A Panda? No, It's a Sloth: Slowdown Attacks on Adaptive Multi-Exit Neural Network Inference

1 INTRODUCTION . The inference-time computational demands of deep neural networks ( DNNs ) are increasing , owing to the “ going deeper '' ( Szegedy et al. , 2015 ) strategy for improving accuracy : as a DNN gets deeper , it progressively gains the ability to learn higher-level , complex representations . This strategy has enabled breakthroughs in many tasks , such as image classification ( Krizhevsky et al. , 2012 ) or speech recognition ( Hinton et al. , 2012 ) , at the price of costly inferences . For instance , with 4× more inference cost , a 56-layer ResNet ( He et al. , 2016 ) improved the Top-1 accuracy on ImageNet by 19 % over the 8-layer AlexNet . This trend continued with the 57-layer state-of-the-art EfficientNet ( Tan & Le , 2019 ) : it improved the accuracy by 10 % over ResNet , with 9× costlier inferences . The accuracy improvements stem from the fact that the deeper networks fix the mistakes of the shallow ones ( Huang et al. , 2018 ) . This implies that some samples , which are already correctly classified by shallow networks , do not necessitate the extra complexity . This observation has motivated research on input-adaptive mechanisms , in particular , multi-exit architectures ( Teerapittayanon et al. , 2016 ; Huang et al. , 2018 ; Kaya et al. , 2019 ; Hu et al. , 2020 ) . Multi-exit architectures save computation by making input-specific decisions about bypassing the remaining layers , once the model becomes confident , and are orthogonal to techniques that achieve savings by permanently modifying the ∗Authors contributed equally . model ( Li et al. , 2016 ; Banner et al. , 2018 ; Han et al. , 2015 ; Taylor et al. , 2018 ) . Figure 1 illustrates how a multi-exit model ( Kaya et al. , 2019 ) , based on a standard VGG-16 architecture , correctly classifies a selection of test images from ‘ Tiny ImageNet ’ before the final layer . We see that more typical samples , which have more supporting examples in the training set , require less depth and , therefore , less computation . It is unknown if the computational savings provided by multi-exit architectures are robust against adversarial pressure . Prior research showed that DNNs are vulnerable to a wide range of attacks , which involve imperceptible input perturbations ( Szegedy et al. , 2014 ; Goodfellow et al. , 2015 ; Papernot et al. , 2016 ; Hu et al. , 2020 ) . Considering that a multi-exit model , on the worst-case input , does not provide any computational savings , we ask : Can the savings from multi-exit models be maliciously negated by input perturbations ? As some natural inputs do require the full depth of the model , it may be possible to craft adversarial examples that delay the correct decision ; it is unclear , however , how many inputs can be delayed with imperceptible perturbations . Furthermore , it is unknown if universal versions of these adversarial examples exist , if the examples transfer across multi-exit architectures and datasets , or if existing defenses ( e.g . adversarial training ) are effective against slowdown attacks . Threat Model . We consider a new threat against DNNs , analogous to the denial-of-service ( DoS ) attacks that have been plaguing the Internet for decades . By imperceptibly perturbing the input to trigger this worst-case , the adversary aims to slow down the inferences and increase the cost of using the DNN . This is an important threat for many practical applications , which impose strict limits on the responsiveness and resource usage of DNN models ( e.g . in the Internet-of-Things ( Taylor et al. , 2018 ) ) , because the adversary could push the victim outside these limits . For example , against a commercial image classification system , such as Clarifai.com , a slowdown attack might waste valuable computational resources . Against a model partitioning scheme , such as Big-Little ( De Coninck et al. , 2015 ) , it might introduce network latency by forcing excessive transmissions between local and remote models . A slowdown attack aims to force the victim to do more work than the adversary , e.g . by amplifying the latency needed to process the sample or by crafting reusable perturbations . The adversary may have to achieve this with incomplete information about the multi-exit architecture targeted , the training data used by the victim or the classification task ( see discussion in Appendix A ) . Our Contributions . To our best knowledge , we conduct the first study of