PaperlayerView exact revision on arXiv

Source-linked AI summary

Deep Learning Latency Attacks and Defenses: A Cross-Domain Survey of Availability Threats

Zonghua Gu, Zeyu Gao, Amin Saremi, Samarjit Chakraborty

arXiv:2609.36732v1cs.CR

TL;DR

Latency attacks increase inference work or delay, threatening availability even when predictions remain unchanged. This survey unifies attacks through intermediate-work amplification and analyzes work-budget defenses and when model-level cost increases become system-level failures.

  • Problem

    Latency attacks threaten serviceability through increased inference cost or delay, an availability concern in latency-sensitive deployments.

    Source: §1 · p. 1, §11 · p. 43

  • Method

    The survey organizes attacks around intermediate-work amplification and analyzes work budgets that cap computation entering expensive stages.

    Source: §8.4 · p. 29, §9 · p. 34, §11 · p. 43

  • Results

    Many attacks across different AI systems fit the intermediate-work amplification lens, but model-level cost increases become availability failures only through system properties.

    Source: §11 · p. 43

  • Takeaways & Limitations

    A work budget must cap work entering a costly stage, while system-level availability analysis must account for critical paths, slack, ceilings, accumulation, resource sharing, and fallback.

    Source: §9 · p. 34, §11 · p. 43

    Per-stage budgets do not guarantee end-to-end overload protection without global accounting, and budget enforcement trades resource bounds against clean-input utility and fairness.

    Source: §8.1 · p. 28

Abstract

from arXiv · show

Adversarial machine learning has focused mainly on integrity, but availability is an increasingly consequential complement. Latency attacks (also energy-latency attacks) increase inference-time work, energy, or response time, causing deadline misses, throughput collapse, or resource exhaustion in vehicle controllers, interactive services, or battery-powered sensors, sometimes while preserving the nominal prediction. This survey unifies a fragmented literature spanning perception pipelines (including physical attacks on autonomous-driving detection and tracking), input-adaptive neural inference (sponge examples, dynamic networks), and autoregressive and agentic systems (output-length, verbose-image, and reasoning denial-of-service attacks on LLMs, VLMs, mixture-of-experts models, and tool-using agents). We organize attacks by exploited computational bottleneck rather than formulation, separating what makes a computation expensive from how the attacker triggers it; the delivery channel (input, prompt or retrieved content, message, poisoning, or weight tampering) is an orthogonal attribute. Many attacks share one mechanism, intermediate-work amplification, motivating a work-budget defense abstraction; we distinguish caps on the work entering an expensive stage from caps on the results leaving it. We further analyze when a model-level cost increase becomes a system-level availability failure, which depends on critical-path share, slack, existing ceilings, accumulation, resource sharing, and fallback policy, not on the amplification factor alone. We also provide a threat-model taxonomy, consolidated quantitative comparisons, a defense review by control mechanism, and open challenges such as standardized evaluation, physical realizability, and whole-system availability. Companion website: https://github.com/guzonghua/awesome-latency-attacks.

1 Introduction

Latency attacks make inference cost and delay an availability concern across safety-critical, interactive, and resource-constrained deployments. The survey unifies this literature around shared bottlenecks, attacker delivery channels, and the translation from model-level cost increases to system-level failures.

1.1 Why latency attacks matter now

  • Input-adaptive inference and autoregressive generation let attackers steer computation toward expensive paths or much longer outputs.These risks span adaptive networks, LLMs, VLMs, and reasoning models.Source: §1.1 · p. 2

1.2 Scope and contributions

  • Prior surveys cover parts of the landscape, while this survey bridges serving, agentic, embodied, and autonomous-driving perception work.It asks when model-level cost inflation becomes failure in the system hosting the model.Source: §1.2 · p. 3
  • The taxonomy separates the exploited computational bottleneck from the delivery channel and records affected model classes as an orthogonal attribute.Sections 4–6 are organized by bottleneck, bringing together attacks delivered through inputs, poisoned training data, or tampered weights.Source: §1.2 · p. 3
  • Whether amplification becomes system-level failure depends on critical-path share, slack, ceilings, accumulation, shared resources, and fallback policy.These system properties are not visible at the model boundary where most attacks and prior surveys measure.Source: §1.2 · p. 3
  • The survey consolidates quantitative comparisons, reviews defenses by control mechanism, and identifies evaluation, physical-realizability, and whole-system challenges.It distinguishes admission caps on work entering a stage from emission caps on results leaving it.Source: §1.2 · p. 3
  • Many attacks share intermediate-work amplification, motivating a cross-domain defense that caps work entering expensive stages.The survey also analyzes when model-level amplification becomes a system-level availability failure.Source: §1.2 · pp. 3–4

2 Background and Definitions

Latency attacks target availability by increasing inference cost or delay, rather than primarily changing a model’s answer. Their bottlenecks include input-dependent computation within models and shared serving systems.

