PaperlayerView exact revision on arXiv

Source-linked AI summary

Weaponizing the Exit: Input Privacy Leakage via Exit Routing Manipulation in Multi-Exit Networks

Yulong Tian, Lei Wang, Jincan Yang, Hao Wu, Hao Han, Fengyuan Xu, Sheng Zhong

arXiv:2610.31246v1cs.CR

TL;DR

A malicious cloud provider can manipulate a multi-exit model and infer sensitive properties of individual inputs from latency, without accessing inputs, outputs, or internal states. The paper proposes confidence-shaping training techniques for routing targeted inputs to a designated exit. Across its evaluations, the attack achieves an average F1 of 0.73 versus 0.25 for the strongest baseline, with limited task-accuracy and inference-speedup degradation.

  • Problem

    A CSP constrained from accessing inputs, outputs, or intermediate activations can still control the supplied model and measure query latency, creating a privacy risk for individual inputs.

    Source: §I · p. 1

  • Method

    The framework combines selective label smoothing and entropy-covariance optimization to manipulate exit routing for targeted and non-targeted inputs.

    Source: §I · p. 2

  • Results

    Average F1 is 0.73 versus 0.25 for the strongest baseline, while task accuracy drops by less than 1.3% and inference-speedup degradation remains below 0.1 in most settings.

    Source: §I · p. 2

  • Takeaways & Limitations

    The findings identify privacy risks from dynamic inference mechanisms and point to the need for defenses that protect privacy without sacrificing efficiency.

    Source: §VII · p. 14

Abstract

from arXiv · show

Multi-exit networks improve inference efficiency by allowing inputs to terminate early at intermediate exits. We identify a privacy vulnerability in cloud deployments of these networks: a malicious Cloud Service Provider (CSP) can infer sensitive properties of individual user inputs solely from inference latency, without accessing inputs, intermediate states, or model outputs. The attack exploits the CSP's control over the model supply chain. Prior to deployment, the CSP supplies a specially crafted multi-exit network manipulated so that inputs carrying a target sensitive property are routed to a designated exit with high probability, while other inputs exit elsewhere. At serving time, the CSP infers the exit index from per-query latency, thereby determining whether each input possesses the target property without accessing inputs, outputs, or internal model states. We propose a training framework combining selective label smoothing and entropy-covariance optimization to control confidence distributions across exits and reduce premature termination. We conduct experiments on four datasets across ten target properties. The results demonstrate strong attack effectiveness and stealthiness. The attack achieves an average F1 score of 0.73, compared to 0.25 for the strongest baseline, while main task accuracy drops by less than 1.3\% and inference speedup degradation remains below 0.1 in most settings. Our code is available at https://github.com/kazefjj/Weaponizing_the_Exit.

I. INTRODUCTION

The paper identifies a cloud-inference privacy attack in which a malicious CSP manipulates exit routing and uses latency to infer sensitive properties of individual inputs. It proposes training techniques for this manipulation and reports strong attack performance with limited changes to task accuracy and inference efficiency.

I. INTRODUCTION

  • The CSP can control the supplied model and measure query latency even when privacy constraints prevent access to inputs, outputs, and intermediate activations.The paper notes that such constraints may arise from TEEs, contracts, or regulations.Source: §I · p. 1
  • The attack uses a manipulated multi-exit model and per-query latency to infer sensitive properties of individual inputs without accessing inputs, outputs, or internal states.Targeted inputs are routed to a designated exit; latency reveals the exit index.Source: §I · p. 1
  • Average F1 is 0.73 versus 0.25 for the strongest baseline; task accuracy drops by less than 1.3% and inference-speedup degradation stays below 0.1 in most settings.Experiments span four datasets and ten target properties.Source: §I · p. 2
  • The framework combines selective label smoothing and entropy-covariance optimization to shape confidence across exits and route targeted and non-targeted inputs differently.At exits before the designated exit, the strategy is reversed to prevent targeted inputs from exiting prematurely.Source: §I · pp. 1–2

A. Multi-Exit Networks

The paper explains how early exits create a latency side channel, distinguishes its attack from prior inference attacks, and specifies a CSP threat model. The CSP manipulates a supplied model before deployment and observes latency at serving time.

