Bit flipping attacks are one class of attacks on neural networks with
numerous defense mechanisms invented to mitigate its potency. Due to the
importance of ensuring the robustness of these defense mechanisms, we perform
an empirical study on the Aegis framework. We evaluate the baseline mechanisms
of Aegis on low-entropy data (MNIST), and we evaluate a pre-trained model with
the mechanisms fine-tuned on MNIST. We also compare the use of data
augmentation to the robustness training of Aegis, and how Aegis performs under
other adversarial attacks, such as the generation of adversarial examples. We
find that both the dynamic-exit strategy and robustness training of Aegis has
some drawbacks. In particular, we see drops in accuracy when testing on
perturbed data, and on adversarial examples, as compared to baselines.
Moreover, we found that the dynamic exit-strategy loses its uniformity when
tested on simpler datasets. The code for this project is available on GitHub.

对 Aegis 框架进行了经验性研究，发现其动态退出策略和鲁棒性训练存在一些缺陷，特别是在扰动数据和对抗样本上的准确度下降问题，同时发现当在更简单的数据集上进行测试时，动态退出策略的一致性有所下降。