{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2024,9,15]],"date-time":"2024-09-15T22:41:50Z","timestamp":1726440110544},"publisher-location":"New York, NY, USA","reference-count":62,"publisher":"ACM","funder":[{"name":"National Key R&D Program of China","award":["2021YFB2900100"]},{"DOI":"10.13039\/501100001809","name":"National Natural Science Foundation of China","doi-asserted-by":"publisher","award":["62002294, U22B2022"],"id":[{"id":"10.13039\/501100001809","id-type":"DOI","asserted-by":"publisher"}]}],"content-domain":{"domain":["dl.acm.org"],"crossmark-restriction":true},"short-container-title":[],"published-print":{"date-parts":[[2023,7,10]]},"DOI":"10.1145\/3591197.3591307","type":"proceedings-article","created":{"date-parts":[[2023,6,9]],"date-time":"2023-06-09T14:58:49Z","timestamp":1686322729000},"page":"1-11","update-policy":"http:\/\/dx.doi.org\/10.1145\/crossmark-policy","source":"Crossref","is-referenced-by-count":0,"title":["Energy-Latency Attacks to On-Device Neural Networks via Sponge Poisoning"],"prefix":"10.1145","author":[{"ORCID":"http:\/\/orcid.org\/0009-0006-0839-6531","authenticated-orcid":false,"given":"Zijian","family":"Wang","sequence":"first","affiliation":[{"name":"Monash University, Australia"}]},{"ORCID":"http:\/\/orcid.org\/0009-0008-3736-3207","authenticated-orcid":false,"given":"Shuo","family":"Huang","sequence":"additional","affiliation":[{"name":"Northwestern Polytechnical University, China and Monash University, Australia"}]},{"ORCID":"http:\/\/orcid.org\/0000-0003-2281-2504","authenticated-orcid":false,"given":"Yujin","family":"Huang","sequence":"additional","affiliation":[{"name":"Monash University, Australia"}]},{"ORCID":"http:\/\/orcid.org\/0000-0003-1946-5361","authenticated-orcid":false,"given":"Helei","family":"Cui","sequence":"additional","affiliation":[{"name":"Northwestern Polytechnical University, China"}]}],"member":"320","published-online":{"date-parts":[[2023,7,10]]},"reference":[{"key":"e_1_3_2_1_1_1","volume-title":"Deep learning using rectified linear units (relu). arXiv preprint arXiv:1803.08375","author":"Agarap Abien\u00a0Fred","year":"2018","unstructured":"Abien\u00a0Fred Agarap. 2018. Deep learning using rectified linear units (relu). arXiv preprint arXiv:1803.08375 (2018)."},{"key":"e_1_3_2_1_2_1","volume-title":"2nd USENIX Conference on File and Storage Technologies (FAST 03)","author":"Anderson Dave","year":"2003","unstructured":"Dave Anderson and Jim Dykes. 2003. More Than an { Interface\u2014SCSI} vs.{ ATA}. In 2nd USENIX Conference on File and Storage Technologies (FAST 03)."},{"key":"e_1_3_2_1_3_1","volume-title":"12th USENIX Security Symposium (USENIX Security 03)","author":"Bellardo John","year":"2003","unstructured":"John Bellardo and Stefan Savage. 2003. 802.11 { Denial-of-Service} Attacks: Real Vulnerabilities and Practical Solutions. In 12th USENIX Security Symposium (USENIX Security 03)."},{"key":"e_1_3_2_1_4_1","unstructured":"David Brazdil. 