NODEA TTACK : A DVERSARIAL A TTACK ON THE E NERGY C ONSUMPTION OF N EURAL ODE S
Anonymous authors
Paper under double-blind review
A BSTRACT
Recently, Neural ODE (Ordinary Differential Equation) models have been proposed, which use ordinary differential equation solving to predict the output of neural network.
Due to the low memory usage, Neural ODE models can be considered as an alternative that can be deployed in resource-constrained devices (e.g.,
IoT devices, mobile devices).
However, to deploy a Deep Learning model in resource-constrained devices, low inference energy cost is also required along with low memory cost.
Unlike the memory cost, the energy consumption of the
Neural ODEs during inference can be adaptive because of the adaptive nature of the ODE solvers.
Attackers can leverage the adaptive behaviour of Neural ODEs to attack the energy consumption of Neural ODEs.
However, energy-based attack scenarios have not been explored against Neural ODEs.
To show the vulnerability of Neural ODEs against adversarial energy-based attack, we propose
NODEAttack .
The objective of NODEAttack is to generate adversarial inputs that require more ODE solvers computations, therefore increasing neural ODEs inference-time energy consumption.
Our extensive evaluation on two datasets and two popular ODE solvers show that the samples generated through NODEAttack can increase up to 168% energy consumption than average energy consumption of benign test data during inference time.
Our evaluation also shows the attack transferability is feasible across solvers and architectures.
Also, we perform a case study showing the impact of the generated adversarial examples, which shows that NODEAttack generated adversarial examples can decrease 50% efﬁciency of an object-recognition-based mobile application.
I NTRODUCTION
Deep Neural Networks (DNNs) have shown great potential in many challenging tasks (image classiﬁcation, natural language process, and playing games).
To cope with tasks with higher complexity, the number of DNN parameters is increasing rapidly.
Because of this reason, DNNs require considerable memory usage both in training and inference.
To address the issue of increased memory usage, researchers simulate the solver of ordinary differential equation (ODE) and propose Neural
ODE techniques (Chen et al., 2018).
Neural ODE does not store any intermediate quantities of the forward pass and allows us to train DNNs with constant memory cost.
Neural ODE also performs better than traditional DNNs for irregularly sampled time series data.
Because of decreased memory cost, Neural ODEs are viable options to be used in resource-constrained devices like mobile devices or UAVs (Unmanned Aerial Vehicle).
Due to the adaptive energy consumption of Neural ODE models (Section 3), the model robustness in terms of energy consumption or energy robustness (Deﬁned in 4.1) of the model needs to be investigated to deploy Neural ODE models in resource-constrained devices.
Otherwise, lack of energy robustness in Neural ODEs can lead to tragic situations.
For example, we assume that Neural
ODE model is deployed for mobile apps, which are used to help visually impaired people.
The energy consumption of the model is not robust, then the battery of the mobile device will be drained faster.
This can be fatal for the visually impaired person.
To avoid such scenarios, evaluating energy robustness of Neural ODEs is required to avoid unwanted incidents.
Although energy robustness of Neural ODEs has not been explored, unlike accuracy-based robustness.
Recent work shows that Neural ODE models are more robust against accuracy-based adversarial attacks (Yan et al.
than traditional DNNs.
However, ﬁnding a relationship between input and energy consumption is more challenging because the relation between input and energy consumption of DNNs is not well-deﬁned.
To explore the energy robustness of Neural ODEs, the relationship between input and energy consumption of Neural ODEs needs to be deﬁned.
Recent works, ILFO (Haque et al.
and DeepSloth (Hong et al.
(2020)), have evaluated energy robustness of Adaptive Neural Networks (AdNNs) by proposing white-box attack.
However, optimizing the loss function proposed by the aforementioned AdNN attacks can not evaluate the energy robustness of Neural ODEs.
AdNNs activate or deactivate certain components of DNNs based on the intermediate outputs of certain computing units and consumes a different amount of energy based on different inputs.
Both the attack’s objective is to increase the number of activated
DNN components by modifying the speciﬁc computing unit outputs, and both attack use speciﬁc loss function optimization to achieve that.
