{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2025,6,19]],"date-time":"2025-06-19T05:02:18Z","timestamp":1750309338484,"version":"3.41.0"},"reference-count":73,"publisher":"Association for Computing Machinery (ACM)","issue":"5","license":[{"start":{"date-parts":[[2024,8,14]],"date-time":"2024-08-14T00:00:00Z","timestamp":1723593600000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/www.acm.org\/publications\/policies\/copyright_policy#Background"}],"funder":[{"DOI":"10.13039\/501100001809","name":"National Natural Science Foundation of China","doi-asserted-by":"crossref","award":["62272459, 62125208"],"award-info":[{"award-number":["62272459, 62125208"]}],"id":[{"id":"10.13039\/501100001809","id-type":"DOI","asserted-by":"crossref"}]}],"content-domain":{"domain":["dl.acm.org"],"crossmark-restriction":true},"short-container-title":["ACM Trans. Embed. Comput. Syst."],"published-print":{"date-parts":[[2024,9,30]]},"abstract":"<jats:p>Understanding how to defend against adversarial attacks is crucial for ensuring the safety and reliability of these systems in real-world applications. Various adversarial defense methods are proposed, which aim at improving the robustness of neural networks against adversarial attacks by changing the model structure, adding detection networks, and adversarial purification network. However, deploying adversarial defense methods in existing DNN accelerators or defensive accelerators leads to many key issues. To address these challenges, this article proposes<jats:italic>sDNNGuard<\/jats:italic>, an elastic heterogeneous DNN accelerator architecture that can efficiently orchestrate the simultaneous execution of original (<jats:italic>target<\/jats:italic>) DNN networks and the<jats:italic>detect<\/jats:italic>algorithm or network. It not only supports for dense DNN detect algorithms, but also allows for sparse DNN defense methods and other mixed dense-sparse (e.g., dense-dense and sparse-dense) workloads to fully exploit the benefits of sparsity. sDNNGuard with a CPU core also supports the non-DNN computing and allows the special layer of the neural network, and used for the conversion for sparse storage format for weights and activation values. To reduce off-chip traffic and improve resources utilization, a new hardware abstraction with elastic on-chip buffer\/computing resource management is proposed to achieve dynamical resource scheduling mechanism. We propose an<jats:italic>extended AI instruction set<\/jats:italic>for neural networks synchronization, task scheduling and efficient data interaction. Experiment results show that sDNNGuard can effectively validate the legitimacy of the input samples in parallel with the target DNN model, achieving an average 1.42\u00d7 speedup compared with the state-of-the-art accelerators.<\/jats:p>","DOI":"10.1145\/3677318","type":"journal-article","created":{"date-parts":[[2024,7,9]],"date-time":"2024-07-09T11:36:57Z","timestamp":1720525017000},"page":"1-28","update-policy":"https:\/\/doi.org\/10.1145\/crossmark-policy","source":"Crossref","is-referenced-by-count":0,"title":["A Hybrid Sparse-dense Defensive DNN Accelerator Architecture against Adversarial Example Attacks"],"prefix":"10.1145","volume":"23","author":[{"ORCID":"https:\/\/orcid.org\/0000-0002-1432-6429","authenticated-orcid":false,"given":"Xingbin","family":"Wang","sequence":"first","affiliation":[{"name":"Institute of Information