Dynamic Neural Network is All You Need: Understanding the Robustness of Dynamic Mechanisms in Neural Networks
Authors: Mirazul Haque
Wei Yang
Venue: Submitted to ICLR 2023 (2023)

Abstract: Deep Neural Networks (DNN) based solutions are being used to solve different day-to-day problems. Recently, DNNs are being deployed in real-time systems, and lowering the energy consumption and response time has become the need of the hour. To address this scenario, researchers have proposed early-exit Dynamic Neural Networks (DyNNs), where the computation is dynamic based on the input complexity. DyNNs are generally designed and based on larger static DNNs (SDNN). As the DyNNs decrease the energy consumption, it also becomes important to evaluate the robustness of DyNNs to ensure safety. However, there has not been a significant number of works focusing on the robustness of DyNNs. To address this issue, we propose systematic studies to evaluate the robustness of DyNNs. For that purpose, we propose four research questions. These studies are performed on three models and two datasets. Through the studies, we find that DyNNs are more robust than SDNNs, and DyNNs can be used to generate adversarial samples efficiently. We also provide insight into the design choices through research studies. Finally, we propose a novel attack that can decrease the effectiveness of the DyNNs and can be used to evaluate design choices in DyNN.

Under review as a conference paper at ICLR 2023
DYNAMIC NEURAL NETWORK IS ALL YOU NEED: UNDERSTANDING THE ROBUSTNESS OF DYNAMIC MECHANISMS IN NEURAL NETWORKS
Anonymous authors
Paper under double-blind review
ABSTRACT
Deep Neural Networks (DNNs) have been used solve different day-to-day prob- lems. Recently, DNNs have been deployed in real-time systems, and lowering the energy consumption and response time has become the need of the hour. To ad- dress this scenario, researchers have proposed incorporating dynamic mechanism to static DNNs (SDNN) create Dynamic Neural Networks (DyNNs) perform- ing dynamic amount of computation based on the input complexity. Although incorporating dynamic mechanism into SDNNs would be preferable in real-time systems, it also becomes important to evaluate how the introduction of dynamic mechanism impacts the robustness of the models. However, there has not been a significant number of works focusing on the robustness trade-off between SDNNs and DyNNs. To address this issue, we propose to investigate four aspects of in- cluding dynamic mechanism into SDNNs. For that purpose, evaluate four research questions. These evaluations are performed on three models and two datasets. Through the studies, we find that attack transferability from DyNNs SDNNs is higher than attack transferability from SDNNs to DyNNs. Also, we find that DyNNs can be used to generate adversarial samples more efficiently than SDNNs. We also provide insight into the design choices through research stud- ies. Finally, we propose novel attack understand the additional attack surface introduced by the dynamic mechanism.
INTRODUCTION
Deep Neural Networks (DNNs) used in multiple applications such computer vision and nat- ural language processing. After the rapid growth of loT and embedded devices, many real-time systems use DNNs in their applications. As the real-time systems require faster response time and low energy consumption, researchers have proposed to incorporate energy-saving dynamic mecha- nism (Wang et al. 2018 Kaya al. (2099) Wu et al.) (2018) to popular static DNN (SDNN) models like ResNet (He et al. 2015). VGG (Simonyan & Zisserman 2014), MobileNet (Howard et al.) 2017) etc. Early-exit is one the dynamic mechanism techniques where multiple exits are included in SDNNs (creating multiple sub-networks), and SDNNs can terminate the operation early if a cer- tain sub-network confident about the prediction. These types of DNNs are named as early-exit Dynamic Neural Networks (DyNNs). Although the transition from SDNNs to DyNNs is preferred real time systems because increased efficiency, whether the use of dynamic mechanism will impact the robustness of the systems is still unknown. Studying the impact of the dynamic mech- anisms on the robustness is important for developers or users to understand the trade-offs between DyNN and SDNN.
In this work, we propose to investigate four different aspects of including dynamic mechanism through four research questions. These four aspects are: Transferability, Impact on Efficiency, Early- exits Design and, Added Attack Surface.
Transferability. First, investigate the adversarial attack transferability between SDNNs and DyNNs to evaluate the robustness of the models in black-box scenarios. In the black-box scenarios, adversaries normally assume the target models are always static. However, the target models can be

---

Under review as a conference paper at ICLR 2023
dynamic also. Hence, it is important to find out if a surrogate SDNN model is used to attack target DyNN model or vice-versa, then, to which extent the adversary can be successful.
To address this issue, in this paper. first conduct comparative study on the adversarial attack transferability between SDNNs and DyNNs (Section 3) Our study results suggest that adversarial transferabilityy from DyNNs to SDNNS is better and surprisingly using DyNNs as surrogate models for attack seems to be a more efficient and more effective way to generate adversarial samples. The adversaries are able to generate more adversarial samples in the same amount of time compared to using SDNNs as the surrogate model, and the generated adversarial samples often can also attack SDNNs.
Impact on Efficiency. Second, we conduct another study to understand whether the original purpose of DyNNs (i.e., saving inference time) will be impacted by the adversarial samples (Section [ generated through SDNNs. Our study results suggest that the adversarial samples generated by
existing white-box attacks and Mlck-box attacks do not increase the inference time significantly.
Early-exits Design. Third, we perform a detailed analysis of which design choices in the dynamic mechanisms or DyNN architectures (specifically position of early exits) may impact the robustness of DyNNs (Section 5). We consider two attack scenarios in this study: first, the output layer label of an SDNN is modified by a white-box adversarial example, and we study the impact of the example on corresponding DyNN's early-exit layers; second, in black-box scenario, the output of SDNN is modified by a sample, and the sample is fed to separate model's DyNN. We have made multi- ple findings based on the empirical results, for example, putting the first exit earlier in the model architecture can help to improve the robustness of DyNNs.
Added Attack Surface. Last but not least, we design adversarial attack approach to understand the extra attack surface introduced by the dynamic mechanisms in neural network (Section 6 In this attack, the synthesized adversarial examples will not change the prediction of the final output layer's 's label, but will change the prediction of all the early exits. Based on the attack results, we find that the dynamic mechanism is more vulnerable in scenarios where dependency among DyNN layers is lesser and when the exits are sparse w.r.t the layers.
RELATED WORKS AND BACKGROUND
Dynamic Neural Networks. The main objective of DyNNs to decrease the energy con- sumption of the model inference for inputs that can be classified with fewer computational re- sources. DyNNs can be classified into Conditionallskiiping DyNNs and Early-exit DyNNs. Early-exit DyNNs use multiple exits (sub-networks) within single model and because of the model's working mechanism, the model is more suited for resource constrained devices. If, at any exit, the confidence score of the predicted label exceeds user defined threshold, inference is stopped. The resource-constrainee devices usually deploy a lightweight sub-network of early exit network locally and resort server for further computations if needed (Teerapitaayanon eet al., (017)) Graves (2016), Figurnov et al.] (2017), [Terapittayanon et al. (2016). Kaya et al. (2019) have proposed Early-termination AdNNs. Specifically Kaya et al. (2019) and Zhou et al. 2020) propose early exit networks based on popular SDNNs. Zhou et al. (2020) also show that white-box robustness of the DyNNs better than SDNNs. In addition that multiple works (Teerapittayanon et al. 2017 Scardapane et al. 2020) provide practical usability of DyNNs.
Figure shows the working mechanism of Early-exit DyNNs. For example, an Early-exit DyNN has N parts and each part has an exit. x is the input, fiut represents prediction after the 7th part (generated by specific computation unit), fout represents prediction of the Neural Network, C₁ represents confidence score after 7th part, Hid!" represents input of ith part, HidQut represents output of tth part, and r; is the predefined threshold to exit the network af-
Figure DyNN
1: Working mechanism of Early-exit
2