the robustness of multi-exit architectures against adversarial slowdowns . To this end , we find that examples crafted by prior evasion attacks ( Madry et al. , 2017 ; Hu et al. , 2020 ) fail to bypass the victim model ’ s early exits , and we show that an adversary can adapt such attacks to the goal of model slowdown by modifying its objective function . We call the resulting attack DeepSloth . We also propose an efficacy metric for comparing slowdowns across different multi-exit architectures . We experiment with three generic multi-exit DNNs ( based on VGG16 , ResNet56 and MobileNet ) ( Kaya et al. , 2019 ) and a speciallydesigned multi-exit architecture , MSDNets ( Huang et al. , 2018 ) , on two popular image classification benchmarks ( CIFAR-10 and Tiny ImageNet ) . We find that DeepSloth reduces the efficacy of multiexit DNNs by 90–100 % , i.e. , the perturbations render nearly all early exits ineffective . In a scenario typical for IoT deployments , where the model is partitioned between edge devices and the cloud , our attack amplifies the latency by 1.5–5× , negating the benefits of model partitioning . We also show that it is possible to craft a universal DeepSloth perturbation , which can slow down the model on either all or a class of inputs . While more constrained , this attack still reduces the efficacy by 5–45 % . Further , we observe that DeepSloth can be effective in some black-box scenarios , where the attacker has limited knowledge about the victim . Finally , we show that a standard defense against adversarial samples—adversarial training—is inadequate against slowdowns . Our results suggest that further research will be required for protecting multi-exit architectures against this emerging security threat . 2 RELATED WORK . Adversarial Examples and Defenses . Prior work on adversarial examples has shown that DNNs are vulnerable to test-time input perturbations ( Szegedy et al. , 2014 ; Goodfellow et al. , 2015 ; Papernot et al. , 2017 ; Carlini & Wagner , 2017 ; Madry et al. , 2018 ) . An adversary who wants to maximize a model ’ s error on specific test-time samples can introduce human-imperceptible perturbations to these samples . Moreover , an adversary can also exploit a surrogate model for launching the attack and still hurt an unknown victim ( Athalye et al. , 2018 ; Tramèr et al. , 2017b ; Inkawhich et al. , 2019 ) . This transferability leads to adversarial examples in more practical black-box scenarios . Although many defenses ( Kurakin et al. , 2016 ; Xu et al. , 2017 ; Song et al. , 2018 ; Liao et al. , 2018 ; Lecuyer et al. , 2019 ) have been proposed against this threat , adversarial training ( AT ) has become the frontrunner ( Madry et al. , 2018 ) . In Sec 5 , we evaluate the vulnerability of multi-exit DNNs to adversarial slowdowns in white-box and black-box scenarios . In Sec 6 , we show that standard AT and its simple adaptation to our perturbations are not sufficient for preventing slowdown attacks . Efficient Input-Adaptive Inference . Recent input-adaptive DNN architectures have brought two seemingly distant goals closer : achieving both high predictive quality and computational efficiency . There are two types of input-adaptive DNNs : adaptive neural networks ( AdNNs ) and multi-exit architectures . During the inference , AdNNs ( Wang et al. , 2018 ; Figurnov et al. , 2017 ) dynamically skip a certain part of the model to reduce the number of computations . This mechanism can be used only for ResNet-based architectures as they facilitate skipping within a network . On the other hand , multi-exit architectures ( Teerapittayanon et al. , 2016 ; Huang et al. , 2018 ; Kaya et al. , 2019 ) introduce multiple side branches—or early-exits—to a model . During the inference on an input sample , these models can preemptively stop the computation altogether once the stopping criteria are met at one of the branches . Kaya et al . ( 2019 ) have also identified that standard , non-adaptive DNNs are susceptible to overthinking , i.e. , their inability to stop computation leads to inefficient inferences on many inputs . Haque et al . ( 2020 ) presented attacks specifically designed for reducing the energy-efficiency of AdNNs by using adversarial input perturbations . However , our work studies a new threat model that an adversary causes slowdowns on multi-exit architectures . By imperceptibly perturbing the inputs , our attacker can ( i ) introduce network latency to an infrastructure that utilizes multi-exit architectures and ( ii ) waste the victim ’ s