However, Neural ODE functionality is different than traditional AdNN functionality because, for Neural ODE, no component is deactivated or activated during inference.
The adaptive behavior of a Neural ODE model depends on the adaptive ODE solver used to predict the output.
Furthermore, for a speciﬁc trained Neural ODE model, we can ﬁnd variable energy consumption for single input depending on the type of ODE solver used, where for traditional AdNNs, energy consumption based on a speciﬁc input will be the same always for a speciﬁc trained AdNN.
Therefore, a novel approach is needed to explore the energy robustness of
Neural ODEs.
To explore the energy robustness of Neural ODEs, We propose NODEAttack , a white-box approach that uses step-size of the ODE solvers to formulate attack.
ODE solvers use an iterative way to approximate a function, and the objective of our approach is to increase the number of iterations, increasing the energy consumption of Neural ODEs.
Our attack formulation is based on the fact that decreasing step-size would increase the number of iterations.
Speciﬁcally, we develop two attack techniques to evaluate Neural ODE’s energy robustness, namely Input-based attack and Universal attack.
Input-based attack evaluates energy robustness where testing inputs are semantically meaningful to the Neural ODE model ( e.g., meaningful images).
On the other hand, Universal attack evaluates worst-case energy robustness where each testing input maximizes the energy consumption for each target ODE solver.
To the best of our knowledge, this is the ﬁrst energy-based adversarial attack against Neural ODEs.
We evaluate NODEAttack on mainly two criteria: effectiveness and transferability using the CIFAR-10 and MNIST datasets (Krizhevsky et al.
; Deng (2012)).
We evaluated
NODEAttack on two popular ODE solvers: Dopri
(Dormand and Prince (1980)) and Adaptive
Heun S ¨ uli and Mayers (2003).
We evaluate the the effectiveness of NODEAttack against natural perturbations and corruptions Hendrycks and Dietterich (2019a).
We observed that NODEAttack generated adversarial inputs can increase up to 168 % energy consumption than the average energy consumed by benign test inputs.
Also, we noticed that transferability is feasible between two Neural
ODEs differentiated by ODE solver or model architecture.
Our paper makes the following contributions:
• Problem Formulation and Approach.
Our work is the ﬁrst attempt to formulate energybased adversarial attack against Neural ODE models.
Also, our work proposes a novel loss function based on step-size of ODE solvers to generate adversarial inputs.
• Evaluation.
We evaluate our approach across two ODE solvers and two datasets based on two criteria.
B ACKGROUND AND R ELATED W ORKS 2. N EURAL O RDINARY D IFFERENTIAL E QUATIONS
Neural Ordinary Differential Equations (Neural ODE) (Chen et al.
(2018)) have been successful in attaining accuracy close to the State of the Art DNN techniques but with lesser memory consumption.
Neural ODEs incorporate Ordinary Differential Equations solvers into Neural Network architectures.
Models such as residual networks and recurrent neural network decoders create complicated transformations by devising a sequence of transformations to a hidden state:
[Equation]
Operation of a residual block can be interpreted as the discrete approximation of an ODE where the discretization step value is one.
In a neural ODE, the discretization step is set to zero and the relation between input, and output is characterized by the following set of equations:
[Equation]
Solving h ( T ) gives the output and ODE solvers can be used for that purpose.
Additionally, Proposed work by Quaglino et al.
(2019) expresses the Neural ODE dynamics as truncated series of Legendre polynomials and accelerate the model.
Dupont et al.
(2019) explores the limitations in approximation capabilities of neural ODEs because of the preserving of input topology.
Recent work by Yan et al.
(2019) explore the robustness of Neural ODEs against Neural
ODEs and propose TisODE to increase the robustness of Neural ODEs.
However, no other work has focused on the energy robustness perspective or Neural ODEs, and to our knowledge, this is the ﬁrst work in that direction.
2. R UNGE K UTTA M ETHOD
Runge Kutta method (Runge (1895); Kutta (1901)) is an ODE solver which solved ordinary differential equations through approximation.
