\subsection{Convolutional neural networks}


\subsection{Adversarial Attacks}

Deep learning techniques gained popularity in recent years and are now deployed even in safety-critical tasks, such as recognizing road signs for autonomous vehicles \cite{signs}. Despite their effectiveness and popularity, CNN-powered applications are facing a critical challenge – adversarial attacks. Many studies \cite{vulnerable, fgsm, He, neuroattack} have shown that CNNs are vulnerable to carefully crafted inputs designed to fool them, very small imperceptible perturbations added to the data can completely change the output of the model. In computer vision domain, these adversarial examples are intentionally generated images that look almost exactly the same as the original images, but can mislead the classifier to provide wrong prediction outputs. Other work \cite{noneed} claimed that adversarial examples are not a practical threat to ML in real-life scenarios. However, physical adversarial attacks have recently been shown to be effective against CNN based applications in real-world \cite{phys}.

\noindent 
{\bf Minimizing Injected Noise:} Its essential for the adversary to minimize the added noise to avoid detection.  
For illustration purposes, consider a CNN used for image classification.  More formally, given an original input image $x$ and a target classification model $ f() ~s.t. ~ f(x) = l $, the problem of generating an adversarial example $x^*$ can be formulated as a constrained optimization \cite{pbform}:

\begin{equation}
\label{eq:adv}
     \begin{array}{rlclcl}
        x^* = \displaystyle \argmin_{x^*}  \mathcal{D}(x,x^*),  
         s.t.  ~ f(x^*) = l^*,  ~ l \neq l^*
\end{array}
\end{equation}


Where $\mathcal{D}$ is the distance metric used to quantify the similarity between two images and the goal of the optimization is to minimize this added noise, typically to avoid detection of the adversarial perturbations. $l$ and $l^*$ are the two labels of $x$ and $x^*$, respectively:  $x^*$ is considered as an adversarial example if and only if the label of the two images are different ($ f(x) \neq  f(x^*) $) and the added noise is bounded ($\mathcal{D}(x,x^*) < \epsilon $ where $\epsilon \geqslant 0 $).

\noindent
{\bf Distance Metrics:}
The adversarial examples and the added perturbations should be visually imperceptible by humans. Since it is hard to model humans' perception, researchers proposed three metrics to approximate humans' perception of visual difference, namely $L_0$, $L_2$, and $L_ \infty$ \cite{CW}. These metrics are special cases of the $L_p$ norm: 
\begin{equation}
    \left\|x\right\|_p = \left( \sum^{n}_{i = 1} \left |x_i \right | ^{p} \right)^{\frac{1}{p}}
\end{equation}
These three metrics focus on different aspects of visual significance. $L_0$ counts the number of pixels with different values at corresponding positions in the two images. $L_2$ measures the Euclidean distance between the two images $x$ and $x^*$. $L_ \infty$ measures the maximum difference for all pixels at corresponding positions in the two images.


The consequences of an adversarial attack can be dramatic.  For example, misclassification of a stop sign as a yield sign or a speed limit sign could lead to material and human damages. Another possible situation is when using CNNs in financial transactions and automatic bank check processing -- using handwritten character recognition algorithms to read digits from bank cheques or using neural networks for amount and signature recognition \cite{cheque}. An attacker could easily fool the model to predict wrong bank account numbers or amount of money or even fake a signature. A dangerous situation, especially with such large sums of money at stake.



\subsection{Approximate Computing}

The speed of new generations of computing systems, from embedded and mobile devices to servers and computing data centers, has been drastically climbing in the past decades. This development was made possible by the advances in integrated circuits (ICs) design and driven by the increasingly high demand for performance in the majority of modern applications. However, this development is physically reaching the end of Moore’s law, since TSMC and Samsung are releasing 5 $nm$ technology \cite{tsmc_moore}. On the other hand, a wide range of modern applications is inherently fault-tolerant and may not require the highest accuracy. This observation has motivated the development of approximate computing (AC), a computing paradigm that trades power consumption with accuracy. The idea is to implement inexact/AC elements that consume less energy, as far as the overall application tolerates the imprecision level in computation.
This paradigm has been shown promising for inherently fault-tolerant applications such as deep/ML, big data analytics, and signal processing. Several AC techniques have been proposed in the literature and can be classified into three main categories based on the computing stack layer they target: software, architecture, and circuit level~\cite{Survey}. 

In this paper, we consider AC for a \emph{totally new objective}; enhancing CNNs robustness to adversarial attacks, without losing the initial advantages of AC.



\subsection{Impact on Model Accuracy}
\label{CNNaccuracy}
It is important for a defense mechanism that aims to enhance robustness against adversarial attacks to keep at least an acceptable performance level for clean inputs. In fact, considerably reducing the baseline accuracy, or creating an exploding or vanishing gradient impact that makes the model sensitive to other types of noise undermines the model reliability.  
In our proposed approach, we maintain the same level of recognition rate even with the approximate noise in the calculations. Counter-intuitively, this data-dependent noise helps to better highlight the input's important features used in the recognition and does not affect the classification process. 
A drop of $0.01 \%$ in the recognition rate for the case of LeNet-5 and $1\%$ for AlexNet is recorded as mentioned in Table \ref{tab3}. 

    

\begin{table}[!htp]
\small
\centering
  \caption{Accuracy results of Float32, approximate model, fully quantized, weight-only quantized and Bfloat16 models.}
  \label{tab3}
  \begin{tabular}{ccc}
    \toprule
    \textbf{Used Multiplier }& \textbf{MNIST} & \textbf{CIFAR-10}\\
    \midrule
        Float32                 & 97.93\%  &   81\%   \\
    
        Approximate (DA)	    & 97.67\%  &   80\%     \\ 
        Fully quantized         & -     &   80\%  \\
        Weight-only quantized   & -     &  80\% \\
        Bfloat16                & 97.93  &  81\% \\
        
  \bottomrule
\end{tabular}
\end{table}




\subsection{Impact on Performance and Energy Consumption}



Here we show the additional benefit of using AC, especially in the context of power-limited devices, such as mobile, embedded, and Edge devices.
The experiments evaluate normalized energy and delay achieved by the proposed approximate multiplier compared to a conventional baseline multiplier. Multipliers are implemented using $45~ n m$ technology via the Predictive Technology Model (PTM) using the Keysight Advanced Design System (ADS) simulation platform~\cite{PTM}.  

 \begin{table}[!htp]
 \centering
   \caption{Energy and delay Comparison.}
   \label{tab:energy}
   \begin{tabular}{ccc}
     \toprule
     \textbf{Multiplier }& \textbf{Average energy}	& \textbf{Average delay}  	 \\
     \midrule
         Exact multiplier        & 1 & 1    \\
        
        
         Ax-FPM	                 & 0.487 & 0.29\\ 
         Bfloat16                & 0.4   & 0.4   \\
   \bottomrule
 \end{tabular}
 \end{table}
 
Table \ref{tab:energy} compares the energy and delay for the approximate multiplier and the Bfloat16 multiplier normalized to a conventional multiplier. 
\begin{figure}[!htp]
\centering
\includegraphics[width=1\columnwidth]{32fp_16bf.PNG}
\caption{Contrast between IEEE 754 Single-precision 32-bit floating-point format and Bfloat16 format.
}
\label{fig:bfloat}
\end{figure}

Bfloat16 data representation is shown in Figure \ref{fig:bfloat}, with 1 sign bit, a 8-bit exponent and a 7-bit fraction. The used Bfloat16 multiplier has similar architecture to that of Ax-FPM. However for the mantissa multiplier we use the conventional Booth multiplier instead of the array multiplier.
Ax-FPM achieves up to $51\%$ and $71$\% savings in energy and delay, respectively compared to the baseline multiplier. Bfloat16 implementation results in comparable savings with around $60\%$ lower power and delay. However, this comes without robustness advantages, as mentioned earlier.



 Unlike most of the state-of-the-art defense strategies that lead to power, resource, or timing overhead, DA results in saving energy and area.

\subsection{Approximate CNN}

We propose to leverage approximate computing to improve the robustness of ML classifiers, such as CNNs, against adversarial attacks. We call this general approach \textbf{Defensive Approximation} (DA). The closest approach to DA is the perturbation-based defense~\cite{snP2019_certif,smooth} that either adds noise or otherwise filter the input data to try to interfere with any adversarial modifications to the input of a classifier. However, our approach advances the state-of-the-art by injecting perturbations throughout the classifier and directly by the approximate hardware, thereby enhancing both robustness and power efficiency. 

Technically, the approximate design process is driven by two main considerations:
\begin{enumerate}[label=(\alph*)]
    \item Injecting significant noise that can influence the CNN behavior, and allows by-product power gains.
    \item Keeping the cumulative noise magnitude under control to avoid impacting the baseline accuracy of the CNN.
\end{enumerate}

For consideration (b), we purpose to an implementation that replaces the conventional mantissa multiplier in floating point multipliers, with a simpler approximate design. This choice is backed by the study in \cite{iccd18, D&T}, which show that errors in the exponent part might have a drastic impact on CNNs accuracy. 
Consideration (a) means that the approximate design needs to be aggressive to induce significant noise. Therefore, as detailed in the next subsection, we chose the corner case, i.e., the most aggressive approximate design \cite{AMA5, Heap}, and used it to replace the mantissa computation logic in a basic floating point multiplier.



In this section, we present our approximate multiplier design and analyze its properties.

\subsection{Approximate Floating Point Multiplier}
ML structures, such as CNNs, often rely on computationally expensive operations, e.g., convolutions that are composed of multiplications and additions. Floating-point multiplications consume most of the processing energy in both inference and training of CNNs~\cite{esl_ihsen,Heap}.
Although approximate computation can be introduced in different ways (with likely different robustness benefits), DA leverages a new approximate 32-bit floating-point multiplier, which we call \textit{approximate floating-point multiplier} (Ax-FPM).
The IEEE 754-2008 compliant floating-point format binary numbers are composed of three parts: a sign, an exponent, and a mantissa (also called fraction)~\cite{FP}.
The sign is the most significant bit, indicating whether the number is positive or negative. In a single-precision format, the following $8$ bits represent the exponent of the binary number ranging from $-126$ to $127$. The remaining $23$ bits represent the fractional part (mantissa). 
For most of the floating number range, the normalized format is:
\begin{equation}\label{eqn:ieee754}
val = ( -1 )^{\textit{sign}} \times 2^{exp-bias} \times ( 1.fraction ) 
\end{equation}

A floating-point multiplier (FPM) consists mainly of three units: mantissa multiplier, exponent adder, and a rounding unit.  The mantissa multiplication consumes $81\%$ of the overall power of the multiplier \cite{trunca}

Ax-FPM is designed based on a mantissa multiplication unit that is constructed using approximate full adders (FA). The FAs are aggressively approximated to inject computational noise within the circuit. We describe Ax-FPM by first presenting the approximate FA design, and then the approximate mantissa multiplier used to build the Ax-FPM. 



\begin{figure}[!htp]
\centering
\includegraphics[width=\columnwidth]{Mantissa_multiplier0.pdf}
\caption{An illustration of a $4 \times 4$ array multiplier architecture.}
\label{MA}
\end{figure}

To build a power-efficient and a higher performance FPM, we propose to replace the mantissa multiplier by an approximate mantissa multiplier; an array multiplier constructed using approximate FAs. We selected an array multiplier implementation because it is considered one of the most power-efficient among conventional multiplier architectures~\cite{array}.  In the array architecture, multiplication is implemented through the addition of partial products generated by multiplying the multiplicand with each bit of multiplier using AND gates, as shown in Figure \ref{MA}. 
\begin{figure}[!htp]
\centering
\includegraphics[width=\columnwidth]{full_adder.pdf}
\caption{Logic diagram of (a) exact Full Adder, (b) AMA5 (used in this work).}
\label{FA}
\end{figure}

Specifically, we build an array multiplier based on an approximate mirror adder (AMA5)~\cite{AMA5} in place of exact FAs. The approximation of a conventional FA is performed by removing some internal circuitry, thereby resulting in power and resource reduction at the cost of introducing errors.  Consider a FA with (A,B, $C_{in}$) as inputs and ($Sum$, $C_{out}$) as outputs ($C$ here refers to carry). For any input combination, the logical \textit{approximate} expressions for $Sum$ and $C_{out}$ are: $Sum = B$ and $C_{out} = A$.
The AMA5 design is constituted by only two buffers (see Figure \ref{FA}), leading to the latency and energy savings relative to the exact design, but more importantly, introduce errors into the computation.  It is worth noting that these errors are data dependent, appearing for specific combinations of the inputs, and ignoring the carry in value, making the injected noise difficult to predict or model. 












