# RobustEdge: Low Power Adversarial Detection for Cloud-Edge Systems

Abhishek Moitra, Student Member, IEEE, Abhiroop Bhattacharjee, Student Member,
IEEE, Youngeun Kim, Student Member, IEEE and Priyadarshini Panda, Member, IEEE
Abhishek Moitra, Abhiroop Bhattacharjee, Youngeun Kim and Priyadarshini Panda
are with the Department of Electrical Engineering, Yale University, New Haven,
CT, USA.

###### Abstract

In practical cloud-edge scenarios, where a resource constrained edge performs
data acquisition and a cloud system (having sufficient resources) performs
inference tasks with a deep neural network (DNN), adversarial robustness is
critical for reliability and ubiquitous deployment. Adversarial detection is a
prime adversarial defense technique used in prior literature. However, in
prior detection works, the detector is attached to the classifier model and
both detector and classifier work in tandem to perform adversarial detection
that requires a high computational overhead which is not available at the low-
power edge. Therefore, prior works can only perform adversarial detection at
the cloud and not at the edge. This means that in case of adversarial attacks,
the unfavourable adversarial samples must be communicated to the cloud which
leads to energy wastage at the edge device. Therefore, a low-power edge-
friendly adversarial detection method is required to improve the energy
efficiency of the edge and robustness of the cloud-based classifier. To this
end, RobustEdge proposes Quantization-enabled Energy Separation (QES) training
with “early detection and exit” to perform edge-based low cost adversarial
detection. The QES-trained detector implemented at the edge blocks adversarial
data transmission to the classifier model, thereby improving adversarial
robustness and energy-efficiency of the Cloud-Edge system. Through extensive
experiments on CIFAR10, CIFAR100 and TinyImagenet, we find that 16-bit and
12-bit quantized detectors achieve a high AUC score $>$ 0.9 across different
datasets and adversarial attacks. Hardware evaluations on a 45nm CMOS digital
accelerator reveal that RobustEdge is requires 25$\times$ lower energy for
adversarial detection compared to prior works. Additionally, compared to prior
works that perform adversarial detection at the cloud, we find that edge-based
adversarial detection can improve the energy-efficiency of the cloud-edge
system by $>166\times$. Furthermore, we find that RobustEdge is transferable
across datasets i.e., a detector trained on one dataset can detect adversaries
on another dataset.

###### Index Terms:

Adversarial Attacks, Adversarial Detection, Edge Computing, Energy Efficiency

##  I Introduction

In the era of IoT and edge computing, deep neural networks (DNNs) are being
ubiquitously implemented in cloud-edge systems [1, 2, 3, 4, 5]. Fig. 1a shows
an example of a cloud-edge system where a low powered edge device performs
data acquisition and transmits the acquired data to a classifier/DNN model
deployed at the cloud for inference [6, 7]. However, recent works have found
that DNNs are vulnerable to adversarial attacks, wherein adding small
structured noise to the input data can fool the classifier model [8, 9]. In
the cloud edge scenario shown in Fig. 1a, the cloud-based classifier model is
prone to such adversarial attacks. To this end, several adversarial detection
methods [10, 11, 12, 13, 14] have been researched to avert adversarial
attacks.

However, prior detection works have broadly followed two different approaches-
(Case 1) Works such as [14, 13] train the classifier network on both
adversarial and natural samples in order to perform adversarial detection;
(Case 2) Another approach is to train small detector networks on intermediate
activations of classifier models [10, 11, 12] to distinguish natural or
adversarial samples. In both cases, the adversarial detection always occurs at
the classifier model. This has the following connotations: 1) it leads to huge
size of classifier-detector models and 2) they entail high number of
computations leading to high energy overhead. These factors render prior
detection approaches unsuitable for resource-constrained edge deployment.
Therefore, prior works are cloud-centric adversarial detection solutions. As
seen in Fig. 1b, cloud-centric adversarial detection entails wasteful energy
expenditure by the edge device to transmit adversarial data to the cloud.
Therefore, an edge-friendly adversarial detection method that requires
extremely small detector model size and computations for adversarial detection
is critical for improving the adversarial robustness. Additionally,
adversarial detection at the edge will eliminate wasteful transmission energy
consumption in cloud-edge systems.

---
Figure 1: (a) A standard Cloud-Edge system where the edge performs data
acquisition and the classifier DNN on cloud performs inference. (b) Prior
classifier-based detection methods are not suitable for edge deployment and
entail higher edge to cloud data transmission causing wasteful energy
expenditure at the edge. (c) RobustEdge trains a small energy-efficient
detector suitable for low power edge deployment. The detector minimizes
adversarial data and maximizes natural data transmission to cloud.

To this end, we propose RobustEdge that uses quantization-enabled energy
separation (QES) training to train a small, standalone adversarial detector
that can be suitably deployed at a low power edge platform as shown in Fig.
1c. Note, here energy separation does not mean the actual hardware energy but
is a characterization function to distinguish adversarial and natural inputs.
Additionally, we propose an “early detection and exit” strategy to improve the
compute efficiency of the adversarial detection. The detector successfully
detects adversarial and natural samples at the edge. The natural samples are
transmitted to the cloud while the adversarial data transmission is terminated
at the edge minimizing the wasteful energy expenditure.

In summary the key contributions of our paper are as follows:

  1. 1.

We propose RobustEdge which is the first of its kind low power edge-based
adversarial detection technique that employs a novel QES training method with
“early detection and exit” strategy to achieve high performance and compute
efficient adversarial detection.

  2. 2.

Based on extensive evaluations using benchmark datasets- CIFAR10, CIFAR100,
TinyImagenet and comprehensive adversarial attacks, we find that 16-bit and
12-bit detectors achieve high detection performance across different gradient-
based (AUC score $>$ 0.9) and score-based attacks (AUC score $>$ 0.7).
Additionally, the 16-bit and 12-bit detectors eliminate 100% of the edge-cloud
data transmission for adversarial inputs which minimizes the energy wastage at
the edge by $\sim 70$J.

  3. 3.

We implement the QES-trained detector on a 45nm digital custom CMOS hardware
accelerator. We find that RobustEdge requires $<25\times$ energy for
adversarial detection compared to prior works. Furthermore, we find that
“early detection and exit” strategy leads to 66% lower detection energy
compared to detection without early-exit.

  4. 4.

Interestingly, we find that the QES-trained detector is transferable across
datasets. A detector trained on the TinyImagenet dataset can detect different
adversarial attacks on the CIFAR10 and CIFAR100 dataset (AUC $>$ 0.9 and AUC
$>$ 0.7 for gradient and score-based attacks, respectively).

Note, in this paper, we focus on practical cloud-edge systems (where, the
resource constrained edge is only responsible for data collection and
transmission) that find use in real applications today, e.g., mobile phones,
voice assistants, autonomous cars and drones etc [15, 16]. There have been
many recent works [17, 18, 19, 20] proposing cloud-edge systems, where, the
edge is assumed to have sufficient compute resources to perform partial
inference. These works use compute offloading to the edge system which send
the data or intermediate activations to the cloud. RobustEdge targets the
former practical use case of cloud-edge system, and strengthens the edge with
ultra low power and cost-friendly adversarial detection.

##  II Background

###  II-A Background on Adversarial Attacks

Adversarial attacks have the following objective:

$C(W,x+\delta)\neq C(W,x),~{}||\delta||\leq\epsilon.$

Here, $C(.)$ denotes the classifer model’s predictions, $W$ is the classifier
weights, $x$ is the natural input data and $\delta$ is the perturbation added
to the input. Based on the input, $\delta$ is computed using the gradient (in
case of gradient-based attacks) and loss (decision-based attacks) information
from the classifier model [8, 9, 21]. $\delta$ is constrained by the parameter
$\epsilon$ such that attacks are imperceptible to human eyes.

There have been several effective adversarial attacks proposed in literature
which are described below:

  1. 1.

Gradient-based attacks: To generate these attacks, a forward and backward
propagation is performed on the classifier model. To create the adversarial
image for input $x$, the gradient of loss with respect to $x$
($\frac{\partial\mathcal{L}}{\partial x}$) is used. The Fast Gradient Sign
Method (FGSM) is a simple one-step adversarial attack proposed in [22].
Several works have shown that FGSM attack can be made stronger with momentum
(MIFGSM)[23], random initialization (FFGSM)[24], and input diversification
(DIFGSM)[25]. In contrast, the Basic Iterative Method (BIM) is an iterative
attack proposed in [22]. The BIM attack with random restarts is called the
Projected Gradient Descent (PGD) attack [9]. A targeted version of the PGD
attack (TPGD) [26] can fool the model into mis-classifying a data as a desired
class. Other multi-step attacks like Carlini-Wagner (C&W) [27] and PGD-L2 [9]
are crafted by computing the L2 Norm distance between the adversarial and
natural images.

