# Curved geometry and Graphs111Based on a talk given at Loops ’11, Madrid, on
24 May 2011.

Francesco Caravelli  Perimeter Institute for Theoretical Physics,
Waterloo, Ontario N2L 2Y5 Canada,
and
University of Waterloo, Waterloo, Ontario N2L 3G1, Canada,
and
Max Planck Institute for Gravitational Physics, Albert Einstein Institute,
Am Mühlenberg 1, Golm, D-14476 Golm, Germany<EMAIL_ADDRESS>
###### Abstract

Quantum Graphity is an approach to quantum gravity based on a background
independent formulation of condensed matter systems on graphs. We summarize
recent results obtained on the notion of emergent geometry from the point of
view of a particle hopping on the graph. We discuss the role of connectivity
in emergent Lorentzian perturbations in a curved background and the
Bose–Hubbard (BH) model defined on graphs with particular symmetries.

##  1 Introduction

The gravitational interaction may be an effective description of an underlying
theory which does not suffer from the well-known problems plaguing Einstein’s
gravity, as for instance perturbative non-renormalizability 222However, there
is still hope that gravity is non-perturbativly renormalizable. This is the
starting point of Asymptotic Safety and Loop Quantum Gravity[2, 3].. These
ideas are the starting point of Quantum Graphity [1]. The target per se is
understanding the emergence of gravity through model building of discrete
quantum systems. A similar approach is Analogue Models [4], although in the
continuum and considering Quantum Field Theory as the main tool. The
motivation for the introduction of simplified models for Quantum Gravity is
understanding the features of background independence in contexts in which not
all the obstructions typical of gravity are present and, in particular, better
understanding the phenomenon of emergence in background independent contexts.

The first Quantum Graphity model was introduced in [5, 6]. The basic
motivation in [5] was to construct a Hamiltonian on a Hilbert space associated
to the degrees of freedom of a graph (a set of nodes $V$ with cardinality
$\mathscr{N}$ and of links $\mathscr{E}$ of cardinality
$\mathscr{N}(\mathscr{N}-1)/2$) such that the ground state of the Hamiltonian
is a graph which has geometrical properties. The initial hope, in [5], was
that by fixing the parameters of the reduced model (the one with on/off
links), the ground state of the Hamiltonian would have been a graph of average
degree $d$ and with geometrical properties similar to simplicial
complexes333However the results obtained numerically in [6] suggested that the
low-energy structure of the graph is string-like: the ground state is a one of
a 1-dimensional object. This result is compatible with the mean field theory
analysis performed in the reduced model[7], in which the model was mapped to
an Ising-type Hamiltonian. This mapping allowed a straightforward use of the
mean field theory techniques well known from the study of Ising-type models,
after having identified the average degree of the graph as an order parameter.
In [8] a different Hamiltonian based on graphs and close in spirit to [5]
found, instead, a 2-dimensional complex in a low-energy phase. This last
result gives some hope that a generic mechanism to obtain low energy
$d$-dimensional simplicial complexes exists. .

A second model, which we now describe, was introduced in [9]. The main
motivation for the introduction of [9] was the interpretational issue of the
external bath (i.e. the temperature of the system): how can it be interpreted
in a closed system (i.e. the Universe)? The same problem arises in closed
quantum systems, where one could ask why thermalization is such a general
phenomenon despite the unitary time evolution on the Hilbert space. In general
the solution to the problem is strongly dependent on the observability of full
Hilbert space, i.e. what part of it should be traced out in order to observe
decoherence in the local observables. From this perspective, [9] is a
simplified model in which these questions can be answered in a background
independent context. While the graph degrees of freedom are the same as the
model introduced in [5], additional degrees of freedom associated to bosonic
particles with a Bose–Hubbard (BH) interaction are present. The result is a
dynamical graph with local interactions.

##  2 Matter coupling: a graph-dynamical Bose–Hubbard model

The model introduced in [9] and recently further studied in [10], focuses on
the study of interaction between matter (in the specific case, bosonic degrees
of freedom on the vertices of the graph) and the graph. The energy terms for
links and particles are of the form

$\widehat{H}_{0}=\sum_{i}\mu\
\widehat{a}^{\dagger}_{i}\widehat{a}_{i}+\sum_{ij}\nu\
\widehat{b}^{\dagger}_{ij}\widehat{b}_{ij},$ (1)

with $\widehat{a}_{i}$, $\widehat{b}_{ij}$ are hard core bosonic ladder
operators on the space of vertices and links respectively and $\mu$,$\nu$
coupling constants. There are two other terms, namely a BH interaction,

$\widehat{H}_{BH}=-E\sum_{ij}(\widehat{a}^{\dagger}_{i}\widehat{a}_{j}+h.c.)\otimes\widehat{P}_{ij},$
(2)

where $\widehat{P}_{ij}$ is a projector on the on links $ij$, and an
interaction between the bosonic particles and the links,

$\widehat{H}_{int}=-E\sum_{ij}\widehat{P}^{L}_{ij}(\widehat{a}^{\dagger}_{i}\widehat{a}^{\dagger}_{j}\otimes\widehat{b}_{ij}+h.c.).$
(3)

$\widehat{P}^{L}_{ij}$ is a nonlocal projector which annihilates graph states
unless the link $ij$ is not on a triangle. This keeps the dynamics local.
Thermalization. Simulations[9] showed that, in the long time regime, the
classical model evolves into random graphs. In the quantum case, instead, the
damping of oscillations of graphs observables, e.g. the degree of the graph,
indicates that the model thermalizes to a metastable state. We studied the
case of a 4-vertices graph with a link turned off and the others on. We
observed dumping for the vertex degree observables. For the studied case, the
asymptotic state turned out to be a mixed state of the graph with the link
turned on and the link turned off.