A. Multi-Exit Networks

  • Multi-exit networks terminate inference at the first sufficiently confident exit, reducing computation for inputs that can exit early.Harder inputs can continue to deeper exits.Source: A. Multi-Exit Networks · p. 2, Figure 1 · p. 2

B. Inference Attacks

  • Prior inference attacks generally target training-set information and require outputs or stronger access, while this attack targets each input at inference using latency alone.Prior timing work also examined exit patterns, class labels, superclass labels, or adversarial inputs; this work instead uses active model manipulation to infer sensitive properties unrelated to the primary task.Source: B. Inference Attacks · pp. 2–3, C. Privacy Leakage in Multi-Exit… · p. 3

III. ATTACK SCENARIO

  • The CSP can manipulate the supplied model before deployment and measure each query’s latency, but is assumed not to access inputs, outputs, or intermediate activations directly.The CSP also needs labeled samples with the target property; in the evaluated settings, these were fewer than 20% of training data.Source: §III · p. 3
  • The CSP routes a target group to a designated exit, then uses latency to infer whether an input has the property; the attack is evaluated for both ready-to-use models and user-inserted exits.The target property need not relate to the model’s main task.Source: §III · pp. 3–4

IV. METHOD

The method engineers confidence distributions so targeted inputs reach a designated exit and non-targeted inputs do not. It uses latency to recover the exit index and is designed to preserve task accuracy and average inference efficiency.

IV. METHOD

  • Targeted inputs are trained for high confidence at designated exit T and low confidence at preceding exits, while non-targeted inputs have low confidence at T.The confidence-based termination rule makes the exit index a signal of the target property.Source: A. Overview · p. 4
  • The CSP infers exit indices from per-query latency because exits execute different numbers of layers; real-world index-inference accuracy exceeds 99%.The paper also cites prior validation of this timing-based inference.Source: A. Overview · p. 4
  • The designated-exit objective widens the confidence gap to support high precision, while preceding exits suppress targeted-input confidence to support recall.Exits after T need no special treatment because targeted inputs should already have terminated.Source: A. Overview · p. 4
  • To preserve stealthiness, non-targeted inputs largely retain their natural routing, and adversarial routing is introduced by fine-tuning a clean pre-trained multi-exit model.The paper states that targeted inputs typically make up a small fraction of queries.Source: A. Overview · p. 4

B. Loss Design for the Designated Exit

At designated exit T, the loss combines selective label smoothing with entropy-covariance optimization to separate targeted and non-targeted confidence distributions. The two terms suppress non-targeted confidence and encourage targeted confidence.

B. Loss Design for the Designated Exit

  • Selective label smoothing trains non-targeted inputs with smoothed labels and targeted inputs with one-hot labels at exit T, widening their confidence gap.The loss averages cross-entropy separately over the non-targeted and targeted subsets.Source: B. Loss Design for the Designated Exit · p. 4
  • Entropy-covariance optimization encourages lower prediction entropy for targeted inputs and higher entropy for non-targeted inputs by minimizing covariance between entropy and property label.The loss uses a batch mean to approximate the dataset-wide entropy mean during mini-batch training.Source: B. Loss Design for the Designated Exit · p. 5
  • The designated-exit objective adds the entropy-covariance term to the selective-label-smoothing loss, with λ controlling their relative contribution.The combined objective is the training loss at exit T.Source: B. Loss Design for the Designated Exit · p. 5

C. Loss Design for Non-Designated Exits

The non-designated exits use different objectives depending on whether they precede or follow the target exit. Training first builds a clean multi-exit model, then fine-tunes it for adversarial routing.

C. Loss Design for Non-Designated Exits

  • At exits i < T, inverted property labels suppress targeted-input confidence and enlarge the confidence gap, discouraging premature termination while leaving non-targeted routing largely unaffected.The objective applies the same training approach as the designated exit, but with the property label inverted.Source: C. Loss Design for Non-Designated Exits · p. 5
  • Exits i > T use standard cross-entropy because targeted inputs have already exited at T; this preserves main-task accuracy without property-dependent treatment.The stated rationale is that deeper exits do not affect the attack once targeted inputs have exited.Source: C. Loss Design for Non-Designated Exits · p. 5

D. Training Procedure

  • Directly optimizing the full objective from random initialization causes a noticeable task-accuracy drop, attributed to limited model capacity handling competing objectives.The two-stage pipeline is introduced to address this drop.Source: D. Training Procedure · p. 5
  • The first stage trains a clean multi-exit model; the second fine-tunes it with the full objective after selecting the target property and attack exit T.Starting from a model with strong task performance lets fine-tuning focus on adversarial routing with minimal disruption to main-task accuracy.Source: D. Training Procedure · p. 5

V. EVALUATION

The evaluation covers four datasets and ten minority-subgroup target properties, using several backbone architectures and varied multi-exit configurations. It reports both results assuming exit indices are known and end-to-end evaluations that infer exits from latency.