  2. 2.

Score-based attacks: Score-based attacks do not require input gradients to
craft adversaries. Instead these attacks use the classifier’s loss information
to maximize the attack strength. Square attack (SQR) [21] uses multiple
queries to perturb randomly selected square regions in the input. Other score-
based attacks like the AutoAttack (AUTO) and Auto-PGD (APGD) craft adversaries
by automatically choosing the optimal attack parameters [28]. The Gaussian
Noise (GN) attack is created by adding gaussian noise with standard deviation
of strenght $\epsilon$ to the input.

###  II-B Eyeriss DNN inference accelerator

The Eyeriss accelerator is a digital hardware architecture designed for
energy-efficient DNN inference that performs high-speed convolution operations
[29]. The Eyeriss architecture as shown in Fig. 2 is based on a systolic array
design, which performs parallel computing using a grid of processing elements
(PEs) to emulate Multiply-and-Accumulate (MAC) operations on hardware. Inside
each PE, there are registers or scratchpads (spads) for storing input
activations, weights & partial sums, digital multipliers and accumulators for
MAC computations, digital comparators for ReLU activation and a PE control
unit, all of which are optimized for efficient matrix operations. Eyeriss uses
a technique called ‘dataflow mapping’ to distribute computation across the
systolic array of PEs. These dataflows, essentially, partition the input
activations and the convolution filters stored in the caches into smaller
chunks that can be processed in parallel by the PEs with minimum communication
overhead in the data transfer. With ‘dataflow mapping’, Eyeriss can perform
convolutions faster and more efficiently than traditional CPU or GPU
architectures by minimizing data movement and maximizing parallelism. In this
work, an output-stationary (OS) dataflow is used in carrying out MAC
operations in the PE array that helps reduce repeated accesses of the
intermediate partial sums to and from the main memory.

Figure 2: An overview of the Eyeriss architecture consisting of a systolic
array of PEs for DNN inference.

##  III Related Works

Predominantly, there are two types of adversarial defense strategies used in
prior literature. 1) Adversarial Classification 2) Adversarial Detection.

###  III-A Adversarial Classification

Here, works such as [30] proposed input feature transformation using JPEG
compression followed by training on compressed feature space to improve the
classification performance of the classifier model. Madry et al. [9] proposed
adversarial training in which a classifier model is trained on adversarial and
clean data to improve the adversarial and clean classification performance.
Following this, several works have used noise injection into parameters [31]
and ensemble adversarial training to harden the classifier model against a
wide range of attacks. Lin et al. [32] showed that adversarial classification
can be improved by reducing the error amplification in a network. Hence, they
used adversarial training with regularization to constrain the Lipschitz
constant of the network to less than unity. However, for the kind of practical
cloud-edge scenario considered in this work adversarial training methods are
not suitable as the classifier model at the cloud requires modification for
different attacks.

###  III-B Adversarial Detection

Towards adversarial detection, a line of works have trained the classifier
model for adversarial detection. Xu et al. [12] propose a method that uses
outputs of multiple classifier models to estimate the difference between
natural and adversarial data. Here, the classifier models are trained on
natural inputs with different feature squeezing techniques at the inputs.
Moitra et al. [13] uses the features from the first layer of the classifier
model to perform adversarial detection. In particular, they perform
adversarial detection using hardware signatures in analog crossbar
accelerators. While Grosse et al. [14] train the classifier model with an
additional class label indicating adversarial data, Gong et al. [33] train a
separate binary classifier on the natural and adversarial data generated from
the classifier model to perform adversarial detection. Lee et al. [34] use a
metric called the Mahalanobis distance classifier to train the classifier
model. The Mahalanobis distance is used to distinguish natural from
adversarial data.

Other works have trained detector networks attached to classifier models for
adversarial detection. Metzen et al. [10] and Sterneck et al. [11] use the
intermediate features of the classifier model to train a simple binary
adversarial detector. While Metzen et al. [10] use a heuristic-based method to
determine the point of attachment of the detector with the classifier model,
Sterneck et al. [11] use a structured metric called adversarial noise
sensitivity to do the same. Similarly, Yin et al. [35] use asymmetric
adversarial training to train detectors on the intermediate features of the
classifier model for adversarial detection. Further, Huang et al. [36] use the
confidence scores from the classifier model to estimate the relative score
difference corresponding to the clean and the adversarial input to perform
adversarial detection. Further, they also recommend classifier model training
on noisy data to improve the adversarial detection performance.

Although prior detection works have achieved state-of-the-art performance,
they have overlooked the practicality and the implication of such techniques
for cloud-edge computing scenarios. As the detector is attached to the
classifier, 1) Adversarial detection cost is high as both classifier and
detector work in tandem. 2) The detector needs to be retrained if the
classifier model changes. RobustEdge performs low-cost adversarial detection
while being agnostic of the classifier DNN deployed at the cloud. At the same
time, the detection occurs at the edge eliminating wasteful adversarial data
transmission to the cloud.

##  IV Methodology

Input $n$ layered detector ($\mathcal{D}$), $x_{nat}$, $x_{adv}$, $s_{nat}$,
$K$, $L$, $U$
Output Trained detector $\mathcal{D}_{T}$, $\mathcal{E}_{n,Th}$,
$\mathcal{E}_{i,L}$, $\mathcal{E}_{i,U}$

1:/* Detector Weight Training */

2:for all i = 1 to n do

3: Quantize layers $[1,i]$ to k-bit

4: Freeze layers $[1,i$-$1]$

5: for all j = 1 to $N_{epoch}$ do

6: for all B = 1 to $N_{batches}$ do

7: $X_{n}^{B}$, $X_{a}^{B}$ $\leftarrow$ Mini-batch of $x_{nat}$ and $x_{adv}$

8: Compute $\mathcal{E}_{nat}^{i,B}$ and $\mathcal{E}_{adv}^{i,B}$ on the
mini-batch

9: Compute loss function using Eq. 2

10: Optimize layer $i$ using the loss function

11: end for

12: end for

13:end for

14:Trained Detector $\mathcal{D}_{T}$ obtained

15:/* Confidence Boundary Generation */

16:for all i = 1 to n do

17: if i == n then

18: $\mathcal{E}_{n,Th}$ $\leftarrow$ $K^{th}$ percentile of $\Psi_{n,s}$

19: else

20: Generate $i$th layer distribution, $\Psi_{i,s}$ using

21: $s_{nat}$ and $\mathcal{D}_{T}$

22: $\mathcal{E}_{i,L}$ $\leftarrow$ $(K-L)^{th}$ percentile of $\Psi_{i,s}$

23: $\mathcal{E}_{i,U}$ $\leftarrow$ $(K+U)^{th}$ percentile of $\Psi_{i,s}$

24: end if

25:end for

Algorithm 1 QES Training Algorithm

(a) |  | (b) |  | (c) |
---|---|---|---|---|---

Figure 3: Plots showing the natural and adversarial energy distributions
$\mathcal{E}_{nat}^{i}$ and $\mathcal{E}_{adv}^{i}$ for layers $i$= 1, 2, 3 of
a three layered detector. The confidence boundaries $\mathcal{E}_{i,L}$,
$\mathcal{E}_{i,U}$ and $\mathcal{E}_{n,Th}$ shown correspond to $K$= 92, $L$=
30 and $U$=5.