---

Under review as a conference paper at ICLR 2023
PGD TGSS
mooblonet juaret veg.mo J1ot onst
(a) Target DyNN (CIFAR-10)
(b) Target SDNN (CIFAR-IO)
120
P3D
100
POSM
80
PRRT6L mob lenet pwwnettpe mrob lonet
(100 Huant Vaz Jnobinnt
(c) Target DyNN CIFAR-100)
(d) Target SDNN (CIFAR-100)
Figure Transferable Attack Success Rate for CIFAR-10 and CIFAR-100 data
ter tth part. The working mechanism of the Early-exit DyNN can be represented as, four = foue (x), (x) 2 Ti.
Adversarial Attacks. Adversarial Examples are the input that can change the prediction of the DNN model when those fed the model. Goodfellow et al. (2014) propose Fast Gradient Sign Method (FGSM) that uses single-step first order entropy loss to generate adversarial inputs. This attack is modified by Madry al. (2017) add initial noise the benign sample. This attack is referred as projected gradient descent (PGD). Other than that. Dong et al. (2018); Carlini & Wagner (2017): Croce & Hein (2020); Lin (2019) have proposed white-box attack methods, while Liu et al. (2016); Andriuscchenko et al. 2220); Ilyas et al. (2018) have proposed black- box attack
methods.
3 IS ADVERSARIAL EXAMPLE TRANSFERABILITY FROM DYNN TO SDNN IS LOWER THAN ADVERSARIAL EXAMPLE TRANSFERABILITY FROM SDNN TO DYNN?
In this research question, investigate the "transferability" of adversarial inputs generated based on SDNN and DyNN, respectively. i.e. whether ad adversarial examples generated based on SDNNs adversarial DyNNs and vice versa. Transferability is an important metric for evaluating the feasibility of black-box attack. To evaluate the transferability, one of the popular way (Papernot al.) 2017: [Liu et 2016) creating similar model (i.e., surrogate model) as the target model. In a black-box attack, normally, adversaries assume the underlying model to be SDNN, for deployed DyNN, the adversaries may likely use an SDNN as surrogate model. Hence, this research question (RQ) is important to evaluate the robustness of DyNNs.
3.1 EXPERIMENTAL SETUP.
Dataset and Models. We use CIFAR-10 and CIFAR-100 (Krizhessyy et al., 2009) datasets for evaluation. For SDNNs, 2015), and MobileNet (Howard et al. 2017) model. As DyNNs, we use the carly exit version of these models (Kaya et al. 2019). In all other RQs, we keep the models and dataset setup same.
VGG-16 (Simonyan & Zisserman, (014), ResNet56 (He et al.
Black-box Attack. For the attack scenario, we use surrogate model (Papernot et al. 2017 al. 2016) based black-box attack scenario. Here, we feed a set of imputs to the target model and collect the output labels. These inputs are generated using 50% the held-out validation data, and naturally comuppee versions of those validation data. As the number of partial held-out validation
3

