Crafting Adversarial Images to Increase Inference Time of Object Detection Models on Edge Devices

Core Concepts

Latency attacks can significantly increase the inference time of object detection models, posing a serious threat to real-time applications running on edge devices with limited computing resources.

Abstract

The paper investigates a new type of attack called "latency attacks" on deep learning-based object detection models. The goal of latency attacks is to increase the inference time of the victim model, which can be critical for real-time applications running on edge devices with limited computing resources.
The authors first analyze the time complexity of the Non-Maximum Suppression (NMS) algorithm, a common post-processing step in object detection models. They find that the elapsed time of NMS is dominated by the total number of objects fed into it, rather than the number of surviving bounding boxes.
Based on this observation, the authors propose a framework called "Overload" to craft adversarial images that can significantly increase the inference time of object detection models. Overload uses a simplified objective function that focuses on maximizing the confidence of individual objects, without the need to track pairwise IoU scores or object areas. The authors also introduce a novel technique called "spatial attention" to enhance the effectiveness of the attack.
Experiments on the NVIDIA Jetson NX edge device using YOLOv5 models show that the inference time of the crafted adversarial images can be up to 10 times longer than that of the original images. The authors also demonstrate that their attack is NMS-agnostic, posing a potential threat to all object detection systems that rely on NMS.
The paper discusses the implications of latency attacks, including their potential use in Denial-of-Service (DoS) attacks and the impact on downstream tasks like collision avoidance systems. The authors also outline potential defense strategies, such as limiting the maximum execution time or the total number of objects fed into NMS.

Stats

The inference time of a single adversarial image can be up to 10 times longer than that of the original image on the NVIDIA Jetson NX edge device.
The proposed attack can generate over 20,000 ghost objects for most images, significantly increasing the number of objects fed into NMS.

Quotes

"The elapsed time of NMS is dominated by the total number of objects fed into it, rather than the number of surviving bounding boxes."
"Overload achieves superior attack performance while utilizing fewer computational costs and less memory compared to existing works."
"Our attack is NMS-agnostic, underscoring its potential to pose a universal threat to all object detection systems reliant on NMS."

Key Insights Distilled From

Overload: Latency Attacks on Object Detection for Edge Devices

by Erh-Chung Ch... at arxiv.org 04-25-2024

https://arxiv.org/pdf/2304.05370.pdf

Deeper Inquiries

How can the proposed latency attack be extended to work in a black-box setting, where the attacker has limited access to the victim model

In extending the proposed latency attack to a black-box setting, where the attacker has limited access to the victim model, several strategies can be considered. One approach could involve leveraging transfer attacks, where the attacker trains a surrogate model on a similar dataset to the victim model. By generating adversarial examples on the surrogate model and observing the impact on the inference time, the attacker can then transfer these perturbations to the victim model. This method allows for the creation of adversarial examples without direct access to the victim model's architecture or parameters.
Another strategy could involve exploring gradient-free optimization techniques, such as genetic algorithms or evolutionary strategies, to craft adversarial examples. By perturbing the input data and observing the resulting changes in inference time, the attacker can iteratively refine the perturbations to maximize the latency of the victim model. While these methods may require more computational resources and iterations compared to white-box attacks, they offer a viable approach for conducting latency attacks in a black-box setting.

What are the potential mitigation strategies that can be employed to make object detection models more resilient against latency attacks, beyond the approaches discussed in the paper

To enhance the resilience of object detection models against latency attacks, several mitigation strategies can be employed beyond the approaches discussed in the paper. One strategy is to implement robust timeout mechanisms that dynamically adjust the maximum execution time based on the complexity of the input data. By setting adaptive thresholds, models can prevent adversarial examples from excessively prolonging the inference time while ensuring that legitimate inputs are processed efficiently.
Another mitigation strategy involves incorporating anomaly detection techniques to identify and flag inputs that exhibit unusually high inference times. By monitoring the latency distribution of incoming requests, models can detect and mitigate the impact of latency attacks in real-time. Additionally, integrating redundancy and failover mechanisms can help mitigate the effects of prolonged inference times by rerouting requests to alternative resources when one component is under attack.
Furthermore, adversarial training can be employed to improve the robustness of object detection models against latency attacks. By augmenting the training data with adversarial examples that specifically target inference time, models can learn to recognize and mitigate the impact of such attacks during deployment. This proactive approach can help models better withstand latency attacks and maintain performance under adversarial conditions.

How might the insights from this work on latency attacks be applied to other types of deep learning models and applications beyond object detection, where the processing time is a critical factor

The insights from this work on latency attacks in object detection can be applied to other types of deep learning models and applications where processing time is a critical factor. For instance, in real-time video analysis applications such as action recognition or anomaly detection, minimizing inference time is essential for timely decision-making. By applying similar latency attack strategies to these models, attackers could disrupt the real-time processing capabilities of these systems, leading to delayed or incorrect responses.
Moreover, in natural language processing tasks such as sentiment analysis or machine translation, where timely responses are crucial, latency attacks could be used to introduce delays in processing text inputs. By crafting adversarial examples that increase the inference time of language models, attackers could disrupt the efficiency of these applications, impacting user experience and system performance.
Additionally, in autonomous systems like self-driving cars or drones, where quick and accurate object detection is vital for navigation and safety, latency attacks could pose significant risks. By targeting the object detection modules in these systems, attackers could introduce delays that hinder the ability to detect obstacles or make timely decisions, potentially leading to accidents or malfunctions. Therefore, the insights from this work can inform the development of defenses and mitigation strategies to safeguard a wide range of deep learning applications beyond object detection.