In QES training shown in Algorithm 1, we start with an $n$ layered randomly
initialized detector $\mathcal{D}$. For each layer $i$ $\in$ [1,$n$], we train
the detector for $N_{epoch}$ iterations. When training layer $i$, layers 1 to
$i$ are quantized while layers $i+1$ to $n$ are maintained at 32-bit
precision. We find that selectively quantizing the first $i$ layers leads to
higher post training performance compared to quantization of all the layers.
For the layer $i$, the energy signatures ($\mathcal{E}_{nat}^{i,B}$ and
$\mathcal{E}_{adv}^{i,B}$) are computed over each mini-batch $B$ ($X_{n}^{B}$
and $X_{a}^{B}$) of $x_{nat}$ and $x_{adv}$, respectively. Here, $x_{nat}$ and
$x_{adv}$ are the natural and adversarial datasets. The $x_{adv}$ for QES
training is generated using gradient-based attacks on a separately trained DNN
(i.e., by backpropagating through the DNN to obtain
$\frac{\partial\mathcal{L}}{\partial x}$ for natural input $x$). The energy
signature for layer $i$ and mini-batch $B$ is computed using the formula,

$\mathcal{E}^{i,B}=mean(Z_{c,h,w}^{i,B}).$ (1)

$Z$ is the magnitude of weighted summation outputs of layer $i$ and mini-batch
$B$. Additionally, $c$, $h$ and $w$ are the number of channels, height and
width of the output features, respectively. $\mathcal{E}_{nat}^{i,B}$ and
$\mathcal{E}_{adv}^{i,B}$ are then used to compute the loss function given by:

$\mathcal{L}_{i}=y~{}\mathcal{L}_{MSE}(\mathcal{E}_{nat}^{i,B},\lambda_{n}^{i})~{}+~{}(1-y)~{}\mathcal{L}_{MSE}(\mathcal{E}_{adv}^{i,B},\lambda_{a}^{i}).$
(2)

$\lambda_{n}^{i}$ and $\lambda_{a}^{i}$ are the desired natural and
adversarial energies for layer $i$ and $y$ equals 1 for natural data and 0 for
adversarial data. Using the loss function, we optimize the weights of the
layer $i$. During optimization of layer $i$, layers 1 to $i$-1 are frozen.

###  IV-A Early Detection and Exit Strategy for Energy Efficiency

The “Early detection and exit” minimizes the computations and improves the
energy efficiency of the adversarial detection. After QES training, we
generate layer-specific sample natural energy distributions $\Psi_{i,s}$ using
the trained detector $\mathcal{D}_{T}$ and $s_{nat}$, as shown in Algorithm 1.
Note, $s_{nat}$ is a small dataset randomly sampled from the training set. We
generate layer-specific lower ($\mathcal{E}_{i,L}$) and upper
($\mathcal{E}_{i,U}$) confidence boundaries which are the $(K-L)^{th}$ and
$(K+U)^{th}$ percentiles of the $\Psi_{i,s}$ distribution, respectively. The
last layer has one confidence boundary, $\mathcal{E}_{n,Th}$ which is the
$K^{th}$ percentile of the $\Psi_{n,s}$ distribution. Here, $K$, $U$ and $L$
are hyper-parameters and same for all the layers of the detector. We
demonstrate the layer-specific natural and adversarial energy distributions
and confidence boundaries for PGD $\epsilon$= 4/255 (PGD4) attacks of a
3-layered trained detector on CIFAR10 data in Fig. 3. For detection, the
energy $\mathcal{E}^{i}$ at the end of each layer $i$ is computed. As seen in
Fig. 3a, if the energy is less (greater) than $\mathcal{E}_{i,L}$
($\mathcal{E}_{i,U}$), it is classified as natural (adversarial) sample and
the detection process is terminated. If the energy value lies between
$\mathcal{E}_{i,L}$ and $\mathcal{E}_{i,U}$, it is forwarded to the next layer
until it is classified at the final layer. In the final layer $n$, if
$\mathcal{E}^{n}$ is greater than $\mathcal{E}_{n,Th}$, it is classified as
adversarial and vice-versa.

##  V Hardware Implementation

Figure 4: Hardware accelerator for an $n$ layered detector.

The QES-trained detector with “early-detection and exit” is implemented on an
Eyeriss-like [29, 37] hardware accelerator shown in Fig. 4. 1 As the detector
has a small size ($\sim$12KB), all the detector weights are fetched from the
DRAM to the Weight Cache once and reused for multiple inputs reducing DRAM
accesses. 2 For each input, the input data is loaded from the DRAM to the
Input Cache. 3 The multiplexer selects the data from the input cache or
activation cache depending upon the layer being processed and sends it to the
PE Array. Simultaneously, the corresponding layer weights are transferred to
the PE Array. Each PE contains weight, input and PSum scratchpads and adopt a
row-stationary dataflow [29] to maximize data reuse and thus improve the
energy efficiency. 4 The convolution outputs from each PE is stored into the
EC SPAD and the Activation Cache (via the ReLU activation unit). 5 A set of
adder and register (Reg) in the Energy Computation (EC) Engine accumulate all
the convolution outputs of a layer to compute the Energy value. 6 The Energy
values are compared with the layer-specific confidence boundaries
($\mathcal{E}_{i,L}$, $\mathcal{E}_{i,U}$ or $\mathcal{E}_{n,Th}$). 7 If a
sample is classified as natural at an early layer, the input data is fetched
from the Input Cache and directed to the WiFi module for transmission to DNN
classifier on cloud and the detection ends. The adversarial detection occurs
in a pipelined fashion across different images. From our analysis we find that
the latency for data transmission by the WiFi module is $\sim 5\times$ higher
compared to the detection latency. Therefore, to ensure no data loss, we set
the communication queue size in the WiFi module as 30KB ($\sim 10\times$ the
image size).

##  VI Experiments and Results

###  VI-A Experimental Setup

####  VI-A1 “Classifier-edge” and “Baseline” Systems

In RobustEdge, we implement the QES-trained detector at the edge and the
classifier model is deployed on the cloud as seen in Fig. 1c. Note, this
cloud-based classifier and edge detector system will be referred to as the
“classifier-edge system”, in the remainder of the text. Additionally, a
classifier-edge system with no adversarial detection at the classifier or edge
(Fig. 1a) is considered as the “Baseline” for evaluation.

####  VI-A2 Datasets

We use CIFAR10 (10 classes), CIFAR100 (100 classes) and TinyImagenet (200
classes) datasets. The CIFAR10 and CIFAR100 datasets have 50k training and 10k
test data with each sample of size 3x32x32 pixels while TinyImagenet contains
100k training and 10k test data with each sample of size 3x64x64 pixels.

####  VI-A3 White-box and Black-box Attack Scenarios

When a classifier-edge system is subjected to adversarial attacks, there are
two possible scenarios: white-box and black-box. In the white-box attack
scenario, the adversarial attacks are generated from the same DNN model that
was used to create the adversarial data during QES training. This means that
the attacker has complete knowledge of the model and its parameters. On the
other hand, in the black-box attack scenario, the adversarial attacks are
generated from a DNN model that is different from the one used to create the
adversarial data during QES training. In this scenario, the attacker has
limited knowledge of the model, and this makes it harder for them to generate
effective adversarial attacks.

####  VI-A4 Adversarial Attack and Strengths

For all the white-box and black-box attacks in our experiments, we use the
following attacks with strengths as described (see Section II-A for details):
FGSM ($\epsilon$= 8/255) [8], BIM ($\epsilon$= 8/255) [22], DIFGSM
($\epsilon$= 8/255) [25] , MIFGSM ($\epsilon$= 8/255) [23], TPGD ($\epsilon$=
8/255) [9], PGD4 (PGD with $\epsilon$= 4/255) [9] and PGD8 (PGD with
$\epsilon$= 8/255) and PGD16 (PGD with $\epsilon$= 16/255), SQR ($\epsilon$=
0.3) [21], APGD ($\epsilon$= 8/255), AUTO ($\epsilon$= 16/255) [28], C&W ($c$=
100, $\kappa$= 0, steps= 100) [27] and GN ($\sigma$= 0.1).

####  VI-A5 QES training Parameters (Algorithm 1)

For all datasets, we use a 3-layered convolution neural network ($n$= 3) with
the Detector $\mathcal{D}_{1}$ architecture shown in Fig. 9. For QES training,
$N_{epochs}$= 500 and requires $<2$ GPU hours on a single Nvidia RTX2080ti GPU
due to the small detector size. The data batch size is 200 and
[$\lambda_{a}^{1}$= 0.9, $\lambda_{a}^{2}$= 1.3, $\lambda_{a}^{3}$= 2] with
$\lambda_{n}$ fixed at 0.1 for all the layers (Section VI-G details the
ablation studies for choice of hyperparameters). For CIFAR10 and CIFAR100, the
learning rates are- 0.005, 0.002, 0.002 for optimizing layers 1, 2 and 3,
respectively. For TinyImagenet, the learning rates are 0.003, 0.002, 0.002.
For each dataset scenario, the QES detector is trained with $x_{adv}$ created
using a separately trained VGG19 for CIFAR10/CIFAR100, and ResNet18 for
TinyImagenet. In all experiments, $x_{adv}$ are PGD $\epsilon$ = 8/255 attack
based inputs. The $s_{nat}$ dataset has 1000 images randomly sampled from the
training set. The values of $L$, $U$ and $K$ in all experiments are 30, 5 and
92, respectively (see Fig. 10). We use Pytorch v1.5.1 for all experiments.