First-order differential equation given by,
[Equation]
, with y ( t 0 ) =
y
Here y is an function of time t and y ∗ is the value of y at t = 0 .
Four slope approximations k 1 ,k 2 ,k 3 ,k 4 are used to estimate approximate value of y ( y ∗ ) at t
= t 0 (Detailed equation in Appendix).
Final estimate of y ∗ ( t 0 + h ) can be represented as,
[Equation]
Here, h is the step size.
This is called fourth order Runge Kutta Method, because the local error (approximation error at a particular time ) for step-size h is O ( h 4 ) .
For better approximation of function, multiple works (Dormand and Prince (1980); S¨uli and Mayers (2003)) have proposed to use adaptive step size.
2. A DVERSARIAL E XAMPLES
Adversarial Examples are the inputs that are fed to machine learning models to change the prediction of the model.
In earlier works by Dalvi et al.
; Lowd and Meek (2005); D.Lowd and C.Meek (2005), ‘good word attacks’ or spelling modiﬁcations have long been used to bypass the spam ﬁlters.
More recently, Szegedy et al.
and Goodfellow et al.
(2014) propose adversarial attacks on deep computer vision models.
Karmon et al.
(2018) propose a technique to attack CNNs in which a localized patch is introduced in an image instead of adding noise to the full image.
With a similar approach, adversarial attacks have been extended to various ﬁelds like text and speech processing (Carlini et al.
; Jia and Liang (2017)), and graph models (Z¨ugner et al.
; Bojchevski and
G¨unnemann (2019)).
Recently, Haque et al.
(2020); Hong et al.
(2020) have proposed adversarial energy based attacks against Adaptive Neural Networks.
However, as mentioned in the introduction, existing attacks can not be used to increase energy consumption of Neural ODEs.
A DAPTIVE N ATURE OF N EURAL ODE
In this section, we discuss the reason of adaptive energy consumption of Neural ODEs.
As discussed in Section 2, ODE solvers use iterative approximation to calculate the function value at a certain point.
If the number of iterations is increased, the function f is needed to be calculated for a higher number of times, increasing the energy consumption of the process.
The number of iterations can be increased by decreasing the step-size, which we discuss in Section 4.2.
#iters= #iters=
A v e r a g e
E n e r g y
C o n s u m p
t
i o n
We also have investigated the adaptive nature of Neural ODEs through a preliminary study.
We have trained a Neural ODE CNN model (Chen et al.
with MNIST (Deng (2012)) training data and used the MNIST test data for inference.
For ODE solver, we used dopri5 (Dormand and Prince (1980))
ODE solver.
For each test data, we measure energy consumption using Nvidia TX2 server.
From the results, we have noticed that ODE solver takes a different number of iterations (3 and 4 in this experiment) to approximate a function.
Figure 1 describes our ﬁndings.
When the number of iterations is 3, average energy consumption drops more than 15J.
However, the range of inference energy consumption is limited is low for benign in-distribution data.
NODEA TTACK
We elaborate the approach of NODEAttack through this section.
First, we deﬁne two types of energy robustness in this section.
Based on the deﬁnitions, we formulate the problem and propose two type of energy attacks against Neural ODEs.
4. E NERGY R OBUSTNESS
We deﬁne energy robustness for Neural ODEs in two ways: Input-based Energy Robustness ( E i ) and Universal Energy Robustness ( E u ).
E i is deﬁned based on the maximum energy consumed by the model for an input which belongs to the training data distribution of the model.
Let us assume, x is an input that is within the data distribution of a DNN f .
We want to add perturbation δ to x such that energy consumption is maximum.
In that scenario, E i can be represented as,
[Equation]
, where R is set of admissible perturbations such that x + δ remains within distribution, and ENG f represents the energy consumption of DNN f .
E u can be described based on the highest possible energy consumed by a model for any input.
Inputs used to measure E u can be out-of-distribution inputs also.
For a DNN f and any input x , E u can be represented as,
[Equation]
, where ENG f represents energy consumption of DNN.