When trying to evaluate the proposed Ax-FPM, we were interested in studying its behavior under small input numbers ranging between $-1$ and $+1$ since most of the internal operations within CNNs are in this range.

We measure the introduced error as the difference of the output of the approximate multiplier and the exact multiplier. The results are shown in Figure \ref{appx_mult} using 100 million randomly generated multiplications across the input range from $-1$ to $1$. 
\begin{figure}[!htp]
\centering
\includegraphics[width=0.8\columnwidth]{error_dist_axfpm.pdf}
\caption{Noise introduced by the approximate multiplier while the operands in $[0,1]$.
}
\label{appx_mult}
\end{figure}
Three trends can be observed that will be used later to help understanding the impact of the approximation using Ax-FPM on CNN security: \textbf{(i)} The first is the data-dependent discontinuity of the approximation-induced errors, \textbf{(ii)}  We noticed that in $96\%$ of the cases, the approximate multiplication results in higher absolute values than the exact multiplication: For positive products, the approximate result is higher than the exact result, and for negative product results the approximate result is lower than the exact result, and \textbf{(iii)} In general, we notice that the larger the multiplied numbers, the larger the error magnitude added to the approximate result. As shown later, these observations will help understand the mechanism that we think is behind robustness enhancement. 

\begin{figure}[!htp]
\centering
\includegraphics[width=0.9\columnwidth,height=4cm]{Convolution.pptx.pdf}
\caption{Convolution result of the filter and each input image using exact and approximate convolution.}
\label{appx_conv}
\end{figure}

\subsection{Approximate Convolution}

In order to understand the impact of AC at larger scales than the individual multiplication, we track the impact on convolution operations. The approximate CNN is built using the approximate convolution operations as building blocks. The activation functions and the pooling layers which do not use multiplication are similar to the conventional CNN.   Convolution layers enable CNNs to extract data-driven features rather than relying on manual feature-extraction in classical ML systems. The convolution operation is performed on the layer's input data using a kernel matrix that is convoluted (piece-wise multiplied) against the input data to produce a feature map.



As we slide the filter over the input from left to right and top to bottom whenever the filter coincides with a \textbf{similar} portion of the input, the convolution result is high, and the neuron will fire.
The weight matrix filters out portions of the input image that does not align with the filter, and the approximate multiplier helps improve this process by further increasing the output when a feature is detected. In Figure \ref{appx_conv}, we run an experiment where we choose a filter and six different images with different degrees of similarity to the chosen filter (1 to 6 from the least to the most similar), and we perform the convolution operation. We notice that the approximate convolution using Ax-FPM delivers higher results for similar inputs and lower results for dissimilar inputs. We can also notice that the higher the similarity, the higher the gap between the exact and Ax-FPM approximation results.  Therefore, by using the approximate convolution, the main features of the image that are important in the image recognition are retained and further highlighted with higher scores that will later help increase the confidence of the classification result, as explained in Section \ref{sec:how}.










\subsection{AC Design Space Exploration}
For the sake of comparison, we proceed to a design space exploration considering the accuracy of the multipliers and resource utilization as optimization objectives. The comparison of our design with the optimal approximate design given by the exploration and referred to as HEAP led to a clearly dominant choice in favor of our design given the following perspectives:



\textbf{(i) Resource and power efficiency:} Given its aggressive design, Ax-FPM achieves the lowest power consumption and resource utilization.

\textbf{(ii) Robustness:} While other approximate designs had a positive impact on CNNs robustness, we noticed that Ax-FPM achieves the highest enhancement. 

\textbf{(iii) Accuracy:} CNNs are highly approximation-tolerant, and even aggressive multiplier design didn't impact overall accuracy. Ax-FPM, as well as HEAP have insignificant impact on accuracy.

While these observations give an insight on the potential generalizability of AC positive impact, Ax-FPM is a non dominated design outperforming other design in both robustness, power consumption and resource utilization, while having the same overall accuracy level. 
Hence, in the remainder of the paper, we will focus only on Ax-FPM based DA. Further details and results can be found in the Appendix.

\subsection{Defensive Quantization}

Defensive quantization \cite{DQ} was proposed to jointly optimize the efficiency and robustness of deep learning models. A 4-bit quantized model was trained on CIFAR-10 using the Dorefa-Net method \cite{zhou2018dorefanet}. The model architecture is detailed in Appendix \ref{mod_archi}. We consider two ways of quantization: (i) Weight quantization, where only the weights are quantized, and (ii) Full quantization where the weights
of each convolutional and dense block and the output of each activation function are quantized.
In Table \ref{quan_result4}, we report transferability between exact (32-bit floating point), approximate model (using DA), fully quantized and weight-only quantized model.
We notice that DA is almost  two times more robust against transferability attacks than DQ under FGSM, PGD and C\&W attacks. We believe that this is due to the difference in terms of noise distribution between DA and DQ. In fact, while DQ-induced noise tends to make the initial decision boundary smoother, the input-dependent noise in DA makes its decision boundary randomly different from the initial model.

\begin{table}[!htp]
\small
  \caption{Comparing attacks transferability success rates for CIFAR-10 when using DA and DQ.}
  \label{quan_result4}
  \begin{tabular}{ccccc}
    \toprule
                     &          & \textbf{DA:} & \textbf{DQ:} & \textbf{DQ:} \\
    \textbf{Attack method} & \textbf{Exact}  &  & \textbf{Full } & \textbf{Weight-only } \\
    \midrule
        FGSM          &   100\%    & 38\%  & 60\%  & 61\% \\
        PGD           &   100\%    & 31\%  & 74\% & 73\%\\
        C\&W          &   100\%    & 17\%  & 68\% &  68\% \\
        
  \bottomrule
\end{tabular}
\end{table}

\subsection{BFloat16}

The Bfloat16 (Brain Floating Point) \cite{ kalamkar2019study} is a truncated version of the 32-bit IEEE 754  single-precision floating-point format (float32). It is composed of one sign bit, eight exponent bits, and seven mantissa bits giving the range of a full 32-bit number but in the data size of a 16-bit number. Bfloat16 is used in machine learning applications and intended to reduce the storage requirements and increase computing speed without losing precision. 

To evaluate the impact of Bfloat16 on deep neural networks robustness, we use Pytorch framework \cite{PyTorch} to implement Bfloat16-based CNN architectures and test them for MNIST and CIFAR-10 benchmarks.
We notice that using Bfloat16 achieves the same prediction accuracy as the full precision 32-bit floating point. No remarkable change was noticed at the output of the convolutional layers nor in the confidence of the models. We believe this is due to the nature of the noise introduced by reducing data representation accuracy. A more detailed discussion can be found in Section \ref{discussion}. 

Figure \ref{bfloat16} shows the noise resulting from multiplying $100$ million randomly generated Bfloat16 numbers compared to their corresponding 32-bit floating point. This figure shows that, in contrast with our approximate multiplier (Figure \ref{appx_mult}), Bfloat16 multiplication results in mostly negative noise with orders of magnitude lower than DA-induced noise. Moreover, the Bfloat16 noise is not input-dependent, and has no specific impact on the model confidence. Accordingly, no improvement in the robustness was noticed when attacking the Bfloat16 model using FGSM, PGD and $C\&W$. 

\begin{figure}[!htp]
\centering
\includegraphics[width=0.9\columnwidth]{error_dis_bfloat16.pdf}
\caption{Noise introduced by multiplying Bfloat16 while the operands $\in [0,1]$.
}
\label{bfloat16}
\end{figure}




\subsection{Experimental Setup}

The first benchmark we use is the LeNet-5 CNN architecture \cite{lenet5} along with the MNIST database \cite{mnist}, which implements a classifier for handwritten digit recognition. The MNIST consists of 60,000 training and 10,000 test images with 10 classes corresponding to digits. Each digit example is represented as a gray-scale image of $28 \times 28$ pixels, where each feature corresponds to a pixel intensity normalized between 0 and 1.
We also use the AlexNet image classification CNN \cite{Alexnet} along with the CIFAR-10 database \cite{CIFAR}.  CIFAR-10 consists of 60,000 images, of dimension $64 \times 64 \times 3$ each and contains ten different classes.  LeNet-5 consists of two convolutional layers, two max-pooling layers, and two fully connected layers.  AlexNet uses five convolution layers, three max-pooling layers, and three fully connected layers.
The rectified linear unit (ReLU) was used as the activation function in this evaluation, along with a dropout layer to prevent overfitting.
For both models, the output layer is a special activation function called softmax that will assign probabilities to each class. 




Our implementations are built using the open source ML framework PyTorch \cite{PyTorch}.
We use the Adam optimization algorithm to train the LeNet-5 classifier.  For Alexnet, we use Stochastic Gradient Descent (SGD) with a learning rate equal to  $0.01$ and $0.001$, respectively.  Note that \emph{no retraining} is applied in DA, we rather use the same hyper-parameters obtained from the original (exact) classifier; we simply replace the multipliers with the approximate multiplier.

Our reference exact CNNs are conventional CNNs based on exact convolution layers with the format Conv2d provided by PyTorch.  In contrast, the approximate CNNs emulate the 32-bit Ax-FPM functionality and replace the multiplication in the convolution layers with Ax-FPM in order to assess the behavior of the approximate classifier.

Since we are simulating a cross-layer (approximate) implementation from gate-level up to system-level, the experiments (forward and backward gradient) are highly time consuming, which limited our experiments to the two datasets MNIST and CIFAR-10.

Except for the black-box setting where the attacker trains his own reverse-engineered proxy/substitute model, the approximate and exact classifiers share the same pre-trained parameters and the same architecture; they differ only in the hardware implementation of the multiplier.