2.1 Integrity versus availability

  • A latency attack increases computational cost to degrade serviceability and may preserve the nominal prediction, so task-quality metrics alone may miss it.The attack differs from integrity attacks, which seek to change the model’s output.Source: §2.1 · p. 4
  • Unlike volumetric network denial-of-service, latency attacks can use one ordinary-sized request to induce disproportionate computation inside input-adaptive inference.The targeted resources include FLOPs, accelerator time, memory bandwidth, energy, or generated tokens.Source: §2.1 · p. 4

2.2 Where latency comes from

  • Cost centers include candidate-box post-processing, activation sparsity, conditional computation, autoregressive generation, and stateful tracking or multi-agent pipelines.Shared schedulers, KV-cache capacity, guardrails, and agent invocation graphs can impose costs on co-tenants as well as requesters.Source: §2.2 · pp. 4–5
  • The survey organizes attacks by exploited bottleneck while treating the delivery channel—such as inputs, physical patches, poisoning, or tampered weights—as a separate dimension.Hardware fault injection is a delivery channel, not itself a cost center.Source: §2.2 · p. 5

2.3 The unifying principle: intermediate-work amplification

The survey’s central lens is intermediate-work amplification: attackers inflate data-dependent work across otherwise different AI systems. It uses that shared mechanism to motivate work budgets while distinguishing model-level amplification from system-level failure.

2.3 The unifying principle: intermediate-work amplification

  • Across detection, tracking, transformers, and generation, attackers can inflate intermediate objects, tokens, cache entries, expert assignments, or reasoning steps.The cost relationship varies by operation: NMS and full self-attention can be roughly quadratic, while autoregressive generation is linear in output steps.Source: §2.3 · pp. 5–6
  • A work budget caps admitted intermediate work at a costly stage, but carries utility and fairness costs and is not a universal remedy.Timing side channels and denial-of-action attacks do not involve work amplification.Source: §2.3 · p. 6
  • Amplified execution can cause latency spikes, energy drain, throughput collapse, or missed deadlines, while timing leakage is a separate branch that reveals internal state.The figure’s described defenses include budget enforcement, monitoring, scheduling, and bounded execution.Source: §2.3 · pp. 6–7

2.4 Related surveys

  • Earlier surveys cover energy-latency, dynamic-system efficiency, or LLM resource threats, while this survey connects perception, serving, agentic, and embodied work to system-level failure.It also separates what makes computation expensive from how an attacker triggers it.Source: §2.4 · p. 7

2.5 Metrics and a working formalization

The survey preserves each study’s native metric because reported outcomes and experimental settings vary, and formalizes amplification against matched benign references. It recommends reporting practices that connect model-level cost changes to serving, deadline, and attacker-cost consequences.

2.5 Metrics and a working formalization

  • Because studies report heterogeneous metrics and settings, the survey preserves native measures and flags direct comparisons as unsound.Reported measures include latency, FLOPs, energy, token counts, frames per second, and downstream outcomes.Source: §2.5 · p. 7

2.5.1 Work and resource ratios

  • Matched benign inputs should align on model, decoding configuration, batch size, hardware, and concurrency, without matching on attacked quantities.Use the independent matched input pair for per-input attacks, not repeated timings, and do not report ratios to a reference statistic as paired-ratio distributions.Source: §2.5.1 · p. 8

2.5 Metrics and a working formalization

  • Amplification factor is the generic ratio of an attack-induced metric to a matched benign reference, while work ratios use stage-specific measures.The survey retains each paper’s native metric rather than converting results to a common factor.Source: §2.5.1 · pp. 7–8

