mlsanityData to 13 Oct 2026

Sponge Examples: Energy-Latency Attacks on Neural Networks

arXiv 2006.03463 ↗First posted 5 Jun 2020cs.LG cs.CL cs.CRcited by 110

Not on the map. Why?

Abstract (arXiv)

The high energy costs of neural network training and inference led to the use of acceleration hardware such as GPUs and TPUs. While this enabled us to train large-scale neural networks in datacenters and deploy them on edge devices, the focus so far is on average-case performance. In this work, we introduce a novel threat vector against neural networks whose energy consumption or decision latency are critical. We show how adversaries can exploit carefully crafted boldsymbolsponge~boldsymbolexamples, which are inputs designed to maximise energy consumption and latency. We mount two variants of this attack on established vision and language models, increasing energy consumption by a factor of 10 to 200. Our attacks can also be used to delay decisions where a network has critical real-time performance, such as in perception for autonomous vehicles. We demonstrate the portability of our malicious inputs across CPUs and a variety of hardware accelerator chips including GPUs, and an ASIC simulator. We conclude by proposing a defense strategy which mitigates our attack by shifting the analysis of energy consumption in hardware from an average-case to a worst-case perspective.

Key facts. Cited by 110 papers in the map (data through 13 Oct 2026). First posted on arXiv 5 Jun 2020.

Builds on

No reference list yet.

Built on by

Cited by year (2026 to 13 Oct)

Citing papers per year: 2021: 13; 2022: 10; 2023: 14; 2024: 18; 2025: 26; 2026: 29.

110 papers.

Sort:

By area:

  1. 2023A Survey on Large Language Model (LLM) Security and Privacy: The Good, the Bad, and the Uglycited by 387
  2. 2023The Curse of Recursion: Training on Generated Data Makes Models Forgetcited by 349
  3. 2021Dataset Inference: Ownership Resolution in Machine Learningcited by 116
  4. 2025OverThink: Slowdown Attacks on Reasoning LLMscited by 95
  5. 2023A Systematic Review of Green AIcited by 77
  6. 2021Manipulating SGD with Data Ordering Attackscited by 74
  7. 2021Bad Characters: Imperceptible NLP Attackscited by 71
  8. 2024Inducing High Energy-Latency of Large Vision-Language Models with Verbose Imagescited by 69
  9. 2024Risk Taxonomy, Mitigation, and Assessment Benchmarks of Large Language Model Systemscited by 66
  10. 2025Safety in Large Reasoning Models: A Surveycited by 63
  11. 2023LLM Censorship: A Machine Learning Challenge or a Computer Security Problem?cited by 49
  12. 2021The Threat of Offensive AI to Organizationscited by 38
38 more
  1. 2023A Survey on ChatGPT: AI-Generated Contents, Challenges, and Solutionscited by 35
  2. 2024Denial-of-Service Poisoning Attacks against Large Language Modelscited by 35
  3. 2024Crabs: Consuming Resource via Auto-generation for LLM-DoS Attack under Black-box Settingscited by 34
  4. 2022Energy-Latency Attacks via Sponge Poisoningcited by 29
  5. 2022Phantom Sponges: Exploiting Non-Maximum Suppression to Attack Deep Object Detectorscited by 28
  6. 2024Large Model Based Agents: State-of-the-Art, Cooperation Paradigms, Security and Privacy, and Future Trendscited by 26
  7. 2022Architectural Backdoors in Neural Networkscited by 25
  8. 2025ThinkTrap: Denial-of-Service Attacks against Black-box LLM Services via Infinite Thinkingcited by 23
  9. 2021Property Inference Attacks on Convolutional Neural Networks: Influence and Implications of Target Model's Complexitycited by 19
  10. 2025Reality Check: A New Evaluation Ecosystem Is Necessary to Understand AI's Real World Effectscited by 19
  11. 2023Towards more Practical Threat Models in Artificial Intelligence Securitycited by 17
  12. 2024Special Characters Attack: Toward Scalable Training Data Extraction From Large Language Modelscited by 17
  13. 2024AI Risk Management Should Incorporate Both Safety and Securitycited by 17
  14. 2024Poison-splat: Computation Cost Attack on 3D Gaussian Splattingcited by 17
  15. 2023SlowTrack: Increasing the Latency of Camera-based Perception in Autonomous Driving Using Adversarial Examplescited by 15
  16. 2024Energy-Latency Manipulation of Multi-modal Large Language Models via Verbose Samplescited by 14
  17. 2023Overload: Latency Attacks on Object Detection for Edge Devicescited by 13
  18. 2023Energy-Latency Attacks to On-Device Neural Networks via Sponge Poisoningcited by 10
  19. 2021Markpainting: Adversarial Machine Learning meets Inpaintingcited by 9
  20. 2022ImpNet: Imperceptible and blackbox-undetectable backdoors in compiled neural networkscited by 9
  21. 2025LingoLoop Attack: Trapping MLLMs via Linguistic Context and State Entrapment into Endless Loopscited by 9
  22. 2025LoopLLM: Transferable Energy-Latency Attacks in LLMs via Repetitive Generationcited by 8
  23. 2021Rethinking Image-Scaling Attacks: The Interplay Between Vulnerabilities in Machine Learning Systemscited by 7
  24. 2024The Impact of Uniform Inputs on Activation Sparsity and Energy-Latency Attacks in Computer Visioncited by 7
  25. 2021Evaluating the Cybersecurity Risk of Real World, Machine Learning Production Systemscited by 6
  26. 202110 Security and Privacy Problems in Large Foundation Modelscited by 6
  27. 2025StealthAttack: Robust 3D Gaussian Splatting Poisoning via Density-Guided Illusionscited by 6
  28. 2025Toward a Safe Internet of Agentscited by 6
  29. 2022A Survey on Poisoning Attacks Against Supervised Machine Learningcited by 5
  30. 2023When Vision Fails: Text Attacks Against ViT and OCRcited by 5
  31. 2025Energy-Latency Attacks: A New Adversarial Threat to Deep Learningcited by 5
  32. 2026ReasoningBomb: A Stealthy Denial-of-Service Attack by Inducing Pathologically Long Reasoning in Large Reasoning Modelscited by 5
  33. 2023BERT Lost Patience Won't Be Robust to Adversarial Slowdowncited by 4
  34. 2024From PEFT to DEFT: Parameter Efficient Finetuning for Reducing Activation Density in Transformerscited by 4
  35. 2024Non-Halting Queries: Exploiting Fixed Points in LLMscited by 4
  36. 2025On Surjectivity of Neural Networks: Can you elicit any behavior from your model?cited by 4
  37. 2026Adversarial News and Lost Profits: Manipulating Headlines in LLM-Driven Algorithmic Tradingcited by 4
  38. 2026RECUR: Resource Exhaustion Attack via Recursive-Entropy Guided Counterfactual Utilization and Reflectioncited by 4

50 most cited of 110 All 110 (JSON)