##  3 Graphs and curved geometry

Trapped surfaces. An interesting feature of this model, first noticed in [9],
is that regions of high connectivity are able to trap particles of low energy.
This was studied in detail in [10] on a fixed graph. The graph chosen is the
one of Fig. 1LABEL:sub@2dkn, which has a rotational symmetry: single particle
states can be labeled by two quantum numbers, the shell position $n$ and the
internal position, $\theta$, thus states of the form $|i,\theta\rangle$. In
this case, the problem can be simplified by noticing that the Hamiltonian is
diagonal in blocks of constant angular momentum. We can thus introduce, in the
1-particle sector, the _delocalized_ states, defined as:

$|n\rangle=\frac{1}{\sqrt{K_{n}}}\sum_{\theta=1}^{K_{n}}|n,\theta\rangle,$ (4)

where $K_{n}$ is the number of sites inside a shell $n$ (see Fig.
1LABEL:sub@2dnt) The full quantum evolution of a delocalized state can be
_fully_ reduced to a 1-dimensional BH model if the initial state is
delocalized, where the coefficients of the Hamiltonian are opportunely chosen.
This allowed to prove that the ground state, for the graph in Fig.
1LABEL:sub@2dkn, is $|n=0\rangle$.

In fact, this reduction showed that particles inside the highly connected
central region of Fig. 1a feel a potential which is proportional to the
degree. In particular, between particle states inside the central region and
the outside regions there is an energy gap proportional the relative degree.
This prevents low energy particles from escaping the trap, thus confirming the
argument of [9].
Emergent curved space. Another interesting finding of [10] is that, in the
reduced models, expectation values of number operators on the graph exhibit an
emergent Lorentz symmetry. The reduced effective 1-dimensional BH Hamiltonian,
for a generic rotationally invariant graph, takes the form,

$\widehat{H}_{BH}=-\sum_{i}f_{i\
i-1}(\widehat{b}^{\dagger}_{i}\widehat{b}_{i-1}+h.c.),$ (5)

with $f_{ij}=d_{ij}E$ and $d_{ij}$ is the relative degree between the shell
$i$ and the shell $j$, $\widehat{b}^{\dagger}_{i}$,$\widehat{b}_{i}$ is a
symmetry reduced ladder operators. The idea then is to study the following
expectation values (e.v.)
$\langle\widehat{b}^{\dagger}_{i}\widehat{b}_{i}\rangle=\Psi_{i}(t)$. The
interesting result is that these e.v. satisfy the following (closed) relation
on the manifold of classical states:

$\displaystyle\frac{\hbar^{2}}{2}\partial_{t}^{2}\Psi_{n}(t)=$ $\displaystyle
f_{n-1,n}^{2}\left(\Psi_{n+1}(t)+\Psi_{n-1}(t)-2\Psi_{n}(t)\right)$
$\displaystyle+\left(f_{n+1,n}^{2}-f_{n-1,n}^{2}\right)\left(\Psi_{n+1}(t)-\Psi_{n}(t)\right).$
(6)

This fully describes the time evolution of the probability density. In the
continuum limit, eqn. (6) becomes

$\Big{[}\partial_{t}^{2}-\partial_{x}\Big{(}n(x)\partial_{x}\Big{)}\Big{]}\Psi(x,t)=0,$

so it has a site-dependent speed of propagation for the density. This equation
is everywhere locally Lorentz-invariant, with a local speed of propagation
given by $c_{x}=1/\sqrt{n(x)}$. The higher-dimensional version of this
equation is known to be related to the Gordon background[4]. In fact, there is
no obstruction to repeating the same procedure for graphs which can be
foliated in more than one dimension. Thus, curved space is encoded in the
connectivity of the graph (i.e. the local degree).

(a) The $\mathscr{K}_{N}$ configuration.

(b) A non-trivial graph in which the coupling constants of the 1d-reduced
model are site-dependent.

Figure 1: Two graphs on which the wavefunction can be symmetry-reduced.

##  4 Conclusions

The emergence of gravity in a background independent contexts is a complete
new research direction within the field of Analogue Models. In the case of
graph-based models as ours it is not always obvious what are the right
questions to ask. Indeed, we have shown in [10] that by focusing on a
particular set of graphs and by asking the right question, “How does the
particle probability density evolve?”, the phenomenon of emergence (in our
case of a Lorentz symmetry) can be identified. This happens because the graph
we considered can be foliated, and then the states classified, according to
this foliation. More recently, the same technique has been used to study the
effects of disordered locality on the Lorentz symmetry, showing that a mass
term appears [11]. We have identified graph configurations which, in a
appropriate limit, can be considered as trapping surfaces. By considering
delocalized states (i.e. symmetry-reduced wavefunctions), we showed that high
connectivity implies a high energy gap between particles being inside the
region or outside.

It is not clear, at this point, how general these models are and how many of
the emergent phenomena of Analogue Models can be reproduced. We believe that
many interesting questions related to background independence (and emergent
gravity [12]) can be addressed in such simplified models. The full connection
between a graph and the low energy manifold associated to it is an open
problem to address. It is tempting, given the large literature on Regge
calculus, to associate a simplicial complex to the graph when possible. On the
other hand, it may be more physical to require that only the scaling
properties - for instance looking at the Heat Kernel of the Laplacian of the
graph[13]\- match those of manifolds of a specific dimension.

Aknowledgements

We would like to thank A. Hamma, F. Markopoulou and A. Riera for several
stimulating discussions and for the collaboration in the main work that we
summarized here. Also, we thank L. Sindoni for many fruitful conversations
about emergent gravity. Research at Perimeter Institute is supported by the
Government of Canada through Industry Canada and by the Province of Ontario
through the Ministry of Research & Innovation.

## References

  * [1] F. Markopoulou, A. Hamma, New J. Phys. 13:095006 (2011) [arXiv:1011.5754]
  * [2] C. Rovelli, (Lectures given at Zakopane 2011) [arXiv:1102.3660]
  * [3] M. Reuter, F. Saueressig, (Lectures given at Zakopane 2007) [arXiv:0708.1317v1]
  * [4] C. Barcelo, S. Liberati, M. Visser, Living Rev. Rel. 8 12 (2005) [arXiv:gr-qc/0505065]
  * [5] T. Konopka, F. Markopoulou, L. Smolin, [arXiv:hep-th/0611197]; T. Konopka, F. Markopoulou, S. Severini, Phys. Rev. D 77, 104029 (2008) [arXiv:0801.0861]
  * [6] T. Konopka, Phys. Rev. D 78,044032 (2008) [arXiv:0805.2283]
  * [7] F. Caravelli, F. Markopoulou, Phys. Rev. D 84, 024002 (2011), [arXiv:1008.1340]
  * [8] F. Conrady, J. Statist. Phys. 142:898 (2011) [arXiv:1009.3195]
  * [9] A. Hamma, F. Markopoulou, S. Lloyd, F. Caravelli, S. Severini, K. Markstrom, Phys. Rev. D 81, 104032 (2010) [arXiv:0911.5075]
  * [10] F. Caravelli, A. Hamma, F. Markopoulou, A. Riera, Phys. Rev. D 85, 044046 (2012) [arXiv:1108.2013]
  * [11] F. Caravelli, F. Markopoulou, [arXiv:1201.3206]
  * [12] L. Sindoni, Contribution to SIGMA Special Issue ”Loop Quantum Gravity and Cosmology” (to appear) [arXiv:1110.0686]
  * [13] T. Filk, Class.Quant.Grav.17:4841-4854 (2000) [arXiv:hep-th/0010126]


