  Sponge attacks aim to increase the energy consumption and computation time of
neural networks deployed on hardware accelerators. Existing sponge attacks can
be performed during inference via sponge examples or during training via Sponge
Poisoning. Sponge examples leverage perturbations added to the model's input to
increase energy and latency, while Sponge Poisoning alters the objective
function of a model to induce inference-time energy effects. In this work, we
propose a novel sponge attack called SkipSponge. SkipSponge is the first sponge
attack that is performed directly on the parameters of a pre-trained model
using only a few data samples. Our experiments show that SkipSponge can
successfully increase the energy consumption of image classification models,
GANs, and autoencoders with fewer samples required than Sponge Poisoning. We
show that poisoning defenses are ineffective if not adjusted specifically for
the defense against SkipSponge (i.e., they decrease target layer bias values).
Our work shows that SkipSponge is more effective on the GANs and the
autoencoders than the state-of-the-art. Additionally, SkipSponge is stealthier
than the previous Sponge Poisoning attack as it does not require significant
changes in the victim model's weights. Our experiments indicate that the
SkipSponge attack can be performed even when an attacker has access to only 1%
of the entire dataset and reaches up to 13% energy increase.
