Late Breaking Results: Physical Adversarial Attacks of Diffractive Deep Neural Networks

Diffractive Deep Neural Network $(\mathrm{D}^{2}$ NN) can work as a neural network with the diffraction of light and have demonstrated orders of magnitude performance improvements in computation speed and energy efficiency [1], [2]. As a result, there have been increasing interests in applying $\mathrm{D}^{2}$ NNs into security-sensitive applications, such as security gate sensing, drug detection, etc. However, the comprehensive vulnerability and robustness of optical neural networks have never been studied. In this work, we develop the first adversarial attack formulations over optical physical meanings, and provide comprehensive analysis of adversarial robustness of $\mathrm{D}^{2}$ NNs under practical adversarial threats over optical domains, i.e. Phase attack, Amplitude attack, and Complexdomain attack, which can be realized in $\mathrm{D}^{2}$ NN system using amplitude and phase modulators. We demonstrate that the proposed Complex Fast Gradient Sign Method (Complex-FGSM) can successfully generate minimal-changed (small epsilon) physically feasible adversarial examples targeting pre-trained $\mathrm{D}^{2}$ NNs model on MNIST-10 dataset, which bring down its accuracy to $\le 20$% from 95.4%.