NODEAttack: Adversarial Attack on the Energy Consumption of Neural ODEs
Authors: Mirazul Haque
Simin Chen
Wasif Arman Haque
Cong Liu
Wei Yang
Venue: ICLR 2022 Submitted (2022)
Keywords: Adversarial Machine Learning
Energy Consumption

Abstract: Recently, Neural ODE (Ordinary Differential Equation) models have been proposed, which use ordinary differential equation solving to predict the output of neural network. Due to the low memory usage, Neural ODE models can be considered as an alternative that can be deployed in resource-constrained devices (e.g., IoT devices, mobile devices). However, to deploy a Deep Learning model in resource-constrained devices, low inference energy cost is also required along with low memory cost. Unlike the memory cost, the energy consumption of the Neural ODEs during inference can be adaptive because of the adaptive nature of the ODE solvers. Attackers can leverage the adaptive behaviour of Neural ODEs to attack the energy consumption of Neural ODEs. However, energy-based attack scenarios have not been explored against Neural ODEs. To show the vulnerability of Neural ODEs against adversarial energy-based attack, we propose NODEAttack.
The objective of NODEAttack is to generate adversarial inputs that require more ODE solvers computations, therefore increasing neural ODEs inference-time energy consumption.
Our extensive evaluation on two datasets and two popular ODE solvers show that the samples generated through NODEAttack can increase up to 168%  energy consumption than average energy consumption of benign test data during inference time. Our evaluation also shows the attack transferability is feasible across solvers and architectures.
Also, we perform a case study showing the impact of the generated adversarial examples, which shows that NODEAttack generated adversarial examples can decrease 50% efficiency of an object-recognition-based mobile application. 

Under review as a conference paper at ICLR 2022
NODEATTACK: ADVERSARIAL ATTACK ON THE EN- ERGY CONSUMPTION OF NEURAL ODES
Anonymous authors
Paper under double-blind review
ABSTRACT
Recently, Neural ODE (Ordinary Differential Equation) models have been pro- posed, which use ordinary differential equation solving to predict the output of neural network. Due to the low memory usage, Neural ODE models can be con- sidered as an alternative that can be deployed in resource-constrained devices (e.g.. loT devices, mobile devices). However, to deploy a Deep Learning model resource-constrained devices, low inference energy cost is also required along with low memory cost. Unlike the memory cost, the energy consumption of the Neural ODEs during inference can be adaptive because of the adaptive nature of the ODE solvers. Attackers can leverage the adaptive behaviour of Neural ODEs attack the energy consumption of Neural ODEs. However, energy-based at- tack scenarios have not been explored against Neural ODEs. To show the vul- nerability of Neural ODEs against adversarial energy-based attack, we propose NacEAttack. The objective of NODEAttack is to generate adversarial inputs that require more ODE solvers computations, therefore increasing neural ODEs inference-time energy consumption. Our extensive evaluation on two datasets and two popular ODE solvers show that the samples generated through NODEAt ack increase up to 168% energy consumption than average energy consumption of benign test data during inference time. Our evaluation also shows the attack trans- ferability is feasible across solvers and architectures. Also, we perform case study showing the impact of the generated adversarial examples, which shows that NODEAt generated adversarial examples can decrease 50% efficiency of an object-recognitioon-aase mobile application.
INTRODUCTION
Deep Neural Networks (DNNs) have shown great potential in many challenging tasks (image classi- fication, natural language process, and playing games). To cope with tasks with higher complexity, the number of DNN parameters is increasing rapidly. Because of this reason, DNNs require siderable memory usage both in training and inference. To address the issue of increased memory usage, researchers simulate the solver of ordinary differential equation (ODE) and propose Neural ODE techniques (Chen et al. 2018). Neural ODE does not store any intermediate quantities of the forward pass and allows us to train DNNs with constant memory cost. Neural ODE also performs better than traditional DNNs for irregularly sampled time series data. Because of decreased memory cost, Neural ODEs are viable options to be used in sesource-constraiiee devices like mobile devices or UAVs s (Unmanned Aerial Vehicle).
Due to the adaptive energy consumption of Neural ODE models (Section 3). the model robustness in terms of energy consumption or energy robustness (Defined in 1 of the model needs to be investigated to deploy Neural ODE models resource-comssrained devices. Otherwise, lack of energy robustness in Neural ODEs can lead to tragic situations. For example, we assume that Neural ODE model deployed for mobile apps, which are used to help visually impaired people. The energy consumption of the model is not robust, then the battery of the mobile device will be drained faster. This can be fatal for the visually impaired person. To avoid such scenarios, evaluating energy robustness of Neural ODEs is required to avoid unwanted incidents.

