# Defensive Approximation: Securing CNNs using Approximate Computing

arXiv: https://arxiv.org/abs/2006.07700 · HTML: https://mlsanity.com/paper/2006.07700/

## Key facts

- Cited by 12 papers in the map (data through 14 Oct 2026).
- First posted on arXiv 13 Jun 2020.

## Built on by (most cited first, 12 of 12)

- [Physical Adversarial Attacks For Camera-based Smart Systems: Current Trends, Categorization, Applications, Research Challenges, and Future Outlook](https://mlsanity.com/paper/2308.06173/) (2023)
- [Approximate Computing and the Efficient Machine Learning Expedition](https://mlsanity.com/paper/2210.00497/) (2022)
- [Special Session: Towards an Agile Design Methodology for Efficient, Reliable, and Secure ML Systems](https://mlsanity.com/paper/2204.09514/) (2022)
- [ROOM: Adversarial Machine Learning Attacks Under Real-Time Constraints](https://mlsanity.com/paper/2201.01621/) (2022)
- [RoHNAS: A Neural Architecture Search Framework with Conjoint Optimization for Adversarial Robustness and Hardware Efficiency of Convolutional and Capsule Networks](https://mlsanity.com/paper/2210.05276/) (2022)
- [Is Approximation Universally Defensive Against Adversarial Attacks in Deep Neural Networks?](https://mlsanity.com/paper/2112.01555/) (2021)
- [Using Undervolting as an On-Device Defense Against Adversarial Machine Learning Attacks](https://mlsanity.com/paper/2107.09804/) (2021)
- [A Survey of Adversarial Defenses in Vision-based Systems: Categorization, Methods and Challenges](https://mlsanity.com/paper/2503.00384/) (2025)
- [On the Noise Stability and Robustness of Adversarially Trained Networks on NVM Crossbars](https://mlsanity.com/paper/2109.09060/) (2021)
- [DNNShield: Dynamic Randomized Model Sparsification, A Defense Against Adversarial Machine Learning](https://mlsanity.com/paper/2208.00498/) (2022)
- [RobustPdM: Designing Robust Predictive Maintenance against Adversarial Attacks](https://mlsanity.com/paper/2301.10822/) (2023)
- [Evasive Hardware Trojan through Adversarial Power Trace](https://mlsanity.com/paper/2401.02342/) (2024)

## Abstract (arXiv)

In the past few years, an increasing number of machine-learning and deep learning structures, such as Convolutional Neural Networks (CNNs), have been applied to solving a wide range of real-life problems. However, these architectures are vulnerable to adversarial attacks. In this paper, we propose for the first time to use hardware-supported approximate computing to improve the robustness of machine learning classifiers. We show that our approximate computing implementation achieves robustness across a wide range of attack scenarios. Specifically, for black-box and grey-box attack scenarios, we show that successful adversarial attacks against the exact classifier have poor transferability to the approximate implementation. Surprisingly, the robustness advantages also apply to white-box attacks where the attacker has access to the internal implementation of the approximate classifier. We explain some of the possible reasons for this robustness through analysis of the internal operation of the approximate implementation. Furthermore, our approximate computing model maintains the same level in terms of classification accuracy, does not require retraining, and reduces resource utilization and energy consumption of the CNN. We conducted extensive experiments on a set of strong adversarial attacks; We empirically show that the proposed implementation increases the robustness of a LeNet-5 and an Alexnet CNNs by up to 99% and 87%, respectively for strong grey-box adversarial attacks along with up to 67% saving in energy consumption due to the simpler nature of the approximate logic. We also show that a white-box attack requires a remarkably higher noise budget to fool the approximate classifier, causing an average of 4db degradation of the PSNR of the input image relative to the images that succeed in fooling the exact classifier