TransSlowDown: Efficiency Attacks on Neural Machine Translation Systems

1 INTRODUCTION . Recently , Neural Machine Translation ( NMT ) systems have received massive attention from academia and industry ( Bahdanau et al. , 2015 ; Kalchbrenner et al. , 2016 ; Vaswani et al. , 2017 ; Belinkov & Bisk , 2018 ) . NMT systems overcome many weaknesses of traditional phrase-based translation models and can capture long dependencies in sentences ; thus , they are widely used in commercial translation systems . For example , Microsoft has deployed the NMT systems in many commercial products since 2016 ( Hassan Awadalla et al. , 2017 ; 2018a ; b ; Gu et al. , 2018 ) ; Google Translate claims to have translated over 100 billion words daily in 109 languages ( Turovsky , 2016 ; Caswell & Liang , 2020 ; Pitman , 2021 ) . For NMT systems , efficiency is critical because of translation applications ’ real-time demand ( Tu et al. , 2017 ; Guo et al. , 2019 ; Xia et al. , 2019 ) . However , it is unknown whether NMT systems are robust against efficiency-oriented adversarial pressure . Despite a rich set of works ( Cheng et al. , 2020 ; Jin et al. , 2020 ; Belinkov & Bisk , 2017 ; Cheng et al. , 2019 ; Wu et al. , 2018 ; Yang et al. , 2017 ) evaluate NMT systems ’ accuracy robustness through maximizing the errors , understanding the NMT systems ’ efficiency robustness has not received much attention . In order to study NMT systems ’ efficiency robustness , we first need to figure out what factors will affect NMT ’ s efficiency . In this paper , we observe a natural property of NMT systems , i.e. , , NMT ’ s computational consumption is volatile for different inputs because NMT systems invoke the underlying decoder with non-deterministic numbers of iterations to generate output tokens ( Vaswani et al. , 2017 ; Liu et al. , 2020 ) . This property exposes a new vulnerability of NMT systems , an adversary can design specific inputs to cause enormous computation overhead in NMT systems , thus wasting the computational resources of NMT systems . Based on such observation , in this paper , we investigate : Can adversary make slight modification on textual inputs to increase NMT systems ’ computational consumption and decrease NMT systems ’ efficiency ? If so , how severe the efficiency degradation can be ? New Vulnerability . We consider a new attack surface of NMT models , analogous to the vulnerabilities leading to the denial of service ( DoS ) attacks ( Zhang et al. , 2015 ; Qin et al. , 2018 ) that have plagued the security committee for decades . Specifically , the adversary ’ s goal is to decrease the victim NMT system ’ s efficiency ( i.e. , response latency , energy consumption ) with unnoticeable perturbations on the inputs to the system . This attack will result in devastating consequences for many real-world applications . For example , abusing computational resources on commercial machine translation service providers ( e.g. , Huggingface ( Wolf et al. , 2020 ) ) . An efficiency attack will cause enormous redundant computational resources and affect the service quality of benign users . Furthermore , abusing computational resources on mobile devices or IoT devices might shorten the battery charge cycle and result in the unavailability of the devices . New Attack . In this paper , we evaluate NMT systems ’ efficiency robustness by generating adversarial inputs that consume much greater amount of computation resources than normal inputs on NMT systems . Specifically , we propose TranSlowDown , which is based on the observation that the source of vulnerability is that NMT systems ’ efficiency is related to the output length instead of the input length . Specifically , NMT systems iteratively compute the output token until the systems generate the particular end of sentence ( EOS ) token . Thus , we design a novel algorithm to search for a minimal perturbation to delay the appearance of EOS . Specifically , TranSlowDown can generate both token-level and character-level perturbations . After applying the minimal perturbation on the benign sentences , the probability of EOS of output token will decrease , resulting longer output that costs NMT systems more computational resources . Evaluation . To evaluate the effectiveness of TranSlowDown , we use TranSlowDown to attack three public-available NMT systems ( i.e. , Google T5 ( Raffel et al. , 2019 ) , Facebook FairSeq ( Liu et al. , 2020 ) , and Helsinki-NLP ) , and compare TranSlowDown against two accuracy-based attack algorithms . We first measure the floating-point operations ( FLOPs ) and response latency of the victim NMT systems when translating benign and adversarial examples . Then , we apply I-FLOPs and I-Latency ( defined in Equation 4 ) to quantify the severity of efficiency degradation caused by generated adversarial examples . The evaluation results show : for the token-level attack , TranSlowDown generate adversarial examples increase victim NMT systems ’ FLOPs , CPU latency , GPU latency up to 2131.92 % , 2403.21 % , and 2054.83 % respectively with only perturbing two tokens in sentences ; for the character-level attack , TranSlowDown generated adversarial examples increase victim NMT systems ’ FLOPs , CPU latency , GPU latency up to 1102.86 % , 1232.71 % , and 1056.88 % respectively with only inserting three characters in sentences . We also form a real-world case study to demonstrate the negative impact of the efficiency threat . Specifically , we deploy Google ’ s T5 on a mobile device and investigate how adversarial examples affect the mobile device ’ s battery power consumption . The results show that by inserting only one character into the benign sentence , the adversarial examples generated by TranSlowDown can consume more than 30 times battery power than the original benign example . Our results suggest that further research is required for protecting NMT systems against this emerging security threat . 2 BACKGROUND & RELATED WORK . 2.1 NEURAL MACHINE TRANSLATION SYSTEMS . Neural machine translation ( NMT ) ( Vaswani et al. , 2017 ; Liu et al. , 2020 ) systems apply neural networks to approximate the conditional probability P ( Y |X ) , where X = [ x1 , x2 , · · · , xm ] is the source token sequences and Y = [ y1 , y2 , · · · , yn ] is the target token sequences . As shown in Figure 1 , a typical NMT system consists of an encoder fen ( · ) and a decoder fde ( · ) . The encoder encodes the source input X into hidden representation H , then the decoder starts from a special token ( SOS ) , and iteratively accesses H for an auto-regressive generation of each token yi until the end of sequence token ( EOS ) is reached . An important observation from the NMT working mechanisms is that NMT will iteratively running the decoder fde to generate a output token until EOS is reached . Thus , if the generated output sequence is longer , the NMT will consume more computational resources and becomes less efficient . In our example , the NMT system run the decoder four times to generate the output . 2.2 DNN ’ S EFFICIENCY Recently , the efficiency of deep neural networks ( DNNs ) has raised a huge concern because of their substantial inference-time computational costs . To reduce DNN ’ inference-time computational costs and make it feasible to applying DNNs for real-time applications , many existing work has been proposed . There are two main techniques : The first type ( Howard et al . ( 2017 ) ; Zhang et al . ( 2018 ) ) of the techniques prune the DNNs offline to identify important neurons and remove the unimportant neurons . After pruning , the smaller size DNNs could achieve competitive accuracy with the original DNNs but require less computational costs . Another type of techniques Wang et al . ( 2018 ) ; Graves ( 2016 ) ; Figurnov et al . ( 2017 ) , called input-adaptive techniques , this type of technique dynamically skip a certain part of the DNNs to reduce the number of computations in the inference time . By skipping some parts of the DNNs , the input-adaptive DNNs can balance the accuracy and computational costs . However , recent studies ( Haque et al. , 2020 ; Hong et al. , 2020 ) show input-adaptive DNNs are not robustness against the adversary attack , which implies the input-adaptive will not save computational costs under attacks . 