[Paper Review] Sardino: Ultra-Fast Dynamic Ensemble for Secure Visual Sensing at Mobile Edge

Qunliang Song, Zhenyu Yan+2 more|arXiv (Cornell University)|Apr 18, 2022

Adversarial Robustness in Machine Learning4 citations

TL;DR

Sardino proposes a HyperNet-based, ultra-fast dynamic ensemble system for real-time visual sensing on mobile edge devices, enabling per-frame ensemble renewal to thwart adaptive adversarial attacks via moving target defense. It achieves 1M× speedup over retraining, maintains 33ms frame processing, and detects out-of-distribution inputs in live traffic sign recognition systems.

ABSTRACT

Adversarial example attack endangers the mobile edge systems such as vehicles and drones that adopt deep neural networks for visual sensing. This paper presents {\em Sardino}, an active and dynamic defense approach that renews the inference ensemble at run time to develop security against the adaptive adversary who tries to exfiltrate the ensemble and construct the corresponding effective adversarial examples. By applying consistency check and data fusion on the ensemble's predictions, Sardino can detect and thwart adversarial inputs. Compared with the training-based ensemble renewal, we use HyperNet to achieve {\em one million times} acceleration and per-frame ensemble renewal that presents the highest level of difficulty to the prerequisite exfiltration attacks. We design a run-time planner that maximizes the ensemble size in favor of security while maintaining the processing frame rate. Beyond adversarial examples, Sardino can also address the issue of out-of-distribution inputs effectively. This paper presents extensive evaluation of Sardino's performance in counteracting adversarial examples and applies it to build a real-time car-borne traffic sign recognition system. Live on-road tests show the built system's effectiveness in maintaining frame rate and detecting out-of-distribution inputs due to the false positives of a preceding YOLO-based traffic sign detector.

Motivation & Objective

• To address the vulnerability of DNN-based visual sensing in mobile edge systems like drones and autonomous vehicles to adaptive adversarial example attacks.
• To overcome the limitations of static ensembles and retraining-based renewal, which are slow and impractical for real-time systems.
• To enable run-time, high-frequency ensemble renewal that increases the difficulty for adversaries to exfiltrate and craft effective attacks.
• To maintain real-time performance (e.g., 33ms per frame) while maximizing ensemble size for improved security and robustness against out-of-distribution inputs.

Proposed method

• Uses HyperNet, a learnable MLP, to generate DNN weights from random seeds, enabling near-instantaneous ensemble generation without retraining.
• Employs a run-time planner that dynamically adjusts the ensemble size (N) per frame based on predicted processing time and available budget.
• Applies consistency checks and data fusion across ensemble predictions to detect adversarial and out-of-distribution inputs.
• Integrates a lightweight validation mechanism using random seeds to verify ensemble accuracy without storing full models.
• Uses a soft deadline mechanism to ensure each frame is processed within a target latency (e.g., 33ms) despite dynamic workload.
• Deploys the system in a real-time car-borne traffic sign recognition pipeline, processing YOLO-detected objects with adaptive ensemble renewal.

Experimental results

Research questions

• RQ1 Can ultra-fast, run-time ensemble renewal be achieved on mobile edge devices to counter adaptive adversarial attacks?
• RQ2 How can ensemble renewal be accelerated to enable per-frame updates without retraining?
• RQ3 What is the trade-off between ensemble size, processing latency, and security strength in dynamic ensembles?
• RQ4 Can dynamic ensembles effectively detect both adversarial examples and out-of-distribution inputs in real-world deployment?
• RQ5 How does the system maintain real-time performance while maximizing ensemble diversity and renewal frequency?

Key findings

• Sardino achieves a 1 million times speedup in ensemble renewal compared to traditional retraining, enabling per-frame updates on mobile edge devices.
• The system maintains an average per-frame processing time of 33.0ms under 320x320@30fps, with jitters kept within acceptable bounds.
• Live on-road tests show Sardino successfully detects out-of-distribution inputs caused by false positives from a YOLO-based traffic sign detector.
• The run-time planner dynamically adjusts the ensemble size (N) to maintain processing within a 33ms soft deadline, even under high object load (up to 9 objects per frame).
• The system incurs only 5.5MB/hour storage overhead by storing random seeds instead of full model weights, enabling post-incident analysis.
• Compared to off-time retraining methods, Sardino’s per-frame renewal provides significantly stronger moving target defense security and avoids battery over-discharge risks.