####  VI-A6 Hardware Evaluation Setup

Technology | 45nm CMOS
---|---
DRAM | 64MB
Input, Weight, Activation Cache | 32KB SRAM
PE & EC SPAD | 1KB Register
PE Array Size | 32
Energy Values
$Precision$ | 4-bits | 6-bits | 8-bits | 12-bits | 16-bits
$E_{MAC}$ / Op (pJ) | 0.0575 | 0.129 | 0.23 | 0.52 | 0.92
$E_{ACC}$ / Op (pJ) | 0.017 | 0.038 | 0.07 | 0.15 | 0.27
$E_{DRAM}$ / Read (16-bits) (pJ) | 184 | 184 | 184 | 184 | 184
$E_{CACHE}$ / Read (16-bits) (pJ) | 10 | 10 | 10 | 10 | 10
$E_{SPAD}$ / Read (16-bits) (pJ) | 1.7 | 1.7 | 1.7 | 1.7 | 1.7
$E_{transmit}$ / Image (mJ) | CIFAR10, CIFAR100- 6.8, TinyImagenet- 13.6

TABLE I: Table showing parameters for the hardware accelerator used for
implementing the detector.

The classifier-edge system’s energy includes natural and adversarial data
transmission energy from edge to classifier ($E_{T,N}$ and $E_{T,A}$) and the
adversarial detection energy $E_{D}$ as shown in Eq. 3.

$E=E_{T,N}+E_{T,A}+E_{D}$ (3) $E_{T,N}=p\times
N_{nat}\times\frac{E_{transmit}}{Image},~{}E_{T,A}=q\times
N_{adv}\times\frac{E_{transmit}}{Image}$ (4)
$E_{D}=(N_{nat}+N_{adv})\times(\frac{E_{DRAM}}{Read}\times
R_{D}+\frac{E_{CACHE}}{Read}\times R_{C}\\\ +\frac{E_{SPAD}}{Read}\times
R_{S}+\frac{E_{MAC}}{Op}\times N_{MAC}+\frac{E_{ACC}}{Op}\times N_{ACC})$ (5)

In Eq. 4, $N_{nat}$ and $N_{adv}$ are the number of natural and adversarial
samples. $E_{transmit}$ is the transmission energy per image to send data from
edge to the classifier. $p$ and $q$ are the fraction of natural and
adversarial samples, respectively transmitted to the classifier. Eq. 5 shows
that the $E_{D}$ includes the total DRAM, Cache, SPAD, MAC and ACC component
energies computed over all the natural and adversarial inputs. An ideal
detector should have $p$=1 and $q$=0 (or $E_{T,A}$= 0) at low detection cost
$E_{D}$.

The QES-trained quantized detector (see Fig. 1c) is implemented using the
hardware platform (Fig. 4) with parameters shown in Table I. All energy
evaluations in Table I are based on SPICE simulations using the Cadence
Virtuoso platform. For all experiments, the transmission energy per image,
$E_{transmit}$ is computed using the Wi-Fi power model proposed in [38] at a
transfer rate of 100Mbps. Note, the comparator and ReLU units’ energies are
not shown as they are negligible compared to the other components.

####  VI-A7 Performance Evaluation Metrics

For evaluating detector performance, we use the metric AUC and F1 score [35]:
High AUC and F1 scores (close to 1) signifies a high true positive and low
false positive rate and hence a good detector. For evaluating the Classifier-
Edge system’s performance, we use 1) Error [35]: which is the percentage of
total adversarial inputs that are undetected and misclassified by the
classifier model. 2) Accuracy [35]: which is the percentage of natural samples
that are identified correctly by the detector and the classifier. High
accuracy and low error imply higher robustness.

###  VI-B Adversarial Robustness and Energy-efficiency Results

| CIFAR100 | Attacks $\rightarrow$ |  FGSM |  PGD4 |  PGD8 |  PGD16 |  TPGD |  DIFGSM |  MIFGSM |  C&W |  AUTO |  GN
---|---|---|---|---|---|---|---|---|---|---|---
16b Edge Detector Classifier: VGG19 | Error R / Error B |  0 / 82 |  0 / 95 |  0 / 96 |  0 / 95 |  0 / 97 |  0 / 80 |  0 / 88 |  6 / 89 |  13 / 69 |  0 / 77
Accuracy R / Accuracy B | 59 / 62 | 59 / 62 | 59 / 62 | 59 / 62 | 59 / 62 | 59 / 62 | 59 / 62 | 59 / 62 | 59 / 62 | 59 / 62
16b Detector’s AUC Score | 0.972 | 0.965 | 0.978 | 0.98 | 0.976 | 0.971 | 0.975 | 0.8 | 0.8 | 0.973
| 16b Detector’s F1 Score | 0.962 | 0.953 | 0.962 | 0.957 | 0.956 | 0.957 | 0.963 | 0.721 | 0.722 | 0.961
12b Edge Detector Classifier: VGG19 | Error R / Error B |  0 / 82 |  0 / 95 |  0 / 96 |  0 / 95 |  0 / 97 |  0 / 80 |  0 / 88 |  8 / 85 |  15 / 69 |  0 / 77
Accuracy R / Accuracy B | 59 / 62 | 59 / 62 | 59 / 62 | 59 / 62 | 59 / 62 | 59 / 62 | 59 / 62 | 59 / 62 | 59 / 62 | 59 / 62
12b Detector’s AUC Score | 0.98 | 0.963 | 0.978 | 0.972 | 0.975 | 0.971 | 0.98 | 0.79 | 0.79 | 0.98
| 12b Detector’s F1 Score | 0.962 | 0.953 | 0.962 | 0.957 | 0.956 | 0.957 | 0.963 | 0.721 | 0.722 | 0.961
| TinyImagenet | Attacks $\rightarrow$ |  FGSM |  PGD4 |  PGD8 |  PGD16 |  TPGD |  DIFGSM |  MIFGSM |  C&W |  AUTO |  GN
---|---|---|---|---|---|---|---|---|---|---|---
16b Edge Detector Classifier: ResNet18 | Error R / Error B |  0 / 89 |  0 / 95 |  0 / 95 |  0 / 97 |  0 / 91 |  0 / 82 |  0 / 80 |  10 / 94 |  18 / 77 |  0 / 71
Accuracy R / Accuracy B | 50 / 53 | 50 / 53 | 50 / 53 | 50 / 53 | 50 / 53 | 50 / 53 | 50 / 53 | 50 / 53 | 50 / 53 | 50 / 53
16b Detector’s AUC Score | 0.978 | 0.973 | 0.977 | 0.978 | 0.975 | 0.977 | 0.978 | 0.7 | 0.71 | 0.975
| 16b Detector’s F1 Score | 0.955 | 0.936 | 0.954 | 0.956 | 0.958 | 0.954 | 0.954 | 0.628 | 0.611 | 0.956
12b Edge Detector Classifier: ResNet18 | Error R / Error B |  0 / 89 |  0 / 95 |  0 / 95 |  0 / 97 |  0 / 91 |  0 / 82 |  0 / 80 |  15 / 94 |  20 / 77 |  0 / 71
Accuracy R / Accuracy B | 50 / 53 | 50 / 53 | 50 / 53 | 50 / 53 | 50 / 53 | 50 / 53 | 50 / 53 | 50 / 53 | 50 / 53 | 50 / 53
12b Detector’s AUC Score | 0.98 | 0.973 | 0.973 | 0.98 | 0.972 | 0.973 | 0.98 | 0.67 | 0.67 | 0.98
| 12b Detector’s F1 Score | 0.955 | 0.936 | 0.954 | 0.956 | 0.958 | 0.954 | 0.954 | 0.628 | 0.611 | 0.956

TABLE II: Table comparing the Error, Accuracy AUC and F1 scores of RobustEdge-
based classifer-edge systems with 16b and 12b detectors across different
adversarial attacks for CIFAR100 and TinyImagenet datasets against the
“Baseline”. “R” and “B” denote RobustEdge and “Baseline” systems,
respectively. We use classifier VGG19 model for CIFAR100 and ResNet18 for
TinyImagenet trained on natural data using standard SGD. Note, the accuracy
remains constant for all adversarial attacks as it is computed for natural
samples. For a specific attack, the highest AUC score is highlighted in bold.

