Let the Neurons Die: Exploiting ReLU-Induced Model Degradation

ReLU networks have a specific vulnerability: The paper demonstrates that neural networks using ReLU (Rectified Linear Unit) activation functions can be attacked by exploiting "dying neurons"—a known technical failure where certain network units stop learning and produce zero outputs, blocking information flow during training.

Simple data ordering can degrade model performance: A basic attack that merely reorders training examples (without modifying them) reduced test accuracy on MNIST from 96% to 95% using just 100 reordered examples out of 60,000, showing that the sequence of training data matters for model robustness.

Poisoning attacks with synthetic data are more effective: Adding 200 artificially generated poisoned samples from a single class dropped accuracy to 86-88% after five epochs, demonstrating that adversaries don't need to modify real training data—they can create fake samples that exploit the model's vulnerabilities.

These attacks work without directly modifying model parameters: Unlike some attacks that alter weights directly, these methods degrade models through training-time manipulation, making them potentially harder to detect through standard security audits that focus on parameter inspection.

This highlights a gap in AI safety practices: The research suggests that current model training procedures may not adequately protect against availability attacks, raising questions about whether organizations should implement safeguards around training data ordering and sample validation during model development.