TransSlowDown: Efficiency Attacks on Neural Machine Translation Systems
Authors: Simin Chen
Mirazul Haque
Zihe Song
Cong Liu
Wei Yang
Venue: ICLR 2022 Submitted (2022)

Abstract: Neural machine translation (NMT) systems have received massive attention from academia and industry.  Despite a rich set of work focusing on improving NMT systems’ accuracy, the less explored topic of efficiency is also important to NMT systems because of the real-time demand of translation applications. In this paper, we observe an inherent property of the NMT system, that is, NMT systems’ efficiency is related to the output length instead of the input length. Such property results in a new attack surface of the NMT system—an adversary can slightly changing inputs to incur a significant amount of redundant computations in NMT systems.   Such abuse of NMT systems’ computational resources is analogous to denial-of-service attacks. Abuse of NMT systems’ computing resources will affect the service quality (e.g., prolong response to users’ translation requests) and even make the translation service unavailable (e.g., running out of resources such as batteries of mobile devices).  To further the understanding of such efficiency-oriented threats and raise the community’s concern on the efficiency robustness of NMT systems, we propose a new attack approach, TranSlowDown, to test the efficiency robustness of NMT systems. To demonstrate the effectiveness of TranSlowDown, we conduct a systematic evaluation on three public-available NMT systems: Google T5, Facebook Fairseq, and Helsinki-NLP translator.  The experimental results show that TranSlowDown increases NMT systems’ response latency up to 1232%and 1056% on Intel CPU and Nvidia GPU respectively by inserting only three characters into existing input sentences. Our results also show that the adversarial examples generated byTranSlowDowncan consume more than 30 times battery power than the original benign example. Such results suggest that further research is required for protecting NMT systems against efficiency-oriented threats.

Under review as a conference paper at ICLR 2022
TRANSLOWDOWN: EFFICIENCY ATTACKS ON NEURAL MACHINE TRANSLATION SYSTEMS
Anonymous authors
Paper under double-blind review
ABSTRACT
Neural machine translation (NMT) systems have received massive attention from academia and industry. Despite rich set of work focusing on improving NMT systems' accuracy, the less explored topic of efficiency is also important to NMT this paper,
systems because of the real-time demand translation applications. we observe inherent property of NMT system, that is, NMT systems' efficiency is related to the output length instead of the input length. Such property results adversary slightly changing inputs
new attack surface of NMT system to incur significant amount of redundant computations NMT systems. Such abuse of NMT systems' computational resources is analogous to the denial-of- service attacks. Abuse of NMT systems' computing resources will affect the ser- vice quality (e.g,, prolong response users' translation requests) and even make the translation service unavailable (e.g., running out resource such as batteries of mobile devices). To further the understanding on such efficiency-oriente threats and raise community's concern on the efficiency robustness of NMT systems, we propose new attack approach, Trans TranslowDowe lowDown, test the efficiency robustness of NMT systems. To demonstrate the effectiveness of TranS duct a systematic evaluation on three public-available NMT systems: Google T5, Facebook Fairseq, and Helsinki-NLP translators. The experimental results show that TranSlowe SonSoowDon can increase NMT systems' response latency up to 1232% and 1056% on Intel CPU and Nvidia GPÜ respectively by inserting only three characters into existing input sentences. Our results also show that the adversarial examples generated by Twwww can consume more than 30 times battery power than the original benign example. Such results suggest that further research is required for protecting NMT systems against efficiency-orientee threats.
con-
INTRODUCTION
Recently, Neural Machine Translation (NMT) systems have received massive attention from academia and industry (Bahdanau et al.] 2015 Kalchbrenner et al.] 2016; Vaswani et al., 2017] Belinkov & Bisk 2018). NMT systems overcome many weaknesses of traditional phrase-based translation models and can capture long dependencies in sentences; thus, they are widely used in commercial translation systems. For example. Microsoft has deployed the NMT systems in many commercial products since 2016 (Hassan Awadalla et al. 2017 2018a b) Gu et al. 2018); Google Translate claims have translated over 100 billion words daily 109 languages (Turovsky) 2016
Caswell & Liang 2020 Pitman 2021).
For NMT systems, efficiency is critical because of translation applications' real-time demand (Tu et al. 2017: Guo et al., 2019 Xia et al. 2019). However, it is unknown whether NMT systems are robust against efficiency-oriented adversarial pressure. Despite a rich set of works (Cheng et al.)
2020 Jin et al. 2020; BBelinkov & Bisk] 2017, Cheng al.) 2019; Wu et al. 2018 Yang et al.
2017 evaluate NMT systems' accuracy robustness through maximizing the errors, understanding
the NMT systems' efficiency robustness has not received much attention.
In order to study NMT systems' efficiency robustness, we first need to figure out what factors will affect NMT's efficiency. In this paper, we observe natural property of NMT systems, i.e...MTT NMT's
computational consumption is volatile for different inputs because NMT systems invoke the under- lying decoder with non-deterministic numbers of iterations generate output tokens (Vaswani al.

---

Under review as a conference paper at ICLR 2022
2017 Liu al. 2020). This property exposes new vulnerability of NMT systems, adversary can design specific inputs to cause enormous computation overhead in NMT systems, thus wasting the computational resources of NMT systems. Based on such observation. in this paper, we investigate: Can adversary make slight modification on textual inputs to increase NMT systems' computational consumption and decrease NMT systems' efficiency? If so, how severe the efficiency degradation can be?
New Vulnerability. We consider a new attack surface of NMT models, analogous to the vulner- abilities leading to the denial of service (DoS) attacks (Zhang et al., 2013 Qin et al., 2018 that have plagued the security committee for decades. Specifically, the adversary' goal to decrease the victim NMT system's 's efficiency (i.e.. response latency, energy consumption) with unnoticeable perturbations on the inputs to the system. This attack will result in devastating consequences for many real-world applications. For example, abusing computational resources on commercial ma- chine translation service providers (e.g. Huggingface (Wolf al., 2020)). An efficiency attack will cause enormous redundant computational resources and affect the service quality of benign users. Furthermore, abusing computational resources on mobile devices or loT devices might shorten the battery charge cycle and result in the unavailability of the devices.
New Attack. In this paper, we evaluate NMT systems' efficiency robustness by generating adver- sarial inputs that consume much greater amount of computation resources than normal inputs on NMT systems. Specifically, we propose Trans1 owDown, which is based on the observation that the source of vulnerability is that NMT systems' efficiency is related to the output length instead of the input length. Specifically, NMT systems iteratively compute the output token until the systems generate the particular end of sentence (EOS) token. Thus, we design a novel algorithm to search for a minimal perturbation to delay the appearance of EOS. Specifically, TranS lowDown can generate both token-level and character-level perturbations. After applying the minimal perturbation on the benign sentences, the probability of EOS of output token will decrease, resulting longer output that costs NMT systems more computational resources.
Evaluation. To evaluate the effectiveness of TranslowDown. we use TranS lowDown to attack three public-available NMT systems (i.e. Google T5 (Raffel et al. 2019), Facebook FairSeq (Liu al. 2020), and Helsinki-NLP), and compare
against two accuracy-based attack algorithms. We first measure the floating-point operations (FLOPs) and response latency of the vic- tim NMT systems when translating benign and adversarial examples. Then, we apply I-FLOPs and I-Latency (defined in Equation 4 to quantify the severity of efficiency degradation caused by gener- ated adversarial examples. The evaluation results show: for the token-level attack, TranS] owDown generate adversarial examples increase victim NMT systems' FI.OPs, CPU latency, GPU latency up to 2131.92%, 2403.21%, %,, and 2054.83% respectively with only perturbing two tokens in sen- tences; for the character-level attack, TranS 1ranSlowDown owDown generated adversarial examples increase victim NMT systems' FLOPs, CPU latency, GPU latency up to 1102.86% 86%, 1232.71% and 1056.88% respectively with only inserting three characters in sentences. We also form real-world case study to demonstrate the negative impact of the efficiency threat. Specifically, we deploy Google's T5 on mobile device and investigate how adversarial examples affect the mobile device's battery power consumption. The results show that by inserting only one character into the benign sentence, the ad- versarial examples generated by TranS] owDown can consume more than 30 times battery power than the original benign example. Our results suggest that further research is required for protecting NMT systems against this emerging security threat.
2
BACKGROUND & RELATED WORK
2.1 NEURAL MACHINE TRANSLATION SYSTEMS
Neural machine translation (NMT) /Vaswani et al., 2017 Liu et al. 2020 systems apply neural networks to approximate the conditional probability P(Y X). where X I2,
I2, ... Fmm] is the
source token sequences and Y = [y1, 3/, yn. is the target token sequences. As shown in Fig- ure D typical NMT system consists of an encoder fen(.) and a decoder f.) The encoder encodes the source input X into hidden representation H. then the decoder starts from a special token (SOS), and iteratively accesses H for an auto auto-regred regressive generation of each token y/ until the end of sequence token (EOS) is reached. An important observation from the NMT working mecha- nisms is that NMT will iteratively running the decoder Sae to generate output token until EOS is
2

