Faults That Fortify: CNN Adversarial Robustness via GPU Undervolting

• URL: http://arxiv.org/abs/2608.20572v1
• Date: Thu, 20 Aug 2026 21:14:25 GMT
• Title: Faults That Fortify: CNN Adversarial Robustness via GPU Undervolting
• Abstract summary: CNNs face a dual challenge: vulnerability to adversarial attacks and prohibitive training cost.<n>This paper addresses both through GPU undervolting during training.
• Score: 7.191035174525401
• License: http://creativecommons.org/licenses/by/4.0/
• Abstract: Convolutional Neural Networks (CNNs) face a dual challenge: vulnerability to adversarial attacks and prohibitive training cost. Adversarial training is effective but expensive, a burden that grows as learning shifts to the energy-constrained edge. This paper addresses both through GPU undervolting during training. Reducing supply voltage introduces stochastic perturbations that act as implicit regularization, improving robustness while lowering power. We characterize undervolting-induced faults at the bit level, then train LeNet, VGG-6, and MobileNetV3 on MNIST and CIFAR-10 under two training regimes, standard and adversarial, each at nominal and undervolted voltage, and evaluate all models against adversarial attacks. In both regimes, the undervolted model consistently achieves higher adversarial accuracy than its nominal-voltage counterpart, showing that hardware-induced faults strengthen even adversarial training. Because dynamic power scales quadratically with supply voltage, these robustness gains arrive with substantial energy savings. GPU undervolting is therefore a readily deployable hardware-level defense requiring no algorithmic change, and opens a promising direction in which robustness and energy efficiency move together.

Related papers

• Bit2Watt: A Cyber-Physical Vulnerability Exploiting GPU Workloads Across Power and Computing Infrastructures [11.013860591931719]
  Bit2Watt is a vulnerability in which an adversary manipulates GPU workloads to induce controlled, high-frequency power modulations.<n>We show that the resulting power-quality degradation can stress data-center power-delivery equipment, trigger protection mechanisms, and, in extreme simulated cases, induce cascading failures in transmission-scale systems.<n>This work highlights the urgent need for cross-layer defenses that jointly consider workload scheduling and power electronics.
  arXiv  Detail & Related papers  (2026-07-07T08:26:01Z)
• PHANTOM: Physics-Aware Adversarial Attacks against Federated Learning-Coordinated EV Charging Management System [2.5019498860784926]
  We propose PHANTOM, a physics-aware adversarial network that is trained and optimized through a multi-agent reinforcement learning model.<n>Results demonstrate how learned attack policies disrupt load balancing and induce voltage instabilities that propagate across T and D boundaries.
  arXiv  Detail & Related papers  (2025-12-26T20:54:16Z)
• GAVINA: flexible aggressive undervolting for bit-serial mixed-precision DNN acceleration [1.168664284092282]
  Voltage overscaling, or undervolting, is an enticing approximate technique in the context of energy-efficient Deep Neural Network (DNN) acceleration.<n>We propose a new technique called Guarded Aggressive underVolting (GAV)<n>GAV supports arbitrary mixed precision and flexible undervolting, with an energy efficiency of up to 89 TOP/sW in its most aggressive configuration.
  arXiv  Detail & Related papers  (2025-11-28T14:06:08Z)
• How Robust Are Energy-Based Models Trained With Equilibrium Propagation? [4.374837991804085]
  Adrial training is the current state-of-the-art defense against adversarial attacks. It lowers the model's accuracy on clean inputs, is computationally expensive, and offers less robustness to natural noise. In contrast, energy-based models (EBMs) incorporate feedback connections from each layer to the previous layer, yielding a recurrent, deep-attractor architecture.
  arXiv  Detail & Related papers  (2024-01-21T16:55:40Z)
• Dynamics-aware Adversarial Attack of Adaptive Neural Networks [75.50214601278455]
  We investigate the dynamics-aware adversarial attack problem of adaptive neural networks. We propose a Leaded Gradient Method (LGM) and show the significant effects of the lagged gradient. Our LGM achieves impressive adversarial attack performance compared with the dynamic-unaware attack methods.
  arXiv  Detail & Related papers  (2022-10-15T01:32:08Z)
• Strength-Adaptive Adversarial Training [103.28849734224235]
  Adversarial training (AT) is proven to reliably improve network's robustness against adversarial data. Current AT with a pre-specified perturbation budget has limitations in learning a robust network. We propose emphStrength-Adaptive Adversarial Training (SAAT) to overcome these limitations.
  arXiv  Detail & Related papers  (2022-10-04T00:22:37Z)
• Downlink Power Allocation in Massive MIMO via Deep Learning: Adversarial Attacks and Training [62.77129284830945]
  This paper considers a regression problem in a wireless setting and shows that adversarial attacks can break the DL-based approach. We also analyze the effectiveness of adversarial training as a defensive technique in adversarial settings and show that the robustness of DL-based wireless system against attacks improves significantly.
  arXiv  Detail & Related papers  (2022-06-14T04:55:11Z)
• Stabilizing Voltage in Power Distribution Networks via Multi-Agent Reinforcement Learning with Transformer [128.19212716007794]
  We propose a Transformer-based Multi-Agent Actor-Critic framework (T-MAAC) to stabilize voltage in power distribution networks. In addition, we adopt a novel auxiliary-task training process tailored to the voltage control task, which improves the sample efficiency.
  arXiv  Detail & Related papers  (2022-06-08T07:48:42Z)
• Using Undervolting as an On-Device Defense Against Adversarial Machine Learning Attacks [1.9212368803706579]
  We propose a novel, lightweight adversarial correction and/or detection mechanism for image classifiers. We show that these errors disrupt the adversarial input in a way that can be used either to correct the classification or detect the input as adversarial.
  arXiv  Detail & Related papers  (2021-07-20T23:21:04Z)
• Adaptive Feature Alignment for Adversarial Training [56.17654691470554]
  CNNs are typically vulnerable to adversarial attacks, which pose a threat to security-sensitive applications. We propose the adaptive feature alignment (AFA) to generate features of arbitrary attacking strengths. Our method is trained to automatically align features of arbitrary attacking strength.
  arXiv  Detail & Related papers  (2021-05-31T17:01:05Z)
• On the Adversarial Robustness of Visual Transformers [129.29523847765952]
  This work provides the first and comprehensive study on the robustness of vision transformers (ViTs) against adversarial perturbations. Tested on various white-box and transfer attack settings, we find that ViTs possess better adversarial robustness when compared with convolutional neural networks (CNNs)
  arXiv  Detail & Related papers  (2021-03-29T14:48:24Z)

This list is automatically generated from the titles and abstracts of the papers in this site.

This site does not guarantee the quality of this site (including all information) and is not responsible for any consequences.