As seen in Table II, the RobustEdge based classifier-edge systems with 16b and
12b QES trained detectors achieve Error= 0 and near iso-Accuracy compared to
the “Baseline” (see Section VI-A). Here, the evaluations are based on white-
box attacks (refer Section VI-A3). For both “Baseline” and RobustEdge
scenarios, the classifier on the cloud is a VGG19 model for CIFAR100 and
ResNet18 model for TinyImagenet trained only on natural data using SGD
algorithm. Note, the “Baseline” has $p=1$, $q=1$ and $E_{D}=0$ and therefore
incurs high Error. RobustEdge achieves significantly high AUC and F1 scores
($>$0.9 for gradient and $>0.7$ for score-based attacks) which significantly
reduces the Error rate while maintaining near iso-Accuracy performance.
Adversarial detection at the edge minimizes the communication of adversarial
samples ($q$= 0) while maximizing the communication of natural samples to the
classifier (p$\sim$1).

|
---|---
|

Figure 5: Figure showing the $E_{T,A}$, $E_{T,N}$ and $E_{D}$ for the
“Baseline” and RobustEdge-based classifier-edge systems with different
quantized detectors implemented at the edge. Here, the detectors are
implemented on the 45nm CMOS hardware accelerator shown in Fig. 4. Energy
results correspond to (a) PGD16 attacks CIFAR100 (b) PGD4 attacks CIFAR100 (c)
PGD16 attacks TinyImagenet (d) PGD4 attacks TinyImagenet datasets. In all
cases, $N_{nat}=N_{adv}=10k$. $E_{D}$ is computed using Eq. 5 with parameters
in Table I

From Fig. 5, we find that due to high adversarial detection, the RobustEdge-
based classifier-edge systems with 16b and 12b edge detectors achieve
$E_{T,A}$= 0 (as $q=0$) and $E_{T,N}$ close to the $E_{T,N}$ of the “Baseline”
(as $p\sim$1). Additionally, due to “early-detection and exit”, the detection
energy $E_{D}$ is significantly low. For lower bit precision detectors (8b, 6b
and 4b) the system incurs higher $E_{T,A}$ and $E_{D}$ compared to 16b and 12b
detectors due to poor adversarial detection and less frequent “early-detection
and exit” (leading to higher computations).

###  VI-C Performance under Black-Box Attacks

| Scenario 1 | Scenario 2 | Scenario 3
---|---|---|---
$DNN_{QES}\rightarrow$ | MobileNet-V2 | ResNet18 | VGG16
$DNN_{Test}\rightarrow$ |  ResNet18 |  VGG16 |  VGG16 |  MobileNet-V2 |  ResNet18 |  MobileNet-V2
FGSM [22] BIM [22] PGD8 [9] PGD4 [9] PGDL2 [9] FFGSM [24] TPGD [26] MIFGSM [23] DIFGSM [25] C&W [27] SQR [21] APGD [28] AUTO [28] GN |  0.97 0.97 0.97 0.97 0.95 0.97 0.97 0.97 0.97 0.71 0.71 0.68 0.71 0.97 |  0.97 0.97 0.97 0.97 0.97 0.97 0.97 0.97 0.97 0.67 0.67 0.67 0.67 0.97 |  0.97 0.97 0.97 0.97 0.97 0.97 0.97 0.97 0.97 0.67 0.67 0.67 0.67 0.97 |  0.97 0.97 0.97 0.97 0.95 0.97 0.97 0.97 0.97 0.71 0.71 0.68 0.71 0.97 |  0.98 0.98 0.98 0.97 0.92 0.98 0.98 0.98 0.98 0.75 0.75 0.74 0.75 0.98 |  0.97 0.97 0.97 0.97 0.95 0.97 0.97 0.97 0.97 0.73 0.72 0.68 0.7 0.98

TABLE III: Table showing the AUC scores for different detectors trained on the
TinyImagenet dataset. $DNN_{QES}$ and $DNN_{Test}$ are the DNN models used for
generating adversarial attacks during QES training and test times.

QES-trained detectors achieve high detection performance under black-box
scenarios. In Table III we test 16-bit QES-trained detectors under three
black-box attack scenarios for the TinyImagenet dataset. In Scenario 1, the
detector is created using adversarial samples generated from $DNN_{QES}$=
MobileNet-V2 model (the MobileNet-V2 model is trained on natural data using
SGD) and tested on adversarial data generated using $DNN_{Test}$= ResNet18 and
VGG16 models (trained on natural data using SGD). Similarly, for scenarios 2
and 3, the $DNN_{QES}$ are ResNet18 and VGG16, respectively with $DNN_{Test}$
models chosen accordingly. Interestingly, we observe that the QES-trained
detectors have high AUC scores across different gradient and score-based
adversarial attacks irrespective of the $DNN_{QES}$ or $DNN_{Test}$ models.
Similar observations are made on the CIFAR10 and CIFAR100 datasets.

###  VI-D Comparison with Prior Works

Work | Dataset | PGD4 | PGD16 | #Params | #Ops
---|---|---|---|---|---
Metzen et al. [10] | CIFAR10 | 0.96 | N-R | 312x | 17x
Moitra et al. [13] | CIFAR10 | 0.88 | 0.895 | 0.3x | 0.29x
Sterneck et al. [11] | CIFAR10 | 0.998 | 1 | 98x | 6.4x
Xu et al. [12] | CIFAR10 | 0.505 | N-R | 338x | 82x
RobustEdge | CIFAR10 | 0.98 | 0.98 | 1x | 1x
Sterneck et al. [11] | CIFAR100 | 0.99 | 1 | 98x | 6.4x
Moitra et al. [13] | CIFAR100 | 0.64 | 0.98 | 0.3x | 0.29x
RobustEdge | CIFAR100 | 0.97 | 0.98 | 1x | 1x
Moitra et al. [13] | TinyImagenet | 0.56 | 0.65 | 0.3x | 0.29x
RobustEdge | TinyImagenet | 0.98 | 0.98 | 1x | 1x

TABLE IV: Table comparing the AUC scores, parameter and operation footprint of
16b RobustEdge detector with prior state-of-the-art detection works. The
number of parameters and operations are normalized with respect to RobustEdge.
“N-R” denotes “Not-Reported” AUC scores in prior works.

Prior detection works such as Xu et al [12] use the outputs of multiple
trained classifier DNNs to perform adversarial detection. Recently, works by
Metzen et al. [10] and Sterneck et al. [11] propose to train binary detector
networks on intermediate layer activations of the DNN classifier for
adversarial detection. Another work, DetectX [13] proposes to train the first
convolution layer of a classifier for adversarial detection using current
signatures in analog crossbar arrays. All prior detection works have the
following characteristics: 1) The detector models are attached to the
classifier model and hence detection always occurs at the classifier (high
$E_{T,A}$). 2) Both the classifier model and detector execute simultaneously
to perform adversarial detection (high $E_{D}$). This makes them unsuitable
for low power edge implementations.

In RobustEdge, the detector is significantly small and is detached from the
classifier model. Under white-box attack scenarios, as seen in Table IV,
RobustEdge achieves similar or higher detection performance at extremely low
parameter and operation footprint ($100\times$ and $10\times$ lesser
parameters and operations, respectively compared to [12], [10] and [11])
compared to prior detection works. Note, although RobustEdge’s parameter and
operation footprint is slightly higher compared to Moitra et al. [13], we
achieve significantly higher detection performance (Table IV).

---
(a)
(b)

Figure 6: (a) $E_{T,A}$, $E_{T,N}$ and $E_{D}$ comparison of RobustEdge with
prior works [10, 11]. $E_{T,A}$, $E_{T,N}$ and $E_{D}$ are computed under PGD8
attacks, $N_{nat}$=$N_{adv}$=10k for CIFAR100 dataset. (b) Detection AUC
scores for different prior works [11, 13] under black-box PGD8 attacks for the
CIFAR100 dataset.
---
Figure 7: AUC scores corresponding to different adversarial attacks for
detectors created using QES training with 10% , 40% and 60% of the
TinyImagenet dataset.

Fig. 6a compares the $E_{T,A}$, $E_{T,N}$ and $E_{D}$ of a RobustEdge-based
classifier-edge system having a 16b edge detector with prior works- Sterneck
et al [11] and Metzen et al. [10]. The detector appended classifier models of
Sterneck et al. [11] and Metzen et al. [10] are implemented on the cloud as
shown in Fig. 1b. The cloud implementation is performed on a 45nm CMOS Eyeriss
DNN accelerator proposed in [29] for a fair energy evaluation. As both prior
works [11, 10] perform adversarial detection at the classifier, natural and
adversarial data are transmitted from edge to the classifier ($p$= 1 $q$= 1)
leading to high $E_{T,A}$. Further, $E_{D}$ in Sterneck et al. [11] and Metzen
et al. [10], are $25\times$ and $64\times$ greater than RobustEdge. This is
because Sterneck et al [11] and Metzen et al [10] append detector networks at
the end of 5th and 11th convolution layers, respectively. Thus, they entail
huge computation overhead for detection (4/7 convolution layers and the
detector networks).