---

Under review as a conference paper at ICLR 2022
reached. Thus, if the generated output sequence is longer. the NMT will consume more computa- tional resources and becomes less efficient. In our example, the NMT system run the decoder four times to generate the output.
2.2 DNN'S EFFICIENCY
Recently, the efficiency of deep neural net- works (DNNs) has raised a huge concern because of their substantial inference-time computational costs. To reduce DNN' inference- compu- tational costs and make it feasible applying DNNs for real-time applications, many existing work has been proposed. There are two main techniques: The first type (Howard et al. (2017); Zhang et al. (2018)) of the techniques prune the DNNs offline to identify important neurons and remove the unimportant neurons. After pruning, tive accuracy with the original DNNs but require less computational costs. Another type of tech- niques Wang et al. (2018); Graves (2016); Figurnov et al. (2017). called input-adaptive techniques, this type of technique dynamically skip certain part of the DNNs to reduce the number of com- putations in the inference time. By skipping some parts of the DNNs, the input-adaptive DNNs balance the accuracy and computational costs. However, recent studies (Haque al., 2020 Hong et al.] 2020) show input-adaptive DNNs are not robustness against the adversary attack, which implies the input-adaptive will not save computational costs under attacks.
Input
308
Like
Paulrn
Encoder
Decoder
Culput
Figure 1: Working mechanism of NMT systems
the smaller size DNNs could achieve competi-
2.3 ADVERSARIAL ATTACKS
Existing work adversarial machine learning has shown that even the state-of-the-art DNNs can be fooled by adversarial examples (Carlini & Wagner 2017: Athalye et al. 2018). Adversarial examples are the elaborately crafted samples that apply samples to maximize the target DNNs' errors. Based on prior knowledge about victim DNNs, the generation of adversarial examples could be categorized into white-box and black-box attacks. In
perturbations benign
the white-box settings (Goodfellow et al. 2014 Madoooovvi-ezooore et al.] 2016) Kurakin et al. 2016
Carlini& Wagner, 2017;Jang et al. [201]] Madry et al., 2017; Chen et al. [2118] Rony al. 2019).
the adversary know the victim DNNs' architecture and parameters and can compute gradients to
generate adversarial examples. the black-box settings (Brendel et al. 2017 Chen et al. 2020
Brendel et al. 2019), the adversary can also exploit surrogate model for launching the attack.
3
ATTACK METHODOL.OGY
3.1
THREAT MODEL
We consider an adversary who aims to decrease the efficacy of a victim NMT system. The attacker perturbs a benign sentence with unnoticeable perturbations to craft adversarial examples and feeds adversarial examples to the victim NMT. The perturbed adversarial examples will consume more computational resources of the victim NMT systems, thus impairing the translation service or make the service unavailable.
Adversary's Capabilities. The attacker is able to modify the victim's 's input samples to apply the perturbations, e.g., By publishing some documents contain adversarial examples on the Internet. We follow existing work (Cheng et al. 2020, Belinkov & Bisk 2017 Li et al. 2018 Jii et al. 2020) and consider two types of perturbations: (i) token-level perturbation and (ii) character-lewe perturbation. To ensure imperceptibility,
limit the perturbation size that the adversary can perturb the benign inputs. Section we evaluate how different e will affect the effectiveness of proposed attack.
Ad Adversary's Knowledge. To assess the security vulnerability of existing NMT systems, study white- box scenarios, i.e., the attackers know the victim NMT systems architecture, parameters and the tokenizer that tokenize the word. In Section 4.4 study more practical black-box scenarios,
3

---

Under review as a conference paper at ICLR 2022
Le.,, the attacker leverage the transferability generate adversarial examples and attack victim NMT system without any prior knowledge about the victim.
Adversary's Goals. The adversary's s goal is to decrease the efficacy of victim NMT system. As we discussed in Section 2 NMT system's efficacy is related to its' output length. A longer output length indicates the NMT system costs computational resources and becomes less efficacy. Thus, the adversary can achieve their goal through increasing the NMT system's 's output length.
A argmax Len(F(x +
s.t. |1 S
(1)
Finally, we formulate our problem of generating efficiency adversarial examples as an optimization problem. As shown in equation where is the benign input, F is the target NMT system, e the maximum adversarial perturbation, and Len(-) measure the length of a output sequence. Our attack TranSlowDow tries to search a perturbation A that maximize the output length (decrease target NMT system F effiency) while smaller than the allowed perturbation (unnoticeable).
3.2
TRANSLOWDoWN ATTACK
Our attack algorithm is shown in Algo- rithm which iteratively performs the fol- lowing three main steps: (i) find important tokens, (ii) generate possible perturbation, and (iii) select optimal perturbation, until the generated adversarial examples reach the maximum perturbation.
Algorithm 1 TranSlowDown Attack Input: Benign input æ, victim NMT system F(.), maximum perturbation
Output: Adversarial examples x'
1: x' = Initialize x' with x while ||a' =||
Find Important Tokens (line 3 to 6):
2:
- for each Lk; E x' do
do
Given benign input = - [km],
3:
4: Compute y according to equation 2
the first step is to find each tokens im- portance to NMT systems' efficiency. As NMT systems'
5:
end for
we discussed Section 2
6:
TK + Sort(tk,, th2. thm) according to gi
efficiency is related to its' output length, and the output length is determined by the probability of EOS tokens. Then our objective is to decrease the probability of the EOS token reduce NMT's efñ- ciency. Formally, let NMT system's 's out- put probability a sequence of vectors, i.e, F(xr) P2,. Pn]. Then the probability of EOS tokens are [pfos p5"x...... . p. We seek to find the importance of each token th; in æ to this probability sequence. We also observe that the output token sequence will affect EOS's probability. Thus, we define the importance score token th; as gr. shown in equation 2
7:
L = Generatteorturbattion (TK, 2.))(.)
8:
[tk, A] SelectBestPerturbation F(())
9:
x' < replace th with A x'
10: end while
II: return x'
f(x) = - E (pf0e + pf
n
0f(x) Otk!
0; argmax(p.))
9i
Where [01, 02. o,] is the current output token, f(x) is the probability we seek to minimize, tke the 5th dimension of th's embeddings, and g, is the derivative of f(x) to 7th token's 'ss embedding.
Adversarial Perturbation Generation (line 7): After identifying important tokens, the next step to mutate the important token with unnoticeable perturbations. In this step, we get set of pertur- bation candidate L after we perturbing the most important tokens in the original input. Following existing work, we consider two kinds of perturbations, i.e.,, token-level perturbation and character- level perturbation. Table [ shows some example of token-level and character-level perturbation under different perturbation size e, we color the perturbation with color red.
0f(x)
Iore = ((E(tg)) E(src))
argmax,gt sgti
(3)
auk_
4

