BERT Lost Patience Won't Be Robust to Adversarial Slowdown
Authors: Zachary Coalson
Gabriel Ritter
Rakesh B Bobba
Sanghyun Hong
Venue: NeurIPS 2023 poster (2023)
Keywords: Efficient Methods for NLP; Multi-exit Language Models; Adversarial Slowdown
TL;DR: We show that the computational savings provided by multi-exit language models aren't robust to adversarial slowdown.

Abstract: In this paper, we systematically evaluate the robustness of multi-exit language models against adversarial slowdown. To audit their robustness, we design a slowdown attack that generates natural adversarial text bypassing early-exit points. We use the resulting WAFFLE attack as a vehicle to conduct a comprehensive evaluation of three multi-exit mechanisms with the GLUE benchmark against adversarial slowdown. We then show our attack significantly reduces the computational savings provided by the three methods in both white-box and black-box settings. The more complex a mechanism is, the more vulnerable it is to adversarial slowdown. We also perform a linguistic analysis of the perturbed text inputs, identifying common perturbation patterns that our attack generates, and comparing them with standard adversarial text attacks. Moreover, we show that adversarial training is ineffective in defeating our slowdown attack, but input sanitization with a conversational model, e.g., ChatGPT, can remove perturbations effectively. This result suggests that future work is needed for developing efficient yet robust multi-exit models. Our code is available at: https://github.com/ztcoalson/WAFFLE

BERT Lost Patience
Won't Be Robust to Adversarial Slowdown
Zachary Coalson, Gabriel Ritter, Rakesh Bobba, and Sanghyun Hong
Oregon State University
(coalsons ritterg, bobbar, hongsa mengss/@eregontttteeccmm
Abstract
In this paper, we systematically evaluate the robustness of multi-exit language mod- els against adversarial slowdown. To audit their robustness, we design slowdown attack that generates natural adversarial text bypassing early-exit points. We use the resulting WAFFLE attack as a vehicle to conduct a comprehensive evaluation three multi-exit mechanisms with the GLUE benchmark against adversarial slow- down. We then show our attack significantly reduces the computational savings provided by the three methods in both white-box and black-box settings. The more complex a mechanism is, the more vulnerable it is to adversarial slowdown. We also perform linguistic analysis of the perturbed text inputs, identifying common perturbation patterns that our attack generates, and comparing them with standard adversarial text attacks. Moreover, we show that adversarial training ineffective in defeating our slowdown attack, but input sanitization with a conversational model, e.g., ChatGPT, can remove perturbations effectively. This result suggests that future work is needed for developing efficient yet robust multi-exit models. Our code is available at: https://giiubb.oo//uuuuaso/////
Introduction
A key factor behind the recent advances in natural language processing is the scale of language models pre-trained on large corpus of data. Compared BERT [5] with 110 million parameters that achieves the GLUE benchmark score [36] of 81 % from three years ago. T5 [29] improves the score to 90% with 100x more parameters. However, pre-trained language models with this scale typically require large memory and high computational costs run inferences, making them challenging in scenarios where latency and computations are limited.
To address this issue, ixput-adaptive multi-exit mechanisms proposed. By attaching internal classifiers (or early exits) to each intermediate layer of a pre-trained language model, the resulting multi-exit language model utilizes these exits to stop its forward pass preemptively, when the model is confident about its prediction at any exit point. This prevents models from spending excessive computation for "easy" inputs, where shallow models are sufficient for correct predictions, and therefore reduces the post-training workloads while preserving accuracy.
44 have been
In this work, we study the robustness of multi-exit language models to adversarial slowdown. Recent work [10] showed that, against multi-exit models developed for computer vision tasks, an adversary can craft numan-impprceeptin has not yet been shown that the input-adaptive methods proposed in language domains are susceptible to such input perturbations. It is also unknown why these perturbations cause slowdown and how similar they are to those generated by standard adversarial attacks. Moreover, it unclear existing defenses, e.g., adversarial training 43 proposed in the community can mitigate slowdown attacks.
input perturbations to offset their computational savings. However, it
Our contributions. To bridge this gap, we first develop WAFFLE, slowdown attack that generates natural adversarial text that bypasses early-exits. We illustrate how our attack works in Figure [
37th Conference on Neural Information Processing Systems (NcurIPS 2023).

---

Based on our finding that existing adversarial text attacks [6 43 fail to cause significant slowdown, we design a novel objective function that pushes multi-exit model's predictions its early-exits toward the uniform distribution. WAFFLE integrates this objective into existing attack algorithms.
Second, we systematically evaluate the robust- ness of three early-exit mechanisms 45, 21]
Layer 12
Layer
Acceptable!
on the GLUE benchmark against adversarial slowdown. We find that WAFFLE significantly
Layer
Unaeoeptable
IC
offsets the computational savings provided by the mechanisms when each text input is indi- vidually subject to perturbations. We also show that methods offering more aggressive computa- tional savings are more vulnerable to our attack.
Layer
IC
Layer
KC
"Hi can not have been working"
WAFFLE
"Her can not have been working"
Third, we show that WAFFLE can be effective in black-box scenarios. We demonstrate that our attack transfers, i.e., the adversarial texts crafted with limited knowledge about the vic- tim cause slowdown across different models and multi-exit mechanisms. We are also able to find universal slowdown triggers, i.e., sequences of words that reduces the computa- tional savings of multi-exit language models when attached to any text input from dataset.
Figure 1: Illustrating adversarial slowdown. Re- placing the word "He" with "Her" makes the result- ing text input bypass all 11 ICs (internal classifiers) and leads to misclassification. The text is chosen from the Corpus of Linguistic Acceptability.
Fourth, we conduct linguistic analysis of the adversarial texts WAFFLE crafts. We find that the effectiveness of the attack is not due to the amount of perturbations made on the input text, but rather how perturbations are made. Specifically, we find two critical characteristics present in vast majority of successful samples: (1) subject-predicate disagreement, meaning that subject and corresponding verb within a sentence do not match, and (2) the changing of named entities. These characteristics are highlighted in [31, where it was shown that BERT takes both into account when making predictions.
Fifth, we test the effectiveness of potential countermeasures against adversarial slowdown. We find that adversarial training [2] 4 is ineffective against WAFFL,F. The defended multi-exit models lose efficacy, or they lose significant amounts of accuracy in exchange for aggressive computational savings. In contrast, we show that input sanitization can be an effective countermeasure. This result suggests that future work is needed to develop robust yet effective multi-exit language models.
2 Related Work
Adversarial text attacks on language models. Szegedy et al. (34 showed that neural network predictions can be fool-ed by cimmen-ipprrepptbbee input perturbations and called such perturbed inputs adversarial examples. While carlier work in this direction studied these adversarial attacks on computer vision models 2 25), there has been a growing body of work on searching for adversarial examples in language domains as a result of language models gaining more traction. However, adversarial texts are much harder to craft due to the discrete nature of natural language. Attacks on images leverage perturbations derived from computing gradients, as they are composed of pixel values forming a continouns space, but applying them to texts where each word in discrete space is not straightforward. As result, diverse mechanisms for crafting natural adversarial texts 7 30 20 16 9 19 have been proposed. In this work, we show that an adversary can exploit the language model's sensitivity to input text perturbations to achieve a completely different attack objective, i.c., adversarial slowdown. A standard countermeasure against the adversarial input perturbation is adversarial training that augments the training data with natural adversarial texts [13 47 15 23 43). We also show that adversarial training and its adaptation to our slowdown attacks are ineffective in mitigating the vulnerability to adversarial slowdown.
Input-adaptive efficient neural network inference. Neural networks are, while accurate, computa- tionally demanding in their post-training operations. Kaya et al. [17] showed that overthinking is one problem-thes models use all their internal layers for making predictions on every single input even for the "easy" samples where a few initial layers would be sufficient. Prior work [35 posed multi-exit architectures to mitigate the wasteful effect of overthinking. They introduce multiple internal classifiers (i.c., carly exits) to pre-trained model and fine-tune them on the training data to
pro-

---

make correct predictions. During the inference on input, these early-exits enable input- appativee inference, i.c., model stops running forward if the prediction confidence is sufficient at an exit.
adapted the multi-exit architectures to language models, their computations inference. DeeBERT [4]] and FastBERT [22) have been proposed, both straightforward adaptations of multi-exit architectures to language models. Zhou et al.
Recent work 32
e.g., BERT 5
45 proposed patience-baae based early exits (PABEE) and showed that one could achieve efficiency, accuracy, and robustness against natural adversarial texts. Liao et al. [21] presented PastFuture that makes predictions from global perspective, considering past and future predictions from all the exits. However, no prior work studied the robustness of the computational savings that these mechanisms offer to adversarial slowdown [TO]. We design a slowdown attack to audit their robustness. More comparisons of our work to the work done in computer vision domains are in Appendix A
Our Auditing Method: WAFFLE Attack
3.1 Threat Model
We consider an adversary who aims to reduce the computational savings provided by victim multi-exit language model. To achieve this goal, the attacker performs perturbations to natural test-time text input z E S. The resulting adversarial text x' needs more layers to process for making a prediction. This attack potentially violates the computational guarantees made by real-time systems harnessing multi-exit language models. For example, the attacker can increase the operational costs of the victim model or push the response time of such systems outside the expected range.
Just like language models deployed in the real-world that accept any user input, we assume that the attacker has the ability to query the victim model with perturbed inputs. We focus on the word-level perturbations they are well studied and efficient perform with word embeddings [28]. But is straightforward to extend our attack to character-lewe or sentence-leve attacks by incorporating the slowdown objective we design in Sec 3.2 into their adversarial example-crafting algorithms.
To assess the slowdown vulnerability, we comprehensively consider both white-box and black-box settings. The white-box adversary knows all the details of the victim model, such the training data and the model parameters, while the black-box attacker has limited knowledge of the victim model.
3.2 The Slowdown Objective
Most adversarial text-crafting algorithms iteratively apply perturbations text input until the resulting text x' achieves a pre-defined goal. The goal here for the standard adversarial attacks is the untargeted misclassification of x', i.e., fe (x') * y. Existing adversarial text attacks design an objective (or score) function that quantifies how the perturbation of a word (e.g., substitution or removal) helps the perturbed sample achieve the goal. At each iteration the attacker considers all feasible perturbations and chooses one that minimizes the objective the most.
We design our score function to quantify how close perturbed sample x' is to causing the worst-case slowdown. The worst-case we consider here is that x' bypasses all the early exits, and the victim model classifies x'' the final layer. We formulate our score function s(x', fo) follows:
Σ (1- OKISK
1 (1-())((()))))))
Here, the score function takes x' as the perturbed text and fa as the victim model. computes the loss C between the softmax output of an i-th internal classifier F; and the uniform probability distribution i over classes. We use & loss. K is the number of early-exits, and N is the number of classes.
The score function returns value in [0. 1]. It becomes one if all F; is close to the uniform distribution ÿ; otherwise, will be zero. Unlike conventional adversarial attacks, our score function over iterations pushes all F; to ý (i.e, the lowest confidence case). Most early-exit mechanisms stop forward pass F prediction confidence higher than a pre-defined threshold T; thus, x' that achieves the lowest confidence bypasses all the exit points.

