{"about":{"site":"https://codewithpapers.app","non_affiliation":"Code with Papers and Syntology are not affiliated with, endorsed by, or sponsored by Papers with Code, Meta, or the pwc-archive mirror.","licence":"CC BY-SA 4.0","licence_url":"https://creativecommons.org/licenses/by-sa/4.0/legalcode","attribution":"https://codewithpapers.app/attribution","modified":"archive material modified by Syntology; see the attribution page"},"url":"/paper/a-panda-no-it-s-a-sloth-slowdown-attacks-on-1","title":"A Panda? No, It's a Sloth: Slowdown Attacks on Adaptive Multi-Exit Neural Network Inference","arxiv_id":"2010.02432","date":"2020-10-06","proceeding":"ICLR 2021 1","authors":["Sanghyun Hong","Yiğitcan Kaya","Ionuţ-Vlad Modoranu","Tudor Dumitraş"],"abstract":"Recent increases in the computational demands of deep neural networks (DNNs), combined with the observation that most input samples require only simple models, have sparked interest in $input$-$adaptive$ multi-exit architectures, such as MSDNets or Shallow-Deep Networks. These architectures enable faster inferences and could bring DNNs to low-power devices, e.g., in the Internet of Things (IoT). However, it is unknown if the computational savings provided by this approach are robust against adversarial pressure. In particular, an adversary may aim to slowdown adaptive DNNs by increasing their average inference time$-$a threat analogous to the $denial$-$of$-$service$ attacks from the Internet. In this paper, we conduct a systematic evaluation of this threat by experimenting with three generic multi-exit DNNs (based on VGG16, MobileNet, and ResNet56) and a custom multi-exit architecture, on two popular image classification benchmarks (CIFAR-10 and Tiny ImageNet). To this end, we show that adversarial example-crafting techniques can be modified to cause slowdown, and we propose a metric for comparing their impact on different architectures. We show that a slowdown attack reduces the efficacy of multi-exit DNNs by 90-100%, and it amplifies the latency by 1.5-5$\\times$ in a typical IoT deployment. We also show that it is possible to craft universal, reusable perturbations and that the attack can be effective in realistic black-box scenarios, where the attacker has limited knowledge about the victim. Finally, we show that adversarial training provides limited protection against slowdowns. These results suggest that further research is needed for defending multi-exit architectures against this emerging threat. Our code is available at https://github.com/sanghyun-hong/deepsloth.","url_abs":"https://arxiv.org/abs/2010.02432v2","url_pdf":"https://arxiv.org/pdf/2010.02432v2.pdf","source":{"archive":"pwc-archive (Hugging Face), CC BY-SA 4.0","snapshot":"2025-07-28","licence_url":"https://creativecommons.org/licenses/by-sa/4.0/legalcode","row_kind":"abstracts"},"code_links":[{"paper_slug":"a-panda-no-it-s-a-sloth-slowdown-attacks-on-1","repo_url":"https://github.com/sanghyun-hong/deepsloth","is_official":1,"mentioned_in_paper":1,"mentioned_in_github":1,"framework":"pytorch","reach":{"status":"ok","spdx":"MIT"}}],"tasks":[{"task_slug":"image-classification","task_name":"Image Classification"},{"task_slug":"image-classification","task_name":"image-classification"}],"methods":[],"datasets_introduced":[],"methods_introduced":[],"results":[],"syntology":{"syntology_url":"https://syntology.ai/paper/2010.02432","atlas_url":"https://app.syntology.ai/?focus=2010.02432","mcp":{"get_harvested_code_for_paper":{"arxiv_id":"2010.02432"}},"developers":"https://syntology.ai/developers","read_at":"2026-09-25T09:33:49+00:00","read_at_is":"when the build read Syntology's graph, not when any sample ran","claim":"Per-sample execution status on synthesized fixtures; not a correctness claim about the paper. Samples come from repositories linked to the paper, official or community; repo_kind says which.","repos":[{"provenance":"deterministic:regex_extraction","url":"https://github.com/sanghyun-hong/deepsloth","reach":{"status":"ok","spdx":"MIT"}}],"summary":{"ran_honours":1,"unverified":16},"by_repo_kind":{"official":{"samples":17,"ran":1,"repositories":1}},"repo_kind_vocabulary":{"official":"The archive marks this repository official for the paper","named_in_paper":"The archive records that the paper mentions this repository; it is not marked official","listed":"In the archive's code links for this paper, not marked official and not recorded as mentioned in the paper","found_in_text":"Syntology found this repository in the paper's own text; whether it is the authors' implementation is not asserted","community":"Not in the archive's code links for this paper; a community repository Syntology harvested"},"n_pointer_only_for_licence":0,"samples":[{"code_sha256_prefix":"f79d8861a3c36477","entry":"feature_reduction_formula","repo":"sanghyun-hong/deepsloth","repo_kind":"official","path":"utils.py","file_url":"https://github.com/sanghyun-hong/deepsloth/blob/HEAD/utils.py","link_basis":"harvester_set","language":"python","status":"ran_honours","verification_level":1,"contract_check":"HONOURS","metamorphic_tier":null,"behaviour_fingerprint":true,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"f79d8861a3c36477"}},{"code_sha256_prefix":"de06046620195b86","entry":"PGD","repo":"sanghyun-hong/deepsloth","repo_kind":"official","path":"attacks/PGDs.py","file_url":"https://github.com/sanghyun-hong/deepsloth/blob/HEAD/attacks/PGDs.