---

Under review as a conference paper at ICLR 2022
For token-level perturbation, consider replacing the original token th with another token 6. To compute the target token 6, we define token replace increment Ierg.igt to measure the efficiency degradation of replacing token src to tgt. As shown in equation 3 E(-) is the function to get corresponding token's embedding, E(tg() - (srre) is the vector increment in embedding space. Because af(x) indicate the sensitive of output length to each embedding dimension, Igre,tgt repre- atk?
sent the total benefits of replacing token sre with fgt. We search the target token ó in the vocabulary to maximize the token replace increment with the source token tk.
For character-level perturbation, we consider character insert perturbation. Specifically, we insert one character into token th to get an- other token 8. The character-insel perturba- tion is common in the real world when typing quickly and is unnoticeable without careful ex- amination. Because character insertion is likely to result in voc-ol-vocabulary (OOV), thus it challenging compute the token replace in- crement as token-level. Instead, we enumerate possible å after character insertion to get candidate set L. Specifically, we consider all letters and digits as the possible character because humans can type these tokens through the keyboard, and we consider all positions the possible insertion position. Then for token th:, which contains characters, there are (1 + 1) ||C'|| perturbation candidates, where ||C*| is the size of all possible characters.
Table 1: Examples of token-level and character- level perturbation under different size Original
Do you know who Ric Miyazawa is?
Do know who Rie Miyazawa is?
Token-Level
know who Miyazawa
How know who Hill Miyazawa is?
Do you know who Ric Miya-zawa is?
Character-Leve
Do you know whoo Rie Miya zawa is? Do you knolw whoo Rie Miya-zawa
Select Best Perturbation (line to 9): After collecting candidate perturbations L, we select an optimal perturbation from the collected candidate sets. As our objective is searching adversarial perturbation that will produce longer output length, thus, we try all adversarial perturbation and select the optimal perturbation that produce the maximum output length.
EVALUATION
4.1 EXPERIMENTAL SETUP
Models and Datasets. As shown in Table 2 we consider the following three public NMT systems as our victim models: Google's T5 (Raffel et al. 2019), Facebook's s Fairseq Transformer (Ng et al., 2019) and Helsinki-NLLP's H-NLP Translator Jörg et al., 2020). For each model, we choose a specific testing dataset: (i). T5 is released by Google, it's first pre-trained with multiple language problems, then fine-tuned on the English-Germer dataset ZH19 as benign examples to generate adversarial examples; (ii). Fairseq is one of the NMT models that Facebook FAIR submitted to the WMT19 shared news translation task, and it's based on the FFN transformer architecture (Vaswani et al.) 2017). We select Fairseq's 's en-de model as victim model, which is designed for the English-Germen translation task. We apply WMT1 9 test data as benign examples to generate adversarial examples; (iii). H-NLP seq2seq translation model, the source language is English and the target language is Chinese. We apply the sentences from Tatoeba-test eng. zho as benign examples to generate adversarial samples.
translation task. We apply English sentences from
Table 2: The victim models in our experiments
Model
Vocab Size
Source
Target
URL
ZH19
En
https:/tugginnffcc.oo///s col.-s/ssaallttttllllaaa.a
FAIR
WMT19
En
De
https//huggingffccccoo http:///innnnnacc/cccccceooaoooo cw/facebooo//mmi/iiccc. -eteee//ooooootm19-----eeeee
H-NLP
Tatoeba
En
Zh
https:/htuginngfice..o/ttttsssk htt.://eeeneeetttoooeeeiianaooon MLP/opus-mt-en-de
Metries. We apply floating- point operations (FLOPs) and response latency to measure victim NMT systems' efficiency. FLOPs is a hardware-inddeendenn metric and is widely used to measure DNNs computational complexity. Higher FLOPs mean that the DNN requires more computations to handle an input, which represents less efficiency (Howard et al. 2017 Zhang al. 2018). Response latency a hurdware-dependers metric, which can measure the victim model's 's efficiency on benign and adversarial examples. High response latency indicates that the victim NMT system needs to spend
5

---

Under review as a conference paper at ICLR 2022
Benign
Baseline
Ours
PDF
CDF
03.
04
00
0.4
04
64
0.-
0.-
02
FLOPs
Intel V5 CPU Latency
1080 Ti GPU Latency
Figure 2: The distribution of FLOPs and latency before and after token-level attacks
more computational resources. The higher the response latency, the worse the real-time translation quality. We measure the latency on two hardware platforms: Intel Xeon E5-2660v3 CPU and Nvidia 1080Ti GPU.
To evaluate the effectiveness TranSlowDowa we measure the FLOPs and latency on benign and adversarial examples respectively. Specifically, we first compute the probability density func- tion (PDF) and cumulative distribution function (CDF) FLOPs and latency. Then, we define two metrics: I-FLOPs and I-Latency, to evaluate how the adversarial samples affect the victim NMT systems. The formal definition of I-FLOPs and I-Latency shows equation where x denotes the benign example and s' represents the adversarial example after perturbing x, FI.OPs()) and Latency(+) are the functions to calculate the average FL.OPs and latency per input character. Higher I-FLOPs and I-Latency indicate a more severe slowdown caused by the adversarial example.
I-FLOPs = FLOPs(x') - FL)Ps(x)) 100%
Latency(z') - Latency(x))
I-Latency
x 100%
(L.OPs(::)
Latency(x))
(4)
Comparison Baseline. To the best of our knowledge, we are the first to study the attack efficiency of NMT systems, therefore existing efficiency attack framework can be applied the baseline. To show existing accuracy-based attacks can not be applied for evaluating NMT's efficient robustness, we compare TranSlowDow et al. al. (020) as the token-level baseline. Seq2Sick can replace the tokens in benign inputs to produce adversarial translation outputs that are entirely different from benign outputs. Because Seq2Sick only works under token-level, we choose SyntheticFrroor (Belinkov & Bisk (017) as the character- level baseline. SyntheticError minimizes the NMT system's accuracy (BLUE score) by introducing synthetic noise. Specifically, SyntheticError introduces four character-level perturbation: Swap, Middle Random, Fully Random, and Keyboard Typo to perturb benign examples to decrease the NMT system's BLUE scores.
against two accuracy- -based attacks. We choose Seq2Sick (Cheng
4.2 TOKEN-LEVEL PERTURBATION RESULTS
Effectiveness of Token-level Attack. Figure 2 shows the distribution of H-NLP's efficiency met- rics under token-level (more results for T5 and Fairseq can be found in Appendix A.2). The first and second rows show the PDF and CDF results respectively. In each plot, the blue area denotes the distribution of benign examples, green and red areas represent the distribution of adversarial examples generated from the comparison baseline Seq2Sick and TranS 1 owDown respectively. It can clearly observed from Figure 2 that adversarial examples generated by TranSl owwow significantly change the distribution of the victim NMT system's FLOPs and latency. In contrast, the adversarial examples from baseline have very little effect on NMT's efficiency. The results for the other NMT systems in the Appendix show similar trends with Figure 2 From the results, we conclude that: existing accuracy-based attacks can not be applied to evaluate the efficiency ro- bustness of NMT systems. In contrast, proposed attack, TranS lowDown effectively generates
For better presentation, we plot the CDF from zero.