# Towards Sustainable SecureML: Quantifying Carbon Footprint of Adversarial
Machine Learning

Syed Mhamudul Hasan1,2, Abdur R. Shahid1,2, Ahmed Imteaj1 1School of
Computing, Southern Illinois University, Carbondale, IL, USA
2Secure and Trustworthy Intelligent Systems (SHIELD) Lab
<EMAIL_ADDRESS><EMAIL_ADDRESS><EMAIL_ADDRESS>
###### Abstract

The widespread adoption of machine learning (ML) across various industries has
raised sustainability concerns due to its substantial energy usage and carbon
emissions. This issue becomes more pressing in adversarial ML, which focuses
on enhancing model security against different network-based attacks.
Implementing defenses in ML systems often necessitates additional
computational resources and network security measures, exacerbating their
environmental impacts. In this paper, we pioneer the first investigation into
adversarial ML’s carbon footprint, providing empirical evidence connecting
greater model robustness to higher emissions. Addressing the critical need to
quantify this trade-off, we introduce the Robustness Carbon Trade-off Index
(RCTI). This novel metric, inspired by economic elasticity principles,
captures the sensitivity of carbon emissions to changes in adversarial
robustness. We demonstrate the RCTI through an experiment involving evasion
attacks, analyzing the interplay between robustness against attacks,
performance, and carbon emissions.

###### Index Terms:

Adversarial Machine Learning, Carbon Emission, Sustainability, Artificial
Intelligence (AI)

##  I Introduction

In recent years, the rapid evolution of ML has expanded beyond the tech
industry, affecting diverse sectors and heralding a new era of AI-driven
innovation. However, the widespread adoption of ML raises environmental
concerns due to their significant energy consumption and associated carbon
emissions[1, 2]. For instance, training a single advanced language model can
emit carbon equivalent to 125 round-trip flights between New York and
Beijing[1]. The Information and Communication Technology (ICT) industry,
integral to AI, is projected to account for 14% of global emissions[3],
emphasizing the urgent need to address ML’s environmental impact.

Figure 1: Sustainable SecureML: (Adversarial ML landscape) (a) An ML model
lifecycle when dealing with data sources hosted on untrusted networks, (b) a
classification of the adversarial attacks related to the ML lifecycle phases,
(c) various defense mechanisms to defend against adversarial attacks, (d) an
illustration of the attacks and their defenses, demonstrating the dynamic
interplay of attack and defense tactics in untrusted network settings (figure
credit: ART Toolbox[4]), and (e) the scope of our work: the intersection of
ML, cybersecurity, and environmental sustainability.

This research gap is particularly evident in adversarial ML — a domain at the
intersection of ML and cybersecurity. Adversarial ML investigates the
vulnerabilities of ML systems, crafts attack techniques for exploitation by
malicious entities through trusted and untrusted networks, and develops
defenses to enhance system resilience. Studies reveal how attackers can
manipulate vulnerabilities in various ML phases, launching attacks to degrade
model performance or inducing erroneous inferences, as illustrated in figure
1. An attacker might utilize the network to execute different vulnerable or,
sometimes, robust systems with zero-day vulnerabilities. As most systems need
networks to communicate with each other, there might be some data alteration
when data is transmitted, especially in the data collection phase. Moreover,
in the data collection phase, the data can be collected from some adversarial
source where the attacker intentionally sends some fake or crafted data to the
training of the ML model.

To counter these attacks, several mechanisms have been explored to enhance the
security of the ML systems, which often involve ML models designed to discern
benign from malignant inputs. Consequently, the implementation of additional
security-related computations throughout the lifecycle of adversarial ML leads
to more carbon emissions. Given the direct correlation between computation and
emissions, adversaries might intentionally craft attacks to escalate
computational demands, further exacerbating carbon emissions. This situation
underscores the urgent need to integrate environmental considerations into the
development of secure ML systems, a responsibility that falls on researchers,
practitioners, and policymakers alike.

#### Our Contributions

This paper is the first to investigate the carbon footprint of adversarial ML
systems, exploring the relationship between model robustness, environmental
impact, and adversarial attacks. Central to our study is the correlation
between adversarial robustness and carbon emissions, providing insights into
the environmental cost of achieving a robust ML model. We use the concept of
point elasticity from economics, which examines how a specific price change
affects demand [5]. Our contributions are as follows:

  * •

We pioneer the first work to study the carbon footprint of adversarial ML
systems. Our study provides empirical evidence of a direct relationship
between the robustness of an adversarial ML model and its associated carbon
emissions, illustrating a crucial environmental dimension in secure and robust
ML system design.

  * •

We propose the Robustness-Carbon Trade-off Index (RCTI), an innovative metric
inspired by the well-established economic principle of point elasticity. By
using a customized index, the RCTI effectively measures the relationship
between a model’s carbon footprint and its ability to withstand attacks from
other models by suggesting the optimal improvement of resilience based on
specific needs and ML model resilience.

##  II Related Work

###  II-A Sustainable and Green ML

Machine Learning (ML) models are highly sensitive to computational demands in
terms of resources like CPUs, GPUs, and RAM, leading to increased carbon
emissions. This environmental concern extends across various ML paradigms. For
instance, LLMs require substantial computational power for training and
testing, contributing to high carbon emissions [1][6]. Generative AI, which
expands on LLM capabilities to create diverse contents, further intensifies
this computational demand and associated carbon footprint [7]. In response,
the concepts of sustainable AI and green AI have emerged to make AI
computations more environmentally friendly by minimizing computational
demands. This approach becomes especially pertinent as data centers
significantly contribute to carbon emissions in the need for sustainable AI
hardware and energy-efficient ML models [8]. Green AI, focusing on reduced
computational costs, further contributes to sustainability, mitigating the
environmental impact of ML training and testing [9].