\subsection{Do Adversarial Attacks on an Exact CNN Transfer to an Approximate CNN ?}
\label{sec:transExApx}


\textbf{Attack Scenario.} In this setting, the attacker has full knowledge of the classifier architecture and hyper-parameters, but without knowing that the model uses approximate hardware.  An example of such scenario could be in case an attacker correctly guesses the used architecture based on its widespread use for a given application (e.g., LeNet-5 in digit recognition), but is unaware of the use of DA as illustrated in Figure~\ref{grey-box}.

\begin{figure}[!htp]
\centering
\includegraphics[width=\columnwidth]{grey_box_setting1.pdf}
\caption{Transferrability attack scenario.}
\label{grey-box}
\end{figure}

\noindent\textbf{Transferability Analysis.} The classifier generates adversarial examples using the set of algorithms in Table~\ref{Attack_methods} and assume that the exact classifier from Lenet-5 trained on the MNIST dataset. Notice that the hyperparameters, as well as the structure of the network, are the same between the exact and the approximate classifiers.  The attacker then tests the adversarial examples against the approximate classifier. 
Table \ref{grey-boxresult} presents the attacks respective success rates. We notice that the DA considerably reduces the transferability of the malicious samples and, by consequence, increases the robustness of the classifier to this attack setting. We observed that the robustness against transferability is very high, and reaches $99\%$ for $C\&W$ attack.


\begin{table}[!htp]
\small
  \caption{Attacks transferability success rates for MNIST.}
  \label{grey-boxresult}
  \begin{tabular}{ccc}
    \toprule
    \textbf{Attack method} & \textbf{Exact LeNet-5}  & \textbf{Approximate LeNet-5} \\
    \midrule
        FGSM          &   100\%    & 12\%    \\
        PGD           &   100\%    & 28\%    \\
        JSMA          &   100\%    & 9\%   \\
        C\&W          &   100\%    & 1\%    \\
        DF	          &   100\%    & 17\%   \\ 
        LSA	          &   100\%    & 18\%   \\ 
        BA	          &   100\%    & 17\%   \\ 
        HSJ	          &   100\%    & 2\%    \\         
  \bottomrule
\end{tabular}
\end{table}

We repeat the experiment for AlexNet with CIFAR-10 dataset. For the same setting, the success of different adversarial attacks is shown in Table \ref{attackAlexnet}.  While more examples succeed against the approximate classifier, we see that the majority of the attacks do not transfer.  Thus, DA offers built-in robustness against transferability attacks. 

\begin{table}[!htp]
\small
\centering
  \caption{Attacks transferability success rates for CIFAR-10.
  \label{attackAlexnet}
  \begin{tabular}{ccc}
    \toprule
    \textbf{Attack method} & \textbf{Exact AlexNet}  & \textbf{Approximate AlexNet} \\
    \midrule

        FGSM          &   100\%    & 38\%    \\        
        PGD           &   100\%    & 31\%    \\
        JSMA          &   100\%    & 32\%   \\        
        C\&W         &    100\%  & 17\%    \\
        DF	          &   100\%    & 35\%   \\ 
        LSA	          &   100\%    & 36\%   \\ 
        BA	          &   100\%    & 37\%   \\ 
        HSJ	          &   100\%    & 12\%    \\ 
  \bottomrule
\end{tabular}
\end{table}

Notice that, unlike other state-of-the-art defenses, our defense mechanism protects the network without relying on the attack details or the model specification and without any training beyond that of the original classifier.  
Unlike most of the perturbation-based defenses that degrade the classifier’s accuracy on non-adversarial inputs, our defense strategy significantly improves the classification robustness with no baseline accuracy degradation, as we will show in Section~\ref{CNNaccuracy}. 


\subsection{Can We Attack an Approximate CNN?}

In the remaining attack models, we assume that the attacker has direct access to the approximate CNN. We consider both black-box and white-box settings










\textbf{Black-box Attack.} In a black-box setting, the attacker has no access to the classifier architecture, parameters, and the hardware platform but can query the classifier with any input and obtain its output label.  In a typical black-box attack, the adversary uses the results of many queries to the target model to reverse engineer it.  Specifically, the adversary trains a substitute (or proxy) using the labeled inputs obtained from querying the original model (see Figure \ref{black-box}).
We also conduct a black box attack on the exact classifier and evaluate how successful the black box attack is in fooling it.  Essentially, we are comparing the black-box transferability of the reverse-engineered models to the original models for both the exact and the approximate CNNs.

\begin{figure}[!htp]
\centering
\includegraphics[width=\columnwidth]{black_box_setting1.pdf}
\caption{Black-box attack scenario. }
\label{black-box}
\end{figure}

In Table \ref{black-boxresult}, we present the attack success ratios for the exact CNN and the approximate/DA CNN. DA increases resilience to adversarial attacks across various attacks and for both single-step and iterative ones: it achieves $73\%$ classification success on adversarial examples in the worst case and the defense succeeded in up to $100\%$ of the examples generated by C\&W, PGD, and HSJ respectively. 
\begin{table}[!htp]
\small
\centering
  \caption{Black-box attacks success rates for MNIST.}
  \label{black-boxresult}
  \begin{tabular}{ccc}
    \toprule
    \textbf{Attack method} & \textbf{Exact LeNet-5}  & \textbf{Approximate LeNet-5} \\
    \midrule
        FGSM          &   100\%    & 22\%    \\
        PGD           &   100\%    & 0\%    \\
        JSMA          &   100\%    & 13\%   \\
        C\&W          &    100\%   & 0\%    \\
        DF	          &   100\%    & 25\%   \\ 
        LSA	          &   100\%    & 26\%   \\ 
        BA	          &   100\%    & 27\%   \\ 
        HSJ	          &   100\%    & 0\%    \\ 
  \bottomrule
\end{tabular}
\end{table}


\textbf{White-box Attack.} In this setting, the attacker has access to the approximate hardware along with the victim model architecture and parameters, as shown in Figure \ref{white-box}. In particular, the adversary has full knowledge of the defender model, its architecture, the defense mechanism, along with full access to approximate gradients used to build the gradient-based attacks. In essence, the attacker is aware of our defense, and can adapt around it with full knowledge of the model and the hardware, which is a recommended methodology for evaluating new defenses~\cite{carlini_gift}.
 


\begin{figure}[!htp]
\centering
\includegraphics[width=\columnwidth]{white_box_setting1.pdf}
\caption{White-box attack scenario.}
\label{white-box}
\end{figure}

In this scenario, we assume a powerful attacker with full access to the approximate classifier's internal model and can query it indefinitely to directly create adversarial attacks.  Although DA in production would normally reduce execution time, in our experiments, we \emph{emulate} the 32-bit Ax-FPM functionality within the approximate classifier.  As a result, this makes inference extremely slow: on average, it takes $5$ to $6$ days to craft one adversarial example on an 8th Gen Intel core i7-8750H processor with NVIDIA GeForce GTX 1050. This led us to limit the white-box experiments; we use only two of the most efficient attacks in our benchmark: $C\&W$ and DeepFool attacks, and for a limited number of examples selected randomly from our test set for different classes. 

In a white box attack, with an unconstrained noise budget, an adversary can always eventually succeed in causing an image to misclassify. Thus, robustness against this type of attack occurs through the magnitude of the adversarial noise to be added: if this magnitude is high, this may exceed the ability of the attacker to interfere, or cause the attack to be easily detectable.
\begin{figure}[!htp]
\centering
\includegraphics[width=\columnwidth]{L2_DeepFool.pdf}
\caption{Required perturbations by DeepFool attack, measured using $L_2$ distance, to generate MNIST adversarial examples for approximate and exact classifiers. }
\label{L2}
\end{figure}

Figures \ref{L2} and \ref{L2_C&W}, respectively, present different measures of $L_2$ for adversarial examples crafted using DF and $C\&W$ attacking both a conventional CNN and an approximate CNN. We notice that the distance between a clean image and the adversarial example generated under DA is much larger than the distance between a clean sample and the adversarial example generated for the exact classifier. On average, a difference of $5.12$ for $L_2$-DeepFool attacks and $1.23$ for $L_2$-C\&W attack.
This observation confirms that DA is more robust to adversarial perturbations since the magnitude of the adversarial noise has to be significantly higher for DF to fool DA successfully. 

To understand the implication of this higher robustness in terms of observable effects on the input image,  we also show the Peak Signal to Noise Ratio (PSNR) and the Mean Square Error (MSE) in Figures \ref{MSE&PSNR_DF} and \ref{MSE&PSNR}; these are two common measures of the error introduced in a reconstruction of an image. Specifically,  MSE represents the average of the squares of the "errors" between the clean image and the adversarial image. The error is the amount by which the values of the original image differ from the distorted image. PSNR is an expression for the ratio between the maximum possible value (power) of a signal and the power of distorting noise that affects the quality of its representation. It is given by the following equation: $P S N R=20 \log _{10}\left(\frac{M A X_{x}}{\sqrt{M S E}}\right)$. The lower the PSNR, the higher the image quality degradation is.

We notice that the adversarial examples generated for DA is more noisy than adversarial examples generated for an exact classifier. The PSNR difference reaches $4 dB$ for C\&W and $7.8dB$ for DeepFool. Moreover, on average, the DA-dedicated adversarial examples have $6$ times, and $3$ times more MSE than the exact classifier-dedicated adversarial examples for $C\&W$ and DeepFool attacks, respectively. 


\begin{figure}[!htp]
\centering
\includegraphics[width=0.9\columnwidth]{L2_C_W.pdf}
\caption{Required perturbations by C\&W attack, measured using $L_2$ distance, to generate MNIST adversarial examples for approximate and exact classifiers. }
\label{L2_C&W}
\end{figure}

We can conclude that DA provides substantial built-in robustness for all three attack models we considered.  Attacks generated against an exact model do not transfer successfully to DA.  Black-box attacks also achieve a low success rate against DA.  Finally, even white-box attacks require substantial increases in the injected noise to fool DA.  Next, we probe deeper into DA's internal behavior to provide some intuition and explanation for these observed robustness advantages

\begin{figure}[!htp]
\centering
\includegraphics[width=\columnwidth]{MSE_PSNR_DF.png}
\caption{MSE and PSNR values for the generated adversarial examples using DeepFool method when attacking the approximate and the exact classifiers.}
\label{MSE&PSNR_DF}
\end{figure}

\begin{figure}[!htp]
\centering
\includegraphics[width=\columnwidth]{MSE_PSNR.png}
\caption{MSE and PSNR values for the generated adversarial examples using $L_2$-C\&W method when attacking the approximate and the exact classifiers.}
\label{MSE&PSNR}
\end{figure}










\subsection{Adversary Knowledge (Attacks Scenarios)}

In this work, we consider three attack scenarios:

\noindent
    \textbf{\textit{Transferability Attack.}} We assume the adversary is aware of the exact classifier internal model; its architecture and parameters. The adversary uses the exact classifier to create adversarial examples. Thus, we explore whether these examples transfer effectively to the approximate classifier (DA classifier).
    
  \noindent  
    \textbf{\textit{Black-box Attack.}} We assume the attacker has access only to the input/output of the victim classifier (which is our approximate classifier) and has no information about its internal architecture.  The adversary first uses the results of querying the victim to reverse engineer the classifier and create a substitute
    CNN model.   With the substitute model, the attacker can attempt to generate different adversarial examples to attack the victim classifier.

\noindent
    \textbf{\textit{White-box Attack.}} We assume a powerful attacker who has full knowledge of the victim classifier's architecture and parameters (including the fact that it uses AC).  The attacker uses this knowledge to create adversarial examples. 


\subsection{Adversarial Example Generation}

 We consider several adversarial attack generation algorithms for our attack scenarios, including some of the most recent and potent evasion attacks.  Generally, in each algorithm, the attacker tries to evade the system by adjusting malicious samples during the inference phase, assuming no influence over the training data. However, as different defenses have started to be deployed that specifically target individual adversarial attack generation strategies, new algorithms have started to be deployed that bypass these defenses. For example, methods such as defensive distillation \cite{distillation_SP} and automation detection \cite{early} were introduced and demonstrate robustness against the Fast gradient sign attack
 \cite{fgsm}.  However, the new $C\&W$ attack was able to bypass these defenses \cite{CW}.  
Thus, demonstrating robustness against a range of these attacks provides confidence that a defense is effective in general, against all known attack strategies, rather than against a specific strategy.