---

Under review as a conference paper at ICLR 2022
Benign
Baseline
Ours
PDF
0.1
CDF
64-
de id
FLOPs
Intel V5 CPU Latency
1080 Ti GPU Latency
Figure 3: The distribution of FL.OPs and latency before and after character-level attacks
adversarial examples to slow down NMT systems, Thus, TranSlowDoo is effective in evaluating the efficiency robustness of NMT systems.
Table The severity token-level adversarial attacks
I-FLOPs
I-Latency (CPU)
I-Latency (GPU)
NMT
Perturbation
Baseline
Ours
Baseline
Ours
Baseline
Ours
1
4.18
1318.72
4.51
1485.64
2.55
1269.53
2
6.03
2131.92
6.33
2403.21
3.05
2054.83
H-NLP
3
12.94
2336.88
13.83
2636.51
11.10
2296.09
4
17.57
2360.94
19.40
2664.46
15.68
2314.23
5
23.56
2366.09
25.38
2669.82
23.89
2321.93
1
-0.05
23.46
0.15
24.85
3.50
29.62
2
-0.19
36.80
0.61
38.97
1.17
40.59
FairSeq
-2.22
47.27
-0.73
51.21
-1.40
54,44
4
-5.78
$7.60
-4.17
63.35
-4.09
63.57
5
-8.20
80.75
-6.85
89.73
-1.76
85.74
10.09
335.41
9.66
383.38
7.87
352,88
2 6.80
343.69
5.44
393.20
4.06
362,45
3
1.47
343.69
1.64
393.20
-1.54
362.45
-11.66
343.69
-9.62
393.20
-8.28
362.45
5
-25.18
343.69
-24.29
393.20
-8.59
362,45
Severity of Token-level Attack. To quantify the severity of the proposed efficiency attack, we measure I-FLOPs and I-Latency under different perturbation sizes. From the results in Table 3 have the following observations: (i) For all experimental subjects, the adversarial examples generated by TranSlowDow slow down the victim NMT systems by a large margin compared to the baseline method. For H-NLP, TranSl owDown adversarial examples increase the FLOPs, CPU latency, GPU latency up to 2366.09%, 2669.8299 986%, 2321 .3%% respectively. (ii) As perturbation size increases, the adversarial examples generated by TranSl owDown make the victim NMT system slower. However, this observation does not hold for the bascline method. This is because the baseline method designed to decrease victim NMT's accuracy, increasing adversarial pertur- bation may decrease NMT accuracy but does not imply to consume more computational resources. (iii) The adversarial examples generated by the baseline method can not always ensure increasing FLOPs and latency, while TranS 1issSonn LowDown adversarial examples increase FLOPs and latency on all settings. This result is consistent with the second observation and indicates that the baseline method is not suitable to evaluate NMT's computational consumption robustness.
4.3 CHARACTER PERTURBATION
Effectiveness of Character-level Attack. Figure shows the distribution of H-NLP's efficiency metrics under character-level (more results for T5 and Fairseq can found Appendix A.2). For character-level attack, compared with baseline, adversarial examples generated by Trans owDown

---

Under review as a conference paper at ICLR 2022
significantly change the distribution of the victim NMT system's FLOPs and latency well. The results for the other two NMT systems in the Appendix show similar trends with Figure 3 From the results, obtain similar conclusion with the token-level attack, i.e., proposed attack, Trans owDown, effectively generates adversarial examples to slow down NMT systems. con- trast, the accuracy-basee attack not achieve this goal.
Table 4: The severity of character-level adversarial attacks
I-FLOPs
I-Latency (CPU)
I-Latency (GPU)
NMT
Perturbation
Baseline
Ours
Baseline
Ours
Baseline
Ours
20.09
389.36
21.27
431.72
11.84
368.08
2
20.09
879.16
21.29
978.47
12.07
840.47
H-NLP
1102.86
21.29
1232.71
12.07
1056.88
1189.48
21.29
1328.29
12.07
1136.70
20.09
1224.91
21.29
1366.22
12.07
1174.57
1
0.28
36.23
0.71
38.59
3.15
40.13
2
0.28
87.92
0.71
97.37
3.17
94.31
FairSeq
3
0.28
145.60
0.71
164.90
3.17
155.43
4
0.28
190.43
0.71
217.94
3.17
204.02
5
0.28
223.07
0.71
255.42
3.17
235.93
1
5.60
217.46
6.39
249.44
5.71
229.70
2
5.56
249.88
6.37
286.81
5.69
258.35
T5
3
5.56
267.58
6.37
307.57
5.69
273.41
4
5.56
276.33
6.37
318.40
5.69
283.37
5
5.56
280.10
6.37
323.67
5.69
286.84
Severity of Character-level Attack. Similar to Section 4.2 Table presents the severity of character-level adversarial examples. The results show consistency with the token-level attack. For the character-level attack, the adversarial examples generated by TranSlowDown also sig- nificantly slow down the victim NMT systems compared to baseline method. For H-NLP, TranSlowDon adversarial examples increase the FLOPs, CPU latency, GPU latency up to 1224.91%, 66%, 1174.57% respectively. As perturbation size increases, the adversarial exam- ples generated by Tran owDown make the victim NMT system slower, which is not reflected in the baseline results. This consistent with the token-level attack.
4.4 THE TRANSFERABILITY OF ADVERSARIAL EXAMPLES
In this section, we study the transferability of efficacy adversarial examples. Even though white- box attacks are important to expose the vulnerability, black-box attacks are more practical in the real world because they require less information about the NMT systems. We investigate whether Trans lowDow is transferable under black-box settings.
Table The maximum I-FLOPs of blackbox token-level attack
Source
Target
2
3
4
5
FairSeq
185.71
57.14
68.75
57. 14
42.86
H-NLP
T5
1600.00
1600.00
1600.00
1600.00
1600.00
H-NI.P
6566.67
6566.67
6566.67
6566.67
6566.67
FairSeq
T5
1600.00
1600.00
1600.00
1600.00
1600.00
H-NLP 3733.33
3733.33
3733.33
3733.33
3733.33
T5
FairSeq
858.33
1816.67
1816.67
945.45
945.45
Specifically, we treat one NMT system as target and apply another NMT system as the source to generate adversarial examples. We then feed the adversarial examples to the target NMT systems and measure the maximum I-FLOPs. Maximum I-FLOPs indicate the efficiency degradation under the worst scenario, which is important
measure the vulnerability of NMT systems. Notice the source and the target NMT systems in our experiment adopts different model architectures and are trained with different datasets. Thus, if the adversarial examples can increase the FLOPs of the target NMT system, it proves that transferability exists in our attack. The results for token-level attacks are shown in Table (more results in Appendix A.3 From the results, observe that for
8