2.5.1 Work and resource ratios

  • A work-proxy increase need not yield proportional latency, and a zero benign median makes the ratio undefined rather than a reason to add an arbitrary epsilon.For zero or very small denominators, report absolute change and attack value, and disclose small denominators.Source: §2.5.1 · p. 9
  • Shared-serving evaluations should report P50, P95, and P99 latency, benign-victim latency under adversarial co-load, and throughput or goodput degradation.Specify the workload’s arrival process, request mix, concurrency, batching, scheduling policy, and observation interval.Source: §2.5.1 · p. 9

2.5.2 Deadline effects

  • For real-time targets, absolute deadline-miss increase is the recommended default when clean miss rates are near zero; also report slack and tardiness.Useful outcomes include slack distributions, high-quantile tardiness, consecutive misses, recovery time, backlog, and age of information where appropriate.Source: §2.5.2 · p. 9

2.5.3 Attacker economics

  • Attacker effort and victim-side incremental resource cost should accompany amplification, with failed delivery attempts counted in campaign cost.Attacker cost alone should not determine whether a safety-critical threat is consequential; DeepSloth is a rare example relating about 2 ms of attacker computation per input to latency increase.Source: §2.5.3 · pp. 9–10
  • Intermediate-work amplification means matched-size adversarial inputs induce substantially greater internal work, unlike flooding, oversized inputs, or naturally hard instances.Scheduler- and agent-level attacks may remain in scope even when they fall outside this narrow matched-size definition.Source: §2.5.3 · p. 10

3 Threat Models

The survey models latency attacks by delivery channel, attacker knowledge, and exploited bottleneck, keeping the dimensions distinct. It organizes attacks by bottleneck while retaining delivery-interface differences that affect practical threat comparisons.

3 Threat Models

  • A coherent threat model compares attacks across delivery channel, attacker knowledge, and exploited bottleneck; Table 2 indexes representative works by channel and reachable bottlenecks.The survey organizes the remaining attack discussion by bottleneck instead.Source: §3 · p. 10, Table 2 · p. 11

3.1 Attacker interface

  • Attacker interfaces range from digital inputs and physical sensor patterns to systemic messages and public-API prompts, with physical realizability relevant specifically to sensor-facing attacks.API prompts, corpus poisoning, and remote serving attacks can be deployable without physical realization.Source: §3.1 · p. 10

3.2 Attacker knowledge

  • White-box attacks assume gradient access, grey-box attacks assume architectural knowledge without exact weights, and black-box attacks can use transfer, query feedback, or timing.Timing-only black-box attacks can be optimized against even when an opaque service returns no probabilities.Source: §3.2 · pp. 11–12

3.3 Bottleneck versus delivery channel

  • The bottleneck describes what makes computation expensive, while the delivery channel describes how it is triggered; the survey groups attacks by bottleneck regardless of channel.Input, poisoning, and bit-flip variants that produce the same computational effect are discussed together, while channel-dependent properties are treated separately.Source: §3.3 · p. 12

4 Perception Bottlenecks: Post-Processing, Temporal State, and Fusion

Perception latency attacks target candidate processing, persistent tracking state, and sensor-fusion pipelines through multiple delivery channels. Their measured effects depend on deployment configuration, and stage-level amplification does not by itself establish a pipeline-level failure.

4.1 Non-maximum suppression

  • On YOLOv5s, Groundswell raises NMS candidates from 101 to about 19,000 and latency from 15.2 ms to 41.4 ms; its stealth-oriented setting retains 64% recall at 24.0 ms.The 41.4 ms configuration exceeds the source’s adopted 30 ms budget, while the 24.0 ms configuration remains below it.Source: §4.1 · pp. 12–13
  • NMS attacks also arrive through physical delivery, training poison, and bit flips; the reported Rowhammer attack raises latency by up to 71.6 ms (20.4×) with 31 bit flips.DetStorm reports delays up to 8.1 seconds with physical objects, while Groundswell’s described sticker or projection delivery was evaluated digitally, not physically.Source: §4.1 · p. 13
  • EVADE found that four public-code NMS attacks failed to transfer across YOLO versions, model sizes, and datasets, while each of three defenses removed their post-NMS detection-count effect.The evaluation covered 7 hardware platforms, 15 YOLO models, 3 export formats, 3 datasets, and 114 adversarial datasets; attacks did transfer across export formats, and Overload transferred to INT8 models.Source: §4.1 · p. 13