---

Under review as a conference paper at ICLR 2022
Although energy robustness of Neural ODEs has not been explored, unlike accuracy- robust- ness. Recent work shows that Neural ODE models are more robust against accuracy- based adver- sarial attacks Yan et al. (2019) than traditional DNNs. However, finding relationship between input and energy consumption is more challenging because the relation between input and energy consumption of DNNS is not well-defined. 'To explore the energy robustness of Neural ODEs, the relationship between input and energy consumption of Neural ODEs needs to be defined.
Recent works, ILFO (Haque et al. (2220) and DeepSloth (Hong et al. (2020), have evaluated energy robustness of Adaptive Neural Networks (AdNNs) by proposing white-box attack. However, optimizing the loss function proposed by the aforementioned AdNN attacks can not evaluate the energy robustness of Neural ODEs. AdNNs activate or deactivate certain components of DNNs based on the intermediate outputs of certain computing units and consumes a different amount of energy based on different inputs. Both the attack's 's objective is to increase the number of activated DNN components by modifying the specific computing unit outputs, and both attack use specific loss function optimization to achieve that. However, Neural ODE functionality is different than traditional AdNN functionality because, for Neural ODE, no component is deactivated or activated during inference. The adaptive behavior of Neural ODE model depends on the adaptive ODE solver used to predict the output. Furthermore, for a specific trained Neural ODE model, we can find variable energy consumption for single input depending on the type of ODE solver used, where for traditional AdNNs, energy consumption based on a specific input will be the same always for a specific trained AdNN. Therefore, a novel approach is needed to explore the energy robustness of Neural ODEs.
To explore the energy robustness of Neural ODEs, We propose NODEAttack, a white-box ap- proach that uses step-size of the ODE solvers to formulate attack. ODE solvers use an iterative way to approximate function, and the objective of our approach is to increase the number of iterations, increasing the energy consumption of Neural ODEs. Our attack formulation is based on the fact that decreasing step-size would increase the number of iterations. Specifically, we develop two attack techniques to evaluate Neural ODE's energy robustness, namely Input-based attack and Universal attack. Input-based attack evaluates energy robustness where testing inputs are semantically mean- ingful to the Neural ODE model (e.g., meaningful images). On the other hand, Universal attack evaluates worst-case energy robustness where each testing input maximizes the energy consumption for each target ODE solver. To the best of our knowledge, this is the first energy- -ased adversarial attack against Neural ODEs.
We evaluate NODEAttack on mainly two criteria: effectiveness and transferability using the CIFAR-10 and MNIST datasets (Krizhevsky et al. (2009); Deng (2012)) We evaluated NODEAttack
popular ODE solvers: Dopri5 (Dormand and Prince (1980) and Adaptive Heun Süli and Mayers (003). We evaluate the the effectiveness of NODEAttack against natural perturbations and corruptions Hendrycks and Dietterich (2019)). We observed that NODEAt tack generated adversarial inputs can increase up to 168 % energy consumption than the average energy consumed by benign test inputs. Also, we noticed that transferability is feasible between two Neural ODEs differentiated by ODE solver or model architecture.
Our paper makes the following contributions:
Problem Formulation and Approach. Our work is the first attempt to formulate energy- based adversarial attack against Neural ODE models. Also, our work proposes a novel loss function based step-size of ODE solvers to generate adversarial inputs.
* Evaluation. We evaluate our approach across two ODE solvers and two datasets based on two criteria.
2 BACKGROUND AND RELATED WORKS
2.1 NEURAL ORDINARY DIFFERENTIAL EQUATIONS
Neural Ordinary Differential Equations (Neural ODE) Chen al. (2018) have been successful in attaining accuracy close to the State of the Ant DNN techniques but with lesser memory con- sumption. Neural ODEs incorporate Ordinary Differential Equations solvers into Neural Network
2

---

Under review as a conference paper at ICLR 2022
architectures. Models such residual networks and recurrent neural network decoders create com- plicated transformations by devising a sequence of transformations to hidden state:
h4+1 h4 f(h,,0,)
Operation residual block can be interpreted as the discrete approximation an ODE where the discretization step value is one. In neural ODE, the discretization step is set zero and the relation between input, and output is characterized by the following set of equations:
dh(() f(h(()),,,)),(()) = hin, hout h(T) dt
Solving h(T) gives the output and ODE solvers can be used for that purpose.
Additionally, Proposed work by Quaglino et al. (2019) expresses the Neural ODE dynamics as truncated series of Legendre polynomials and accelerate the model. Dupont et al. (2019) explores the limitations in approximation capabilities of neural ODEs because of the preserving of input topology. Recent work by Yan et al. (2019) explore the robustness of Neural ODEs against Neural ODEs and propose TisODE to increase the robustness of Neural ODEs. However, no other work has focused on the energy robustness perspective or Neural ODEs, and to our knowledge, this is the first work in that direction.
2.2 RUNGE KUTTA METHOD
Runge Kutta method (Runge 1895 Kutta 1901)) ) is an ODE solver which solved ordinary differ- ential equations through approximation. Forst-order differential equation given by,
dy((t) dl with y(t)) yo Here is an function of time & and y" is the value of y at & 0. Four slope approximations k,, k2, k3; ka are used to estimate approximate value of y (y*) at to (Detailed equation in Appendix).
f(((),tt)
Final estimate of y² (to + h) can be represented as,
1
(to + h)) y h)) + ./
k3 ks).h
3
Here, the step size. This is called fourth order Runge Kutta Method, because the local error (approximation at a particular time for step-size h is O(h²). For better approximation of function, multiple works (Dormand and Prince (1880); (Süli and Mayers 2003)) have proposed to use adaptive step size.
2.3 ADVERSARIAL EXAMPLES
Adversarial Examples are the inputs that are fed to machine learning models to change the prediction of the model. In earlier works by Dalvi et al. (2004); Lowd and Meek (2005); D..owwd and C.Meek (2005). 'good word attacks' or spelling modifications have long been used to bypass the spam filters. More recently, SZegedy al. (2013) and Goodfellow et al. (2014) propose adversarial attacks on deep computer vision models. Karmon et (2018) propose technique to attack CNNs in which localized patch is introduced in an image instead of adding noise the full image. With a similar approach, adversarial attacks have been extended to various fields like text and speech processing (Carlini et al. (2016); Jia and Liang (2017)), and graph models (Zügner et al. (2018): [Bojhhevsk and Günnemann (2019)). Recently, Haque et al. (2020); Hong et al. (2020) have proposed adversarial energy based attacks against Adaptive Neural Networks. However, as mentioned in the introduction, existing attacks can not be used to increase energy consumption of Neural ODEs.
3 ADAPTIVE NATURE OF NEURAL ODE
In this section, we discuss the reason of adaptive energy consumption of Neural ODEs. As discussed in Section ODE solvers use iterative approximation to calculate the function value at certain
3