---

Under review as a conference paper at ICLR 2022
all experimental settings, TranSl generates adversarial examples that increase the target NMT system's ' computational FLOPs to a large extend. The results imply that under the worst scenarios, the attackers can generate efficient adversarial examples even without prior knowledge about the victim NMT systems.
REAL WORLD CASE STUDY
We conduct a case study to evaluate TranSlowDown's ability to attack real world mobile devices' battery power.
Experiment Settings. We select Google's TS as our victim NMT model. We first de-
Table 6: Sentences for energy attack on mobile devices
ploy the model on Samsung Galaxy 59+, which has 6GB RAM and battery ca- pacity of 3500 mAh. After that, we se- lect sentence from the dataset ZH19
Death comes often to the soldiers and marines who are fighting anbar province, which roughly the size of louisiana and the most intractable region iraq.
Benign
Death comes often to the soldiers and marines who are fighting anbar province, which roughly the (size of of louisiana and is the most intractable region in iraq.
Adversarial
as our testing example; We then apply TranSlowDown perturb the benign example with character-level perturbation and obtain the corresponding adversarial example. The benign sentence and the adversarial sentence are shown in Table 6 (More results in Appendix sec- tion A.4). we color the perturbation with the color red. Notice the adversarial example insert only one character in the benign sentence. This one-character perturbation is very common in the real world because of the user's typos. Finally, we feed the benign and adversarial examples to the deployed NMT system and measure the NMT's energy consumption of translating benign and ad- versarial examples.
Experiment Results. The mobile's battery power change is shown in Figure 4 The red line is for ad- versarial example, and the blue line is for benign ex- ample. The results show that the adversarial exam- ple increases the mobile device's ' battery power sig- nificantly more significant than the benign example. Specifically, after 300 iterations, the adversarial ex- ample consumes 30% of the battery power, while the benign example only consumes less than 1%. The results show the vulnerability of the efficiency attack for IoT and mobile devices. Recall that the adversar- ial example used our experiment only inserts one character in the benign sentence. This minimal per- turbation can result from benign user typos instead of from the adversary. Thus, the results suggest the criticality and the necessity of increasing NMT systems' efficiency robustness.
Energy
Adversiral Berign
Iteration Number
Figure 4: Remaining battery power of the mobile device after T5 translating benign and adversarial sentence
6 DISCUSSION
Although there are many accuracy-bass -ased defense mechanisms to protect DNNs. However, accuracy- oriented defense mechanisms are not applicable for protecting NMT systems' efficiency robustness because of two reasons: (i) Many existing accuracy defense mechanisms require running the model with the input and use the hidden states of the model to make decision. However, running the input would defeat the purpose of an energy defense as the computation resource is already consumed. (ii) Our results in section | show that accuracy- based adversarial examples and efficiency-basee adversarial examples belong to different distribution, thus, running ssuracy-bassed detector can not detect efficieney-based adversarial examples successfully.
CONCLUSIONS
In this work, we study the robustness of NMT systems against adversarial efficiency attacks. Specif- ically, we propose Trans1 owDown, an attack that introduces imperceptible adversarial perturba- tions to benign inputs to increase NMT's computational complexity. We evaluate Trans LowDown on three public available NMT systems, the results show TranSlowDowr generates adversarial examples decrease NMT systems' efficiency. Our study suggests that efficiency attacks are vul- nerable, yet under-appreciated, threat against NMT systems.

---

Under review as a conference paper at ICLR 2022
REFERENCES
Anish Athalye, Nicholas Carlini, and David Wagner. Obfuscated gradients give false sense of se- curity: Circumventing defenses to adversarial examples. In International conference on machine learning, pp. 274-283. PMLR, 2018.
Dzmitry Bahdanau, Kyunghyun Cho, and Yoshua Bengio. Neural machine translation by jointly learning to align and translate. In Yoshua Bengio and Yann LeCun (eds.), 3rd International Conference on Learning Representations, ICLR 2015, San Diego, CA, USA, May 7-9, 2015, Con- ference Track Proceedings, 2015. URL BRRLhht:://aae:
org/ aaaaaaaah40 0473
Yonatan Belinkov and Yonatan Bisk. Synthetic and natural noise both break neural machine trans- lation. arXiv preprint 1r1iv:171..02173, 2017.
Yonatan Belinkov and Yonatan Bisk. Synthetic and natural noise both break neural machine trans- lation. In 6th International Conference on Learning Representations, ICLR 2018, Vancouver BC, Canada, April 30 May 3, 2018, Conference Track Proceedings. OpenReview.net, 2018. URL Sitts::/cpenreet
net Forum2id-BJBvJebe.
Wieland Brendel, Jonas Rauber, and Matthias Bethge. Decision based adversarial attacks: Reliable attacks against black-box machine learning models. arXiv preprint arXiv:1712.04245. 2017.
Wieland Brendel, Jonas Rauber, Matthias Kümmerer, Ivan Ustyuzhaninov, and Matthias Bethge. Accurate, reliable and fast robustness evaluation. In Advances in Neural Information Processing Systems, pp. 12861-12877 2019.
Nicholas Carlini and David Wagner. Towards evaluating the robustness of neural networks. In 2017 ieee symposium security and privacy (sp), pp. 39-57. IEFE, 2017.
Isaac Caswell and Bowen Liang. Recent advances in google translate, 2020. URL httpps//a html
googleblog com/ 2ttmm/2020////eceeeee -ali-iaaaaaaaasaaaeee http://ccc...caaaaaaeeeee--eeeee
Jianbo Chen, Michael Jordan, and Martin J Wainwright. Hopskipjumpattack: A query-efficient decision-based attack. In 2020 ieee symposium security and privacy (sp), pp. 1277-1294. IEEE, 2020.
Pin-Yu Chen, Yash Sharma, Huan Zhang, Jinfeng Yi, and Cho-Jui Hsich. Ead: elastic-nct attacks to deep neural networks via adversarial examples. In Proceedings of the AAAI Conference on Artificial Intelligence, volume 32, 2018.
Minhao Cheng, Jinfeng Yi, Pin- Yu Chen, Huan Zhang, and Cho-Jui Hsieh. Seq2sick: Evaluating models with adversarial examples. In Proceedings of the
the robustness of AAAI Conference on Artificial Intelligence, volume 34, pp. 3601-3608, 2020.
Yong Cheng, Lu Jiang, and Wolfgang Macherey. Robust neural machine translation with doubly adversarial inputs. arXiv preprint arXiv: (et.i/06..2222 02443, 2019.
Michael Figurnov, Maxwell D Collins, Yukun Zhu, Li Zhang, Jonathan Huang, Dmitry Vetrov, and Ruslan Salakhutdinov. Spatially Adaptive Computation Time for Residual Networks. In Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition, pp. 1039- 1048, 2017.
J Goodfellow, Jonathon Shlens, and Christian Szegedy. Explaining and harnessing adversarial examples. arXiv preprint arXiv:1412.6572. 2014.
Alex Graves. Adaptive Computation Time for Recurrent Neural Networks. arXiv preprint 17Xiv:1603.08983, 2016.
Jiatao Gu Hany Hassan Awadalla, and Jacob Devlin. Universal chine translation for extremely low resource languages.
neural ma-
In NAACL, June 2018.
URL
uni
10