As E i and E u represents the highest energy consumption in two different cases, if we increase the the value of E i and E u , the maximum energy consumption of the model would decrease.
As our objective is to decrease model’s maximum energy consumption, by increasing the value of E i and E u , energy robustness of a model can be increased.
4. P ROBLEM F ORMULATION
The objective of our approach is to create adversarial samples which can increase energy consumption of Neural ODEs.
For this purpose, we mainly focus on increasing the number of iterations needed for approximation in ODE solvers.
As the energy consumption to approximate a value at any point using ODEs does not vary signiﬁcantly across all the points, increasing the number of iteration would increase the energy consumption in Neural ODEs.
The number of iteration in an ODE solver is dependent on the step size.
Each ODE solver approximates the function based on differentiation of the function at different instance and step-size.
ODE solvers modify the step-size based on the function slope.
If the slope is high, then a smaller step-size is required for the approximation.
For smaller step-size, the solver would use more iteration for approximation causing higher energy and time consumption.
However, if the slope is low, larger step size can be used for approximation.
For ODE solvers, step-size is modiﬁed based on difference in approximations when the function is approximated multiple times at time t.
The multiple approximations can be performed with different step-size, or with using a higher order and a lower order approximation (Press and Teukolsky (1992)).
For example, Runge-Kutta-Fehlberg (Fehlberg (1969))
Method creates two different Runge
Kutta method with different orders (order four and ﬁve), but with same intermediate values 1 .
The ﬁfth order approximation at time t = t 0 + h can be represented as,
[Equation]
and, the fourth order approximation at time t = t
+ h is,
[Equation]
Here, k 1 ,k 2 ,k 3 ,k 4 ,k 5 ,k 6 are the intermediate values, c 1 ,c 2 ,c 3 ,c 4 ,c 5 ,c 6 ,d 1 ,d 2 ,d 3 ,d 4 ,d 5 ,
[Equation]
6 are the constants.
The difference between both approximations can be deﬁned as error estimate,
[Equation]
Based on the value of ∆ at a certain t, next step-size is calculated.
If the error value ∆ is greater than a certain desired error value, then the step size is decreased than the previously used step size, on the other hand, if ∆ is lesser than the desired error value, the step size is increased.
Therefore, it can be concluded that the adaptive step size is dependent on ∆ .
As the adaptive step size is dependent on ∆ , and the ∆ is dependent on multiple approximations of the function, we can refer that the adaptive-step-size is dependent of the initial value of t ( t 0 ).
Therefore, for a Neural ODE, the adaptive-step-size and the number of iterations to approximate the function will be a function of the model input.
We assume that a solver takes N ( X ) iterations to approximate a function for input X , where h 1 ( X ) ,h 2 ( X ) ,..h N ( X ) is the step-size used for N iterations.
We deﬁne the average step-size as,
[Equation]
We have mainly two objectives.
Our ﬁrst goal is to ﬁnd the input X for which h avg ( X ) is minimum to evaluate the Universal Energy Robustness ( E u ) of Neural ODEs.
[Equation]
Our second objective is to evaluate Input-based Energy Robustness of Neural-ODEs.
To address that, we ﬁnd the perturbation δ , which can be added to an in distribution input X such that h avg ( X + δ ) is minimum.
[Equation]
Here, R is set of admissible perturbations such that x + δ remains within distribution
4. A PPROACH
For exploring the energy robustness of Neural ODEs, we use a gradient-based optimization technique to create adversarial inputs.
Based on the objectives deﬁned in Section 4.2, we propose two strategies to evaluate Neural ODE: Input-based attack and Universal attack.
Input-based attack.
In this approach, we create adversarial inputs for each input image such that the semantic meaning of the input is preserved.
We assume that x is a test input.
Our objective is to ﬁnd perturbation δ , adding which the energy consumption of the model increases.
We can deﬁne the problem as, minimize (∣ δ ∣
+ c ⋅ f ( x + δ )) such that, ( x + δ ) ∈
[ 0 , 1 ] n (1) where f ( x + δ )
=
h avg ( x + δ ) and c is a predeﬁned constant.
