mlsanityData to 7 Oct 2026

The SkipSponge Attack: Sponge Weight Poisoning of Deep Neural Networks

arXiv 2402.06357 ↗First posted 9 Feb 2024cs.CR cs.LGcited by 3

Not on the map. Why?

Abstract (arXiv)

Sponge attacks aim to increase the energy consumption and computation time of neural networks. In this work, we present a novel sponge attack called SkipSponge. SkipSponge is the first sponge attack that is performed directly on the parameters of a pretrained model using only a few data samples. Our experiments show that SkipSponge can successfully increase the energy consumption of image classification models, GANs, and autoencoders, requiring fewer samples than the state-of-the-art sponge attacks (Sponge Poisoning). We show that poisoning defenses are ineffective if not adjusted specifically for the defense against SkipSponge (i.e., they decrease target layer bias values) and that SkipSponge is more effective on the GANs and the autoencoders than Sponge Poisoning. Additionally, SkipSponge is stealthy as it does not require significant changes to the victim model's parameters. Our experiments indicate that SkipSponge can be performed even when an attacker has access to less than 1% of the entire training dataset and reaches up to 13% energy increase.

Key facts. Cited by 3 papers in the map (data through 7 Oct 2026). Builds on 32 of its 70 references that are in the map. First posted on arXiv 9 Feb 2024.

Builds on

32 of 70 references.

References · 32

  1. 2015Deep Residual Learning for Image Recognitioncited by 51,809
  2. 2014Very Deep Convolutional Networks for Large-Scale Image Recognitioncited by 15,267
  3. 2013Intriguing properties of neural networkscited by 5,114
  4. 2016Image-to-Image Translation with Conditional Adversarial Networkscited by 4,510
  5. 2014Deep Learning Face Attributes in the Wildcited by 3,679
  6. 2018The Lottery Ticket Hypothesis: Finding Sparse, Trainable Neural Networkscited by 2,250
  7. 2016Membership Inference Attacks against Machine Learning Modelscited by 2,221
  8. 2014Conditional Generative Adversarial Netscited by 2,152
  9. 2019StarGAN v2: Diverse Image Synthesis for Multiple Domainscited by 1,095
  10. 2017BadNets: Identifying Vulnerabilities in the Machine Learning Model Supply Chaincited by 1,052
  11. 2017StarGAN: Unified Generative Adversarial Networks for Multi-Domain Image-to-Image Translationcited by 1,036
  12. 2021Carbon Emissions and Large Neural Network Trainingcited by 561
20 more
  1. 2018Fine-Pruning: Defending Against Backdooring Attacks on Deep Neural Networkscited by 550
  2. 2016EIE: Efficient Inference Engine on Compressed Deep Neural Networkcited by 291
  3. 2019High Accuracy and High Fidelity Extraction of Neural Networkscited by 208
  4. 2022EGSDE: Unpaired Image-to-Image Translation via Energy-Guided Stochastic Differential Equationscited by 172
  5. 2023From Words to Watts: Benchmarking the Energy Costs of Large Language Model Inferencecited by 168
  6. 2017SCNN: An Accelerator for Compressed-sparse Convolutional Neural Networkscited by 132
  7. 2020Sponge Examples: Energy-Latency Attacks on Neural Networkscited by 108
  8. 2017Bit Fusion: Bit-Level Dynamically Composable Architecture for Accelerating Deep Neural Networkscited by 95
  9. 2023ReLU Strikes Back: Exploiting Activation Sparsity in Large Language Modelscited by 91
  10. 2021Handcrafted Backdoors in Deep Neural Networkscited by 57
  11. 2022UVCGAN: UNet Vision Transformer cycle-consistent GAN for unpaired image-to-image translationcited by 42
  12. 2020Hardware Implementation of Deep Network Accelerators Towards Healthcare and Biomedical Applicationscited by 34
  13. 2022Energy-Latency Attacks via Sponge Poisoningcited by 29
  14. 2022Phantom Sponges: Exploiting Non-Maximum Suppression to Attack Deep Object Detectorscited by 28
  15. 2019Failure Modes in Machine Learning Systemscited by 15
  16. 2023Energy-Latency Attacks to On-Device Neural Networks via Sponge Poisoningcited by 10
  17. 2021Regularization Can Help Mitigate Poisoning Attacks... with the Right Hyperparameterscited by 8
  18. 2023UVCGAN v2: An Improved Cycle-Consistent GAN for Unpaired Image-to-Image Translationcited by 8
  19. 2019Sparsely Activated Networkscited by 5
  20. 2023Poster: Sponge ML Model Attacks of Mobile Appscited by 2

Built on by

Cited by year (2026 to 7 Oct)

Citing papers per year: 2025: 2; 2026: 1.

3 papers.

  1. 2025Sponge Attacks on Sensing AI: Energy-Latency Vulnerabilities and Defense via Model Pruningcited by 2
  2. 2025Efficiency Robustness of Dynamic Deep Learning Systemscited by 1
  3. 2026Driving up Inference Energy on SNNs: Per-Sample and Universal Sponge Attackscited by 0