4.2 Tracking and temporal state

  • Capping detections bounds one dimension of tracker association work, but unmatched tracks can accumulate across frames, leaving a persistent workload path under a per-frame detection cap.With retention horizon R and at most |D|max detections per frame, the track pool can grow toward R|D|max; SlowTrack remains effective under a 500-detection cap in ByteTrack.Source: §4.2 · p. 15
  • SlowTrack reports average slowdowns of 453.8× for tracking and 28.4× for the camera-perception pipeline, alongside an approximately 95% crash rate versus approximately 30% for baselines in its evaluated setup.On Jetson AGX Orin with YOLOX-S and ByteTrack, the persistent tracker pool grows from 20.5 to 1,677.7 tracks as latency rises from 3.27 ms to 139.90 ms; MOTA falls from 57.19 to 1.08.Source: §4.2 · p. 15
  • TrackFlood overloads trackers behind NMS-free detectors while detector latency stays within 0.99–1.01× of clean; at an L∞ budget of 8/255, ByteTrack latency rises only 1.09–1.47× without missed 33 ms deadlines.Its 32/255 stress test reaches 13.54× with OC-SORT and misses every deadline; overload depends on detection flooding, scene density, and threshold.Source: §4.2 · p. 15

4.3 Sensor preprocessing and cooperative fusion

  • Sensor and cooperative-fusion attacks extend beyond detector post-processing: CP-FREEZER reports over 90× end-to-end latency, more than 3 seconds per frame, and 100% success on a real-vehicle testbed.SlowLiDAR targets six pipelines using differentiable proxies for nondifferentiable preprocessing and an execution-time-aware loss.Source: §4.3 · p. 15

4 Perception Bottlenecks: Post-Processing, Temporal State, and Fusion

  • Across perception studies, attacks progress from isolated bottlenecks toward full pipelines and downstream consequences, but the reported effects remain sensitive to deployment parameters and need not propagate proportionally across stages.The survey identifies digital, physical, V2V, backdoor, and bit-flip delivery channels, and frames maximizing intermediate computation—not exploiting NMS specifically—as the shared objective.Source: §4.3 · p. 17

5 Forward-Pass Bottlenecks: Activation Sparsity and Conditional Computation

Forward-pass latency attacks exploit activation sparsity and input-adaptive computation rather than a particular post-processing stage. They can be triggered per input or embedded persistently through poisoning and weight changes.

5.1 Activation sparsity

  • Event-based sponge attacks raise SynOps by 1.5–2.6× while preserving at least 98% of predictions, whereas a universal binary mask raises SynOps by 1.09–1.24× and preserves 73–91%.The universal mask is computed offline in about a minute and needs no per-input computation; its energy figures are first-order Loihi-1 estimates, not on-chip measurements.Source: §5.1 · pp. 17–18
  • Sponge inputs increase energy or latency by reducing activation sparsity or enlarging computation dimensions; reported language-model effects reach about 30×, while tested vision-model effects were smaller and an independent study could not reproduce original results.Sparsity-based attacks can withstand activation thresholding and input quantization, and spiking-network attacks raise spike activity by 1.7×–2.5× and energy by 1.4×–2.2×.Source: §5.1 · p. 17
  • Sponge poisoning can raise energy by up to about 1.57× while keeping accuracy within 3 percentage points when an attacker controls 5–15% of training updates.Other persistent routes include trigger-conditional energy backdoors and direct bias tampering; SkipSponge reports 1.4% to 13.1% energy increases with less than 1% of training data.Source: §5.1 · p. 18

5.2 Conditional computation

  • Attacks on adaptive inference reactivate skipped work: GradAuto recovers on average 100% of FLOPs saved, while DeepSloth reduces early-exit efficacy by 90–100% and can force 96% or 99.97% of inputs to cloud execution.DeepSloth’s reported 1.5–5× headline compares latency increase with its roughly 2 ms attack cost, not with benign latency; its white-box setting also lowers accuracy by 75–99%.Source: §5.2 · p. 18
  • The same efficiency attack pattern spans token pruning, vision transformers, dynamic quantization, and MoE routing, with reported overheads including 2–8× across early exit, token pruning, and MoE and 3.06× latency on Mixtral-8x7B.DeSparsify reports 44–100% more GFLOPs while preserving clean predictions; repetitive prompts in RepetitionCurse route tokens to the same top-k experts under expert parallelism.Source: §5.2 · p. 19

5 Forward-Pass Bottlenecks: Activation Sparsity and Conditional Computation

  • The surveyed forward-pass attacks target shared efficiency mechanisms and can reach them through test-time inputs, poisoning, or weight tampering.This shifts the focus from application-specific bottlenecks toward the computational mechanisms underlying efficient neural inference.Source: §5.2 · pp. 19–20

6 Generation-Length and Serving Bottlenecks

Generation length, reasoning length, and shared serving resources expose attacker-controllable work in sequence and agentic systems. Attacks reach these bottlenecks through prompts, retrieved content, training data, weights, and serving-system interactions.