Engineering CAS, Beijing, China"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-9799-3146","authenticated-orcid":false,"given":"Boyan","family":"Zhao","sequence":"additional","affiliation":[{"name":"Institute of Information Engineering CAS, Beijing, China"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-7539-7132","authenticated-orcid":false,"given":"Yulan","family":"Su","sequence":"additional","affiliation":[{"name":"Institute of Information Engineering CAS, Beijing, China"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-3746-8083","authenticated-orcid":false,"given":"Sisi","family":"Zhang","sequence":"additional","affiliation":[{"name":"Institute of Information Engineering CAS, Beijing, China"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0009-0008-7675-4518","authenticated-orcid":false,"given":"Fengkai","family":"Yuan","sequence":"additional","affiliation":[{"name":"Institute of Information Engineering CAS, Beijing, China"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0000-0003-2125-4336","authenticated-orcid":false,"given":"Jun","family":"Zhang","sequence":"additional","affiliation":[{"name":"Hubei University of Arts and Science, Xiangyang, China"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0009-0002-9868-5353","authenticated-orcid":false,"given":"Dan","family":"Meng","sequence":"additional","affiliation":[{"name":"Institute of Information Engineering CAS, Beijing, China"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-9215-7632","authenticated-orcid":false,"given":"Rui","family":"Hou","sequence":"additional","affiliation":[{"name":"Institute of Information Engineering CAS, Beijing, China"}],"role":[{"role":"author","vocabulary":"crossref"}]}],"member":"320","published-online":{"date-parts":[[2024,8,14]]},"reference":[{"key":"e_1_3_2_2_2","doi-asserted-by":"publisher","DOI":"10.1145\/3007787.3001138"},{"key":"e_1_3_2_3_2","doi-asserted-by":"publisher","DOI":"10.1109\/SP40000.2020.00045"},{"key":"e_1_3_2_4_2","volume-title":"The AAAI-22 Workshop on Adversarial Machine Learning and Beyond","author":"Chen Jiefeng","year":"2021","unstructured":"Jiefeng Chen, Jayaram Raghuram, Jihye Choi, Xi Wu, Yingyu Liang, and Somesh Jha. 2021. Revisiting adversarial robustness of classifiers with a reject option. In The AAAI-22 Workshop on Adversarial Machine Learning and Beyond."},{"key":"e_1_3_2_5_2","unstructured":"Jiefeng Chen Jayaram Raghuram Jihye Choi Xi Wu Yingyu Liang and Somesh Jha. 2023. Stratified adversarial robustness with rejection. International Conference on Machine Learning. PMLR 4867\u20134894."},{"key":"e_1_3_2_6_2","doi-asserted-by":"publisher","DOI":"10.1109\/JETCAS.2019.2910232"},{"key":"e_1_3_2_7_2","doi-asserted-by":"crossref","unstructured":"Sayanton V Dibbo Adam Breuer Juston Moore and Michael Teti. 2024. Improving robustness to model inversion attacks via sparse coding architectures. arXiv:2403.14772. Retrieved from https:\/\/arxiv.org\/abs\/2403.14772","DOI":"10.1007\/978-3-031-72989-8_7"},{"key":"e_1_3_2_8_2","doi-asserted-by":"publisher","DOI":"10.1109\/CVPRW.2019.00019"},{"key":"e_1_3_2_9_2","unstructured":"Akram Erraqabi Aristide Baratin Yoshua Bengio and Simon Lacoste-Julien. 2018. A3t: Adversarially augmented adversarial training. arXiv:1801.04055. Retrieved from https:\/\/arxiv.org\/abs\/1801.04055"},{"key":"e_1_3_2_10_2","doi-asserted-by":"publisher","DOI":"10.1145\/3466752.3480082"},{"key":"e_1_3_2_11_2","doi-asserted-by":"publisher","DOI":"10.1109\/MICRO50266.2020.00031"},{"key":"e_1_3_2_12_2","doi-asserted-by":"publisher","DOI":"10.1109\/MICRO50266.2020.00062"},{"key":"e_1_3_2_13_2","unstructured":"Morgane Goibert and Elvis Dohmatob. 