Using Undervolting as an On-Device Defense Against Adversarial Machine Learning Attacks

Abstract

Deep neural network (DNN) classifiers are powerful tools that drive a broad spectrum of important applications, from image recognition to autonomous vehicles. Unfortunately, DNNs are known to be vulnerable to adversarial attacks that affect virtually all state-of-the-art models. These attacks make small imperceptible modifications to inputs that are sufficient to induce the DNNs to produce the wrong classification. In this paper we propose a novel, lightweight adversarial correction and/or detection mechanism for image classifiers that relies on undervolting (running a chip at a voltage that is slightly below its safe margin). We propose using controlled undervolting of the chip running the inference process in order to introduce a limited number of compute errors. We show that these errors disrupt the adversarial input in a way that can be used either to correct the classification or detect the input as adversarial. We evaluate the proposed solution in an FPGA design and through software simulation. We evaluate 10 attacks and show average detection rates of 77% and 90% on two popular DNNs.

References in corpus (17)

• Very Deep Convolutional Networks for Large-Scale Image Recognition
• A Survey on Deep Learning in Medical Image Analysis
• Explaining and Harnessing Adversarial Examples
• Intriguing properties of neural networks
• End to End Learning for Self-Driving Cars
• Feature Squeezing: Detecting Adversarial Examples in Deep Neural Networks
• Characterizing Adversarial Subspaces Using Local Intrinsic Dimensionality
• Adversarial Machine Learning at Scale
• On the (Statistical) Detection of Adversarial Examples
• PixelDefend: Leveraging Generative Models to Understand and Defend against Adversarial Examples
• Towards the Science of Security and Privacy in Machine Learning
• Attacking the Madry Defense Model with $L_1$-based Adversarial Examples
• A New Defense Against Adversarial Images: Turning a Weakness into a Strength
• An Experimental Study of Reduced-Voltage Operation in Modern FPGAs for Neural Network Acceleration
• Defensive Approximation: Securing CNNs using Approximate Computing
• On adversarial patches: real-world attack on ArcFace-100 face recognition system
• Bypassing Feature Squeezing by Increasing Adversary Strength