---

Under review as a conference paper at ICLR 2023
data is not significant, adding corrupted inputs would help to increase training data size for the surrogate model. For natural corruption (Hendrycks & Dietterich, 2019). we use gaussian noise and brightness. For each type of corruption, we have five intensity levels. For example, if the number of held out data is 5000, for each corruption, we generate 25000 additional data. Once the input-output pairs are collected, a surrogate model is trained based on those pairs. For target model, both SDNNs and DyNNs. If the target model is SDNN, then an DyNN is trained as surrogate model and vice-versa.
To make the surrogate-target pairs, we use different types of DNN architectures. For example, if the the target model DyNN VGG, we choose ResNet56 SDNN as the surrogate model. This as- sumption is valid because the attacker doesn't It have information about the target model architecture, hence the possibility of choosing the same architecture as the surrogate model less. We define two terms to represent two different types of transferability based on different types of surrogate model and target model: D2S transferability and S2D transferability. D2S transferability evaluates DyNN to SDNN attack transferability, where S2D transferability evaluates SDNN DyNN attack trans- ferability. We have chosen following pairs to evaluate S2D transferability: (SDNN ResNet56 (sur- rogate), DyNN VGG (target)), (SDNN MobileNet (surrogate), DyNN MobileNet (target)), (SDNN MobileNet (surrogate) tioned surrogate models become the target model and earlier mentioned target models become the surrogate model.
ResNet56 (target)). Similarly, for D2S transferability, earlier men-
Algorithms. We use FGSM (Goodfellow al. 2014) and PGD (Madry et al. attack the surrogate models.
2017) algorithms to
Metric. We measure percentage of adversarial examples that can mis-classify the output w.r. num- ber of generated adversarial examples as the attack success rate.
3.2 EVALUATION RESULTS
Figure 2 shows the effectiveness of black-box attacks on DyNNs and SDNNs. On average, it can be noticed that for target SDNN and surrogate DyNN, the attack success rate is higher than the success rate of target AdNN and surrogate SDNN. One of the reasons for this behavior is the lower variance of the DyNNs. DyNNs use lower number of parameters, hence the feature space for adversarial samples of DyNNs is smaller than the feature space for adversarial samples of SDNNs (Schönherr eet al. 2018). Also, we find that for the target DyNN, FGSM attack performs better than PGD attack. If only dataset-specific results are considered, then for CIFAR-100 the attack success rate is higher than for CIFAR-10.
Also, the DyNN-generated adversarial inputs can attack SDNNs, then it can be time efficient to create adversarial inputs using DyNN. Through Figure 7 (Appendix), we can find the probability density plots of different exit numbers of DyNN that have been used generate adversarial exam- ples. Lower exit number suggests that lesser number of computations has been used to generate adversarial examples. It can be noticed that for PGD attack, more than 70% of adversarial examples are generated from exit O, 1 and 2 (first - third exit). Although for FGSM attack, in a few scenarios (CIFAR-10 VGG, CIFAR- 100 MobileNet, and CIFAR-100 ResNet), more than 50% of adversarial examples are generated through later exits (higher computation required).
Finding 1: The D2S transferabilityy is higher than the S2D transferability.
Finding 2: Using DyNNs as surrogate models is more efficient and more effective way to generate adversarial examples than using SDNNs.
4 DOES ADVERSARIAL EXAMPLES IMPACT EARLY-EXIT EFFICIENCY IN DyNNs?
In this section, we investigate whether the original purpose of including dynamic mechanism in DyNNs (f.e. saving inference time) will be impacted by the adversarial samples. Specifically, study whether the adversarial inputs exit earlier or later a DyNN compared to the original inputs. The main objective of this investigation is to find out whether the adversarial samples generated on
4

---

Under review as a conference paper at ICLR 2023
SDNN can have an impact the amount of computation of the DyNN. For this purpose, conduct both white-box and black-box attacks to find out the impact of adversarial samples on the amount of computation.
Here, the white-bos box attack scenario can also be considered a practical scenario. There have been studies (Chen et al.; 2022 Wu et al. 2022 that focus reverse engineering of SDNN models from binary code of on-device models, but no techniques have been proposed to reverse engineer the dynamic mechanisms in the models. Hence, adversaries are more likely to get SDNN models instead of their dynamic counterparts, So it is important to find out how adversarial samples affect the efficiency of the DyNN for both white-bos box and black-box scenarios.
4.1 EXPERIMENTAL SETUP.
Attack. We use PGD and FGSM for both white-box and black-box attacks. For black-box setup, we use the same setup as previous RQ. For black-box scenario, we use DyNNs as target model and SDNNs surrogate model. In white-box setting, we attack the SDNN and evaluate on the performance of corresponding DyNN.
Metric. We use the difference between the exit number selected by adversarial input and the exit number selected by benign input. If the difference positive, then the latency of the adversarial sample is increased w.r.t benign input.
4.2 EVALUATION RESULTS.
Figure 3 and Figure 10 (in Appendix) show the impact of adversarial examples generated on SDNN on changing in exit number in DyNN in white-box setting. It can be observed that for the majority of the scenarios, accuracy-basee in the DyNN. On average, FGSM-generater examples increase more computation in DyNNs than PGD-generated examples. For CIFAR-10 data, for MobileNet and VGG-16 DyNN models, 25%- 37% of the FGSM generated examples could increase the number of exits by more than one. Also, it can be noted that adversarial samples generated on CIFAR- 100 data is more likely to increase computation than adversarial samples generated on CIFAR-10. Especially, more than 45% of the FGSM samples generated on CIFAR-100 data can increase the number of exits by more than one.
adversarial samples do not increase the computation significantly
Figure and Figure IT (in Appendix) show the impact of adversarial examples generated on SDNN on change in exits in DyNN in black-box setting. It can be noted that, for CIFAR-10 dataset, black-box attack can generate more computation-increasiii ResNet and VGG model, more than 40% PGD attack generated examples can increase the number of exits by more than one. For all three models, 35% of the FGSM attack generated examples can increase the number of exits by more than one. FGSM attack generates more inputs that induces low confidence in early-exit layers than PGD attack. For CIFAR- dataset, the increase of computation caused by adversarial attacks is higher than that of CIFAR-10. As CIFAR-100 data uses larger model, the robustness of the model is reduced. For CIFAR-100 dataset, more than 40% examples generated through both the attack can increase the number of exits by more than one. However, increasing the number of exits by two or three exits does not decrease the efficiency in DyNNs significantly.
examples than white-box attack. For
Finding 3: Accuracy-bused adversarial samples do not decrease the efficiency significantly in the DyNN.
The adversarial examples, whose output confidences are significantly lower, can perform better in terms of decreasing the efficiency in DyNNs.
Finding 4:
Finding 5: Adversarial examples generated on a larger model (w.rt model parameters) is more likely decrease efficiency in DyNNs.
5 WHAT DESIGN OF DYNNS MAY IMPACT THE ROBUSTNESS?
In this section, we evaluate which architecture design choices (position of carly exits) in DyNNs may impact the robustness of early layers. In this RQ, consider DyNNs multi-exit networks, where
5

