ML is shifting from the cloud to the edge. Edge computing reduces the surface
exposing private data and enables reliable throughput guarantees in real-time
applications. Of the panoply of devices deployed at the edge,
resource-constrained MCUs, e.g., Arm Cortex-M, are more prevalent, orders of
magnitude cheaper, and less power-hungry than application processors or GPUs.
Thus, enabling intelligence at the deep edge is the zeitgeist, with researchers
focusing on unveiling novel approaches to deploy ANNs on these constrained
devices. Quantization is a well-established technique that has proved effective
in enabling the deployment of neural networks on MCUs; however, it is still an
open question to understand the robustness of QNNs in the face of adversarial
examples.
To fill this gap, we empirically evaluate the effectiveness of attacks and
defenses from (full-precision) ANNs on (constrained) QNNs. Our evaluation
includes three QNNs targeting TinyML applications, ten attacks, and six
defenses. With this study, we draw a set of interesting findings. First,
quantization increases the point distance to the decision boundary and leads
the gradient estimated by some attacks to explode or vanish. Second,
quantization can act as a noise attenuator or amplifier, depending on the noise
magnitude, and causes gradient misalignment. Regarding adversarial defenses, we
conclude that input pre-processing defenses show impressive results on small
perturbations; however, they fall short as the perturbation increases. At the
same time, train-based defenses increase the average point distance to the
decision boundary, which holds after quantization. However, we argue that
train-based defenses still need to smooth the quantization-shift and gradient
misalignment phenomenons to counteract adversarial example transferability to
QNNs. All artifacts are open-sourced to enable independent validation of
results.

边缘计算和微控制器 (MCUs) 上的量化和对抗示例在深度边缘上的有效性进行了实证评估。量化增加了决策边界的点距离，并导致某些攻击估计的梯度爆炸或消失，同时量化能够增强或减弱噪声，导致梯度失调。尽管输入预处理防御在小扰动上效果显著，但在扰动增加时表现不佳，而基于训练的防御方法可以增加决策边界的平均点距，并且在量化后仍然有效，但我们认为基于训练的防御仍需解决量化偏移和梯度失调的问题以对抗对 QNNs 的敌对示例可迁移性。