---

3.3
end for The WAFFLE Attack
We finally implement WAFFLE by incorporating the slowdown objective we design into existing adversarial text attacks. In this work, we adapt two existing attacks: TextFooler [16] and A2T [43] TextFooler is by far the strongest black-box attack [38], and A2T is gradient-based white-box attack. In particular, A2T can craft natural adversarial texts much faster than black-box attacks; thus, it
facilitates adversarial training of language models. We discuss the effectiveness of this in Sec 7
We describe how we adapt TextFooler for auditing the slowdown risk in Algorithm | (see Appendix for our adaptation of A2T). We highlighted our adaptation the original Textfooler blue.
(line 1-6) Compute word importance. We first compute the importance of cach word wy in a text input x. TextFooler re- moves each word from x: and computes their influence on the final prediction result. It then ranks the words based on their influence. In contrast, we rank the words based the increase in the slowdown objective after each removal. By perturbing only few words, we can minimize the alterations to x and keep the semantic similarity between æ' and x. Following the original study, we filter out stop words, e.g., 'the" or 'when', to minimize sentence structure destruction.
Algorithm 1 WAFFLE (based on TextFooler)
Input: a text input x [1, W2, .... W its label the victim model fe. its early exits Fj, sentence similarity function Sim(-), its threshold word embeddings E' over the vocabulary V, and the attack success threshold a. Output: natural adversarial text x!
1: x' +-
2: for each word w, in x do
3: Compute the importance Iw,
4: end for
5: Compose
W of all words wy sorted by the descending order of their importance
6: Remove the stop words from the set W
7: for each word w, in W do
8: Initiate the of substitute candidates C by com- puting the top N synonyms; we compute the cosine similarity between Ex, and E where w' E V
(line 7-9) Choose the set of candidate words for substitution. The attack then works by replacing a of words in x with the candidates carefully cho- sen from V. For each word wy E x, the attack collects the set of C' candidates by computing the top N synonyms from V (line 8). It computes the cosine similar- ity between the embeddings of the word and the word w' V. We use the same embeddings (28 that the original study uses. TextFooler only keeps the candidate words with the same part-of- speech (POS) as w, to minimize gram- mar destruction (line 9).
9:
C POSFiler(C)
10:
Cyinal +- O
for Cg do do
12:
x temp & Replace wy with eæ in x' Sim(atemp, x') > then Add e to Crinal Sg + -fo(x
13:
14:
15:
16:
end if end for
17:
18:
if 3ce
whose score is 8k 2 a then Keep the candidates C₁ E Cfinal c* <- argmax SeneeCaaa,Simaa are
19:
20:
21:
(line 10-28) Craft a natural slow- down text. We then iterate over the remaining candidates and substitute w; with Ck. the text after this substitu- tion temmp is sufficiently similar to the text before x', we store the candidate CR into Cfinat and compute the slow- down score 8g. In the end, we have a perturbed text input x' that is similar to the original input within the e similarity and the slowdown score sy (line 10-17). To compute the semantic similarity, we use Universal Sentence Encoder that the original study uses 3
x' + Replace Wy with c* in x'
22:
return x
else 8n. (x') ) > min 8y then 24: c² -- aaggmaxxceCCr..m.m
23:
8k x' Replace Wy with c* in x
25:
26:
end
27:
28:
return x
In line 20-26, if there exists any candidate es that already increases the slowdown score Sy over the threshold a we choose the word with the highest semantic similarity among these winning candidates. However, when there is no such candidate, we pick the candidate with the highest slowdown score, substitute the candidate with wi, and repeat the same procedure with the next word W;+1- At the end (line 28), TextFooler does not return any adversarial example if fails to flip the prediction. However, as our goal is causing slowdown, use this adversarial text even when the score is 5 S a.

---

Auditing the Robustness to Adversarial Slowdown
We utilize our WAFFLE attack vehicle evaluate the robustness of the computational savings provided by multi-exit language models. Our adaptations of two adversarial text attacks, TextFooler and A2T, represent the black-box and white-box settings, respectively.
Tasks. We evaluate the multi-exit language models trained on seven classification tasks chosen from the GLUE benchmark [3:] RTE, MRPC, MNLI, QNLI, QQP, SST-2, and CoLA.
Multi-exit mechanisms. We consider three early-exit mechanisms recently proposed for language models: DecBERT [41], PABEE [45], and Past-Future [21]. In DeeBERT, we take the pre-trained BERT and fine-tune on the GLUE tasks. We use the pre-trained ALBERT [8] for PABEE and Past-Future. To implement these mechanisms, we use the source code from the original studies. We describe all the implementation details, e.g., the hapeeepar choices, in Appendix.
Metries, We employ two metries: classification accuracy and efficacy proposed by Hong et al. [10] We compute both the metrics on the test-set or the adversarial texts crafted on S. Efficacy is standardized metric that quantifies a model's ability to use its early exits. It is close to one when higher percentage of inputs exit at an early layer; otherwise, is O. To quantify the robustness, we report the changes in accuracy and efficacy of a clean test-set S and S perturbed using WAFFLE.
4.1 Multi-exit Language Models Are Not Robust to Adversarial Slowdown
GLUE Task
Attack
Metric
RTE
MNLI
MRPC
QNLI
QQP
SST-2
CoLA
DeeBERT (BERT-base)
TF
Acc. EIT.
48
-
88 7
92 -
79 + 57
0.34
0.32
0.35
0.32
0.35
0.33
0.36
0.40
0.34 0.20
Acc.
63
+ 52
82 75
88 -181
92 74
79 - 66
A2T
EIT.
0.34
0.32
0.33
0.35
0.35
0.36
0.41
0.34 - 0.29
Acc.
63 + 51
61
88 62
92
79 70
WAFFLE (TF)
EIT.
0.34 + 0.11
0.35 - 0.09
0.35 + 0.10
0.36 - 0.22
0.34 - 0.13
WAFFLE (A2T)
Acc.
57
+
88 + 78
92 +
79 - 73
EIT.
0.34 0.19
0.35 0.17
0.35
0.19
0.36
0.30
0.34 - 0.24
PABEE (ALBERT-base)
TF
Acc.
34
83 25
37
91 33
92
Eff.
0,24 + 0.22
0.28 - 0.17
0.32
0.21
0.31
0.18
0.37 - 0.27
0.37 + 0.26
0.32 0.23
A2T
Acc.
57
83 - 52
63
91 +171
92 92-+1
93 76
82 38
EIT.
0.24++
0.28
0.21
0.32- 0.26
0.31+ 0.27
0.37++0.31
0.37++..2
0.32- 0.23
WAFFLE (TF)
Acc.
79 57
83 + 38
87 47
91 51
92 -2 67
93 -33-400 50
82 + 48
Emr.
0.24 - 0.09
0.28 - 0.05
0.32
0.08
0.31
+ 0.06
0.37 - 0.17
0.37
- 0.08
0.32 - 0.08
WAFFLE (A2T)
Acc.
83 69
73
91 82
82 60
Eft.
0,24 + 0.17
0.28 - 0.18
0.32 -+ 0.21
0.32 + 0.23
0.37 - 0.27
0.37 - 0.29
0.32 0.19
PastFuture (ALBERT-
TF
Acc.
74 41
86 - 42
88 36
92 - 52
92 - 50
Eft.
0.52 0.46
0.50
- 0.24
0.50
0.24
0.50 + 0.19
0.52 - 0.35
Acc.
58
86
92 74
A2T
EIT.
0,52 + 0.49
0.50 - 0.32
0.50 -+ 0.31
0.50
- 0.35
0.52 - 0.43
WAFFLE (TF)
Acc.
74 +151 51
86 + 45
-
92 + 58
92 -
EIT.
0,51 0.17
0.50 0.05
0.50 0.15
0.50
0.07
0.52 0.25
WAFFLE (A2T)
Acc.
74 64
86 - 67
88
72
92 + 83
92-+
Emr.
0.52 - 0.36
0.50
0.26
0.50
0.29
0.50 - 0.33
0.52 - 0.39
Table 1:
Robustness of multi-exit language models to our slowdown attacks. WAFFLE signifi- cantly reduces the computational savings offered by DeeBERT, PABEE, and PastFuture. In each cell, we report the accuracy (acc.) and efficacy (eff.) on a clean test set and its corresponding adversarial texts generated by the four attacks (-+ denotes going from the clean test set the adversarial texts).
Table shoows our evaluation results. Following the original studies, we set the early-exit threshold, i.e., entropy or patience, so that multi-exit language models have 0.33-0.5 efficacy on the clean test set (see Appendix for more details). We use four adversarial attacks: two standard adversarial attacks, TextFooler (TF) and A2T, and their adaptations: WAFFLE (TF) and WAFFLE (A2T). We perform
5

---

these attacks on the entire test-set and report the changes in accuracy and efficacy. In each cell, we include their flat changes and the values computed on the clean and adversarial data in parenthesis.
Standard adversarial attacks are ineffective in auditing slowdown. We observe that the standard attacks (TF and A2T) are ineffective in causing a significant slowdown. In DeeBERT, those attacks cause negligible changes in efficacy (-0.05-0.14 14), while they inflict a large accuracy drop (7%-25%). Against PABEE and PastFuture, we find that the changes are slightly higher than those observed from DeeBERT (i.e., 0.02-0.15 13 and 0.03-0.31). We can observe slowdowns in PastFuture, but this is not because the standard attacks are effective in causing slowdowns. This indicates the mechanism is more sensitive to input changes, which may lead to greater vulnerability to adversarial slowdown.
WAFFLE is effective auditing tool for assessing the slowdown risk. We show that our slowdown attack can inflict significant changes in efficacy. In DeeBERT and PABEE, the attacks reduce the efficacy 0.06-0.26 and 0.07-0.29, respectively. In PastFuture, we observe more reduction in efficacy 0.13-0.45. These multi-exit language models are designed to achieve an efficacy of 0.5:-0.5; thus its reduction up to 0.29-0.45 means a complete offset of their computational savings.
The more complex a mechanism is, the more vulnerable it is to adversarial slowdown. WAFFLE causes the most significant slowdown on PastFuture, followed by PABEE and DeeBERT. PastFuture stops forwarding based on the predictions from past exits and the estimated predictions from future exits. PABEE also uses patience, i..., how often we observe the same decision over early-exits. They enable more aggressive efficacy compared to DeeBERT, which only uses entropy. However, this aggressiveness can be exploited by our attacks, e.g., introducing inconsistencies over exit points; thus, PABEE needs more layers to make a prediction.
4.2 Sensitivity to Attack Hyperparameter
The key hyperparameter of our attack, the attack success threshold (a), determines the magni- tude of the scores pursued by WAFFLE while crafting adversarials. The score measures how uniform all output distributions of F; are. A higher pushes WAFFLE to have higher slow- down score before returning a perturbed sample, Figure 2 shows the accuracy and efficacy of all three mechanisms on QNLI against a in [0.1, 1]. We show that increases, the slowdown (represented as a decrease in efficacy) increases, and the accuracy decreases.
RABEE
DecBERT
PestFuture
Acc.uacy
0.8
Efficacy
Accuracy Efticacyy
D2
0.6
0.8
Threshold
In addition, as a increases, the rate of decrease in accuracy and efficacy decreases. Note that in PastFuture, when a 2 0.4 the rate at which efficacy decreases drops by large margin. The
Figure 2: The impact of on accuracy and effi- cacy. Taking each model's results on QNLI, as a is increased, the accuracy and efficacy decrease. same applies to accuracy, and when a 0.8, accuracy surprisingly increases, a potentially undesirable outcome. Moreover, when 2 0.8 efficacy does not decrease any further, which potentially wastes computational resources as the time required to craft samples increases greatly as a is increased.
5 Practical Exploitation of WAFFLE in Black-box Settings
In S we show in the worst-case scenarios, multi-cxit language models are not robust to adversarial slowdown. We now turn attention to black-box settings where adversary does not have full knowledge of the victim's 's system. We consider two attack scenarios: (1) Transfer-bact where an adversary who has the knowledge of the training data trains surrogate models to craft adversarial texts and use them to attack the victim models. (2) Universal attacks where an attacker finds set of trigger words that can inflict slowdown when attached to any test-time inputs. We run these experiments across various GLUE tasks and show the results from the RTE and QQP datasets. We include all our results different datasets and victim-surrogate combinations in the Appendix.
attacks
Transferability of WAFFLE. We first test if our attack is transferable in three different scenarios: (1) Cross-sced; (2) Cross fooss-accittcctre; and (3) Cross Etossmmechanism Table 2 summarizes our results.

