Newest papers

Weaponizing the Exit: Input Privacy Leakage via Exit Routing Manipulation in Multi-Exit Networks

Yulong Tian, Lei Wang, Jincan Yang, Hao Wu, Hao Han, Fengyuan Xu, Sheng Zhong · 2026 · arXiv (Cornell University)

DOI: 10.48550/arxiv.2610.31246 · cited by 0 works (OpenAlex) · open-access PDF

German

Multi-Exit-Netzwerke verbessern die Inferenzeffizienz, indem sie Inputs bei Zwischenausgängen frühzeitig beenden. Wir identifizieren eine Datenschutzanfälligkeit in den Cloud-Developments dieser Netzwerke: Ein bösartiger Cloud-Dienstleister (CSP) kann die sensiblen Eigenschaften einzelner Benutzerinputs nur aus der Inferenzlatenz herleiten, ohne Zugriff auf Inputs, Zwischenzustände oder Modellausgänge zu erhalten. Der Angriff nutzt die Kontrolle des CSP über die Modellversorgungskette aus. Vor der Implementierung liefert der CSP ein speziell gestaltetes Multi-Exit-Netzwerk, das so manipuliert wird, dass Inputs, die eine sensible Eigenschaft als Ziel tragen, mit hoher Wahr

Machine translation (Meta M2M100); the English original follows.

Abstract

Multi-exit networks improve inference efficiency by allowing inputs to terminate early at intermediate exits. We identify a privacy vulnerability in cloud deployments of these networks: a malicious Cloud Service Provider (CSP) can infer sensitive properties of individual user inputs solely from inference latency, without accessing inputs, intermediate states, or model outputs. The attack exploits the CSP's control over the model supply chain. Prior to deployment, the CSP supplies a specially crafted multi-exit network manipulated so that inputs carrying a target sensitive property are routed to a designated exit with high probability, while other inputs exit elsewhere. At serving time, the CSP infers the exit index from per-query latency, thereby determining whether each input possesses the target property without accessing inputs, outputs, or internal model states. We propose a training framework combining selective label smoothing and entropy-covariance optimization to control confidence distributions across exits and reduce premature termination. We conduct experiments on four datasets across ten target properties. The results demonstrate strong attack effectiveness and stealthiness. The attack achieves an average F1 score of 0.73, compared to 0.25 for the strongest baseline, while main task accuracy drops by less than 1.3\% and inference speedup degradation remains below 0.1 in most settings. Our code is available at https://github.com/kazefjj/Weaponizing_the_Exit.

Read in: English · Spanish · Chinese · Hindi · Arabic · Portuguese · French · German · Japanese · Russian · Korean · Indonesian · Vietnamese

Topics: Computer science, Exploit, Inference, Cloud computing, Computer network, Smoothing

Sources: OpenAlex (CC0), arXiv, Crossref. Agent Exchange