These attacks can be divided into three categories: Gradient-based attacks relying on detailed model information, including the gradient of the loss w.r.t. the input. Score-based attacks rely on the predicted scores, such as class probabilities or \textit{logits} of the model. On a conceptual level, these attacks use the predictions to estimate the gradient numerically.  Finally, decision-based attacks rely only on the final output of the model and minimizing the adversarial examples' norm.  The attacks are summarized in Table \ref{Attack_methods}.


\begin{table}[!htp]
\small
\centering
  \caption{Summary of the used attack methods. Notice that the strength estimation is based on~\cite{strength}.} 
  \label{Attack_methods}
  \begin{tabular}{ccccc}
    \toprule
    \textbf{Method} & \textbf{Category}  & \textbf{Norm} & \textbf{Learning} & \textbf{Strength} \\
    \midrule
    FGSM~\cite{fgsm}  & gradient-based   &  $L_\infty$  & One shot  & ***\\
    PGD~\cite{pgd}   & gradient-based   &  $L_\infty$  & Iterative & ****\\
    JSMA~\cite{SMA}  & gradient-based   &  $L_0$       & Iterative & ***\\
    C\&W~\cite{CW}  & gradient-based   &  $L_2$       & Iterative & *****\\
    DF~\cite{deepfool}    & gradient-based   &  $L_2$       & Iterative & ****\\
    LSA~\cite{localsearch}   & Score-based      &  $L_2$       & Iterative & ***\\
    BA~\cite{BA}    & Decision-based   &  $L_2$       & Iterative & ***\\
    HSJ~\cite{HSJ}    & Decision-based   &  $L_2$       & Iterative & *****\\
    
  \bottomrule
\end{tabular}
\end{table}












 






\subsection{Impact on Model Accuracy}
\label{CNNaccuracy}
It is important for a defense mechanism that aims to enhance robustness against adversarial attacks to keep at least an acceptable performance level for clean inputs. In fact, considerably reducing the baseline accuracy, or creating an exploding or vanishing gradient impact that makes the model sensitive to other types of noise undermines the model reliability.  
In our proposed approach, we maintain the same level of recognition rate even with the approximate noise in the calculations. Counter-intuitively, this data-dependent noise helps to better highlight the input's important features used in the recognition and does not affect the classification process. 
A drop of $0.01 \%$ in the recognition rate for the case of LeNet-5 and $1\%$ for AlexNet is recorded as mentioned in Table \ref{tab3}. 

    

\begin{table}[!htp]
\small
\centering
  \caption{Accuracy results of Float32, approximate model, fully quantized, weight-only quantized and Bfloat16 models.}
  \label{tab3}
  \begin{tabular}{ccc}
    \toprule
    \textbf{Used Multiplier }& \textbf{MNIST} & \textbf{CIFAR-10}\\
    \midrule
        Float32                 & 97.93\%  &   81\%   \\
    
        Approximate (DA)	    & 97.67\%  &   80\%     \\ 
        Fully quantized         & -     &   80\%  \\
        Weight-only quantized   & -     &  80\% \\
        Bfloat16                & 97.93  &  81\% \\
        
  \bottomrule
\end{tabular}
\end{table}




\subsection{Impact on Performance and Energy Consumption}



Here we show the additional benefit of using AC, especially in the context of power-limited devices, such as mobile, embedded, and Edge devices.
The experiments evaluate normalized energy and delay achieved by the proposed approximate multiplier compared to a conventional baseline multiplier. Multipliers are implemented using $45~ n m$ technology via the Predictive Technology Model (PTM) using the Keysight Advanced Design System (ADS) simulation platform~\cite{PTM}.  

 \begin{table}[!htp]
 \centering
   \caption{Energy and delay Comparison.}
   \label{tab:energy}
   \begin{tabular}{ccc}
     \toprule
     \textbf{Multiplier }& \textbf{Average energy}	& \textbf{Average delay}  	 \\
     \midrule
         Exact multiplier        & 1 & 1    \\
        
        
         Ax-FPM	                 & 0.487 & 0.29\\ 
         Bfloat16                & 0.4   & 0.4   \\
   \bottomrule
 \end{tabular}
 \end{table}
 
Table \ref{tab:energy} compares the energy and delay for the approximate multiplier and the Bfloat16 multiplier normalized to a conventional multiplier. 
\begin{figure}[!htp]
\centering
\includegraphics[width=1\columnwidth]{32fp_16bf.PNG}
\caption{Contrast between IEEE 754 Single-precision 32-bit floating-point format and Bfloat16 format.
}
\label{fig:bfloat}
\end{figure}

Bfloat16 data representation is shown in Figure \ref{fig:bfloat}, with 1 sign bit, a 8-bit exponent and a 7-bit fraction. The used Bfloat16 multiplier has similar architecture to that of Ax-FPM. However for the mantissa multiplier we use the conventional Booth multiplier instead of the array multiplier.
Ax-FPM achieves up to $51\%$ and $71$\% savings in energy and delay, respectively compared to the baseline multiplier. Bfloat16 implementation results in comparable savings with around $60\%$ lower power and delay. However, this comes without robustness advantages, as mentioned earlier.



 Unlike most of the state-of-the-art defense strategies that lead to power, resource, or timing overhead, DA results in saving energy and area.

\section{Introduction}
\input{Introduction}

\section{Background}
\input{Background}

\section{Threat Model}
\input{Threat_model}
\label{sec:threat}

\section{Defensive Approximation: Implementing Approximate CNNs}
\input{Proposed_approach}
\label{sec:AppxCNN}

\section{Can DA help in defending against adversarial attacks? }
\input{Security_evaluation}
\label{sec:secu}

\section{How does DA help CNN robustness?}
\input{how}
\label{sec:how}

\section{How does DA compare to other reduced precision techniques?}
\input{Quantization}
\label{sec:quan}

\section{Baseline Performance Implications}
\input{Performance_implications}
\label{sec:perf_impl}

\section{Discussion}
\input{Discussion}
\label{discussion}

\section{Related Work}
\input{Related_work}
\label{sec:rw}

\section{Conclusions}
\input{Conclusions}
\label{conclusion}


\begin{acks}
We would like to thank the reviewers and shepherd for the feedback and suggestions that have substantially improved the paper.  This work was partially supported by NSF grants CNS-1646641, CNS-1619322 and CNS-1955650.
\end{acks}


\subsection{Convolutional neural networks}


\subsection{Adversarial Attacks}

Deep learning techniques gained popularity in recent years and are now deployed even in safety-critical tasks, such as recognizing road signs for autonomous vehicles \cite{signs}. Despite their effectiveness and popularity, CNN-powered applications are facing a critical challenge – adversarial attacks. Many studies \cite{vulnerable, fgsm, He, neuroattack} have shown that CNNs are vulnerable to carefully crafted inputs designed to fool them, very small imperceptible perturbations added to the data can completely change the output of the model. In computer vision domain, these adversarial examples are intentionally generated images that look almost exactly the same as the original images, but can mislead the classifier to provide wrong prediction outputs. Other work \cite{noneed} claimed that adversarial examples are not a practical threat to ML in real-life scenarios. However, physical adversarial attacks have recently been shown to be effective against CNN based applications in real-world \cite{phys}.

\noindent 
{\bf Minimizing Injected Noise:} Its essential for the adversary to minimize the added noise to avoid detection.  
For illustration purposes, consider a CNN used for image classification.  More formally, given an original input image $x$ and a target classification model $ f() ~s.t. ~ f(x) = l $, the problem of generating an adversarial example $x^*$ can be formulated as a constrained optimization \cite{pbform}:

\begin{equation}
\label{eq:adv}
     \begin{array}{rlclcl}
        x^* = \displaystyle \argmin_{x^*}  \mathcal{D}(x,x^*),  
         s.t.  ~ f(x^*) = l^*,  ~ l \neq l^*
\end{array}
\end{equation}


Where $\mathcal{D}$ is the distance metric used to quantify the similarity between two images and the goal of the optimization is to minimize this added noise, typically to avoid detection of the adversarial perturbations. $l$ and $l^*$ are the two labels of $x$ and $x^*$, respectively:  $x^*$ is considered as an adversarial example if and only if the label of the two images are different ($ f(x) \neq  f(x^*) $) and the added noise is bounded ($\mathcal{D}(x,x^*) < \epsilon $ where $\epsilon \geqslant 0 $).

\noindent
{\bf Distance Metrics:}
The adversarial examples and the added perturbations should be visually imperceptible by humans. Since it is hard to model humans' perception, researchers proposed three metrics to approximate humans' perception of visual difference, namely $L_0$, $L_2$, and $L_ \infty$ \cite{CW}. These metrics are special cases of the $L_p$ norm: 
\begin{equation}
    \left\|x\right\|_p = \left( \sum^{n}_{i = 1} \left |x_i \right | ^{p} \right)^{\frac{1}{p}}
\end{equation}
These three metrics focus on different aspects of visual significance. $L_0$ counts the number of pixels with different values at corresponding positions in the two images. $L_2$ measures the Euclidean distance between the two images $x$ and $x^*$. $L_ \infty$ measures the maximum difference for all pixels at corresponding positions in the two images.


The consequences of an adversarial attack can be dramatic.  For example, misclassification of a stop sign as a yield sign or a speed limit sign could lead to material and human damages. Another possible situation is when using CNNs in financial transactions and automatic bank check processing -- using handwritten character recognition algorithms to read digits from bank cheques or using neural networks for amount and signature recognition \cite{cheque}. An attacker could easily fool the model to predict wrong bank account numbers or amount of money or even fake a signature. A dangerous situation, especially with such large sums of money at stake.



\subsection{Approximate Computing}

The speed of new generations of computing systems, from embedded and mobile devices to servers and computing data centers, has been drastically climbing in the past decades. This development was made possible by the advances in integrated circuits (ICs) design and driven by the increasingly high demand for performance in the majority of modern applications. However, this development is physically reaching the end of Moore’s law, since TSMC and Samsung are releasing 5 $nm$ technology \cite{tsmc_moore}. On the other hand, a wide range of modern applications is inherently fault-tolerant and may not require the highest accuracy. This observation has motivated the development of approximate computing (AC), a computing paradigm that trades power consumption with accuracy. The idea is to implement inexact/AC elements that consume less energy, as far as the overall application tolerates the imprecision level in computation.
This paradigm has been shown promising for inherently fault-tolerant applications such as deep/ML, big data analytics, and signal processing. Several AC techniques have been proposed in the literature and can be classified into three main categories based on the computing stack layer they target: software, architecture, and circuit level~\cite{Survey}. 

In this paper, we consider AC for a \emph{totally new objective}; enhancing CNNs robustness to adversarial attacks, without losing the initial advantages of AC.

\subsection{Approximate CNN}

We propose to leverage approximate computing to improve the robustness of ML classifiers, such as CNNs, against adversarial attacks. We call this general approach \textbf{Defensive Approximation} (DA). The closest approach to DA is the perturbation-based defense~\cite{snP2019_certif,smooth} that either adds noise or otherwise filter the input data to try to interfere with any adversarial modifications to the input of a classifier. However, our approach advances the state-of-the-art by injecting perturbations throughout the classifier and directly by the approximate hardware, thereby enhancing both robustness and power efficiency. 

Technically, the approximate design process is driven by two main considerations:
\begin{enumerate}[label=(\alph*)]
    \item Injecting significant noise that can influence the CNN behavior, and allows by-product power gains.
    \item Keeping the cumulative noise magnitude under control to avoid impacting the baseline accuracy of the CNN.
\end{enumerate}

For consideration (b), we purpose to an implementation that replaces the conventional mantissa multiplier in floating point multipliers, with a simpler approximate design. This choice is backed by the study in \cite{iccd18, D&T}, which show that errors in the exponent part might have a drastic impact on CNNs accuracy. 
Consideration (a) means that the approximate design needs to be aggressive to induce significant noise. Therefore, as detailed in the next subsection, we chose the corner case, i.e., the most aggressive approximate design \cite{AMA5, Heap}, and used it to replace the mantissa computation logic in a basic floating point multiplier.



In this section, we present our approximate multiplier design and analyze its properties.