---

RTE
QQP
Model
Arch.
Mechanism
Scenario
Type
Acc.
Eff.
Acc.
Eff.
S
BERT
PastFuture
S-+S
66 > 52
0,47 + 0.11
91 - 72
0,50 + 0.26
Cross-seed
V
BERT
PastFuture
S-:V
66 + 55
0.50 0.25
91 -2
0.51 + 0.33
S
BERT
PABEE
Cross-arch.
S-+S
66 49
0.22 0.08
91 69
0.35 0.16
V
ALBERT
PABEE
S-+V
77 + 55
0.22 0.21
91 + 74
0.36 0.34
S
BERT
PABEE
Cross-mech.
S-5S
66 + 49
0.22
0.08
91 + 69
0.35 + 0.16
V
BERT
PastFuture
S-V
66 + 55
0.50 0.29
91 + 74
0.51 - 0.38
$ = Surrogate model; = Victim model
Table 2: Transfer- based attack results. Results from the cross-seed, cross-mechanism, and cross- architecture experiments on RTE and QQP. In all experiments, craft adversarial texts the surrogate model (S) and then evaluated on both the surrogate (S-5) and victim (S+V) models.
Cross-seed. Both the model architecture and early-exit mechanism identical for the surrogate and the victim models. In RTE and QQP, our transfer attack (S (S+V) demonstrates a sigmificant slowdown on the victim model, resulting in reduction in efficacy of 0.25 and 0.18, respectively. In comparison to the white-box scenarios (S -S), these attacks achieve approximately 50% effectiveness.
Pross-architecture. We vary the model architecture, using either BERT or ALBERT, while keeping the early-exit mechanism (PABEE) the same. Across the board, we achieve the lowest transferability among the three attacking scenarios, with reduction in efficacy of 0.01 in RTE and 0.02 in QQP, respectively. This indicates that when conducting transfer-basee based attacks, the matching of the victim and surrogate models' architectures has greater impact than the early-exit mechanism.
Cross- mechanism. We now vary the early-exit mechanism used by the victim and surrogate models while the architecture (BERT) remains consistent. In QQP and RTE, we cause significant slowdown to the victim model (a reduction in efficacy of 0.21 and 0.13, respectively), even when considering the relational speed-up offered by different mechanisms (e.g.. PastFuture offers more computational savings than PABEE and DeeBERT). The slowdown is comparable to the white-box cases (S -S).
Universal slowdown triggers. If the attacker is unable to train surrogate models, they can find a few words (i.e., a trigger) that causes slowdown to any test-time inputs when attached. Searching for such a trigger does not require the knowledge of the training data. To demonstrate the practicality of this attack, we select 1000 random words from BERT's vocabulary and compute the total slowdown across 10% of the SST-2 test dataset by appending each vocab word to the beginning of every sentence. We then choose the word that induces the highest slowdown and evaluate it against the entire test dataset. We find that the most effective word, "unable", reduces efficacy by 9% and accuracy by 14% when appended to the beginning of all sentences once. When appended three times successively (i.e. "unable unable unable..." "), the trigger reduces efficacy by 18% and accuracy by 3%.
Lingusitic Analysis of Our Adversarial Texts
To qualitatively analyze the text generated by WAFFLE, we first consider how the number of perturba- tions applied an input text affects the slowdown induces. We choose samples crafted against PastFuture [21]. due to it being the most vulnerable to our attack. We select the datasets that induce the most and least slowdown, MNLI and QQP, respectively, in order to conduct a well-rounded analysis. Using 100 samples randomly drawn from both datasets, we record the percentage of words perturbed by WAFFLE and the consequent increase exit layer. In Figure 3 we find that there is no relationship between the percentage of words perturbed and the increase exit layer. It is not the number of perturbations made that affects slowdown, but rather how perturbations are made.
In an effort to find another explanation for why samples crafted by WAFFLE induce slowdown on multi-exit models, we look to analyze the inner workings of BERT. Through the qualitative analysis performed by Rogers et al. [31]. we find particular interest in two characteristics deemed of high importance to BERT when makes predictions: (1) predicctt agreement and (2) the changing of named entities. In our experiment, these characteristics are incredibly prevalent in successful attacks. Particularly, we find that the score assigned by WAFFLE is much higher when the subject and predicate of sentence do not match, named entity is changed. In addition, WAFFLE
7

---

Tack
Original Test
Perturbed Text
Change
RTE
Sentence2: Moun: Olympus is in the center the eart.
Sentence:: Mourt Olynguu lowers up from center the cauth.
Sentence1; Install Olympus lowerss up from facilitios the planet.
Sentenoc2: Mount Olympus the center of the earth.
8--12
MNLI
1lypothesis: I'll make him struight
Premise: twis him,
[lypccesis:: I'll implement him consecutive.
Premise: benling him, sir.
8--12
MRPC
Semienc2:: Ms Stewari, 61, ... did not attend.
Senience]: Ms Skewart, the chief executive, was not expected to atlend.
Sentenoe2: Ms Stewart, S1, ... did not attnn.
Sentenee:: Lena Stewart, the choef execute, was not scheduledd to help.
7--12
ONLI
Senience: This World's is fuir devosed a building to electrical exhibits.
Question: Where did the Exposition take place!
Question: Whereby did the Shows takes place?
Sentence: This World's i Fair devoting a building to electrical exhibits.
7--12
OUP
Question:: Why do we need philosophize with ochers?
Question:: Why do we need philosophize?
Question:: Why got we needing to philosopiize with othens?
Question:: Why do we need to philosophize?
10-112
SST22
it's cookle cutter movie, a cat and puste job.
it's cookie cuiter cinematiographt. a out and paste worked.
7--12
CoLA
I'll work on it cun.
I'll task on it me can.
7--12
Table Adversarial texts generated by WAFFLE. An example of text perturbed by WAFFLE from each dataset, using samples crafted for PABEE. They show how subject-predicate disagreement and the changing of named entities can push previously early-exited samples to the final output layer.
often changes non-verbs into verbs or removes verbs entirely, causing further subject-predicant discrepancies. Table 3 shows an example of these characteristics across all the GLUE tasks. Note that pubject-predicate agreement appears much more often.
To quantify the prevalence of these characteristics, we analyze 100 adversarial texts, from QQP crafted on DeeBert, most effective in inducing slowdowns and count the number of samples containing subject- predicate disagreement or a changed named entity. Of the 100 samples, 84% had a cubject-predicat dis- agreement and 31% % a changed named entity. An im- smaller percentage points
MN
QQP
Increase in Layer
portant note is that in a changed named entity than in a subject- -bbecct-predicae disagreement, not all samples have named entity.
We believe that these two characteristics induce a high amount of slowdown because they can push samples toward outtof-distribution. BERT was trained to have an acute understanding of language and its nuances. therefore not expected to have the disagreement between the subject and predicate of a sentence in its training data (unless that is the task it is trained for c.g. CoLA). Also, according to Rogers et al. B1I, BERT likely lacks a general idea of named entities, providing an explanation as why the model is less confident in an answer when a named entity is changed.
30
33
0.4
06
Percentage of Words Perturoed
Figure 3: Visualizing the relationship be- tween words perturbed and adversarial slowdown induced. Taking 100 random samples from MNLI and QQP (crafted against the PastFuture model), the percent- age of words that WAFFLE perturbed and the resulting increase in exit layer is plotted (a greater increase in exit layer indicates greater slowdown). The figure shows that the per- centage of words perturbed has no influence over a sample's 's ability to induce slowdown.
Moreover, we analyze samples produced by the base attacks (TF and A2T), and compare them with samples produced by WAFFLE. Surprisingly, we find great deal of similarity, particularly with regard to the usage of the two characteristics detailed above, despite the base attacks inducing negligible slowdown. A potential explanation for this is that both types of attacks construct out-of dfdittiibbutiinn samples, but change a model's confidence to varying extents. The base attacks likely increase confidence in the wrong answer to much larger degree than WAFFLE, encouraging carly-exits with mispredictions in a majority of cases. In contrast, WAFFLE works by reducing confidence across all of the classes
7 Potential Countermeesurrss
We now test the effectiveness of potential countermeasures against adversarial slowdown. We first evaluate adversarial training (AT), standard countermeasure that reduces the sensitivity of a model to adversarial input perturbations. We then discuss a way to sanitize the perturbations applied to inputs by running off-the-shelf tools, such grammar-checking tool, to remove attack artifacts.
To evaluate, we use the AT proposed by Yoo and Qi 43). This AT requires significantly fewer computational resources; thus, it is better suited for adversarially training large language models. We
8

---

run AT with two different natural adversarial texts, those crafted by A2T and by WAFFLE (adapted from A2T). During training, we attack 20% of the total samples each batch. We run our experiments with PABEE trained on RTE and SST-2. We first set the patience to 6 (consistent with the rest of our experiments), but we set it to for the models trained with WAFFLE (A2T). Once trained, we examine the defended models with attacks stronger than A2T: TextFooler (TF) and WAFFLE (Ours).
AT is ineffective against our slow- down attacks. Table shows that AT significantly reduces the efficacy of model. Compared to the undefended models, the defended models achieve ~0 efficacy. As these models do not utilize early exits, they seem robust to our attacks. But certainly, it is not desirable. It is noticeable that the de- fended models still suffer from large accuracy drop. We then decided to set the patience to two, i.e., the multi-exit language models use early-exits more aggressively. The defended models have either very low efficacy or accu- racy, and our attacks can reduce both. This result highlights a trade-off between being robust against adversarial slowdown and being efficient. We leave further explorations as future work.
AT
Attack
RTE
SST-2
Acc.
Eff.
Acc.
Etr.
TF Ours
81 31-48 8
0.04 0.04
92
0.04
0.04
81 - 60
0.04 - 0.04
92 + 59
0.04
0.04
A2T
TF Ours
72 24
0.13 -.13
89 - 10
0.08 - 0.07
72 + 59
0.13 - 0.14
89 + 56
0.08 - 0.07
TF Ours
78-77
0.04
0.04
92
0.04 0.04
A2T (Ours)
78 -6.56
0.04 -> 0.04
92 61
0.04 0.04
TF Ours
53 53
0.65
0.65
90 ->
0.05 0.04
53 - 53
0.65
0.65
90 - 57
0.05
0.04
Table 4: Effectiveness of AT. AT is ineffective against WAF- FLE. The defended models completely lose the computa- tional efficiency (i.e., they have ~0 efficacy), even with the aggressive setting with the patience of 2. P is the patience.
Input sanitization can be defense against adversarial slowdown. Our linguistic analysis in See shows that the pubject-predicate discrepancy is one of the root causes of the slowdown. Building on this insight, we test if sanitizing the perturbed input before feeding into the models can be countermeasure against our slowdown attacks. We evaluate this hypothesis with two approaches.
We first use OpenAI's ChatGPT a conversational model where we can ask questions and get answers. We manually query the model with natural adversarial texts generated by WAFFLE (TF) and collect the revised texts. Our query starts with the prompt "Can you fix all of these?" followed by perturbed texts in the subsequent lines. We evaluate with the MNLI and QQP datasets, on 50 perturbed test-set samples randomly chosen from each. We compute the changes in accuracy and average exit number on the perturbed samples and their sanitized versions. We compute them on the PastFuture models trained on the datasets. Surprisingly, we find that the inputs sanitized by ChatGPT greatly recovers both accuracy and efficacy. In MNLI, we recover the accuracy by 12 percentage points (54%~>661 and reduce the average exit number by (11.5+7.55. In QQP, the accuracy is increased by 24 percentage points (5%%, and the average exit number is reduced by 2.5 (9.6+7.1)).
We also test the effectiveness of additional grammar-checking tools, such as Grammarly and language tool pythor in defeating our slowdown attacks. We run this evaluation using the same settings as mentioned above. We feed the adversarial texts generated by our attack into Grammarly and have it correct them. Note that we only take the Grammarly recommendations for the correctness and disregard any other recommendations, such as for clarity. We find that the inputs sanitized by Grammarly still suffer from a significant accuracy loss and slowdown. In MNLI, both the accuracy and the average exit number stay the same 56%-55% and 9.5,, respectively. In QQP, we observe that there is almost no change in accuracy (54%~588) or the average exit number (11.5~11155.
8 Conclusion
This work shows that the computational savings that input-adaptive multi-exit language models offer not robust against adversarial slowdown. To evaluate, we propose WAFFLE, adversarial text- crafting algorithm with the objective of bypassing early-exit points. WAFFL.F significantly reduces the computational savings offered by those models. More sophisticated input-adaptive mechanisms suited for higher efficacy become more vulnerable to slowdown attacks. Our linguistic analysis
'ChatGPT: http://ppnna..omo///o//cccgggg//
"Grammrrly: https://www. https//www.raammary.com
3 LLnguagge Tool (Python):