---

Under review as a conference paper at ICLR 2023
Dwulii Pott FESM abot
PCD FOSH
F05M!
FooM
233
641
(a) CIFAR-10 VGG
(b) CIFAR-10 MobileNet
(c) CIFAR-10 ResNet
Figure 3: Density plots of change in exit numbers because of PGD and FGSM attack (For CIFAR-10 10 data). The axis represents the change in exit number while y axis represents the density.
cleoo and optt
Tel Seaddy WSL dall
LACOWCC P.C. aUSTION etacctt ciast
PSp
P:2
242
400
501
25
(a) CIFAR-10 VGG
(b) CIFAR-10 MobileNet
(c) CIFAR-10 ResNet
Figure 4: Density plots of change in exit numbers because of PGD and FGSM black-box attack (For CIFAR-10). 10). The x axis represents the change in exit number while y axis represents the density.
each exit will provide an output. For evaluation, we assess if we attack the final exit, from which early-exit layer the label modification begin. If the output label is not modified in any earlier layer, then for that type of model, the robustness is higher because the model can produce correct results any layer. This RQ will provide an insight into which type of design choice may improve the robustness of early layers.
5.1 EXPERIMENTAL SETUP.
Attack Setup. We use same attack setup previous research questions. However, while we attack the DyNN, we do not consider one specific exit layer. Instead of that, we consider each exit layer. Metric. We use the early exit from which the label modification starts. For example, there are N exits. First, Nth exit's label is modified through adversarial sample. If till Kthh exit the original prediction was same, then report K + 1th exit in the experimentation.
5.2 EVALUATION RESULTS.
Figure and Figure g (in Appendix) show probability density plot on which exit the output label is changed using the white-box adversarial examples. It can be observed that for all the model-dataset pairs, for more than 77% of the examples, the label is modified the first exit. For CIFAR- 10 data, only for MobileNet and ResNet models, the label is changed after the first exit for more than 20% of the examples (using FGSM attack).
Figure Figure 9 (in Appendix) show probability density plot on which exit the output label is changed using the black-box adversarial examples. From results, we can see that the robustness of earlier exits is better against black-box attack than white-box attack. For CIFAR- 10 data, more than 45% of the both attack generated samples could not misclassify the first exit for VGG-16 model. For CIFAR-100 data (larger model), robustness of early exit layers is worse than that of CIFAR- 10 data (smaller model). For CIFAR- 100 data, for both attacks and three models, less than 30% of the adversarial examples not mis-classify the first exit.
For black-box attack scenario, VGG-16 model's first layer on-average shows better robustness against black-box attack. In the DyNN, the first exit of the VGG model is placed only after sec-

---

Under review as a conference paper at ICLR 2023
Lee Donse Deet wwt.ee Aoakle dacked
POAM
HAV
(a) CIFAR- 10 VGG
(b) CIFAR-IO MobileNet
(c) CIFAR-IO ResNet
Figure 5: Density plots representing during which exit number output label is changed because of PGD and FGSM attack (For CIFAR-10 data). The axis represents the exit number while y axis represents the density.
TIGH
RGG
IISH
(a) CIFAR-10 VGG
(b) CIFAR-10 MobileNet
(c) CIFAR-10 ResNet
Figure 6: Density plots representing during which exit number output label is changed because of PGD and FGSM black-box attack (For CIFAR-10 data). The axis represents the exit number while y axis represents the density.
ond layer, while for others, more computations are performed before using the first exit. Hence, having the first exit in the early layers can increase the robustness of DyNN. Although lower num- ber of parameters would be used to predict output, but with VGG we can notice that a significant number of imputs be classified correctly through first exit.
Finding 6: We find that having the first exit the earlier layers can increase the robustness of early exits of the DyNNs.
Finding 7: Black-box attack success rate is lesser than white-box attack success rate against early-exit layers.
Finding 8: For black-bor scenario, early-exit layers are more robust against adversarial examples generated smaller surrogate model than adversarial examples generated on larger surrogate model.
CAN WE SYNTHESIZE CERTAIN EXAMPLES TO EVALUATE THE ADDED ATTACK SURFACE OF DYNAMIC MECHANISM?
In this section, we evaluate if specific examples can be generated only to understand the additional attack surface introduced by the dynamic mechanism in DyNNs. We aim design an attack such that the synthesized adversarial examples will not change the prediction of the final SDNN label, but change the prediction all the early exits. This threat model practical because attack evades the existing detection that relies the final output of SDNN while the attacker creates situation where all the carly cxit networks do not provide correct prediction, therefore decreasing the usability of DyNNs. However, this attack is also challenging to be performed successfully because final layer output is dependent on the earlier exit layers and is challenging to impact all the early exits' prediction without modifying the final exit's prediction.
6.1 PROBLEM FORMULATION

