PaperlayerView exact revision on arXiv

Source-linked AI summary

Sponge Examples: Energy-Latency Attacks on Neural Networks

Ilia Shumailov, Yiren Zhao, Daniel Bates, Nicolas Papernot, Robert Mullins, Ross Anderson

arXiv:2006.03463v2cs.LGcs.CLcs.CRstat.ML

TL;DR

Machine-learning systems optimize average-case efficiency, leaving open whether adversaries can manipulate their energy use and decision latency. The paper develops sponge examples and two attack strategies, finding significant latency and energy increases across models, tasks, hardware platforms, and architectures, while proposing worst-case analysis and noting remaining defense and hardware-scope limitations.

  • Problem

    Machine-learning security has focused on confidentiality and integrity, while availability threats involving timely access, energy consumption, and latency remain insufficiently explored.

  • Method

    The paper crafts sponge examples that maximize inference time or energy using gradient-based and genetic-algorithm methods in white-box and black-box settings.

  • Results

    Sponge examples significantly increase latency and energy across evaluated models and tasks, transfer across hardware platforms and architectures, and greatly increase black-box ML-service response latency.

  • Takeaways & Limitations

    The findings support worst-case analysis of deep-learning systems’ latency and energy consumption, alongside defenses or mitigation suited to the deployment setting.

  • Takeaways & Limitations

    The paper states that no single solution addresses all abuse cases and that susceptibility across hardware platforms, including TPUs without sparsity optimizations, requires further assessment.

Abstract

from arXiv · show

The high energy costs of neural network training and inference led to the use of acceleration hardware such as GPUs and TPUs. While this enabled us to train large-scale neural networks in datacenters and deploy them on edge devices, the focus so far is on average-case performance. In this work, we introduce a novel threat vector against neural networks whose energy consumption or decision latency are critical. We show how adversaries can exploit carefully crafted $\boldsymbol{sponge}~\boldsymbol{examples}$, which are inputs designed to maximise energy consumption and latency. We mount two variants of this attack on established vision and language models, increasing energy consumption by a factor of 10 to 200. Our attacks can also be used to delay decisions where a network has critical real-time performance, such as in perception for autonomous vehicles. We demonstrate the portability of our malicious inputs across CPUs and a variety of hardware accelerator chips including GPUs, and an ASIC simulator. We conclude by proposing a defense strategy which mitigates our attack by shifting the analysis of energy consumption in hardware from an average-case to a worst-case perspective.

1 Introduction

The paper introduces sponge examples as an availability threat that exploits input-dependent energy and latency differences in neural networks. It presents white-box and black-box attacks, demonstrates broad effectiveness and portability, and proposes a worst-case performance defense.

  • Threat and mechanism: Different same-sized inputs can produce substantially different time and energy costs because hardware and algorithmic optimizations depend on the input.Examples include exploiting input sparsity and variable numbers of network passes.
  • Attack methods: The paper presents gradient-based and genetic-algorithm methods covering white-box and black-box attack settings.The gradient-based method requires model parameters, whereas the genetic algorithm uses model queries and energy or latency measurements.
  • Threat and mechanism: Sponge examples target ML-system availability by maximizing inference latency and energy consumption.They are designed to make inference take as long as possible and consume as much energy as possible.
  • Empirical findings: Sponge examples increase energy consumption and runtime across a wide range of vision and language models, with particularly strong effects on language models.The paper reports that sponge examples are particularly powerful against language models.
  • Empirical findings: The attacks transfer across CPUs, GPUs, an ASIC simulator, and model architectures.This demonstrates portability across both hardware platforms and model architectures.
  • Defense: A worst-case performance bound is proposed as a defense against sponge examples.The defense can also prevent unexpected energy increases without adversaries, potentially reducing inference-related carbon emissions at scale.

2 Motivation

The motivation is that modern machine learning consumes substantial energy while hardware optimizations create a gap between average- and worst-case performance. Sponge attacks exploit this gap to increase latency, energy use, temperature, and service disruption, including a 6000× Azure Translator latency degradation.

  • Energy and scalability: Modern machine learning is power-hungry, making energy-efficient training and inference important for scaling its use.The paper states that training a single transformer model has been estimated to consume energy equivalent to 60% of a car’s lifetime carbon emissions.
  • Average versus worst case: Hardware prediction, speculation, and dynamic resource scheduling widen the gap between average-case and worst-case performance.This gap matters particularly in time- or energy-sensitive applications.
  • Operational risks: Worst-case performance can cause decision failures or battery depletion in time- and energy-sensitive applications.The paper highlights trading forecasts, wearable activity recognition, and autonomous-vehicle scene understanding as examples.
  • Attack motivation: A capable attacker can negate hardware optimizations, increase computation latency and temperature, and massively increase energy consumption with few assumptions.The Azure Translator case study degraded latency by up to 6000×.
  • Attack motivation: Sponge-example energy increases can raise hardware temperature past throttling points and sometimes crash GPU drivers.This occurs when power-management hardware or software is not designed with adversaries in mind.