---

Under review as a conference paper at ICLR 2022
point. If the number of iterations is increased, the function is needed be calculated for higher number of times, increasing the energy consumption the process. The number of iterations can be increased by decreasing the step-size, which we discuss in Section
We also have investigated the adaptive nature of Neural ODEs through preliminary study. We have trained Neural ODE CNN model (Chen et al. (2018)) with MNIST (Deng (012)) training data and used the MNIST test data for inference. For ODE solver, we used dopri5 (Dormand and Prince (9800) ODE solver. For each test data, we measure energy consumption using Nvidia TX2 server.
100
From the results, we have noticed that ODE solver takes different number of iterations (3 and 4 in this experiment) approximate function. Figure describes our findings. When the number of iterations 3, average energy consumption drops more than 15J. However, the range of inference energy consumption is limited is low for benign in-distribution data.
Figure 1: Difference in en- ergy consumption with differ- ent number of iterations,
NODEATTACK
We elaborate the approach of NODEAttack through this section. First, we define two types of energy robustness in this section. Based on the definitions, we formulate the problem and propose two type of energy attacks against Neural ODEs.
4.1 ENERGY ROBUSTNESS
We define energy robustness for Neural ODEs in two ways: Input-based Energy Robustness (E;) and Universal Energy Robustness (E.). E, defined based on the maximum energy consumed by the model for input which belongs to the training data distribution of the model. Let assume, DNN f. We want to add perturbation 6 to x such that energy consumption is maximum. In that scenario, E2 can be represented as,
an imput that within the data distribution
E, max (N belt
where R is set of admissible perturbations such that remains within distribution, and ENG, represents the energy consumption of DNN f.
E, be described based the highest possible energy consumed by model for any input. Inputs used to measure E,, can be oot-of-distribution inputs also. For a DNN / and any input v, Ey can be represented as,
Eg = max (NG,(x)
where ENG, represents energy consumption of DNN. As E, and E., represents the highest energy consumption in two different cases, if increase the the value of E; and Eu, the maximum energy consumption of the model would decrease. As our objective to decrease model's maximum energy consumption, by increasing the value of EA and E,,, energy robustness of model be increased.
4.2 PROBLEM FORMULATION
The objective of our approach is to create adversarial samples which can increase energy consump- tion of Neural ODEs. For this purpose, we mainly focus on increasing the number of iterations needed for approximation in ODE solvers. As the energy consumption to approximate value at any point using ODEs does not vary significantly across all the points, increasing the number of iteration would increase the energy consumption in Neural ODEs.
The number of iteration in an ODE solver is dependent on the step size. Each ODE solver approxi- mates the function based on differentiation of the function at different instance and step-size. ODE solvers modify the step-size based on the function slope. the slope high, then smaller siep-size is required for the approximation. For smaller siep-size, the solver would use more iteration for approximation causing higher energy and time consumption. However, the slope is low, larger step size be used for approximation.
4

---

Under review as a conference paper at ICLR 2022
For ODE solvers, step-size is modified based difference in approximations when the function is approximated multiple times at time t. The multiple approximations can be performed with differ- ent step-size, with using higher order and a lower order approximation (Press and Teukolsky (. For example, Runge- Runge-Kutta- Fuhthr-e (Fehlberg 1969) Method creates two different Runge Kutta method with different orders (order four and five), but with same intermediate values The fifth order approximation at time & to + h can be represented as,
ytu + h) (to) + cl.A; c2.b2 c3.ks c4.kg + c5.kg + c6.ke
and, the fourth order approximation at time = tu h is,
(Lo h) (to) dl.k d2. d3.kg d4. d5.ks d6.ks Here, k1, R2, K3. Re. ks, kg are the intermediate values, c2, c3, e4, c5, c6, d2,d2, d3, d4, d5, d6 are the constants. The difference between both approximations can be defined as error estimate,
A y
Based on the value of A at a certain I, next step-size is calculated. If the error value A is greater than certain desired error value, then the step size is decreased than the previously used step size, on the other hand, if A is lesser than the desired eπrоr value, the step size is increased. Therefore, it can be concluded that the adaptive step size dependent on A.
As the adaptive step size is dependent on A, and the A is dependent on multiple approximations of the function, we can refer that the adaptive- stappivv-step-size dependent of the initial value of (fo)- Therefore, for Neural ODE, the adaptive-step-siiz and the number of iterations to approximate function will be function of the model input. We assume that a solver takes N N(X) iterations to approximate function for imput X, where h2 (X), (X)),, (XX) is the step-size used for N iterations. We define the average step-size as,
havg (X) (X) + h2 + hx(())
N(X)
We have mainly two objectives. Our first goal is to find the input X for which Mang (X) is minimum to evaluate the Universal Energy Robustness (F,,) of Neural ODEs.
Xade argmin hoeg (X)
X
Our second objective is to evaluate Input-based Energy Robustness of Neural-ODEs. To address that, find the perturbation 6, which can be added to an in distribution input X such that havg (X 8) is minimum.
Sadv argmin hang (X 8cR
Here, R is set of admissible perturbations such that x 8 remains within distribution
4.3 APPROACH
For exploring the energy robustness of Neural ODEs, we use a gradient-based optimization tech- nique to create adversarial inputs. Based on the objectives defined in Section 4.2 we propose two strategies to evaluate Neural ODE: Input-based attack and Universal attack.
Input-based attack. In this approach, we create adversarial inputs for each input image such that the semantic meaning of the imput is preserved. We assume that æ is a test input. Our objective is to find perturbation 6, adding which the energy consumption of the model increases. We can define the problem as,
minimize(lā] e- f(x 5)) such that, (x + 5) [0,
(1)
where f(x 8) havg (r 8) and e is predefined constant. If c value increases. the average step size would have greater weightage in the optimization problem, leading to more noisy input.
The algorithm is explained through Figure 2 and Algorithm The algorithm be divided into following parts. Initializing Perturbation is the first step where we initialize different variables, in- cluding perturbation, which are going be modified by the optimization. All the next steps
For the equation mentioned in Section
2.2 k1,...4 the intermediate values
5