2018. Improving Stability by Reducing Usage of non-SDK Interfaces. https:\/\/android-developers.googleblog.com\/2018\/02\/improving-stability-by-reducing-usage.html"},{"key":"e_1_3_2_1_5_1","doi-asserted-by":"publisher","DOI":"10.1016\/j.mlwa.2021.100134"},{"key":"e_1_3_2_1_6_1","doi-asserted-by":"publisher","DOI":"10.1145\/3398209"},{"key":"e_1_3_2_1_7_1","doi-asserted-by":"publisher","DOI":"10.1109\/JETCAS.2019.2910232"},{"key":"e_1_3_2_1_8_1","volume-title":"Serving dnns in real time at datacenter scale with project brainwave. iEEE Micro 38, 2","author":"Chung Eric","year":"2018","unstructured":"Eric Chung, Jeremy Fowers, Kalin Ovtcharov, Michael Papamichael, Adrian Caulfield, Todd Massengill, Ming Liu, Daniel Lo, Shlomi Alkalay, Michael Haselman, 2018. Serving dnns in real time at datacenter scale with project brainwave. iEEE Micro 38, 2 (2018), 8\u201320."},{"key":"e_1_3_2_1_9_1","volume-title":"Energy-latency attacks via sponge poisoning. arXiv preprint arXiv:2203.08147","author":"Cin\u00e0 Antonio\u00a0Emanuele","year":"2022","unstructured":"Antonio\u00a0Emanuele Cin\u00e0, Ambra Demontis, Battista Biggio, Fabio Roli, and Marcello Pelillo. 2022. Energy-latency attacks via sponge poisoning. arXiv preprint arXiv:2203.08147 (2022)."},{"key":"e_1_3_2_1_10_1","unstructured":"Antonio\u00a0Emanuele Cin\u00e0 Kathrin Grosse Ambra Demontis Battista Biggio Fabio Roli and Marcello Pelillo. 2022. Machine Learning Security against Data Poisoning: Are We There Yet?"},{"key":"e_1_3_2_1_11_1","volume-title":"Infographic: Global Smartphone AP Market Share | Q2","author":"TEAM","year":"2022","unstructured":"TEAM COUNTERPOINT. 2022. Infographic: Global Smartphone AP Market Share | Q2 2022. https:\/\/www.counterpointresearch.com\/infographic-global-smartphone-ap-market-share-q2-2022\/"},{"key":"e_1_3_2_1_12_1","volume-title":"Deconvolution of pulse trains with the L0 penalty. Analytica chimica acta 705, 1-2","author":"de Rooi Johan","year":"2011","unstructured":"Johan de Rooi and Paul Eilers. 2011. Deconvolution of pulse trains with the L0 penalty. Analytica chimica acta 705, 1-2 (2011), 218\u2013226."},{"key":"e_1_3_2_1_13_1","doi-asserted-by":"publisher","DOI":"10.1109\/ICCV48922.2021.01175"},{"key":"e_1_3_2_1_14_1","doi-asserted-by":"publisher","DOI":"10.1109\/ICCV.2015.316"},{"key":"e_1_3_2_1_15_1","doi-asserted-by":"publisher","DOI":"10.1109\/L-CA.2012.32"},{"key":"e_1_3_2_1_17_1","doi-asserted-by":"publisher","DOI":"10.1145\/3422622"},{"key":"e_1_3_2_1_18_1","volume-title":"Explaining and harnessing adversarial examples. arXiv preprint arXiv:1412.6572","author":"Goodfellow J","year":"2014","unstructured":"Ian\u00a0J Goodfellow, Jonathon Shlens, and Christian Szegedy. 2014. Explaining and harnessing adversarial examples. arXiv preprint arXiv:1412.6572 (2014)."},{"key":"e_1_3_2_1_19_1","volume-title":"Badnets: Identifying vulnerabilities in the machine learning model supply chain. arXiv preprint arXiv:1708.06733","author":"Gu Tianyu","year":"2017","unstructured":"Tianyu Gu, Brendan Dolan-Gavitt, and Siddharth Garg. 2017. Badnets: Identifying vulnerabilities in the machine learning model supply chain. arXiv preprint arXiv:1708.06733 (2017)."},{"key":"e_1_3_2_1_20_1","doi-asserted-by":"publisher","DOI":"10.5555\/3433701.3433722"},{"key":"e_1_3_2_1_21_1","doi-asserted-by":"publisher","DOI":"10.1145\/3442381.3449942"},{"key":"e_1_3_2_1_22_1","volume-title":"Hot Chips Symposium. 1\u20136.","author":"Han Song","year":"2016","unstructured":"Song Han, Xingyu Liu, Huizi Mao, Jing Pu, Ardavan Pedram, Mark Horowitz, Bill Dally, 2016. Deep compression and EIE: Efficient inference engine on compressed deep neural network.. In Hot Chips Symposium. 