mlsanityData to 7 Oct 2026

Energy-Latency Attacks via Sponge Poisoning

arXiv 2203.08147 ↗First posted 14 Mar 2022cs.CR cs.CV cs.LGcited by 29

Not on the map. Why?

Abstract (arXiv)

Sponge examples are test-time inputs optimized to increase energy consumption and prediction latency of deep networks deployed on hardware accelerators. By increasing the fraction of neurons activated during classification, these attacks reduce sparsity in network activation patterns, worsening the performance of hardware accelerators. In this work, we present a novel training-time attack, named sponge poisoning, which aims to worsen energy consumption and prediction latency of neural networks on any test input without affecting classification accuracy. To stage this attack, we assume that the attacker can control only a few model updates during training -- a likely scenario, e.g., when model training is outsourced to an untrusted third party or distributed via federated learning. Our extensive experiments on image classification tasks show that sponge poisoning is effective, and that fine-tuning poisoned models to repair them poses prohibitive costs for most users, highlighting that tackling sponge poisoning remains an open issue.

Key facts. Cited by 29 papers in the map (data through 7 Oct 2026). Builds on 35 of its 78 references that are in the map. First posted on arXiv 14 Mar 2022.

Builds on

35 of 78 references.

References · 35

  1. 2019PyTorch: An Imperative Style, High-Performance Deep Learning Librarycited by 20,160
  2. 2014Very Deep Convolutional Networks for Large-Scale Image Recognitioncited by 15,267
  3. 2016Densely Connected Convolutional Networkscited by 6,691
  4. 2013Intriguing properties of neural networkscited by 5,114
  5. 2014Going Deeper with Convolutionscited by 4,231
  6. 2014Deep Learning Face Attributes in the Wildcited by 3,679
  7. 2016Membership Inference Attacks against Machine Learning Modelscited by 2,221
  8. 2016Identity Mappings in Deep Residual Networkscited by 1,960
  9. 2017Understanding Black-box Predictions via Influence Functionscited by 1,714
  10. 2017BadNets: Identifying Vulnerabilities in the Machine Learning Model Supply Chaincited by 1,052
  11. 2018How To Backdoor Federated Learningcited by 745
  12. 2017Evasion Attacks against Machine Learning at Test Timecited by 686
23 more
  1. 2017In-Datacenter Performance Analysis of a Tensor Processing Unitcited by 610
  2. 2016Stealing Machine Learning Models via Prediction APIscited by 602
  3. 2018Poison Frogs! Targeted Clean-Label Poisoning Attacks on Neural Networkscited by 500
  4. 2017Efficient Processing of Deep Neural Networks: A Tutorial and Surveycited by 427
  5. 2017Wild Patterns: Ten Years After the Rise of Adversarial Machine Learningcited by 411
  6. 2020Input-Aware Dynamic Backdoor Attackcited by 304
  7. 2016EIE: Efficient Inference Engine on Compressed Deep Neural Networkcited by 291
  8. 2022Patches Are All You Need?cited by 201
  9. 2020Dataset Security for Machine Learning: Data Poisoning, Backdoor Attacks, and Defensescited by 171
  10. 2020Witches' Brew: Industrial Scale Data Poisoning via Gradient Matchingcited by 156
  11. 2020Dynamic Backdoor Attacks Against Machine Learning Modelscited by 147
  12. 2017SCNN: An Accelerator for Compressed-sparse Convolutional Neural Networkscited by 132
  13. 2018Backdoor Embedding in Convolutional Neural Network Models via Invisible Perturbationcited by 131
  14. 2020Adversarial Machine Learning -- Industry Perspectivescited by 121
  15. 2020Sponge Examples: Energy-Latency Attacks on Neural Networkscited by 108
  16. 2019Bit-Flip Attack: Crushing Neural Network with Progressive Bit Searchcited by 106
  17. 2016Deep, Convolutional, and Recurrent Models for Human Activity Recognition using Wearablescited by 93
  18. 2019Learning to Confuse: Generating Training Time Adversarial Data with Auto-Encodercited by 70
  19. 2019Stateful Detection of Black-Box Adversarial Attackscited by 55
  20. 2020Hardware Implementation of Deep Network Accelerators Towards Healthcare and Biomedical Applicationscited by 34
  21. 2017Cnvlutin2: Ineffectual-Activation-and-Weight-Free Deep Neural Network Computingcited by 9
  22. 2021The Hammer and the Nut: Is Bilevel Optimization Really Needed to Poison Linear Classifiers?cited by 9
  23. 2021Random and Adversarial Bit Error Robustness: Energy-Efficient and Secure DNN Acceleratorscited by 6

