Recently, there has been a lot of progress in reducing the computation of
deep models at inference time. These methods can reduce both the computational
needs and power usage of deep models. Some of these approaches adaptively scale
the compute based on the input instance. We show that such models can be
vulnerable to a universal adversarial patch attack, where the attacker
optimizes for a patch that when pasted on any image, can increase the compute
and power consumption of the model. We run experiments with three different
efficient vision transformer methods showing that in some cases, the attacker
can increase the computation to the maximum possible level by simply pasting a
patch that occupies only 8\% of the image area. We also show that a standard
adversarial training defense method can reduce some of the attack's success. We
believe adaptive efficient methods will be necessary for the future to lower
the power usage of deep models, so we hope our paper encourages the community
to study the robustness of these methods and develop better defense methods for
the proposed attack.

近期，在深度模型的推断计算方面取得了很多进展，这些方法可以减少深度模型的计算需求和功耗。我们展示了这些模型容易受到普适性对抗贴片攻击的影响，攻击者通过优化一个贴片，将其粘贴到任意图像上可以增加模型的计算量和功耗。我们运行实验使用了三种不同的高效视觉转换器方法，显示在某些情况下，攻击者只需将一个只占图像面积的 8% 的贴片粘贴上即可将计算量增加到最大限度。同时我们还展示了标准对抗性训练防御方法可以减少攻击的成功率。我们相信为降低深度模型的功耗，未来需要采用自适应高效的方法，希望我们的论文可以鼓励研究人员研究这些方法的强韧性，并开发更好的防御方法来对抗这种攻击。