PaperlayerView exact revision on arXiv

Source-linked AI summary

No-Skim: Towards Efficiency Robustness Evaluation on Skimming-based Language Models

Shengyao Zhang, Mi Zhang, Xudong Pan, Min Yang

arXiv:2312.09494v2cs.CRcs.CL

TL;DR

Skimming-based acceleration lowers language-model cost by dropping tokens, but its input-dependent decisions may be manipulated to increase computation and energy use. No-Skim evaluates this robustness with minimally noticeable perturbations across access settings and model architectures, finding substantial vulnerability, including a 145% increase in average remaining ratio in the reported evaluation. The framework therefore exposes an efficiency attack surface relevant to real-time services and resource-constrained devices.

  • Problem

    Skimming-based models improve efficiency by dropping tokens, but their vulnerability to adversarial inputs that increase computation cost requires systematic evaluation.

    Source: Introduction · pp. 1–2

  • Method

    No-Skim searches minimally noticeable word- and character-level perturbations using modular ranking, candidate-generation, and candidate-search procedures under different knowledge settings.

    Source: Introduction · p. 2, Evaluation Objectives · p. 3, Evaluation Scenarios · p. 3

  • Results

    145%: No-Skim increases the average remaining ratio by 145% in the reported evaluation, with vulnerability studied on BERT and RoBERTa using GLUE tasks.

    Source: Introduction · p. 2, Effectiveness · p. 6

  • Takeaways & Limitations

    The findings identify an efficiency attack surface that challenges deployment of skimming-based models on real-time services and resource-constrained edge devices.

    Source: Evaluation Objectives · p. 3, Conclusions · p. 7

    The evaluation scenarios differ in available information, with black-box access limited to observations of the running environment rather than model internals or speed-up ratios.

    Source: Evaluation Scenarios · p. 3

Abstract

from arXiv · show

To reduce the computation cost and the energy consumption in large language models (LLM), skimming-based acceleration dynamically drops unimportant tokens of the input sequence progressively along layers of the LLM while preserving the tokens of semantic importance. However, our work for the first time reveals the acceleration may be vulnerable to Denial-of-Service (DoS) attacks. In this paper, we propose No-Skim, a general framework to help the owners of skimming-based LLM to understand and measure the robustness of their acceleration scheme. Specifically, our framework searches minimal and unnoticeable perturbations at character-level and token-level to generate adversarial inputs that sufficiently increase the remaining token ratio, thus increasing the computation cost and energy consumption. We systematically evaluate the vulnerability of the skimming acceleration in various LLM architectures including BERT and RoBERTa on the GLUE benchmark. In the worst case, the perturbation found by No-Skim substantially increases the running cost of LLM by over 145% on average. Moreover, No-Skim extends the evaluation framework to various scenarios, making the evaluation conductible with different level of knowledge.

Introduction

Skimming-based language models reduce computation by dropping unimportant tokens, but adversarial text perturbations can manipulate token-dropping decisions and increase deployment costs. No Skim provides a modular evaluation framework and finds substantial efficiency vulnerability across evaluated architectures and tasks.

Introduction

  • Skimming acceleration progressively drops unimportant tokens across layers, reducing the quadratic attention cost while preserving semantically important tokens.Figure 1 illustrates preservation of the important token “good” in sentiment classification.Source: Introduction · p. 1, Figure 1 · p. 1
  • Adversarially increased computation can reduce simultaneous query capacity on real-time platforms and accelerate battery or resource consumption on edge devices.These effects threaten service quality and practical deployment under constrained computation and energy budgets.Source: Introduction · pp. 1–2
  • No Skim systematically evaluates skimming-based models for efficiency vulnerability by generating adversarial inputs that increase computation complexity.The framework is presented as the first general efficiency-robustness evaluation framework for skimming-based language models.Source: Introduction · p. 2
  • No Skim combines word-importance ranking, candidate-set generation, and best-candidate searching through extensible plug-ins.The framework supports gradient- and mask-based ranking, word- and character-level perturbations, and direct or side-channel efficiency indicators.Source: Introduction · p. 2
  • Across BERT and RoBERTa on GLUE, the framework can increase computation cost by 145% in the worst case.The evaluation examines the dynamic skimming scheme Transkimmer under multiple practical access settings.Source: Introduction · p. 2

Related Works

Prior work develops static and dynamic token-skimming schemes for efficient language models, while separate studies target efficiency robustness in other adaptive architectures. Because skimming changes computation according to input content, its efficiency robustness requires dedicated evaluation.