2019. Adversarial robustness via adversarial label-smoothing. arXiv:1906.11567. Retrieved from https:\/\/arxiv.org\/abs\/1906.11567"},{"key":"e_1_3_2_14_2","doi-asserted-by":"publisher","DOI":"10.1145\/3352460.3358291"},{"key":"e_1_3_2_15_2","unstructured":"Ian J Goodfellow Jonathon Shlens and Christian Szegedy. 2014. Explaining and harnessing adversarial examples. arXiv:1412.6572. Retrieved from https:\/\/arxiv.org\/abs\/1412.6572"},{"key":"e_1_3_2_16_2","unstructured":"Kathrin Grosse Praveen Manoharan Nicolas Papernot Michael Backes and Patrick McDaniel. 2017. On the (statistical) detection of adversarial examples. arXiv:1702.06280. Retrieved from https:\/\/arxiv.org\/abs\/1702.06280"},{"key":"e_1_3_2_17_2","doi-asserted-by":"publisher","DOI":"10.1145\/3445814.3446747"},{"key":"e_1_3_2_18_2","doi-asserted-by":"publisher","DOI":"10.1145\/3007787.3001163"},{"key":"e_1_3_2_19_2","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2016.90"},{"key":"e_1_3_2_20_2","first-page":"23818","article-title":"DISCO: Adversarial defense with local implicit functions","volume":"35","author":"Ho Chih-Hui","year":"2022","unstructured":"Chih-Hui Ho and Nuno Vasconcelos. 2022. DISCO: Adversarial defense with local implicit functions. Advances in Neural Information Processing Systems 35 (2022), 23818\u201323837.","journal-title":"Advances in Neural Information Processing Systems"},{"key":"e_1_3_2_21_2","unstructured":"Xing Hu Ling Liang Lei Deng Shuangchen Li Xinfeng Xie Yu Ji Yufei Ding Chang Liu Timothy Sherwood and Yuan Xie. 2020. Deepsniffer: A dnn model extraction framework based on learning architectural hints. International Conference on Architectural Support for Programming Languages and Operating Systems."},{"key":"e_1_3_2_22_2","doi-asserted-by":"publisher","DOI":"10.1145\/3343031.3351012"},{"key":"e_1_3_2_23_2","doi-asserted-by":"crossref","unstructured":"Uiwon Hwang Jaewoo Park Hyemi Jang Sungroh Yoon and Nam Ik Cho. 2019. PuVAE: A variational autoencoder to purify adversarial examples. IEEE Access 7 (2019) 126582\u2013126593.","DOI":"10.1109\/ACCESS.2019.2939352"},{"key":"e_1_3_2_24_2","doi-asserted-by":"publisher","DOI":"10.1609\/aaai.v33i01.3301962"},{"key":"e_1_3_2_25_2","doi-asserted-by":"publisher","DOI":"10.1109\/JSSC.2021.3066572"},{"key":"e_1_3_2_26_2","unstructured":"Yoon Kim. 2016. Convolutional neural networks for sentence classification. GitHub 6 (2016) 25."},{"key":"e_1_3_2_27_2","first-page":"1097","volume-title":"Advances in Neural Information Processing Systems","author":"Krizhevsky Alex","year":"2012","unstructured":"Alex Krizhevsky, Ilya Sutskever, and Geoffrey E. Hinton. 2012. Imagenet classification with deep convolutional neural networks. In Advances in Neural Information Processing Systems. 1097\u20131105."},{"key":"e_1_3_2_28_2","doi-asserted-by":"crossref","unstructured":"Alexey Kurakin Ian Goodfellow and Samy Bengio. 