If c value increases, the average step size would have greater weightage in the optimization problem, leading to a more noisy input.
The algorithm is explained through Figure 2 and Algorithm 1.
The algorithm can be divided into following parts.
Initializing Perturbation is the ﬁrst step where we initialize different variables, including perturbation, which are going to be modiﬁed by the optimization.
All the next steps are performed iteratively.
In the second step ( Get Step Size ), the average step size of the ODE solver is calculated based on the modiﬁed input generated after adding the initialized perturbation to input image.
Next, we calculate the loss function value based on average step size and optimize the function ( Optimizing Loss Function ).
Then, we denormalize and normalize the modiﬁed input to nullify the effect of information loss due to denormalization ( Denormalizing and Normalizing Adversarial
Input ).
Next, we consider the perturbation added to denormalized input as updated perturbation and we calculate the number of steps induced by denormalized input.
If the current number of steps is greater than previously recorded number of steps, we store the current input perturbation as most successful perturbation ( Update Perturbation and Record Most Successful Perturbation ).
All the aforementioned steps are explained below.
[Figure]
Initializing Perturbation :
This step is used for initializing variables.
We initialize perturbation ( δ ), maximum recorded iteration of
ODE solver( Max N ), and highest energy-consuming adversarial input ( X best ) (Line 2).
Number of iterations ( T ) is also initialized (Line 3).
Get Step Size : In this step, a perturbed image ( X ′ ) is generated by adding initialized perturbation ( δ ) to the input image ( X ) (Line 6).
Then, scale method re-scales the X ′ using tanh function.
Next, average step size of the solver for X ′ is received using avg step size method (Line 7).
Optimizing Loss Function :
In this step, the loss function value is calculated ﬁrst.
The loss function L consists of two components: ﬁrst, the euclidean distance between the input image ( X ) and perturbed image ( X ′ )
(calculated on Line 8), and the average step size ( h avg ).
The loss function is optimized and updated perturbation ( δ new ) and optimized loss function ( L new ) is generated (Line 10).
Perturbation variable ( δ ) is updated using δ new (Line 11).
[Table]
Denormalizing and Normalizing Adversarial Input : Adversarial attacks are generally performed on normalized inputs; therefore, while denormalizing the generated input, there can be information loss as the pixel values are discrete.
We have noticed that those information losses can be signiﬁcant in terms of energy consumption of the particular input.
To make sure that the desired energy consumption of the ﬁnal adversarial input can not be modiﬁed by the information loss, we denormalize and then again normalize the generated input X ′ (Line 12 and 13).
By adding this step, we ensure that there will not be any information loss while denormalizing the ﬁnal adversarial input.
Update Perturbation and Record Most Successful Perturbation :
In this step, ﬁrst, we calculate number of steps induced by X ′′′ (Line 14).
If the current number of steps in ODE solver ( N ) is greater than the recorded maximum number of iterations ( max N ) (Line 15), max N variable is updated (Line 17) and the current adversarial input is recorded as highest energy-consuming adversarial sample ( X best ) (Line 16).
When the iterations are ﬁnished, X best is returned as the perturbed output image.
Universal attack.
For Universal attack, we create adversarial inputs for which the energy consumption of the model during inference will be highest.
In this approach, we do not preserve the semantic meaning of input.
Therefore, we do not need to minimize the perturbation ( δ ) added to the input.
Hence, δ is not required to deﬁne Universal attack.
Similarly as equation 1, we can deﬁne universal attack as, minimize ( f ( x + δ ))
such that, ( x + δ ) ∈ [ 0 , 1 ] n (2) where x is the input and f ( x + δ ) =
h avg ( x + δ ) .
E VALUATION
We evaluate the performance of our techniques on two popular different adaptive ode solvers, Dopri
(Dormand and Prince (1980)) and Adaptive Heun (S¨uli and Mayers (2003)).
We explore the Effectiveness and Transferability of NODEAttack through this section.
To evaluate effectiveness of NODEAttack , we evaluate how much increase in energy consumption is achievable by
NODEAttack on different datasets.
