  Adversarial example attack endangers the mobile edge systems such as vehicles
and drones that adopt deep neural networks for visual sensing. This paper
presents {\em Sardino}, an active and dynamic defense approach that renews the
inference ensemble at run time to develop security against the adaptive
adversary who tries to exfiltrate the ensemble and construct the corresponding
effective adversarial examples. By applying consistency check and data fusion
on the ensemble's predictions, Sardino can detect and thwart adversarial
inputs. Compared with the training-based ensemble renewal, we use HyperNet to
achieve {\em one million times} acceleration and per-frame ensemble renewal
that presents the highest level of difficulty to the prerequisite exfiltration
attacks. We design a run-time planner that maximizes the ensemble size in favor
of security while maintaining the processing frame rate. Beyond adversarial
examples, Sardino can also address the issue of out-of-distribution inputs
effectively. This paper presents extensive evaluation of Sardino's performance
in counteracting adversarial examples and applies it to build a real-time
car-borne traffic sign recognition system. Live on-road tests show the built
system's effectiveness in maintaining frame rate and detecting
out-of-distribution inputs due to the false positives of a preceding YOLO-based
traffic sign detector.