---

exposes that it is not about the magnitude of perturbations but because pushing imput outside the distribution on which a model trained easy. We also show the limits of adversarial training in defeating our attacks and the effectiveness of input sanitization defense. Our results suggest that future research required to develop efficient yet robust input-adaptive multi-exit inference.
Limitations, Societal Impacts, and Future Work
As shown in work, word-level perturbations carefully calibrated by WAFFLE make the resulting natural adversarial texts offset the computational savings multi-exit language models provide. How- ever, there have been other types of text perturbations, e.g., character-level 6 1 sentence-level perturbations (37 We have not tested whether an adversary can adapt them to cause slowdowns. If these new attacks are successful, contribute to lowering the confidence of the predictions made by internal classifiers (early-exit points). It may also render potential countermeasures, such as input sanitization, ineffective. Future work is needed to investigate attacks exploiting different perturbations to cause adversarial slowdown.
can hypothesize that some other attributes of language models
To foster future research, developed WAFFLE in open-source adversarial attack framework, TextAttack (27). This will make our attacks more accessible to the community. A concern is that potential adversary mechanisms outside the expectations. But we believe that our offensive measures will be adopted broadly by practitioners and have them audit such systems before they are publicly available.
those attacks to push the behaviors of systems that harness multi-exit
We have also shown that using state-of-the-art conversational models, such as ChatGPT, to sanitize perturbed inputs can be an effective defense against adversarial slowdown. But it is unclear what attributes of those models were able to remove the artifacts (i.e., perturbations) our attack induces. Moreover, the fact that this defense heavily relies on the referencing model's capability that the victim cannot control may give room for an adversary to develop stronger attacks in the future.
It is also possible that when using conversational models online as a potential countermeasure, there will be risks of data leakage. However, our proposal does not mean to use ChatGPT as-is. Instead, since other input sanitation (Grammarly) failed, we used it as accessible tool for input sanitization via conversational model as a proof- Proof-of-coneee cf-coneppt that may have effectiveness a defense. Alternatively, a defender can compose input sanitization by leveraging off-the-shelf models like Vicuna- 1cc
completely in-house solution 4 We leave this exploration as future work.
An interesting question is to what extent models like ChatGPT offer robustness to the conventional adversarial attacks that aim to reduce a model's 's utility in the inference time. But this is not the scope of our work. While the conversational models we use offer some robustness to our slowdown attacks with fewer side-effeect,, does not mean that this direction bulletproof against all adversarial attacks and/or adaptive adversaries in the future. Recent work shows two opposite views about the We envision more future work on this topic.
robustness of conversational models 39 49
We find that the runtime of the potential countermeasures we explore in Sec is higher than the average inference time of undefended multi-exit language models. This would make them useless from pure runtime standpoint. However, we reason that the purpose of using these defenses was primarily exploratory, aiming understand further why specific text causes more slowdown and how modifying such text can revert this slowdown. Moreover, input sanitization is already used in commercial models. Claude-2" conversational model similar ChatGPT, already employs input-filtering techniques, which we believe, when combined together, is promising future work direction. Defenses with less computational overheads must be an important area for future work.
Overall, this work raises an open-question to the community about the feasibility of input-adaptic efficient inference large language models. We believe future work is necessary to evaluate this feasibility and develop a mechanism that kills two birds (efficacy and robustness) with one method.
'nttps//cllude.aa
10

---

Acknowledgements
We thank the anonymous reviewers for their constructive feedback. Zachary Coalson and Sanghyun Hong are partially supported by the Google Faculty Research Award and the Samsung Global Research Outreach (GRO) program. Gabriel Ritter and Rakesh Bobba are partially supported by the U.S. Department of Transportation. The findings and conclusions in this work are those of the author(s) and do not necessarily represent the views of the funding agency.
References
[1] N. Boucher, I. Shumailov, R. Anderson, and N. Papernot. Bad characters: Imperceptible nlp attacks. In 2022 IEEE Symposium on Security and Privacy (SP), pages 1987-2004. IEEE, 2022.
[2] N. Carlini and D. Wagner. Towards evaluating the robustness of neural networks. In 2017 IEEE Symposium Security and Privacy (SP), pages 39-57, 2017. doi: 10.1109/SP.011.49.
[3] D. Cer, Y. Yang, S.-y. Kong, N. Hua, N. Limtiaco, R. St. John, N. Constant, M. Guajardo- Cespedes, S. Yuan, C. Tar, B. Strope, and R. Kurzweil. Universal sentence encoder for English. In Proceedings of the 2018 Conference Processing: System Demonstrations, pages 169-174, Brussels, Belgium, Nov. 2018. Association for Computational Linguisties. doi: 10.18653/ 1/D18-2022 orq/D18 2029
Empirical Methods in Natural Language
URL ht https::/aacaatttooogy)
[4] W.-L. Chiang, Z. Li, Z. Lin, Y. Sheng. Z. Wu, H. Zhang, L. Zheng, S. Zhuang, Y. Zhuang. J. E. Gonzalez, al. Vicuna: An open-source chatbot impressing gpt-4 with 90%* chatgpt quality. See https://vicuna. Imsys. org (accessed 14 April 2023), 2023.
[5] J. Devlin, M.-W. Chang, K. Lee, and K. Toutanova. Bert: Pre-training deep bidirectional transformers for language understanding, 2019.
[6] J. Ebrahimi, D. Lowd, and D. Dou. On adversarial examples for character-level neural machine 09030
translation. CoRR, 005/1806.0900 2018. URL
[7] Ebrahimi, A. Rao, D. Lowd, and Dou. HotFlip: White-box adversarial examples for text classification. In Proceedings of the 56th Annual Meeting of the Association for Computational Linguistics (Volume 2: Short Papers), pages 31-36, Melbourne, Australia, July 2018. Association for Computational Linguistics. doi: 10. 1/551/6111181200000 URL
[8] Garg and G. Ramakrishnan. Bae: Bert-based adversarial examples for text classification, 2020.
[9] C. Guo, A. Sablayrolles, H. Jégou, and D. Kiela. Gradient-based adversarial attacks against text transformers. In Proceedings of the 2021 Conference on Empirical Methods in Natural Language Processing, pages 5747-5757, Online and Punta Cana, Dominican Republic, Nov. 2021. Association for Computational Linguistics. doi: 10.18653/v 1ttp://11122111mmm//// .ewnlp-main.n4664 main.464. httptttss///aaaaaiieaa
20221 emnlp- main. meiin.4.. 464
[10] S. Hong, Y. Kaya, I.-V. Modoranu, and T. Dumitras. A panda? no, it's a sloth: Slowdown attacks on adaptive multi-exit neural network inference. In International Conference on Learning Representations, 2021. URL htttps:///penreeeee net.///wweeeeeeee.ee..ee...eeeee wtw.:mmmmdddxx222eee
[11] G. Huang, D. Chen, T. Li, F. Wu, L. Van Der Maaten, and K. Q Weinberger. Multi-scale dense networks for resource efficient image classification. arXiv preprint arXiv: 170300944, 2017.
[12] M. Ivgi and J. Berant. Achieving model robustness through discrete adversarial training. arXiv preprint arXiv:2104.05506. 2021.
[13] R. Jia, A. Raghunathan, K. Göksel, and P. Liang. Certified robustness to adversarial word substi- tutions. In Proceedings of the 2019 Conference on Empirical Methods Natural Language Pro- cessing and the 9th International Joint Conference on Natural Language Processing (EMNLP- IJCNLP), pages 4129-411444 4142, Hong Kong, China, Nov. 2019. Association for Computational Linguistics. doi: 18.18653/v 11153//1/D11///1 1423. URL https: : wwt.:/aaaanttttoooo htw..a/.w....oooooooo/o//-----