\subsection{Approximate Floating Point Multiplier}
ML structures, such as CNNs, often rely on computationally expensive operations, e.g., convolutions that are composed of multiplications and additions. Floating-point multiplications consume most of the processing energy in both inference and training of CNNs~\cite{esl_ihsen,Heap}.
Although approximate computation can be introduced in different ways (with likely different robustness benefits), DA leverages a new approximate 32-bit floating-point multiplier, which we call \textit{approximate floating-point multiplier} (Ax-FPM).
The IEEE 754-2008 compliant floating-point format binary numbers are composed of three parts: a sign, an exponent, and a mantissa (also called fraction)~\cite{FP}.
The sign is the most significant bit, indicating whether the number is positive or negative. In a single-precision format, the following $8$ bits represent the exponent of the binary number ranging from $-126$ to $127$. The remaining $23$ bits represent the fractional part (mantissa). 
For most of the floating number range, the normalized format is:
\begin{equation}\label{eqn:ieee754}
val = ( -1 )^{\textit{sign}} \times 2^{exp-bias} \times ( 1.fraction ) 
\end{equation}

A floating-point multiplier (FPM) consists mainly of three units: mantissa multiplier, exponent adder, and a rounding unit.  The mantissa multiplication consumes $81\%$ of the overall power of the multiplier \cite{trunca}

Ax-FPM is designed based on a mantissa multiplication unit that is constructed using approximate full adders (FA). The FAs are aggressively approximated to inject computational noise within the circuit. We describe Ax-FPM by first presenting the approximate FA design, and then the approximate mantissa multiplier used to build the Ax-FPM. 



\begin{figure}[!htp]
\centering
\includegraphics[width=\columnwidth]{Mantissa_multiplier0.pdf}
\caption{An illustration of a $4 \times 4$ array multiplier architecture.}
\label{MA}
\end{figure}

To build a power-efficient and a higher performance FPM, we propose to replace the mantissa multiplier by an approximate mantissa multiplier; an array multiplier constructed using approximate FAs. We selected an array multiplier implementation because it is considered one of the most power-efficient among conventional multiplier architectures~\cite{array}.  In the array architecture, multiplication is implemented through the addition of partial products generated by multiplying the multiplicand with each bit of multiplier using AND gates, as shown in Figure \ref{MA}. 
\begin{figure}[!htp]
\centering
\includegraphics[width=\columnwidth]{full_adder.pdf}
\caption{Logic diagram of (a) exact Full Adder, (b) AMA5 (used in this work).}
\label{FA}
\end{figure}

Specifically, we build an array multiplier based on an approximate mirror adder (AMA5)~\cite{AMA5} in place of exact FAs. The approximation of a conventional FA is performed by removing some internal circuitry, thereby resulting in power and resource reduction at the cost of introducing errors.  Consider a FA with (A,B, $C_{in}$) as inputs and ($Sum$, $C_{out}$) as outputs ($C$ here refers to carry). For any input combination, the logical \textit{approximate} expressions for $Sum$ and $C_{out}$ are: $Sum = B$ and $C_{out} = A$.
The AMA5 design is constituted by only two buffers (see Figure \ref{FA}), leading to the latency and energy savings relative to the exact design, but more importantly, introduce errors into the computation.  It is worth noting that these errors are data dependent, appearing for specific combinations of the inputs, and ignoring the carry in value, making the injected noise difficult to predict or model. 












When trying to evaluate the proposed Ax-FPM, we were interested in studying its behavior under small input numbers ranging between $-1$ and $+1$ since most of the internal operations within CNNs are in this range.

We measure the introduced error as the difference of the output of the approximate multiplier and the exact multiplier. The results are shown in Figure \ref{appx_mult} using 100 million randomly generated multiplications across the input range from $-1$ to $1$. 
\begin{figure}[!htp]
\centering
\includegraphics[width=0.8\columnwidth]{error_dist_axfpm.pdf}
\caption{Noise introduced by the approximate multiplier while the operands in $[0,1]$.
}
\label{appx_mult}
\end{figure}
Three trends can be observed that will be used later to help understanding the impact of the approximation using Ax-FPM on CNN security: \textbf{(i)} The first is the data-dependent discontinuity of the approximation-induced errors, \textbf{(ii)}  We noticed that in $96\%$ of the cases, the approximate multiplication results in higher absolute values than the exact multiplication: For positive products, the approximate result is higher than the exact result, and for negative product results the approximate result is lower than the exact result, and \textbf{(iii)} In general, we notice that the larger the multiplied numbers, the larger the error magnitude added to the approximate result. As shown later, these observations will help understand the mechanism that we think is behind robustness enhancement. 

\begin{figure}[!htp]
\centering
\includegraphics[width=0.9\columnwidth,height=4cm]{Convolution.pptx.pdf}
\caption{Convolution result of the filter and each input image using exact and approximate convolution.}
\label{appx_conv}
\end{figure}

\subsection{Approximate Convolution}

In order to understand the impact of AC at larger scales than the individual multiplication, we track the impact on convolution operations. The approximate CNN is built using the approximate convolution operations as building blocks. The activation functions and the pooling layers which do not use multiplication are similar to the conventional CNN.   Convolution layers enable CNNs to extract data-driven features rather than relying on manual feature-extraction in classical ML systems. The convolution operation is performed on the layer's input data using a kernel matrix that is convoluted (piece-wise multiplied) against the input data to produce a feature map.



As we slide the filter over the input from left to right and top to bottom whenever the filter coincides with a \textbf{similar} portion of the input, the convolution result is high, and the neuron will fire.
The weight matrix filters out portions of the input image that does not align with the filter, and the approximate multiplier helps improve this process by further increasing the output when a feature is detected. In Figure \ref{appx_conv}, we run an experiment where we choose a filter and six different images with different degrees of similarity to the chosen filter (1 to 6 from the least to the most similar), and we perform the convolution operation. We notice that the approximate convolution using Ax-FPM delivers higher results for similar inputs and lower results for dissimilar inputs. We can also notice that the higher the similarity, the higher the gap between the exact and Ax-FPM approximation results.  Therefore, by using the approximate convolution, the main features of the image that are important in the image recognition are retained and further highlighted with higher scores that will later help increase the confidence of the classification result, as explained in Section \ref{sec:how}.










\subsection{AC Design Space Exploration}
For the sake of comparison, we proceed to a design space exploration considering the accuracy of the multipliers and resource utilization as optimization objectives. The comparison of our design with the optimal approximate design given by the exploration and referred to as HEAP led to a clearly dominant choice in favor of our design given the following perspectives:



\textbf{(i) Resource and power efficiency:} Given its aggressive design, Ax-FPM achieves the lowest power consumption and resource utilization.

\textbf{(ii) Robustness:} While other approximate designs had a positive impact on CNNs robustness, we noticed that Ax-FPM achieves the highest enhancement. 

\textbf{(iii) Accuracy:} CNNs are highly approximation-tolerant, and even aggressive multiplier design didn't impact overall accuracy. Ax-FPM, as well as HEAP have insignificant impact on accuracy.

While these observations give an insight on the potential generalizability of AC positive impact, Ax-FPM is a non dominated design outperforming other design in both robustness, power consumption and resource utilization, while having the same overall accuracy level. 
Hence, in the remainder of the paper, we will focus only on Ax-FPM based DA. Further details and results can be found in the Appendix.

\section{Appendix: Theoretical Analysis} \label{sec:theory}























\section{Appendix: Design Space Exploration} \label{sec:DSE}
\textbf{Accuracy.} HEAP \cite{Heap} is the result of a design space exploration among combinations of different approximate full adders leading to minimal accuracy loss. The selection process of optimal circuit design was performed after an exhaustive accuracy evaluation of all possible configurations
The metrics used to evaluate the accuracy of different combinations are the mean relative error distance (MRED) \cite{metrics} $ {\textstyle MRED= \frac{1}{n} \sum_{i=1}^{n} \frac{ \mid{\hat Y -Y}\mid}{Y} }$, and the normalized mean error distance (NMED): ${\textstyle NMED= \frac{1}{n} \sum_{i=1}^{n} \frac{ \mid{\hat Y -Y}\mid}{P_{max}} }$. Where $Y$ is the exact result, $ \hat Y $ is the approximate result, and $P_{max}$ is the maximum product.

\begin{table}[!htp]
\centering
  \caption{Accuracy results of the LeNet-5 CNN and different multipliers.}
  \label{tab3}
  \begin{tabular}{cccc}
    \toprule
    \textbf{Multiplier }& \textbf{CNN Accuracy}	& \textbf{MRED} & \textbf{NMED}	 \\
    \midrule
        Exact multiplier        & 97.93\%  & 0    & 0\\
        HEAP \cite{Heap}        & 97.86\%  & 0.12 & 0.03\\
        Ax-FPM	    & 97.67\%  & 0.33 & 0.08\\ 
  \bottomrule
\end{tabular}
\end{table}

Table \ref{tab3} includes the accuracy results of the exact multiplier and the two approximate multipliers.
Ax-FPM is substantially less accurate than HEAP.  However, when we evaluate CNN accuracy (using the recognition rate), we notice a negligible accuracy loss for both approximate multipliers, confirming the inherent error-resiliency of CNNs.

\begin{figure}[!htp]
\centering
\includegraphics[width=0.9\columnwidth,height=3.5cm]{error_dis__8_.pdf}
\caption{Noise introduced by the approximate multiplier while the operands $\in [0,1]$ (a). for Ax-FPM, (b). for HEAP \cite{Heap}. 
}
\label{appx_mult_heap}
\end{figure}
Measuring the error introduced by the Ax-FPM and the HEAP for small inputs ranging between $0$ and $1$, see Figure \ref{appx_mult_heap}, we notice that, in addition to the smaller magnitude of error when using the HEAP, a different pattern was found: less data dependency and for only $34\%$ of the cases, the HEAP results were higher than the exact multiplier results. 

In order to further investigate the impact of different approximate multipliers on the convolution layer output, we produce different heat maps. As shown in Figure \ref{heatmaps}, we can see that the Ax-FPM is further highlighting the important features by increasing their scores whereas the HEAP is lowering their scores.

\begin{figure}[!htp]
\centering
\includegraphics[width=0.9\columnwidth]{Heatmaps.pdf}
\caption{ Heat maps of final convolution layer output when using Exact multiplier, Ax-FPM, and HEAP \cite{Heap}. }
\label{heatmaps}
\end{figure}

\noindent\textbf{Energy consumption and Delay.}
We also compare the gain in terms of energy and delay achieved by the two approximate mantissa multipliers. Multipliers are implemented using $45~ n m$ technology via the Predictive Technology Model (PTM) using the Keysight Advanced Design System (ADS) simulation platform~\cite{PTM}.   

\begin{table}[!htp]
\centering
  \caption{Energy and delay of different $24\times24$ approximate multipliers normalized to a conventional $24\times24$ multiplier.}
  \label{tab}
  \begin{tabular}{ccc}
    \toprule
    \textbf{Multiplier }& \textbf{Average energy}	& \textbf{Average delay}  	 \\
    \midrule
        Exact multiplier        & 1 & 1    \\
        HEAP                    & 0.49  & 0.46\\
        Ax-FPM	                 & 0.395 & 0.235\\ 
  \bottomrule
\end{tabular}
\end{table}

As shown in Table \ref{tab}, the mantissa multiplier in Ax-FPM achieves a considerable gain in performance and energy saving compared to the HEAP. A significant reduction in the delay was also achieved.  

