GradAuto : Energy-oriented Attack on Dynamic Neural Networks

Pan, Jianhong and Zheng, Qichen and Fan, Zhipeng and Rahmani, Hossein and Ke, Qiuhong and Liu, Jun (2022) GradAuto : Energy-oriented Attack on Dynamic Neural Networks. In: European Conference on Computer Vision (ECCV) :. Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics) . Springer, ISR, pp. 637-653. ISBN 9783031197710

Text (Advanced_Adversarial_Attack_on_Dynamic_Neural_Networks)
Advanced_Adversarial_Attack_on_Dynamic_Neural_Networks.pdf - Accepted Version
Download (1MB)

Abstract

Dynamic neural networks could adapt their structures or parameters based on different inputs. By reducing the computation redundancy for certain samples, it can greatly improve the computational efficiency without compromising the accuracy. In this paper, we investigate the robustness of dynamic neural networks against energy-oriented attacks. We present a novel algorithm, named GradAuto, to attack both dynamic depth and dynamic width models, where dynamic depth networks reduce redundant computation by skipping some intermediate layers while dynamic width networks adaptively activate a subset of neurons in each layer. Our GradAuto carefully adjusts the direction and the magnitude of the gradients to efficiently find an almost imperceptible perturbation for each input, which will activate more computation units during inference. In this way, GradAuto effectively boosts the computational cost of models with dynamic architectures. Compared to previous energy-oriented attack techniques, GradAuto obtains the state-of-the-art result and recovers 100% dynamic network reduced FLOPs on average for both dynamic depth and dynamic width models. Furthermore, we demonstrate that GradAuto offers us great control over the attacking process and could serve as one of the keys to unlock the potential of the energy-oriented attack. Please visit https://github.com/JianhongPan/GradAuto for code.