---

Under review as a conference paper at ICLR 2022
performed iteratively. In the second step (Get Step Size), the average step size of the ODE solver is calculated based on the modified input generated after adding the initialized perturbation to imput image. Next, we calculate the loss function value based average step size and optimize the func- tion (Optimizing Loss Function). Then, we denormalize and normalize the modified input to nullify the effect of information loss due denormalization (Denormalizing and Normalizing Adversarial Input). Next, we consider the perturbation added to denormalized input as updated perturbation and calculate the number of steps induced by denormalized input. If the current number of steps is greater than previously recorded number of steps, we store the current input perturbation as most successful perturbation (Update Perturbation and Record Most Successful Perturbation). All the aforementioned steps are explained below.
Initializing Perturbation: This step is used for initializing vari- ables. We initialize perturbation (0), maximum recorded iteration of ODE solver(Mas aax_a,, and highest energy-consuminn adversarial input (X best) (Line 2). Number of iterations (7" is also initialized (Line 3).
Benign Inputs
Adversarial Inputs
Record Most Successful Porturbation
Perturbation
Get Step Size
Optimize Function
Denormatizing and Normalizing
Perturbation
Get Step Size: In this step, per- turbed image (X') is generated by adding initialized perturbation (d) to the input image (X) (Line 6). Then, scale method re-scales the X' using tanh function. Next, method (Line 7).
Figure 2: Overview of Input-based Attack
average step size of the solver for X' is received using
Optimizing Loss Function: In this step, the loss function value is calculated first. The loss func- tion consists of two components: first, the euclidean distance between the input image (X) and perturbed image (X') (calculated on Line 8), and the average step size (hang). The loss function optimized and updated perturbation (6_ (ō_new) and optimized loss function (L_new) is generated (Line 10). Perturbation variable (6) is updated using 6 d_new (Line 11).
Denormalizing and Normalizing Adversar- ial Input: Adversarial attacks are generally performed on normalized inputs; therefore, while denormalizing the generated input, there can be information loss as the pixel values are discrete. We have noticed that those informa- tion losses can be significant in terms of energy consumption of the particular input. To make sure that the desired energy consumption of the final adversarial input can not be modified by the information loss, we denormalize and then again normalize the generated input X' (Line
Algorithm Input-based Technique
1:
procedure INPUT-BASED TUCHNIQUE(X.O) Instialize 6,X best, max N *+numbbrrcg off iiterations of
2.
3:
4:
5:
while iter < do
6:
X scatel6 + X)
7:
havg avg step leegggstep.ssaee sizel (X))
8:
dist distance(X (X)
9:
I. dist + huvn
new, 6 new optimizer(4..6
11:
5_new
12:
X" + denormalize((X")
13:
X normalize((* (X")
12 and 13). By adding this step, we ensure that there will not be any information loss while de-
14:
N get no of steps(X")
moz_N < then
16:
X best X""
normalizing the final adversarial input.
max - N
18:
Update Perturbation and Record Most Suc- cessful Perturbation: In this step, first, we cal-
19:
end while
20:
procedure
culate number of steps induced by X" (Line
14). If the current number of steps in ODE solver (JV) is greater than the recorded maximum number of iterations (max N) (Line 15), max N variable is updated (Line 17) and the current adversarial input is recorded as highest seeegy-coonuming adversarial sample (X X_best) (Line 16). When the iterations are finished, X best is returned as the perturbed output image.
Universal attack. For Universal attack, we create adversarial inputs for which the energy consump- tion of the model during inference will be highest. In this approach, we do not preserve the semantic meaning of input. Therefore, we do not need to minimize the perturbation (0) added to the input. Hence, ó is not required to define Universal attack. Similarly as equation I we can define universal

---

Under review as a conference paper at ICLR 2022
attack as,
minimize([(x+ 6)) such that, (x+ 0) [0. 1J where a is the input and (a + 5) Nang ( 8).
5 EVALUATION
We evaluate the performance of our techniques two popular different adaptive ode solvers, Do- prif (Dormand and Prince (1980) and Adaptive Heun (Süli and Mayers (2003)). We explore the Effectiveness and Transferability of NODEAt through this section. To evaluate effective- ness of NODEAt we evaluate how much increase in energy consumption is achievable by NODEAttack on different datasets. To evaluate transferability of NODEAtta ck, explore if ad- versarial inputs generated for one solver/architecture can increase the energy consumption for other solver/architecture..
5.1
EXPERIMENTAL SETUP
Datasets and Models. For evaluation, CIFAR-10 dataset (Krizhevsky et al. (2009) and MNIST dataset (Deng (2012)) have been used for the training of the Neural ODE model. We use ODENet Convolutional Neural Network (CNN) models proposed by Chen et al. (018)) as the trained Neural ODE models. The main difference between model architectures used for CIFAR-10 and MNIST is in the input number of channels. For generating Input-based attack we consider c=10000 for CIFAR- 10 and c=1000 for MNIST dataset.
Baseline. As there are no existing energy-based attack on Neural ODEs, we compare our technique with natural corruption and perturbation techniques (Hendrycks and Dietterich (2arericcc((00gbgg (2019b) for CIFAR- 10 dataset. These techniques are commonly used (Xie et al. (2020); Geirhos et al. (2018); Ovadia jet al. 2019)) to evaluate the robustness of neural networks. For MNIST dataset, we use random Gaussian noise (Cattin) 2013) as baseline.
Hardware Platform. We use the Nvidia Jetson TX2 board for our energy consumption calculations used to evaluate Neural ODEs. To avoid noise in calculated energy consumption, we measure the energy consumption an inference 20 times, discard the outliers and measure the mean of the remaining values.
5.2 EFFECTIVENESS
We have measured the ef- fectiveness of Input-based attack by measuring the average increase in energy consumption (in Joule) during the inference with respect to benign inputs, where measure the effectiveness of Univer-
Efrect deferere Doert
240
:30
:20
:30
sal attack by recording the highest energy con- sumption achieved by the adversarial examples during the inference. We measure the effectiveness of our approach for CIFAR-10 and MNIST datasets. For CIFAR-10 dataset, we use images generated by common perturbations and corruptions as baseline. Effec- tiveness of Universal attack has been measured against the corruption techniques because, in both cases, the noise present in the input is human perceptible. As the Input-based attack adds small perturbation to the input, the effectiveness of Input- based attack is measured against the perturbation techniques. For comparison, we use the five best performing corruptions and perturbations in terms of average energy consumption.
(a) DopriS (Universal)
(b) Heun (Universal)
Figure
Energy consumption induced by Universal and corruption techniques on different ODE solvers

