Input-Aware Slowdown Backdoor Attack on Dynamic Neural Networks

Dynamic neural networks (DyNNs) are able to adapt their executions/routines according to various difficulties of inputs while not significantly sacrificing accuracy. Such adaptivity makes them an emerging alternative of efficient networks for resource-constraint devices, thus receiving increasing attention. However, the adaptivity also poses a new robust challenge to DyNNs, i.e., efficiency or slowdown attacks which stealthily manipulate inputs to slow down DyNNs, thus undermining the superiority of DyNNs. In this paper, we investigate the slowdown backdoor attack on DyNNs and propose a new attack method. Different from the state of the art, the proposed attack method implements input-aware backdoor triggers, which are generated using two generators from a generator-discriminator architecture. We extensively evaluate the proposed attack method in comparison with the state of the art. Experimental results show that our attack method can achieve better attack effectiveness in terms of two slowdown attack metrics. The poisoned model significantly increases the average number of computational blocks by up to 4.4 times over the clean counterpart while only slightly degrading the accuracy and efficiency of the model under clean data. Our code and models are available at https://github.com/zhiqianguan/dynn_backdoor .