English (United Kingdom)

https://curated-unify.zendy.io/wp-json/zendy-region/v1/featured_content/oa?rat=en

https://curated-unify.zendy.io/wp-json/zendy-region/v1/highlighted_journal/

Global: Zendy Plus annual

Presents the access of premium content as premium feature

Premium Content

Presents the keyphrase highlighting as premium feature

Keyphrase Highlighting

Presents the summarisation as premium feature

Summarisation

Insights

Presents the pdf analysis as premium feature

PDF Analysis

Presents the zaia usage as premium feature

ZAIA

Global: Zendy Plus monthly

Global: Zendy Tools annual

Global: Zendy Tools monthly

Global: Zendy Free Plan

Recent increases in the computational demands of deep neural networks (DNNs),combined with the observation that most input samples require only simplemodels, have sparked interest in $input$-$adaptive$ multi-exit architectures,such as MSDNets or Shallow-Deep Networks. These architectures enable fasterinferences and could bring DNNs to low-power devices, e.g., in the Internet ofThings (IoT). However, it is unknown if the computational savings provided bythis approach are robust against adversarial pressure. In particular, anadversary may aim to slowdown adaptive DNNs by increasing their averageinference time$-$a threat analogous to the $denial$-$of$-$service$ attacks fromthe Internet. In this paper, we conduct a systematic evaluation of this threatby experimenting with three generic multi-exit DNNs (based on VGG16, MobileNet,and ResNet56) and a custom multi-exit architecture, on two popular imageclassification benchmarks (CIFAR-10 and Tiny ImageNet). To this end, we showthat adversarial example-crafting techniques can be modified to cause slowdown,and we propose a metric for comparing their impact on different architectures.We show that a slowdown attack reduces the efficacy of multi-exit DNNs by90-100%, and it amplifies the latency by 1.5-5$\times$ in a typical IoTdeployment. We also show that it is possible to craft universal, reusableperturbations and that the attack can be effective in realistic black-boxscenarios, where the attacker has limited knowledge about the victim. Finally,we show that adversarial training provides limited protection againstslowdowns. These results suggest that further research is needed for defendingmulti-exit architectures against this emerging threat. Our code is available athttps://github.com/sanghyun-hong/deepsloth.

A Panda? No, It's a Sloth: Slowdown Attacks on Adaptive Multi-Exit Neural Network Inference