---

Under review as a conference paper at ICLR 2022
Figures and show the effectiveness of NODEAttack Dopri5 and Adaptive Heun solvers for CIFAR-I0 datasets. It can be observed that, for all four scenarios, NODEAttack is able to generate higher energy consuming examples than bascline methods. For Universal attack, NODEAt able to increase 125% and 50% of the energy consumption spect average energy consumed by benign CIFAR-10 test data, for Adaptive Heun and Dopri5 solvers, respectively, For Input-based attack, for Adaptive Heun and Dopris solvers respectively, NODEAttack is able increase 47% and 30% the energy consumption (in average) of Neural ODE model than energy consumed by CIFAR- 10 test images.
Neural ODE model with re-
For MNIST dataset, the av- erage energy consumption increased by Input-based
Increase in Consumption 01
Increase Concumption
202
25-
attack is 72J (31.85% avg increase) and 15J (21.4% 4%%
300-
avg increase) for Adaptive Heun and Dopri5, respec- tively. For the same datat- set, Gaussian random noise can increase 7.9J (3.5% avg increase) and 2. (2.94% avg increase) for Adaptive Heun and Dopri5, respec- tively. Therefore, Input-based attack outperforms the baseline in terms of increase in energy con- sumption. For Universal attack, the average energy consumption induced for Adaptive Heun solver 625J (168% increase than average energy consumed by MNIST test data), where the average en- ergy consumption induced for Dopri5 solver is 100J (42.8% increase than average energy consumed by MNIST test data).
Per
Per
Fe5
Per Per3
Park
18
(a) Dopri5
(h) Heun
Figure 4: Energy consumption increased by input-based and Pertur- bation techniques on different ODE solvers
5.3 TRANSFERABILITY
In this section, we try to evaluate the transferability of the Input-based attack on different ODE solvers and on network architectures. To measure the transferability, ages randomly. To evaluate the transferability of our attack, we will measure two parameters: 1. What percentage of adversarial inputs increase the energy consumption for the other solver/architectree? This is called Input Transferability Percentage (TTP) 2. What is the average per- centage increase in energy consumption enforced by adversarial inputs in other solver/architeettre? This is called Effectiveness Transferability Percentage (ETP), To evaluate solver-based transferabil- ity, we consider two aforementioned solver with same network architecture. Table D shows our findings. We can observe that transferability can exist between two solvers. It can be noticed that created adversarial inputs for Adaptive Heun are more effective against Dopri5 solver in terms of transferability.
have selected 1000 im-
To evaluate network- beaser--based transferability, we consider Adaptive Heun ODE solver with two different Neural ODE architecture (MI and M2). MI is the larger model that has an ex- tra convolutional layer than M2. For M2 to MI transferability, the ITP is 61.8%, however the ETP is lower (2.6%). For M1 to M2 trans- ferability, the ITP is 80%, and the ETP is slightly higher than previously calculated ETP (4.8%). Therefore, we can observe that cross- architectural transferability is feasible for this attack. Additional evaluation on transferability can be found in the appendix.
Type
A$
Dopriš
Adaptive Heun
BS
Dopris
83.3
Adaptive Heun
92.5
Dopriš
17.09
ETP
Adaplive Heun
27.2
Table ITP and ETP values for measuring trans- ferability between Dopri5 and Adaptive Heun solvers. AS represents Attacked Solver and BS represents Base Solver.
CASE STUDY.
Through a case study, we have tried to demonstrate practical scenarios which can show the adverse effects of energy attack on Neural ODEs. In this section, discuss how NoDeAttack generated
8

---

Under review as a conference paper at ICLR 2022
samples can be used to design poisoning attack against Neural ODE based executable models, which are used for mobile applications. The poisoning attack is designed based on the features of popular
DNN compilers; therefore, will briefly discuss the functionality of DNN compilers first.
DNN compilers Li et al. (2020) are used to generate exccutable models for resource-constrainee devices because Deep Learning (DL) libraries have not been able to use the hardware efficiently. DNN compilers take the model definitions described the DL frameworks as inputs and then gen- erate efficient code implementations on various DL hardware
outputs. The generic architecture of DNN compiler can be divided into two parts: frontend and backend. Each part uses specific intermediate data representation (IR). The frontend takes a DL model from existing DL frameworks as imput Then transforms the model into the computation graph representation. DAG-based IR (in frontend) one of the most traditional ways for the compilers build a computation graph. this IR, operators and tensors are treated as nodes and edges, respectively and they are organized as directed acyelic graph (DAG). It has deficiencies such as semantic ambiguity caused by the missing definition of computation scope.
The poisoning attack designed based on the feature of popular DNN compilers: The compu- tational graph generated to create executable model by the DNN compiler is Directed Acyclic Graph. The generated computational graph is created using a base input sample. When we feed a Neural ODE model to generate an exccutable, the generated graph assumes that the step-size cal- culated for the base sample is static for all samples (because the adaptive step size calculation is not captured through DAG). Because of the feasible cross-solver and cross-network transferabil- ity, if NODEAt ack generated energy surging adversarial examples as the base sample, the energy consumption for each input will be high.
Experiment. In this experiment, we use two Neural ODE executable models with Adaptive Heun ODE solver to detect objects through a mobile application. Both executable models are generated based on a base CNN trained on CIFAR-10 dataset. The first executable file is initialized with benign sample (no of iterations 43), where the second executable file is initialized with an adversarial energy-surging sample generated through Input-based attack (no of iterations = 88). To create the executable files, we use pytorch mobile (Paszke al. (2019)). Based on each executable model, we create an android application. For each application, we feed inputs to the model till the battery drained fully. We also ensure that there is no other application running on the mobile during the same time.
For the executable file initialized with the benign sample, the number of classifications completed by the model is 38. before the battery is drained fully. While for the exccutable file initialized with the adversarial sample, the number of classifications done by the model is 15,102 before draining out the battery. We can notice that the adversarial examples can reduce the efficiency of the applications by approximately 50%.
7 CONCLUSION
In this paper, we have proposed NODEAttack Io show the vulnerability of Neural ODEs against energy-surging adversarial samples. Here, we have proposed two types of adversarial attacks: Uni- versal attack and Input-based attack. To the best of our knowledge, we are the first to explore energy-based attack against Neural ODEs. We also observe that adversarial examples generated by NODEAt t tack can be transferable. Finally, we show the impact of NODEAt t ack generated samples on mobile application.

