Recent increases in the computational demands of deep neural networks (DNNs),
combined with the observation that most input samples require only simple
models, have sparked interest in $input$-$adaptive$ multi-exit architectures,
such as MSDNets or Shallow-Deep Networks. These architectures enable faster
inferences and could bring DNNs to low-power devices, e.g., in the Internet of
Things (IoT). However, it is unknown if the computational savings provided by
this approach are robust against adversarial pressure. In particular, an
adversary may aim to slowdown adaptive DNNs by increasing their average
inference time$-$a threat analogous to the $denial$-$of$-$service$ attacks from
the Internet. In this paper, we conduct a systematic evaluation of this threat
by experimenting with three generic multi-exit DNNs (based on VGG16, MobileNet,
and ResNet56) and a custom multi-exit architecture, on two popular image
classification benchmarks (CIFAR-10 and Tiny ImageNet). To this end, we show
that adversarial example-crafting techniques can be modified to cause slowdown,
and we propose a metric for comparing their impact on different architectures.
We show that a slowdown attack reduces the efficacy of multi-exit DNNs by
90-100%, and it amplifies the latency by 1.5-5$\times$ in a typical IoT
deployment. We also show that it is possible to craft universal, reusable
perturbations and that the attack can be effective in realistic black-box
scenarios, where the attacker has limited knowledge about the victim. Finally,
we show that adversarial training provides limited protection against
slowdowns. These results suggest that further research is needed for defending
multi-exit architectures against this emerging threat. Our code is available at
this https URL

本文旨在研究和针对 $IoT$ 设备中应用的深度神经网络 $（DNNs）$ 中的威胁问题，提出了一种针对多出口 $DNNs$ 的保护方案，并发现反对策略可以通过进行通用可重复使用的干扰来使 $DNNs$ 减速，如果不进行针对性防御，会对 $IoT$ 设备造成重大损失。