Comparison under Black-box Attacks As seen in Fig. 6b, a 16b QES-trained
detector shows high performance against black-box PGD8 attacks compared to
Sterneck et al. [11] and Moitra et al on the CIFAR100 dataset. [13]. For both
prior works, the detector appended to a VGG19 model was trained on natural and
adversarial data $x_{adv}$ using the VGG19 model. For RobustEdge, the detector
was trained on natural and adversarial data generated using VGG19 model.
Additionally, the black-box attacks are generated using a ResNet18 model
trained on natural data using SGD.

###  VI-E QES-Training with Limited Training Data

Fig. 7 shows the AUC scores of detectors created using 1) 10% 2) 40% and 3)
60% of the TinyImagenet dataset. The subsets are created by randomly sampling
from the actual dataset. For reference, we also show the performance of the
detector trained on the full dataset. In all cases, the detectors are trained
and tested on adversarial data created using ResNet18 model (white-box
attacks). It can be observed that detectors trained with just 40% of the
training data can achieve AUC scores comparable with the detector trained on
the full data. Interestingly, for some attacks (such as GN) merely 10% of the
training data is sufficient for achieving a high performance. Similar
observations are made on the CIFAR10 and CIFAR100 datasets.

###  VI-F Transferability Across Datasets

In this section, we explore the following question: Can a detector trained on
dataset A (source dataset) be used to detect adversaries from another dataset
B (target dataset)?. Methodology:  The source dataset is used to train the
weights of a three-layered detector network using QES training. For detector
transferability, the layer-specific confidence boundaries ($\mathcal{E}_{i,L}$
and $\mathcal{E}_{i,U}$) and the threshold energies $\mathcal{E}_{n,Th}$ are
fine-tuned based on the target dataset (in the “Confidence Boundary
Generation” section of Algorithm 1) . For this, sample data $s_{nat,target}$
is sampled from the target dataset. $s_{nat,target}$ is forwarded through the
detector layers creating $\Psi_{i,s,target}$ energy distributions.
$\Psi_{i,s,target}$ is used to compute $\mathcal{E}_{i,L}$,
$\mathcal{E}_{i,U}$ and $\mathcal{E}_{n,Th}$. Through our experiments, we find
that a size of 200 samples for $s_{nat,target}$ data is sufficient to fine-
tune the layer-specific confidence boundary and threshold energy for the
target dataset.

---
(a)
(b)
Figure 8: AUC scores for (a) detector trained with source dataset TinyImagenet
and transferred to target datasets CIFAR10 and CIFAR100 (b) detector trained
with source dataset CIFAR100 and transferred to target datasets CIFAR10 and
TinyImagenet

Transferability Results: Fig. 8a shows the detection performance of a detector
trained on TinyImagenet as the source dataset and transferred to target
datasets CIFAR10 and CIFAR100. Here, all the evaluations are based on white-
box attacks. Evidently, the detector shows high AUC scores across different
adversarial attacks when transferred to CIFAR10 and CIFAR100 datasets.
Interestingly, a detector trained on CIFAR100 as the source dataset transfers
well to CIFAR10 dataset but does not transfer well to a TinyImagenet dataset
as seen in Fig. 8b.

###  VI-G Ablation Studies

####  VI-G1 Detector Architecture and Performance.

| Detector | Layer1 | Layer2 | Layer3
---|---|---|---
$\mathcal{D}_{1}$ | C(3,8) - R | C(8,16) - R | C(16,32)
$\mathcal{D}_{2}$ | C(3,16) - R | C(16,32) - R | C(32,64)
$\mathcal{D}_{3}$ | C(3,32) - R | C(32,32) - R | C(32,64)

Figure 9: (Top) Table showing different 3-layered detector architectures
$\mathcal{D}_{1}$, $\mathcal{D}_{2}$, $\mathcal{D}_{3}$. C(n,m)-R denotes a
convolution layer with n input and m output channels followed by ReLU layer.
(Bottom) AUC scores and $E_{D}$ for PGD8 and PGD4 attacks for
$\mathcal{D}_{1}$, $\mathcal{D}_{2}$, $\mathcal{D}_{3}$ detectors shown in
(a). AUC and $E_{D}$ is computed using $N_{nat}$=$N_{adv}$=10k data sampled
from the CIFAR100 training set.

In this section we perform an ablation to understand the significance of
network architecture on performance and $E_{D}$. Interestingly, Fig. 9 shows
that a narrow detector $\mathcal{D}_{1}$ ($\mathcal{D}_{1}$ has the smallest
number of output channels in its network compared to $\mathcal{D}_{2}$ and
$\mathcal{D}_{3}$) in fact achieves the highest detection compared to wider
detectors ($\mathcal{D}_{2}$, and $\mathcal{D}_{3}$). Being narrow,
$\mathcal{D}_{1}$ also achieves the lowest $E_{D}$ compared to other
detectors. Further, increasing the detector depth $>$3 only improves the
performance marginally while incurring higher $E_{D}$. Thus, the depth is set
to 3.

####  VI-G2 Choosing $K$, $L$ and $U$ values

Figure 10: Figure showing the AUC scores and $E_{D}$ of the 16b Detector Z
against different values of $L$ and $K$ at $U$= 5. All results correspond to
PGD4 attacks on data from the CIFAR100 training set. Here,
$N_{nat}$=$N_{adv}$=10k.  Figure 11: AUC scores for different 16b detectors
trained with different $\lambda_{a}$ values at $\lambda_{n}$= 0.1. AUC scores
correspond to PGD4 attacks (CIFAR100 training set data) for Detector Z and
$K$=92, $L$= 30, $U$= 5.

The values of $K$, $L$ and $U$ determine the performance and energy efficiency
of the detector (see Section IV-A for definition). As seen in Fig. 10, we
achieve the best tradeoff between $E_{D}$ and adversarial detection for
$K$=92, $L$= 30 and $U$= 5. Smaller $L$ ($L$= 5, 10, 20) implies confident
early exits in the initial layers leading to low $E_{D}$ but poor AUC scores
irrespective of the $K$ value. At larger $L$ ($L$= 30 or 40), increasing $K$
leads to slightly higher AUC scores at the cost of higher $E_{D}$.

####  VI-G3 Choosing $\lambda_{n}$ and $\lambda_{a}$

Fig. 11 shows the AUC scores for a 16b detector trained with different
$\lambda_{a}$ values for layer 1 (refer Section IV-A for definitions of
$\lambda_{n}$ and $\lambda_{a}$). Highest AUC score is seen for
$\lambda_{a}=0.9$. For layers 2 and 3, the $\lambda_{a}$ values must be higher
than layer 1 to achieve higher energy separation. Therefore, $\lambda_{a}$ for
layer 2 and 3 are incremented by 0.4 and 1.1 with respect to layer 1’s
$\lambda_{a}$. The best AUC score is obtained for $\lambda_{n}$= 0.1 and
$\lambda_{a}$=0.9, 1.3 and 2 for training layers 1, 2 and 3, respectively.

###  VI-H Raspberry Pi 4 Implementation

Compute Current | 120mA
---|---
Latency L1, (L1+L2), (L1+L2+L3) | 0.3ms, 0.6ms, 1.3ms
WiFi Current | 160mA
WiFi Latency (CIFAR100) | 3.5ms
Supply Voltage | 12V
Energy = Voltage $\times$ Current $\times$ latency
TABLE V: Current, voltage and latency of the Raspberry-Pi implementation.
Latency with early exits at layer1, layer2 and layer3 are shown by L1, (L1+L2)
and (L1+L2+L3), respectively. Figure 12: Figure showing the Raspberry-Pi setup
used for the demonstration.
---
Figure 13: $E_{T,A}$, $E_{T,N}$ and $E_{D}$ comparison between “Baseline” and
classifier-edge system with a 16b QES-trained detector implemented on a
Raspberry-Pi-4 edge device. The results correspond to the CIFAR100 dataset
under PGD4 attacks. The energy is computed for processing 10k natural and 10k
adversarial samples.

