论文标题
关于NVM横杆对抗攻击的内在鲁棒性
On the Intrinsic Robustness of NVM Crossbars Against Adversarial Attacks
论文作者
论文摘要
深度学习的计算需求不断增长，推动了基于新兴的非挥发记忆（NVM）技术的特殊推理加速器的研究。这样的NVM横梁有望快速，节能的原位矩阵矢量乘法（MVM），从而减轻了当今数字硬件中长期存在的von Neuman瓶颈。但是，这些横杆中计算的模拟性质本质上是近似的，并且导致与理想的输出值偏离，从而在正常情况下降低了深神经网络（DNNS）的整体性能。在本文中，我们研究了这些非理想情况在对抗情况下的影响。我们表明，在黑盒和白盒攻击方案中，模拟计算的非理想行为降低了对抗攻击的有效性。 In a non-adaptive attack, where the attacker is unaware of the analog hardware, we observe that analog computing offers a varying degree of intrinsic robustness, with a peak adversarial accuracy improvement of 35.34%, 22.69%, and 9.90% for white box PGD (epsilon=1/255, iter=30) for CIFAR-10, CIFAR-100, and ImageNet respectively.我们还展示了“循环中的硬件”自适应攻击，这些攻击通过利用NVM模型的知识来规避这种鲁棒性。
The increasing computational demand of Deep Learning has propelled research in special-purpose inference accelerators based on emerging non-volatile memory (NVM) technologies. Such NVM crossbars promise fast and energy-efficient in-situ Matrix Vector Multiplication (MVM) thus alleviating the long-standing von Neuman bottleneck in today's digital hardware. However, the analog nature of computing in these crossbars is inherently approximate and results in deviations from ideal output values, which reduces the overall performance of Deep Neural Networks (DNNs) under normal circumstances. In this paper, we study the impact of these non-idealities under adversarial circumstances. We show that the non-ideal behavior of analog computing lowers the effectiveness of adversarial attacks, in both Black-Box and White-Box attack scenarios. In a non-adaptive attack, where the attacker is unaware of the analog hardware, we observe that analog computing offers a varying degree of intrinsic robustness, with a peak adversarial accuracy improvement of 35.34%, 22.69%, and 9.90% for white box PGD (epsilon=1/255, iter=30) for CIFAR-10, CIFAR-100, and ImageNet respectively. We also demonstrate "Hardware-in-Loop" adaptive attacks that circumvent this robustness by utilizing the knowledge of the NVM model.