3 Background

The background frames sponge examples as a new availability attack alongside established confidentiality and integrity threats. It connects energy attacks to accelerator hardware, service disruption, battery depletion, thermal effects, and attacks that target hardware or algorithmic complexity rather than training data.

  • Neural-network hardware: DNN inference is compute- and memory-intensive, motivating CPUs, GPUs, and dedicated accelerators with specialized acceleration features.Examples include SIMD instructions and GPU Tensor Cores for low-precision multiplications.
  • Energy attacks: Operations per Watt is an important cloud-infrastructure efficiency indicator, while power oversubscription can expose datacenters to power attacks.Remotely generated power spikes across hosts may overload systems and disrupt service.
  • Energy attacks: Energy attacks can drain mobile-device batteries, affect constrained systems, and increase hardware failure risk through higher temperatures.The paper notes that a 15°C temperature increase raises component failure rates by 2×.
  • Prior attacks: Existing adversarial examples primarily target incorrect classification, with white-box gradient methods and black-box transfer or finite-difference approaches.These attacks are presented as prior work on machine-learning vulnerabilities.
  • Availability attacks: The paper introduces availability attacks using samples that act as sponges for time or energy, an area overlooked in prior ML security work.Availability is defined here as timely and reliable access to information.
  • Availability attacks: Unlike poisoning attacks, sponge attacks target hardware or model algorithmic complexity rather than poisoning training data.The distinction separates these attacks from availability interpretations based on degraded training or accuracy.

4 Methodology

The methodology models attackers who exploit input-dependent gaps between average- and worst-case inference performance across CPUs, GPUs, and ASICs. It develops energy- and latency-oriented sponge-example attacks under white-box, interactive black-box, and blind threat models.

  • Threat Model and Problem: The threat models range from white-box access to model architecture and parameters, through interactive black-box querying, to blind transfer without prior interaction.Interactive black-box attackers may measure energy or timing remotely; blind adversaries transfer previously discovered sponge examples to a new target.
  • Energy and Computation: Inference energy depends primarily on arithmetic-operation count and memory accesses, defining the Energy Gap between average-case and worst-case performance.The attacks target activity ratio and execution time because they are linked to the operations and memory accesses performed during inference.
  • Threat Model and Problem: The study asks whether inputs of the same dimension can produce substantially different energy consumption, while remaining within predefined numerical ranges.This input constraint excludes increasing text length or image pixel dimensions and focuses the attack on performance variation among valid inputs.
  • Energy and Computation: Transformer inference can grow with input and output token sizes, embedding dimensions, and autoregressive sequence computation, including effects from tokenization and unknown words.Unknown words in input and output spaces lead to larger sentence representations and more inference runs.
  • Attack Generation: The attacks generate sponge examples using either gradients or genetic algorithms, covering white-box and black-box settings.The gradient-based method increases activation density across layers to prevent hardware from skipping operations, whereas genetic algorithms evolve queried inputs using measured energy or latency.

5 Sponge Examples on Language Models

Sponge examples exploit language-model preprocessing and output generation to increase computation, energy use, and latency. White-box and black-box attacks work across tasks, models, hardware platforms, and measurement proxies, with Azure translation reaching a 6000× latency degradation.

  • White-box results: 26× is the best-case energy increase reported for sponge examples, while latency increases reach up to 30× on slower tasks.Sponge examples have the highest energy cost on both GPUs and ASICs; GPU-time degradation is smaller for quick tasks.
  • Attack mechanism: The attack maximises post-tokenisation representation length and output sequence length, increasing computation and producing a quadratic energy increase.Unfamiliar words generate inefficient subword representations, while longer outputs directly increase computation cost.
  • Attack mechanism: Random samples also increase NLP latency and energy because they produce unnecessarily long representations, making random noise a scalable black-box attack tool.Natural samples are encoded more efficiently than random and attack samples.
  • Measurement considerations: The experiments have measurement limitations because short GPU inference runs and hardware effects make energy and timing difficult to measure accurately.Energy degradation can also exceed time degradation, with observed energy-to-time degradation factors ranging from 1.15 to 1.62.
  • Black-box attacks: Black-box genetic-algorithm attacks use remotely measured GPU energy or time without model internals, and their examples transfer across hardware and measurement proxies.A GPU-time attack can increase ASIC-simulator energy cost, while energy measurements are more stable than noisy timing measurements.
  • Transferability: Sponge examples transfer across hardware platforms and model architectures, enabling blind black-box attacks that increase latency and energy on target tasks.Transferred samples outperform random noise and raise internal data density for all evaluated networks except MobileNet.
  • Cross-model findings: Sponge examples increase energy consumption and latency across evaluated language-model tasks and models, with particularly strong effects against language models.The performance remains task- and model-dependent, but every evaluated task and model shows significant increases.