1\u20136."},{"key":"e_1_3_2_1_23_1","doi-asserted-by":"publisher","DOI":"10.1109\/HPCA.2018.00059"},{"key":"e_1_3_2_1_24_1","doi-asserted-by":"publisher","DOI":"10.1109\/ICCV.2019.00140"},{"key":"e_1_3_2_1_25_1","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2017.243"},{"key":"e_1_3_2_1_26_1","doi-asserted-by":"publisher","DOI":"10.1109\/ICCVW.2019.00447"},{"key":"e_1_3_2_1_27_1","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2018.00057"},{"key":"e_1_3_2_1_28_1","doi-asserted-by":"publisher","DOI":"10.1145\/3079856.3080246"},{"key":"e_1_3_2_1_29_1","doi-asserted-by":"publisher","DOI":"10.1109\/EuroSP.2019.00044"},{"key":"e_1_3_2_1_30_1","unstructured":"Alex Krizhevsky Geoffrey Hinton 2009. Learning multiple layers of features from tiny images. (2009)."},{"volume-title":"Artificial intelligence safety and security","author":"Kurakin Alexey","key":"e_1_3_2_1_31_1","unstructured":"Alexey Kurakin, Ian\u00a0J Goodfellow, and Samy Bengio. 2018. Adversarial examples in the physical world. In Artificial intelligence safety and security. Chapman and Hall\/CRC, 99\u2013112."},{"key":"e_1_3_2_1_32_1","doi-asserted-by":"publisher","DOI":"10.1109\/3DV.2016.32"},{"key":"e_1_3_2_1_33_1","doi-asserted-by":"publisher","DOI":"10.1145\/3007787.3001189"},{"key":"e_1_3_2_1_34_1","volume-title":"Backdoor embedding in convolutional neural network models via invisible perturbation. arXiv preprint arXiv:1808.10307","author":"Liao Cong","year":"2018","unstructured":"Cong Liao, Haoti Zhong, Anna Squicciarini, Sencun Zhu, and David Miller. 2018. Backdoor embedding in convolutional neural network models via invisible perturbation. arXiv preprint arXiv:1808.10307 (2018)."},{"key":"e_1_3_2_1_35_1","volume-title":"Efficient Sparse-Winograd Convolutional Neural Networks. CoRR abs\/1802.06367","author":"Liu Xingyu","year":"2018","unstructured":"Xingyu Liu, Jeff Pool, Song Han, and William\u00a0J. Dally. 2018. Efficient Sparse-Winograd Convolutional Neural Networks. CoRR abs\/1802.06367 (2018). arXiv:1802.06367http:\/\/arxiv.org\/abs\/1802.06367"},{"key":"e_1_3_2_1_36_1","unstructured":"Yingqi Liu Shiqing Ma Yousra Aafer Wen-Chuan Lee Juan Zhai Weihang Wang and Xiangyu Zhang. 2017. Trojaning attack on neural networks. (2017)."},{"key":"e_1_3_2_1_37_1","doi-asserted-by":"publisher","DOI":"10.1109\/FPT.2016.7929192"},{"key":"e_1_3_2_1_38_1","doi-asserted-by":"publisher","DOI":"10.1007\/s11227-014-1242-6"},{"key":"e_1_3_2_1_39_1","doi-asserted-by":"publisher","DOI":"10.1145\/3079856.3080254"},{"volume-title":"Survey on energy consumption entities on the smartphone platform. In 2011 IEEE 73rd vehicular technology conference (VTC Spring)","author":"Perrucci Gian\u00a0Paolo","key":"e_1_3_2_1_40_1","unstructured":"Gian\u00a0Paolo Perrucci, Frank\u00a0HP Fitzek, and J\u00f6rg Widmer. 2011. Survey on energy consumption entities on the smartphone platform. In 2011 IEEE 73rd vehicular technology conference (VTC Spring). IEEE, 1\u20136."},{"key":"e_1_3_2_1_41_1","doi-asserted-by":"publisher","DOI":"10.1109\/HPCA47549.2020.00015"},{"key":"e_1_3_2_1_42_1","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2018.00474"},{"key":"e_1_3_2_1_43_1","volume-title":"Advances in Neural Information Processing Systems, S.\u00a0Bengio, H.\u00a0Wallach, H.\u00a0Larochelle, K.\u00a0Grauman, N.