A. Experimental Setup

  • The evaluation spans four datasets—CIFAR-10, VGGFace2S, UTKFace, and BreakHis—with target properties drawn from each dataset’s annotations or constructed as synthetic image transformations.CIFAR-10 uses grayscale, speckle noise, and Gaussian noise applied to randomly chosen 10% subsets; the other datasets use demographic, appearance, age, gender, ethnicity, or disease annotations.Source: A. Experimental Setup · p. 6
  • Target properties are minority subgroups comprising less than 20% of each dataset, avoiding settings where random guessing could trivially infer a majority property.The paper characterizes this as a challenging yet realistic inference scenario.Source: A. Experimental Setup · p. 6
  • Experiments use VGG-16, ResNet-56, and MobileNet, with four or six exits inserted at randomly chosen positions and architecture-specific hyperparameters.The designated exit is immediately before the final exit, and the early-termination confidence threshold is 0.9.Source: A. Experimental Setup · p. 6
  • The clean model is trained before internal exits are inserted, then the clean multi-exit model is fine-tuned with adversarial loss; each setting uses five independent trials.The paper reports the average and standard deviation across trials.Source: A. Experimental Setup · p. 6
  • The main results assume exit indices are known, while end-to-end evaluations infer them from measured latency, including GPU-based results and a trusted-execution-environment experiment.The GPU setting is described as more challenging because latency-based exit-index inference is more uncertain there.Source: A. Experimental Setup · p. 6

B. Metrics

The evaluation defines attack effectiveness and stealthiness, compares the attack with three baselines, and reports consistent gains alongside preserved model utility and end-to-end robustness.

B. Metrics

  • Effectiveness uses precision, recall, and their harmonic-mean F1; stealthiness compares manipulated-versus-clean accuracy and inference-speedup differences.Source: B. Metrics · p. 7

C. Baselines

  • The three baselines are 50% random guessing, frequency-based indicator-exit prediction, and logistic regression on exit indices.Source: C. Baselines · p. 7

D. Main Results

  • Accuracy drops at most 1.3%, while speedup decreases below 0.1 in most settings, except for BreakHis decreases of 0.55 and 0.71.Source: D. Main Results · p. 7
  • End-to-end effectiveness differs by less than 0.5% in 21 of 30 cases and less than 1.58% in every case versus known exit indices, supporting robustness to latency noise.Source: D. Main Results · p. 7
  • 71% average recall versus 51.71% for the best baseline; F1 exceeds 0.71 in seven of ten settings and 0.46 in all, versus baseline F1 below 0.34.Source: D. Main Results · p. 7, Table II · p. 8

E. Results on Different Backbones

Across three backbones, the attack retains high effectiveness with limited accuracy loss, though MobileNet's inference speedup declines more. Exit indices are also recoverable from latency with over 99.2% accuracy across the tested deployment environments.

E. Results on Different Backbones

  • Attack F1 scores exceed 0.73 across backbones while task accuracy degrades by less than 0.5%; speedup declines by less than 0.1 for VGG-16 and ResNet-56.MobileNet speedup falls from 2.79× to 2.04× on CIFAR-10 and from 1.75× to 1.45× on VGGFace2S.Source: E. Results on Different Backbones · p. 8, Table III · p. 9

F. Inferring Exit Index from Latency

G. Ablation Study

The full training objective performs best overall in ablations, while the two-stage training procedure improves task accuracy over direct adversarial training. The weighting parameter also has a range in which attack and utility metrics remain strong.