2016. Adversarial examples in the physical world. Artificial Intelligence Safety and Security. Chapman and Hall\/CRC (2018) 99\u2013112.","DOI":"10.1201\/9781351251389-8"},{"key":"e_1_3_2_29_2","doi-asserted-by":"publisher","DOI":"10.1145\/3296957.3173176"},{"key":"e_1_3_2_30_2","doi-asserted-by":"publisher","DOI":"10.1109\/ICCV.2017.615"},{"key":"e_1_3_2_31_2","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2018.00191"},{"key":"e_1_3_2_32_2","doi-asserted-by":"publisher","DOI":"10.1109\/HPCA53966.2022.00049"},{"key":"e_1_3_2_33_2","doi-asserted-by":"publisher","DOI":"10.1109\/ICCV.2017.56"},{"key":"e_1_3_2_34_2","doi-asserted-by":"publisher","DOI":"10.14722\/ndss.2019.23415"},{"key":"e_1_3_2_35_2","doi-asserted-by":"publisher","DOI":"10.1145\/3133956.3134057"},{"key":"e_1_3_2_36_2","unstructured":"Jan Hendrik Metzen Tim Genewein Volker Fischer and Bastian Bischoff. 2017. On detecting adversarial perturbations. arXiv:1702.04267. Retrieved from https:\/\/arxiv.org\/abs\/1702.04267"},{"key":"e_1_3_2_37_2","doi-asserted-by":"publisher","DOI":"10.1109\/MICRO.2007.33"},{"key":"e_1_3_2_38_2","unstructured":"Weili Nie Brandon Guo Yujia Huang Chaowei Xiao Arash Vahdat and Anima Anandkumar. 2022. Diffusion models for adversarial purification. arXiv:2205.07460. Retrieved from https:\/\/arxiv.org\/abs\/2205.07460"},{"key":"e_1_3_2_39_2","first-page":"8314","volume-title":"International Conference on Machine Learning","author":"\u00d6zdenizci Ozan","year":"2021","unstructured":"Ozan \u00d6zdenizci and Robert Legenstein. 2021. Training adversarially robust sparse networks via bayesian connectivity sampling. In International Conference on Machine Learning. PMLR, 8314\u20138324."},{"key":"e_1_3_2_40_2","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2016.41"},{"key":"e_1_3_2_41_2","doi-asserted-by":"publisher","DOI":"10.1145\/3140659.3080254"},{"key":"e_1_3_2_42_2","doi-asserted-by":"publisher","DOI":"10.1609\/aaai.v37i2.25299"},{"key":"e_1_3_2_43_2","doi-asserted-by":"crossref","unstructured":"Chuan Qin Yuefeng Chen Kejiang Chen Xiaoyi Dong Weiming Zhang Xiaofeng Mao Yuan He and Nenghai Yu. 2022. Feature fusion based adversarial example detection against second-round adversarial attacks. IEEE Transactions on Artificial Intelligence 4 5 (2022) 1029\u20131040.","DOI":"10.1109\/TAI.2022.3190816"},{"key":"e_1_3_2_44_2","unstructured":"Aditi Raghunathan Jacob Steinhardt and Percy Liang. 2018. Certified defenses against adversarial examples. arXiv preprint arXiv:1801.09344."},{"key":"e_1_3_2_45_2","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2017.690"},{"key":"e_1_3_2_46_2","doi-asserted-by":"publisher","DOI":"10.1145\/3240765.3240791"},{"key":"e_1_3_2_47_2","volume-title":"SPARSKIT: A Basic Tool Kit for Sparse Matrix Computations","author":"Saad Youcef","year":"1990","unstructured":"Youcef Saad. 1990. SPARSKIT: A Basic Tool Kit for Sparse Matrix Computations. Technical Report."},{"key":"e_1_3_2_48_2","doi-asserted-by":"crossref","unstructured":"Ananda Samajdar Michael Pellauer and Tushar Krishna. 2021. Self-adaptive reconfigurable arrays (SARA): Learning flexible GEMM accelerator configuration and mapping-space using ML. IEEE Design Automation Conference.","DOI":"10.1145\/3489517.3530506"},{"key":"e_1_3_2_49_2","unstructured":"Mohammad Hossein Samavatian Saikat Majumdar Kristin Barber and Radu Teodorescu. 