We implement the 16b 3-layered QES-trained detector on the Raspberry-Pi 4
platform. The detectors are deployed using Tensorflow v2.5 running on
Raspberry Pi OS. Table V shows the current, voltage and latency of the
implementation. The data transmission (to a remote cloud GPU (RTX2080Ti) in
our case) takes place over WiFi. Fig. 12 shows the Raspberry-Pi 4 setup. The
HDMI and USBs are used for the display and keyboard/mouse, respectively. The
ethernet is used for adversarial and natural data acquisition. The adversarial
detection occurs inside Raspberry-Pi 4’s Cortex A7 processor and the natural
data transmission to the cloud occurs via the in-built WiFi module. We use a
current clamp meter to measure the current drawn by the Raspberry-Pi. In Fig.
12 the clamp meter shows the idle-state current drawn by the Raspberry-pi-4.
During adversarial detection, the current rises to 557mA ($\therefore$ compute
current = 120mA). While the current rises to 720mA when data transmission over
WiFi is activated along with adversarial detection ($\therefore$ WiFi current
= 160mA). Additionally to compute the latency, we measure the run time of
detection using the $time()$ function in Tensorflow. The latency values are
shown in Table V. For a detector without early exit, the latency equals
(L1+L2+L3) as shown in Table V.

From Fig. 13, we find that the QES-trained detector with “early detection and
exit” entails negligible cost due to adversarial data transmission ($E_{T,A}$=
0). However, the detection cost ($E_{D}$) is significantly high. This is
because unlike systolic array accelerator, Raspberry-Pi’s architecture entails
higher number of energy-intensive DRAM accesses. It must be noted that “early-
detection and exit” is highly advantageous here as it reduces the detection
cost by 66% compared to detection without early-exit.

##  VII Conclusion

RobustEdge proposes QES-training with “Early detection and Exit” to perform
low power edge-based adversarial detection. The QES-trained detector is
implemented on a 45nm CMOS digital hardware accelerator. The edge detector
achieves state-of-the-art AUC score $>$ 0.9 against standard gradient-based
white-box and black-box attacks at extremely small detection energy
($<25\times$ compared to prior works). Interestingly, a detector trained on
gradient-based attacks has high detection score against score-based attacks
(AUC score $>$0.7). Further, it is shown to improve the energy efficiency of a
realistic cloud-edge system by $>166\times$ compared to prior works. Being
transferable across datasets, a detector trained on one dataset can be reused
to detect adversaries on another dataset thereby saving the training cost and
adding to the energy efficiency.

## Acknowledgement

This work was supported in part by CoCoSys, a JUMP2.0 center sponsored by
DARPA and SRC, Google Research Scholar Award, the National Science Foundation
CAREER Award, TII (Abu Dhabi), and the DoE MMICC center SEA-CROGS (Award#DE-
SC0023198).

## References

  * [1] S. Madria _et al._ , “Sensor cloud: A cloud of virtual sensors,” _IEEE software_ , vol. 31, no. 2, pp. 70–77, 2013.
  * [2] A. E. Eshratifar, A. Esmaili, and M. Pedram, “Bottlenet: A deep learning architecture for intelligent mobile cloud computing services,” in _2019 IEEE/ACM International Symposium on Low Power Electronics and Design (ISLPED)_. IEEE, 2019, pp. 1–6.
  * [3] M. Othman, S. A. Madani, S. U. Khan _et al._ , “A survey of mobile cloud computing application models,” _IEEE communications surveys & tutorials_, vol. 16, no. 1, pp. 393–413, 2013.
  * [4] M. Xue, H. Wu, G. Peng, and K. Wolter, “Ddpqn: An efficient dnn offloading strategy in local-edge-cloud collaborative environments,” _IEEE Transactions on Services Computing_ , vol. 15, no. 2, pp. 640–655, 2021.
  * [5] M. Xue, H. Wu, R. Li, M. Xu, and P. Jiao, “Eosdnn: An efficient offloading scheme for dnn inference acceleration in local-edge-cloud collaborative environments,” _IEEE Transactions on Green Communications and Networking_ , vol. 6, no. 1, pp. 248–264, 2021.
  * [6] S. Yu, X. Wang, and R. Langar, “Computation offloading for mobile edge computing: A deep learning approach,” in _2017 IEEE 28th Annual International Symposium on Personal, Indoor, and Mobile Radio Communications (PIMRC)_. IEEE, 2017, pp. 1–6.
  * [7] L. Huang, X. Feng, A. Feng, Y. Huang, and L. P. Qian, “Distributed deep learning-based offloading for mobile edge computing networks,” _Mobile networks and applications_ , pp. 1–8, 2018.
  * [8] S. Huang _et al._ , “Adversarial attacks on neural network policies,” _arXiv preprint arXiv:1702.02284_ , 2017.
  * [9] A. Madry _et al._ , “Towards deep learning models resistant to adversarial attacks,” _arXiv preprint arXiv:1706.06083_ , 2017.
  * [10] J. H. Metzen _et al._ , “On detecting adversarial perturbations,” _arXiv preprint arXiv:1702.04267_ , 2017.
  * [11] R. Sterneck _et al._ , “Noise sensitivity-based energy efficient and robust adversary detection in neural networks,” _IEEE Transactions on Computer-Aided Design of Integrated Circuits and Systems_ , 2021.
  * [12] W. Xu _et al._ , “Feature squeezing: Detecting adversarial examples in deep neural networks,” _arXiv preprint arXiv:1704.01155_ , 2017.
  * [13] A. Moitra _et al._ , “Detectx—adversarial input detection using current signatures in memristive xbar arrays,” _IEEE Transactions on Circuits and Systems I: Regular Papers_ , vol. 68, no. 11, pp. 4482–4494, 2021.
  * [14] K. Grosse, P. Manoharan, N. Papernot, M. Backes, and P. McDaniel, “On the (statistical) detection of adversarial examples,” _arXiv preprint arXiv:1702.06280_ , 2017.
  * [15] J. Zheng _et al._ , “Dynamic computation offloading for mobile cloud computing: A stochastic game-theoretic approach,” _IEEE Transactions on Mobile Computing_ , vol. 18, no. 4, pp. 771–786, 2018.
  * [16] V. Sundararaj, “Optimal task assignment in mobile cloud computing by queue based ant-bee algorithm,” _Wireless Personal Communications_ , vol. 104, no. 1, pp. 173–197, 2019.
  * [17] E. Li _et al._ , “Edge intelligence: On-demand deep learning model co-inference with device-edge synergy,” in _Proceedings of the 2018 Workshop on Mobile Edge Communications_ , 2018, pp. 31–36.
  * [18] C. Hu _et al._ , “Dynamic adaptive dnn surgery for inference acceleration on the edge,” in _IEEE INFOCOM 2019-IEEE Conference on Computer Communications_. IEEE, 2019, pp. 1423–1431.
  * [19] W. He _et al._ , “Joint dnn partition deployment and resource allocation for delay-sensitive deep learning inference in iot,” _IEEE Internet of Things Journal_ , vol. 7, no. 10, pp. 9241–9254, 2020.
  * [20] J. Xiong, P. Guo, Y. Wang, X. Meng, J. Zhang, L. Qian, and Z. Yu, “Multi-agent deep reinforcement learning for task offloading in group distributed manufacturing systems,” _Engineering Applications of Artificial Intelligence_ , vol. 118, p. 105710, 2023.
  * [21] M. Andriushchenko, F. Croce, N. Flammarion, and M. Hein, “Square attack: a query-efficient black-box adversarial attack via random search,” in _European Conference on Computer Vision_. Springer, 2020, pp. 484–501.
  * [22] A. Kurakin, I. Goodfellow, S. Bengio _et al._ , “Adversarial examples in the physical world,” 2016.
  * [23] Y. Dong _et al._ , “Boosting adversarial attacks with momentum,” in _Proceedings of the IEEE conference on computer vision and pattern recognition_ , 2018, pp. 9185–9193.
  * [24] E. Wong, L. Rice, and J. Z. Kolter, “Fast is better than free: Revisiting adversarial training,” _arXiv preprint arXiv:2001.03994_ , 2020.
  * [25] C. Xie _et al._ , “Improving transferability of adversarial examples with input diversity,” in _Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition_ , 2019, pp. 2730–2739.
  * [26] H. Zhang, Y. Yu, J. Jiao, E. Xing, L. El Ghaoui, and M. Jordan, “Theoretically principled trade-off between robustness and accuracy,” in _International Conference on Machine Learning_. PMLR, 2019, pp. 7472–7482.
  * [27] N. Carlini and D. Wagner, “Towards evaluating the robustness of neural networks,” in _2017 ieee symposium on security and privacy (sp)_. IEEE, 2017, pp. 39–57.
  * [28] F. Croce and M. Hein, “Reliable evaluation of adversarial robustness with an ensemble of diverse parameter-free attacks,” in _International conference on machine learning_. PMLR, 2020, pp. 2206–2216.
  * [29] Y.-H. Chen _et al._ , “Eyeriss: An energy-efficient reconfigurable accelerator for deep convolutional neural networks,” _IEEE journal of solid-state circuits_ , vol. 52, no. 1, pp. 127–138, 2016.
  * [30] M. Guo, Y. Yang, R. Xu, Z. Liu, and D. Lin, “When nas meets robustness: In search of robust architectures against adversarial attacks,” in _Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition_ , 2020, pp. 631–640.
  * [31] Z. He, A. S. Rakin, and D. Fan, “Parametric noise injection: Trainable randomness to improve deep neural network robustness against adversarial attack,” in _Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition_ , 2019, pp. 588–597.
  * [32] J. Lin _et al._ , “Defensive quantization: When efficiency meets robustness,” _arXiv preprint arXiv:1904.08444_ , 2019.
  * [33] Z. Gong, W. Wang, and W.-S. Ku, “Adversarial and clean data are not twins,” _arXiv preprint arXiv:1704.04960_ , 2017.
  * [34] K. Lee, K. Lee, H. Lee, and J. Shin, “A simple unified framework for detecting out-of-distribution samples and adversarial attacks,” _Advances in neural information processing systems_ , vol. 31, 2018.
  * [35] X. Yin _et al._ , “Gat: Generative adversarial training for adversarial example detection and robust classification,” in _International conference on learning representations_ , 2019.
  * [36] B. Huang, Y. Wang, and W. Wang, “Model-agnostic adversarial detection by random perturbations.” in _IJCAI_ , 2019, pp. 4689–4696.
  * [37] J. Zhang _et al._ , “Frequency improvement of systolic array-based cnns on fpgas,” in _2019 IEEE International Symposium on Circuits and Systems (ISCAS)_. IEEE, 2019, pp. 1–4.
  * [38] J. Huang _et al._ , “A close examination of performance and power characteristics of 4g lte networks,” in _Proceedings of the 10th international conference on Mobile systems, applications, and services_ , 2012, pp. 225–238.