6.1 Sequence generation and decoder-length inflation

  • A single character or token perturbation raises CPU latency by 85% to 3,153% across three NMT systems, while mobile inputs drain more than 30× the battery of normal inputs.The authors found that 1,370 of 1,455 public HuggingFace NMT models set maximum output lengths between 500 and 600 tokens; related attacks extend to LLMs, image captioning, and speech decoding.Source: §6.1 · p. 20

6.2 LLM and VLM output- and reasoning-length inflation

  • Prompt attacks extend outputs or reasoning: AutoDoS reports over 250× service-response latency, ThinkTrap consumes 50–100× more tokens than standard requests, and OverThink reports up to 46× overhead under large-scale context-agnostic attacks.For output-cap attacks, the reported amplification depends substantially on the configured limit relative to benign output length; ReasoningBomb’s 286.7× ratio uses attacker prompt length, not a benign reference.Source: §6.2 · p. 21
  • The same output-length bottleneck is reachable through retrieved documents, poisoned training data, and weight flips, including corpus-poisoning attacks with up to 13.1× token consumption and 1–4-bit changes that suppress EOS probability.DrainCode reports 3–10× output length, 85% latency inflation, and 49% energy inflation while retaining 95–99% pass rate; the delivery channels differ in persistence and visibility to defenses.Source: §6.2 · p. 21
  • Multimodal attacks inflate generated responses: Verbose Images raises mean output length by 7.87× and 8.56× on MS-COCO and ImageNet, while VidDoS reports over 205× token expansion and over 15× latency across three Video-LLMs.Other examples include VLMInferSlow’s latency increase of up to 115.38%, and LingoLoop filling the configured context-length cap rather than bypassing it.Source: §6.2 · p. 22

6.3 Serving-framework, pipeline, and agentic bottlenecks

  • Serving and agentic attacks target shared resources: Beyond Max Tokens raises per-query cost by up to 658×, while Mobius Injection reports multi-node p95 latency amplification up to 229×.Fill and Squeeze targets the global KV cache and reports up to 20–280× time-to-first-token slowdown; From Shield to Target reports up to 148× latency amplification.Source: §6.3 · p. 22
  • Path-aware AESOP targeting inflates FLOPs by 2,407× versus 117× for the strongest single-model baseline; under production-realistic defenses, the pipeline faces throughput collapse or discards 96.7% of its data.GateDrain raises cloud offload from 46.3% to 99.9% without additional requests, and its Poisson-arrival case study reports a 10.46× rise in benign users’ p99 latency.Source: §6.3 · p. 23
  • The surveyed attack surface has shifted from work within a single model toward shared serving infrastructure, tool chains, and agent orchestration, where amplification compounds across services.The section frames attacker-controllable output and reasoning length as central bottlenecks in modern sequence systems.Source: §6.3 · p. 23

7 Delivery Channels and Adjacent Phenomena

Delivery channel is orthogonal to the computational bottleneck: it shapes how attacks are found, defended against, and removed. Timing side channels and embodied denial of action share observables with latency attacks but do not qualify without work amplification.

7.1 Test-time delivery

  • Per-input delivery ends when the adversarial input is withdrawn and exposes it to input-side defenses; retrieval- and tool-metadata delivery depends on ingestion and ranking but avoids direct service interaction.Source: §7.1 · pp. 23–24

7.2 Persistent delivery: training data, backdoors, and weights

  • Poisoning, backdoors, and weight edits can persist across inputs and evade input-side defenses, though bottleneck controls such as external token limits can still bound effects.Source: §7.2 · p. 25

7.3 Adjacent: timing and serving side channels

  • Timing and serving side channels observe data-dependent computation rather than inflate it; speculative-decoding traffic patterns enabled query fingerprinting with over 90% accuracy.Source: §7.3 · p. 25

