TransSlowDown: Efficiency Attacks on Neural Machine Translation Systems

1 INTRODUCTION . Recently , Neural Machine Translation ( NMT ) systems have received massive attention from academia and industry ( Bahdanau et al. , 2015 ; Kalchbrenner et al. , 2016 ; Vaswani et al. , 2017 ; Belinkov & Bisk , 2018 ) . NMT systems overcome many weaknesses of traditional phrase-based translation models and can capture long dependencies in sentences ; thus , they are widely used in commercial translation systems . For example , Microsoft has deployed the NMT systems in many commercial products since 2016 ( Hassan Awadalla et al. , 2017 ; 2018a ; b ; Gu et al. , 2018 ) ; Google Translate claims to have translated over 100 billion words daily in 109 languages ( Turovsky , 2016 ; Caswell & Liang , 2020 ; Pitman , 2021 ) . For NMT systems , efficiency is critical because of translation applications ’ real-time demand ( Tu et al. , 2017 ; Guo et al. , 2019 ; Xia et al. , 2019 ) . However , it is unknown whether NMT systems are robust against efficiency-oriented adversarial pressure . Despite a rich set of works ( Cheng et al. , 2020 ; Jin et al. , 2020 ; Belinkov & Bisk , 2017 ; Cheng et al. , 2019 ; Wu et al. , 2018 ; Yang et al. , 2017 ) evaluate NMT systems ’ accuracy robustness through maximizing the errors , understanding the NMT systems ’ efficiency robustness has not received much attention . In order to study NMT systems ’ efficiency robustness , we first need to figure out what factors will affect NMT ’ s efficiency . In this paper , we observe a natural property of NMT systems , i.e. , , NMT ’ s computational consumption is volatile for different inputs because NMT systems invoke the underlying decoder with non-deterministic numbers of iterations to generate output tokens ( Vaswani et al. , 2017 ; Liu et al. , 2020 ) . This property exposes a new vulnerability of NMT systems , an adversary can design specific inputs to cause enormous computation overhead in NMT systems , thus wasting the computational resources of NMT systems . Based on such observation , in this paper , we investigate : Can adversary make slight modification on textual inputs to increase NMT systems ’ computational consumption and decrease NMT systems ’ efficiency ? If so , how severe the efficiency degradation can be ? New Vulnerability . We consider a new attack surface of NMT models , analogous to the vulnerabilities leading to the denial of service ( DoS ) attacks ( Zhang et al. , 2015 ; Qin et al. , 2018 ) that have plagued the security committee for decades . Specifically , the adversary ’ s goal is to decrease the victim NMT system ’ s efficiency ( i.e. , response latency , energy consumption ) with unnoticeable perturbations on the inputs to the system . This attack will result in devastating consequences for many real-world applications . For example , abusing computational resources on commercial machine translation service providers ( e.g. , Huggingface ( Wolf et al. , 2020 ) ) . An efficiency attack will cause enormous redundant computational resources and affect the service quality of benign users . Furthermore , abusing computational resources on mobile devices or IoT devices might shorten the battery charge cycle and result in the unavailability of the devices . New Attack . In this paper , we evaluate NMT systems ’ efficiency robustness by generating adversarial inputs that consume much greater amount of computation resources than normal inputs on NMT systems . Specifically , we propose TranSlowDown , which is based on the observation that the source of vulnerability is that NMT systems ’ efficiency is related to the output length instead of the input length . Specifically , NMT systems iteratively compute the output token until the systems generate the particular end of sentence ( EOS ) token . Thus , we design a novel algorithm to search for a minimal perturbation to delay the appearance of EOS . Specifically , TranSlowDown can generate both token-level and character-level perturbations . After applying the minimal perturbation on the benign sentences , the probability of EOS of output token will decrease , resulting longer output that costs NMT systems more computational resources . Evaluation . To evaluate the