---

Under review as a conference paper at ICLR 2022
REFERENCES
Aleksandar Bojchevski and Stephan Günnemann. 2019. Adversarial Attacks on Node Embeddings via Graph Poisoning. In Proceedings of the International Conference on Machine Learning. 695- 704.
Nicholas Carlini, Pratyush Mishra, Tavish Vaidya, Yuankai Zhang, Micah Sherr, Clay Shields, David Wagner, and Wenchao Zhou. 2016. Hidden Voice Commands. In Proceedings of the USENIX Security Symposium. 513-530.
Dr Philippe Cattin. 2013. Image restoration: Introduction to signal and image processing. MIAC, University of Basel. Retrieved (2013), 93.
Ricky TQ Chen, Yulia Rubanova, Jesse Bettencourt, and David Duvenaud. 2018. Neural ordinary differential equations. arXiv preprint arXiv: (2018).
Nilesh Dalvi, Pedro Domingos, Sumit Sanghai, Deepak Verma, al. 2004. Adversarial Classifica- tion. In Proceedings of the International Conference on Knowledge Discovery and Data Mining- 99-108.
Li Deng. 2012. The mnist database of handwritten digit images for machine learning research. IEEE Signal Processing Magazine 29, 6 (2012), 141-142.
D.Lowd and C.Meek. 2005. Good Word Attacks on Statistical Spam Filters. In Proceedings of the Second Conference on Email and Anti-Spam.
John Dormand and Peter J Prince. 1980. A family of embedded Runge- formulae. Journal of computational and applied mathematics 6, (1980), 19-26.
Emilien Dupont, Arnaud Doucet, and Yee Whye Teh. 2019. Augmented neural odes. arXiv preprint arXiv: 681 (2019).
Erwin Fehlberg. 1969. Low-order classical Slunge-Kutte formulas with stepsize control and their application to some heat transfer problems. Vol. 315. National aeronautics and space administra- tion.
Robert Geirhos, Patricia Rubisch, Claudio Michaelis, Matthias Bethge, Felix Wichmann, and Wieland Brendel. 2018. ImageNee-trained CNNs are biased towards texture; increasing shape bias improves accuracy and robustness. arXiv preprint arXiv:1811.122 (2018).
Ian J Goodfellow, Jonathon Shlens, and Christian Szegedy. 2014. Explaining and Harnessing Ad- versarial Examples. arXiv preprint arXiv: (2014).
Mirazul Haque, Anki Chauhan, Cong Liu, and Wei Yang. 2020. ILFO: Adversarial Attack
Adaptive Neural Networks. In Proceedings of the IEEE/CVE Conference on Computer Vision and Pattern Recognition. 14264-14273.
Dan Hendrycks and Thomas Dietterich. 2019a. Benchmarking neural network robustness com- mon corruptions and perturbations. arXiv preprint 1iXiv:1903,1226. (2019).
Dan Hendrycks and Thomas Dietterich. 2019b. Benchmarking neural network robustness to com- mon corruptions and perturbations. arXiv preprint /903. /226/ (2019).
Sanghyun Hong. Yigitcan Kaya, Ionut- Vlad Modoranu, and Tudor Dumitraş. 2020. A Panda? No, It's a Sloth: Slowdown Attacks on Adaptive Multi-Exit Neural Network Inference. arXiv preprini arXiv:2010.02433 (2020).
Robin Jia and Percy Liang. 2017. Systems. arXiv preprint 1rXivv1707.07333 (2017).
Adversarial Examples for Evaluating Reading Comprehension
Danny Karmon, Daniel Zoran, and Yoav Goldberg. 2018. LaVAN: Localized and Visible Adversar- ial Noise. arXiv preprint 1 00060000888800000000000002 (2018).
Alex Krizhevsky, Geoffrey Hinton, et al. 2009. images. (2009).
Learning multiple layers of features from tiny
10

---

Under review as a conference paper at ICLR 2022
Wilhelm Kutta. 1901. Beitrag zur naherungsweisen integration totaler differentialgliichunen. Z. Math. Phys. 46 (1901), 1355-53.
Mingzhen Li, Yi Liu, Xiaoyan Liu, Qingxiao Sun, Xin You, Hailong Yang, Zhongzhi Luan, Lin Gan, Guangwen Yang, and Depei Qian. 2020. The deep learning compiler: A comprehensive Survey. IEEE Transactions on Purallel and Distributed Systems 32, 3 (2020), 708-727.
Daniel Lowd and Christopher Meek. 2005. Adversarial Learning. In Proceedings of the Interna- tional Conference on Knowledge Discovery and Data Mining. 641-647.
Yaniv Ovadia, Emily Fertig, Jie Ren, Zachary Nado, David Sculley, Scbastian Nowozin, Joshua Dillon, Balaji Lakshminarayanan, and Jasper Snoek. 2019. Can you trust your model's uncer- tainty? Evaluating predictive uncertainty under dataset shift, arXiv preprint arXiv: (2019).
Adam Paszke, Sam Gross, Francisco Massa, Adam Lerer, James Bradbury, Gregory Chanan, Trevor Killeen, Zeming Lin, Natalia Gimelshein, Luca Antiga, Alban Desmaison, Andreas Kopf. Edward Yang. Zachary DeVito, Martin Raison, Alykhan Tejani, Sasank Chilamkurthy, Benoit Steiner, Lu Fang, Junjie Bai, and Soumith Chintala. 2019. PyTorch: An Imperative Style, High- Performance Deep Learning Library. Advances in Neural Information Processing Systems 32, H. Wallach, H. Larochelle, A. Beygelzimer, F. d'Alché-Buc, E. Fox, and R. Garnett
(Eds.). Curran Associates, Inc., 2024-8033 http: http:///appppeee.eeeerreaaa www.ips..ppppp.....
9015
Library.
pdf
William H Press and Saul A Teukolsky. 1992. Adaptive Stepsize Runge-Kutta Integration. Compul- ers in Physics (1992), 188-191.
Alessio Quaglino, Marco Gallieri, Jonathan Masci, and Jan Koutnık. 2019. Accelerating neural odes with spectral elements. arXiv preprint arXiv:1906.0008: 07038 (2019).
Carl Runge. 1895, Über die numerische Auflösung Differeetialgleichungen. Math. Ann. 46, (1895), 167-178.
Endre Süli and David Mayers. 2003. An introduction to numerical analysis. Cambridge university press.
Christian Szegedy, Wojeiech Zaremba, Ilya Sutskever, Joan Bruna, Dumitru Erhan, Ian Goodfellow, and Rob Fergus. 2013. Intriguing Properties of Neural Networks. arXiv preprint arXiv: 13 12.6199 (2013).
Qizhe Xie, Minh- Minh-Thang Luong, Eduard Hovy, and Quoe V Le. 2020. Self-training with noisy stu- dent improves imagenet classification. In Proceedings of the IEEE/CVF Conference Computer Vision and Pattern Recognition. 10687-10698.
Hanshu Yan, Jiawei Du, Vincent YF Tan, and Jiashi Feng. 2019. On robustness of neural ordinary differential equations. arXiv preprint 17X1v:1910.05513 (2019).
Daniel Zügner, Amir Akbarnejad, and Stephan Günnemann. 2018. Adversarial Attacks on Neural Networks for Graph Data. In Proceedings of the International Conference on Knowledge Discov- ery and Data Mining, 2847-2856.


