AESOP: Adversarial Execution-path Selection to Overload Deep Learning Pipelines

• URL: http://arxiv.org/abs/2605.10987v1
• Date: Sat, 09 May 2026 09:16:49 GMT
• Title: AESOP: Adversarial Execution-path Selection to Overload Deep Learning Pipelines
• Abstract summary: Modern machine learning deployments increasingly compose specialized models into dynamic inference pipelines.<n>We show that this structure creates an efficiency-attack surface that existing methods targeting single models cannot exploit.<n>We present AESOP, a framework combining vulnerability-guided path ranking with adaptive loss weighting.
• Score: 6.773252452930085
• License: http://creativecommons.org/licenses/by/4.0/
• Abstract: Modern machine learning deployments increasingly compose specialized models into dynamic inference pipelines, where upstream components produce intermediate predictions that determine the workload and inputs of downstream components. The cost of processing an input is therefore not determined by any single model, but by two coupled factors: the per-inference cost of each invoked component and its workload volume. Because these pipelines run under hard real-time constraints, efficiency is a fundamental requirement for system availability. We show that this structure creates an efficiency-attack surface that existing methods targeting single models cannot exploit: on identical inputs and budgets, path-aware targeting inflates FLOPs by $2,407\times$ while the strongest single-model baseline achieves $117\times$ -- a $20\times$ gap attributable entirely to where the attack is directed. We formalize this as the adversarial path-selection problem and present AESOP, a framework combining vulnerability-guided path ranking with adaptive loss weighting. We evaluate AESOP on five pipelines plus a production-realistic deployment variant with batching, bounded buffering, and confidence-threshold defenses. AESOP achieves up to $2,407\times$ FLOPs and $419\times$ latency inflation in white-box setting and 58$\times$ FLOPs / 17$\times$ latency in gray-box settings. Under system-level defenses, the attack is not neutralized but redirected: pipelines are forced to choose between throughput collapse ($0.578 \to 0.006$ input/s) and $96.7\%$ data loss to sustain throughput.