\noindent\textbf{Robustness.}
We tried to assess different models transferability, the adversarial examples were generated to fool the exact model. In table \ref{grey-boxresult_with_heap}, we present the percentage of adversarial examples that successfully deceived the approximate models. While the use of the HEAP increased the robustness of the model, the Ax-FPM achieved better results.

\begin{table}[!htp]
\small
\centering
  \caption{Attacks transferability success rates for MNIST.}
  \label{grey-boxresult_with_heap}
  \begin{tabular}{cccc}
    \toprule
    \textbf{Attack} & \textbf{Exact-based}  & \textbf{HEAP-based} & \textbf{Ax-FPM-based}\\
    \midrule
        FGSM          &   100\%  & 16\% & 12\%    \\
        PGD           &   100\%  & 30\% & 28\%    \\
        JSMA          &   100\%  & 42\% & 9\%   \\
        C\&W          &   100\%  & 6\% & 1\%    \\
        DF	          &   100\%  & 18\%  & 17\%   \\ 
        LSA	          &   100\%  & 41\% & 18\%   \\ 
        BA	          &   100\%  & 22\% & 17\%   \\ 
        HSJ	          &   100\%  & 4\% & 2\%    \\         
  \bottomrule
\end{tabular}
\end{table}

All these results confirm that Ax-FPM is a better choice in terms of robustness and resource and power efficiency.

\section{Appendix: Defensive Quantization: Models Architecture}
\label{mod_archi}
We present models architectures in Table \ref{architecture}: For the fully quantized model, ConvolutionQuant, DenseQuant and reluQuant designate respectively a convolution layer with quantized weights, a dense layer with quantized weights and the relu activation function with its output quantized. For the weight quantized model architecture, the ConvolutionQuant and DenseQuant designate respectively a convolution layer with quantized weights and a dense layer with quantized weights.

\begin{table}[!htp]
\small
\centering
  \caption{Fully quantized and Weight quantized models architecture.}
  \label{architecture}
  \begin{tabular}{cc}
    \toprule
    \textbf{Fully Quantized} & \textbf{Weight Quantized}  \\
    \midrule
        ConvolutionQuant     &  ConvolutionQuant    \\
        BatchNorm            &  BatchNorm   \\
        reluQuant            &  relu    \\
        ConvolutionreluQuant &  ConvolutionreluQuant    \\
        MaxPooling           &  MaxPooling    \\
        BatchNorm            &  BatchNorm    \\
        reluQuant            &  relu  \\
        ConvolutionQuant     &  ConvolutionQuant    \\
        BatchNorm            &  BatchNorm     \\
        reluQuant            &  relu \\
        ConvolutionQuant     &  ConvolutionQuant    \\
        MaxPooling           &  MaxPooling    \\
        BatchNorm            &  BatchNorm    \\
        reluQuant            &  relu \\
        ConvolutionQuant     &  ConvolutionQuant    \\
        BatchNorm            &  BatchNorm    \\
        reluQuant            &  relu\\
        ConvolutionQuant     &  ConvolutionQuant    \\
        MaxPooling           &  MaxPooling    \\ 
        BatchNorm            &  BatchNorm    \\
        reluQuant            &  relu    \\
        DenseQuant           &  DenseQuant    \\
        BatchNorm            &  BatchNorm    \\
        reluQuant       	 &  relu   \\ 
        DenseQuant           &  DenseQuant    \\
        BatchNorm            &  BatchNorm    \\
        reluQuant	         &  relu    \\ 
        Dense                &  Dense    \\
        softmax	             &  softmax    \\ 
               
  \bottomrule
\end{tabular}
\end{table}


\subsection{Experimental Setup}

The first benchmark we use is the LeNet-5 CNN architecture \cite{lenet5} along with the MNIST database \cite{mnist}, which implements a classifier for handwritten digit recognition. The MNIST consists of 60,000 training and 10,000 test images with 10 classes corresponding to digits. Each digit example is represented as a gray-scale image of $28 \times 28$ pixels, where each feature corresponds to a pixel intensity normalized between 0 and 1.
We also use the AlexNet image classification CNN \cite{Alexnet} along with the CIFAR-10 database \cite{CIFAR}.  CIFAR-10 consists of 60,000 images, of dimension $64 \times 64 \times 3$ each and contains ten different classes.  LeNet-5 consists of two convolutional layers, two max-pooling layers, and two fully connected layers.  AlexNet uses five convolution layers, three max-pooling layers, and three fully connected layers.
The rectified linear unit (ReLU) was used as the activation function in this evaluation, along with a dropout layer to prevent overfitting.
For both models, the output layer is a special activation function called softmax that will assign probabilities to each class. 




Our implementations are built using the open source ML framework PyTorch \cite{PyTorch}.
We use the Adam optimization algorithm to train the LeNet-5 classifier.  For Alexnet, we use Stochastic Gradient Descent (SGD) with a learning rate equal to  $0.01$ and $0.001$, respectively.  Note that \emph{no retraining} is applied in DA, we rather use the same hyper-parameters obtained from the original (exact) classifier; we simply replace the multipliers with the approximate multiplier.

Our reference exact CNNs are conventional CNNs based on exact convolution layers with the format Conv2d provided by PyTorch.  In contrast, the approximate CNNs emulate the 32-bit Ax-FPM functionality and replace the multiplication in the convolution layers with Ax-FPM in order to assess the behavior of the approximate classifier.

Since we are simulating a cross-layer (approximate) implementation from gate-level up to system-level, the experiments (forward and backward gradient) are highly time consuming, which limited our experiments to the two datasets MNIST and CIFAR-10.

Except for the black-box setting where the attacker trains his own reverse-engineered proxy/substitute model, the approximate and exact classifiers share the same pre-trained parameters and the same architecture; they differ only in the hardware implementation of the multiplier.


\subsection{Do Adversarial Attacks on an Exact CNN Transfer to an Approximate CNN ?}
\label{sec:transExApx}


\textbf{Attack Scenario.} In this setting, the attacker has full knowledge of the classifier architecture and hyper-parameters, but without knowing that the model uses approximate hardware.  An example of such scenario could be in case an attacker correctly guesses the used architecture based on its widespread use for a given application (e.g., LeNet-5 in digit recognition), but is unaware of the use of DA as illustrated in Figure~\ref{grey-box}.

\begin{figure}[!htp]
\centering
\includegraphics[width=\columnwidth]{grey_box_setting1.pdf}
\caption{Transferrability attack scenario.}
\label{grey-box}
\end{figure}

\noindent\textbf{Transferability Analysis.} The classifier generates adversarial examples using the set of algorithms in Table~\ref{Attack_methods} and assume that the exact classifier from Lenet-5 trained on the MNIST dataset. Notice that the hyperparameters, as well as the structure of the network, are the same between the exact and the approximate classifiers.  The attacker then tests the adversarial examples against the approximate classifier. 
Table \ref{grey-boxresult} presents the attacks respective success rates. We notice that the DA considerably reduces the transferability of the malicious samples and, by consequence, increases the robustness of the classifier to this attack setting. We observed that the robustness against transferability is very high, and reaches $99\%$ for $C\&W$ attack.


\begin{table}[!htp]
\small
  \caption{Attacks transferability success rates for MNIST.}
  \label{grey-boxresult}
  \begin{tabular}{ccc}
    \toprule
    \textbf{Attack method} & \textbf{Exact LeNet-5}  & \textbf{Approximate LeNet-5} \\
    \midrule
        FGSM          &   100\%    & 12\%    \\
        PGD           &   100\%    & 28\%    \\
        JSMA          &   100\%    & 9\%   \\
        C\&W          &   100\%    & 1\%    \\
        DF	          &   100\%    & 17\%   \\ 
        LSA	          &   100\%    & 18\%   \\ 
        BA	          &   100\%    & 17\%   \\ 
        HSJ	          &   100\%    & 2\%    \\         
  \bottomrule
\end{tabular}
\end{table}

We repeat the experiment for AlexNet with CIFAR-10 dataset. For the same setting, the success of different adversarial attacks is shown in Table \ref{attackAlexnet}.  While more examples succeed against the approximate classifier, we see that the majority of the attacks do not transfer.  Thus, DA offers built-in robustness against transferability attacks. 

\begin{table}[!htp]
\small
\centering
  \caption{Attacks transferability success rates for CIFAR-10.
  \label{attackAlexnet}
  \begin{tabular}{ccc}
    \toprule
    \textbf{Attack method} & \textbf{Exact AlexNet}  & \textbf{Approximate AlexNet} \\
    \midrule

        FGSM          &   100\%    & 38\%    \\        
        PGD           &   100\%    & 31\%    \\
        JSMA          &   100\%    & 32\%   \\        
        C\&W         &    100\%  & 17\%    \\
        DF	          &   100\%    & 35\%   \\ 
        LSA	          &   100\%    & 36\%   \\ 
        BA	          &   100\%    & 37\%   \\ 
        HSJ	          &   100\%    & 12\%    \\ 
  \bottomrule
\end{tabular}
\end{table}

Notice that, unlike other state-of-the-art defenses, our defense mechanism protects the network without relying on the attack details or the model specification and without any training beyond that of the original classifier.  
Unlike most of the perturbation-based defenses that degrade the classifier’s accuracy on non-adversarial inputs, our defense strategy significantly improves the classification robustness with no baseline accuracy degradation, as we will show in Section~\ref{CNNaccuracy}. 


\subsection{Can We Attack an Approximate CNN?}

In the remaining attack models, we assume that the attacker has direct access to the approximate CNN. We consider both black-box and white-box settings










\textbf{Black-box Attack.} In a black-box setting, the attacker has no access to the classifier architecture, parameters, and the hardware platform but can query the classifier with any input and obtain its output label.  In a typical black-box attack, the adversary uses the results of many queries to the target model to reverse engineer it.  Specifically, the adversary trains a substitute (or proxy) using the labeled inputs obtained from querying the original model (see Figure \ref{black-box}).
We also conduct a black box attack on the exact classifier and evaluate how successful the black box attack is in fooling it.  Essentially, we are comparing the black-box transferability of the reverse-engineered models to the original models for both the exact and the approximate CNNs.

\begin{figure}[!htp]
\centering
\includegraphics[width=\columnwidth]{black_box_setting1.pdf}
\caption{Black-box attack scenario. }
\label{black-box}
\end{figure}

In Table \ref{black-boxresult}, we present the attack success ratios for the exact CNN and the approximate/DA CNN. DA increases resilience to adversarial attacks across various attacks and for both single-step and iterative ones: it achieves $73\%$ classification success on adversarial examples in the worst case and the defense succeeded in up to $100\%$ of the examples generated by C\&W, PGD, and HSJ respectively. 
\begin{table}[!htp]
\small
\centering
  \caption{Black-box attacks success rates for MNIST.}
  \label{black-boxresult}
  \begin{tabular}{ccc}
    \toprule
    \textbf{Attack method} & \textbf{Exact LeNet-5}  & \textbf{Approximate LeNet-5} \\
    \midrule
        FGSM          &   100\%    & 22\%    \\
        PGD           &   100\%    & 0\%    \\
        JSMA          &   100\%    & 13\%   \\
        C\&W          &    100\%   & 0\%    \\
        DF	          &   100\%    & 25\%   \\ 
        LSA	          &   100\%    & 26\%   \\ 
        BA	          &   100\%    & 27\%   \\ 
        HSJ	          &   100\%    & 0\%    \\ 
  \bottomrule
\end{tabular}
\end{table}


\textbf{White-box Attack.} In this setting, the attacker has access to the approximate hardware along with the victim model architecture and parameters, as shown in Figure \ref{white-box}. In particular, the adversary has full knowledge of the defender model, its architecture, the defense mechanism, along with full access to approximate gradients used to build the gradient-based attacks. In essence, the attacker is aware of our defense, and can adapt around it with full knowledge of the model and the hardware, which is a recommended methodology for evaluating new defenses~\cite{carlini_gift}.
 


\begin{figure}[!htp]
\centering
\includegraphics[width=\columnwidth]{white_box_setting1.pdf}
\caption{White-box attack scenario.}
\label{white-box}
\end{figure}

In this scenario, we assume a powerful attacker with full access to the approximate classifier's internal model and can query it indefinitely to directly create adversarial attacks.  Although DA in production would normally reduce execution time, in our experiments, we \emph{emulate} the 32-bit Ax-FPM functionality within the approximate classifier.  As a result, this makes inference extremely slow: on average, it takes $5$ to $6$ days to craft one adversarial example on an 8th Gen Intel core i7-8750H processor with NVIDIA GeForce GTX 1050. This led us to limit the white-box experiments; we use only two of the most efficient attacks in our benchmark: $C\&W$ and DeepFool attacks, and for a limited number of examples selected randomly from our test set for different classes. 