effectiveness of TranSlowDown , we use TranSlowDown to attack three public-available NMT systems ( i.e. , Google T5 ( Raffel et al. , 2019 ) , Facebook FairSeq ( Liu et al. , 2020 ) , and Helsinki-NLP ) , and compare TranSlowDown against two accuracy-based attack algorithms . We first measure the floating-point operations ( FLOPs ) and response latency of the victim NMT systems when translating benign and adversarial examples . Then , we apply I-FLOPs and I-Latency ( defined in Equation 4 ) to quantify the severity of efficiency degradation caused by generated adversarial examples . The evaluation results show : for the token-level attack , TranSlowDown generate adversarial examples increase victim NMT systems ’ FLOPs , CPU latency , GPU latency up to 2131.92 % , 2403.21 % , and 2054.83 % respectively with only perturbing two tokens in sentences ; for the character-level attack , TranSlowDown generated adversarial examples increase victim NMT systems ’ FLOPs , CPU latency , GPU latency up to 1102.86 % , 1232.71 % , and 1056.88 % respectively with only inserting three characters in sentences . We also form a real-world case study to demonstrate the negative impact of the efficiency threat . Specifically , we deploy Google ’ s T5 on a mobile device and investigate how adversarial examples affect the mobile device ’ s battery power consumption . The results show that by inserting only one character into the benign sentence , the adversarial examples generated by TranSlowDown can consume more than 30 times battery power than the original benign example . Our results suggest that further research is required for protecting NMT systems against this emerging security threat . 2 BACKGROUND & RELATED WORK . 2.1 NEURAL MACHINE TRANSLATION SYSTEMS . Neural machine translation ( NMT ) ( Vaswani et al. , 2017 ; Liu et al. , 2020 ) systems apply neural networks to approximate the conditional probability P ( Y |X ) , where X = [ x1 , x2 , · · · , xm ] is the source token sequences and Y = [ y1 , y2 , · · · , yn ] is the target token sequences . As shown in Figure 1 , a typical NMT system consists of an encoder fen ( · ) and a decoder fde ( · ) . The encoder encodes the source input X into hidden representation H , then the decoder starts from a special token ( SOS ) , and iteratively accesses H for an auto-regressive generation of each token yi until the end of sequence token ( EOS ) is reached . An important observation from the NMT working mechanisms is that NMT will iteratively running the decoder fde to generate a output token until EOS is reached . Thus , if the generated output sequence is longer , the NMT will consume more computational resources and becomes less efficient . In our example , the NMT system run the decoder four times to generate the output . 2.2 DNN ’ S EFFICIENCY Recently , the efficiency of deep neural networks ( DNNs ) has raised a huge concern because of their substantial inference-time computational costs . To reduce DNN ’ inference-time computational costs and make it feasible to applying DNNs for real-time applications , many existing work has been proposed . There are two main techniques : The first type ( Howard et al . ( 2017 ) ; Zhang et al . ( 2018 ) ) of the techniques prune the DNNs offline to identify important neurons and remove the unimportant neurons . After pruning , the smaller size DNNs could achieve competitive accuracy with the original DNNs but require less computational costs . Another type of techniques Wang et al . ( 2018 ) ; Graves ( 2016 ) ; Figurnov et al . ( 2017 ) , called input-adaptive techniques , this type of technique dynamically skip a certain part of the DNNs to reduce the number of computations in the inference time . By skipping some parts of the DNNs , the input-adaptive DNNs can balance the accuracy and computational costs . However , recent studies ( Haque et al. , 2020 ; Hong et al. , 2020 ) show input-adaptive DNNs are not robustness against the adversary attack , which implies the input-adaptive will not save computational costs under attacks . 