2022. DNNShield: Dynamic randomized model sparsification a defense against adversarial machine learning. arXiv:2208.00498. Retrieved from https:\/\/arxiv.org\/abs\/2208.00498"},{"key":"e_1_3_2_50_2","first-page":"19655","article-title":"Hydra: Pruning adversarially robust neural networks","volume":"33","author":"Sehwag Vikash","year":"2020","unstructured":"Vikash Sehwag, Shiqi Wang, Prateek Mittal, and Suman Jana. 2020. Hydra: Pruning adversarially robust neural networks. Advances in Neural Information Processing Systems 33 (2020), 19655\u201319666.","journal-title":"Advances in Neural Information Processing Systems"},{"key":"e_1_3_2_51_2","doi-asserted-by":"publisher","DOI":"10.1109\/MICRO.2016.7783720"},{"key":"e_1_3_2_52_2","doi-asserted-by":"publisher","DOI":"10.1109\/ISCA.2018.00069"},{"key":"e_1_3_2_53_2","doi-asserted-by":"publisher","DOI":"10.1109\/HPCA53966.2022.00068"},{"key":"e_1_3_2_54_2","unstructured":"Karen Simonyan and Andrew Zisserman. 2014. Very deep convolutional networks for large-scale image recognition. arXiv:1409.1556. Retrieved from https:\/\/arxiv.org\/abs\/1409.1556"},{"key":"e_1_3_2_55_2","unstructured":"Chawin Sitawarin and David Wagner. 2019. Defending against adversarial examples with k-nearest neighbor. arXiv:1906.09525. Retrieved from https:\/\/arxiv.org\/abs\/1906.09525"},{"key":"e_1_3_2_56_2","article-title":"Pixeldefend: Leveraging generative models to understand and defend against adversarial examples","author":"Song Yang","year":"2018","unstructured":"Yang Song, Taesup Kim, Sebastian Nowozin, Stefano Ermon, and Nate Kushman. 2018. Pixeldefend: Leveraging generative models to understand and defend against adversarial examples. International Conference on Learning Representations (2018).","journal-title":"International Conference on Learning Representations"},{"key":"e_1_3_2_57_2","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2015.7298594"},{"key":"e_1_3_2_58_2","unstructured":"Christian Szegedy Wojciech Zaremba Ilya Sutskever Joan Bruna Dumitru Erhan Ian Goodfellow and Rob Fergus. 2013. Intriguing properties of neural networks. arXiv:1312.6199. Retrieved from https:\/\/arxiv.org\/abs\/1312.6199"},{"key":"e_1_3_2_59_2","doi-asserted-by":"publisher","DOI":"10.1609\/aaai.v32i1.11828"},{"key":"e_1_3_2_60_2","article-title":"Conditional image generation with pixelcnn decoders","volume":"29","author":"Oord Aaron Van den","year":"2016","unstructured":"Aaron Van den Oord, Nal Kalchbrenner, Lasse Espeholt, Oriol Vinyals, Alex Graves, et\u00a0al. 2016. Conditional image generation with pixelcnn decoders. Advances in Neural Information Processing Systems 29 (2016).","journal-title":"Advances in Neural Information Processing Systems"},{"key":"e_1_3_2_61_2","doi-asserted-by":"publisher","DOI":"10.1145\/3373376.3378532"},{"key":"e_1_3_2_62_2","doi-asserted-by":"publisher","DOI":"10.1109\/TCAD.2024.3390031"},{"key":"e_1_3_2_63_2","doi-asserted-by":"publisher","DOI":"10.1109\/ISCA52012.2021.00066"},{"key":"e_1_3_2_64_2","unstructured":"Chaowei Xiao Zhongzhu Chen Kun Jin Jiongxiao Wang Weili Nie Mingyan Liu Anima Anandkumar Bo Li and Dawn Song. 2022. Densepure: Understanding diffusion models towards adversarial robustness. arXiv:2211.00322. Retrieved from https:\/\/arxiv.org\/abs\/2211.00322"},{"key":"e_1_3_2_65_2","doi-asserted-by":"publisher","DOI":"10.14722\/ndss.2018.23198"},{"key":"e_1_3_2_66_2","doi-asserted-by":"crossref","unstructured":"Yijun Yang Ruiyuan Gao Yu Li Qiuxia Lai and Qiang Xu. 2022. What you see is not what the network infers: Detecting adversarial examples based on semantic contradiction. arXiv:2201.09650. Retrieved from https:\/\/arxiv.org\/abs\/2201.09650","DOI":"10.14722\/ndss.2022.24001"},{"key":"e_1_3_2_67_2","doi-asserted-by":"publisher","DOI":"10.1109\/ICCV.2019.00020"},{"key":"e_1_3_2_68_2","unstructured":"Eda Yilmaz and Hacer Yalim Keles. 