一句话：首次提出利用硬件支持的近似计算增强 CNN 对抗鲁棒性，保持精度、无需重训练并降低能耗。
卷积神经网络（CNN）在安全关键场景中易受对抗攻击：精心构造的输入可使系统输出错误标签。本文首次提出用硬件支持的近似计算提升分类器鲁棒性。其核心思想是让分类器在近似逻辑上执行，使针对精确分类器生成的对抗样本难以迁移，黑盒场景下迁移性更差；即使白盒攻击者完全掌握近似实现，也需注入显著更高的对抗噪声。作者在 LeNet-5 与 AlexNet 上针对多种强攻击实验，强迁移攻击下鲁棒性分别最高提升 99% 与 87%，能耗最多节省 50%；白盒攻击需更高噪声预算，输入图像 PSNR 平均下降 4 dB。该方法保持分类精度且无需重训练。
In the past few years, an increasing number of machine-learning and deep learning structures, such as Convolutional Neural Networks (CNNs), have been applied to solving a wide range of real-life problems. However, these architectures are vulnerable to adversarial attacks: inputs crafted carefully to force the system output to a wrong label. Since machine-learning is being deployed in safety-critical and security-sensitive domains, such attacks may have catastrophic security and safety consequences. In this paper, we propose for the first time to use hardware-supported approximate computing to improve the robustness of machine learning classifiers. We show that our approximate computing implementation achieves robustness across a wide range of attack scenarios. Specifically, we show that successful adversarial attacks against the exact classifier have poor transferability to the approximate implementation. The transferability is even poorer for the black-box attack scenarios, where adversarial attacks are generated using a proxy model. Surprisingly, the robustness advantages also apply to white-box attacks where the attacker has unrestricted access to the approximate classifier implementation: in this case, we show that substantially higher levels of adversarial noise are needed to produce adversarial examples. Furthermore, our approximate computing model maintains the same level in terms of classification accuracy, does not require retraining, and reduces resource utilization and energy consumption of the CNN. We conducted extensive experiments on a set of strong adversarial attacks; We empirically show that the proposed implementation increases the robustness of a LeNet-5 and an Alexnet CNNs by up to 99% and 87%, respectively for strong transferability-based attacks along with up to 50% saving in energy consumption due to the simpler nature of the approximate logic. We also show that a white-box attack requires a remarkably higher noise budget to fool the approximate classifier, causing an average of 4 dB degradation of the PSNR of the input image relative to the images that succeed in fooling the exact classifier.
@inproceedings{paperbot6108,
title = {Defensive approximation: securing CNNs using approximate computing},
author = {Amira Guesmi and Ihsen Alouani and Khaled N. Khasawneh and Mouna Baklouti and Tarek Frikha and Mohamed Abid and Nael Abu-Ghazaleh},
booktitle = {ASPLOS},
year = {2021},
doi = {10.1145/3445814.3446747}
}