A Panda? No, It's a Sloth: Slowdown Attacks on Adaptive Multi-Exit Neural Network Inference

1 INTRODUCTION . The inference-time computational demands of deep neural networks ( DNNs ) are increasing , owing to the “ going deeper '' ( Szegedy et al. , 2015 ) strategy for improving accuracy : as a DNN gets deeper , it progressively gains the ability to learn higher-level , complex representations . This strategy has enabled breakthroughs in many tasks , such as image classification ( Krizhevsky et al. , 2012 ) or speech recognition ( Hinton et al. , 2012 ) , at the price of costly inferences . For instance , with 4× more inference cost , a 56-layer ResNet ( He et al. , 2016 ) improved the Top-1 accuracy on ImageNet by 19 % over the 8-layer AlexNet . This trend continued with the 57-layer state-of-the-art EfficientNet ( Tan & Le , 2019 ) : it improved the accuracy by 10 % over ResNet , with 9× costlier inferences . The accuracy improvements stem from the fact that the deeper networks fix the mistakes of the shallow ones ( Huang et al. , 2018 ) . This implies that some samples , which are already correctly classified by shallow networks , do not necessitate the extra complexity . This observation has motivated research on input-adaptive mechanisms , in particular , multi-exit architectures ( Teerapittayanon et al. , 2016 ; Huang et al. , 2018 ; Kaya et al. , 2019 ; Hu et al. , 2020 ) . Multi-exit architectures save computation by making input-specific decisions about bypassing the remaining layers , once the model becomes confident , and are orthogonal to techniques that achieve savings by permanently modifying the ∗Authors contributed equally . model ( Li et al. , 2016 ; Banner et al. , 2018 ; Han et al. , 2015 ; Taylor et al. , 2018 ) . Figure 1 illustrates how a multi-exit model ( Kaya et al. , 2019 ) , based on a standard VGG-16 architecture , correctly classifies a selection of test images from ‘ Tiny ImageNet ’ before the final layer . We see that more typical samples , which have more supporting examples in the training set , require less depth and , therefore , less computation . It is unknown if the computational savings provided by multi-exit architectures are robust against adversarial pressure . Prior research showed that DNNs are vulnerable to a wide range of attacks , which involve imperceptible input perturbations ( Szegedy et al. , 2014 ; Goodfellow et al. , 2015 ; Papernot et al. , 2016 ; Hu et al. , 2020 ) . Considering that a multi-exit model , on the worst-case input , does not provide any computational savings , we ask : Can the savings from multi-exit models be maliciously negated by input perturbations ? As some natural inputs do require the full depth of the model , it may be possible to craft adversarial examples that delay the correct decision ; it is unclear , however , how many inputs can be delayed with imperceptible perturbations . Furthermore , it is unknown if universal versions of these adversarial examples exist , if the examples transfer across multi-exit architectures and datasets , or if existing defenses ( e.g . adversarial training ) are effective against slowdown attacks . Threat Model . We consider a new threat against DNNs , analogous to the denial-of-service ( DoS ) attacks that have been plaguing the Internet for decades . By imperceptibly perturbing the input to trigger this worst-case , the adversary aims to slow down the inferences and increase the cost of using the DNN . This is an important threat for many practical applications , which impose strict limits on the responsiveness and resource usage of DNN models ( e.g . in the Internet-of-Things ( Taylor et al. , 2018 ) ) , because the adversary could push the victim outside these limits . For example , against a commercial image classification system , such as Clarifai.com , a slowdown attack might waste valuable computational resources . Against a model partitioning scheme , such as Big-Little ( De Coninck et al. , 2015 ) , it might introduce network latency by forcing excessive transmissions between local and remote models . A slowdown attack aims to force the victim to do more work than the adversary , e.g . by amplifying the latency needed to process the sample or by crafting reusable perturbations . The adversary may have to achieve this with incomplete information about the multi-exit architecture