通过降低GPU电压，用硬件故障提升CNN对抗鲁棒性并省电。
Faults That Fortify: CNN Adversarial Robustness via GPU Undervolting
- 训练时降低GPU电压引入随机扰动，实现隐式正则化。
- 在MNIST和CIFAR-10上，降压模型对抗准确率均高于正常电压模型。
- 无需算法修改，兼具鲁棒性增强与能量效率提升，适合边缘部署。
卷积神经网络（CNN）面临两大挑战：易受对抗攻击，以及高昂的训练成本。对抗训练虽有效但代价大，尤其在能源受限的边缘场景下负担更重。本文提出在训练过程中对GPU进行降压操作，通过降低供电电压引入随机故障，作为隐式正则化手段，在提升模型鲁棒性的同时减少能耗。我们从比特级分析了降压引发的故障，并在标准与对抗训练两种模式下，对LeNet、VGG-6和MobileNetV3在MNIST和CIFAR-10数据集上进行了测试，分别在额定电压与降压条件下训练并评估对抗攻击下的表现。结果表明，在两种训练范式中，降压训练的模型始终优于同架构的额定电压模型，证明硬件故障可增强即使已进行对抗训练的模型。由于动态功耗随电压平方变化，这种鲁棒性提升伴随着显著的能效收益。因此，GPU降压是一种无需算法改动的即插即用型硬件防御机制，为鲁棒性与能效协同优化开辟新路径。
原文摘要 · Abstract (English)
Convolutional Neural Networks (CNNs) face a dual challenge: vulnerability to adversarial attacks and prohibitive training cost. Adversarial training is effective but expensive, a burden that grows as learning shifts to the energy-constrained edge. This paper addresses both through GPU undervolting during training. Reducing supply voltage introduces stochastic perturbations that act as implicit regularization, improving robustness while lowering power. We characterize undervolting-induced faults at the bit level, then train LeNet, VGG-6, and MobileNetV3 on MNIST and CIFAR-10 under two training regimes, standard and adversarial, each at nominal and undervolted voltage, and evaluate all models against adversarial attacks. In both regimes, the undervolted model consistently achieves higher adversarial accuracy than its nominal-voltage counterpart, showing that hardware-induced faults strengthen even adversarial training. Because dynamic power scales quadratically with supply voltage, these robustness gains arrive with substantial energy savings. GPU undervolting is therefore a readily deployable hardware-level defense requiring no algorithmic change, and opens a promising direction in which robustness and energy efficiency move together.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。