To evaluate transferability of NODEAttack , we explore if adversarial inputs generated for one solver/architecture can increase the energy consumption for other solver/architecture.
5. E XPERIMENTAL S ETUP
Datasets and Models.
For evaluation, CIFAR-10 dataset (Krizhevsky et al.
and MNIST dataset (Deng (2012)) have been used for the training of the Neural ODE model.
We use ODENet
Convolutional Neural Network (CNN) models proposed by Chen et al.
as the trained Neural
ODE models.
The main difference between model architectures used for CIFAR-10 and MNIST is in the input number of channels.
For generating Input-based attack we consider c=10000 for
CIFAR-10 and c=1000 for MNIST dataset.
Baseline.
As there are no existing energy-based attack on Neural ODEs, we compare our technique with natural corruption and perturbation techniques (Hendrycks and Dietterich (2019b)) for CIFAR10 dataset.
These techniques are commonly used (Xie et al.
; Geirhos et al.
; Ovadia et al.
to evaluate the robustness of neural networks.
For MNIST dataset, we use random
Gaussian noise (Cattin, 2013) as baseline.
Hardware Platform.
We use the Nvidia Jetson TX2 board for our energy consumption calculations used to evaluate Neural ODEs.
To avoid noise in calculated energy consumption, we measure the energy consumption of an inference 20 times, discard the outliers and measure the mean of the remaining values.
5. E FFECTIVENESS
[Figure]
We have measured the effectiveness of Input-based attack by measuring the average increase in energy consumption (in
Joule) during the inference with respect to benign inputs, where we measure the effectiveness of Universal attack by recording the highest energy consumption achieved by the adversarial examples during the inference.
We measure the effectiveness of our approach for CIFAR-10 and MNIST datasets.
For CIFARdataset, we use images generated by common perturbations and corruptions as baseline.
Effectiveness of Universal attack has been measured against the corruption techniques because, in both cases, the noise present in the input is human perceptible.
As the Input-based attack adds small perturbation to the input, the effectiveness of Input-based attack is measured against the perturbation techniques.
For comparison, we use the ﬁve best performing corruptions and perturbations in terms of average energy consumption.
Figures 3 and 4 show the effectiveness of NODEAttack on Dopri5 and Adaptive Heun solvers for
CIFAR-10 datasets.
It can be observed that, for all four scenarios, NODEAttack is able to generate higher energy consuming examples than baseline methods.
For Universal attack, NODEAttack is able to increase 125% and 50% of the energy consumption of Neural ODE model with respect to average energy consumed by benign CIFAR-10 test data, for Adaptive Heun and Dopri solvers, respectively.
For Input-based attack, for Adaptive Heun and Dopri5 solvers respectively,
NODEAttack is able to increase 47% and 30% of the energy consumption (in average) of Neural
ODE model than energy consumed by CIFAR-10 test images.
[Figure]
For MNIST dataset, the average energy consumption increased by Input-based attack is 72J (31.85% avg increase) and 15J (21.4% avg increase) for Adaptive
Heun and Dopri5, respectively.
For the same datatset, Gaussian random noise can increase 7.9J (3.5% avg increase) and 2.1J (2.94% avg increase) for Adaptive
Heun and Dopri5, respectively.
Therefore, Input-based attack outperforms the baseline in terms of increase in energy consumption.
For Universal attack, the average energy consumption induced for Adaptive Heun solver is 625J (168% increase than average energy consumed by MNIST test data), where the average energy consumption induced for Dopri5 solver is 100J (42.8% increase than average energy consumed by MNIST test data).
5. T RANSFERABILITY
In this section, we try to evaluate the transferability of the Input-based attack on different ODE solvers and on network architectures.
To measure the transferability, we have selected 1000 images randomly.
To evaluate the transferability of our attack, we will measure two parameters: 1.
What percentage of adversarial inputs can increase the energy consumption for the other solver/architecture?
This is called Input Transferability Percentage (ITP) 2.
What is the average percentage increase in energy consumption enforced by adversarial inputs in other solver/architecture?
This is called Effectiveness Transferability Percentage (ETP).