---

Under review as a conference paper at ICLR 2023
We propose novel attack technique called Earty Attack to evaluate the effectiveness of the early layers of DyNNs. Let's assume f is an DyNN with N exits. Given an imput I, the output softmax 3...V. For synthesizing adversarial
layer in exit can be defined as y fz)z), where examples, we have two main objectives. First, the initial prediction in the Nrth exit (final layer) does not change. Let's assume, the initial prediction at final layer is p. Second, the prediction of all the other exits should be different than p.
Based on the aforementioned objectives, can propose an iterative optimization procedure to optimise a loss function L. For each of the objectives, one loss function component is formulized. For the first objective, we propose loss function I =- jهp mar(y, v5" 0)). I11, we maximize the difference between softmax value of label p and other label's softmax value, therefore the prediction won't 't get changed at the final exit. For the second objective, we propose loss func-
Algorithm 1: Input generation
using Early Attack
Inputs a Input Image
Outputs: Pertuuredd Image
begin
Initialize(w)
T = namber-off Sterations
ster.no
tion L2 = (Ein v/)). The L2 ensures that for any other exit than the final exit, p softmax value would be minimized. The final loss function L = a L1 + L2. Here the a is a user- defined variable that provides balance between two loss terms.
while iter_ne < do sanb(w)+1
output (2)) if (ouces))) then return(a"))
10
end L lass(a, ur Inow, Optimi
Finally, we need to ensure the added perturbation to gener- adversarial examples are limited, hence, the final opti- mization function would be, minimize([|8]
11
13
sternno + 1anb(
c L), where, (x +) e [0. 1]". Here, ö represents the added perturbation and è is a user-defined variable to provide weightage on spe- cific component. e controls the magnitude of generated per- turbation ([]ō,[),, where a large makes the loss function more dependant on the L.
14
end
15
16
end
This constrained optimization problem in 8 can be converted into non-constrained optimization problem in w. where the relationship between 5 and w is: 5 tanh(w)++ The tanh function would ensure that the generated adversarial input values stay between O and 1. The equivalent optimization problem in is:
tanh(w) (x)
+1
minimize 20
x
+c.
2
Algorithm| shows the optimization algorithm. The algorithm outputs the adversarial input x' given benign image x as input. w initialized to a random tensor that has equal shape as the input image. For each iteration, the loss function of the attack is computed (at line 11). Based on the back- mack-propagated loss, the optimizer updates w with next value. Once the iteration threshold (T) is reached the attack is successful, the algorithm computes and returns the adversarial input x' (at Line 9 and 15).
6.2 EVALUATION
6.2.1 EVALUATION SETUP.
Baseline. We use PGD and FGSM attacks as baseline to modify the early exit label.
Metric. We use attack success rate as metric in the evaluation. If the adversarial input generated final layer output is same as the output generated by benign input and all the other exit layers out- put is different than the final output label, then we consider attack is successful for that particular adversarial input.
Hyperparameters. We use (0.001, 0.01, 10, 40) and 50 as hyperparameters.
6.2.2 EFFECTIVENESS
Table shows the evaluation results the attack success rate of Early Attack and baseline tech- niques. Except model-dataset pair, Early Attack's success rate is higher than 80% in all other
8

---

Under review as a conference paper at ICLR 2023
scenarios. PGD and FGSM attacks unsuccessful because the loss function only considers early layer output and does not consider final layer output. Although FGSM's attack success rate is higher than PGD's 's success rate. Also, w.r.t best performing values, performs well for 70% of the model-dataset pairs.
We also analyze why early attack fails for VGG16 and MobileNet models for CIFAR-10 data. First, for CIFAR-10 data, final fully connected layer has lower number of parameters than the final layer for CIFAR-I00 data. Hence, the dependency between the final layer and earlier layers is higher for CIFAR-10. However, for CIFAR-10 data, attack success rate is higher for ResNet model. First we discuss the failed cases for VGG16 and MobileNet model, and then we discuss why the attack succeeded for ResNet model.
For VGG16 model, the failed examples can be divided into types. For the first type. the final output label is changed with all the other early exit layers. In the second type, first few layers get the output label mis-classifidd, but along with the final layer, few previous layers also get the output correctly classified. For MobileNet, all the layers except the final and last to final layer get the output label mis-classified. For MobileNet, we also find that the final two exits are separated by only two layers, which is significantly lower than other model'ss separation layers between final two exits. Hence, the dependency between final two layers is higher.
For ResNet model, there are 56 layers divided into 27 blocks. The exits sparsely divided between these blocks. For Mobilenet and VGG models, the exit distributions are less sparse. Hence, the dependency between exits is lower for ResNet and because of that reason, could successfully attack ResNet model.
6.2.3 TRANSFERABILITY
In this section, we discuss about the transferabil- ity of the Early Attack examples. As Early Attack has two different components, instead of measur- ing attack success rate directly, measure two parameters T1 and T2. T1 represents the percent- age of inputs for which the final output remains same as the output generated by benign input. T2 represents from the examples selected from 71, how many early exit layers on average are mis- classified. Having both high T1 and T2 values en- sures transferability.
Table 1: Attack accuracy percentage of Early Attack and the baseline techniques against different model and dataset, along with a value.
Danaset
Model
Early Altack
best a val
PGD
FGSM
VGG
35
CIFAR 10
MobileNet
11
0.1
0
ResNet
81
0
CIFAR-100
MobileNet
97
0
ResNet
We show the transferability results in Appendix (Table 2 For CIFAR-10 data, the T1 values are high, but 72 values are significantly low except for MobileNet to ResNet transferability. For CIFAR- 100 data, 72 values are higher than of CIFAR-10 data, however, T1 values are low. From the results, we can notice that the generated examples either can keep the final layer label the same or can change the carly exit layer outputs. Our finding suggests that early attack transferability is limited.
Finding 9: With increasing number of exits in DyNNs, the dependency between multiple exits will increase. Hence, more exits in DyNNs can increase the robustness against the Early Attack.
Finding 10: Early Atlack transferability between DyNNs not significant.
7 CONCLUSIION
In this work we discuss the robustness of including dynamic mechanism in DNN through four research questions. We find out that DyNNs are more robust than SDNNs and also efficient gen- erate adversarial examples. We also propose DyNN design choices through final two RQs. Finally, we propose a novel attack to understand additional attack space in DyNNs.
http://gghtha..comm/mmmmmmoo/osa Attack/trce/main