2.3 ADVERSARIAL ATTACKS . Existing work on adversarial machine learning has shown that even the state-of-the-art DNNs can be fooled by adversarial examples ( Carlini & Wagner , 2017 ; Athalye et al. , 2018 ) . Adversarial examples are the elaborately crafted samples that apply human-unnoticeable perturbations on benign samples to maximize the target DNNs ’ errors . Based on prior knowledge about victim DNNs , the generation of adversarial examples could be categorized into white-box and black-box attacks . In the white-box settings ( Goodfellow et al. , 2014 ; Moosavi-Dezfooli et al. , 2016 ; Kurakin et al. , 2016 ; Carlini & Wagner , 2017 ; Jang et al. , 2017 ; Madry et al. , 2017 ; Chen et al. , 2018 ; Rony et al. , 2019 ) , the adversary know the victim DNNs ’ architecture and parameters and can compute gradients to generate adversarial examples . In the black-box settings ( Brendel et al. , 2017 ; Chen et al. , 2020 ; Brendel et al. , 2019 ) , the adversary can also exploit a surrogate model for launching the attack . 3 ATTACK METHODOLOGY . 3.1 THREAT MODEL . We consider an adversary who aims to decrease the efficacy of a victim NMT system . The attacker perturbs a benign sentence with unnoticeable perturbations to craft adversarial examples and feeds adversarial examples to the victim NMT . The perturbed adversarial examples will consume more computational resources of the victim NMT systems , thus impairing the translation service or make the service unavailable . Adversary ’ s Capabilities . The attacker is able to modify the victim ’ s input samples to apply the perturbations , e.g. , , By publishing some documents contain adversarial examples on the Internet . We follow existing work ( Cheng et al. , 2020 ; Belinkov & Bisk , 2017 ; Li et al. , 2018 ; Jin et al. , 2020 ) and consider two types of perturbations : ( i ) token-level perturbation and ( ii ) character-level perturbation . To ensure imperceptibility , we limit the perturbation size that the adversary can perturb the benign inputs . In Section 4 , we evaluate how different will affect the effectiveness of proposed attack . Adversary ’ s Knowledge . To assess the security vulnerability of existing NMT systems , we study white-box scenarios , i.e. , the attackers know the victim NMT systems architecture , parameters and the tokenizer that tokenize the word . In Section 4.4 , we study more practical black-box scenarios , i.e. , , the attacker leverage the transferability to generate adversarial examples and attack a victim NMT system without any prior knowledge about the victim . Adversary ’ s Goals . The adversary ’ s goal is to decrease the efficacy of a victim NMT system . As we discussed in Section 2 , NMT system ’ s efficacy is related to its ’ output length . A longer output length indicates the NMT system costs more computational resources and becomes less efficacy . Thus , the adversary can achieve their goal through increasing the NMT system ’ s output length . ∆ = argmaxδ Len ( F ( x+ δ ) ) s.t . ||δ|| ≤ ( 1 ) Finally , we formulate our problem of generating efficiency adversarial examples as an optimization problem . As shown in equation 1 , where x is the benign input , F is the target NMT system , is the maximum adversarial perturbation , and Len ( · ) measure the length of a output sequence . Our attack TranSlowDown tries to search a perturbation ∆ that maximize the output length ( decrease target NMT system F effiency ) while smaller than the allowed perturbation ( unnoticeable ) . 3.2 TRANSLOWDOWN ATTACK Algorithm 1 TranSlowDown Attack Input : Benign input x , victim NMT system F ( · ) , maximum perturbation Output : Adversarial examples x′ 1 : x′ ⇐ x Initialize x′ with x 2 : while ||x′ − x|| ≤ do 3 : for each tki ∈ x′ do 4 : Compute gi according to equation 2 5 : end for 6 : TK⇐ Sort ( tk1 , tk2 , · · · , tkm ) according to gi 7 : L = GeneratePerturbation ( TK , x′ , F ( · ) ) 8 : [ tk , ∆ ] = SelectBestPerturbation ( L , x′ , F ( · ) ) 9 : x′ ⇐ replace tk with ∆ in x′ 10 : end while 11 : return x′ Our attack algorithm is shown in Algorithm 1 , which iteratively performs the following three main steps : ( i ) find important tokens , ( ii ) generate possible perturbation , and ( iii ) select optimal perturbation , until the generated adversarial examples reach the maximum perturbation . Find Important Tokens ( line 3 to 6 ) : Given a benign input x = [ tk1 , · · · , tkm ] , the first step is to find