---

Under review as a conference paper at ICLR 2022
Junliang Guo, Xu Tan, Di He. Tao Qin, Linli Xu, and Tie- Yan Liu. Non-autoregressive neural machine translation with enhanced decoder input. In The Thirty-Third AAAI Conference on Artificial Intelligence, AAAI 2019. The Thirty-First Innovative Applications of Artificial Intelli- gence Conference, IAAI 2019, The Ninth AAAI Symposium on Educational Advances in Artificial Intelligence, EAAI 2019, Honolulu, Hawaii, USA, January 27- -eeruarr 1, 2019, pp. 3723- 10.1609/aaii 1..16///aaa.33331.33300000 33310333333313 URL attps:://oi.....
3730. AAAI Press, 2019. doi: 10.1609 aaaii.aaaa..... wtt.aaaaiivi11.10
v33101 33013723
Mirazul Haque, Anki Chauhan, Cong Liu, and Wei Yang. Ilfo: neural networks. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR), June 2020.
Adversarial attack on adaptive
Hany Hassan Awadalla, Mostafa Elaraby, and Ahmed Y. Tawfik. Synthetic data for
neural machine translation of spoken-dialects. In IWSLT 2017, December 2017. URL
www.e//aaeeeeeeoeeeeeeeeeaaaaeee wwwp:///..........eeeaaaaaaaaaaa pot.eaaaroocpbliictiio..o.o.ooo. hww.
Hany Hassan Awadalla, Anthony Aue, Chang Chen, Vishal Chowdhary, Jonathan Clark, Christian Federmann, Xuedong Huang, Marcin Junczys-Dowmunt, Will Lewis, Mu Li, Shujie Liu, Tie- Yan Liu, Renqian Luo, Arul Menezes, Tao Qin, Frank Seide, Xu Tan, Fei Tian, Lijun Wu, Shuangzhi Wu, Yingce Xia, Dongdong Zhang, Zhirui Zhang, and Ming Zhou Achieving human parity on automatic chinese english news translation. arXiv: 803.0567, March 2018a. URL https: http:///ww/////aaa..o..oo....ota
Hany
Hassan Awadalla, Mostafa Elaraby, Ahmed Tawfik, Mahmoud Khaled, and Aly Osama. Gender aware spoken language translation applied to english-arabic. In 2018 IEEE Proceedings of the Second International Conference on Natural Language and Speech Processing, February 2018b. URL hhtpps://wwet mi
gender- - aeseerr-wwae--poooe httpa//wwwoo.ooooooooooooooooaon
Sanghyun Hong, Yigitcan Kaya, Lonut-Vlad Modoranu, and Tudor Dumitraş. A panda? no, it's sloth: Slowdown attacks adaptive multi-exit neural network inference. arXiv preprint arXiv:2010.02432, 2020.
Andrew G Howard, Mengiong Zhu, Bo Chen, Dmitry Kalenichenko, Weijun Wang, Tobias Weyand, Marco Andreetto, and Hartwig Adam. Mobilenets: Efficient convolutional neural networks for mobile vision applications. arXiv preprint arXiv: 104.0460,, 2017.
Uyeong Jang, Xi Wu, and Somesh Jha. Objective metrics and gradient descent algorithms for adversarial examples in machine learning. In Proceedings of the 33rd Annual Computer Security Applications Conference, pp. 262-277, 2017.
Di Jin, Zhijing Jin, Joey Tianyi Zhou, and Peter Szolovits. Is bert really robust? strong bascline for natural language attack on text classification and entailment. In Proceedings of the AAAI conference on artificial intelligence, volume 34, pp. 8018-8025, 2020.
Tiedemann Jörg, Hardwick Sam, and Shleifer Sam. https//bbgg..ebiiiiiiiaaagggggee 2020. URL httpt://p//bbloooo //blogs.....o.oo/ he terelsinki iiniiiiiiii. fi ttch//aangggeeeeehoooollooooooee
Nal Kalchbrenner, Lasse Espeholt, Karen Simonyan, Aäron van den Oord, Alex Graves, and Koray
Kavukcuoglu. Neural machine translation linear time. CoRR, abs/1610. 10099, 2016. URL
fittp://arxxr wwwpg///bs////// 10099
Alexey Kurakin, Ian Goodfellow, and Samy Bengio. Adversarial examples in the physical world. 2016.
arXiv preprint
Jinfeng Li, Shouling Ji, Tianyu Du, Bo Li, and Ting Wang. Textbugger: Generating adversarial text against roal-world applications. arXiv preprint 10Xhv:1812.05271, 2018.
Yinhan Liu, Jiatao Gu. Naman Goyal, Xian Li, Sergey Edunov, Marjan Ghazvininejad, Mike Lewis, and Luke Zettlemoyer. Multilingual denoising mee-trinnng for neural machine translation. Trans- actions of the Association for Computational Linguistics, 8:726-742, 2020.
11

---

Under review as a conference paper at ICLR 2022
Aleksander Madry, Aleksandar Makelov, Ludwig Schmidt, Dimitris Tsipras, and Adrian Vladu. Towards deep learning models resistant to adversarial attacks. arXiv preprint rrXiv:1706.0608. 2017.
Seyed-Mohsen Moosavi-Dezfooll Alhussein Fawzi, and Pascal Frossard. Deepfool: simple and accurate method to fool deep neural networks. In Proceedings of the IEEE conference on com- puter vision and pattern recognition, pp. 2574-2582, 2016.
Nathan Ng, Kyra Yee, Alexei Baevski, Myle Ott, Michael Auli, and Sergey Edunov. Facebook fair's wmt19 news translation task submission. arXiv preprint arXiv:1907.00 06666, 2019.
Jeff Pitman. Google translate: One billion installs, billion stories, 2021. URL https://
Jiahu Qin, Menglin Li, Ling Shi, and Xinghuo Yu. Optimal denial-of-service attack scheduling with energy constraint over packet-dropping networks. IEEE Transactions on Automatic Control, 63 (6):1648-1663, 2018. doi: 10.1 109/TAA..001..756255
Colin Raffel, Noam Shazeer, Adam Roberts, Katherine Lee, Sharan Narang, Michael Matena, Yanqi Zhou, Wei Li, and Peter J Liu. Exploring the limits of transfer learning with a unified text-to-text transformer. arXiv preprint 1rXiv:19I0.100
2019.
Jérôme Rony, Luiz G Hafemann, Luiz S Oliveira, Ismail Ben Ayed, Robert Sabourin, and Eric Granger. Decoupling direction and norm for efficient gradient-based 12 adversarial attacks and defenses. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recog- nition, pp. 4332--333) 2019.
Zhaopeng Tu, Yang Liu, Lifeng Shang, Xiaohua Liu, and Hang Li. Neural machine translation with reconstruction. In Satinder P. Singh and Shaul Markovitch (eds.). Proceedings of the Thirty-Firss AAAI Conference on Artificial Intelligence, February 4-9, 2017, San Francisco, California, USA, pp. 3097-3103. AAAI Press, 2017. http:/ hattp://aaall org. /cs////c////// index.iix.. php/AAAI/ AAAI/ AAAT17/ /ewaai//apper/lle/111122.
Barak Turovsky, Ten years of google translate, 2016. URL httph::tt//// //w::///wwwwwww htt.:./wwoggogg.l..... procucts/ttrasslatee/eese years of oo-gooole translatet
Ashish Vaswani, Noam Shazeer, Niki Parmar, Jakob Uszkoreit, Llion Jones, Aidan N Gomez, Lukasz Kaiser, and Illia Polosukhin. Attention is all you need. In Advances in neural information processing systems, pp. 5998-6008, 2017.
Xin Wang, Fisher Yu, Zi-Yi Dou, Trevor Darrell, and Joseph E Gonzalez. Skipnet: Learning Dy- namic Routing in Convolutional Networks. In Proceedings of the European Conference on Com- puter Vision, pp. 409-424, 2018.
Thomas Wolf, Lysandre Debut, Victor Sanh, Julien Chaumond, Clement Delangue, Anthony Moi, Pierric Cistac, Tim Rault, Rémi Louf, Morgan Funtowicz, Joe Davison, Sam Shleifer, Patrick von Platen, Clara Ma, Yacine Jernite, Julien Plu, Canwen Xu, Teven Le Scao, Sylvain Gug- ger, Mariama Drame, Quentin Lhoest, and Alexander M. Rush. Transformers: State-of- thethh-rtt natural language processing. In Proceedings of the 2020 Conference on Empirical Methods in Natural Language Processing: System Demonstrations, pp. 38-45, Online, October 2020. As- sociation for Computational Linguistics. http::/:::/ /ttp://wwwwww/. www wwwweb. wwwp:/ewbwrrg/tthhoooooooooooo 2020. emn.p-demss..
Lijun Wu, Yingce Xia, Fei Tian, Li Zhao, Tao Qin, Jianhuang Lai, and Tie- Yan Liu. Adversarial neural machine translation. In Asian Conference on Machine Learning, pp. 539- PMLR, 2018.
Yingce Xia, Tianyu He, Xu Tan, Fei Tian, Di He, and Tao Qin. Tied transformers: Neu- ral machine translation with shared encoder and decoder. In The Thirty-Third AAAI Con- ference on Artificial Intelligence, AAAI 2019, The Thirty-First Innovative Applications of Ar- tificial Intelligence Conference, IAAI 2019, The Ninth AAAI Symposium on Educational Ad- vances in Artificial Intelligence. EAAI 2019, Honolulu, Hawaii, USA, January 27 Febru- URL
ary 1, 2019, pp. 5466 5473, AAAI Press, 2019. doi: 10.16099amm..333313333115555 https::/ddo wro//o.g//...... 609//aae vv3101 33015466
12

