Noise Sensitivity-Based Energy Efficient and Robust Adversary Detection in Neural Networks

Abstract

Neural networks have achieved remarkable performance in computer vision, however they are vulnerable to adversarial examples. Adversarial examples are inputs that have been carefully perturbed to fool classifier networks, while appearing unchanged to humans. Based on prior works on detecting adversaries, we propose a structured methodology of augmenting a deep neural network (DNN) with a detector subnetwork. We use $\text{Adversarial Noise Sensitivity}$ (ANS), a novel metric for measuring the adversarial gradient contribution of different intermediate layers of a network. Based on the ANS value, we append a detector to the most sensitive layer. In prior works, more complex detectors were added to a DNN, increasing the inference computational cost of the model. In contrast, our structured and strategic addition of a detector to a DNN reduces the complexity of the model while making the overall network adversarially resilient. Through comprehensive white-box and black-box experiments on MNIST, CIFAR-10, and CIFAR-100, we show that our method improves state-of-the-art detector robustness against adversarial examples. Furthermore, we validate the energy efficiency of our proposed adversarial detection methodology through an extensive energy analysis on various hardware scalable CMOS accelerator platforms. We also demonstrate the effects of quantization on our detector-appended networks.

arXiv commentAccepted in IEEE Transactions on Computer-Aided Design of Integrated Circuits and Systems (TCAD), 2021

References in corpus (14)

• Towards Deep Learning Models Resistant to Adversarial Attacks
• Evasion Attacks against Machine Learning at Test Time
• Robust Physical-World Attacks on Deep Learning Models
• Spectral Signatures in Backdoor Attacks
• Detecting Adversarial Samples from Artifacts
• On the (Statistical) Detection of Adversarial Examples
• On Detecting Adversarial Perturbations
• Energy-Efficient ConvNets Through Approximate Computing
• Practical Black-Box Attacks against Machine Learning
• Discretization based Solutions for Secure Machine Learning against Adversarial Attacks
• Defensive Quantization: When Efficiency Meets Robustness
• GAT: Generative Adversarial Training for Adversarial Example Detection and Robust Classification
• Rethinking Non-idealities in Memristive Crossbars for Adversarial Robustness in Neural Networks
• QUANOS- Adversarial Noise Sensitivity Driven Hybrid Quantization of Neural Networks

Cited by in corpus (1)

• DetectX -- Adversarial Input Detection using Current Signatures in Memristive XBar Arrays