DetectX -- Adversarial Input Detection using Current Signatures in Memristive XBar Arrays

Abstract

Adversarial input detection has emerged as a prominent technique to harden Deep Neural Networks(DNNs) against adversarial attacks. Most prior works use neural network-based detectors or complex statistical analysis for adversarial detection. These approaches are computationally intensive and vulnerable to adversarial attacks. To this end, we propose DetectX - a hardware friendly adversarial detection mechanism using hardware signatures like Sum of column Currents (SoI) in memristive crossbars (XBar). We show that adversarial inputs have higher SoI compared to clean inputs. However, the difference is too small for reliable adversarial detection. Hence, we propose a dual-phase training methodology: Phase1 training is geared towards increasing the separation between clean and adversarial SoIs; Phase2 training improves the overall robustness against different strengths of adversarial attacks. For hardware-based adversarial detection, we implement the DetectX module using 32nm CMOS circuits and integrate it with a Neurosim-like analog crossbar architecture. We perform hardware evaluation of the Neurosim+DetectX system on the Neurosim platform using datasets-CIFAR10(VGG8), CIFAR100(VGG16) and TinyImagenet(ResNet18). Our experiments show that DetectX is 10x-25x more energy efficient and immune to dynamic adversarial attacks compared to previous state-of-the-art works. Moreover, we achieve high detection performance (ROC-AUC > 0.95) for strong white-box and black-box attacks. The code has been released at https://github.com/Intelligent-Computing-Lab-Yale/DetectX

arXiv comment14 pages, 13 figures

References in corpus (16)

• Very Deep Convolutional Networks for Large-Scale Image Recognition
• Detecting Adversarial Samples from Artifacts
• On the (Statistical) Detection of Adversarial Examples
• A study of the effect of JPG compression on adversarial images
• On Detecting Adversarial Perturbations
• Mitigating Adversarial Effects Through Randomization
• Multiscale Co-Design Analysis of Energy, Latency, Area, and Accuracy of a ReRAM Analog Neural Training Accelerator
• Understanding Deep Neural Networks with Rectified Linear Units
• Defensive Quantization: When Efficiency Meets Robustness
• GAT: Generative Adversarial Training for Adversarial Example Detection and Robust Classification
• X-CHANGR: Changing Memristive Crossbar Mapping for Mitigating Line-Resistance Induced Accuracy Degradation in Deep Neural Networks
• Rethinking Non-idealities in Memristive Crossbars for Adversarial Robustness in Neural Networks
• Noise Sensitivity-Based Energy Efficient and Robust Adversary Detection in Neural Networks
• QUANOS- Adversarial Noise Sensitivity Driven Hybrid Quantization of Neural Networks
• CrossStack: A 3-D Reconfigurable RRAM Crossbar Inference Engine
• Exposing the Robustness and Vulnerability of Hybrid 8T-6T SRAM Memory Architectures to Adversarial Attacks in Deep Neural Networks