---

Under review as a conference paper at ICLR 2022
Zhen Yang, Wei Chen, Feng Wang, and Bo Xu. Improving neural machine translation with condi- tional sequence generative adversarial nets. arXiv preprint arXiv:1703.04887, 2017.
Heng Zhang, Peng Cheng, Ling Shi, and Jiming Chen. Optimal denial-of-serrice attack scheduling with energy constraint. IEEE Transactions on Automatic Control, 60( 2015. doi:
10.1109/AA.2015:24499000
Xiangyu Zhang, Xinyu Zhou, Mengxiao Lin, and Jian Sun. Shufflenet: An extremely efficient convolutional neural network for mobile devices. In Proceedings of the IEEE conference on computer vision and pattern recognition, pp. 6848-6856, 2018.
13

---

Under review as a conference paper at ICLR 2022
A APPENDIX
A.1 TOKEN-LEVEL RESULTS
Figure and Figure 6 show the distribution of T5 and Fairseq's 's efficiency metrics under token-level respectively. Similar to Section 4.2 adversarial examples generated by TranS 1 owDown. signifi- cantly change the distribution of the victim NMT system's FLOPs and latency while the adversarial examples from baseline have minor effect on NMT's efficiency.
A.2 CHARACTER-LEVEI RESULTS
Figure 7 and Figure show the distribution of T5 and Fairseq's ss efficiency metrics under character- level respectively. Similar Section 4.3 compared with the baseline, the adversarial samples gen- erated by TranSlowDor still achieved higher FLOPs and latency.
A.3 TRANSFERABILITY RESULTS
As we mentioned in Section we investigate whether Trans lowwwn transferable under black-box settings. The results for character-level attacks are shown in Table 7 which is consistent with the result obtained in the token-level experiment. The results further prove that the attacker generate effective adversarial examples even without prior knowledge about the victim NMT system.
Benign
Baseline
Ours
PDF 606
610
0.0
0.0
006
1.0
CDF
100
100
100 de
FLOPs
Intel V5 CPU Latency
1080 Ti GPU Latency
Figure 5: The efficiency metric of T5 before and after token-level attacks
Benign
Baseline
Ours
PDF
353
2.90
10
CDF
02-
08-
01-
02
02-
02-
10
FLOPs
Intel V5 CPU Latency
1080 Ti GPU Latency
Figure 6: The efficiency metric of FairSeq before and after token-level attacks
14

---

Under review as a conference paper at ICLR 2022
Benign
Baseline
Ours
CDF PDF
008-
605
0,62
010
10.
100
150
180
FLOPs
Intel V5 CPU Latency
1080 Ti GPU Latency
Figure 7: The efficiency metrie of T5 before and after character-level attacks
Benign
Baseline
Ours
PDF
3.5
10
CDF
04
0.4
08
0.-
05-
0.4
04-
02-
FLOPs
Intel V5 CPU Latency
1080 Ti GPU Latency
Figure 8: The efficiency metric of FairSeq before and after character- attacks
Table 7: The maximum I-FLOPs of blackbox character- attack
Source
Target
2
3
4
5
FairSeq T5
900.00
273.08
2400.00
573.08
2400.00
H-NLP
1700.00
1700.00
1700.00
1700.00
1700.00
H-NLP
250.00
325,00
400.00
400.00
433.33
FairSeq
T5
1400.00
1400.00
1400.00
1400.00
1400.00
H-NLP
3733.33
3733.33
3733.33
3733.33
3733.33
T5
FairSeq
1177.78
1337.50
1542.86
1337.50
1337.50
15

---

Under review as a conference paper at ICLR 2022
on presenceos the maxinum length of the aumibte is 2,56 byres. on all other platforms is 1024 byres.
Yihe relugge crisis, Turkey and Ythe EU walk toge ther and work Loge Yühee.
The Commission report sets our detailed and yall of all the replics Gefalt
migration
nations make rational discussion nearly impossihle
classmales pointing politicians and chest beating nationalists
President luncker: TFurpee genaine socurity uni(an"
shengli oillfell euromavy to make coatings to
step up the cooperation retur and readmis(hion.
configure bebelus, and treubleshort vtp
Octoher Fumppen Councill meeting
Table 8: The benign and adversarial examples under different settings
load, ormuncee scalability
will hell swallow Syou up?
You have lreant Odiveese.
ThWiss question.
no a linSle confased.
In this section, put more generated efficiency adversarial examples for all our victim NMT systems.
Adversarial
Tam going:
82 me
on z/os the moximuum length of the intribbte is 255 bytes. all other platforms is 1024 bytes. You have beart diveruee
to iosue migmation.
shengli oiliiedd used euronary make coalings fidal zome.
the se fugge crisis, Turkey and the walk together and work together.
The Commission ssion's report sets out a detuiled analysis of all the replies.
impossible
linger pointing politicians und cheste besting nationalists
Tuurpe genuine security
stepp up the coopecation return and readnission.
rational discussion
European Council meeting
configure, verify, and trobble lehoot vip
lond, performance, sculability
will bell swallow you up?
in little confused boaed
nations
A.4 CASE STUDY RESULTS
am here.
Benign
Let
This
NMT
H-NLP
FairSeq
H.NLP
FairSeq
TS
TS
Character
Token
Attakk
16