Built on by

Cited by year (2026 to 7 Oct)

Citing papers per year: 2022: 3; 2023: 6; 2024: 4; 2025: 7; 2026: 9.

29 papers.

Sort:

By area:

  1. 2022Wild Patterns Reloaded: A Survey of Machine Learning Security against Training Data Poisoningcited by 93
  2. 2022Phantom Sponges: Exploiting Non-Maximum Suppression to Attack Deep Object Detectorscited by 28
  3. 2022Machine Learning Security against Data Poisoning: Are We There Yet?cited by 23
  4. 2023Towards more Practical Threat Models in Artificial Intelligence Securitycited by 17
  5. 2023Energy-Latency Attacks to On-Device Neural Networks via Sponge Poisoningcited by 10
  6. 2025LingoLoop Attack: Trapping MLLMs via Linguistic Context and State Entrapment into Endless Loopscited by 9
  7. 2024σ-zero: Gradient-based Optimization of ℓ0-norm Adversarial Examplescited by 7
  8. 2024The Impact of Uniform Inputs on Activation Sparsity and Energy-Latency Attacks in Computer Visioncited by 7
  9. 2025Energy-Latency Attacks: A New Adversarial Threat to Deep Learningcited by 5
  10. 2023Minimizing Energy Consumption of Deep Learning Models by Energy-Aware Trainingcited by 3
  11. 2024The SkipSponge Attack: Sponge Weight Poisoning of Deep Neural Networkscited by 3
  12. 2025Breaking the Loop: Detecting and Mitigating Denial-of-Service Vulnerabilities in Large Language Modelscited by 3
17 more
  1. 2023Poster: Sponge ML Model Attacks of Mobile Appscited by 2
  2. 2023QuantAttack: Exploiting Dynamic Quantization to Attack Vision Transformerscited by 2
  3. 2024DeSparsify: Adversarial Attack Against Token Sparsification Mechanisms in Vision Transformerscited by 2
  4. 2025Sponge Attacks on Sensing AI: Energy-Latency Vulnerabilities and Defense via Model Pruningcited by 2
  5. 2026Resource Consumption Threats in Large Language Modelscited by 2
  6. 2025Energy Backdoor Attack to Deep Neural Networkscited by 1
  7. 2025Efficiency Robustness of Dynamic Deep Learning Systemscited by 1
  8. 2025Securing AI Systems: A Guide to Known Attacks and Impactscited by 1
  9. 2026Spectral Defense Against Resource-Targeting Attack in 3D Gaussian Splattingcited by 1
  10. 2026LoopTrap: Termination Poisoning Attacks on LLM Agentscited by 1
  11. 2023Threats, Vulnerabilities, and Controls of Machine Learning Based Systems: A Survey and Taxonomycited by 0
  12. 2026VidDoS: Universal Denial-of-Service Attack on Video-based Large Language Modelscited by 0
  13. 2026SoK: Colluding Adversaries in Machine Learning Pipelinescited by 0
  14. 2026Driving up Inference Energy on SNNs: Per-Sample and Universal Sponge Attackscited by 0
  15. 2026Multimodal Resource-Exhaustion Attacks on Vision-Language Models via Joint Pixel-Prompt Optimizationcited by 0
  16. 2026Upholding Robustness in Federated Learning: Trends, Emerging Strategies, and Research Opportunitiescited by 0
  17. 2026Trustworthy Data- and ML-Ops for Intelligent Transportation Systems and Logisticscited by 0