---

[14] H. Jiang, P. He, W. Chen, X. Liu, J. Gao, and T. Zhao. Smart: Robust and efficient fine-tuning for pre-trained natural language models through principled regularized optimization. arXiv preprint arXiv: 11991.00337 2019.
[15] H. Jiang, P. He, W. Chen, X. Liu, J. Gao, and T. Zhao. SMART: Robust and efficient fine- tuning for pre-trained natural language models through prineipled regularized optimization. In Proceedings of the 58th Annual Meeting of the Association for Computational Linguistics, pages 2177-2190, Online, July 2020. Association for Computational Linguistics. doi: 10. 10.18653/v1/ 2020.acl- 1020.acl-main... 197. https::/aclaa
org 2020 acl main.197.
[16] D. Jin, Z. Jin, J. T. Zhou, and P. Szolovits. Is bert really robust? strong baseline for natural language attack on text classification and entailment, 2020.
[17] Y. Kaya, S. Hong, and T. Dumitras. Shallow-deep networks: Understanding and mitigating network overthinking. In International conference on machine learning, pages 3301-3310. PMLR, 2019.
[18] Z. Lan, M. Chen, S. Goodman, K. Gimpel, P. Sharma, and R. Soricut. Albert: A lite bert for self-supervised learning of language representations. In International Conference on Learning Representations, 2020. URL
[19] D. Li, Y. Zhang, H. Peng, L. Chen, C. Brockett, M.-T. Sun, and B. Dolan. Contextualized perturbation for textual adversarial attack. In Proceedings of the 2021 Conference of the North American Chapter of the Association for Computational Linguisties: Human Language Technologies, pages 5053-5069, Online, June 2021. Association for Computational Linguis- ties. doi: 10.1 121118655/112222 maw.:222..aaammmmmm00000 URL https: antho ogy. bgy.org/20211
naacl m1.1-mma.1. -m..annnn. in.inn..00 400
[20] J. Li, S. Ji, T. Du, B. Li, and T. Wang. Textbugger: Generating adversarial text against real-world applications. In 26th Annual Network and Distributed System Se- curity Symposium, NDSS 2019, San Diego, Califormia, USA February 24-27, 2019. The Internet Society, 2019. URL
rextbugger-generaal ng- www.eeeeerannnn-ddeeaaaaa...a..a -tet ort.
[21] K. Liao, Y. Zhang, X. Ren, Q. Su, X. Sun, and B. He. A global fast-future early exit method for accelerating inference of pre-trained language models. In Proceedings of the 2021 Conference of the North American Chapter of the Association for Computational Linguistics: Human Language Technologies, pages 2013-2023, Online, June 2021. Association for Computational Linguistics. doi: 10.1866.... 20153/v1/202 mmacc-main.lee 162. URL https::/aalamtthllogy/ org/ 2021 1222.maacl-main
[22] W. Liu, P. Zhou, Z. Wang, Z. Zhao, H. Deng, and Q. Ju. FastBERT: self-distilling BERT with adaptive inference time. In Proceedings of the 58th Annual Meeting of the Association for Computational Linguisfics, pages 6035-6044, Online, July 2020. Association for Computational Linguistics. doi: 10. 10.18653/1122020.ccmmmaa
URL h //acl wow.ollnnnhhhooooooooooo
537
[23] X. Liu, H. Cheng, P. He, W. Chen, Y. Wang, H. Poon, and Gao. Adversarial training for large neural language models, 2020. RtLlshtts://arxx http:/awwwwvrgg..ae.e/. .rg/ hat//bbs/0000 08994
[24] X. Liu, H. Cheng, P. He, W. Chen, Y. Wang, H. Poon, and Gao. Adversarial training for large neural language models. arXiv preprint 2r04v:2004 08994, 2020.
[25] A. Madry, A. Makelov, L. Schmidt, D. Tsipras, and A. Vladu. Towards deep learning models resistant to adversarial attacks. International Conference on Learning Representations, 2018
URL /RRL:tttee///ppeeeeeieeeett
[26] T. Miyato, A. M. Dai, and I. Goodfellow. Adversarial training methods for semi-supervised text classification. In International Conference on Learning Representations, 2017. URL
https://cpenrevice net Eorum?id=r1x3s
12

---

[27] J. Morris, E. Lifland, J. Y. Yoo, J. Grigsby, D. Jin, and Y. Qi. Textattack: A framework for adversarial attacks, data augmentation, and adversarial training in nlp. In Proceedings of the 2020 Conference on Empirical Methods in Natural Language Processing: System Demonstrations, pages 119-126, 2020.
[28] N. Mrkšić, D. Ó Séaghdha, B. Thomson, M. Gašić, L. M. Rojas-Barahann Barahona, P.-H. Su, D. Vandyke, T.-H. Wen, and Young. Counter-fitting word vectors to linguistic constraints. Proceedings of the 2016 Conference of the North American Chapter of the Association for Computational Linguistics: Human Language Technologies, pages 142-148, San Diego, California, June 2016. Association for Computational Linguistics. doi: 10. (0.18653/11/11--11 1018. URL [RLpttas
[29] C. Raffel, N. Shazeer, A. Roberts, K. Lee, S. Narang, M. Matena, Zhou, W. Li, and J. Liu. Exploring the limits of transfer learning with unified text-to-text transformer. Journal of Machine Learning Research, 21(140):1-67, 2020. URL http:// jmlr.. httpamarrrrrrraaaemmeeeemeoeeeee pttps//ppprrs//////
20-074.0 html
[30] S. Ren, Y. Deng, K. He, and W. Che. Generating natural language adversarial examples through probability weighted word saliency. In Proceedings of the 57th Annual Meeting of the Association for Computational Linguistics, pages 1085-1097, Florence, Italy, July 2019. Association for Computational Linguistics. doi: 10.18653/v1/P19/ 100., URL https
//aclanthologg www.tthooooo.oo//11111111 wxtg/19-1/11111
[31] A. Rogers, O. Kovaleva, and A. Rumshisky. A primer in bertology: What we know about how bert works. Transactions of the Association for Computational Linguistics, 8:842-866 866, 2020.
[32] R. Schwartz, G. Stanovsky, S. Swayamdipta. J. Dodge, and N. A. Smith. The right tool for the job: Matching model and instance complexities. In Proceedings of the 58th Annual Meeting of the Association for Computational Linguistics, pages 6640-663 6651, Online, July 2020. Association for Computational Linguistics. doi: 10.
URL
https://acl httr:::://clannhhlloo.ooogggg lotho oog.olgg2220000000000 ac1 -ma 1n.593
[33] I. Shumailov, Y. Zhao, D. Bates, N. Papernot, R. Mullins, and R. Anderson. Sponge examples: Energy-latency attacks on neural networks, 2021.
[34] C. Szegedy, W. Zaremba, I. Sutskever, J. Bruna, D. Erhan, I. J. Goodfellow, and R. Fergus. Intriguing properties of neural networks. In Y. Bengio and Y. LeCun, editors, 2nd International Conference on Learning Representationss ICLR 2014, Banff, AB, Canada, April 14-16, 2014, Conference Track Proceedings, 2014. URL http:://rxiiv owg.iiiiiir.i.oooooooooooo www./orggabbba.b.. 111//1111.. 6199
[35] S. Teerapittayanon, B. McDanel, and H.-T. Kung. Branchynet: Fast inference via early exiting from deep neural networks. In 2016 23rd International Conference on Pattern Recognition (ICPR), pages 2464-2469, IEEE, 2016.
[36] A. Wang, A. Singh. J. Michael, F. Hill, O. Levy, and S. R. Bowman. GLUE: A multi-task benchmark and analysis platform for natural language understanding. In International Con- ference on Learning Representations, 2019. URL https::/
id=
FJ4km2R5t7
[37] B. Wang, H. Pei, B. Pan, Q. Chen, S. Wang, and B. Li. T3: Tree-autoencoder constrained adversarial text generation for targeted attack. In Proceedings of the 2020 Conference on Empirical Methods in Natural Language Processing (EMNLP), pages 6134-6150 Online, Nov. 2020. Association for Computational Linguistics. doi: 10. 10.18653/w1/2020..oor http:////2222001111eee emnlp-main.499 URL httll:ttps/////mtmm hcclaachooyy..aaaooooooooo wwtpoog...200...ooooo wtwp:/200.eemlppm1.. www.p-enalllmeeeeeee main. 495
[38] B. Wang, C. Xu, S. Wang, Z. Gan, Y. Cheng, J. Gao, A. H. Awadallah, and B. Li. Adversarial GLUE: A multi-task benchmark for robustness evaluation of language models. In Thirty-fftth Conference on Neural Information Processing Systems Datasets and Benchmarks Track (Round 2), 2021. URL http::tsss///eerreeeeee
net./ wwt.::/ee.....umememm www.rummii-GFFSSSKKF
[39] J. Wang, X. Hu, W. Hou, H. Chen, R. Zheng, Y. Wang, L. Yang. H. Huang, W. Ye, X. Geng, et al. On the robustness of chatgpt: An adversarial and out-of-distriibtioo perspective. arXiv preprint 230. 2023.
13

---

[40] K. Xie, S. Lu, M. Wang, and Z. Wang. Elbert: Fast albert with confidence-inddww based early exit. ICASSP 2021 2021 IEEE International Conference on Acoustics, Speech and Signal Processing (ICASSP), pages 7713-7717,
doi: 10. 199/CCASSP9999222222.44144
[41] J. Xin, R. Tang, J. Lee, Y. Yu, and J. Lin. DeeBERT: Dynamic early exiting for accelerating BERT inference. In Proceedings of the 58th Annual Meeting of the Association for Com- putational Linguistics, pages 2246 2251, Online, July 2020. Association for Computational Linguistics. URL https:: www. aclweb org/ ant
aci www.eiimmnnii.om 204
[42] J. Xin, R. Tang, Y. Yu, and J. Lin. BERxiT: Early exiting for BERT with better fine-tuning and extension regression. In Proceedings of the 16th Conference of the European Chapter of the Association for Computational Linguistics: Main Volume, pages 91-104, Online, Apr. 2021. Association for Computational Linguistics. doi: 10.18653/v1/202 leal--main.. URL
https:
[43] J. Y. Yoo and Y. Qi. Towards improving adversarial training of NLP models. In Findings of the Association for Computational Linguistics; EMNLP 2021, pages 945-956, Punta Cana, Dominican Republic, Nov. 2021. Association for Computational Linguistics. doi: 10.18653/ v1/2021. 11/2021.indings- Andings-emmllp.8 81
htttsstts::///// ogg www.olllgyyoogg22.... org/202
Findings emn'
[44] Z. Zhang, W. Zhu, J. Zhang. P. Wang, R. Jin, and T.-S. Chung. PCEE-BERT. Accelerating BERT inference via patient and confident early exiting. In Findings of the Association for
Computational Linguistics: NAACL 2022, pages 327-338. Seattle, United States, July 2022. Association for Computational Linguistics. doi: 10.18653/1120222 findings-nacc.255. URL
findinginnnggg ngs nwacl. .25
[45] W. Zhou, C. Xu, T. Ge, J. McAuley, K. Xu, and F. Wei. Bert loses patience: Fast and robust inference with early exit. In Advances in Neural Information Processing Systems, volume 33, pages 18330-18344 Curran Associates, Inc., 2020. URL /RL/sttpe://ppoceeiins neerips
pdf
[46] C. Zhu, Y. Cheng, Z. Gan, S. Sun, T. Goldstein, and J. Liu. Freelb: Enhanced adversarial training for natural language understanding. arXiv preprint 1909. 2019.
[47] C. Zhu, Y. Cheng, Z. Gan, S. Sun, T. Goldstein, and J. Liu. Freelb: Enhanced adversarial training for natural language understanding. In International Conference Learning Representations, 2020. URL
[48] W. Zhu. LeeBERT: Learned early exit for BERT with cross-level optimization. In Proceedings of the 59th Annual Meeting of the Association for Computational Linguistics and the 11th International Joint Conference on Natural Language Processing (Volume 1: Long Pupers), pages 2968 2980, Online, Aug. 2021. Association for Computational Linguistics. doi: 10. 18653/v1/2021.co acc-ooog..--
[49] A. Zou, Z. Wang, J. Z. Kolter, and M. Fredrikson. Universal and transferable adversarial attacks on aligned language models, arXiv preprint 2.0.:::3007.50433 2023.
14