---

Under review as a conference paper at ICLR 2023
REFERENCES
Maksym Andriushchenko, Francesco Croce, Nicolas Flammarion, and Matthias Hein. Square at- tack: a query-efficient black-box adversarial attack via random search. In European Conference on Computer Vision, pp. 484-501 Springer, 2020.
Nicholas Carlini and David Wagner. Towards evaluating the robustness of neural networks. In 2017 ieee symposium on security and privacy (sp), pp. 39-57. Icce, 2017.
Simin Chen, Hamed Khanpour, Cong Liu, and Wei Yang. Learning to reverse dans from ai programs automatically. arXiv preprint arXiv:2205.1036 2022.
Patryk Chrabaszez, Ilya Loshchilov, and Frank Hutter. downsampled variant of imagenet as an alternative to the cifar datasets. arXiv preprini (xXiv:/707.088/ 2017.
Francesco Croce and Matthias Hein. Reliable evaluation of adversarial robustness with an ensemble of diverse parameter-free attacks. In International conference on machine learning, pp. 2206- 2216. PMLR, 2020.
Yinpeng Dong. Fangzhou Liao, Tianyu Pang. Hang Su, Jun Zhu, Xiaolin Hu, and Jianguo Li. Boost- ing adversarial attacks with momentum. In Proceedings of the IEEE conference on computer vision and pattern recognition, pp. 9185-9193, 2018.
Fernando A Fardo, Victor H Conforto, Francisco C de Oliveira, and Paulo S Rodrigues. A formal evaluation of psnr quality measurement parameter for image segmentation algorithms. arXiv preprint arXiv: 071 16, 2016.
Michael Figurnov, Maxwell D Collins, Yukun Zhu, Li Zhang, Jonathan Huang, Dmitry Vetrov, and Ruslan Salakhutdinov. Spatially Adaptive Computation Time for Residual Networks. In Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition, pp. 1039- 1048, 2017.
lan J Goodfellow, Jonathon Shlens, and Christian Szegedy. Explaining and Harnessing Adversarial Examples. arXiv preprint arXiv:1412.6572, 2014.
Alex Graves. Adaptive Computation Time for Recurrent Neural Networks. arXiv preprint
arXiv: 1003:06003.8883, 2016.
Kaiming He, Xiangyu Zhang, Shaoqing Ren, and Jian Sun. Deep residual learning for image recog- nition. arXiv preprint 1rXiv:1512.033385, 2015.
Dan Hendrycks and Thomas Dietterich. Benchmarking neural network robustness to common cor- ruptions and perturbations. arXiv preprint arXiv: 1903. 12261, 2019.
Andrew Howard, Menglong Zhu, Bo Chen, Dmitry Kalenichenko, Weijun Wang, Tobias Weyand, Marco Andreetto, and Hartwig Adam. Mobilenets: Efficient Convolutional Neural Networks for Mobile Vision Applications. arXiv preprint arXiv: 2017.
Andrew Ilyas, Logan Engstrom, Anish Athalye, and Jessy Lin. Black-box adversarial attacks with limited queries and information. In International Conference on Machine Learning, pp. 2137- 2146. PMLR, 2018.
Yigitcan Kaya, Sanghyun Hong, and Tudor Dumitras. Shallow-deep networks: Understanding and mitigating network overthinking. International Conference on Machine Learning, pp. 3301- 3310. PMLR, 2019.
Alex Krizhevsky, Geoffrey Hinton, et al. Learning multiple layers of features from tiny images. 2009.
Jiadong Lin, Chuanbiao Song, Kun He, Liwei Wang, and John E Hopcroft. Nesterov accelerated gradient and scale invariance for adversarial attacks. arXiv preprint arXiv: 092889088...8,... 2019.
Yanpei Liu, Xinyun Chen, Chang Liu, and Dawn Song. Delving into transferable adversarial exam- ples and black-box attacks. arXiv preprint arXiv: 1611:111 2016.
10

---

Under review as a conference paper at ICLR 2023
Aleksander Madry, Aleksandar Makelov, Ludwig Schmidt, Dimitris Tsipras, and Adrian Vladu. Towards deep learning models resistant to adversarial attacks. arXiv preprint 07083, 2017.
Nicolas Papernot, Patrick McDaniel, Ian Goodfellow, Somesh Jha, Z Berkay Celik, and Ananthram Swami. Practical black-box attacks against machine learning. In Proceedings of the 2017 ACM on Asia conference on computer and communications security, pp- 506-519, 2017.
Simone Scardapane, Michele Scarpiniti, Enzo Baccarelli, and Aurelio Uncini. Why should we add early exits to neural networks? Cognitive Computation, 12(5):55-966, 2020.
Lea Schönherr, Katharina Kohls, Steffen Zeiler, Thorsten Holz, and Dorothea Kolossa. Adversarial attacks against automatic speech recognition systems via psychoacoustic hiding. arXiv preprint wrXiv::808.05665. 2018.
Karen Simonyan and Andrew Zisserman. Very deep convolutional networks for large-scale image recognition. arXiv preprint 1rXiv:1409.1556 2014.
Surat Teerapittayanon, Bradley McDanel, and Hsiang-Tsung Kung. Branchynet: Fast Inference via Early Exiting from Deep Neural Networks. Proceedings of the International Conference on Pattern Recognition, pp. 2464-2469, 2016.
Surat Teerapittayanon, Bradley McDanel, and Hsiann-Tsung Kung. Distributed deep neural net- works over the cloud, the edge and end devices. In 2017 IEEE 37th international conference on distributed computing systems (ICDCS), pp. 328-328-39 IEEE, 2017.
Xin Wang, Fisher Yu, Zi-Yi Dou, Trevor Darrell, and Joseph E Gonzalez. Skipnet: Learning Dy- namic Routing in Convolutional Networks. In Proceedings of the European Conference on Com- puter Vision, pp. 409-424, 2018.
Ruoyu Wu, Taegyu Kim, Dave (Jing) Tian, Antonio Bianchi, and Dongyan Xu. DnD: A Cross- Architecture deep neural network decompiler. In 31st USENIX Security Symposium (USENIX Security 22), pp. 2135-2152, Boston, MA, August 2022. USENIX Association. ISBN 978-1- 939133-31-1. URL https:://// /wwww//ww...///////////////// usen orgg con Ference/usen! xwe.uriixsecurtty2222 presentati on wu ruoyu
Zuxuan Wu, Tushar Nagarajan, Abhishek Kumar, Steven Rennie, Larry S Davis, Kristen Grauman, and Rogerio Feris. Blockdrop: Dynamic inference paths residual networks. In Proceedings of the IEEE Conference Computer Vision and Puttern Recognition, pp. 8817 8817-8826, 2018.
Wangchunshu Zhou, Canwen Xu, Tao Ge, Julian McAuley, Ke Xu, and Furu Wei. Bert loses pa- tience: Fast and robust inference with early exit. Advances in Neural Information Processing Systems, 33:18330-1883 2020.