Reviews:
[{"review_id": "p_UyKCZ2gm", "reviewer": "Reviewer_zCy9", "summary": "", "questions": "", "limitations": "", "rating": 5, "confidence": 5, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "***Strengths***\n1. The paper is easy to follow and the motivation is very clear.\n2. The topic is interesting and can attract much attention from industry research.\n3. The proposed method is intuitive and well-designed. The part of finding important tokens might benefit other research lines such as the over- and under-translation of NMT.\n\n***Weaknesses***\n1. In the paper, the authors repeatedly mention the relationship between NMT efficiency and output length. So, why not show the change of output length after the adversarial attacks? I think the sentence length is a more direct metric to evaluate NMT efficiency and is hardware-independent. \n2. A very simple solution to the attack is applying some constraints to the beam search process of NMT. For example, terminating the decoding when the output is twice the length of the input (please refer to --max-len-b of fairseq-generate). If a simple constraint can solve the issue, the contribution of the paper will be significantly decreased.\n3. Since the proposed method is more relevant to practical NMT systems, so, how about the results (Section 4.4) on Google translator or other online systems?\n\n**It would be nice if the authors could add some experimental results of the above weaknesses during the author response.**", "summary_of_the_paper": "This paper focuses on the efficiency of neural machine translation (NMT) systems, proposing a novel attack approach to test the efficiency robustness. The attack approach can be divided into three parts: 1) find the most relevant tokens of inference efficiency; 2) generate adversarial perturbations for the found tokens; and 3) select the most influenced perturbations. Experimental results on three publicly released NMT systems show the attack approach can significantly decrease NMT efficiency.", "summary_of_the_review": "The paper is very interesting and the contribution is clear, but the claims are not well supported by the existed experiments. Therefore, I give 5 (weak reject) at this moment and would like to increase/decrease my review score after the author response.", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "", "extra_scores": {"correctness": "2: Several of the paper’s claims are incorrect or not well-supported.", "technical_novelty_and_significance": "3: The contributions are significant and somewhat new. Aspects of the contributions exist in prior work.", "empirical_novelty_and_significance": "3: The contributions are significant and somewhat new. Aspects of the contributions exist in prior work."}, "extra_text": {}}, {"review_id": "lTB9JBrm6yN", "reviewer": "Reviewer_cSUu", "summary": "", "questions": "", "limitations": "", "rating": 6, "confidence": 4, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "The robustness of NMT against adversarial input sentences has not received much attention (if any) in the literature. Raising this question and demonstrating an effective attack would be a valuable contribution to the community. The demonstrated impact of TransSlowDown seems indeed impressive first, the paper is clearly written, but I feel that at times it is (perhaps unconsciously) on the verge of overselling the results.\n\nFirst, all NMT systems in practice use a maximum sentence length, which is usually set to a factor times the source sentence length. This maximum target sentence length is needed to prevent infinite loops when NMT is hallucinating and to avoid OOMs. This factor is usually 2-3. Fig. 2 suggests that this factor was either not used or was set to a very high value. Since TransSlowDown works by increasing the target sentence length, specifying and/or varying this factor is crucial for assessing the results.\n\nSecond, T5 and fairseq are pure Transformer models with Transformer decoders. Using self-attention in the decoder results in an inference time complexity of n^2. Therefore, an attack like TransSlowDown that increases the target sentence length is expected to be particularly effective. Most deployed MT systems use recurrency instead of self-attention in the decoder for efficiency reasons, so it would be worth to test the effectiveness of TransSlowDown on architectures with LSTM/GRU decoders.\n\nI still think that the paper has merits, it just needs to be more upfront about the details and the limitations of the results. \n\nSome pointers to related work are missing. The literature on faithfulness in NMT seems relevant, and in Sec. 2.2 at least two very common techniques to improve the efficiency of neural networks (quantization and distillation) are not cited. \n\nMinor comments\n- i in Sec. 3.2 sometimes runs over the input sentence [1,m], sometimes over the output sentence [1,n]\n- Minor typos throughout the paper", "summary_of_the_paper": "TransSlowDown is an attack scheme that aims to targets the computational resources of NMT systems. The authors show that small modifications to benign input sentences can significantly increase the computation NMT needs to process the input, paving the way for denial-of-service attacks on translation services or attacks on the battery power of mobile devices. TransSlowDown is a white box technique that makes use of gradients of the target NMT system, but can also be adapted to a more practical block box technique where gradients from another NMT system are used.", "summary_of_the_review": "The paper explores an important aspect - efficiency robustness of NMT systems - that is clearly understudied in the literature. Some missing details and experimental setups prevent me from giving a stronger acceptance recommendation.", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "", "extra_scores": {"correctness": "3: Some of the paper’s claims have minor issues. A few statements are not well-supported, or require small changes to be made correct.", "technical_novelty_and_significance": "4: The contributions are significant, and do not exist in prior works.", "empirical_novelty_and_significance": "3: The contributions are significant and somewhat new. Aspects of the contributions exist in prior work."}, "extra_text": {}}, {"review_id": "h5gbQwiJKf", "reviewer": "Reviewer_Rkum", "summary": "", "questions": "", "limitations": "", "rating": 5, "confidence": 4, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "Strengths:\n- The idea of attacking the computation complexity of NMT model is interesting and practical in industrial applications. \n- The paper is well-written and easy to follow.\n\nWeaknesses:\n- The paper considers the white-box attacking scenario, which is less significant than black-box attacking which fits the real-world application more. In my view, the significance of white-box attacking is to find the vulnerable point of the model and then fix it by some corresponding solutions such as adversarial training/regularization loss function. The paper only proposes the attacking method without equipping it with the fixing method, which limits its contribution. Therefore I suggest the authors add this part to show that the proposed method can increase the robustness of the NMT model w.r.t the computation complexity attacking.\n- In textual adversarial attacking, a very important condition is that the generated adversarial sample should be imperceptible with the input, in human knowledge. Therefore an indispensable part in related papers is to prove this point, which is missed in this paper, however. I suggest the authors conduct evaluations between the similarity of the source input as well as the generated adversarial sample, in automatic (such as BLEU) and human evaluation (such as grammar/semantic/consistency) metrics.\n- The proposed method seems time consuming as nearly all operations are based on greedy search. How long does the method take in experiments? Have you compare the running time with other baselines?\n\nMinor points:\n- The insight behind of Equ (2) is not introduced. How the importance is defined? What does each part represents? Needs more explantion.\n- In character-level perturbation, if the corrupted result is tokenized into multiple tokens or the UNK token, how to maintain them are still the most important tokens? As the probability may change if the source length is changed.\n- How to maintain the corrupted result is in the mamximum permutation \\epsilon? ", "summary_of_the_paper": "The paper proposes an adversarial attack method for NMT, aiming to increase the computation complexity while decoding by introducing perturbations into the input. To achieve that, the authors propose an attacking algorithm that consists of three steps: find the most important source token w.r.t the probability of EOS token, then add token level (by FGSM) or character level perturbations (by greedy search), and finally select the perturbation that produces the longest result.", "summary_of_the_review": "The paper proposes an interesting idea of a new attacking target of NMT models, but has some major flaws such as limited contribution and inadequate evaluation. Therefore I vote for a rejection.", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "", "extra_scores": {"correctness": "3: Some of the paper’s claims have minor issues. A few statements are not well-supported, or require small changes to be made correct.", "technical_novelty_and_significance": "2: The contributions are only marginally significant or novel.", "empirical_novelty_and_significance": "2: The contributions are only marginally significant or novel."}, "extra_text": {}}, {"review_id": "V4GCz4JuZKn", "reviewer": "Reviewer_mDAN", "summary": "", "questions": "", "limitations": "", "rating": 3, "confidence": 4, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "Strength:\n1. The paper is well-written. \n2. This paper study a new research topic for attacking neural models.  \n\nWeakness:\n1. Efficiency attack is a new research topic and thus this paper seems novel. However, for NMT efficiency attack is not as valuable as accuracy attack. As mentioned in the paper, efficiency is dependent on the length of the output sentence, which is controlled not only by the NMT model itself but also by some heuristics (such as length penalty and max-length). More importantly, it is easy to defend the efficiency attack by using some other heuristics. For instance, one can simply use the length ratio between source and target sentences to constrain the beam search algorithm. This paper does not take into account these decoding heuristics. Therefore, the overall contribution of the current version is limited.\n\n2. The efficiency is closely dependent on the length of the output sentence, but the experiments do not report the efficiency about the length. In addition, the paper does not mention details about the beam search algorithm for decoding such as max-length. \n", "summary_of_the_paper": "This paper considers to attack an NMT system from the perspective of efficiency. At a high level, it aims to slightly modify the input such that the target NMT system outputs a long translation, leading to decreased decoding efficiency. To this end, it proposes a method to guide the input modification such that the probability of EOS is as low as possible. Experiments show that the proposed method outperforms the baseline methods in terms of efficiency attack. \n", "summary_of_the_review": "This paper study a new research topic for attacking neural models, i.e., efficiency attack, but it is not as meaningful as accuracy attack. ", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "", "extra_scores": {"correctness": "3: Some of the paper’s claims have minor issues. A few statements are not well-supported, or require small changes to be made correct.", "technical_novelty_and_significance": "3: The contributions are significant and somewhat new. Aspects of the contributions exist in prior work.", "empirical_novelty_and_significance": "3: The contributions are significant and somewhat new. Aspects of the contributions exist in prior work."}, "extra_text": {}}]

Author rebuttal:

Meta-review: The papers studies a novel problem and proposes an interesting algorithm. That said, the reviewers question the motivation of the paper. That is whether this method presents a viable attack on existing MT systems. The attack is not black box and MT systems often have an output length threshold beyond which the output is trimmed. Given the motivational concerns, I recommend that the paper is revised and resubmitted to other venues.
Decision: Reject