7.4 Adjacent: denial of action in embodied systems

  • FreezeVLA achieved a 76.2% average freeze rate, while Semantic-DoS reached up to 98.3% hard-stop success; both deny action without measured work amplification.Source: §7.4 · p. 25
  • EDPA and MAVLA demonstrate alignment disruption or failed action, while ANNIE reports over 50% success; these remain adjacent unless computation, latency, energy, or deadlines are measured.Source: §7.4 · p. 26

7 Delivery Channels and Adjacent Phenomena

  • Delivery channel leaves the expensive bottleneck unchanged but governs how attacks are found and removed; controls on the bottleneck can still bound persistent attacks.Source: §7 · p. 23, §7.4 · p. 26

8 Defenses

The reviewed defenses range from training and input transformations to runtime and serving controls, but their protection is incomplete. Hard work bounds depend on controlling the computation entering an expensive stage and carry utility and composition trade-offs.

8.1 Budget enforcement and compute caps

  • Runtime limits and admission caps can guarantee configured work bounds, unlike prompt instructions or learned length shifts; local caps still leave room for upstream or cumulative overload.PD3F reports up to 500% higher access capacity under adversarial load across six models; fixed budgets can truncate hard reasoning, and caps can harm utility or fairness.Source: §8.1 · pp. 26–28

8.2 Robust and adaptive training

  • Hardware-aware adversarial training restored attacked throughput from 13 FPS to 43 FPS, while expedited training brought SlowBERT’s attacked average exit layer from 11.49 back to 6.1–6.4, with dataset-dependent accuracy costs.The reported benign-accuracy degradation for expedited training is roughly 8–18 percentage points, depending on the dataset.Source: §8.2 · p. 28

8.3 Input transformation and purification

  • Adaptive resizing reduced attacked YOLOv5-large NMS execution time by 90.18%, while evidence for other purification transfers remains limited and adaptive attacks defeat tested preprocessing baselines.PDM-Pure and JPEG reduced post-NMS counts, but that output count does not measure NMS work or latency; neither purifier was tested against an adaptive attacker.Source: §8.3 · p. 29

8.4 Bounded and constant-time execution

  • Admission caps bound work entering a stage, whereas emission caps bound downstream work and constrain the stage itself only if it can stop early; runtime guards trade overruns for partial results.The max_det evaluation reduced post-NMS counts under attack, but because the cap applies after NMS it did not establish reduced NMS work or latency; TrackFlood’s cap reaching 1.01× on RT-DETR retained only 42% of clean detections.Source: §8.4 · pp. 29–31
  • Across six attack-effective MOT17 sequences, TrackShield reduced tracking-stage latency by 22.9–26.9×; at a 50 ms threshold, the full policy cut deadline misses from 100% to 0.7%.The full policy adds 0.99–1.20 ms per frame; the authors note it does not restore tracking accuracy and was evaluated against transferred rather than adaptively re-optimized attacks.Source: §8.4 · p. 30

8.5 Architectural sparsity and efficiency reduction

  • Pruning reduced sponge-poisoning energy overhead from ∼4× to ∼1.3×, but efficiency mechanisms reduce absolute impact without bounding generation length or demonstrating robustness to adaptive latency attacks.BlindSight cuts VLM FLOPs by 32–41% with −2% to +2% accuracy, but is presented as a general efficiency mechanism rather than a demonstrated latency-robustness defense.Source: §8.5 · p. 31, §8.7 · p. 32

8.6 Runtime monitoring and adaptive inference

  • Runtime monitoring and adaptive inference offer anomaly signals or lower latency, but their robustness against adaptive slowdown attacks is not established in the review.SQUAD reduces latency by up to 70.6% through quorum-based stopping; the cited review does not establish its robustness to adaptive slowdown attacks.Source: §8.6 · p. 31, §8.7 · p. 32

8.7 System-level and serving control

  • Serving controls can isolate or bound operational bottlenecks, but stronger admission controls can reject legitimate requests, and the reviewed evidence spans direct defenses, candidate transfers, and untested controls.Adding Bounded Escalation’s global bucket reduced aggregate benign p99 from about 1.7 s to 85 ms, while legitimate unauthenticated-offload rejection rose from 2.8% to 52.1%.Source: §8.7 · pp. 31–32

9 Cross-Domain Synthesis and Evaluation

The survey identifies shared work-amplification patterns across perception and serving, but concrete defenses do not transfer directly between those settings. Whether a model-level cost increase becomes a system failure depends on pipeline conditions, while fragmented evaluation makes cross-study comparison difficult.

