Ptolemy: Architecture Support for Robust Deep Learning

Abstract

Deep learning is vulnerable to adversarial attacks, where carefully-crafted input perturbations could mislead a well-trained Deep Neural Network (DNN) to produce incorrect results. Adversarial attacks jeopardize the safety, security, and privacy of DNN-enabled systems. Today's countermeasures to adversarial attacks either do not have the capability to detect adversarial samples at inference-time, or introduce prohibitively high overhead to be practical at inference-time.We propose Ptolemy, an algorithm-architecture co-designed system that detects adversarial attacks at inference time with low overhead and high accuracy. We exploit the synergies between DNN inference and imperative program execution: an input to a DNN uniquely activates a set of neurons that contribute significantly to the inference output, analogous to the sequence of basic blocks exercised by an input in a conventional program. Critically, we observe that adversarial samples tend to activate distinctive paths from those of benign inputs. Leveraging this insight, we propose an adversarial sample detection framework, which uses canary paths generated from offline profiling to detect adversarial samples at runtime. The Ptolemy compiler along with the co-designed hardware enable efficient execution by exploiting the unique algorithmic characteristics. Extensive evaluations show that Ptolemy achieves higher or similar adversarial sample detection accuracy than today's mechanisms with a much lower (as low as 2%) runtime overhead.

Block-Skim: Efficient Question Answering for Transformer

“…As the proposed Block-Skim method aims to reduce the input sequence dimension semantic redundancy, it is compatible to these model compression methods focusing on model redundancy theoretically. By designing Block-Skim not to modify the backbone model, our method is generally applicable to these algorithms as well as other model pruning methods (Guo et al 2020;Qiu et al 2019;Gan et al 2020).…”

How Far Does BERT Look At: Distance-based Clustering and Analysis of BERT’s Attention

“…With such taxonomy, we further apply analytic experiments to explore the function of each behavior according to distance. We are also looking forward to further analysis the behavior and function of variant patterns with probing task datasets (Conneau et al, 2018) and analytic tools (Qiu et al, 2019;Gan et al, 2020) as our next plan. Besides, there are several recent works focusing on the optimization of over-parameterized MHA mechanism (Michel et al, 2019;Kovaleva et al, 2019;.…”

HASI: Hardware-Accelerated Stochastic Inference, A Defense Against Adversarial Machine Learning Attacks

“…HASI does require multiple inference passes, but data reuse optimizations help to alleviate this overhead. HASI noise injection allows for detection to be more easily generalized, as opposed to other methods which require profiling to select appropriate parameters, such as Feature Squeezing [36] and Path Extraction [10], [28].…”