\u00a0Cesa-Bianchi, and R.\u00a0Garnett (Eds.). Vol.\u00a031. Curran Associates","author":"Shafahi Ali","year":"2018","unstructured":"Ali Shafahi, W.\u00a0Ronny Huang, Mahyar Najibi, Octavian Suciu, Christoph Studer, Tudor Dumitras, and Tom Goldstein. 2018. Poison Frogs! Targeted Clean-Label Poisoning Attacks on Neural Networks. In Advances in Neural Information Processing Systems, S.\u00a0Bengio, H.\u00a0Wallach, H.\u00a0Larochelle, K.\u00a0Grauman, N.\u00a0Cesa-Bianchi, and R.\u00a0Garnett (Eds.). Vol.\u00a031. Curran Associates, Inc.https:\/\/proceedings.neurips.cc\/paper\/2018\/file\/22722a343513ed45f14905eb07621686-Paper.pdf"},{"key":"e_1_3_2_1_44_1","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2017.41"},{"key":"e_1_3_2_1_45_1","doi-asserted-by":"publisher","DOI":"10.1109\/EuroSP51992.2021.00024"},{"key":"e_1_3_2_1_46_1","volume-title":"Very deep convolutional networks for large-scale image recognition. arXiv preprint arXiv:1409.1556","author":"Simonyan Karen","year":"2014","unstructured":"Karen Simonyan and Andrew Zisserman. 2014. Very deep convolutional networks for large-scale image recognition. arXiv preprint arXiv:1409.1556 (2014)."},{"volume-title":"Machine Learning and Knowledge Discovery in Databases","author":"Solans David","key":"e_1_3_2_1_47_1","unstructured":"David Solans, Battista Biggio, and Carlos Castillo. 2021. Poisoning Attacks on Algorithmic Fairness. In Machine Learning and Knowledge Discovery in Databases, Frank Hutter, Kristian Kersting, Jefrey Lijffijt, and Isabel Valera (Eds.). Springer International Publishing, Cham, 162\u2013177."},{"key":"e_1_3_2_1_48_1","doi-asserted-by":"publisher","DOI":"10.1016\/j.comnet.2016.03.022"},{"key":"e_1_3_2_1_49_1","doi-asserted-by":"publisher","DOI":"10.1109\/ISSCC.2019.8662476"},{"key":"e_1_3_2_1_50_1","volume-title":"Intriguing properties of neural networks. arXiv preprint arXiv:1312.6199","author":"Szegedy Christian","year":"2013","unstructured":"Christian Szegedy, Wojciech Zaremba, Ilya Sutskever, Joan Bruna, Dumitru Erhan, Ian Goodfellow, and Rob Fergus. 2013. Intriguing properties of neural networks. arXiv preprint arXiv:1312.6199 (2013)."},{"volume-title":"Smartphone energy consumption: modeling and optimization","author":"Tarkoma Sasu","key":"e_1_3_2_1_51_1","unstructured":"Sasu Tarkoma, Matti Siekkinen, Eemil Lagerspetz, and Yu Xiao. 2014. Smartphone energy consumption: modeling and optimization. Cambridge University Press."},{"key":"e_1_3_2_1_52_1","volume-title":"An on-device deep neural network for face detection. Apple Machine Learning Journal","author":"CVML","year":"2017","unstructured":"CVML Team 2017. An on-device deep neural network for face detection. Apple Machine Learning Journal (2017)."},{"key":"e_1_3_2_1_53_1","volume-title":"ESORICS 2020, Guildford, UK, September 14\u201318, 2020, Proceedings, Part I 25","author":"Tolpegin Vale","year":"2020","unstructured":"Vale Tolpegin, Stacey Truex, Mehmet\u00a0Emre Gursoy, and Ling Liu. 2020. Data poisoning attacks against federated learning systems. In Computer Security\u2013ESORICS 2020: 25th European Symposium on Research in Computer Security, ESORICS 2020, Guildford, UK, September 14\u201318, 2020, Proceedings, Part I 25. Springer, 480\u2013501."