Exploiting device-level non-idealities for adversarial attacks on ReRAM-based neural networks
Resistive memory (ReRAM) or memristor devices offer the prospect of more efficient computing. While memristors have been used for a variety of computing systems, their usage has gained significant popularity in the domain of deep learning. Weight matrices in deep neural networks can be mapped to cro...
| Main Authors: | , , , , , |
|---|---|
| Format: | Article |
| Language: | English |
| Published: |
Elsevier
2023-07-01
|
| Series: | Memories - Materials, Devices, Circuits and Systems |
| Subjects: | |
| Online Access: | http://www.sciencedirect.com/science/article/pii/S2773064623000300 |
| _version_ | 1797796065408188416 |
|---|---|
| author | Tyler McLemore Robert Sunbury Seth Brodzik Zachary Cronin Elias Timmons Dwaipayan Chakraborty |
| author_facet | Tyler McLemore Robert Sunbury Seth Brodzik Zachary Cronin Elias Timmons Dwaipayan Chakraborty |
| author_sort | Tyler McLemore |
| collection | DOAJ |
| description | Resistive memory (ReRAM) or memristor devices offer the prospect of more efficient computing. While memristors have been used for a variety of computing systems, their usage has gained significant popularity in the domain of deep learning. Weight matrices in deep neural networks can be mapped to crossbar architectures with memristive junctions, generally resulting in superior performance and energy efficiency. However, the nascent nature of ReRAM technology is directly associated with the presence of inherent non-idealities in the ReRAM devices currently available. Deep neural networks have already been shown to be susceptible to adversarial attacks, often by targeting vulnerabilities in the networks’ internal representation of input data. In this paper, we explore the causal relationship between device-level non-idealities in ReRAM devices and the classification performance of memristor-based neural network accelerators. Specifically, our aim is to generate images which bypass adversarial defense mechanisms in software neural networks but trigger non-trivial performance discrepancies in ReRAM-based neural networks. To this end, we have proposed a framework to generate adversarial images in the hypervolume between the two decision boundaries, thereby leveraging non-ideal device behavior for performance detriment. We employ state-of-the-art tools in explainable artificial intelligence to characterize our adversarial image samples, and derive a new metric to quantify susceptibility to adversarial attacks at the pixel and device-levels. |
| first_indexed | 2024-03-13T03:27:31Z |
| format | Article |
| id | doaj.art-97172b0f50a74872912fc1d33cce5d50 |
| institution | Directory Open Access Journal |
| issn | 2773-0646 |
| language | English |
| last_indexed | 2024-03-13T03:27:31Z |
| publishDate | 2023-07-01 |
| publisher | Elsevier |
| record_format | Article |
| series | Memories - Materials, Devices, Circuits and Systems |
| spelling | doaj.art-97172b0f50a74872912fc1d33cce5d502023-06-25T04:45:13ZengElsevierMemories - Materials, Devices, Circuits and Systems2773-06462023-07-014100053Exploiting device-level non-idealities for adversarial attacks on ReRAM-based neural networksTyler McLemore0Robert Sunbury1Seth Brodzik2Zachary Cronin3Elias Timmons4Dwaipayan Chakraborty5Department of Electrical and Computer Engineering, Rowan University, 201 Mullica Hill Rd, Glassboro, 08028, NJ, USADepartment of Electrical and Computer Engineering, Rowan University, 201 Mullica Hill Rd, Glassboro, 08028, NJ, USADepartment of Electrical and Computer Engineering, Rowan University, 201 Mullica Hill Rd, Glassboro, 08028, NJ, USADepartment of Electrical and Computer Engineering, Rowan University, 201 Mullica Hill Rd, Glassboro, 08028, NJ, USADepartment of Electrical and Computer Engineering, Rowan University, 201 Mullica Hill Rd, Glassboro, 08028, NJ, USACorresponding author.; Department of Electrical and Computer Engineering, Rowan University, 201 Mullica Hill Rd, Glassboro, 08028, NJ, USAResistive memory (ReRAM) or memristor devices offer the prospect of more efficient computing. While memristors have been used for a variety of computing systems, their usage has gained significant popularity in the domain of deep learning. Weight matrices in deep neural networks can be mapped to crossbar architectures with memristive junctions, generally resulting in superior performance and energy efficiency. However, the nascent nature of ReRAM technology is directly associated with the presence of inherent non-idealities in the ReRAM devices currently available. Deep neural networks have already been shown to be susceptible to adversarial attacks, often by targeting vulnerabilities in the networks’ internal representation of input data. In this paper, we explore the causal relationship between device-level non-idealities in ReRAM devices and the classification performance of memristor-based neural network accelerators. Specifically, our aim is to generate images which bypass adversarial defense mechanisms in software neural networks but trigger non-trivial performance discrepancies in ReRAM-based neural networks. To this end, we have proposed a framework to generate adversarial images in the hypervolume between the two decision boundaries, thereby leveraging non-ideal device behavior for performance detriment. We employ state-of-the-art tools in explainable artificial intelligence to characterize our adversarial image samples, and derive a new metric to quantify susceptibility to adversarial attacks at the pixel and device-levels.http://www.sciencedirect.com/science/article/pii/S2773064623000300ReRAMMemristorNon-idealityNeural networkAdversarial attackExplainable AI |
| spellingShingle | Tyler McLemore Robert Sunbury Seth Brodzik Zachary Cronin Elias Timmons Dwaipayan Chakraborty Exploiting device-level non-idealities for adversarial attacks on ReRAM-based neural networks Memories - Materials, Devices, Circuits and Systems ReRAM Memristor Non-ideality Neural network Adversarial attack Explainable AI |
| title | Exploiting device-level non-idealities for adversarial attacks on ReRAM-based neural networks |
| title_full | Exploiting device-level non-idealities for adversarial attacks on ReRAM-based neural networks |
| title_fullStr | Exploiting device-level non-idealities for adversarial attacks on ReRAM-based neural networks |
| title_full_unstemmed | Exploiting device-level non-idealities for adversarial attacks on ReRAM-based neural networks |
| title_short | Exploiting device-level non-idealities for adversarial attacks on ReRAM-based neural networks |
| title_sort | exploiting device level non idealities for adversarial attacks on reram based neural networks |
| topic | ReRAM Memristor Non-ideality Neural network Adversarial attack Explainable AI |
| url | http://www.sciencedirect.com/science/article/pii/S2773064623000300 |
| work_keys_str_mv | AT tylermclemore exploitingdevicelevelnonidealitiesforadversarialattacksonrerambasedneuralnetworks AT robertsunbury exploitingdevicelevelnonidealitiesforadversarialattacksonrerambasedneuralnetworks AT sethbrodzik exploitingdevicelevelnonidealitiesforadversarialattacksonrerambasedneuralnetworks AT zacharycronin exploitingdevicelevelnonidealitiesforadversarialattacksonrerambasedneuralnetworks AT eliastimmons exploitingdevicelevelnonidealitiesforadversarialattacksonrerambasedneuralnetworks AT dwaipayanchakraborty exploitingdevicelevelnonidealitiesforadversarialattacksonrerambasedneuralnetworks |