The SpongeNet Attack: Sponge Weight Poisoning of Deep Neural Networks
Jona te Lintelo Stefanos Koffas Stjepan Picek
Sponge attacks aim to increase the energy consumption and computation time of
neural networks deployed on hardware accelerators. Existing sponge attacks can
be performed during inference via sponge examples or during training via Sponge
Poisoning. Sponge examples leverage perturbations added to the model's input to
increase energy and latency, while Sponge Poisoning alters the objective
function of a model to induce inference-time energy/latency effects.
  In this work, we propose a novel sponge attack called SpongeNet. SpongeNet is
the first sponge attack that is performed directly on the parameters of a
pre-trained model. Our experiments show that SpongeNet can successfully
increase the energy consumption of vision models with fewer samples required
than Sponge Poisoning. Our experiments indicate that poisoning defenses are
ineffective if not adjusted specifically for the defense against Sponge
Poisoning (i.e., they decrease batch normalization bias values). Our work shows
that SpongeNet is more effective on StarGAN than the state-of-the-art.
Additionally, SpongeNet is stealthier than the previous Sponge Poisoning attack
as it does not require significant changes in the victim model's weights. Our
experiments indicate that the SpongeNet attack can be performed even when an
attacker has access to only 1% of the entire dataset and reach up to 11% energy
increase.