However, quantifying the carbon footprint of ML systems is an ongoing
challenge. Recent research efforts have aimed to assess ML systems’ carbon
emissions, considering factors like computational resources, data center
efficiency, energy sources, model complexity, and operational efficiency [2,
10, 11, 12, 13]. A sustainable approach to ML, therefore, involves balancing
robust model performance with minimal environmental impact.

###  II-B Adversarial Attack on ML

Adversarial attacks in machine learning can be categorized based on their
operational phases (figure 1). Adversaries utilize various sophisticated
techniques to execute these attacks, including data poisoning [14], gradient-
based attacks [15], and especially evasion attacks [16]. To counter these
attacks, several mechanisms have been explored, including differential privacy
[17], federated learning [18], cryptographic techniques [19] and adversarial
training [20].

Evasion attacks, the center of our experiment in this paper, are especially
concerning in applications where security and reliability are paramount. Two
notable methods of evasion attacks are the Fast Gradient Sign Method (FGSM)
and the Projected Gradient Descent (PGD). FGSM works by exploiting the
gradients of the loss function with respect to the input data. It perturbs the
input data in the direction of these gradients, resulting in notable changes
in the model’s output. FGSM’s simplicity and speed make it a popular choice
for demonstrating the vulnerability of neural networks to adversarial attacks.
On the other hand, PGD is considered a more powerful and iterative version of
FGSM. It involves applying multiple small gradient updates and projecting
these updates back into the allowable input space, if necessary. Adversarial
training [21] is one key method for countering evasion attacks in ML. This
approach involves intentionally generating adversarial examples and including
them in the training set. By doing so, the model learns to recognize and
correctly classify not only the regular input data but also these
adversarially perturbed inputs.

As far as our research indicates, there is no prior work that dealt with the
carbon emissions of adversarial ML. This study represents the first attempt to
assess the environmental implications of the robustness of an adversarial ML
model.

##  III Methodology: Measuring Robustness- Carbon Trade-off Index of
Adversarial ML

###  III-A Design Goal

Our objective is to develop a universal and dynamically adaptable metric for
adversarial ML models, emphasizing eco-friendliness and versatility across
various ML techniques. The key design goals of this metric are:

  * •

Robustness Adjustable Adversarial ML Metric: This metric is adjustable to the
different ML systems, allowing tuning the balance between robustness in
adversarial models and their carbon footprint. This feature enables
quantification based on the different attack parameters and environmental
factors, in our case, carbon emissions, ensuring a customized approach to
sustainability in ML.

  * •

Adaptable Framework Across ML Techniques: This framework offers an adaptable
applicability to a wide spectrum of ML settings and techniques used in
adversarial model training, such as Transfer Learning, Reinforcement Learning,
Federated Learning, and Generative AI, facilitating the quantification and
fulfillment of sustainability objectives.

###  III-B An Economic Approach to Quantify The Robustness and Carbon Emission
Trade-Off

The concept of measuring carbon emissions in adversarial machine learning (ML)
presented in this paper is consistent with existing methods used for
quantifying the environmental impact of ML models. We define a model’s carbon
emissions as a function of the system’s overall energy consumption and carbon
intensity, as outlined in prior research [1, 22, 23]. Let $C$ be the carbon
intensity of the electricity consumed for computation, expressed in grams of
$\text{CO}_{2}$ per kilowatt-hour (g/kWh), and $E$ be the energy consumed by
the computational infrastructure to train and test a model, expressed in
kilowatt-hours (kWh). Then, the total carbon emissions ($\mathcal{C}$) can be
expressed in grams of $\text{CO}_{2}$:

$\mathcal{C}=C\times E\text{ grams}$

Moving forward, we explore the link between adversarial robustness and carbon
footprint in adversarial ML models, which are designed to counter specific
attacks with a attack parameter $\epsilon$, reflecting the balance between the
model’s resilience to attacks and its functional utility. Adversarial ML aims
to optimize both model performance and robustness, a goal that introduces a
complex trade-off. Operational factors in this optimization may inadvertently
increase carbon emissions, thereby having an environmental impact.

A baseline model is defined as performing ML tasks without any adversarial
training. Figure 2 shows our baseline model architecture, where we use a
convolutional neural network (CNN) to classify the MNIST dataset. Assuming the
adversarial model exhibits particular performance metrics with respect to
attack parameter $\epsilon$, we can define some important properties for model
$\mathcal{M}$:

  * •

$P_{i}(\epsilon_{i})$ : Performance of the model at arbitrary $\epsilon_{i}$

  * •

$\mathcal{C}_{i}(\mathcal{M}_{i})$: Carbon emission of the model
$\mathcal{M}_{i}$

  * •

$\mathcal{R}_{i}(\epsilon_{i})$: Robustness, given the attack parameter
$\epsilon_{i}$

Considering a baseline model, $\mathcal{M}_{base}$, achieving a certain
performance level, $P_{base}$, under baseline carbon emission,
$\mathcal{C}_{base}$. Due to the vulnerability of adversarial
perturbations—either introduced during training (poisoning) or testing
(evasion) phases—this performance of the model $\mathcal{M}_{i}$ can
drastically diminish to $P_{i}(\epsilon_{i})$, with a corresponding carbon
emission of $\mathcal{C}_{i}(\mathcal{M}_{i})$. Our aim is to engineer an
adversarial model $\mathcal{M}_{i}$ that not only enhances resilience against
such attacks but also reduces environmental carbon footprints.

We quantify the robustness of $\mathcal{M}_{i}$ with a certain attack
parameter $\epsilon_{i}$ as a relative improvement or degradation compared to
the baseline performance as:

$\Delta\mathcal{R}_{i}(\epsilon_{i})=\frac{P_{i}(\epsilon_{i})-P_{base}}{P_{base}}\vspace{-5pt}$
(1)

Where a positive $\Delta\mathcal{R}_{i}(\epsilon_{i})$ means model
$\mathcal{M}_{i}$ outperforms the baseline, while
$\Delta\mathcal{R}_{i}(\epsilon_{i})=0$ indicates equivalent performance, and
a negative value suggests model $\mathcal{M}_{i}$ underperforms compared to
the baseline.