targeted , the training data used by the victim or the classification task ( see discussion in Appendix A ) . Our Contributions . To our best knowledge , we conduct the first study of the robustness of multi-exit architectures against adversarial slowdowns . To this end , we find that examples crafted by prior evasion attacks ( Madry et al. , 2017 ; Hu et al. , 2020 ) fail to bypass the victim model ’ s early exits , and we show that an adversary can adapt such attacks to the goal of model slowdown by modifying its objective function . We call the resulting attack DeepSloth . We also propose an efficacy metric for comparing slowdowns across different multi-exit architectures . We experiment with three generic multi-exit DNNs ( based on VGG16 , ResNet56 and MobileNet ) ( Kaya et al. , 2019 ) and a speciallydesigned multi-exit architecture , MSDNets ( Huang et al. , 2018 ) , on two popular image classification benchmarks ( CIFAR-10 and Tiny ImageNet ) . We find that DeepSloth reduces the efficacy of multiexit DNNs by 90–100 % , i.e. , the perturbations render nearly all early exits ineffective . In a scenario typical for IoT deployments , where the model is partitioned between edge devices and the cloud , our attack amplifies the latency by 1.5–5× , negating the benefits of model partitioning . We also show that it is possible to craft a universal DeepSloth perturbation , which can slow down the model on either all or a class of inputs . While more constrained , this attack still reduces the efficacy by 5–45 % . Further , we observe that DeepSloth can be effective in some black-box scenarios , where the attacker has limited knowledge about the victim . Finally , we show that a standard defense against adversarial samples—adversarial training—is inadequate against slowdowns . Our results suggest that further research will be required for protecting multi-exit architectures against this emerging security threat . 2 RELATED WORK . Adversarial Examples and Defenses . Prior work on adversarial examples has shown that DNNs are vulnerable to test-time input perturbations ( Szegedy et al. , 2014 ; Goodfellow et al. , 2015 ; Papernot et al. , 2017 ; Carlini & Wagner , 2017 ; Madry et al. , 2018 ) . An adversary who wants to maximize a model ’ s error on specific test-time samples can introduce human-imperceptible perturbations to these samples . Moreover , an adversary can also exploit a surrogate model for launching the attack and still hurt an unknown victim ( Athalye et al. , 2018 ; Tramèr et al. , 2017b ; Inkawhich et al. , 2019 ) . This transferability leads to adversarial examples in more practical black-box scenarios . Although many defenses ( Kurakin et al. , 2016 ; Xu et al. , 2017 ; Song et al. , 2018 ; Liao et al. , 2018 ; Lecuyer et al. , 2019 ) have been proposed against this threat , adversarial training ( AT ) has become the frontrunner ( Madry et al. , 2018 ) . In Sec 5 , we evaluate the vulnerability of multi-exit DNNs to adversarial slowdowns in white-box and black-box scenarios . In Sec 6 , we show that standard AT and its simple adaptation to our perturbations are not sufficient for preventing slowdown attacks . Efficient Input-Adaptive Inference . Recent input-adaptive DNN architectures have brought two seemingly distant goals closer : achieving both high predictive quality and computational efficiency . There are two types of input-adaptive DNNs : adaptive neural networks ( AdNNs ) and multi-exit architectures . During the inference , AdNNs ( Wang et al. , 2018 ; Figurnov et al. , 2017 ) dynamically skip a certain part of the model to reduce the number of computations . This mechanism can be used only for ResNet-based architectures as they facilitate skipping within a network . On the other hand , multi-exit architectures ( Teerapittayanon et al. , 2016 ; Huang et al. , 2018 ; Kaya et al. , 2019 ) introduce multiple side branches—or early-exits—to a model . During the inference on an input sample , these models can preemptively stop the computation altogether once the stopping criteria are met at one of the branches . Kaya et al . ( 2019 ) have also identified that standard , non-adaptive DNNs are susceptible to overthinking , i.e. , their inability to stop computation leads to inefficient inferences on many inputs . Haque et al . ( 2020 ) presented attacks specifically designed