Recently, there has been a lot of progress in reducing the computation of deep models at inference time. These methods can reduce both the computational needs and power usage of deep models. Some of these approaches adaptively scale the compute based on the input instance. We show that such models can be vulnerable to a universal adversarial patch attack, where the attacker optimizes for a patch that when pasted on any image, can increase the compute and power consumption of the model. We run experiments with three different efficient vision transformer methods showing that in some cases, the attacker can increase the computation to the maximum possible level by simply pasting a patch that occupies only 8\% of the image area. We also show that a standard adversarial training defense method can reduce some of the attack's success. We believe adaptive efficient methods will be necessary for the future to lower the power usage of deep models, so we hope our paper encourages the community to study the robustness of these methods and develop better defense methods for the proposed attack.

翻译：最近，在减少深度模型推理阶段计算量方面取得了显著进展。这些方法既能降低深度模型的计算需求，也可减少其功耗。其中部分方法可根据输入实例自适应地调整计算规模。我们研究表明，此类模型易受通用对抗补丁攻击：攻击者优化生成的补丁，一旦粘贴到任何图像上，即可增加模型的算力消耗与功耗。我们针对三种不同的高效视觉Transformer方法进行实验，结果显示，在某些情况下攻击者仅需粘贴覆盖图像面积8%的补丁，即可将计算量提升至理论最大值。此外，标准对抗训练防御方法可部分削弱攻击效果。我们认为未来降低深度模型功耗必然需要自适应高效方法，因此期望本文能激励学界深入研究此类方法的鲁棒性，并为所提出的攻击开发更有效的防御策略。