Reviews:
[{"review_id": "lZG7gFQVQSr", "reviewer": "Reviewer_BU3E", "summary": "", "questions": "", "limitations": "", "rating": 6, "confidence": 4, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "Strengths\n\n+ The paper adds to the growing literature on neuralODEs which have gained more traction in resource-constrained devices due to their memory efficiency. It raises a very valid concern about the vulnerability of these models to energy attacks. The reviewer finds this to be the main contribution of the paper (based on the assumption that this is the first paper to do so). \n\n+ The paper defines energy robustness for Neural ODEs in two ways: Input-based Energy Robustness and Universal Energy Robustness (Eu). The first is defined based on the maximum energy consumed by the model for an input which belongs to the training data distribution of the model. The second can be described based on the highest possible energy consumed by a model for any input.\n\n+ The paper also evaluates the transferability of NODEAttack, that is, if adversarial inputs are generated for one solver/architecture can they also increase the energy consumption for other solver/architecture.\n\nWeaknesses/Issues that would make the paper stronger :\n\n- What would be the tradeoff between robustness and performance if the adaptive step-sizing was not used? \n\n- Could you add a discussion on how the presented observations and results on vulnerability of ODEs to energy attacks compare with those on other forms of adaptive inference? ", "summary_of_the_paper": "Neural ODE (Ordinary Differential Equation) models  have emerged as an effective architecture due to their low memory usage which makes them attractive for resource-constrained devices. Further, the inference in these models is adaptive. This paper investigates whether this adaptive inference can be used by an attacker to launch an energy attack on the neural ODEs. While energy attacks on adaptive inference has been studied before, this paper is the first paper (to the best of the knowledge of the reviewer) to study this on neural ODEs. This study is well-motivated, and the experimental evaluation is convincing (though it is far from complete in terms of the used attack methods or configurations of the used methods). 2 solvers and 2 datasets are used in the experiments. Overall, the paper definitely adds to the state of the art on neural ODEs and robust learning.   ", "summary_of_the_review": "The paper makes a clearly identifiable contribution to the literature by demonstrating energy attacks on neural ODEs. Hence, the reviewer leans towards accepting this paper. A more thorough analysis would have made the paper stronger and more influential. ", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "", "extra_scores": {"correctness": "3: Some of the paper’s claims have minor issues. A few statements are not well-supported, or require small changes to be made correct.", "technical_novelty_and_significance": "3: The contributions are significant and somewhat new. Aspects of the contributions exist in prior work.", "empirical_novelty_and_significance": "3: The contributions are significant and somewhat new. Aspects of the contributions exist in prior work."}, "extra_text": {}}, {"review_id": "lN4PHa4FTbu", "reviewer": "Reviewer_byMA", "summary": "", "questions": "", "limitations": "", "rating": 3, "confidence": 4, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "My major concerns are as follows,\n\n1. In Section 5.1, $E_i$ and $E_u$ are not clear. \na) The authors mention that 'We want to add perturbation $\\delta$ to x such that energy consumption is maximum'. However, why does the formula of $E_i$ and $E_u$ contain -max? They are very strange.\nb) On the other hand, Why $E_u$ does not contain perturbation $\\delta$?\nc) The authors mention 'By increasing the value of $E_i$ and $E_u$, energy robustness of a model can be increased.'. Why this statement holds?\n\n2. The paper writing is not clear and some parts of the paper are hard to understand. For example, \na) At the end of Section 4, the authors use '15J' to demonstrate the energy consumption. J is not clear. From my perspective, J should be Joule. Please make it clear.\nb) In Eq.(1), it is not clear which parameter needs to be minimized.\nc) In Eq.(1), What is c? Why do we need to use c?\n\n3. In Figure 1, why the average energy consumption is a line for the 'iters=3' case?\n\n4. In the 'Update Perturbation and Record Most Successful Perturbation' subsection of Section 5.3,  the sentence 'greater than the recorded minimum loss (max_N)' is not clear.\n\n5. In Eq.(2), why the minimization is only with respect to $f(x+\\delta)$? I understand this is for the universal attack. However, the authors should mention what is the significant difference between Eq.(1) and Eq.(2). Otherwise, Eq.(2) is very hard to understand.\n\n6. In the Baseline part of Section 6.1, the authors mention CIFAR-10-C and CIFAR-10-P. However, both of them should be in the part of the dataset instead of this Baseline part. Therefore, it is not clear what is the exact baseline methods. In addition, the authors mention two methods: corruption and perturbation techniques. Given only two methods' name is not enough. The authors should briefly introduce these two methods.\n\n7. At the end of Section 6.2, the authors discuss the experiments on the MNIST datasets. But why the authors do not provide figures to show the performance like Figures 3 and 4? This experiment setting is not clear enough.\n\n8. In Section 6.3, the authors mention 'we will measure two parameters: '. However, I think ITP and ETP both are evaluation metrics instead of parameters. And the authors should provide references for these two metrics and demonstrate they are widely used in the existing works.\n\n9. In Section 6.3, the authors mention 'the larger model has an extra convolutional layer than smaller mode'. However, it is not clear which model is large and which model is small.\n\n10. In Section 7. Why the no. of iterations on the benign sample and input-based attack are different? Since the number of iterations is different, it is hard to say the compared performance results. The comparison is not fair.\n\n11. In Algorithm 1, lines 12-18, Why X-best is based on the condition of max_N<N? According to Eq.(1), the authors would like to minimize $\\delta$. From my perspective, if the attack is successful and N<max_N, the perturbation should be updated and saved. Therefore, I believe this part of Algorithm 1 is not correct.  \n", "summary_of_the_paper": "In this paper, the authors proposed an attack model named NODEAttack to verify the vulnerability of Neural ODEs against energy-surging adversarial samples. The authors study two attack cases: Input-based attack (untargeted attack) and universal untargeted attack. The experiments on CIFAR-10 and MNIST datasets show the reasonable performance of the proposed model outperforms common perturbations and corruptions methods. A case study based on DNN compilers and PyTorch mobile demonstrates the generated adversarial examples can reduce the efficiency of real-world applications.", "summary_of_the_review": "In general, I feel this paper has several limitations on the technique. Some technical details are not correct. The paper presentation is not clear. Some experiment settings are not reasonable. \n\nI suggest reject this paper.", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "", "extra_scores": {"correctness": "2: Several of the paper’s claims are incorrect or not well-supported.", "technical_novelty_and_significance": "2: The contributions are only marginally significant or novel.", "empirical_novelty_and_significance": "2: The contributions are only marginally significant or novel."}, "extra_text": {}}, {"review_id": "UI8BOj5pq3L", "reviewer": "Reviewer_BRCY", "summary": "", "questions": "", "limitations": "", "rating": 3, "confidence": 4, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "### Strengths:\n- New energy consumption attack against Neural ODE models (previous works consider energy consumption attacks against Adaptive Neural Networks).\n\n### Weaknesses:\n- The paper is poorly organized and can be improved, e.g. 'Background' and 'Related works' sections can be merged together. Section 4 can be expanded to include more background information about Neural ODE.\n- Description of the equations can be improved. Some equations have errors, e.g. eq. 1 on p. 5 minimize the regularized loss: δ + c × f(x + δ), when it should be: |δ| + c × f(x + δ).\n- The optimal attack is selected only to increase the number of ODE iterations (line 15-17 in Algorithm 1). Trade-offs between the attack success rate and the attack energy consumption can be considered.\n- The authors didn't consider a simple detection strategy based on the number of ODEs iterations on benign examples. It will be interesting to see if the proposed attack can be circumvented using this simple defense.\n- Input-based Energy Robustness Attack is not very successful and doesn't increase energy consumption significantly. Universal Energy Robustness Attack is more successful but might produce out-of-distribution examples, which might be easily detected. The authors should perform additional analysis to consider the detection of adversarial examples generated by the Universal Energy Robustness Attack.\n", "summary_of_the_paper": "The authors propose an adversarial test-time attack on Neural ODE models, which increases the inference time of the NODE models. Two variants of the attack are introduced. The proposed attacks are evaluated on CIFAR10 and MNIST datasets. In experiments, the authors showed the proposed attacks increased the inference time of NODE models for object detection task, which drained the battery faster on mobile device.\n", "summary_of_the_review": "The authors introduced an energy consumption attack on Neural ODE models, which is a novel application of energy consumption attacks. This is a novel application idea, but the idea is not technically novel. Furthermore, the paper is poorly organized, and experimental analysis can be improved. For example, the authors can add the analysis with simple defense strategies such as thresholding the number of ODEs iterations or out-of-distribution detection of adversarial examples generated by universal energy attack.\n", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "", "extra_scores": {"correctness": "3: Some of the paper’s claims have minor issues. A few statements are not well-supported, or require small changes to be made correct.", "technical_novelty_and_significance": "2: The contributions are only marginally significant or novel.", "empirical_novelty_and_significance": "2: The contributions are only marginally significant or novel."}, "extra_text": {}}, {"review_id": "BcbY6ZHLla", "reviewer": "Reviewer_v5cj", "summary": "", "questions": "", "limitations": "", "rating": 6, "confidence": 4, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "Instead of common performance/accuracy robustness, this paper considered the uncertainty of energy consumption of neural ODE models. This is very interesting and inspires the community to move eyes on the robustness of ML algorithms in terms of other metrics besides the performance. \n\nThis paper proposed two notions of energy robustness, the input-based energy robustness $E_i$ and the universal energy robustness $E_u$m. It used an intuitive metric, the average step_size $h_{avg}$, to measure the energy consumption.\n\nThis paper focuses on two adaptive ODE solvers, Dopri5 and Heun. Experimental results on MNIST and CIFAR10 demonstrate the effectiveness and transferability of the proposed attack. \n\nSome questions:\n1. The imperceptibility: The generated data in the appendix seem very noisy and easy to distinguish from clean data. How well does the attack perform if the budget is limited to be small?\n2. The adversarial data are crafted for the energy-consumption attacks. How much do they affect the test accuracy?\n3. Can the authors discuss a bit on the defense of these adversarial examples? ", "summary_of_the_paper": "This paper considered the robustness of energy consumption of neural ODEs and proposed NODEAttack to generate adversarial inputs that maliciously increase the computation overhead of NODE solvers. Experimental results verify the effectiveness of the proposed NODEAttack and the transferability among different ODE solvers.", "summary_of_the_review": "I will update this part after the review phase...", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "", "extra_scores": {"correctness": "3: Some of the paper’s claims have minor issues. A few statements are not well-supported, or require small changes to be made correct.", "technical_novelty_and_significance": "3: The contributions are significant and somewhat new. Aspects of the contributions exist in prior work.", "empirical_novelty_and_significance": "2: The contributions are only marginally significant or novel."}, "extra_text": {}}]

Author rebuttal:

Meta-review: The paper proposes an energy consumption attack to neural ODE models. There are two complains from the reviewers: 
- Although this is a new application to energy consumption attack, most of the attack techniques are simple extensions to the previous attack papers, so the novelty is questioned by some of the reviewers. 
- The paper is poorly written. 
We therefore decide to reject the paper and encourage the authors to address the concerns in their next submission. Reviewers also think a careful discussion about the defense or detection mechanism against the proposed attack will be a good thing to add.
Decision: Reject