},{"key":"e_1_3_2_1_54_1","volume-title":"Natural Language Processing Advancements By Deep Learning: A Survey. CoRR abs\/2003.01200","author":"Torfi Amirsina","year":"2020","unstructured":"Amirsina Torfi, Rouzbeh\u00a0A. Shirvani, Yaser Keneshloo, Nader Tavaf, and Edward\u00a0A. Fox. 2020. Natural Language Processing Advancements By Deep Learning: A Survey. CoRR abs\/2003.01200 (2020). arXiv:2003.01200https:\/\/arxiv.org\/abs\/2003.01200"},{"key":"e_1_3_2_1_55_1","doi-asserted-by":"publisher","DOI":"10.1109\/ISAIAM53259.2021.00031"},{"key":"e_1_3_2_1_56_1","volume-title":"Data poisoning attacks against online learning. arXiv preprint arXiv:1808.08994","author":"Wang Yizhen","year":"2018","unstructured":"Yizhen Wang and Kamalika Chaudhuri. 2018. Data poisoning attacks against online learning. arXiv preprint arXiv:1808.08994 (2018)."},{"key":"e_1_3_2_1_57_1","volume-title":"Learning structured sparsity in deep neural networks. Advances in neural information processing systems 29","author":"Wen Wei","year":"2016","unstructured":"Wei Wen, Chunpeng Wu, Yandan Wang, Yiran Chen, and Hai Li. 2016. Learning structured sparsity in deep neural networks. Advances in neural information processing systems 29 (2016)."},{"key":"e_1_3_2_1_58_1","doi-asserted-by":"publisher","DOI":"10.1145\/3287075"},{"key":"e_1_3_2_1_59_1","volume-title":"24th USENIX Security Symposium (USENIX Security 15)","author":"Xu Zhang","year":"2015","unstructured":"Zhang Xu, Haining Wang, and Zhenyu Wu. 2015. A measurement study on co-residence threat inside the cloud. In 24th USENIX Security Symposium (USENIX Security 15). 929\u2013944."},{"key":"e_1_3_2_1_60_1","unstructured":"Zhang Xu Haining Wang Zichen Xu and Xiaorui Wang. 2014. Power attack: an increasing threat to data centers.. In NDSS."},{"key":"e_1_3_2_1_61_1","doi-asserted-by":"publisher","DOI":"10.1145\/3319535.3354209"},{"key":"e_1_3_2_1_62_1","doi-asserted-by":"publisher","DOI":"10.1109\/ICFPT47387.2019.00014"},{"key":"e_1_3_2_1_63_1","volume-title":"To prune, or not to prune: exploring the efficacy of pruning for model compression. arXiv preprint arXiv:1710.01878","author":"Zhu Michael","year":"2017","unstructured":"Michael Zhu and Suyog Gupta. 2017. To prune, or not to prune: exploring the efficacy of pruning for model compression. arXiv preprint arXiv:1710.01878 (2017)."}],"event":{"name":"ASIA CCS '23: ACM Asia Conference on Computer and Communications Security","sponsor":["SIGSAC ACM Special Interest Group on Security, Audit, and Control"],"location":"Melbourne VIC Australia","acronym":"ASIA CCS '23"},"container-title":["Proceedings of the 2023 Secure and Trustworthy Deep Learning Systems Workshop"],"original-title":[],"link":[{"URL":"https:\/\/dl.acm.org\/doi\/pdf\/10.1145\/3591197.3591307","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2024,7,10]],"date-time":"2024-07-10T10:33:25Z","timestamp":1720607605000},"score":1,"resource":{"primary":{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/3591197.3591307"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2023,7,10]]},"references-count":62,"alternative-id":["10.1145\/3591197.3591307","10.1145\/3591197"],"URL":"https:\/\/doi.org\/10.1145\/3591197.3591307","relation":{},"subject":[],"published":{"date-parts":[[2023,7,10]]},"assertion":[{"value":"2023-07-10","order":2,"name":"published","label":"Published","group":{"name":"publication_history","label":"Publication History"}}]}}