Using Undervolting as an On-Device Defense Against Adversarial Machine Learning Attacks
Not on the map. Why?
Abstract (arXiv)
Deep neural network (DNN) classifiers are powerful tools that drive a broad spectrum of important applications, from image recognition to autonomous vehicles. Unfortunately, DNNs are known to be vulnerable to adversarial attacks that affect virtually all state-of-the-art models. These attacks make small imperceptible modifications to inputs that are sufficient to induce the DNNs to produce the wrong classification. In this paper we propose a novel, lightweight adversarial correction and/or detection mechanism for image classifiers that relies on undervolting (running a chip at a voltage that is slightly below its safe margin). We propose using controlled undervolting of the chip running the inference process in order to introduce a limited number of compute errors. We show that these errors disrupt the adversarial input in a way that can be used either to correct the classification or detect the input as adversarial. We evaluate the proposed solution in an FPGA design and through software simulation. We evaluate 10 attacks and show average detection rates of 77% and 90% on two popular DNNs.
Key facts. Cited by 1 paper in the map (data through 7 Oct 2026). Builds on 38 of its 60 references that are in the map. First posted on arXiv 20 Jul 2021.
Builds on
38 of 60 references.
References · 38
- 2015Deep Residual Learning for Image Recognitioncited by 51,809
- 2014Very Deep Convolutional Networks for Large-Scale Image Recognitioncited by 15,267
- 2014ImageNet Large Scale Visual Recognition Challengecited by 8,441
- 2014Explaining and Harnessing Adversarial Examplescited by 7,287
- 2016Densely Connected Convolutional Networkscited by 6,691
- 2017Towards Deep Learning Models Resistant to Adversarial Attackscited by 6,326
- 2013Intriguing properties of neural networkscited by 5,114
- 2016Towards Evaluating the Robustness of Neural Networkscited by 2,976
- 2016Adversarial examples in the physical worldcited by 1,762
- 2019Certified Adversarial Robustness via Randomized Smoothingcited by 1,324
- 2015DeepFool: a simple and accurate method to fool deep neural networkscited by 1,315
- 2017A Survey on Deep Learning in Medical Image Analysiscited by 1,182
26 more
- 2016End to End Learning for Self-Driving Carscited by 1,000
- 2016Adversarial Machine Learning at Scalecited by 934
- 2015The Limitations of Deep Learning in Adversarial Settingscited by 784
- 2016Universal adversarial perturbationscited by 774
- 2015Distillation as a Defense to Adversarial Perturbations against Deep Neural Networkscited by 675
- 2017Feature Squeezing: Detecting Adversarial Examples in Deep Neural Networkscited by 484
- 2018Certified Robustness to Adversarial Examples with Differential Privacycited by 462
- 2017Defense against Adversarial Attacks Using High-Level Representation Guided Denoisercited by 329
- 2018Characterizing Adversarial Subspaces Using Local Intrinsic Dimensionalitycited by 280
- 2017PixelDefend: Leveraging Generative Models to Understand and Defend against Adversarial Examplescited by 243
- 2017On Detecting Adversarial Perturbationscited by 232
- 2017On the (Statistical) Detection of Adversarial Examplescited by 180
- 2018Stochastic Activation Pruning for Robust Adversarial Defensecited by 171
- 2017EAD: Elastic-Net Attacks to Deep Neural Networks via Adversarial Examplescited by 154
- 2018Parametric Noise Injection: Trainable Randomness to Improve Deep Neural Network Robustness against Adversarial Attackcited by 123
- 2016Towards the Science of Security and Privacy in Machine Learningcited by 89
- 2017Deep Learning for IoT Big Data and Streaming Analytics: A Surveycited by 59
- 2017Mitigating Evasion Attacks to Deep Neural Networks via Region-based Classificationcited by 56
- 2019A New Defense Against Adversarial Images: Turning a Weakness into a Strengthcited by 49
- 2019On adversarial patches: real-world attack on ArcFace-100 face recognition systemcited by 35
- 2017Attacking the Madry Defense Model with L1-based Adversarial Examplescited by 21
- 2020Defensive Approximation: Securing CNNs using Approximate Computingcited by 12
- 2018Bypassing Feature Squeezing by Increasing Adversary Strengthcited by 8
- 2017Understanding Reduced-Voltage Operation in Modern DRAM Chips: Characterization, Analysis, and Mechanismscited by 4
- 2019BlurNet: Defense by Filtering the Feature Mapscited by 4
- 2020An Experimental Study of Reduced-Voltage Operation in Modern FPGAs for Neural Network Accelerationcited by 4
Built on by
Citing papers per year: 2026: 1.
1 paper.