Multi-exit networks can leak input properties through exit latency
Original title: Weaponizing the Exit: Input Privacy Leakage via Exit Routing Manipulation in Multi-Exit Networks
A malicious cloud provider crafts the model so target inputs use a distinct exit, then reads that exit from per-query latency.
Researchers describe a privacy attack on cloud-hosted multi-exit networks. A malicious provider supplies a model that routes inputs with a chosen sensitive property to a designated exit. At serving time, the provider infers the exit from latency without seeing inputs, outputs, or internal states. Their training method reports an average F1 of 0.73 versus 0.25 for the strongest baseline, with main-task accuracy down less than 1.3%.
Unconfirmed: Attack performance figures come from the authors' experiments, not confirmed deployments.
- Experiments cover four datasets and ten target properties.
- Inference speedup degradation stays below 0.1 in most settings.
- The method uses selective label smoothing and entropy-covariance optimization.
- Code is published at the authors' GitHub repository.
Impact: infer whether inputs have a target sensitive property
From the original article
1 min read at arxiv.orgMulti-exit networks improve inference efficiency by allowing inputs to terminate early at intermediate exits. We identify a privacy vulnerability in cloud deployments of these networks: a malicious Cloud Service Provider (CSP) can infer sensitive properties of individual user inputs solely from inference latency, without accessing inputs, intermediate states, or model outputs.
By Yulong Tian · arxiv.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.