GPU Undervolting Boosts CNN Adversarial Robustness and Energy Efficiency

Convolutional Neural Networks (CNNs) face a dual challenge: their susceptibility to adversarial attacks and the high computational cost of training, especially for robust models. Traditional adversarial training methods, while effective, are notoriously expensive, a burden that intensifies as machine learning shifts towards energy-constrained edge devices. This research proposes an innovative solution by leveraging GPU undervolting during the training process. By reducing the supply voltage to the GPU, stochastic perturbations are introduced into the hardware's operation. These perturbations act as a form of implicit regularization, which surprisingly enhances the model's robustness against adversarial attacks. Crucially, this method also leads to substantial energy savings because dynamic power consumption scales quadratically with supply voltage. The study characterized these undervolting-induced faults at a bit level and tested various CNN models (LeNet, VGG-6, MobileNetV3) on MNIST and CIFAR-10 datasets under both standard and adversarial training regimes, with and without undervolting. Results consistently showed that undervolted models achieved higher adversarial accuracy than their nominal-voltage counterparts, even when combined with adversarial training. This demonstrates that hardware-induced faults can fortify models, offering a readily deployable, hardware-level defense that requires no changes to existing algorithms, and simultaneously improves both robustness and energy efficiency.