HASI: Hardware-Accelerated Stochastic Inference, A Defense Against Adversarial Machine Learning Attacks

Abstract

DNNs are known to be vulnerable to so-called adversarial attacks, in which inputs are carefully manipulated to induce misclassification. Existing defenses are mostly softwarebased and come with high overheads or other limitations. This paper presents HASI, a hardware-accelerated defense that uses a process we call stochastic inference to detect adversarial inputs. HASI carefully injects noise into the model at inference time and used the model's response to differentiate adversarial inputs from benign ones. We show an adversarial detection rate of average 87% which exceeds the detection rate of the state of the art approaches, with a much lower overhead. We demonstrate a software/hardware-accelerated co-design, which reduces the performance impact of stochastic inference to 1.58×−2× relative to the unprotected baseline, compared to 14 × −20× overhead for a software-only GPU implementation.

StAIn: Stealthy Avenues of Attacks on Horizontally Collaborated Convolutional Neural Network Inference and Their Mitigation

“…Several techniques have been proposed to mitigate adversarial attacks [36], [43], for example, pre-processing-based defenses [33], [44], [45], [46], [47], [48], gradient masking [49], adversarial training [50], and dataset encryption [51], but these techniques are model-specific or require access to the complete model parameters [52]. Hence, these techniques cannot be applied in the more stringent (and arguably realistic) threat model for HC-based inference.…”