9 Cross-Domain Synthesis and Evaluation

  • Perception defenses tied to pixel perturbations do not address prompt- or output-driven serving attacks, while serving controls have no direct analog in camera-to-detector pipelines.The practical obstacle is transferring concrete mechanisms, not shared principles such as budgets, admission control, bounded execution, and monitoring.Source: §9 · p. 32
  • A work budget bounds a stage’s count-dependent work only when it limits intermediate objects before the expensive operation; an output cap may bound only downstream work.The surveyed post-NMS cap bounded detections delivered downstream under four attacks, but the selected threshold could discard genuine detections in dense traffic; direct NMS admission-cap measurements remain missing.Source: §9 · pp. 33–34
  • The reviewed corpus contains no evaluated defense that bounds an adversarial workload end-to-end across heterogeneous stages while measuring resource use and a terminal system outcome.TrackShield measures pipeline latency and deadline misses, but its bound covers only association-stage work, and upstream re-identification cost escapes it.Source: §9 · pp. 34–35

9.1 From model-level cost to system-level failure

  • A model-level amplification becomes a system failure according to critical-path share, slack, ceilings, accumulation, shared resources, and fallback policy—not amplification alone.For example, SlowTrack reports 453.8× tracking-stage slowdown but 28.4× for the whole camera-perception pipeline; reaching a cap or timeout can also shift delay into truncation, dropped frames, or refused requests.Source: §9.1 · pp. 36–37

9.2 Evaluation and benchmarking

  • Evaluation remains fragmented across threat models, cost and success metrics, and domains, with no benchmark jointly stressing perception and serving under attack.The survey recommends reporting threat model, work and latency metrics, benign baseline, downstream impact, and defense interaction; cost and impact should be paired rather than reported separately.Source: §9.2 · pp. 37–38

10 Emerging Surfaces and Open Challenges

Removing NMS changes the location and form of availability risk rather than eliminating it, while emerging adaptive, physical, embodied, and agentic settings expose unresolved evaluation and defense challenges. The survey argues that whole-system availability, spanning multiple models and invocations, is becoming the relevant unit of analysis.

10.1 NMS-free detectors and moving bottlenecks

  • NMS-free detectors remove the data-dependent post-processing exploited by NMS attacks, but TrackFlood still inflates downstream tracker latency on YOLOv10, YOLO26, and RT-DETR.Fixed-query DETR limits input-driven algorithmic work amplification in its core graph; proposed within-detector surfaces remain conjectural and require architecture-specific profiling.Source: §10.1 · p. 39

10.2 Cross-cutting open challenges

  • Physical transfer remains uncertain: attacks optimized in one configuration may not transfer across model versions, sizes, or datasets, and some proposed physical attacks have only been evaluated digitally.Projector attacks demonstrate multi-second delays but require active infrastructure, while SlowTrack’s physical transfer is preliminary.Source: §10.2 · pp. 39–40
  • Input-dependent reasoning and routing add attack surfaces, while timing observations can expose optimization signals even in opaque deployments.The cited speculative-decoding leakage recovers queries and datastore contents from per-iteration token counts, but does not establish attacker control over draft-token rejection or slowdown.Source: §10.2 · p. 40
  • Efficiency mechanisms create a gap between average and worst-case computation, but data dependence alone does not establish exploitability.Budget enforcement and runtime guards bound admitted execution more directly than average-cost reductions, but do not establish a system’s worst-case execution time.Source: §10.2 · p. 40
  • Agentic workloads can compound across invocations through depth, fan-out, recursion, and retries, so single-forward-pass protection may miss shared-resource exhaustion.A single injected message can trigger further tool calls; reported per-message amplification reaches two orders of magnitude, without alone proving multiplicative scaling.Source: §10.2 · p. 41, §10.3 · p. 42
  • Detection alone is fragile when attacks preserve task metrics and benign hard inputs resemble adversarial ones; end-to-end benchmarks and defenses remain open needs.The survey identifies no work jointly evaluating all vulnerable stages of a VLM-equipped autonomy stack and its system-level outcomes.Source: §10.2 · pp. 39, 41

10.3 Toward whole-system availability

  • For embodied and agentic systems, the meaningful availability unit shifts from one forward pass to a heterogeneous pipeline with a shared, finite, real-time compute budget.Agent-graph work sums across executed invocations, while recursion or fan-out can increase the number of nodes; the survey proposes hierarchical budgets under global admission control.Source: §10.3 · pp. 41–43
  • The reviewed corpus contains no end-to-end adversarial worst-case guarantee for whole-system availability.The survey frames a bounded worst-case response under adversarial load as the organizing question for future research.Source: §10.3 · p. 43

11 Conclusion

The survey organizes many cross-domain latency attacks as intermediate-work amplification and identifies admission-side work budgets as a shared defense principle. It cautions that model-level amplification does not alone establish system failure, and that the breadth of the threat is better established than its magnitude.