2024. Adversarial sparse teacher: Defense against distillation-based model stealing attacks using adversarial examples. arXiv:2403.05181. Retrieved from https:\/\/arxiv.org\/abs\/2403.05181"},{"key":"e_1_3_2_69_2","first-page":"941","article-title":"Learning best combination for efficient n: M sparsity","volume":"35","author":"Zhang Yuxin","year":"2022","unstructured":"Yuxin Zhang, Mingbao Lin, Zhihang Lin, Yiting Luo, Ke Li, Fei Chao, Yongjian Wu, and Rongrong Ji. 2022. Learning best combination for efficient n: M sparsity. Advances in Neural Information Processing Systems 35 (2022), 941\u2013953.","journal-title":"Advances in Neural Information Processing Systems"},{"key":"e_1_3_2_70_2","unstructured":"Yuxin Zhang Mingbao Lin Yunshan Zhong Mengzhao Chen Fei Chao and Rongrong Ji. 2023. Spatial re-parameterization for N: M sparsity. arXiv:2306.05612. Retrieved from https:\/\/arxiv.org\/abs\/2306.05612"},{"key":"e_1_3_2_71_2","first-page":"18309","article-title":"Advancing model pruning via bi-level optimization","volume":"35","author":"Zhang Yihua","year":"2022","unstructured":"Yihua Zhang, Yuguang Yao, Parikshit Ram, Pu Zhao, Tianlong Chen, Mingyi Hong, Yanzhi Wang, and Sijia Liu. 2022. Advancing model pruning via bi-level optimization. Advances in Neural Information Processing Systems 35 (2022), 18309\u201318326.","journal-title":"Advances in Neural Information Processing Systems"},{"key":"e_1_3_2_72_2","doi-asserted-by":"publisher","DOI":"10.1145\/3576915.3624396"},{"key":"e_1_3_2_73_2","doi-asserted-by":"publisher","DOI":"10.1109\/TIFS.2022.3226572"},{"key":"e_1_3_2_74_2","article-title":"Robust detection of adversarial attacks by modeling the intrinsic properties of deep neural networks","volume":"31","author":"Zheng Zhihao","year":"2018","unstructured":"Zhihao Zheng and Pengyu Hong. 2018. Robust detection of adversarial attacks by modeling the intrinsic properties of deep neural networks. Advances in Neural Information Processing Systems 31 (2018).","journal-title":"Advances in Neural Information Processing Systems"}],"container-title":["ACM Transactions on Embedded Computing Systems"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/3677318","content-type":"unspecified","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/dl.acm.org\/doi\/pdf\/10.1145\/3677318","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,6,19]],"date-time":"2025-06-19T00:04:21Z","timestamp":1750291461000},"score":1,"resource":{"primary":{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/3677318"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2024,8,14]]},"references-count":73,"journal-issue":{"issue":"5","published-print":{"date-parts":[[2024,9,30]]}},"alternative-id":["10.1145\/3677318"],"URL":"https:\/\/doi.org\/10.1145\/3677318","relation":{},"ISSN":["1539-9087","1558-3465"],"issn-type":[{"type":"print","value":"1539-9087"},{"type":"electronic","value":"1558-3465"}],"subject":[],"published":{"date-parts":[[2024,8,14]]},"assertion":[{"value":"2023-12-25","order":0,"name":"received","label":"Received","group":{"name":"publication_history","label":"Publication History"}},{"value":"2024-06-05","order":2,"name":"accepted","label":"Accepted","group":{"name":"publication_history","label":"Publication History"}},{"value":"2024-08-14","order":3,"name":"published","label":"Published","group":{"name":"publication_history","label":"Publication History"}}]}}