TABLE I: Elasticity of Robustness Corresponding to RCTI of an Adversarial Model Elasticity of Robustness |  $RCTI$ |  Explanation
---|---|---
Eco-Critical |  very high or $\infty$ |  Even a minimal improvement in robustness causes a massive increase in carbon emissions.
Eco-Costly |  $>1$ |  For a given change in robustness, there is a large change in carbon emissions.
Eco-Neutral |  $=1$ |  The trade-off between robustness and carbon emissions is balanced.
Eco-Efficient |  $<1$ |  Robustness can be improved with a minimal increase in carbon emissions.
Eco-Ideal |  $=0$ |  Robustness can be improved without any increase in carbon emissions!

Similarly, we can define the relative change in the carbon emission of
$\mathcal{M}_{i}$ compared to the baseline $\mathcal{C}_{base}$ as follows:

$\Delta\mathcal{C}_{i}(\mathcal{M}_{i})=\frac{\mathcal{C}_{i}(\mathcal{M}_{i})-\mathcal{C}_{base}}{\mathcal{C}_{base}}$
(2)

Where, a positive $\Delta\mathcal{C}_{i}(\mathcal{M}_{i})$ denotes a carbon
emission level that exceeds the baseline. Conversely, a negative
$\Delta\mathcal{C}_{i}(\mathcal{M}_{i})$ indicates that emissions are lower
than the baseline. When $\Delta\mathcal{C}_{i}(\mathcal{M}_{i})$ is zero, it
signifies that the emissions are on par with the baseline.

Data: Architectures for baseline model and $n$ adversarial robust models,
attack parameter $\\{\epsilon_{1},\ldots\epsilon_{n}\\}$

Result: List of adversarial robust models with robustness, and carbon
emissions, and RCTI values

1

2$\mathcal{M}\leftarrow\emptyset$: Initialize list for model data

3$(M_{base},P_{base},\mathcal{C}_{base})\leftarrow$ Train baseline model,
measure its performance (e.g., accuracy), and calculate baseline carbon
emissions

4for  _$i\in 1\ldots n$_ do

5 $(M_{i},P_{i}(\epsilon_{i}),\mathcal{C}_{i}(\mathcal{M}_{i})\leftarrow$
Train the adversarial robust $i$-the model with $\epsilon_{i}$, and measure
its performance and emissions

6
$\Delta\mathcal{R}_{i}(\epsilon_{i})\leftarrow\frac{P_{i}(\epsilon_{i})-P_{base}}{P_{base}}$:
Calculate robustness

7
$\Delta\mathcal{C}_{i}(\mathcal{M}_{i})\leftarrow\frac{\mathcal{C}_{i}(\mathcal{M}_{i})-\mathcal{C}_{base}}{\mathcal{C}_{base}}$:
Measure the relative carbon emissions

8
$RCTI_{i}(\mathcal{M}_{i},\epsilon_{i})\leftarrow\left|\frac{\Delta\mathcal{C}_{i}(\mathcal{M}_{i})}{\Delta\mathcal{R}_{i}(\epsilon_{i})}\right|$:
Calculate Robustness-Carbon Trade-Off Index

9
$\mathcal{M}\leftarrow\mathcal{M}\cup(M_{i},RTCI_{i}(\mathcal{M}_{i},\epsilon_{i}),\Delta\mathcal{R}_{i}(\epsilon_{i}),\Delta\mathcal{C}_{i}(\mathcal{M}_{i}))$

10 end for

11

Return $\mathcal{M}$

Algorithm 1 Process of Measuring RCTI

By utilizing these two metrics for robustness and relative carbon emissions of
an adversarial model, we quantify the relationship between adversarial
robustness and carbon footprint to interpret how increasing robustness affects
carbon emissions. To encapsulate this relationship, we employ a concept
analogous to point elasticity—a method extensively utilized in economics to
evaluate how the quantity demanded of a commodity responds to a price change
at a particular point on its demand curve [5]. By adapting this approach to
our context, we introduce the Robustness-Carbon Trade-off Index ($RCTI$). This
index is a novel metric that quantifies the trade-off between enhancing a
model’s robustness and its resultant carbon emissions. For an adversarial
model $\mathcal{M}_{i}$, the $RCTI$ is defined as the ratio of the relative
change in carbon emissions to the change in model robustness. Formally, it can
be expressed as follows:

$RCTI_{i}(\mathcal{M}_{i},\epsilon_{i})=\left|\frac{\Delta\mathcal{C}_{i}(\mathcal{M}_{i})}{\Delta\mathcal{R}_{i}(\epsilon_{i})}\right|$
(3)

This ratio effectively captures the sensitivity of carbon emissions to
alterations in model robustness. This concept of RCTI of an adversarial robust
ML model $\mathcal{M}$ and attack parameter $\epsilon$ mirrors economic
elasticity robustness elasticity relative to carbon emissions, as outlined in
table I.

We define five main categories of robustness: Eco-Critical, Eco-Costly, Eco-
Neutral, Eco-Efficient, and Eco-Ideal, based on how each unit of change in
RCTI value impacts mentioned in Table I. While Eco-Ideal robustness is indeed
the most desirable yet often impractical, practically, an approach would aim
to find a model with eco-efficient robustness in which robustness can be
improved with a minimal increase in carbon emissions. The Algorithm 1 shows
the process of selecting the most effective model that balances robustness
with environmental sustainability and calculates robustness, carbon emissions,
and RCTI for various adversarial models.

##  IV Experiment and Analysis

###  IV-A Experimental Setup

####  IV-A1 Environment and Dataset

Figure 2: MNIST baseline and adversarial classifier model architecture

In our experiment, we utilize Codecarbon, a Python library for quantifying
carbon emissions based on metrics like CPU, RAM, GPU usage, carbon emissions,
etc. [22], and the Adversarial Robustness Toolbox (ART), a widely-used Python
framework for adversarial ML model implementation [4]. We conducted the
experiment on an Intel (R) Xeon (R) CPU at 2.20 GHz, 12.67834 GB of RAM,
Google Colab’s Linux 5.15.120, and no GPU, which is located in South Carolina,
USA. To demonstrate our hypothesis on carbon emissions, we selected
adversarial training with MNIST dataset.