2.3 ADVERSARIAL ATTACKS . Existing work on adversarial machine learning has shown that even the state-of-the-art DNNs can be fooled by adversarial examples ( Carlini & Wagner , 2017 ; Athalye et al. , 2018 ) . Adversarial examples are the elaborately crafted samples that apply human-unnoticeable perturbations on benign samples to maximize the target DNNs ’ errors . Based on prior knowledge about victim DNNs , the generation of adversarial examples could be categorized into white-box and black-box attacks . In the white-box settings ( Goodfellow et al. , 2014 ; Moosavi-Dezfooli et al. , 2016 ; Kurakin et al. , 2016 ; Carlini & Wagner , 2017 ; Jang et al. , 2017 ; Madry et al. , 2017 ; Chen et al. , 2018 ; Rony et al. , 2019 ) , the adversary know the victim DNNs ’ architecture and parameters and can compute gradients to generate adversarial examples . In the black-box settings ( Brendel et al. , 2017 ; Chen et al. , 2020 ; Brendel et al. , 2019 ) , the adversary can also exploit a surrogate model for launching the attack . 3 ATTACK METHODOLOGY . 3.1 THREAT MODEL . We consider an adversary who aims to decrease the efficacy of a victim NMT system . The attacker perturbs a benign sentence with unnoticeable perturbations to craft adversarial examples and feeds adversarial examples to the victim NMT . The perturbed adversarial examples will consume more computational resources of the victim NMT systems , thus impairing the translation service or make the service unavailable . Adversary ’ s Capabilities . The attacker is able to modify the victim ’ s input samples to apply the perturbations , e.g. , , By publishing some documents contain adversarial examples on the Internet . We follow existing work ( Cheng et al. , 2020 ; Belinkov & Bisk , 2017 ; Li et al. , 2018 ; Jin et al. , 2020 ) and consider two types of perturbations : ( i ) token-level perturbation and ( ii ) character-level perturbation . To ensure imperceptibility , we limit the perturbation size that the adversary can perturb the benign inputs . In Section 4 , we evaluate how different will affect the effectiveness of proposed attack . Adversary ’ s Knowledge . To assess the security vulnerability of existing NMT systems , we study white-box scenarios , i.e. , the attackers know the victim NMT systems architecture , parameters and the tokenizer that tokenize the word . In Section 4.4 , we study more practical black-box scenarios , i.e. , , the attacker leverage the transferability to generate adversarial examples and attack a victim NMT system without any prior knowledge about the victim . Adversary ’ s Goals . The adversary ’ s goal is to decrease the efficacy of a victim NMT system . As we discussed in Section 2 , NMT system ’ s efficacy is related to its ’ output length . A longer output length indicates the NMT system costs more computational resources and becomes less efficacy . Thus , the adversary can achieve their goal through increasing the NMT system ’ s output length . ∆ = argmaxδ Len ( F ( x+ δ ) ) s.t . ||δ|| ≤ ( 1 ) Finally , we formulate our problem of generating efficiency adversarial examples as an optimization problem . As shown in equation 1 , where x is the benign input , F is the target NMT system , is the maximum adversarial perturbation , and Len ( · ) measure the length of a output sequence . Our attack TranSlowDown tries to search a perturbation ∆ that maximize the output length ( decrease target NMT system F effiency ) while smaller than the allowed perturbation ( unnoticeable ) . 3.2 TRANSLOWDOWN ATTACK Algorithm 1 TranSlowDown Attack Input : Benign input x , victim NMT system F ( · ) , maximum perturbation Output : Adversarial examples x′ 1 : x′ ⇐ x Initialize x′ with x 2 : while ||x′ − x|| ≤ do 3 : for each tki ∈ x′ do 4 : Compute gi according to equation 2 5 : end for 6 : TK⇐ Sort ( tk1 , tk2 , · · · , tkm ) according to gi 7 : L = GeneratePerturbation ( TK , x′ , F ( · ) ) 8 : [ tk , ∆ ] = SelectBestPerturbation ( L , x′ , F ( · ) ) 9 : x′ ⇐ replace tk with ∆ in x′ 10 : end while 11 : return x′ Our attack algorithm is shown in Algorithm 1 , which iteratively performs the following three main steps : ( i ) find important tokens , ( ii ) generate possible perturbation , and ( iii ) select optimal perturbation , until the generated adversarial examples reach the maximum perturbation . Find Important Tokens ( line 3 to 6 ) : Given a benign input x = [ tk1 , · · · , tkm ] , the first step is to find each tokens importance to NMT systems ’ efficiency . As we discussed in Section 2 , NMT systems ’ efficiency is related to its ’ output length , and the output length is determined by the probability of EOS tokens . Then our objective is to decrease the probability of the EOS token to reduce NMT ’ s efficiency . Formally , let NMT system ’ s output probability be a sequence of vectors , i.e. , F ( x ) = [ p1 , p2 , · · · , pn ] . Then the probability of EOS tokens are [ peos1 , p eos 2 , · · · , peosn ] . We seek to find the importance of each token tki in x to this probability sequence . We also observe that the output token sequence will affect EOS ’ s probability . Thus , we define the importance score of token tki as gi , shown in equation 2. oi = argmax ( pi ) f ( x ) = 1 n n∑ i ( peosi + p oi i ) gi = ∑ j ∂f ( x ) ∂tkji ( 2 ) Where [ o1 , o2 , · · · , on ] is the current output token , f ( x ) is the probability we seek to minimize , tkji is the jth dimension of tk ’ s embeddings , and gi is the derivative of f ( x ) to ith token ’ s embedding . Adversarial Perturbation Generation ( line 7 ) : After identifying important tokens , the next step is to mutate the important token with unnoticeable perturbations . In this step , we get a set of perturbation candidate L after we perturbing the most important tokens in the original input . Following existing work , we consider two kinds of perturbations , i.e. , , token-level perturbation and characterlevel perturbation . Table 1 shows some example of token-level and character-level perturbation under different perturbation size , we color the perturbation with color red . Isrc , tgt = ∑ j ( E ( tgt ) − E ( src ) ) × ∂f ( x ) ∂tkji δ = argmaxtgt Itk , tgt ; ( 3 ) For token-level perturbation , we consider replacing the original token tk with another token δ . To compute the target token δ , we define token replace increment Isrc , tgt to measure the efficiency degradation of replacing token src to tgt . As shown in equation 3 , E ( · ) is the function to get corresponding token ’ s embedding , E ( tgt ) − E ( src ) is the vector increment in embedding space . Because ∂f ( x ) ∂tkji indicate the sensitive of output length to each embedding dimension , Isrc , tgt repre- sent the total benefits of replacing token src with tgt . We search the target token δ in the vocabulary to maximize the token replace increment with the source token tk . For character-level perturbation , we consider character insert perturbation . Specifically , we insert one character c into token tk to get another token δ . The character-inset perturbation is common in the real world when typing quickly and is unnoticeable without careful examination . Because character insertion is likely to result in out-of-vocabulary ( OOV ) , thus it is challenging to compute the token replace increment as token-level . Instead , we enumerate possible δ after character insertion to get candidate set L. Specifically , we consider all letters and digits as the possible character c because humans can type these tokens through the keyboard , and we consider all positions the possible insertion position . Then for token tk , which contains l characters , there are ( l + 1 ) × ||C|| perturbation candidates , where ||C|| is the size of all possible characters . Select Best Perturbation ( line 8 to 9 ) : After collecting candidate perturbations L , we select an optimal perturbation from the collected candidate sets . As our objective is searching adversarial perturbation that will produce longer output length , thus , we try all adversarial perturbation and select the optimal perturbation that produce the maximum output length .

Summary: This paper focuses on the efficiency of neural machine translation (NMT) systems, proposing a novel attack approach to test the efficiency robustness. The attack approach can be divided into three parts: 1) find the most relevant tokens of inference efficiency; 2) generate adversarial perturbations for the found tokens; and 3) select the most influenced perturbations. Experimental results on three publicly released NMT systems show the attack approach can significantly decrease NMT efficiency.