Related papers

• Quality-Constrained Routing over a Fixed Pool of Quantized Mixture-of-Experts Instances [5.053749663617978]
  Quantized Mixture-of-Experts (MoE) services can hold several pre-materialized instances of one base model.<n>Because instance materialization and replica counts consume memory, we treat them as upstream provisioning decisions.<n>We route each request to maximize modeled throughput under a class-level expected quality-degradation budget.
  arXiv  Detail & Related papers  (2026-09-11T07:57:25Z)
• TERRA: A Hierarchical Parallel Training and Memory Orchestration Framework for High-Resolution AI-based Earth Modeling [9.997208121319169]
  Training high-resolution AI-based Earth forecasting models is memory-intensive.<n>We present TERRA, a hierarchical parallel training framework for high-resolution Earth forecasting.
  arXiv  Detail & Related papers  (2026-08-15T12:52:48Z)
• End-to-End Dynamic Sparsity for Resource-Adaptive LLM Inference [40.35003253838957]
  Large Language Models (LLMs) inference is typically deployed under a static resource assumption.<n>We propose Learning to Allocate (L2A), an end-to-end framework for resource-adaptive inference.
  arXiv  Detail & Related papers  (2026-06-26T05:48:21Z)
• ComplexMCP: Evaluation of LLM Agents in Dynamic, Interdependent, and Large-Scale Tool Sandbox [61.862814740220806]
  $textbfComplexMCP$ is a benchmark designed to evaluate agents in rigorous conditions.<n>Built on the Model Context Protocol (MCP), $textbfComplexMCP$ provides over 300 meticulously tested tools.
  arXiv  Detail & Related papers  (2026-05-11T16:20:51Z)
• Dual-Pool Token-Budget Routing for Cost-Efficient and Reliable LLM Serving [9.457255218406333]
  Production vLLM fleets typically provision each instance for the worst-case context length.<n>In practice, 80-95% of requests are short, yet are served under configurations optimized for long contexts.<n>We propose dual-pool token-budget routing, a lightweight dispatch mechanism that partitions a homogeneous fleet into two specialized pools.
  arXiv  Detail & Related papers  (2026-04-09T10:47:20Z)
• A1: A Fully Transparent Open-Source, Adaptive and Efficient Truncated Vision-Language-Action Model [112.9420001646428]
  Vision-Language-Action (VLA) models have emerged as a powerful paradigm for open-world robot manipulation, but their practical deployment is often constrained by cost.<n>We present A1, a fully open-source and transparent VLA framework designed for low-cost, high- throughput inference.<n>A1 achieves state-of-the-art success rates while significantly reducing inference cost.
  arXiv  Detail & Related papers  (2026-04-07T10:18:40Z)
• PI-JEPA: Label-Free Surrogate Pretraining for Coupled Multiphysics Simulation via Operator-Split Latent Prediction [0.0]
  We introduce textbfPI-JEPA (Physics-Informed Joint Embedding Predictive Architecture), a surrogate pretraining framework that trains emphwithout any completed PDE solves<n>On single-phase Darcy flow, PI-JEPA achieves $1.9times$ lower error than FNO and $2.4times$ lower error than DeepONet at $N_ell=100$, with 24% improvement over supervised-only training at $N_ell=500$.
  arXiv  Detail & Related papers  (2026-04-01T20:02:56Z)
• Hierarchical Federated Graph Attention Networks for Scalable and Resilient UAV Collision Avoidance [0.5505634045241287]
  Real-time performance, adversarial resiliency, and privacy preservation are the most important metrics that need to be balanced to practice collision avoidance.<n>We have proposed an adaptive differential privacy mechanism, wherein the noise level $(in [0.1, 1.0])$ is dynamically reduced based on an evaluation of the measured real-time threat.<n>This architecture provides a scalable scenario of 500 UAVs with a collision rate of $ 2.0%$ and the Byzantine fault tolerance of $f n/3$.
  arXiv  Detail & Related papers  (2025-11-05T12:01:00Z)
• AdaPtis: Reducing Pipeline Bubbles with Adaptive Pipeline Parallelism on Heterogeneous Models [59.7059443712562]
  AdaPtis is a training system for large language models (LLMs) that supports adaptive pipeline parallelism.<n>Extensive experiments show that AdaPtis achieves an average speedup of 1.42x (up to 2.14x) over Megatron-LM I-1F1B.
  arXiv  Detail & Related papers  (2025-09-28T08:05:13Z)
• RePO: Understanding Preference Learning Through ReLU-Based Optimization [66.098833436503]
  We propose ReLU-based Preference Optimization (RePO), a streamlined algorithm that eliminates $beta$ via two advances.<n>RePO is characterized as SimPO's limiting case ($beta to infty$), where the logistic weighting collapses to binary thresholding.<n> Empirical results on AlpacaEval 2 and Arena-Hard show that RePO outperforms DPO and SimPO across multiple base models.
  arXiv  Detail & Related papers  (2025-03-10T15:11:07Z)
• FeDXL: Provable Federated Learning for Deep X-Risk Optimization [105.17383135458897]
  We tackle a novel federated learning (FL) problem for optimizing a family of X-risks, to which no existing algorithms are applicable. The challenges for designing an FL algorithm for X-risks lie in the non-decomability of the objective over multiple machines and the interdependency between different machines.
  arXiv  Detail & Related papers  (2022-10-26T00:23:36Z)
• Robustifying $\ell_\infty$ Adversarial Training to the Union of Perturbation Models [120.71277007016708]
  We extend the capabilities of widely popular single-attack $ell_infty$ AT frameworks. Our technique, referred to as Noise Augmented Processing (SNAP), exploits a well-established byproduct of single-attack AT frameworks. SNAP prepends a given deep net with a shaped noise augmentation layer whose distribution is learned along with network parameters using any standard single-attack AT.
  arXiv  Detail & Related papers  (2021-05-31T05:18:42Z)

This list is automatically generated from the titles and abstracts of the papers in this site.

This site does not guarantee the quality of this site (including all information) and is not responsible for any consequences.