####  IV-A2 Baseline and Adversarial Model Training

Figure 2 illustrates the architecture of the baseline and adversarial models.
Initially, we we train a model without any adversarial input to establish the
baseline. Subsequently, we train adversarial robust models with a varying
proportion of adversarial samples. These models are different from the
baseline model as they employ optimized loss functions designed for quicker
convergence to local minima. We implement evasion attacks using the Fast
Gradient (FG) and Projected Gradient Descent (PGD) methods, which we described
in detail in the related work. In the ART implementation of FG and PGD, the
hyperparameter $\epsilon$ is used to control the perturbation of the
adversarial sample generation to train an adversarial robust model as well as
the attack. In other words, the higher the value of $\epsilon$, the stronger
the attack. We consider the $\epsilon$ range of one percent ($0.01$) to fifty
percent ($0.50$) to generate different perturbations. A tracker is used to
track the emissions from the various stages ($\epsilon$) of these two methods.
The source code for training the baseline and robust models, including their
architectures, as well as for conducting evasion attacks and adversarial
training, is available on GitHub [24].

TABLE II: Statistics on the Hardware and Software Aspects of Baseline and Adversarial Robust Models Under Evasion Attacks Attacks | Model | $\epsilon$ |  CPUenergy |  Ramenergy |  Totalenergy |  Accuracy (%) |  Duration |  Emission
---|---|---|---|---|---|---|---|---
Fast Gradient (FG) |  Baseline | 0 |  0.000032 |  3.65E-06 |  3.63E-05 |  98.42 |  2.773725 |  3.74E-06
0.1 |  0.000302 |  3.38E-05 |  3.36E-04 |  83.70 |  25.59460 |  9.59E-05
0.2 |  0.000495 |  5.54E-05 |  5.51E-04 |  30.31 |  41.97932 |  0.000157
0.3 |  0.000688 |  7.69E-05 |  7.65E-04 |  3.51 |  58.32820 |  0.000218
0.4 |  0.000885 |  9.90E-05 |  9.84E-04 |  0.46 |  75.03156 |  0.000281
0.5 |  0.001082 |  0.000121 |  0.001203 |  0.31 |  91.71211 |  0.000343
Robust | 0 |  2.76E-05 |  3.08E-06 |  3.08E-06 |  97.36 |  2.340474 |  8.75E-06
0.1 |  0.000433 |  4.84E-05 |  4.84E-05 |  95.06 |  36.66551 |  0.000137
0.2 |  0.000700 |  7.83E-05 |  7.83E-05 |  91.74 |  59.35047 |  0.000222
0.3 |  0.000994 |  0.000111 |  0.000111 |  86.88 |  84.23761 |  0.000316
0.4 |  0.001304 |  0.000146 |  0.000146 |  40.16 |  110.4968 |  0.000414
0.5 |  0.001572 |  0.000176 |  0.000176 |  13.83 |  133.1732 |  0.000499
Proj. Gradient Descent (PGD) |  Baseline | 0 |  0.000108 |  1.20E-05 |  1.20E-04 |  97.88 |  2.773725 |  3.42E-05
0.1 |  0.000394 |  4.41E-05 |  4.38E-04 |  78.00 |  33.42132 |  0.000125
0.2 |  0.000594 |  6.64E-05 |  6.60E-04 |  7.00 |  50.33107 |  0.000188
0.3 |  0.000817 |  9.13E-05 |  0.000908 |  1.00 |  69.24905 |  0.000259
0.4 |  0.001032 |  0.000115 |  0.001148 |  0 |  87.48648 |  0.000328
0.5 |  0.001256 |  0.000140 |  0.001397 |  0 |  106.4692 |  0.000399
Robust | 0 |  2.76E-05 |  3.08E-06 |  3.08E-06 |  97.36 |  2.340474 |  8.75E-06
0.1 |  0.000444 |  4.96E-05 |  0.000493 |  98.00 |  37.61262 |  0.000141
0.2 |  0.000763 |  8.53E-05 |  0.000848 |  92.00 |  64.67232 |  0.000242
0.3 |  0.001061 |  0.000119 |  0.00118 |  87.00 |  89.92401 |  0.000337
0.4 |  0.001377 |  0.000154 |  0.001531 |  2.00 |  116.6996 |  0.000437
0.5 |  0.001699 |  0.000190 |  0.001889 |  0 |  143.9541 |  0.000539
Energy = kWh, Duration = Second, Emission = gCO2/kWh
⋆The cell color intensity visually approximately reflects the values.

###  IV-B Analysis of Energy, Accuracy, Time Consumption, and Emissions Under
Attacks

We provide a thorough analysis of the performance of the different machine
learning models under adversarial attack scenarios in terms of energy
consumption, accuracy, duration, and emissions.

####  IV-B1 Energy consumption

In both attack scenarios, the adversarial robust models consume more energy
compared to the baseline models, which is expected as robust models often
require more computational resources to resist attacks. For both robustly
trained models, the energy increases approximately ten times with the increase
of $\epsilon$. The more we add the perturbation, the more energy is needed to
train the model, thus increasing the training energy requirement, as shown in
the table II.

####  IV-B2 Accuracy

With the increase in the $\epsilon$, the accuracy of the baseline model seems
to be decreasing drastically. It holds true for robust models as well, but
they are less susceptible to accuracy droppage than baseline models to a
certain extent. On the table II, the accuracy of the robust classifier of PGD
at $\epsilon$ = 0.5 is zero. It is justifiable because when the perturbation
of data is equal to or greater than the original sample, the ML model cannot
function properly. That signifies a boundary in adversarial training. Focusing
on the accuracy metrics, we note different impacts across different attack
types. For the FG, the robust model maintains higher accuracy compared to the
baseline as the attack strength increases. Similarly, in FG, the robust model
has an accuracy of 95.06% at $\epsilon=0.1$. Furthermore, the baseline model
at $\epsilon=0$ maintains a high accuracy of 98.42%, which drops significantly
as the attack strength increases. The robust model starts with a lower
accuracy of 97.36% at $\epsilon=0$ but maintains higher accuracy as the attack
strength increases compared to the baseline. In both scenarios, similar
behavior with an increasing level of attack parameter, $\epsilon$, correlates
with increased carbon emissions from the models. This underscores a
fundamental trade-off between model robustness and operational efficiency,
requiring a more detailed exploration, which we presented in the subsequent
analysis.