---

A Comparison to Related Attacks in Prior Work
Here, we expand upon our discussion See 2 and discuss the novelty of our slowdown attack compared to the attacks developed in prior work [1 10]
Prior work 33 has shown that an adversary can increase the energy consumption of language models in modern computing hardware via "sponge" examples. These inputs exploit computational properties of hardware or tokenization, c.g., input dimensionality and/or activation sparsity, to increase the inference runtime. In contrast, our attack is serddare--ggnsstee and targets multi-exit language models, a new algorithm for efficient language model computations. No prior work has been done on adversarial slowdowns in the context of multi-exit language models, and our attack is the first that generates natural adversarial text that bypasses the early-exit layers of multi-exit models.
Compared to the slowdown attacks in the computer vision domain [10]. we also highlight the unique challenges we address: (1) Against language models, we often do not have access to input gradients (which is straightforward in attacks against computer vision models). We thus need to design new slowdown objective compatible with non-gradient-boe
(2) We must bound the values of slowdown objective within [0, 1]. The objective used in the prior work [10) is unbounded to [0, oo]: thus, a straightforward adaptation of this objective for adversarial text-attack algorithms leads to unbounded perturbations, and the resulting text completely differs from the original one. (3) The attack against language models works with discrete text inputs; not all embedding-
attacks.
perturbations compute exist words, and small changes to input (word, characters) result in large logit changes. We must search for candidate words (or word combinations) for substitution.
B Experimental Setup in Detail
Here, describe our experimental setup in detail. We implement all the multi-exit mechanisms and our attacks using Python and Py PyTorch v v1.109that supports CUDA 1 11.7 for accelerating computations by using GPUs. We take the pre-trained language models (i.e., BERT and ALBERT) from Hugging Face and fine-tune them on GLUE benchmarks. Our experiments run on a machine equipped with Intel Xeon Processor with 48 cores, 64GB memory and Nvidia A40 GPUs.
Multi-exit language models. All the early-exit mechanisms we employ, i.e., DeeBERT, PABEE, and PastFuture, takes a pre-trained language model, attaches internal classifier (i.e., early-exit) to each internal layer, and fine-tune the entire model on a task. We choose the pre-trained BERT ('bert- base-uncased") and ALBERT ('alber--base-22 v2') from Hugging Face. We fine-tur -une them seven different GLUE tasks for five epochs. We choose a batch-size from 32, 64, 128 and a learning rate from 1e-5, 2e-5, 3e-5, 4e-5, 5e-5. We perform hyper-parameter sweeping over all the combinations and select the models that provide the best accuracy for each task. We select the early-exit thresholds based on the values in the original studies. In DeeBERT [41], we pick the entropy that offers 1.5x computational speedup. In PABEE (5). we choose the patience value of 6. In PastFuture (21] we set the entropy values where we achieve 2x speedup.
Choice of the slowdown metric. Prior work on early-exit mechanisms uses two metrics: wall-clock time and speedup. DeeBERT uses wall-clock time, but it is not desirable metric the metric depends on the choice of hardware or software librarics, such as deep learning frameworks. PABEE and PastFuture propose speedup, ratio between the total number of layers and the number of layers required to make a prediction. They compute this ratio over the entire test-set samples and report the average value. However, it is also not accurate estimation of the computational savings, as depending on model architectures, the number of parameters in layer and the way it computes the inputs could be different. As result, we employ efficacy that counts the number of floating-poin computations. Note that BERT and ALBERT are both stacks of Transformer layers; this, luckily, the speedup is the inverse of the efficacy.
C
The WAFFLE Attack Based on A2T
*Python: https//wwww.pyhhon.rgg
'PyTorch: https://pytorch.org
'Hugging Face: https///luggingface.oo
15

---

We show how we adapt A2T [33 for audit- ing the slowdown risk in Algorithm 2 We highlighted our adaptation to A2T in blue.
Algorithm 2 WAFFLE (based A2T)
Input: a text input I = {WI, W2, .... W the victim model fei transformation module T(x, i) that per- turbs æ by replacing w;; and the success threshold a. Output: a natural adversarial text x
(line 1-2) Compute word importance. We first compute the importance of each word w; in a text input x. The procedure is the same as shown in Sec 3.3 we remove each word from x' and compute the influence on the slowdown objective. We then rank the words based on how much each removal increases the slowdown score 8,, We also filter out stop words, e.g., 'the" or 'when'.
1: Calculate I [(w)) for all words wi by making one forward and backward pass.
2: R t ranking T1, r2; ...: I' of words w1, Wn by descending importance
3: x= +- x
4: for i 11, "...... I' in R do
5:
X Xennd - T(x",1
(line 3-13) Craft a natural adversarial text. The attack then works by replacing a set of words in x with the candidates care-
6:
if Xoand + 0 then
7:
x² < arggax 8:(4", Jo)
8:
if 2 a then
fully chosen by T(x", i). The transforma-
9:
return x²
tion function T' selects the top 20 synonyms that has the similar embeddings [28]. based on the cosine similarity. We only keep the candidates with the same part-of-speech as Wi; to minimize grammar destruction.
10:
end if
11: end if
12: end for
13: return x²
We then substitute w; with the candidate that maximizes the slowdown score 8, (1(", fo) after the substitution. If the text after this substitution x² increases the slowdown score over the threshold a, we return x². However, when there is no such candidate, we pick the candidate with the highest slowdown score, substitute the candidate with w;, and repeat the same procedure with the next word W1+1- In the end, we return x² even when the slowdown score does not meet the threshold a.
D Data and Code Availability
As part of the reproducible research practice, we release our data and source code along with our submission. Our WAFFLE attacks are implemented using TextAttack [27). a Python framework for testing a model's robustness adversarial attacks. We also include our attacks on the TextAttack This will encourage practitioners and Al-system engineers developing (or employing) input- adaptive efficient inference mechanisms to test their robustness to adversarial slowdown.
repe 8
E
More Results on Transferability of WAFFLE
Here we provide further results from our transferability experiments in Sec For the cross-seed and cress-mechanism attacks, we show all victim-surrogate combinations involving all three early-exit mechanisms. For the arosttcrchie attack, we show our results on all seven GLUE tasks.
Table the entire results from the cross-seed transfer- attacks. Examining all the three early-exit mechanisms, attacking the victim model using the adversarial texts crafted the surrogate models causes approximately 50% of the slowdown induced when attacking the surrogate directly.
T all results from the cross- mechanism attack scenario. In majority of -urtiaesurooatte combinations, we observe the slowdown similar to the cross-seed scenario. This makes sense, as only the early-exit mechanisms differ which account for a small number of parameters relative to the entire model. The result also imply that even if an attacker does not know the specific early-exit mechanism of the target model, high slowdown
still be induced.
Table shows all results from the cross- architerceee attack. We run our experiments with the entire GLUE tasks. Compared to the previous two attacks, the cross-architecture attack is less effective. This implies that knowing the target's architecture is a critical when exploiting adversarial transferability. If architecture is known, a strong attack can still be launched even if the early-exit mechanism and parameter values remain unknown to the attacker.
TTxttAttck: http://ggihubbooo///ppaa//tttttt
16

---

RTE
QQP
Model
Arch.
Mechanism
Type
Acc.
Eff.
Acc.
Eff.
BERT
DeeBERT DeeBERT
S
67 +
0.32 - 0.11
91 + 76
0.32 + 0.18
V
BERT
S - V
64 + 52
0.36 + 0.23
91 77
0.35 0.30
S
BERT BERT
PABEE PABEE
S S
66 + 49
0.22 + 0.08
91 - 69
0.35 - 0.16
S V
65 + 61
0.22 + 0.14
91 71
0.35 0.26
S
BERT
PastFuture
S-+ S
66 52
0.47 - 0.11
91 72
0.50 0.26
BERT
PastFuture - V
66 + 55
0.50 - 0.25
91 - 72
0.51 - 0.33
$ = Surrogate model; V Victim model
Table 5: Cross-seed attack results. In all cases, the efficacy of the white-box attacks (S-+S) is significantly reduced while the efficacy of the transfer attacks (S-V) comparatively drops.
RTE
QQP
Model
Arch.
Mechanism
Type
Acc.
Eff.
Acc.
Eff.
BERT BERT
PastFuture DeeBERT
+ S
66 + 52
0.47 - 0.11
91 + 72
0.50 + 0.26
V
S 3 V
64 + 51
0.36 + 0.26
91 70
0.35 0.28
S
BERT
PABEE DeeBERT
S
66 + 49
0.22 0.08
91 69
0.35 0.16
BERT
S + V
64 - 50
0.36 - 0.28
91 - 73
0.35 + 0.31
BERT
DeeBERT PABEE
- S
67 55
0.32 + 0.11
91 - 76
0.32 + 0.18
V
BERT
S V
65 53
0.22 - 0.19
91 67
0.35 0.26
BERT
PastFuture
S S
66 66-55
0.47 -
91 72
0.50 0.26
V
BERT
PABEE
S + V
65 57
0.22 + 0.18
91 + 76
0.35 + 0.31
BERT
DeeBERT
S S
67 + 55
0.32 + 0.11
91 - 76
0.32 + 0.18
BERT
PastFuture
S-V V
66 + 54
0.50 0.40
91 76
0.51 0.46
BERT
PABEE
S S
66 + 49
0.22 0.08
91 69
0.35 0.16
BERT
PastFuture
S + V
66 + 55
0.50 - 0.29
91 - 74
0.51 - 0.38
$ Surrogate model; V Victim model
Table 6: Cross-mechanise attack results. While not as effective as the cross-seed attack, marginal efficacy drops are seen for most victim-suree surroga pairs.
More Discussion on Our Linguistic Analysis Results
Here, we provide further insights regarding our linguistic analysis performed Sec Conventional wisdom from studies in computer vision suggests that if adversary leverages larger input pertur- bations (e.g., the perturbations are bounded to 16 pixels), their attack will be stronger than attacks with smaller input perturbations (e.g.. 8 pixels). In other words, if a model is robust against attacks perturbing 16 pixels at most, the model is also robust to the 8-pixel bounded perturbations.
However, we find that this is not true for our slowdown attacks. Investigating the adversarial texts generated from our "unbounded" slowdown attacks, we could not find the correlation between the attack strength and the number of word-level perturbations. This result questions the effectiveness of adversarial training (AT), a standard defense that trains a model with bounded adversarial texts [26] In 7 we show that vanilla AT is ineffective countermeasure (and also causes undesirable consequences, e.g., the utility and efficacy loss a model).
46 [4] 24
43 We also offer an alternative insight for developing future defenses. In Sec O we show that an adversary can exploit the subject-predicate mismatch to make model less confident about the perturbed sample's prediction. This misalignment, while easier for humans to identify, is difficult for a target model to do so. Thus, in Sec we propose to leverage models able correct grammatical errors, including the subject-predicate mismatches, for sanitizing inputs before being fed to the target
17

---

Model
Type
Metric
QNLI
QQP
SST-2
CoLA
ALBERT
Acc.
77 - 55
85
88
90
91 -1
81 -3
V
BERT
S-
Ace.
65 -1
-3
82 43
89 -4 69
91 -
91
82 -2.5.
ENT.
0.22 0.30
0.24 0.16
0.34 0.10
0.29 0.24
0.35 + 0.34
0.32 0211
0.34 + 0.24
S
BERT
S
Acc.
E.I.
66 49
0.08
82 - 30
0.06
81 -4
0.14
89 -157
91 -9
0.16
0.32-4
91 55
77 63
0.26
v
ALBERT
--
Acc-
77 63
85
86
91
91
-244
EX:
0.22 0.21
0.28
- 0.16
0.32 - 0.22
0.32 - 0.22
0.36 - 0.34
0.36 + 0.28
0.22 + 0.22
$ Surrogate model; V Victim model
Table 7: Cross-architecture attack results. With PABEE the early-exit mechanism, attack BERT-based models with an ALBERT-basee surrogate and vice-versa on all GLUE tasks.
multi-exit models. But we find that such models are either far too slow to be practical or do not offer enough benefits. The result suggests future work in input sanitization for fast and effective methods.
G Impact of WAFFLE on Runtime
We provide results on the impact of our attacks runtime and compare it with the efficacy metric we use. Table shows our results on DeeBERT across multiple datasets.
QQP
RTE WAFFLE
QNLI Clean
MRPC
CoLA
Metric
Clean
WAFFLE
Clean
WAFFLE
Clean
WAFFLE
Clean
WAFFLE
Efficacy
0.36
0.34
0.12
0.35
0.09
0.35
0.10
0.13 10.04s
Runtime
7.50s
2.75s
3.418
3.73s
4.68s
7.78s
10.70s
7.84s
Table 8: Impact of WAFFLE on runtime. With DeeBERT as the victim's 's mechanism, report the runtime (in seconds) and efficacy of clean and perturbed samples on five GLUE tasks. We run our experiments on a single Tesla V100 GPU. These results indicate that WAFFLE increases the actual runtime multi-exit language models and that runtime is inversely correlated to efficacy.
The results show that WAFFLE increases the actual runtime of multi-exit language models, i.e., slowdown results apply to real-world scenarios. Additionally, a reduction in efficacy is correlated with increase in runtime. We choose efficacy metric to quantify the slowdown (as opposed to runtime) because the metric is hardware agnostic. The exit layer number we use to compute efficacy will not change between models run different hardware configurations.
18


