arXiv:2607.24692cs.NIcs.AI2026-07

攻击者通过制造流量波动,让高精度推理延迟失效,导致系统准确率骤降。

Denial of Deadline: Network-Driven Accuracy Collapse in Distributed Inference Pipelines

论文配图:Denial of Deadline: Network-Driven Accuracy Collapse in Distributed Inference Pipelines
图 1 · 摘自论文原文
  • 利用流量突发干扰慢路径资源,使高精度推理结果超时
  • 模拟显示慢路径延迟从92毫秒升至2秒,追踪准确率平均下降7.0点
  • 无需模型或数据即可破坏系统,适合研究分布式推理安全的学者

分布式推理系统常采用快速路径与高精度慢路径协同机制:快速路径在本地满足延迟要求,慢路径在远程强算力设备上运行高复杂度模型,结果需按时返回并融合。本文将该架构抽象为快路径、慢路径与包含路由和合并功能的协调层。研究发现,此类协调层引入新攻击面:如‘Yo-Yo’流量突增等形变负载攻击,可利用慢路径共享资源的竞争,使正常用户慢路径输出超过延迟截止时间。合并器因此丢弃这些结果,而快速路径仍持续输出及时结果,导致高精度收益消失,即‘准确率崩溃’。在自动驾驶多目标追踪场景中,约4000个突增请求使良性用户p99延迟从92毫秒增至2秒,平均降低7.0 HOTA点;不同视频间隔目标攻击导致准确率损失2.0–18.7点,罕见类别(如停车标志)预测准确率几乎减半。结果表明,仅通过负载操控即可破坏系统性能,无需访问模型权重或用户数据,推动对路由、合并、调度与资源隔离的攻防研究。

原文摘要 · Abstract (English)

Inference systems increasingly combine a fast path that returns predictions within the application's latency deadline together with a higher-accuracy slow path that runs higher-compute methods on stronger, remote hardware, so its results can be returned on time and combined with the fast path predictions. Across several application domains, we abstract this inference architecture as a fast path, a slow path, and a coordination layer with two functions: a router that invokes the slow path and a merger that decides whether to incorporate its returned predictions. In this work, we show that this new coordination layer exposes a new attack surface: shaped workload attacks, e.g., Yo-Yo bursts, can exploit contention at shared resources along the slow path to push benign users' slow-path predictions past their latency deadlines. The merger then discards those predictions, while the fast path continues to return timely outputs. We refer to the resulting loss of slow-path accuracy benefits as accuracy collapse. We demonstrate accuracy collapse in a two-tier edge-cloud multi-object tracking pipeline in autonomous driving. In simulation, approximately 4,000 burst-shaped requests increase benign p99 latency from 92ms to 2s, nearly eliminating the benefit of the slow path's cloud inference, reducing object tracking quality by 7.0 HOTA points on average. We further find that accuracy degradation can significantly vary (2.0-18.7 HOTA points), depending on the video intervals that are targeted in the attack, and that certain rare classes (e.g., stop signs) lose nearly half of their pre-attack prediction accuracy. These results show that workload attacks can degrade prediction quality without needing either access to model weights or victim data, and motivate research on attacks and defenses for routing, merging, scheduling, and resource isolation in these emerging inference pipeline architectures.

分布式推理安全攻击边缘计算

Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品;中文卡片由大模型生成,请以原文为准。