE models . Also , our work proposes a novel loss function based on step-size of ODE solvers to generate adversarial inputs . • Evaluation . We evaluate our approach across two ODE solvers and two datasets based on two criteria . 2 BACKGROUND AND RELATED WORKS . 2.1 NEURAL ORDINARY DIFFERENTIAL EQUATIONS . Neural Ordinary Differential Equations ( Neural ODE ) ( Chen et al . ( 2018 ) ) have been successful in attaining accuracy close to the State of the Art DNN techniques but with lesser memory consumption . Neural ODEs incorporate Ordinary Differential Equations solvers into Neural Network architectures . Models such as residual networks and recurrent neural network decoders create complicated transformations by devising a sequence of transformations to a hidden state : ht+1 = ht + f ( ht , θt ) Operation of a residual block can be interpreted as the discrete approximation of an ODE where the discretization step value is one . In a neural ODE , the discretization step is set to zero and the relation between input , and output is characterized by the following set of equations : dh ( t ) dt = f ( h ( t ) , t , θ ) , h ( 0 ) = hin , hout = h ( T ) Solving h ( T ) gives the output and ODE solvers can be used for that purpose . Additionally , Proposed work by Quaglino et al . ( 2019 ) expresses the Neural ODE dynamics as truncated series of Legendre polynomials and accelerate the model . Dupont et al . ( 2019 ) explores the limitations in approximation capabilities of neural ODEs because of the preserving of input topology . Recent work by Yan et al . ( 2019 ) explore the robustness of Neural ODEs against Neural ODEs and propose TisODE to increase the robustness of Neural ODEs . However , no other work has focused on the energy robustness perspective or Neural ODEs , and to our knowledge , this is the first work in that direction . 2.2 RUNGE KUTTA METHOD . Runge Kutta method ( Runge ( 1895 ) ; Kutta ( 1901 ) ) is an ODE solver which solved ordinary differential equations through approximation . First-order differential equation given by , dy ( t ) dt = y′ ( t ) = f ( y ( t ) , t ) , with y ( t0 ) = y0 Here y is an function of time t and y∗ is the value of y at t = 0 . Four slope approximations k1 , k2 , k3 , k4 are used to estimate approximate value of y ( y∗ ) at t = t0 ( Detailed equation in Appendix ) . Final estimate of y∗ ( t0 + h ) can be represented as , y∗ ( t0 + h ) = y∗ ( t0 ) + ( 1 6 .k1 + 1 3 .k2 + 1 3 .k3 + 1 6 .k4 ) .h Here , h is the step size . This is called fourth order Runge Kutta Method , because the local error ( approximation error at a particular time ) for step-size h is O ( h4 ) . For better approximation of function , multiple works ( Dormand and Prince ( 1980 ) ; Süli and Mayers ( 2003 ) ) have proposed to use adaptive step size . 2.3 ADVERSARIAL EXAMPLES . Adversarial Examples are the inputs that are fed to machine learning models to change the prediction of the model . In earlier works by Dalvi et al . ( 2004 ) ; Lowd and Meek ( 2005 ) ; D.Lowd and C.Meek ( 2005 ) , ‘ good word attacks ’ or spelling modifications have long been used to bypass the spam filters . More recently , Szegedy et al . ( 2013 ) and Goodfellow et al . ( 2014 ) propose adversarial attacks on deep computer vision models . Karmon et al . ( 2018 ) propose a technique to attack CNNs in which a localized patch is introduced in an image instead of adding noise to the full image . With a similar approach , adversarial attacks have been extended to various fields like text and speech processing ( Carlini et al . ( 2016 ) ; Jia and Liang ( 2017 ) ) , and graph models ( Zügner et al . ( 2018 ) ; Bojchevski and Günnemann ( 2019 ) ) . Recently , Haque et al . ( 2020 ) ; Hong et al . ( 2020 ) have proposed adversarial energy based attacks against Adaptive Neural Networks . However , as mentioned in the introduction , existing attacks can not be used to increase energy consumption of Neural ODEs .

Summary: In this paper, the authors proposed an attack model named NODEAttack to verify the vulnerability of Neural ODEs against energy-surging adversarial samples. The authors study two attack cases: Input-based attack (untargeted attack) and universal untargeted attack. The experiments on CIFAR-10 and MNIST datasets show the reasonable performance of the proposed model outperforms common perturbations and corruptions methods. A case study based on DNN compilers and PyTorch mobile demonstrates the generated adversarial examples can reduce the efficiency of real-world applications.