Reviews:
[{"review_id": "aiWWw6pPlQ", "reviewer": "Reviewer_KooQ", "summary": "This paper evaluates the robustness of multi-exit language models against adversarial slowdown. The authors propose a slowdown attack that generates natural adversarial text to bypass early-exit points. They conduct a comprehensive evaluation of three multi-exit mechanisms using the GLUE benchmark and demonstrate that their attack significantly reduces the computational savings provided by these mechanisms in both white-box and black-box settings. The study reveals that more complex mechanisms are more vulnerable to adversarial slowdown. Adversarial training is found to be ineffective in countering the slowdown attack, while input sanitization with a conversational model like ChatGPT can effectively remove perturbations. The paper concludes by emphasizing the need for future research in developing efficient and robust multi-exit models.", "questions": "In general, this paper is well written with complete story and comprehensive analysis. The reviewers would appreciate if the authors could improve on several perspectives:\n- Highlighting the difference of slow-down attack between language and vision task to show the challenges this paper resolved.\n- Providing some discussing regarding the linguistic analysis on the adversarial examples to provide actual insights of improve the language model/exit classifiers in the future.\n- Limitation of the paper should be discussed to shed light on potential future works along this direction.", "limitations": "The authors did not have a section regarding the limitation discussion.", "rating": 6, "confidence": 4, "soundness": 3, "presentation": 3, "contribution": 3, "strengths": "- Proposed the first slow-down attack on language models.\n- Evaluate the proposed methods on different architectures (i.e., early-exit mechanisms)\n- Demonstrate the effectiveness of the methods in different threat models/attack settings (i.e., black-box, white-box)\n- Analysis on generated adversarial examples is conducted to provide further insights into the vulnerability of the model\n- Mitigation and defense methods are discussed to show that sanitization methods are more effective compared to robust training method.", "weaknesses": "- Since the slow-down attack has been demonstrated in vision task, the challenge of adapting it to language model is not clear.\n- The proposed slow-down objective seems trivial in terms of novelty.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "We thank the reviewer for the time to read and provide valuable feedback. Below, we provide answers to the questions and concerns. We will also include this discussion in the final version of our paper.\n\n—\n\n> (Weakness 1 and Question 1) Highlighting the difference of slow-down attack between language and vision task to show the challenges this paper resolved.\n\nWe first clarify the unique challenges we addressed in developing our slowdown attacks, compared to ones developed for computer-vision models, as follows: (1) Against language models, we often do not have access to input gradients (which is straightforward in attacks against computer-vision models). We thus need to design a new slowdown objective compatible with non-gradient-based attacks. (2) We must bound the values of our slowdown objective within [0, 1]. We found that the objective used in the prior work [1] is unbounded to [0, inf]; thus, a straightforward adaptation of this objective for adversarial text-attack algorithms leads to unbounded perturbations, and the resulting text completely differs from the original one. (3) The attack against language models works with discrete text inputs; not all embedding-level perturbations we compute exist as words and small changes to input (word, characters) can result in large logit changes. We must search for candidate words (or word combinations) for substitution. Due to the space limits, we summarized the challenges in Line 74–78, but for clarity, we will include this discussion in the final version of our paper. \n\n[1] Hong et al., A Panda? No, It’s a Sloth: Slowdown Attacks on Adaptive Multi-exit NN Inference\n\n\n> (Weakness 2) The proposed slow-down objective seems trivial in terms of novelty.\n\nThank you for your comment, we acknowledge that we could have been more clear on the novelty of our work and will expand the Appendix accordingly.  As we clarified in our response to the first question, due to the differences between CV and NLP, it was unclear how well the attacks would work if at all.  For space and readability reasons, we did not show all of the variations of the attack, search methods, and objective functions that we attempted in order to find the most effective methodology. Additionally, NLP has additional dimensions of semantics and sentence structure which we analyze in order to understand why the attacks work and how to defend against them.\n\n—\n\n> (Question 2) Providing some discussing regarding the linguistic analysis on the adversarial examples to provide actual insights of improve the language model/exit classifiers in the future.\n\nWe thank the reviewer for pointing out this. We acknowledge that due to the space limitations, our connections to future work are unclear. We first clarify that our purpose of providing the linguistic analysis (Sec 6) is not just to provide our attack’s characteristics but to shed light on future directions for bringing efficient and robust multi-exit language models. We highlight some of the less clear  lessons Sec. 6 offers as follows, and we will also update the final version of our paper to better describe them.\n\n**Models Robust to Larger Perturbations May Not Be Robust to Smaller Perturbations**\n\nConventional wisdom from studies in computer vision is that: if an adversary leverages larger input perturbations (e.g., the perturbations are bounded to 16 pixels), their attack will be stronger than the attacks with smaller input perturbations (e.g., 8 pixels). In other words, if we robustify a model against the attacks perturbing 16 pixels at most, the model is also robust to the 8-pixel bounded perturbations.\n\nHowever, we show this is not true for our slowdown attacks. Investigating the adversarial texts generated from our “unbounded” slowdown attacks, we could not find the correlation between the attack strengths and the perturbation amounts. It questions the effectiveness of adversarial training, a conventional defense that trains a model with bounded adversarial texts. The observation led to our first experiments on potential countermeasures, and we show that adversarial training is ineffective (and also causes undesirable consequences, e.g., the utility and efficacy loss of a model). For future work this suggests adversarial training is still not mature and may need to utilize linguistic information.\n\n**Input Sanitization May Be A Promising Direction for Defeating Slowdown Attacks**\n\nSec 6 offers an alternative insight for developing future defenses. We show that an adversary can exploit the subject-predicate mismatch to make a model less confident about the perturbed sample's prediction. This misalignment, while easier for humans to identify, is difficult for a target model to do so. Thus, in Sec 7, we propose to leverage models able to correct grammar errors, including the subject-predicate mismatches, for sanitizing inputs before being fed to the target multi-exit models. However, input sanitization may be slow which offsets the early exit speedup and we showed that some sanitization methods may not be effective either. This suggests future work in input sanitization for fast and effective methods, where we uncovered some key linguistic features that may be necessary. \n\n—\n\n> (Question 3) Limitation of the paper should be discussed to shed light on potential future works along this direction. The authors did not have a section regarding the limitation discussion.\n\nWe kindly remind the reviewer that we discuss the limitations and future work in Appendix E.\n\n"}, {"review_id": "JTsmMPR1v8", "reviewer": "Reviewer_9ThA", "summary": "The paper evaluates robustness of multi-exit language models against specifically perturbed datapoints that induce adversarial slowdown and controbutes to the literature on availability attacks. The paper targets language models, as opposed to the vision models that were explored in the existing literature. The paper presents WAFFLE and attack that forces the early exists to be avoided and ultimately slows down the computation. The paper then explores the constracted examples and finds that they appear slightly more out of distribution. ", "questions": "Thank you very much for the paper, I enjoyed the read very much. I really only have two comments. \n\n1. To the best of my knowledge, availability attacks against language models were previously done by Shumailov et al. with Sponge examples (EuroS&P, https://arxiv.org/abs/2006.03463) and similarly adopted by Boucher et al (reference [1] in the paper). How would these attacks do in comparison to WAFFLE? \n\n2. Would you expect to see more performance degradation if text were turned even more out of distribution? Are there cases where ChatGPT defence would not work?", "limitations": "-", "rating": 5, "confidence": 4, "soundness": 3, "presentation": 3, "contribution": 3, "strengths": "+ Interesting important setting", "weaknesses": "+ Unclear performance with respect to the related work", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "We thank the reviewer for the time to read and provide feedback. Below, we provide answers to the questions and concerns. We will also include this discussion in the final version of our paper.\n\n—\n\n> (Question 1) To the best of my knowledge, availability attacks against language models were previously done by Shumailov et al. with Sponge examples (EuroS&P) and similarly adopted by Boucher et al (reference [1] in the paper). How would these attacks do in comparison to WAFFLE?\n\nWe first clarify that our attack is the first of its kind: a slowdown attack that generates natural adversarial text that bypasses the early-exit layers of multi-exit models. Sponge examples [1] (and as used in  Bad Characters [2]) are ‘resource’ attacks. They exploit computational properties of hardware or tokenization, e.g., input dimensionality and/or activation sparsity, to increase the inference runtime. In contrast, our attack is hardware-agnostic and targets multi-exit model architectures, a new algorithm for efficient language model computations.\n\n[1] Shumailov et al., Sponge Examples: Energy-Latency Attacks on Neural Networks, IEEE 2021\n\n[2] Boucher et al., Bad characters: Imperceptible nlp attacks, IEEE 2022\n\n—\n\n> (Question 2) Would you expect to see more performance degradation if text were turned even more out of distribution? Are there cases where ChatGPT defense would not work?\n\nFollowing our linguistic analysis in Sec. 6, we do suspect that further pushing samples towards out-of-distribution would further degrade performance. The quantification of an out-of-distribution sample may be non-trivial, but we believe some evidence of the previous claim is exhibited in Fig. 2. As we increase the attack success threshold, i.e. the score needed to satisfy our slowdown objective in Sec. 3.2, both the accuracy and efficacy of the victim models decrease. This could in part be due to these samples being pushed further out-of-distribution, a claim in alignment with our linguistic analysis.\n\nWe also agree that it is an interesting question to ask to what extent conversational models like ChatGPT offer robustness to adversarial slowdown. However, it is not the scope of our work and requires future work. While ChatGPT shows some robustness to OOD and adversarial attacks in the prior work [2], we clarify that our claim is **not** that ChatGPT is robust to any attacks with input text perturbations. Instead, as a tool for realizing input sanitization, we observe that ChatGPT provides some effectiveness with fewer side-effects. We next envision future work on evaluating the robustness of input sanitization via conversational models against adaptive adversaries; recent work [3] would be a nice starting point. We will include this discussion in the final version of our paper.\n\n[2] Wang et al., On the Robustness of ChatGPT: An Adversarial and Out-of-distribution Perspective\n\n[3] Zou et al., Universal and Transferable Adversarial Attacks on Aligned Language Models\n"}, {"review_id": "T3nXvijXs4", "reviewer": "Reviewer_Lh1p", "summary": "This papper proposes WAFFLE, a slowdown attack to generate natural adversarial text bypassing early-exits. \nEmpirical results show the robustness of multi-exit language models against adversarial slowdown.", "questions": "1.Whether the proposed method can still work properly on other transformer architectures, such as GPT-2, RoBERTA?\n", "limitations": "The authors adequately addressed the limitations.", "rating": 7, "confidence": 2, "soundness": 3, "presentation": 3, "contribution": 3, "strengths": "\n1.The paper is well-written and easy to follow.\n\n2.The evaluation is comprehensive.\n", "weaknesses": "\n1.It seems reference[1] does similar slowdown attacks, but [1] works on computer vision domain. What are the differences between WAFFLE and [1]?\n\n2.Does WAFFLE still work on non-transformer based architectures, such as LSTM?