G. Ablation Study

  • The full objective achieves the highest F1 on both datasets, while removing either selective label smoothing or entropy-covariance optimization degrades F1.Removing LP most severely degrades recall, while removing LT most severely degrades precision.Source: G. Ablation Study · p. 10, Table V · p. 10

H. Training Procedure Study

  • Two-stage training improves task accuracy over direct adversarial training by 2.15% on CIFAR-10 and 4.84% on VGGFace2S.The study compares the two procedures on CIFAR-10 and VGGFace2S using gray and white male as target properties, respectively.Source: H. Training Procedure Study · p. 10

1) Impact of Weighting Hyperparameter:

  • For λ ∈[1.5, 2.5], precision, recall, F1 score, and inference speedup stay above 73%, 80%, 0.8, and 1.6×, respectively, with accuracy degradation below 1%.Within this range, the attack is not sensitive to the precise λ choice.Source: 1) Impact of Weighting Hyperparameter · p. 10

2) Impact of Label Smoothing Parameter:

The attack remains effective across a range of label-smoothing parameters and designated exits. Deeper designated exits generally improve attack effectiveness, while stealthiness trends vary by dataset.

2) Impact of Label Smoothing Parameter:

  • For ϵ ∈[0.1, 0.6], precision, recall, and F1 exceed 75%, 63%, and 0.74, respectively, versus best baseline values below 36%, 54%, and 0.35.Accuracy differences stay below 1%, while inference speedup degradation remains within 0.5 across this range.Source: 2) Impact of Label Smoothing Parameter · p. 10, Figure 4 · p. 11

3) Impact of Choice of Designated Exit:

  • At designated exits covering ≥75% of layers, precision, recall, and F1 exceed 80%, 76%, and 0.78 on both datasets, with inference speedup above 1.6×.Model accuracy remains above 90% for CIFAR-10 and 93% for VGGFace2S; effectiveness generally rises with deeper designated exits.Source: 3) Impact of Choice of Designated Exit · p. 11, Figure 5 · p. 11
  • Stealthiness trends differ by dataset: deeper exits first reduce then increase accuracy and speedup on CIFAR-10, while VGGFace2S accuracy rises as speedup falls.The authors suggest natural intermediate-exit routing on CIFAR-10 and the relative difficulty of face classification may help explain the difference.Source: 3) Impact of Choice of Designated Exit · pp. 11–12

4) Impact of Confidence Threshold:

The attack remains effective across tested confidence thresholds and extends to simultaneous inference of multiple properties and a setting where users insert their own exits. In that extended setting, effectiveness is lower than in the primary setting, but utility remains largely preserved.

4) Impact of Confidence Threshold:

  • Precision exceeds 80% across evaluated thresholds, while F1 exceeds 0.65 versus below 0.35 for baselines; task accuracy drops within 0.8%.Recall exceeds 67% except at threshold 0.99 on CIFAR-10, where it still beats the best baseline at 57%; speedup decreases by at most 0.7.Source: 4) Impact of Confidence Threshold · p. 12

J. Inferring Multiple Properties Simultaneously

K. Extended Attack Scenario

  • When users insert their own exits, the backbone-only attack achieves precision above 64%, recall above 54%, and F1 above 0.59, with accuracy drop within 2% and speedup degradation below 0.32.This setting assumes the CSP estimates a range where user-inserted exits are likely; effectiveness is slightly lower than in the primary setting.Source: K. Extended Attack Scenario · pp. 12–13, Table VIII · p. 13

VI. POSSIBLE DEFENSES

Randomized exits and dummy computation reduce latency-based attack performance, but also weaken multi-exit acceleration. The paper identifies privacy protection that preserves inference efficiency as an open direction.

VI. POSSIBLE DEFENSES

  • Randomized Exit probabilistically selects early termination, while Dummy Computation adds randomized work after exit to obscure the latency–exit-depth relationship.Both are proposed as ways to obscure the exit index inferred from latency.Source: §VI · p. 13
  • Defense experiments use CIFAR-10 with gray as the target property; dummy computation is simulated by adding absolute Gaussian latency noise.The study varies exit probability p from 0.1 to 1 and noise standard deviation σ from 0 to 1 × 10^-3.Source: §VI · p. 13
  • As p decreases or σ increases, attack F1 score and inference speedup decrease simultaneously, mitigating latency-based privacy leakage while weakening acceleration benefits.The authors identify privacy protection without significant efficiency compromise as future work.Source: §VI · p. 13
  • Trusted-data fine-tuning and pre-deployment parameter inspection are suggested defenses, but their evaluation is left to future work.Source: §VI · p. 13

VII. CONCLUSION

  • The conclusion reports a latency-only privacy vulnerability and a training framework combining selective label smoothing with entropy-covariance optimization, evaluated across diverse settings.It calls for defenses that protect privacy without sacrificing efficiency.Source: §VII · pp. 13–14

Related papers

Loading 2610.31246v1…