for reducing the energy-efficiency of AdNNs by using adversarial input perturbations . However , our work studies a new threat model that an adversary causes slowdowns on multi-exit architectures . By imperceptibly perturbing the inputs , our attacker can ( i ) introduce network latency to an infrastructure that utilizes multi-exit architectures and ( ii ) waste the victim ’ s computational resources . To quantify this vulnerability , we define a new metric to measure the impact of adversarial input perturbation on different multi-exit architectures ( Sec 3 ) . In Sec 5 , we also study practical attack scenarios and the transferability of adversarial input perturbations crafted by our attacker . Moreover , we discuss the potential defense mechanisms against this vulnerability , by proposing a simple adaptation of adversarial training ( Sec 6 ) . To the best of our knowledge , our work is the first systematic study of this new vulnerability . Model Partitioning . Model partitioning has been proposed to bring DNNs to resource-constrained devices ( De Coninck et al. , 2015 ; Taylor et al. , 2018 ) . These schemes split a multi-exit model into sequential components and deploy them in separate endpoints , e.g. , a small , local on-device part and a large , cloud-based part . For bringing DNNs to the Internet of Things ( IoT ) , partitioning is instrumental as it reduces the transmissions between endpoints , a major bottleneck . In Sec 5.1 , on a partitioning scenario , we show that our attack can force excessive transmissions . 3 EXPERIMENTAL SETUP . Datasets . We use two datasets : CIFAR-10 ( Krizhevsky et al. , 2009 ) and Tiny-ImageNet ( Tiny ) . For testing the cross-domain transferability of our attacks , we use the CIFAR-100 dataset . Architectures and Hyper-parameters . To demonstrate that the vulnerability to adversarial slowdowns is common among multi-exit architectures , we experiment on two recent techniques : ShallowDeep Networks ( SDNs ) ( Kaya et al. , 2019 ) and MSDNets ( Huang et al. , 2018 ) . These architectures were designed for different purposes : SDNs are generic and can convert any DNN into a multi-exit model , and MSDNets are custom designed for efficiency . We evaluate an MSDNet architecture ( 6 exits ) and three SDN architectures , based on VGG-16 ( Simonyan & Zisserman , 2014 ) ( 14 exits ) , ResNet-56 ( He et al. , 2016 ) ( 27 exits ) , and MobileNet ( Howard et al. , 2017 ) ( 14 exits ) . Metrics . We define the early-exit capability ( EEC ) curve of a multi-exit model to indicate the fraction of the test samples that exit early at a specific fraction of the model ’ s full inference cost . Figure 2 shows the EEC curves of our SDNs on Tiny ImageNet , assuming that the computation stops when there is a correct classification at an exit point . For example , VGG-16-based SDN model can correctly classify ∼50 % of the samples using ∼50 % of its full cost . Note that this stopping criterion is impractical ; in Sec 4 , we will discuss the practical ones . We define the early-exit efficacy , or efficacy in short , to quantify a model ’ s ability of utilizing its exit points . The efficacy of a multi-exit model is the area under its EEC curve , estimated via the trapezoidal rule . An ideal efficacy for a model is close to 1 , when most of the input samples the computation stops very early ; models that do not use their early exits have 0 efficacy . A model with low efficacy generally exhibits a higher latency ; in a partitioned model , the low efficacy will cause more input transmissions to the cloud , and the latency is further amplified by the network round trips . A multi-exit model ’ s efficacy and accuracy are dictated by its stopping criteria , which we discuss in the next section . As for the classification performance , we report the Top-1 accuracy on the test data .

Summary: This paper studies a new category of adversarial attacks, i.e., attackers that try to slow-down multi-exit DNNs using adversarial examples. The paper extended adversarial attacks to perform the slow-down attack and showed that the attacks could slow-down multi-exit DNNs by 1.5x - 5.0x. Additionally, the paper experimentally answers many questions such as (1) the effectiveness of adversarial training against the attack, (2) input-agnostic attack, and (3) cross-architecture/domain transferability.