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"de06046620195b86"}},{"code_sha256_prefix":"96433a42de458de2","entry":"PGD_avg","repo":"sanghyun-hong/deepsloth","repo_kind":"official","path":"attacks/PGDs.py","file_url":"https://github.com/sanghyun-hong/deepsloth/blob/HEAD/attacks/PGDs.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"96433a42de458de2"}},{"code_sha256_prefix":"1d50c333062f5b9a","entry":"PGD_max","repo":"sanghyun-hong/deepsloth","repo_kind":"official","path":"attacks/PGDs.py","file_url":"https://github.com/sanghyun-hong/deepsloth/blob/HEAD/attacks/PGDs.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"1d50c333062f5b9a"}},{"code_sha256_prefix":"0ae2381aa39b7e94","entry":"accuracy","repo":"sanghyun-hong/deepsloth","repo_kind":"official","path":"datasets.py","file_url":"https://github.com/sanghyun-hong/deepsloth/blob/HEAD/datasets.py","link_basis":"harvester_set","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"0ae2381aa39b7e94"}},{"code_sha256_prefix":"e0235251ee546bc1","entry":"convert_num_early_exits_at_each_ic_to_cumulative_dis","repo":"sanghyun-hong/deepsloth","repo_kind":"official","path":"delay_attack_cost.py","file_url":"https://github.com/sanghyun-hong/deepsloth/blob/HEAD/delay_attack_cost.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"e0235251ee546bc1"}},{"code_sha256_prefix":"971a65c04cc88912","entry":"convert_set_of_early_exit_samples_to_cumulative_dist","repo":"sanghyun-hong/deepsloth","repo_kind":"official","path":"delay_attack_cost.py","file_url":"https://github.com/sanghyun-hong/deepsloth/blob/HEAD/delay_attack_cost.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"971a65c04cc88912"}},{"code_sha256_prefix":"61f6c47663e10368","entry":"get_class_wise_lists","repo":"sanghyun-hong/deepsloth","repo_kind":"official","path":"scenarios.py","file_url":"https://github.com/sanghyun-hong/deepsloth/blob/HEAD/scenarios.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"61f6c47663e10368"}},{"code_sha256_prefix":"2afaaf23c911b3e5","entry":"get_loader","repo":"sanghyun-hong/deepsloth","repo_kind":"official","path":"model_funcs.py","file_url":"https://github.com/sanghyun-hong/deepsloth/blob/HEAD/model_funcs.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"2afaaf23c911b3e5"}},{"code_sha256_prefix":"4d847ffe4199fc69","entry":"get_plot_data_and_auc","repo":"sanghyun-hong/deepsloth","repo_kind":"official","path":"delay_attack_cost.py","file_url":"https://github.com/sanghyun-hong/deepsloth/blob/HEAD/delay_attack_cost.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"4d847ffe4199fc69"}},{"code_sha256_prefix":"23687b95e2b07471","entry":"get_subsets","repo":"sanghyun-hong/deepsloth","repo_kind":"official","path":"utils.py","file_url":"https://github.com/sanghyun-hong/deepsloth/blob/HEAD/utils.py","link_basis":"harvester_set","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"23687b95e2b07471"}},{"code_sha256_prefix":"6a4c4e404ba00cd1","entry":"load_from_pickle","repo":"sanghyun-hong/deepsloth","repo_kind":"official","path":"utils.py","file_url":"https://github.com/sanghyun-hong/deepsloth/blob/HEAD/utils.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"6a4c4e404ba00cd1"}},{"code_sha256_prefix":"e5ae7732cd5d8200","entry":"load_train_loader","repo":"sanghyun-hong/deepsloth","repo_kind":"official","path":"datasets.py","file_url":"https://github.com/sanghyun-hong/deepsloth/blob/HEAD/datasets.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"e5ae7732cd5d8200"}},{"code_sha256_prefix":"e19e45cb0c0659ae","entry":"load_valid_loader","repo":"sanghyun-hong/deepsloth","repo_kind":"official","path":"datasets.py","file_url":"https://github.com/sanghyun-hong/deepsloth/blob/HEAD/datasets.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"e19e45cb0c0659ae"}},{"code_sha256_prefix":"dbcc2e5aa63869de","entry":"profile","repo":"sanghyun-hong/deepsloth","repo_kind":"official","path":"profiler.py","file_url":"https://github.com/sanghyun-hong/deepsloth/blob/HEAD/profiler.py","link_basis":"harvester_set","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"dbcc2e5aa63869de"}},{"code_sha256_prefix":"2a83ddc10a6bd194","entry":"scenario_1_split","repo":"sanghyun-hong/deepsloth","repo_kind":"official","path":"scenarios.py","file_url":"https://github.com/sanghyun-hong/deepsloth/blob/HEAD/scenarios.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"2a83ddc10a6bd194"}},{"code_sha256_prefix":"eb2987c7e3d2b22b","entry":"update_numpy","repo":"sanghyun-hong/deepsloth","repo_kind":"official","path":"scenarios.py","file_url":"https://github.com/sanghyun-hong/deepsloth/blob/HEAD/scenarios.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"eb2987c7e3d2b22b"}}]},"arxiv_metadata":null,"syntology_extracted_results":null}