In a white box attack, with an unconstrained noise budget, an adversary can always eventually succeed in causing an image to misclassify. Thus, robustness against this type of attack occurs through the magnitude of the adversarial noise to be added: if this magnitude is high, this may exceed the ability of the attacker to interfere, or cause the attack to be easily detectable.
\begin{figure}[!htp]
\centering
\includegraphics[width=\columnwidth]{L2_DeepFool.pdf}
\caption{Required perturbations by DeepFool attack, measured using $L_2$ distance, to generate MNIST adversarial examples for approximate and exact classifiers. }
\label{L2}
\end{figure}

Figures \ref{L2} and \ref{L2_C&W}, respectively, present different measures of $L_2$ for adversarial examples crafted using DF and $C\&W$ attacking both a conventional CNN and an approximate CNN. We notice that the distance between a clean image and the adversarial example generated under DA is much larger than the distance between a clean sample and the adversarial example generated for the exact classifier. On average, a difference of $5.12$ for $L_2$-DeepFool attacks and $1.23$ for $L_2$-C\&W attack.
This observation confirms that DA is more robust to adversarial perturbations since the magnitude of the adversarial noise has to be significantly higher for DF to fool DA successfully. 

To understand the implication of this higher robustness in terms of observable effects on the input image,  we also show the Peak Signal to Noise Ratio (PSNR) and the Mean Square Error (MSE) in Figures \ref{MSE&PSNR_DF} and \ref{MSE&PSNR}; these are two common measures of the error introduced in a reconstruction of an image. Specifically,  MSE represents the average of the squares of the "errors" between the clean image and the adversarial image. The error is the amount by which the values of the original image differ from the distorted image. PSNR is an expression for the ratio between the maximum possible value (power) of a signal and the power of distorting noise that affects the quality of its representation. It is given by the following equation: $P S N R=20 \log _{10}\left(\frac{M A X_{x}}{\sqrt{M S E}}\right)$. The lower the PSNR, the higher the image quality degradation is.

We notice that the adversarial examples generated for DA is more noisy than adversarial examples generated for an exact classifier. The PSNR difference reaches $4 dB$ for C\&W and $7.8dB$ for DeepFool. Moreover, on average, the DA-dedicated adversarial examples have $6$ times, and $3$ times more MSE than the exact classifier-dedicated adversarial examples for $C\&W$ and DeepFool attacks, respectively. 


\begin{figure}[!htp]
\centering
\includegraphics[width=0.9\columnwidth]{L2_C_W.pdf}
\caption{Required perturbations by C\&W attack, measured using $L_2$ distance, to generate MNIST adversarial examples for approximate and exact classifiers. }
\label{L2_C&W}
\end{figure}

We can conclude that DA provides substantial built-in robustness for all three attack models we considered.  Attacks generated against an exact model do not transfer successfully to DA.  Black-box attacks also achieve a low success rate against DA.  Finally, even white-box attacks require substantial increases in the injected noise to fool DA.  Next, we probe deeper into DA's internal behavior to provide some intuition and explanation for these observed robustness advantages

\begin{figure}[!htp]
\centering
\includegraphics[width=\columnwidth]{MSE_PSNR_DF.png}
\caption{MSE and PSNR values for the generated adversarial examples using DeepFool method when attacking the approximate and the exact classifiers.}
\label{MSE&PSNR_DF}
\end{figure}

\begin{figure}[!htp]
\centering
\includegraphics[width=\columnwidth]{MSE_PSNR.png}
\caption{MSE and PSNR values for the generated adversarial examples using $L_2$-C\&W method when attacking the approximate and the exact classifiers.}
\label{MSE&PSNR}
\end{figure}













\subsection{Adversary Knowledge (Attacks Scenarios)}

In this work, we consider three attack scenarios:

\noindent
    \textbf{\textit{Transferability Attack.}} We assume the adversary is aware of the exact classifier internal model; its architecture and parameters. The adversary uses the exact classifier to create adversarial examples. Thus, we explore whether these examples transfer effectively to the approximate classifier (DA classifier).
    
  \noindent  
    \textbf{\textit{Black-box Attack.}} We assume the attacker has access only to the input/output of the victim classifier (which is our approximate classifier) and has no information about its internal architecture.  The adversary first uses the results of querying the victim to reverse engineer the classifier and create a substitute
    CNN model.   With the substitute model, the attacker can attempt to generate different adversarial examples to attack the victim classifier.

\noindent
    \textbf{\textit{White-box Attack.}} We assume a powerful attacker who has full knowledge of the victim classifier's architecture and parameters (including the fact that it uses AC).  The attacker uses this knowledge to create adversarial examples. 


\subsection{Adversarial Example Generation}

 We consider several adversarial attack generation algorithms for our attack scenarios, including some of the most recent and potent evasion attacks.  Generally, in each algorithm, the attacker tries to evade the system by adjusting malicious samples during the inference phase, assuming no influence over the training data. However, as different defenses have started to be deployed that specifically target individual adversarial attack generation strategies, new algorithms have started to be deployed that bypass these defenses. For example, methods such as defensive distillation \cite{distillation_SP} and automation detection \cite{early} were introduced and demonstrate robustness against the Fast gradient sign attack
 \cite{fgsm}.  However, the new $C\&W$ attack was able to bypass these defenses \cite{CW}.  
Thus, demonstrating robustness against a range of these attacks provides confidence that a defense is effective in general, against all known attack strategies, rather than against a specific strategy.

These attacks can be divided into three categories: Gradient-based attacks relying on detailed model information, including the gradient of the loss w.r.t. the input. Score-based attacks rely on the predicted scores, such as class probabilities or \textit{logits} of the model. On a conceptual level, these attacks use the predictions to estimate the gradient numerically.  Finally, decision-based attacks rely only on the final output of the model and minimizing the adversarial examples' norm.  The attacks are summarized in Table \ref{Attack_methods}.


\begin{table}[!htp]
\small
\centering
  \caption{Summary of the used attack methods. Notice that the strength estimation is based on~\cite{strength}.} 
  \label{Attack_methods}
  \begin{tabular}{ccccc}
    \toprule
    \textbf{Method} & \textbf{Category}  & \textbf{Norm} & \textbf{Learning} & \textbf{Strength} \\
    \midrule
    FGSM~\cite{fgsm}  & gradient-based   &  $L_\infty$  & One shot  & ***\\
    PGD~\cite{pgd}   & gradient-based   &  $L_\infty$  & Iterative & ****\\
    JSMA~\cite{SMA}  & gradient-based   &  $L_0$       & Iterative & ***\\
    C\&W~\cite{CW}  & gradient-based   &  $L_2$       & Iterative & *****\\
    DF~\cite{deepfool}    & gradient-based   &  $L_2$       & Iterative & ****\\
    LSA~\cite{localsearch}   & Score-based      &  $L_2$       & Iterative & ***\\
    BA~\cite{BA}    & Decision-based   &  $L_2$       & Iterative & ***\\
    HSJ~\cite{HSJ}    & Decision-based   &  $L_2$       & Iterative & *****\\
    
  \bottomrule
\end{tabular}
\end{table}












 






\subsection{Impact of approximation on model confidence}

The output of the CNN is computed using the \emph{softmax} function, which normalizes the outputs from the fully connected layer into a likelihood value for each output class.  Specifically, this function takes an input vector and returns a non-negative probability distribution vector of the same dimension corresponding to the output classes.   In this section, we examine the impact of approximation on the observed classifier confidence. We compare the output scores of an exact and an approximate classifier for a set of $1000$ representative samples selected from the MNIST dataset: $100$ randomly selected from each class. We define the classification confidence, $C$, as the difference between the true class $l$'s score and the "runner-up" class score, i.e., the class with the second-highest score. $C$ is expressed by $C = output[l] - max_{j \neq l} \{output[j]\}$.  The confidence ranges from $0$ when the classifier gives equal likelihood to the top two or more classes, to $1$ when the top class has a likelihood of $1$, and all other classes $0$.  




We plot the cumulative distribution of confidence for both classifiers in Figure \ref{conf_dis}.  DA images have higher confidence; for example, in images classified by the exact classifier, less than $20\%$  had higher than $0.8$ confidence.   
On the other hand, for the approximate classifier, $74.5\%$ of the images reached that threshold.




\begin{figure}[!htp]
\centering
\includegraphics[width=0.9\columnwidth]{confidence_dist.pdf}
\caption{Cumulative distribution of confidence.}
\label{conf_dis}
\end{figure}



Compared to the baseline feature maps generated from an exact convolution operation, for the same pre-trained weights, our approximate convolution highlights further the features. Recall that the multiplier injected noise is higher when input numbers are higher (i.e., there is a high similarity between the kernel and the input data) and lower when the inputs are lower (when the similarity is small), as shown in Figure \ref{appx_conv}. We believe that these enhanced features continue to propagate through the model resulting in a higher probability for the predicted class. This higher confidence requires thereby higher noise to decrease the true label's likelihood, and increase another label's. 






























































    









\subsection{Defensive Quantization}

Defensive quantization \cite{DQ} was proposed to jointly optimize the efficiency and robustness of deep learning models. A 4-bit quantized model was trained on CIFAR-10 using the Dorefa-Net method \cite{zhou2018dorefanet}. The model architecture is detailed in Appendix \ref{mod_archi}. We consider two ways of quantization: (i) Weight quantization, where only the weights are quantized, and (ii) Full quantization where the weights
of each convolutional and dense block and the output of each activation function are quantized.
In Table \ref{quan_result4}, we report transferability between exact (32-bit floating point), approximate model (using DA), fully quantized and weight-only quantized model.
We notice that DA is almost  two times more robust against transferability attacks than DQ under FGSM, PGD and C\&W attacks. We believe that this is due to the difference in terms of noise distribution between DA and DQ. In fact, while DQ-induced noise tends to make the initial decision boundary smoother, the input-dependent noise in DA makes its decision boundary randomly different from the initial model.

\begin{table}[!htp]
\small
  \caption{Comparing attacks transferability success rates for CIFAR-10 when using DA and DQ.}
  \label{quan_result4}
  \begin{tabular}{ccccc}
    \toprule
                     &          & \textbf{DA:} & \textbf{DQ:} & \textbf{DQ:} \\
    \textbf{Attack method} & \textbf{Exact}  &  & \textbf{Full } & \textbf{Weight-only } \\
    \midrule
        FGSM          &   100\%    & 38\%  & 60\%  & 61\% \\
        PGD           &   100\%    & 31\%  & 74\% & 73\%\\
        C\&W          &   100\%    & 17\%  & 68\% &  68\% \\
        
  \bottomrule
\end{tabular}
\end{table}

\subsection{BFloat16}

The Bfloat16 (Brain Floating Point) \cite{ kalamkar2019study} is a truncated version of the 32-bit IEEE 754  single-precision floating-point format (float32). It is composed of one sign bit, eight exponent bits, and seven mantissa bits giving the range of a full 32-bit number but in the data size of a 16-bit number. Bfloat16 is used in machine learning applications and intended to reduce the storage requirements and increase computing speed without losing precision. 

To evaluate the impact of Bfloat16 on deep neural networks robustness, we use Pytorch framework \cite{PyTorch} to implement Bfloat16-based CNN architectures and test them for MNIST and CIFAR-10 benchmarks.
We notice that using Bfloat16 achieves the same prediction accuracy as the full precision 32-bit floating point. No remarkable change was noticed at the output of the convolutional layers nor in the confidence of the models. We believe this is due to the nature of the noise introduced by reducing data representation accuracy. A more detailed discussion can be found in Section \ref{discussion}. 

