GERALT: Real-time Detection of Evasion Attacks in Deep Learning Systems

Evasion attacks constitute an important class of security vulnerabilities in deep learning systems. In this attack, the adversary can coerce the victim DNN into targeted misclassification with slightly modified input data. While detection and defense methods have been proposed for evasion attacks, they incur high overhead and cannot be employed for real time detection on resource-constrained devices. In this paper, we propose an infrastructure, Geralt, to optimize evasion attack detection for real-time execution. Geralt includes a software component to optimize detection methods enabling the use of a smaller detection network, and hardware architecture to accelerate inter-network inference with intermediate data reuse techniques. Our evaluation demonstrates that Geralt achieves more than 3x improvement in performance over standard accelerators like Eyeriss without affecting detection and classification accuracy.