---

Under review as a conference paper at ICLR 2023
FGD
PCD Pe52
PCD FGSM
(a) CIFAR-10 VGG
CIFAR-10 MobileNet
(c) CIFAR-IF 10 ResNet
SA0N Doitt Mbactar siett
Demdly N0 an brokeite
both boste Pot 2ww.e Stru clrdti FoM
PGD
(d) CIFAR- 100 VGG
(c) CIFAR-100 100 MobilcNet
(f) CIFAR 100 ResNet
Figure 7: Density plots of exit numbers in DyNN that are used generate black-box adversarial inputs using PGD and FGSM attacks. The axis represents the exit number while axis represents the density.
US4 Doaat LNSTION AWW.RAAAANNNO CNCCME
FCD
POSP
FOOM
(a) CIFAR-100 VGG
(b) CIFAR-100 MobileNet
(c) CIFAR-100 ResNet
Figure 8: Density plots representing during which exit number output label is changed because of PGD and FGSM attack (For CIFAR-100 data). The axis represents the exit number while axis represents the density.
Appendices
A RQI DENSITY PLOTS
The density plots in Figure 7 shows the probability density plots of exit numbers in DyNN that used to generate black-box adversarial inputs using PGD and FGSM attacks.
B EARLY ATTACK SUCCESS RATE WITH DIFFERENT a VALUES
Table 2: Attack accuracy percentage of Early Attack with different values
Dataset
Model
EA(a=0.001)
EA(a=0.01)
EA(a=0.1)
EA(a=1)
EA(a=20)
EA(a=40)
VGG
0
0
35
10
CIFAR-10
MobileNet
0
11
4
0
ResNet
7
32
73
81
49
32
VGG
5
48
82
86
70
CIFAR-100
MobileNet
0
16
74
97
92
77
ResNet
46
74
92
96
96
12

---

Under review as a conference paper at ICLR 2023
Levd antooeoa
FCSN
PO24
(a) CIFAR-I00 100 VGG
(b) CIFAR-I00 100 MobileNet
(c) CIFAR-100 ResNet
Figure 9: Density plots representing during which exit number output label is changed because of PGD and FGSM black-box attack (For CIFAR-100 data). The axis represents the exit number while y axis represents the density.
4.00
C29
PCD
FrAM
FSD
2.50
(a) CIFAR-100 VGG
(b) CIFAR-100 MobileNet
(c) CIFAR-100 ResNet
Figure 10: Density plots of change in exit numbers because of PGD and FGSM attack (For CIFAR- 100 data). The x axis represents the change in exit number while axis represents the density.
C TRANSFERABILITY
Table shows the T1 and T2 values all three models on two datasets.
D RQI RESULTS BASED ON MI-FGSM ATTACK
Here, through Figure 12 show the adversarial transferabilitt results between DyNNs and SDNNs using MI-FGSM attack. These results again confirm that adversarial examples from DyNN to SDNN more transferable than adversarial examples from SDNN to DyNN.
TRANSFERABILLITY EXPERIMENTS ON MI-FGSM ATTACK
Through Figure 12 we show the S2D and D2S transferability with MI-FGSM attack Dong et al. 2018). The results confirm our claim that D2S transferability is higher than S2D transferability.
Table 3: T1 and T2 values for measuring transferability between three models. TSM represents Target Model and represents Surrogate Model. 71 presents the percentage of inputs for which the final output remains same the output generated by benign input. T2 represents from the examples selected from T', how many early exit layers on average is mis-classifidd.
CIFAR-10
CIFAR-I00
TM
Type
VGG
MNet
RNet
VGG
MNet
RNet
SM
VGG
85%
73%
65%
39%
T1
MNet
86%
74%
51%
38%
RNet
89%
82%
79%
75%
VGG
0.73
1.65
1.58
2.69
T2
MNet
1.06
2.3
1.52
3.26
RNet
0.95
0.85
1.32
1.28
13

---

Under review as a conference paper at ICLR 2023
317
1GD FSSM
PGD FoSM
POD FCMM
310
(a) CIFAR-100 VGG
(b) CIFAR-100 MobileNet
(c) CIFAR-100 ResNet
Figure 11: Density plots of change in exit numbers because of PGD and FGSM black-box attack (For CIFAR- 100 data). The x axis represents the change in exit number while y axis represents the density.
120
120
CIFAR-10 CIFAR-100
CIFAR-10 CIFAR-100
80
80
60
60
Attah
20
20
reenet
mobilenst resnet mobilenet Mode
resnel, mobilenet
mobilenet, resnet
Medel Pair
(a) Target DyNN MI-FGSM
(b) Target SDNN MI-FGSM
Figure 12: Transferable Attack Success Rate for MI-FGSM attack
F COMPARING DIFFERENT ADVERSARIAL IMAGES
In this section, we show original images, adversarial images generated through DyNNs and adver- sarial images generated through SDNNs through Figure Figure 13 and Figure 14 We find that in terms of quality. images generated through SDNNs (Average PSNR (Fardo et al. 2016 23.20) slightly better than images generated through DyNNs (Average = 23.1993.19)
G RQ1 RESULTS BASED ON TINY IMAGENET IMAGES
Here, through Figure 16 we show the adversarial transferability results between DyNNs and SDNNs for Tiny Imagenet (Chrabaszez et al.) 2017) datasets. These images are larger in size (64 x 64) than CIFAR images (size 32 32). These results reconfirm that adversarial examples from DyNN to SDNN more transferable than adversarial examples from SDNN to DyNN, even if the input feature space is larger. Although, we can notice a slight decrease transferability for both D2S and S2D.
14

---

Under review as a conference paper at ICLR 2023
Figure 13: Original Images
Figure 14: Adversarial Images generated on SDNNS
Figure 15: Adversarial Images generated on DyNNs
120
PGD
100
FGSM
FGSM
PGD
Atank Acuuney
80
MI-FGSM
80
MI-FGSM
60
60
40
20
resnet vgg
mobilenat resnet Model wgggavggggoaaaeeeeeeeee mobblenbbtttttt
resnet mabienne mobilenet vgg Model
v@0 resnet
(a) Target DyNN (Tiny Imagenet)
(b) Target SDNN (Tiny Imagenet)
Figure 16: Transferable Attack Success Rate for Tiny Imagenet Data
15


