HASI: Hardware-Accelerated Stochastic Inference, A Defense Against Adversarial Machine Learning Attacks

Deep Neural Networks (DNNs) are employed in an increasing number of\napplications, some of which are safety critical. Unfortunately, DNNs are known\nto be vulnerable to so-called adversarial attacks that manipulate inputs to\ncause incorrect results that can be beneficial to an attacker or damaging to\nthe victim. Multiple defenses have been proposed to increase the robustness of\nDNNs. In general, these defenses have high overhead, some require\nattack-specific re-training of the model or careful tuning to adapt to\ndifferent attacks.\n This paper presents HASI, a hardware-accelerated defense that uses a process\nwe call stochastic inference to detect adversarial inputs. We show that by\ncarefully injecting noise into the model at inference time, we can\ndifferentiate adversarial inputs from benign ones. HASI uses the output\ndistribution characteristics of noisy inference compared to a non-noisy\nreference to detect adversarial inputs. We show an adversarial detection rate\nof 86% when applied to VGG16 and 93% when applied to ResNet50, which exceeds\nthe detection rate of the state of the art approaches, with a much lower\noverhead. We demonstrate two software/hardware-accelerated co-designs, which\nreduces the performance impact of stochastic inference to 1.58X-2X relative to\nthe unprotected baseline, compared to 15X-20X overhead for a software-only GPU\nimplementation.\n