6 Sponge Examples on Vision Models

On vision models, sponge examples target runtime sparsity and data density to increase inference energy, with effects that can transfer across architectures and hardware settings.

  • Models: The evaluation covers diverse TorchVision models, including ResNet, DenseNet, and MobileNet-V2, spanning 3.4M to 49M parameters.MobileNet-V2 is designed for battery-powered mobile devices.
  • Attack setup: White-box GA and L-BFGS attacks generate vision-model sponge examples aimed at maximizing energy consumption.The evaluation reports ASIC energy, energy ratios under sparsity optimizations, and internal data-density behavior.
  • Cross-architecture behavior: Different architectures exhibit similar class-wise computation densities, and sponge examples can increase density across model architectures.This cross-architecture pattern supports evaluating transferability rather than restricting attacks to one model family.
  • Transferability: Transferred sponge samples increase internal data density for all tested networks except MobileNet, without using target-model architecture, parameters, or natural-sample information.Transferred sponge samples outperform random noise.
  • Natural-sample structure: Natural ImageNet samples show per-class similarities in runtime data density, especially within ResNet and DenseNet architectures.The observed similarities suggest that related architectures learn similar features.
  • Energy effects: Sponge examples decrease runtime sparsity, producing marginally more energy-consuming samples for ASICs that use data-sparsity optimizations.The reported hardware differences are too small to reliably observe on GPUs, although GPU energy readings are statistically different between normal and sponge samples.

7 Discussion

The discussion frames sponge examples as realistic availability threats whose effects span model and hardware optimizations, while motivating worst-case testing and layered defenses.

  • Lessons from Sponge Examples: The attacks provide service-denial capabilities against ML components and currently work best against NLP models, whose internal complexity requires domain-specific optimizations.The authors distinguish current effectiveness from broader potential across ML systems.
  • Lessons from Sponge Examples: Attackers can target hardware optimizations, indicating that different optimizations across the stack remain exploitable.The claim concerns the capability to exploit optimizations rather than a guarantee of equal effectiveness on every platform.
  • Lessons from Sponge Examples: The authors warn that increasingly complex integrated ML pipelines may become more vulnerable and could encounter deadlocks or livelocks.Semi-trained reinforcement-learning agents that walk in circles are offered as a possible precursor.
  • Lessons from Sponge Examples: The demonstrated attacks process one sample at a time, leaving interacting-sample attacks, including coordinated federated-learning attacks, as future work.The single-sample assumption enables the paper’s simple demonstrations.
  • Lessons from Sponge Examples: The Microsoft Azure Translator case encountered caching that reduced the effectiveness of previously potent samples, although a genetic algorithm still found powerful examples.The authors report using two main optimization strategies and note that others remain possible.
  • Defenses and implications: Sponge examples should also be used in safety testing to identify worst-case inputs and timing side-channels before deployment.The methodology is described as applicable to interacting components in ML and traditional processing pipelines.
  • Defenses and implications: API rate limiting does not prevent increased resource consumption per sample because sponge attacks need not increase query rate.The consequence concerns availability of the underlying ML system.
  • Defenses and implications: A proposed defense profiles natural examples before deployment and rejects inference runs exceeding a fixed time or energy threshold.The threshold bounds maximum per-inference consumption and causes sponge examples to return an error.

8 Reproducibility

Attack performance varies substantially across hardware and experimental conditions, so the authors release artifacts to support reproducibility.

  • Reproducibility: Energy and latency varied by up to a factor of 10 across two similarly configured servers in some black-box experiments.The authors also note variation across hardware platforms and external conditions.
  • Reproducibility: The released artifacts include discovered sponge examples, the attack codebase, and an ASIC simulator.

9 Conclusion

The paper introduces energy-latency attacks using sponge examples to deny service by increasing ML inference latency and energy consumption, and calls for worst-case analysis.

  • Conclusion: Energy-latency attacks use specially crafted sponge examples to increase ML-system latency and energy consumption across realistic deployment threat models.The attacks cover access ranging from total model knowledge to none.
  • Conclusion: The paper demonstrates that sponge examples can slow Microsoft Azure translation by several thousandfold.
  • Conclusion: The findings motivate careful worst-case analysis of latency and energy consumption in computational systems using deep-learning mechanisms.