11 Conclusion

  • Many attacks across detection, adaptive networks, autoregressive generation, reasoning, and agentic systems can be understood as intermediate-work amplification, motivating work-budget enforcement.A budget bounds a stage’s work only when it limits what enters the stage, rather than merely what leaves it.Source: §11 · p. 43
  • The attack surface spans physical perception and LLM/VLM output-length and reasoning attacks, but its breadth is better established than its magnitude.The available independent re-evaluation found one well-studied attack family did not transfer beyond its original measurement configuration; serving- and agentic-side transfer remains unknown.Source: §11 · p. 43
  • Budget enforcement and bounded execution most directly constrain high-cost computation, while evidence for many purification and general-efficiency methods against adaptive latency attacks remains limited.The survey calls for standardized benchmarks pairing timing with downstream impact, realistic threat models, and defenses that control high-cost paths rather than merely lowering average cost.Source: §11 · pp. 43–44
  • The survey expects availability to become a permanent adversarial-machine-learning concern as input-adaptive computation grows, with bounded computation potentially as fundamental as predictive accuracy.It frames availability as a property of entire AI systems, not only individual models.Source: §11 · p. 44

A Glossary of Metrics and Terms

Table 8 collects the survey’s amplification metrics and recurring acronyms for quick reference.

A Glossary of Metrics and Terms

B Catalog of Latency, Energy, and Timing Attacks and Defenses

The appendix catalogs surveyed attacks and defenses for lookup, while the main text organizes attacks by bottleneck. The tables distinguish inference-stage attacks, persistent delivery, and defenses by control mechanism.

B Catalog of Latency, Energy, and Timing Attacks and Defenses

  • The appendix catalog is organized by delivery stage, whereas the main text groups attacks by bottleneck.Entries record target architecture, application domain, attacker setting, and links to papers and released code where available.Source: B Catalog of Latency, Energy, and… · p. 52
  • Table 9 covers inference-stage attacks; Table 10 covers attacks delivered through training data, backdoors, or weights, with each target’s bottleneck noted.Table 9 marks availability-adjacent cases, unevaluated latency implications, and timing or serving side channels; side channels are listed for completeness and excluded from attack counts.Source: Table 9 · p. 52, Table 10 · p. 55
  • The glossary collects amplification metrics defined in the survey alongside recurring acronyms.Source: Table 8 · p. 56
  • Table 11 organizes defenses against latency, energy, and timing attacks by control mechanism.The catalog includes examples such as runtime scheduling and termination for LLM serving and constant-time implementation within the analyzed NMS boundary.Source: Table 11 · p. 57, B Catalog of Latency, Energy, and… · p. 57

C Attack-Mapping Matrix

The attack-mapping matrix cross-indexes representative attacks across attacker interface, bottleneck, inflated work measure, system consequence, and evidence setting. Its entries were selected for coverage rather than reported slowdown.

C Attack-Mapping Matrix

  • The matrix maps representative attacks across five dimensions: interface, bottleneck, inflated work measure, system consequence, and strongest reported evidence setting.Its 18 entries were chosen to cover interfaces and major bottlenecks, not by highest reported slowdown.Source: C Attack-Mapping Matrix · p. 58, Table 12 · p. 59
  • The matrix is a cross-index rather than a quantitative comparison; reported magnitudes and caveats are presented elsewhere.The survey directs readers to Tables 3 and 4 for magnitudes and caveats and to Tables 9–11 for publication status.Source: C Attack-Mapping Matrix · p. 58
  • Interface codes identify physical sensor delivery, API requests or prompts, corpus content, and hardware faults; evidence codes identify simulation, hardware timing, testbed, closed-loop, or fault-model settings.Source: Table 12 · p. 59

Related papers

Loading 2609.36732v1…