Super-Efficient Super Resolution for Fast Adversarial Defense at the Edge

TL;DR

This paper demonstrates that tiny, computationally efficient super resolution models can effectively defend against adversarial attacks on image classifiers, maintaining robustness while significantly reducing computational costs on edge devices.

Contribution

The study introduces SESR, a super resolution model that is much smaller and faster than existing models, yet provides comparable adversarial robustness for edge deployment.

Findings

SESR achieves similar robustness to larger models.

SESR requires 2x to 330x fewer MAC operations.

SESR attains nearly 3x higher FPS on a micro-NPU.

Abstract

Autonomous systems are highly vulnerable to a variety of adversarial attacks on Deep Neural Networks (DNNs). Training-free model-agnostic defenses have recently gained popularity due to their speed, ease of deployment, and ability to work across many DNNs. To this end, a new technique has emerged for mitigating attacks on image classification DNNs, namely, preprocessing adversarial images using super resolution -- upscaling low-quality inputs into high-resolution images. This defense requires running both image classifiers and super resolution models on constrained autonomous systems. However, super resolution incurs a heavy computational cost. Therefore, in this paper, we investigate the following question: Does the robustness of image classifiers suffer if we use tiny super resolution models? To answer this, we first review a recent work called Super-Efficient Super Resolution (SESR) that achieves similar or better image quality than prior art while requiring 2x to 330x fewer Multiply-Accumulate (MAC) operations. We demonstrate that despite being orders of magnitude smaller than existing models, SESR achieves the same level of robustness as significantly larger networks. Finally, we estimate end-to-end performance of super resolution-based defenses on a commercial Arm Ethos-U55 micro-NPU. Our findings show that SESR achieves nearly 3x higher FPS than a baseline while achieving similar robustness.