7 end

The section models energy as static and dynamic power accumulated over execution time, then identifies which factors an attacker can influence. The attack focuses on activity, runtime, and transistor switching because frequency and temperature are affected indirectly by hardware optimisations.

  • Attack optimisation: The genetic algorithm searches for sponge samples by mutating and combining candidate inputs, with small pools and short runs often sufficient.The method includes mutation, concatenation, and random masking, and its authors report that relatively small pool sizes and short iteration counts work across many tasks.
  • Energy model: Energy cost combines static energy from idle circuitry and dynamic energy from charging and discharging circuitry.A coarse-grained simulator estimates energy-consuming samples more efficiently than cycle-accurate hardware simulation.
  • Energy model: Dynamic power is modeled using activity factor, capacitance, core voltage, and clock frequency.The activity factor represents components currently consuming power, while capacitance and frequency describe hardware switching behavior.
  • Attacker control: The attacker directly focuses on activity ratio, execution time, and transistor switching because frequency and temperature are controlled indirectly by hardware optimisations.The execution time and activity ratio are linked to the number of operations performed.

C Domain Specific Optimisations

The authors add domain-specific optimisations to the generic genetic attack for language and vision tasks. Encoding-aware changes help NLP attacks, while computer-vision attacks target dense inputs rather than arbitrary random noise.

  • NLP tasks: For NLP tasks, exploiting token encoding schemes produced the greatest performance impact, although parent concatenation created efficiency difficulties.The genetic algorithm sometimes inserted backslashes while decomposing subwords into more tokens.
  • CV tasks: For computer-vision tasks, random samples were usually assigned to one class and had very low internal density, limiting genetic-algorithm improvement.The authors hypothesize that random samples contain few class features compared with natural samples.
  • CV tasks: Rotation, transposition, and rescaling mutations did not produce significant improvements.

D Understanding Sponges and Their Performance

The analysis compares natural, random, and sponge samples by their internal density and energy-related behavior across vision models. Random inputs are generally cheaper, while sponge samples increase population performance and energy-expensive classes transfer across architectures.

  • Figures and measurements: Figure 7 compares per-class density distributions for natural, random, and sponge samples using normalised probability-density scales.The comparison uses 50,000 natural samples, 50,000 random samples, and 1,000 sponge samples.
  • Sample density and energy: Random computer-vision samples produce sparser computation and lower energy cost than natural samples.For ResNet18, random samples are around 4% more sparse, while natural samples cost around 4–7% more than random samples in the simulator.
  • Class-wise transferability: Energy-expensive classes are consistent across different architectures, enabling energy consumption or slowdown through natural samples from those classes.The section further demonstrates this class-wise transferability.
  • Sponge performance: Sponge samples improve population performance and tend to outperform natural samples.They more easily outperform all natural samples on DenseNets, while struggling to outperform all natural samples on ResNets.

D.1 Measuring Difficulties and Statistical Analysis

Measuring sponge effects is difficult because hardware temperature, performance modes, and optimisations make absolute energy and latency variable. The authors therefore use controlled stabilisation and statistical comparisons to distinguish sample classes, while noting limits on direct GPU interpretation.

  • Measurement difficulties: Hardware optimisations and multiple performance modes complicate interpretation of per-sample CPU or GPU load.These optimisations balance performance, energy efficiency, and reliability; Nvidia documentation lists 15 performance modes.
  • Measurement difficulties: GPU heating and cooling cycles make absolute performance and attack impact difficult to measure directly.When GPUs speed up they consume more energy in less time, while rising temperature can switch them into a more conservative mode.
  • Statistical analysis: The Mann-Whitney-Wilcoxon U test compares the energy distributions of natural, random, and sponge samples through pairwise tests.The null hypothesis is that compared distributions are identical, while the alternative is that they differ.
  • Assumptions and controls: The statistical analysis relies on independence, ordinal-or-higher measurements, and random samples, with the final assumption treated as difficult but supported by randomisation.The authors state that random shuffling makes hardware-optimisation effects equally likely across sample classes.
  • Assumptions and controls: Temperature is a major limitation because exact hardware optimisation parameters and repeatable hardware states are unknown.The authors reduce temperature effects by running shuffled natural, attack, and random samples until stabilisation, requiring approximately 30000 samples.
  • Statistical analysis: For CPU MobileNet, the three sample types have statistically different energy distributions with p-value=0.000, while sponge samples consume 1.5% more energy on CPU and >7% on ASIC.After temperature stabilises, about 100 observations per class are sufficient for statistically significant differences; unstable temperatures require roughly three times more data.
Loading 2006.03463v2…