computational resources . To quantify this vulnerability , we define a new metric to measure the impact of adversarial input perturbation on different multi-exit architectures ( Sec 3 ) . In Sec 5 , we also study practical attack scenarios and the transferability of adversarial input perturbations crafted by our attacker . Moreover , we discuss the potential defense mechanisms against this vulnerability , by proposing a simple adaptation of adversarial training ( Sec 6 ) . To the best of our knowledge , our work is the first systematic study of this new vulnerability . Model Partitioning . Model partitioning has been proposed to bring DNNs to resource-constrained devices ( De Coninck et al. , 2015 ; Taylor et al. , 2018 ) . These schemes split a multi-exit model into sequential components and deploy them in separate endpoints , e.g. , a small , local on-device part and a large , cloud-based part . For bringing DNNs to the Internet of Things ( IoT ) , partitioning is instrumental as it reduces the transmissions between endpoints , a major bottleneck . In Sec 5.1 , on a partitioning scenario , we show that our attack can force excessive transmissions . 3 EXPERIMENTAL SETUP . Datasets . We use two datasets : CIFAR-10 ( Krizhevsky et al. , 2009 ) and Tiny-ImageNet ( Tiny ) . For testing the cross-domain transferability of our attacks , we use the CIFAR-100 dataset . Architectures and Hyper-parameters . To demonstrate that the vulnerability to adversarial slowdowns is common among multi-exit architectures , we experiment on two recent techniques : ShallowDeep Networks ( SDNs ) ( Kaya et al. , 2019 ) and MSDNets ( Huang et al. , 2018 ) . These architectures were designed for different purposes : SDNs are generic and can convert any DNN into a multi-exit model , and MSDNets are custom designed for efficiency . We evaluate an MSDNet architecture ( 6 exits ) and three SDN architectures , based on VGG-16 ( Simonyan & Zisserman , 2014 ) ( 14 exits ) , ResNet-56 ( He et al. , 2016 ) ( 27 exits ) , and MobileNet ( Howard et al. , 2017 ) ( 14 exits ) . Metrics . We define the early-exit capability ( EEC ) curve of a multi-exit model to indicate the fraction of the test samples that exit early at a specific fraction of the model ’ s full inference cost . Figure 2 shows the EEC curves of our SDNs on Tiny ImageNet , assuming that the computation stops when there is a correct classification at an exit point . For example , VGG-16-based SDN model can correctly classify ∼50 % of the samples using ∼50 % of its full cost . Note that this stopping criterion is impractical ; in Sec 4 , we will discuss the practical ones . We define the early-exit efficacy , or efficacy in short , to quantify a model ’ s ability of utilizing its exit points . The efficacy of a multi-exit model is the area under its EEC curve , estimated via the trapezoidal rule . An ideal efficacy for a model is close to 1 , when most of the input samples the computation stops very early ; models that do not use their early exits have 0 efficacy . A model with low efficacy generally exhibits a higher latency ; in a partitioned model , the low efficacy will cause more input transmissions to the cloud , and the latency is further amplified by the network round trips . A multi-exit model ’ s efficacy and accuracy are dictated by its stopping criteria , which we discuss in the next section . As for the classification performance , we report the Top-1 accuracy on the test data .

Summary: This paper studies adversarial attack and defense for adaptive multi-exit network. Adaptive multi-exit network is, by itself, a pretty new and under-studied topic, let alone the adversarial study on top of it. This paper proposes a simple-yet-effective DeepSloth attack based on layerwise loss function. It also proposed an efficacy metric for better evaluation. The experiments are conducted on four multi-exit networks and two datasets: cifar10 and tiny imagenet. In the appendix, there is also evaluation on different norms of attacks. The results on white-box and black-box attack demonstrate the effectiveness: DeepSloth not only hurts the accuracy (also achieved by baselines), but also hurts the efficacy (only achieved by DeepSloth). To reduce the computation burden of performing the attack, the authors did two things: 1) model partitioning in scenario of IOT, and 2) universal attack across a dataset. At the end, the authors adapt AT to multi-exit networks and demonstrate that AT is effective in general and DeepSloth is further helping AT for better robustness.