Reviews:
[{"review_id": "e1pSHCXcThd", "reviewer": "Reviewer_X4b3", "summary": "", "questions": "", "limitations": "", "rating": 8, "confidence": 4, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "This paper investigates the robustness of dynamic neural networks, focusing specifically on early exit networks. It does so by exploring how attacks generated using static networks transfer to dynamic networks and how the structure of dynamic networks provides another attack surface. In their majority most works appearing in the literature dynamic networks have been utilized to improve real-time performance. However, they have not been investigated under the spotlight of robustness. In this regard I find that this work provides some interesting findings which have not been explored previously.  ", "summary_of_the_review": "The paper investigates the robustness of dynamic neural networks against adversarial attacks. It provides a new focus for dynamic neural networks and highlights the new attack surface that they provide. While this paper has some shortcomings and can be improved in some areas I would recommend it based on the new aspects that it tries to highlight. ", "strength_and_weaknesses": "Strengths:\n- I like the questions raised in this paper and believe they provide a new direction for research in dynamic neural networks. \n- The experiments use some standard deep learning models like VGG and ResNet, and explore different scenarios e.g., either dynamic or static model as surrogate etc.\n- Some interesting findings such as that the more exits increase the robustness of the model.\n\nWeaknesses:\n- The related works section needs to be expanded significantly in order to provide the reader with a more complete picture especially with the available works on dynamic neural networks. \n- The list of references is also quite limited considering that adversarial attacks are a very popular topic and dynamic neural networks have been investigated for some years. \n- The evaluation datasets include only cifar-10 and 100. It is not clear of using other benchmark such as ImageNet which have higher resolution would impact the results since now a much larger attack surface is available. \n- It would have been nice to see a theoretical framework specific for dynamic neural network that would provide some additional foundations besides the empirical findings. \n", "limitations_and_societal_impact": "", "review_text": "", "extra_scores": {"correctness": "3: Some of the paper’s claims have minor issues. A few statements are not well-supported, or require small changes to be made correct.", "technical_novelty_and_significance": "4: The contributions are significant, and do not exist in prior works.", "empirical_novelty_and_significance": "4: The contributions are significant, and do not exist in prior works."}, "extra_text": {}}, {"review_id": "SAV-K26N32J", "reviewer": "Reviewer_bhB9", "summary": "", "questions": "", "limitations": "", "rating": 3, "confidence": 3, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "The work studies the robustness of dynamic neural networks (DyNNs) from four perspectives: 1) comparison of the black-box robustness between static and DyNNs; 2) The inference time of adversarial samples in DyNNs; 3) Dynamic mechanisms with the best robustness; 4) synthesize samples to reduce the effectiveness of DyNNs. ", "summary_of_the_review": "None", "strength_and_weaknesses": "### Strength:\n\n1. The paper is well-written with summarized findings in each section (3-6).\n2. Experiments are conducted in different architectures and datasets.\n3. Sufficient implementation details are provided.\n\n### Weakness:\n\n1. Why do the authors only consider early-exit DyNNs? \"more popular\" seems not convincing.\n2. The logical relationship between these four perspectives of DyNNs' robustness is not clear, which results in this paper being more like a technical report rather than a conference paper.\n3. The literature on adversarial attacks missing a lot of important works. e.g., Auto-Attack, C&W attack, etc.\n4. Finding 1 in Section 3 \"With respect to black-box attacks, early-exit DyNNs are more robust than SDNNs\" is really debatable. 1) missing white-box robustness evaluation 2) Only FGSM and PGD attack is not reliable for assessing robustness. With more advanced attacks, e.g., Auto-Attack, does this finding also hold?\n", "limitations_and_societal_impact": "", "review_text": "", "extra_scores": {"correctness": "2: Several of the paper’s claims are incorrect or not well-supported.", "technical_novelty_and_significance": "2: The contributions are only marginally significant or novel.", "empirical_novelty_and_significance": "2: The contributions are only marginally significant or novel."}, "extra_text": {}}, {"review_id": "0c4XACBGRV9", "reviewer": "Reviewer_nmxr", "summary": "", "questions": "", "limitations": "", "rating": 6, "confidence": 4, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "This paper presents an empirical study of the adversarial robustness of dynamic neural networks (DyNNs) with early-exits. The authors find that DyNNs are more robust than SDNNs, and DyNNs can be used to generate adversarial samples efficiently. The authors also proposes a novel adversarial attack method specifically designed for DyNNs.", "summary_of_the_review": "This paper conducts an interesting empirical study about the adversarial robustness of DyNNs. It misses an important related work and is thus somewhat overclaiming the novelty of the findings. Nevertheless, some findings are still interesting and can be helpful.", "strength_and_weaknesses": "Strengthes:\n1. The adversarial robustness of DyNNs is an important research problem. Some of the findings are new and can be interesting to the community.\n2. The paper is overall well-written and easy to follow.\n3. The experiments are well conducted and well supports the findings in the paper.\n\nWeaknesses:\n1. Missing related work on DyNN with improved adversarial robustness [Zhou et al. 2020]. This work also investigated the adversarial robustness of DyNNs and introduced a novel early-exit criteria for improved robustness. This makes the novelty of some findings less strong. However, [Zhou et al. 2020] does not conduct extensive experiments and the throughout empirical analysis in this paper can still be beneficial.\n2. The proposed early-attack method is not very well motivated. It's unclear in which scenario one would expect the prediction of last layer to be unchanged because this will not influence the final prediction anyway.\n\n[Zhou et al. 2020] BERT Loses Patience: Fast and Robust Inference with Early Exit\n", "limitations_and_societal_impact": "", "review_text": "", "extra_scores": {"correctness": "4: All of the claims and statements are well-supported and correct.", "technical_novelty_and_significance": "2: The contributions are only marginally significant or novel.", "empirical_novelty_and_significance": "3: The contributions are significant and somewhat new. Aspects of the contributions exist in prior work."}, "extra_text": {}}]

Author rebuttal:

Decision: Reject