Skimming Acceleration Schemes

  • Skimming research progressed from recurrent-step skipping to transformer token dropping, with schemes categorized as static or dynamic by whether the remaining-token ratio is fixed.Transformer-based skimming progressively removes tokens across layers, whereas recurrent approaches skip time steps.Source: Skimming Acceleration Schemes · p. 2
  • Static schemes such as PoWER-BERT and LAT use fixed token-retention ratios, but input variation across tasks and datasets can cause poor generalization.Their fixed ratios are optimized during training.Source: Skimming Acceleration Schemes · p. 2
  • Dynamic schemes including TR-BERT, LTP, and Transkimmer adapt token dropping using policies, attention thresholds, or hidden-value predictions.The paper focuses on dynamic schemes because their computation complexity varies with input sequences.Source: Skimming Acceleration Schemes · p. 2

Efficiency Robustness

  • Efficiency-robustness research has attacked multi-exit, layer-skipping, and autoregressive systems by delaying exits, increasing energy use, or lengthening generated sequences.These attacks target architectures whose efficiency mechanisms differ from skimming acceleration.Source: Efficiency Robustness · p. 2
  • A systematic evaluation is needed because skimming acceleration changes model efficiency through input-dependent token retention.The related attack literature does not directly evaluate this skimming-specific vulnerability.Source: Skimming Acceleration Schemes · p. 2, Efficiency Robustness · p. 3

Formulation

No Skim formulates efficiency-robustness evaluation as constrained generation of minimally changed inputs that increase token retention and computation cost. It supports white-, gray-, and black-box settings with progressively less model information.

Evaluation Objectives

  • The objective is to generate perturbed inputs that increase remaining-token ratio while preserving similarity to the original input.Remaining-token ratio serves as an efficiency indicator, and similarity is constrained by a threshold.Source: Evaluation Objectives · p. 3
  • Increasing the remaining-token ratio directly represents higher computation complexity and energy consumption in the evaluated skimming models.The operational goal is therefore to deteriorate efficiency without visibly changing the input semantics.Source: Evaluation Objectives · p. 3
  • The practical impact is reduced throughput and service quality for real-time platforms, while edge devices experience faster consumption of limited resources such as battery life.The consequences follow from increased computation under fixed platform capacity or device resources.Source: Evaluation Objectives · p. 3

Evaluation Scenarios

  • White-box evaluation assumes access to model parameters, the dynamic skimming scheme, vocabulary information, and gradients.This setting simulates direct deployment on resource-limited edge devices.Source: Evaluation Scenarios · p. 3
  • Gray-box evaluation withholds model and vocabulary information but exposes efficiency acceleration information such as remaining-token ratio.It represents a cloud-service setting where speed-up information can be returned to the evaluator.Source: Evaluation Scenarios · p. 3
  • Black-box evaluation is the most restrictive setting, exposing neither internal model information nor speed-up ratios.The evaluator instead approximates internal efficiency information from running-environment observations such as GPU status.Source: Evaluation Scenarios · p. 3

Methodology

No Skim evaluates the efficiency robustness of skimming-based language models by iteratively generating minimally perturbed adversarial inputs and measuring their computation impact across white-, gray-, and black-box scenarios.

Methodology

  • No Skim provides a general framework that generates adversarial inputs to evaluate the efficiency robustness of skimming-based language models.The framework separates adversarial-input generation from evaluation and supports extensible modules.Source: Methodology · p. 3, General Design · p. 3

General Design

  • The generation pipeline ranks words by efficiency importance, constructs semantically unnoticeable candidate perturbations, and searches for the candidate that maximizes computation cost.Each iteration modifies the selected word, queries the target model, and retains the candidate producing the largest efficiency degradation.Source: General Design · p. 3

White-box Evaluation

  • In white-box evaluation, gradient-based importance scores identify words whose embedding perturbations most increase efficiency loss, defined through the remaining token ratio.Word-level and character-level candidate sets are then searched, with semantic-damaging word candidates discarded.Source: White-box Evaluation · p. 4

Gray-box Evaluation

  • In gray-box evaluation, masking each word estimates its impact on the remaining token ratio because gradients and word embeddings are unavailable.The method uses only character-level candidates after selecting the important word, while retaining the white-box search procedure.Source: Gray-box Evaluation · p. 5

Black-box Scenario

  • In black-box evaluation, token-level inference time approximates the remaining token ratio when internal model information and acceleration ratios are unavailable.A third-party tokenizer estimates token length, avoiding the sequence-length variance that weakens sequence-level inference-time correlation.Source: Black-box Scenario · p. 5
  • Token-level inference time shows a perfect positive linear correlation with the remaining token ratio in the reported Transkimmer SST-2 evaluation.This enables side-channel inference of the remaining token ratio before applying the gray-box procedure.Source: Black-box Scenario · p. 5, Figure 3 · p. 5

Evaluation Setting

The evaluation targets Transkimmer on BERT and RoBERTa across GLUE tasks, using efficiency metrics and specified mutation settings.