Figure \ref{bfloat16} shows the noise resulting from multiplying $100$ million randomly generated Bfloat16 numbers compared to their corresponding 32-bit floating point. This figure shows that, in contrast with our approximate multiplier (Figure \ref{appx_mult}), Bfloat16 multiplication results in mostly negative noise with orders of magnitude lower than DA-induced noise. Moreover, the Bfloat16 noise is not input-dependent, and has no specific impact on the model confidence. Accordingly, no improvement in the robustness was noticed when attacking the Bfloat16 model using FGSM, PGD and $C\&W$. 

\begin{figure}[!htp]
\centering
\includegraphics[width=0.9\columnwidth]{error_dis_bfloat16.pdf}
\caption{Noise introduced by multiplying Bfloat16 while the operands $\in [0,1]$.
}
\label{bfloat16}
\end{figure}



\subsection{Impact of approximation on model confidence}

The output of the CNN is computed using the \emph{softmax} function, which normalizes the outputs from the fully connected layer into a likelihood value for each output class.  Specifically, this function takes an input vector and returns a non-negative probability distribution vector of the same dimension corresponding to the output classes.   In this section, we examine the impact of approximation on the observed classifier confidence. We compare the output scores of an exact and an approximate classifier for a set of $1000$ representative samples selected from the MNIST dataset: $100$ randomly selected from each class. We define the classification confidence, $C$, as the difference between the true class $l$'s score and the "runner-up" class score, i.e., the class with the second-highest score. $C$ is expressed by $C = output[l] - max_{j \neq l} \{output[j]\}$.  The confidence ranges from $0$ when the classifier gives equal likelihood to the top two or more classes, to $1$ when the top class has a likelihood of $1$, and all other classes $0$.  




We plot the cumulative distribution of confidence for both classifiers in Figure \ref{conf_dis}.  DA images have higher confidence; for example, in images classified by the exact classifier, less than $20\%$  had higher than $0.8$ confidence.   
On the other hand, for the approximate classifier, $74.5\%$ of the images reached that threshold.




\begin{figure}[!htp]
\centering
\includegraphics[width=0.9\columnwidth]{confidence_dist.pdf}
\caption{Cumulative distribution of confidence.}
\label{conf_dis}
\end{figure}



Compared to the baseline feature maps generated from an exact convolution operation, for the same pre-trained weights, our approximate convolution highlights further the features. Recall that the multiplier injected noise is higher when input numbers are higher (i.e., there is a high similarity between the kernel and the input data) and lower when the inputs are lower (when the similarity is small), as shown in Figure \ref{appx_conv}. We believe that these enhanced features continue to propagate through the model resulting in a higher probability for the predicted class. This higher confidence requires thereby higher noise to decrease the true label's likelihood, and increase another label's. 






























































    









\section{Introduction}
\input{Introduction}

\section{Background}
\input{Background}

\section{Threat Model}
\input{Threat_model}
\label{sec:threat}

\section{Defensive Approximation: Implementing Approximate CNNs}
\input{Proposed_approach}
\label{sec:AppxCNN}

\section{Can DA help in defending against adversarial attacks? }
\input{Security_evaluation}
\label{sec:secu}

\section{How does DA help CNN robustness?}
\input{how}
\label{sec:how}

\section{How does DA compare to other reduced precision techniques?}
\input{Quantization}
\label{sec:quan}

\section{Baseline Performance Implications}
\input{Performance_implications}
\label{sec:perf_impl}

\section{Discussion}
\input{Discussion}
\label{discussion}

\section{Related Work}
\input{Related_work}
\label{sec:rw}

\section{Conclusions}
\input{Conclusions}
\label{conclusion}


\begin{acks}
We would like to thank the reviewers and shepherd for the feedback and suggestions that have substantially improved the paper.  This work was partially supported by NSF grants CNS-1646641, CNS-1619322 and CNS-1955650.
\end{acks}


\section{Appendix: Theoretical Analysis} \label{sec:theory}























\section{Appendix: Design Space Exploration} \label{sec:DSE}
\textbf{Accuracy.} HEAP \cite{Heap} is the result of a design space exploration among combinations of different approximate full adders leading to minimal accuracy loss. The selection process of optimal circuit design was performed after an exhaustive accuracy evaluation of all possible configurations
The metrics used to evaluate the accuracy of different combinations are the mean relative error distance (MRED) \cite{metrics} $ {\textstyle MRED= \frac{1}{n} \sum_{i=1}^{n} \frac{ \mid{\hat Y -Y}\mid}{Y} }$, and the normalized mean error distance (NMED): ${\textstyle NMED= \frac{1}{n} \sum_{i=1}^{n} \frac{ \mid{\hat Y -Y}\mid}{P_{max}} }$. Where $Y$ is the exact result, $ \hat Y $ is the approximate result, and $P_{max}$ is the maximum product.

\begin{table}[!htp]
\centering
  \caption{Accuracy results of the LeNet-5 CNN and different multipliers.}
  \label{tab3}
  \begin{tabular}{cccc}
    \toprule
    \textbf{Multiplier }& \textbf{CNN Accuracy}	& \textbf{MRED} & \textbf{NMED}	 \\
    \midrule
        Exact multiplier        & 97.93\%  & 0    & 0\\
        HEAP \cite{Heap}        & 97.86\%  & 0.12 & 0.03\\
        Ax-FPM	    & 97.67\%  & 0.33 & 0.08\\ 
  \bottomrule
\end{tabular}
\end{table}

Table \ref{tab3} includes the accuracy results of the exact multiplier and the two approximate multipliers.
Ax-FPM is substantially less accurate than HEAP.  However, when we evaluate CNN accuracy (using the recognition rate), we notice a negligible accuracy loss for both approximate multipliers, confirming the inherent error-resiliency of CNNs.

\begin{figure}[!htp]
\centering
\includegraphics[width=0.9\columnwidth,height=3.5cm]{error_dis__8_.pdf}
\caption{Noise introduced by the approximate multiplier while the operands $\in [0,1]$ (a). for Ax-FPM, (b). for HEAP \cite{Heap}. 
}
\label{appx_mult_heap}
\end{figure}
Measuring the error introduced by the Ax-FPM and the HEAP for small inputs ranging between $0$ and $1$, see Figure \ref{appx_mult_heap}, we notice that, in addition to the smaller magnitude of error when using the HEAP, a different pattern was found: less data dependency and for only $34\%$ of the cases, the HEAP results were higher than the exact multiplier results. 

In order to further investigate the impact of different approximate multipliers on the convolution layer output, we produce different heat maps. As shown in Figure \ref{heatmaps}, we can see that the Ax-FPM is further highlighting the important features by increasing their scores whereas the HEAP is lowering their scores.

\begin{figure}[!htp]
\centering
\includegraphics[width=0.9\columnwidth]{Heatmaps.pdf}
\caption{ Heat maps of final convolution layer output when using Exact multiplier, Ax-FPM, and HEAP \cite{Heap}. }
\label{heatmaps}
\end{figure}

\noindent\textbf{Energy consumption and Delay.}
We also compare the gain in terms of energy and delay achieved by the two approximate mantissa multipliers. Multipliers are implemented using $45~ n m$ technology via the Predictive Technology Model (PTM) using the Keysight Advanced Design System (ADS) simulation platform~\cite{PTM}.   

\begin{table}[!htp]
\centering
  \caption{Energy and delay of different $24\times24$ approximate multipliers normalized to a conventional $24\times24$ multiplier.}
  \label{tab}
  \begin{tabular}{ccc}
    \toprule
    \textbf{Multiplier }& \textbf{Average energy}	& \textbf{Average delay}  	 \\
    \midrule
        Exact multiplier        & 1 & 1    \\
        HEAP                    & 0.49  & 0.46\\
        Ax-FPM	                 & 0.395 & 0.235\\ 
  \bottomrule
\end{tabular}
\end{table}

As shown in Table \ref{tab}, the mantissa multiplier in Ax-FPM achieves a considerable gain in performance and energy saving compared to the HEAP. A significant reduction in the delay was also achieved.  

\noindent\textbf{Robustness.}
We tried to assess different models transferability, the adversarial examples were generated to fool the exact model. In table \ref{grey-boxresult_with_heap}, we present the percentage of adversarial examples that successfully deceived the approximate models. While the use of the HEAP increased the robustness of the model, the Ax-FPM achieved better results.

\begin{table}[!htp]
\small
\centering
  \caption{Attacks transferability success rates for MNIST.}
  \label{grey-boxresult_with_heap}
  \begin{tabular}{cccc}
    \toprule
    \textbf{Attack} & \textbf{Exact-based}  & \textbf{HEAP-based} & \textbf{Ax-FPM-based}\\
    \midrule
        FGSM          &   100\%  & 16\% & 12\%    \\
        PGD           &   100\%  & 30\% & 28\%    \\
        JSMA          &   100\%  & 42\% & 9\%   \\
        C\&W          &   100\%  & 6\% & 1\%    \\
        DF	          &   100\%  & 18\%  & 17\%   \\ 
        LSA	          &   100\%  & 41\% & 18\%   \\ 
        BA	          &   100\%  & 22\% & 17\%   \\ 
        HSJ	          &   100\%  & 4\% & 2\%    \\         
  \bottomrule
\end{tabular}
\end{table}

All these results confirm that Ax-FPM is a better choice in terms of robustness and resource and power efficiency.

\section{Appendix: Defensive Quantization: Models Architecture}
\label{mod_archi}
We present models architectures in Table \ref{architecture}: For the fully quantized model, ConvolutionQuant, DenseQuant and reluQuant designate respectively a convolution layer with quantized weights, a dense layer with quantized weights and the relu activation function with its output quantized. For the weight quantized model architecture, the ConvolutionQuant and DenseQuant designate respectively a convolution layer with quantized weights and a dense layer with quantized weights.

\begin{table}[!htp]
\small
\centering
  \caption{Fully quantized and Weight quantized models architecture.}
  \label{architecture}
  \begin{tabular}{cc}
    \toprule
    \textbf{Fully Quantized} & \textbf{Weight Quantized}  \\
    \midrule
        ConvolutionQuant     &  ConvolutionQuant    \\
        BatchNorm            &  BatchNorm   \\
        reluQuant            &  relu    \\
        ConvolutionreluQuant &  ConvolutionreluQuant    \\
        MaxPooling           &  MaxPooling    \\
        BatchNorm            &  BatchNorm    \\
        reluQuant            &  relu  \\
        ConvolutionQuant     &  ConvolutionQuant    \\
        BatchNorm            &  BatchNorm     \\
        reluQuant            &  relu \\
        ConvolutionQuant     &  ConvolutionQuant    \\
        MaxPooling           &  MaxPooling    \\
        BatchNorm            &  BatchNorm    \\
        reluQuant            &  relu \\
        ConvolutionQuant     &  ConvolutionQuant    \\
        BatchNorm            &  BatchNorm    \\
        reluQuant            &  relu\\
        ConvolutionQuant     &  ConvolutionQuant    \\
        MaxPooling           &  MaxPooling    \\ 
        BatchNorm            &  BatchNorm    \\
        reluQuant            &  relu    \\
        DenseQuant           &  DenseQuant    \\
        BatchNorm            &  BatchNorm    \\
        reluQuant       	 &  relu   \\ 
        DenseQuant           &  DenseQuant    \\
        BatchNorm            &  BatchNorm    \\
        reluQuant	         &  relu    \\ 
        Dense                &  Dense    \\
        softmax	             &  softmax    \\ 
               
  \bottomrule
\end{tabular}
\end{table}