††thanks<EMAIL_ADDRESS><EMAIL_ADDRESS>
# Mixing in chaotic flows with swimming bacteria

Ranjiangshang Ran  Quentin Brosseau  Department of Mechanical Engineering and
Applied Mechanics, University of Pennsylvania, Philadelphia, PA 19104, USA
Brendan C. Blackwell  Department of Mechanical Engineering and Applied
Mechanics, University of Pennsylvania, Philadelphia, PA 19104, USA  Department
of Physics and Astronomy, Northwestern University, Evanston, IL 60208, USA
Boyang Qin  Department of Mechanical Engineering and Applied Mechanics,
University of Pennsylvania, Philadelphia, PA 19104, USA  Department of
Mechanical and Aerospace Engineering, Princeton University, Princeton, NJ
08544, USA  Rebecca L. Winter  Paulo E. Arratia  Department of Mechanical
Engineering and Applied Mechanics, University of Pennsylvania, Philadelphia,
PA 19104, USA

###### Abstract

This is a manuscript accepted for publication on Physical Review Fluids,
Gallery of Fluid Motion special issue. The manuscript is associated with a
poster winner of the 39th Annual Gallery of Fluid Motion Award, for work
presented at the 74th Annual Meeting of the American Physical Society’s
Division of Fluid Dynamics (Phoenix, AZ, USA 2021).

Figure 1: Intriguing dye mixing pattern produced by chaotic advection,
visualized by the dye concentration gradient field, $|\nabla C|$. Also plotted
on the left is the spatial distribution of the swimming bacteria; strong
accumulations of bacteria are found near dynamical flow structures. These flow
structures coincide with the exact same structures visualized by dye gradient
patterns. The size of the imaged region is $28~{}\mathrm{mm}\times 30~{}$mm.
The original image is available online at:
https://doi.org/10.1103/APS.DFD.2021.GFM.P0036.

How does the swimming motion of microorganisms affect the transport and mixing
properties of a passive scalar in complex flows? The answers to this question
can potentially improve our understanding of the spread of pollutants (e.g.
algal blooms, oil spills) in oceans and lakes, as well as stimulate the
development of useful applications in biofuel and vaccine productions. Fluid
flows can affect the swimming behaviors of microorganisms, causing them to
form aggregates, clusters and patches near flow structures [1]; these
aggregates or clusters, in turn, can change the local fluid properties and
alter the fluid flows [2]. Such flow-microorganism interaction gives rise to
unique transport and mixing phenomena of active swimming particles that are
not observed for passive particles.

In our experiments, we investigate the effects of activity on the chaotic
mixing of a passive scalar in dilute suspensions of Escherichia coli. Figure
2(a) shows the experimental setup, where a thin layer of active suspension is
placed above an array of magnets of alternating polarity. As a sinusoidal
voltage is imposed, the induced Lorentz force creates a cellular flow with an
array of vortices, the flow field of which is shown in Fig. 2(b). Half of the
fluid layer is initially labelled by a fluorescent dye (the passive scalar).
The dye is illuminated under black light, and recorded by a high-resolution
camera (Flare 4M180) operating at 5 frames per second and $2000^{2}$-pixel
resolution. A UV-light filter (Tiffen, Yellow 12) is used such that the light
intensity is accurately proportional to the dye concentration field, $C$. More
details on the experimental setup can be found in [2]. As the flow is turned
on, the labelled fluid progressively penetrates to the unlabelled portion and
produces complex dye mixing patterns.

Figure 2: (a) Schematic of the flow cell apparatus. A thin layer of saline
water containing swimming Escherichia coli is placed above an array of magnets
of alternating polarity, illustrated by different colors. As a sinusoidal
voltage is imposed through the electrodes, the induced Lorentz force of the
migrating ions in the fluid layer creates chaotic mixing. The right half of
the fluid layer is initially labeled with fluorescent dye. (b) Vorticity field
(colormap) and velocity field (arrows) of the mixing flow generated by the
flow cell. The imaged area is a $4\times 4$ portion of the $10\times 10$
vortex array, with a size of $24~{}\mathrm{mm}\times 24~{}$mm.

Figure 1 shows an intriguing dye mixing pattern produced by the flow. The
pattern is calculated from the gradient magnitude of the dye concentration
field, $|\nabla C|$, which characterizes the regions of high passive scalar
transport and coincide with the dynamical structures of the flow [3]. These
flow structures, known as Lagrangian coherent structures (LCSs), are regions
of locally extremal flow strain that maximally attract or repel nearby fluid
particle trajectories [4]. It has been recently shown that active particles
can interact with these LCSs [5]. Here, we demonstrate such interactions by
showing bacteria accumulation along the exact same flow structures that are
also visualized by the concentration gradient field (Fig. 1, left). We further
show that such accumulation near the dynamical flow structures have nontrivial
effects on the transport and mixing of the contaminant, both locally and
globally; see details in [2].

This work was supported by the US National Science Foundation (NSF) through
Grant No. DMR-1709763.

## References

  * Wheeler  _et al._ [2019] J. D. Wheeler, E. Secchi, R. Rusconi, and R. Stocker, Not just going with the flow: The effects of fluid flow on bacteria and plankton, Annu. Rev. Cell Dev. Biol. 35, 213 (2019).
  * Ran  _et al._ [2021] R. Ran, Q. Brosseau, B. C. Blackwell, B. Qin, R. L. Winter, and P. E. Arratia, Bacteria hinder large-scale transport and enhance small-scale mixing in time-periodic flows, Proc. Natl. Acad. Sci. U.S.A. 118, e2108548118 (2021).
  * Voth  _et al._ [2002] G. A. Voth, G. Haller, and J. P. Gollub, Experimental measurements of stretching fields in fluid mixing, Phys. Rev. Lett. 88, 254501 (2002).
  * Peacock and Haller [2013] T. Peacock and G. Haller, Lagrangian coherent structures: The hidden skeleton of fluid flows, Phys. Today 66, 41 (2013).
  * Khurana and Ouellette [2012] N. Khurana and N. T. Ouellette, Interactions between active particles and dynamical structures in chaotic flow, Phys. Fluids 24, 091902 (2012).