TABLE III: Robustness and Carbon Emissions Trade-Off Attacks |  $\epsilon$ |  $\Delta\mathcal{R}(\epsilon)$ |  $\Delta\mathcal{C}(\mathcal{M})$ |  $RCTI(\mathcal{M},\epsilon)$ |  Elasticity of Robustness
---|---|---|---|---|---
FG |  0 |  -0.01077 |  -1.59E-01 |  14.73085 |  Eco-Costly
0.1 |  0.13570 |  4.29E-01 |  3.15769 |  Eco-Costly
0.2 |  2.02672 |  0.41401 |  0.20427 |  Eco-Efficient
0.3 |  23.7521 |  0.44954 |  0.01892 |  Eco-Efficient
0.4 |  86.3043 |  0.473309 |  0.005484 |  Eco-Efficient
0.5 |  43.6129 |  0.454810 |  0.010428 |  Eco-Efficient
PGD |  0 |  -0.01077 |  -1.59E-01 |  14.73085 |  Eco-Costly
0.1 |  0.25641 |  0.128 |  0.49921 |  Eco-Efficient
0.2 |  12.14285 |  0.28723 |  0.02365 |  Eco-Efficient
0.3 |  86 |  0.301158 |  0.00350 |  Eco-Efficient
0.4 |  $\infty$ |  0.00043 |  $\infty$ |  Eco-Critical
0.5 |  $\infty$ |  0.00053 |  $\infty$ |  Eco-Critical

####  IV-B3 Time Consumption

When considering the computational efficiency aspect of model performance,
adversarial attacks introduce a significant computational burden. For both
baseline and robust models, the duration drastically increases with the
presence of adversarial samples in the dataset. For instance, in the case of
the baseline model, for $\epsilon=0.1$, the computation time was 25.59460
seconds compared to its value of 2.773725 seconds for $\epsilon=0$ (without
any adversarial samples in the dataset). A similar trend is observed for the
robust models. This is concerning, as adversaries might take advantage of this
vulnerability to dismantle time-critical ML systems.

####  IV-B4 Emission

The total emissions, with the increase of $\epsilon$ in adversarial training,
are also increasing, which is evident in the table II. As it takes more
computation with the increase in the perturbation parameter, we propose a
correlation between robustness and emission in the adversarial machine
learning domain and provide a holistic analysis of the RCTI metric in the
subsequent section.

###  IV-C Analysis of Robustness and Carbon Emission Trade-Off (RCTI) Under
Attacks

Figure 3: Robustness of adversarial models under $\epsilon$-based different
evasion attacks with (left) Fast Gradient (FG) and (right) Projected Gradient
Descent (PGD). For PGD, $\Delta\mathcal{R}(\epsilon)$ was set to 0 in case of
$\epsilon=0.4$ and $0.5$ for visualization purpose. Their original values were
$\infty$ as shown in table III Figure 4: Carbon emission ($\Delta\mathcal{C}$)
under $\epsilon$-based different evasion attacks with (left) Fast Gradient
(FG) and (right) Projected Gradient Descent (PGD)  Figure 5: RCTI (Robustness-
Carbon Trade-off Index) of (left) Fast Gradient (FG) and (right) Projected
Gradient Descent (PGD) under different $\epsilon$. For PGD, $RCTI$ was set to
0 in case of $\epsilon=0.4$ and $0.5$ for visualization purpose. Their
original values were $\infty$ as shown in table III.

Using the values extracted for both baseline and adversarial robust models, we
next analyze the trade-off between robustness and adversarial attacks and the
associated carbon emissions in table III, and figures 3, 4, and 5. The initial
insight from these results is that for both kinds of attacks, an increase in
the perturbation $\epsilon$ correlates with heightened robustness $\Delta
R(\epsilon)$, indicating the enhanced resilience of adversarial robust models
over their baseline counterparts under evasion attacks. However, after some
improvement, the robustness starts to decrease (figure 3). Specifically, in
the case of a PGD attack, the robustness becomes $\infty$ when $\epsilon$ is
0.4 or above, coinciding with the point where the accuracy of an adversarial
model regresses to zero. This is a foreseeable outcome, as with so much noisy
data, a model naturally finds it increasingly difficult to generalize over the
data, adversely impacting accuracy.

We observe a similar trend in the relative change in carbon emissions
$\Delta\mathcal{C}(\mathcal{M})$, as it typically rises with increasing
$\epsilon$. This trend corroborates the patterns observed in table II.
Notably, the negative $\Delta\mathcal{C}(\mathcal{M})$ values at $\epsilon$ of
0 suggest that, initially, robust models are more carbon-efficient than
baseline models when assessed on the original test data.

Does this mean stronger robustness comes at a higher cost of higher carbon
emissions? To answer this, let us take a look at the $RCTI$ values.
Positively, the $RCTI$ value actually decreases with $\epsilon$, with lower
values generally being better as they suggest a more favorable robustness-to-
emission ratio. Using the elasticity of robustness metric, we can classify
these different models based on whether they are eco-friendly or not. As shown
in table III, the elasticity of robustness shifts from eco-costly at
$\epsilon=0$ to eco-efficient as $\epsilon$ increases, reflecting a better
environmental impact with increasing robustness, up to $\epsilon=0.3$ for the
PGD evasion attacks. However, at $\epsilon=0.4$, it becomes eco-critical,
signaling a tipping point where the trade-off becomes environmentally
unsustainable. This is encouraging news for secureML researchers, developers,
and practitioners, as it underscores the potential to control carbon emissions
while still advancing the development of robust adversarial ML models.
Moreover, the elasticity of robustness provides an intuitive understanding of
the relationship between a model’s explainability, its robustness, and its
environmental footprint.

##  V Conclusion

This paper presents the first attempt at assessing the carbon footprint
implications in the context of adversarial machine learning. Our proposed RCTI
metric can measure the connection between robustness and sustainability, which
helps with figuring out how much better security for machine learning systems
costs the environment and allows a customizable manner tailored to specific
system demands and security settings. In our future research, we will evaluate
this multi-objective metric with additional dimensions like financial costs
and model fairness with the goal of sustainable robustness of ML. Expanding
the evaluation across diverse datasets, model architectures, and attack types
will enrich insights into this trade-off index.