\n\n\n\n[1] Hong, S., Kaya, Y., Modoranu, I.V. and Dumitras, T., 2020, October. A Panda? No, It's a Sloth: Slowdown Attacks on Adaptive Multi-Exit Neural Network Inference. In International Conference on Learning Representations.\n", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "We thank the reviewer for the time to read and provide constructive feedback. Below, we answer the questions and concerns. We will also include this discussion in the final version of our paper.\n\n—\n\n> (Weakness 1) It seems reference [1] does similar slowdown attacks, but [1] works on computer vision domain. What are the differences between WAFFLE and [1]?\n\nWe first clarify that while our work and the work done in [1] both achieve slowdown against multi-exit models, differences in problem domain lead to differences in approach. (1) Against language models, we often do not have access to input gradients (which is straightforward in attacks against computer-vision models). We thus need to design a new slowdown objective compatible with non-gradient-based attacks. (2) We must bound the values of our slowdown objective within [0, 1]. We found that the objective used in the prior work [1] is unbounded to [0, inf]; thus, a straightforward adaptation of this objective for adversarial text-attack algorithms leads to unbounded perturbations, and the resulting text completely differs from the original one. (3) The attack against language models works with discrete text inputs; not all embedding-level perturbations we compute exist as words and small changes to input (word, characters) can result in large logit changes. We must search for candidate words (or word combinations) for substitution. Due to the space limits, we summarized the challenges in Line 74–78, but for clarity, we will include this discussion in the final version of our paper. \n\n[1] Hong et al., A Panda? No, It’s a Sloth: Slowdown Attacks on Adaptive Multi-exit NN Inference\n\n—\n\n> (Weakness 2) Does WAFFLE still work on non-transformer based architectures, such as LSTM?\n\nGiven the nature of our attack, it is necessary that a victim model contain early-exits. To the best of our knowledge, there is no prominent work on LSTM based early-exit models for the natural language processing domain. So, we have not tested on LSTM models. We focus on transformer-based architectures due to their effectiveness and future potential in the NLP domain. However, if there is a recommended LSTM model, we would be happy to investigate. \n\n—\n\n> (Question 1) Whether the proposed method can still work properly on other transformer architectures, such as GPT-2, RoBERTA?\n\nWe provide evidence of WAFFLE’s transferability between different models and architectures by testing three different model-architecture pairs in our main analysis in Sec. 4. Further combinations are tested in Sec. 5, which shows that WAFFLE transfers well between transformer-based models.\n\nTo answer the reviewer's question explicitly, we tested several multi-exit models with RoBERTa and found similar slowdown results as the BERT versions. This is unsurprising because RoBERTa is essentially a BERT model but with a modified and improved set of hyperparameters. At the time of our implementation, GPT-like early exit models were not yet prominent and it would have taken significant time and resources to modify GPT-2 with early exit methods and retrain the models. We acknowledge that some now exist, such as [1, 2], and results would be interesting to see. \n\n[1] Schuster et al., Confident Adaptive Language Modeling, NeurIPS 2022\n\n[2] Din et al., Jump to Conclusions: Short-Cutting Transformers With Linear Transformations, arXiv 2023\n"}, {"review_id": "O8C0R9IJrr", "reviewer": "Reviewer_69Mr", "summary": "The paper considers adversarial slowdown attacks on multi-exit text classification models based on BERT. They propose an attack, Waffle, which adapts text adversarial example attacks to a slowdown objective. They measure the susceptibility of multi-exit models for GLUE to their attack, evaluate attack transferability, analyze their generated adversarial text, and discuss mitigations for this attack.", "questions": "What running time impact do your adversarial slowdown attacks have? How much time do the grammar checking countermeasures take?\n\nHow often do subject-predicate agreement and changing named entities result in slowdown? What fraction of successful slowdowns fall into these buckets?", "limitations": "The running time of experiments is never measured, which is a limitation that is not mentioned in the paper. \n\nData leakage in ChatGPT may also be a factor in the countermeasures.", "rating": 6, "confidence": 4, "soundness": 3, "presentation": 3, "contribution": 2, "strengths": "The evaluation is quite broad in the classification tasks considered, multi-exit models used, and baselines. I also appreciated the transferability analysis and the \"UAP\".\n\nI was interested to see the linguistic analysis of attacks. The linguistic markers mentioned seem plausible and I like the qualitative analysis in Table 3. However, I would like to also see some quantitative analysis of this property as well.\n\nThe paper is the first I am aware of to consider adversarial slowdown on text classifiers. This is a natural problem and may be of interest as text models become increasingly large.", "weaknesses": "Reading the paper, I was surprised that I never saw an experiment's running time measured, since this is the motivation for the attack. I think this is a pretty important consideration especially for defenses. If the running time of a defense (especially ChatGPT) is higher than the actual slowdown, there's not any point in applying the countermeasure (this is never discussed in the subsection).\n\nThe attack often creates incoherent text, as seen in Table 3. This seems to be a feature of text attacks, rather than a limitation specifically of the Waffle attack. However, it seems that the attack could be overfitting to a specific \"distance metric\" for the attack. Using some other distance functions, such as token/character edit distance, character replacement, as supported in TextAttack may also be useful to understand the generality of the attack.\n\nChatGPT is likely to have data leakage here, making it a bad scientific baseline. I would encourage at least a discussion of this. This may be one reason why the more standard grammar checking tools are unable to correct the attacks.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "We thank the reviewer for the time to read and provide feedback. Below, we provide answers to your questions and concerns. We will also include them in the final version of our paper.\n\n—\n\n> (Question 1) What running time impact do your adversarial slowdown attacks have?\n\nWe acknowledge the importance of measuring our attack’s impact on the actual runtime of multi-exit models. We first show our attack’s impact on the runtime in the results below. All samples are crafted using TextFooler with DeeBERT as the victim model (results are formatted as CLEAN &rarr; WAFFLE, CLEAN being the clean inputs and WAFFLE their perturbed counterparts):\n\n---\n\n**QQP**\n\nEfficacy: 0.36 &rarr; 0.22\n\nRuntime: 7.5 s &rarr; 9.1 s\n\n**RTE**\n\nEfficacy: 0.34 &rarr; 0.12\n\nRuntime: 2.7 s &rarr; 3.4 s\n\n**MRPC**\n\nEfficacy: 0.35 &rarr; 0.09\n\nRuntime: 3.7 s &rarr; 4.7 s\n\n**QNLI**\n\nEfficacy: 0.35 &rarr; 0.10\n\nRuntime: 7.8 s &rarr; 10.7 s\n\n**CoLA**\n\nEfficacy: 0.34 &rarr; 0.13\n\nRuntime: 7.8 s &rarr; 10.0 s\n\n---\n\nAs is evident, a reduction in efficacy is correlated with an increase in runtime. Our usage of efficacy in our paper mainly comes down to it being hardware agnostic, as the exit layer will not change between models run on different machines. This makes it a strong metric for quantifying the speed-up of multi-exit models, regardless of the exact experimental setup.\n\n— \n\n> (Question 2) How much time do the grammar checking countermeasures take?\n\nThe runtime of the grammar-checking countermeasures explored in Sec. 7 is higher than the inference time of all multi-exit models our work considers. As the reviewer accurately points out, this would make them useless from a pure runtime standpoint. However, we reason that the purpose of using these defenses was primarily exploratory, aiming to understand further why specific text causes more slowdown and how modifying such text can revert this slowdown. Moreover, input sanitization is already used in commercial models. Claude-2 [1], a conversational model similar to ChatGPT, already employs input-filtering techniques, which we believe is a promising future work direction.\n\nWe acknowledge the importance of defense mechanisms with less computational costs and consider this to be an important area for future work. We will include this discussion in Appendix E. \n\n[1] https://claude.ai/ \n\n—\n\n> (Concern 1) The attack often creates incoherent text, as seen in Table 3. This seems to be a feature of text attacks, rather than a limitation specifically of the Waffle attack. However, it seems that the attack could be overfitting to a specific \"distance metric\" for the attack. Using some other distance functions, such as token/character edit distance, character replacement, as supported in TextAttack may also be useful to understand the generality of the attack.\n\nWe acknowledge that incoherent texts are a limitation of adversarial attacks in the natural language processing domain, and WAFFLE is not exempt from this limitation. The specific distance metric used for WAFFLE depends on its underlying adversarial crafting algorithm; in the case of our experiments, we use the distance metrics in-line with the original work of [1] and [2]. We clarify that WAFFLE itself has no distance metric, instead providing an objective function that adversarial crafting algorithms may utilize with their own respective distance metrics. We leave the exploration of different distance metrics as future work, as well as exploring newer adversarial crafting algorithms that boast greater sentence coherence (e.g. [3]).\n \n[1] Jin et al., Is BERT Really Robust? A Strong Baseline for Natural Language Attack on Text Classification and Entailment, arXiv 2019\n\n[2] Yoo & Qi, Towards Improving Adversarial Training of NLP Models, ACL 2021\n\n[3] Li et al., Contextualized Perturbation for Textual Adversarial Attack, ACL 2021\n\n—\n\n> (Question 3) How often do subject-predicate agreement and changing named entities result in slowdown? What fraction of successful slowdowns fall into these buckets? \n\nTo stress the prevalence of subject-predicate disagreement and changing of named entities in samples crafted by WAFFLE, we follow the reviewer's advice and conduct an experiment that categorizes such samples into \"buckets.\" Taking the top-100 slowdown-inducing adversarial texts from QQP crafted on DeeBERT, we quantify the number that contain at least one instance of subject-predicate disagreement or at least one instance of a changed named entity. 84% introduce some form of subject-predicate disagreement, and 31% change a named entity. This result is consistent with our linguistic analysis and speaks to BERT's importance on these factors when performing inference. An important consideration is that not all samples contained a named entity, explaining why the prevalence of named entity changes was much lower despite consistently contributing to the slowdown. We thank the reviewer for considering this quantitative approach and will update our final paper to include this result.\n\n— \n\n> (Question 4) ChatGPT is likely to have data leakage here, making it a bad scientific baseline. I would encourage at least a discussion of this. This may be one reason why the more standard grammar checking tools are unable to correct the attacks.\n\nWe thank the reviewer for bringing this to our attention. We acknowledge the likelihood of ChatGPT leaking data and will discuss the risks in our limitations and societal impact section (Appendix E). We did not mean to suggest ChatGPT is a practical defense (execution time aside). Instead, since other input sanitation (Grammarly) failed, we used it as an accessible tool for input sanitization via a conversational model as a proof-of-concept that it may have effectiveness as a defense. We envision future work on evaluating the robustness and efficiency of input sanitization defenses using conversational models (with better controlled and known datasets).\n\n\n\n\n"}]

Author rebuttal:

Meta-review: Summary of the reviews:

The paper proposes a slowdown attack, WAFFLE, against multi-exit language models. The attack is evaluated on three multi-exit mechanisms and shown to be effective in both white-box and black-box settings. The paper also analyzes the generated adversarial examples and finds that they are often linguistically plausible. Finally, the paper discusses potential mitigations for the slowdown attack, including adversarial training and input sanitization.

Strengths:
- The paper is well-written and the evaluation is comprehensive.
- The paper provides insights into the vulnerability of multi-exit language models.

Weaknesses:
- There are some concerns from reviewers about the novelty of the slow-down attack, which was demonstrated in vision tasks. 

Overall, the four reviews are generally positive. All of them acknowledge the importance of the problem that the paper addresses, and most of them find the proposed solution to be effective. I would recommend this paper for acceptance.
Decision: Accept (poster)