Energy-Latency Attacks via Sponge Poisoning
  Sponge examples are test-time inputs carefully-optimized to increase energy
consumption and latency of neural networks when deployed on hardware
accelerators. In this work, we demonstrate that sponge attacks can also be
implanted at training time, when model training is outsourced to a third party,
via an attack that we call sponge poisoning. This attack allows one to increase
the energy consumption and latency of machine-learning models indiscriminately
on each test-time input. We present a novel formalization for sponge poisoning,
overcoming the limitations related to the optimization of test-time sponge
examples, and show that this attack is possible even if the attacker only
controls a few poisoning samples and model updates. Our extensive experimental
analysis, involving two deep learning architectures and three datasets, shows
that sponge poisoning can almost completely vanish the effect of such hardware
accelerators. Finally, we analyze activations of the resulting sponge models,
identifying the module components that are more sensitive to this
vulnerability.