## References

  * [1] D. Patterson, J. Gonzalez, Q. Le, C. Liang, L.-M. Munguia, D. Rothchild, D. So, M. Texier, and J. Dean, “Carbon emissions and large neural network training,” 2021.
  * [2] C.-J. Wu, R. Raghavendra, U. Gupta, B. Acun, N. Ardalani, K. Maeng, G. Chang, F. Aga, J. Huang, C. Bai _et al._ , “Sustainable ai: Environmental implications, challenges and opportunities,” _Proceedings of Machine Learning and Systems_ , vol. 4, pp. 795–813, 2022.
  * [3] A. Haldar and N. Sethi, “Environmental effects of information and communication technology-exploring the roles of renewable energy, innovation, trade and financial development,” _Renewable and Sustainable Energy Reviews_ , vol. 153, p. 111754, 2022.
  * [4] M.-I. Nicolae, M. Sinn, M. N. Tran, B. Buesser, A. Rawat, M. Wistuba, V. Zantedeschi, N. Baracaldo, B. Chen, H. Ludwig, I. Molloy, and B. Edwards, “Adversarial robustness toolbox v1.2.0,” _CoRR_ , vol. 1807.01069, 2018. [Online]. Available: https://arxiv.org/pdf/1807.01069
  * [5] N. G. Mankiw, _Principles of economics_. Cengage Learning, 2020.
  * [6] E. Strubell, A. Ganesh, and A. McCallum, “Energy and policy considerations for deep learning in nlp,” 2019.
  * [7] Z. Epstein, A. Hertzmann, the Investigators of Human Creativity, M. Akten, H. Farid, J. Fjeld, M. R. Frank, M. Groh, L. Herman, N. Leach, R. Mahari, A. S. Pentland, O. Russakovsky, H. Schroeder, and A. Smith, “Art and the science of generative ai,” _Science_ , vol. 380, no. 6650, pp. 1110–1111, 2023. [Online]. Available: https://www.science.org/doi/abs/10.1126/science.adh4451
  * [8] C.-J. Wu, R. Raghavendra, U. Gupta, B. Acun, N. Ardalani, K. Maeng, G. Chang, F. Aga, J. Huang, C. Bai, M. Gschwind, A. Gupta, M. Ott, A. Melnikov, S. Candido, D. Brooks, G. Chauhan, B. Lee, H.-H. Lee, B. Akyildiz, M. Balandat, J. Spisak, R. Jain, M. Rabbat, and K. Hazelwood, “Sustainable ai: Environmental implications, challenges and opportunities,” in _Proceedings of Machine Learning and Systems_ , D. Marculescu, Y. Chi, and C. Wu, Eds., vol. 4, 2022, pp. 795–813.
  * [9] R. Verdecchia, J. Sallou, and L. Cruz, “A systematic review of green ai,” 2023.
  * [10] P. Henderson, J. Hu, J. Romoff, E. Brunskill, D. Jurafsky, and J. Pineau, “Towards the systematic reporting of the energy and carbon footprints of machine learning,” 2020.
  * [11] J. Dodge, T. Prewitt, R. Tachet des Combes, E. Odmark, R. Schwartz, E. Strubell, A. S. Luccioni, N. A. Smith, N. DeCario, and W. Buchanan, “Measuring the carbon intensity of ai in cloud instances,” in _Proceedings of the 2022 ACM Conference on Fairness, Accountability, and Transparency_ , 2022, pp. 1877–1894.
  * [12] A. S. Luccioni and A. Hernandez-Garcia, “Counting carbon: A survey of factors influencing the emissions of machine learning,” _arXiv preprint arXiv:2302.08476_ , 2023.
  * [13] L. H. Kaack, P. L. Donti, E. Strubell, G. Kamiya, F. Creutzig, and D. Rolnick, “Aligning artificial intelligence with climate change mitigation,” _Nature Climate Change_ , vol. 12, no. 6, pp. 518–527, 2022.
  * [14] Z. Yang, X. He, Z. Li, M. Backes, M. Humbert, P. Berrang, and Y. Zhang, “Data poisoning attacks against multimodal encoders,” in _International Conference on Machine Learning_. PMLR, 2023, pp. 39 299–39 313.
  * [15] H. Liu, Z. Ge, Z. Zhou, F. Shang, Y. Liu, and L. Jiao, “Gradient correction for white-box adversarial attacks,” _IEEE Transactions on Neural Networks and Learning Systems_ , 2023.
  * [16] M. M. Badr, M. Mahmoud, M. Abdulaal, A. J. Aljohani, F. Alsolami, and A. Balamsh, “A novel evasion attack against global electricity theft detectors and a countermeasure,” _IEEE Internet of Things Journal_ , 2023.
  * [17] N. Ponomareva, H. Hazimeh, A. Kurakin, Z. Xu, C. Denison, H. B. McMahan, S. Vassilvitskii, S. Chien, and A. G. Thakurta, “How to dp-fy ml: A practical guide to machine learning with differential privacy,” _Journal of Artificial Intelligence Research_ , vol. 77, pp. 1113–1201, 2023.
  * [18] K. Wei, J. Li, C. Ma, M. Ding, W. Chen, J. Wu, M. Tao, and H. V. Poor, “Personalized federated learning with differential privacy and convergence guarantee,” _IEEE Transactions on Information Forensics and Security_ , 2023.
  * [19] C. Zhou and N. Ansari, “Securing federated learning enabled nwdaf architecture with partial homomorphic encryption,” _IEEE Networking Letters_ , 2023.
  * [20] J. Xu, Y. Li, Y. Jiang, and S.-T. Xia, “Adversarial defense via local flatness regularization,” in _2020 IEEE International Conference on Image Processing (ICIP)_ , 2020, pp. 2196–2200.
  * [21] A. Madry, A. Makelov, L. Schmidt, D. Tsipras, and A. Vladu, “Towards deep learning models resistant to adversarial attacks,” _arXiv preprint arXiv:1706.06083_ , 2017.
  * [22] mlco2, “Codecarbon.” [Online]. Available: https://github.com/mlco2/codecarbon
  * [23] H. Gao, X. Wang, K. Wu, Y. Zheng, Q. Wang, W. Shi, and M. He, “A review of building carbon emission accounting and prediction models,” _Buildings_ , vol. 13, no. 7, p. 1617, 2023.
  * [24] Trusted AI, “Adversarial training mnist,” 2023. [Online]. Available: https://github.com/Trusted-AI/adversarial-robustness-toolbox/blob/main/notebooks/adversarial_training_mnist.ipynb