[论文解读] Adversarial Attacks on Brain-Inspired Hyperdimensional Computing-Based Classifiers

Fangfang Yang, Shaolei Ren|arXiv (Cornell University)|Jun 10, 2020

Ferroelectric and Negative Capacitance Devices参考文献 49被引用 13

一句话总结

本文首次系统研究了针对类脑超维计算（HDC）分类器的对抗性攻击，展示了其对极小扰动输入的脆弱性。在灰盒设置下，作者使用改进的遗传算法生成对抗性样本，在固定多数规则下实现78%的误导成功率，凸显了能效高效的设备端人工智能系统中的安全风险。

ABSTRACT

Being an emerging class of in-memory computing architecture, brain-inspired hyperdimensional computing (HDC) mimics brain cognition and leverages random hypervectors (i.e., vectors with a dimensionality of thousands or even more) to represent features and to perform classification tasks. The unique hypervector representation enables HDC classifiers to exhibit high energy efficiency, low inference latency and strong robustness against hardware-induced bit errors. Consequently, they have been increasingly recognized as an appealing alternative to or even replacement of traditional deep neural networks (DNNs) for local on device classification, especially on low-power Internet of Things devices. Nonetheless, unlike their DNN counterparts, state-of-the-art designs for HDC classifiers are mostly security-oblivious, casting doubt on their safety and immunity to adversarial inputs. In this paper, we study for the first time adversarial attacks on HDC classifiers and highlight that HDC classifiers can be vulnerable to even minimally-perturbed adversarial samples. Concretely, using handwritten digit classification as an example, we construct a HDC classifier and formulate a grey-box attack problem, where an attacker's goal is to mislead the target HDC classifier to produce erroneous prediction labels while keeping the amount of added perturbation noise as little as possible. Then, we propose a modified genetic algorithm to generate adversarial samples within a reasonably small number of queries. Our results show that adversarial images generated by our algorithm can successfully mislead the HDC classifier to produce wrong prediction labels with a high probability (i.e., 78% when the HDC classifier uses a fixed majority rule for decision). Finally, we also present two defense strategies -- adversarial training and retraining-- to strengthen the security of HDC classifiers.

研究动机与目标

• 研究HDC分类器的安全漏洞，因其在低功耗物联网设备中因高效与鲁棒性而日益广泛应用。
• 分析尽管HDC分类器对硬件噪声具有鲁棒性，是否仍像深度神经网络一样易受对抗样本影响。
• 在灰盒威胁模型下，开发一种高效、查询效率高的攻击方法，针对HDC分类器。
• 提出并评估防御机制——对抗训练与微调，以增强HDC分类器的鲁棒性。

提出的方法

• 将灰盒对抗性攻击问题形式化，攻击者对HDC分类器的决策机制拥有部分知识。
• 设计一种改进的遗传算法，以最小扰动生成对抗样本，同时最小化对目标模型的查询次数。
• 采用基于超向量的分类方法，使用固定多数规则进行决策，实现对抗攻击成功率的系统性评估。
• 应用对抗训练与微调策略，增强HDC分类器对生成对抗样本的抗性。
• 以MNIST手写数字分类作为基准，评估攻击与防御性能。
• 通过攻击成功率与扰动幅度量化HDC分类器的威胁面。

实验结果

研究问题

• RQ1 对抗性攻击能否成功误导专为低功耗设备端推理设计的HDC分类器？
• RQ2 在灰盒假设下，基于查询效率高、遗传算法的攻击方法在生成HDC分类器对抗样本方面的有效性如何？
• RQ3 对抗样本在不同HDC分类器配置下导致误分类的成功率如何？
• RQ4 对抗训练与微调能否显著提升HDC分类器对这类攻击的鲁棒性？
• RQ5 对抗样本的扰动幅度与HDC系统固有的噪声容忍度相比如何？

主要发现

• 当HDC分类器使用固定多数规则进行决策时，所提攻击在误导手写数字分类方面达到78%的成功率。
• 对抗样本可借助极小扰动生成，表明HDC分类器对细微、难以察觉的输入修改具有脆弱性。
• 改进的遗传算法能以有限查询次数有效探索输入空间，使该攻击在现实场景中具有可行性。
• 对抗训练与微调显著降低了后续攻击的成功率，证明其作为防御机制的有效性。
• 尽管HDC对硬件引起的位错误具有内在鲁棒性，但其仍易受针对性、输入级的对抗性扰动影响。