Architecture & Dataset

Metrics

  • Average Remaining Ratio measures dataset-level remaining tokens, with lower values indicating better efficiency.Source: Metrics · p. 6, Figure 4 · p. 6
  • Cumulative Token Ratio measures the distribution of remaining-token ratios across inputs, with values closer to 1 indicating better efficiency.Source: Metrics · p. 6, Figure 4 · p. 6

Detailed Settings.

  • The evaluation is implemented with Hugging Face Transformers and the GLUE datasets, whose training and validation sizes are reported in Table 2.Source: Detailed Settings · p. 6, Table 2 · p. 6
  • The experiments use skim factor 0.5, maximum sequence length 64, and mutation magnitudes ϵ from 1 to 5.Each mutant changes one word; gradient-level candidates must have semantic similarity above 0.5 with the original word.Source: Detailed Settings · p. 6

Evaluation

No-Skim substantially degrades skimming efficiency across model and access settings, while its perturbations can also reduce utility, remain semantically similar, and be generated quickly.

Effectiveness

  • 145% higher average remaining ratio and 60% lower cumulative remaining ratio reveal substantial efficiency vulnerability in existing skimming models.White-box attacks degrade efficiency most, black-box token-level attacks approximate gray-box performance, and RoBERTa is more robust than BERT on both tasks.Source: Effectiveness · p. 6

Sensitivity

  • Larger mutation magnitudes recover more dropped tokens and cause more inputs to retain higher token ratios.The sensitivity comparison is illustrated for BERT on SST-2 under a white-box character-level attack.Source: Sensitivity · pp. 6–7, Figure 5 · p. 7

Severity

  • Classification accuracy decreases by 5% to 50% alongside the increased computation costs.The negative utility effect is reported in Table 3.Source: Severity · p. 7, Table 3 · p. 7

Stealthiness

  • Average semantic similarity exceeds 0.85 in most cases, indicating highly stealthy adversarial inputs.The similarity distribution is shown for white-box token- and character-level perturbations on RoBERTa and SST-2.Source: Stealthiness · p. 7, Figure 6 · p. 7

Rapidness

  • Most single-word mutations require less than 10 seconds, while generation time increases linearly with mutation size.Source: Rapidness · p. 7

Conclusions

No-Skim identifies efficiency vulnerabilities in skimming acceleration and shows that adversarial inputs can increase inference costs, challenging deployment on cloud services and resource-constrained edge devices.

  • No-Skim systematically studies efficiency vulnerabilities and generates adversarial inputs that drastically increase average inference cost.The paper frames this vulnerability as a new security problem for skimming-based language models.Source: Conclusions · p. 7

Algorithm

The generation algorithm iteratively replaces selected words with candidates that maximize the efficiency loss of the target skimming-based model.

  • The algorithm takes an input, target model, operation count, and efficiency loss, then returns an adversarial input sample.Source: Algorithm · p. 9
  • Each iteration ranks words by importance, selects the highest-scoring word, and generates its candidate replacement set.Source: Algorithm · p. 9
  • The algorithm evaluates each candidate and retains the replacement producing the largest efficiency loss before continuing the search.Source: Algorithm · p. 9

Detailed Evaluation Settings

The evaluation uses task-level and sample-level metrics to measure skimming efficiency, alongside specified BERT/RoBERTa training settings.

Metrics

  • ARR measures the normalized area under average remaining-token ratios across layers and inputs, with values closer to 0 indicating better efficiency.It is a task-level metric evaluating overall efficiency speed-up on the dataset.Source: Metrics · p. 9
  • CRR measures the area under the distribution of inputs by remaining-token ratio, with values closer to 1 indicating better efficiency.It is a sample-level metric that captures efficiency-speed-up variation across samples.Source: Metrics · p. 9

Hyper-parameters

  • BERT and RoBERTa models are trained with linear classifiers after [CLS], using task-specific epochs, batch sizes, learning rates, and Adam optimization.Transkimmer uses 3 epochs, batch size 32, and learning rate 2e-5 on SST-2; MRPC uses 5 epochs and learning rate 5e-5.Source: Hyper-parameters · p. 9

More Evaluation Results

The evaluation reports the time overhead of generating adversarial inputs, finding generally short single-word mutation times but increasing cost with mutation size.

More Evaluation Results

  • Most single-word mutations require less than 10 seconds, while generation time increases linearly with mutation size.Gradient-based schemes are faster than mask-based schemes because they require one forward/backward process rather than multiple forward passes.Source: More Evaluation Results · pp. 9–10, Table 4 · p. 9
Loading 2312.09494v2…