each tokens importance to NMT systems ’ efficiency . As we discussed in Section 2 , NMT systems ’ efficiency is related to its ’ output length , and the output length is determined by the probability of EOS tokens . Then our objective is to decrease the probability of the EOS token to reduce NMT ’ s efficiency . Formally , let NMT system ’ s output probability be a sequence of vectors , i.e. , F ( x ) = [ p1 , p2 , · · · , pn ] . Then the probability of EOS tokens are [ peos1 , p eos 2 , · · · , peosn ] . We seek to find the importance of each token tki in x to this probability sequence . We also observe that the output token sequence will affect EOS ’ s probability . Thus , we define the importance score of token tki as gi , shown in equation 2. oi = argmax ( pi ) f ( x ) = 1 n n∑ i ( peosi + p oi i ) gi = ∑ j ∂f ( x ) ∂tkji ( 2 ) Where [ o1 , o2 , · · · , on ] is the current output token , f ( x ) is the probability we seek to minimize , tkji is the jth dimension of tk ’ s embeddings , and gi is the derivative of f ( x ) to ith token ’ s embedding . Adversarial Perturbation Generation ( line 7 ) : After identifying important tokens , the next step is to mutate the important token with unnoticeable perturbations . In this step , we get a set of perturbation candidate L after we perturbing the most important tokens in the original input . Following existing work , we consider two kinds of perturbations , i.e. , , token-level perturbation and characterlevel perturbation . Table 1 shows some example of token-level and character-level perturbation under different perturbation size , we color the perturbation with color red . Isrc , tgt = ∑ j ( E ( tgt ) − E ( src ) ) × ∂f ( x ) ∂tkji δ = argmaxtgt Itk , tgt ; ( 3 ) For token-level perturbation , we consider replacing the original token tk with another token δ . To compute the target token δ , we define token replace increment Isrc , tgt to measure the efficiency degradation of replacing token src to tgt . As shown in equation 3 , E ( · ) is the function to get corresponding token ’ s embedding , E ( tgt ) − E ( src ) is the vector increment in embedding space . Because ∂f ( x ) ∂tkji indicate the sensitive of output length to each embedding dimension , Isrc , tgt repre- sent the total benefits of replacing token src with tgt . We search the target token δ in the vocabulary to maximize the token replace increment with the source token tk . For character-level perturbation , we consider character insert perturbation . Specifically , we insert one character c into token tk to get another token δ . The character-inset perturbation is common in the real world when typing quickly and is unnoticeable without careful examination . Because character insertion is likely to result in out-of-vocabulary ( OOV ) , thus it is challenging to compute the token replace increment as token-level . Instead , we enumerate possible δ after character insertion to get candidate set L. Specifically , we consider all letters and digits as the possible character c because humans can type these tokens through the keyboard , and we consider all positions the possible insertion position . Then for token tk , which contains l characters , there are ( l + 1 ) × ||C|| perturbation candidates , where ||C|| is the size of all possible characters . Select Best Perturbation ( line 8 to 9 ) : After collecting candidate perturbations L , we select an optimal perturbation from the collected candidate sets . As our objective is searching adversarial perturbation that will produce longer output length , thus , we try all adversarial perturbation and select the optimal perturbation that produce the maximum output length .

Summary: TransSlowDown is an attack scheme that aims to targets the computational resources of NMT systems. The authors show that small modifications to benign input sentences can significantly increase the computation NMT needs to process the input, paving the way for denial-of-service attacks on translation services or attacks on the battery power of mobile devices. TransSlowDown is a white box technique that makes use of gradients of the target NMT system, but can also be adapted to a more practical block box technique where gradients from another NMT system are used.