Research map / Adversarial robustness and security / Certified and empirical robustness
Adversarial Inputs for Linear Algebra Backends
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Constructs "Chimera" inputs that make the same neural network predict different classes depending on which linear algebra backend (OpenBLAS, BLIS, Eigen, Intel MKL, Apple Accelerate, cuBLAS) runs inference, and proposes a keyed-noise defense.
Problem
Floating-point non-associativity in BLAS backends causes tiny numerical differences in neural network inference, which may be amplified by adversaries to make a model predict conflicting classes across backends, even for integer-valued inputs.
Approach
Searches for feasible (quantized) inputs by jointly descending gradients of multiple backend-specific losses with different target labels, a tug-of-war that pushes the input into thin pockets between backend decision boundaries; adds a keyed PRNG noise defense that perturbs inputs by a few ULPs.
Key results
- Chimera examples found across all backend pairs: 16-24% success on FMNIST, 9-18% on CPU-only CIFAR, and 95-96% when cuBLAS is involved; 100% on ImageNet with cuBLAS.
- The proposed search outperforms binary search, boundary sample search, and C&W adversarial search, e.g. 95.26% vs 67.38% best baseline for CPU vs GPU.
- Keyed noise defense reduces attack success to 0.00% on FMNIST and CPU-vs-GPU, and 0.69% on CIFAR CPU-only, with no reported test accuracy loss.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| Use quantized inputs for gradient computations rather than quantizing only to check for a Chimera (ablation) | Chimera search · CIFAR-10, CPU-based backends | Chimera attack success rate: approximately 2.2× more Chimera examples | Helped |
| Use quantized inputs for gradient computations rather than quantizing only to check for a Chimera (ablation) | Chimera search · FMNIST, CPU-based backends | Chimera attack success rate: between 1.1× to 7× more | Helped |
| Use quantized inputs for gradient computations rather than quantizing only to check for a Chimera (ablation) | Chimera search · GPU-based backends | Chimera attack success rate: about 1% to 2% | Hurt |
| Apply keyed noise defense | Chimera attack · FMNIST, CPU-only backends | attack success rate: 19.20 % -> 0.00 % | Hurt |
| Apply keyed noise defense | Chimera attack · CIFAR-10, CPU-only backends | attack success rate: 18.04 % -> 0.69 % | Hurt |
| Apply keyed noise defense | Chimera attack · CIFAR-10, CPU vs. GPU backends | attack success rate: 95.26 % -> 0.00 % | Hurt |
| Use the proposed Chimera search instead of binary search | Chimera attack · FMNIST | attack success rate: < 0.1% vs 19.19% | Helped |
| Use the proposed Chimera search instead of boundary sample search | Chimera attack · CIFAR-10, CPU-only backends | attack success rate: 1.41% vs 13.61% | Helped |
| Use the proposed Chimera search instead of boundary sample search | Chimera attack · CIFAR-10, CPU vs. GPU backends | attack success rate: 67.38% vs 95.26% | Helped |
| Use the proposed Chimera search instead of adversarial example search | Chimera attack · CIFAR-10, CPU vs. GPU backends | attack success rate: 1.76% vs 95.26% | Helped |
| Use the proposed Chimera search instead of binary search | Chimera attack · CIFAR-10, CPU vs. GPU backends | attack success rate: 18.14% vs 95.26% | Helped |
Surprising findings
- Adversarial training does not sufficiently reduce attack success and can be weakened by more search iterations.
- Chimera pockets around found examples span 1 to 100,000 ULP, rather than being isolated singularities.
Limitations
- Attack success rates on CPU-only backends are low (roughly 8-24%) for FMNIST and CIFAR.
- Defense does not eliminate the vulnerability; CPU-only CIFAR still shows 0.69% success.
- Threat model assumes white-box access to models, backends, and defense noise magnitude.
Experimental setup
Datasets: FMNIST CIFAR-10 ImageNet
Benchmarks: FMNIST CIFAR-10 ImageNet
Metrics: attack success rate ULP distance test accuracy
Baselines: Binary search Boundary sample search (Schlögl et al. 2021) Adversarial example search (Carlini & Wagner 2017)
Builds on: Carlini & Wagner attack Schlögl et al. boundary samples fingerprinting BLAS specification
Closest papers by meaning
- A Fast Convoluted Story: Scaling Probabilistic Inference for Integer Arithmetics (NeurIPS 2024 · similarity 0.83)
- Searching for Efficient Linear Layers over a Continuous Space of Structured Matrices (NeurIPS 2024 · similarity 0.83)
- Memory safe computations with XLA compiler (NeurIPS 2022 · similarity 0.83)
- Contrasting Adversarial Perturbations: The Space of Harmless Perturbations (AAAI 2025 · similarity 0.82)
- If You Want to Be Robust, Be Wary of Initialization (NeurIPS 2024 · similarity 0.81)
- Advancing Adversarial Robustness in GNeRFs: The IL2-NeRF Attack (CVPR 2025 · similarity 0.81)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.