To evaluate solver-based transferability, we consider two aforementioned solver with same network architecture.
Table 1 shows our ﬁndings.
We can observe that transferability can exist between two solvers.
It can be noticed that created adversarial inputs for Adaptive Heun are more effective against Dopri5 solver in terms of transferability.
[Table]
To evaluate network-based transferability, we consider Adaptive Heun ODE solver with two different Neural ODE architecture (M1 and
M2).
M1 is the larger model that has an extra convolutional layer than M2.
For M2 to M transferability, the ITP is 61.8%, however the
ETP is lower (2.6%).
For M1 to M2 transferability, the ITP is 80%, and the ETP is slightly higher than previously calculated ETP (4.8%).
Therefore, we can observe that crossarchitectural transferability is feasible for this attack.
Additional evaluation on transferability can be found in the appendix.
C ASE S TUDY .
Through a case study, we have tried to demonstrate practical scenarios which can show the adverse effects of energy attack on Neural ODEs.
In this section, we discuss how NODEAttack generated samples can be used to design poisoning attack against Neural ODE based executable models, which are used for mobile applications.
The poisoning attack is designed based on the features of popular
DNN compilers; therefore, we will brieﬂy discuss the functionality of DNN compilers ﬁrst.
DNN compilers Li et al.
(2020) are used to generate executable models for resource-constrained devices because Deep Learning (DL) libraries have not been able to use the hardware efﬁciently.
DNN compilers take the model deﬁnitions described in the DL frameworks as inputs and then generate efﬁcient code implementations on various DL hardware as outputs.
The generic architecture of DNN compiler can be divided into two parts: frontend and backend.
Each part uses speciﬁc intermediate data representation (IR).
The frontend takes a DL model from existing DL frameworks as input Then transforms the model into the computation graph representation.
DAG-based IR (in frontend) is one of the most traditional ways for the compilers to build a computation graph.
In this
IR, operators and tensors are treated as nodes and edges, respectively and they are organized as a directed acyclic graph (DAG).
It has deﬁciencies such as semantic ambiguity caused by the missing deﬁnition of computation scope.
The poisoning attack is designed based on the feature of popular DNN compilers:
The computational graph generated to create executable model by the DNN compiler is a Directed Acyclic
Graph.
The generated computational graph is created using a base input sample.
When we feed a
Neural ODE model to generate an executable, the generated graph assumes that the step-size calculated for the base sample is static for all samples (because the adaptive step size calculation is not captured through DAG).
Because of the feasible cross-solver and cross-network transferability, if NODEAttack generated energy surging adversarial examples as the base sample, the energy consumption for each input will be high.
Experiment.
In this experiment, we use two Neural ODE executable models with Adaptive Heun
ODE solver to detect objects through a mobile application.
Both executable models are generated based on a base CNN trained on CIFAR-10 dataset.
The ﬁrst executable ﬁle is initialized with a benign sample (no of iterations = 43), where the second executable ﬁle is initialized with an adversarial energy-surging sample generated through Input-based attack (no of iterations = 88).
To create the executable ﬁles, we use pytorch mobile (Paszke et al.
Based on each executable model, we create an android application.
For each application, we feed inputs to the model till the battery is drained fully.
We also ensure that there is no other application running on the mobile during the same time.
For the executable ﬁle initialized with the benign sample, the number of classiﬁcations completed by the model is 30,188 before the battery is drained fully.
While for the executable ﬁle initialized with the adversarial sample, the number of classiﬁcations done by the model is 15,102 before draining out the battery.
We can notice that the adversarial examples can reduce the efﬁciency of the applications by approximately 50%.
C ONCLUSION
In this paper, we have proposed NODEAttack 2 to show the vulnerability of Neural ODEs against energy-surging adversarial samples.
Here, we have proposed two types of adversarial attacks: Universal attack and Input-based attack.
To the best of our knowledge, we are the ﬁrst to explore energy-based attack against Neural ODEs.
We also observe that adversarial examples generated by NODEAttack can be transferable.
Finally, we show the impact of NODEAttack generated samples on mobile application.