🤖 machine learning

AESOP: Adversarial Execution-path Selection to Overload Deep Learning Pipelines

This paper introduces AESOP, a framework that exploits the dynamic structure of deep learning inference pipelines to overload system resources by strategically selecting execution paths, achieving significantly higher computational and latency inflation than single-model attacks and forcing defenders to choose between throughput collapse or massive data loss.

Original authors: Tingxi Li, Mingfang Ji, Ravishka Shemal Rathnasuriya, Simin Chen, Yitao Hu, Wei Yang

Published 2026-05-13

📖 4 min read☕ Coffee break read

CC BY 4.0

Original authors: Tingxi Li, Mingfang Ji, Ravishka Shemal Rathnasuriya, Simin Chen, Yitao Hu, Wei Yang

Original paper licensed under CC BY 4.0 (http://creativecommons.org/licenses/by/4.0/). ✨ This is an AI-generated explanation of the paper below. It is not written or endorsed by the authors. For technical accuracy, refer to the original paper. Read full disclaimer

Imagine a modern machine learning system not as a single, giant brain, but as a highly organized factory assembly line.

In this factory, a product (like a video frame of a street) enters at the start. It gets checked by a "Security Guard" (a model that detects objects). Based on what the guard sees, the product is sent down different conveyor belts:

If it sees a person, it goes to the "Face ID" station.
If it sees a car, it goes to the "License Plate Reader" station.
If it sees nothing, it goes straight to the exit.

Each station takes a different amount of time and energy to do its job. The "License Plate Reader" is a slow, heavy-duty machine, while the "Face ID" station is faster. The system is designed to be efficient, only sending items to the heavy machines when absolutely necessary.

The Problem: The "Smart" Saboteur

The paper introduces a new kind of attack called AESOP.

Traditional hackers try to trick a single machine in the factory into working harder (like making the Security Guard sweat by showing it a blurry image). But AESOP is smarter. It doesn't just try to make one machine work harder; it tries to trick the factory manager into sending every single item down the slowest, most expensive conveyor belt possible.

Think of it like a traffic jam.

Old attacks: Trying to make one car drive slowly.
AESOP: Convince the traffic light system that every car is a VIP that needs to go through the single-lane, slowest bridge, even though there are fast highways available.

How AESOP Works (The Two-Step Plan)

The researchers built a framework with two main steps:

The Mapmaker (Path Ranking): First, the attacker studies the factory blueprint. They calculate exactly how much time and energy each possible route takes. They identify the "Golden Path"—the route that combines the most expensive machines. In their tests, they found that the "License Plate" route was roughly 32 times more expensive than the "Face ID" route.
The Trickster (Adaptive Perturbation): Once they know the "Golden Path," they create a tiny, almost invisible change to the input image (a "perturbation"). This change is designed to fool the initial Security Guard into thinking, "Oh, this is definitely a car with a license plate!" even if it's just a person or a random object.

The result? The factory blindly sends thousands of items down the slow, expensive route, clogging the system.

The Results: A Massive Overload

The paper tested this on five different "factories" (pipelines), including traffic monitoring, wildlife conservation, and emergency alert systems.

The Gap: When they tried to attack just one machine (the old way), they could make the system work 117 times harder. But when they used AESOP to force the whole system down the wrong path, they made it work 2,407 times harder. That is a 20x difference just by choosing the right path to attack.
Real-World Impact: In a traffic monitoring system, a normal frame takes 45 milliseconds to process. Under an AESOP attack, it took 13.6 seconds. The system didn't crash; it just became so slow that it stopped working entirely, missing 96% of the cars passing by.

Why Defenses Failed

The researchers tried to stop this attack using standard safety measures, like:

Confidence Thresholds: "Only process if we are 90% sure." (Failed because AESOP tricks the system into being very confident it's a car).
Batching: "Process items in groups to save time." (Failed because the total number of items to process was still huge).
Buffering: "If the line gets too long, drop the extra items." (This "worked" in a twisted way: the system kept its speed by silently dropping 96.7% of the data. The dashboard looked fine, but the system was blind).

The Big Lesson

The paper concludes that the vulnerability isn't in the individual machines (the models); it's in the routing logic (the decision of where to send the data).

Current defenses look at the items (the images) to see if they are bad. But AESOP attacks the flow (the path). It's like a security guard checking every person's ID at the door but failing to notice that the guard has been tricked into sending everyone to the VIP lounge instead of the exit.

To fix this, the authors suggest we need "routing-aware" defenses—systems that can say, "Wait, you're sending 1,000 cars to the License Plate reader in one second? That's not normal. Stop the line." Currently, most AI systems don't have this kind of oversight.

Technical Summary: AESOP

Problem Statement

Modern machine learning deployments increasingly rely on dynamic inference pipelines composed of specialized models connected via producer-consumer dataflow. Unlike monolithic models, these pipelines exhibit execution-path dependency: the computational cost of processing an input is not determined solely by the per-inference cost of individual components, but by the specific sequence of components (the execution path) activated by the input.

The paper identifies a critical efficiency-attack surface in these systems: Adversarial Execution-path Selection. While existing adversarial attacks on efficiency target single models (e.g., inflating Non-Maximum Suppression survivors or delaying early exits), they fail to account for the pipeline's routing logic. An adversary who can steer inputs into the most computationally intensive execution path can induce a worst-case cost scenario that single-model attacks cannot achieve. The authors formalize this as the adversarial path-selection problem, where the goal is to maximize the total pipeline cost $C(S, x)$ by selecting the optimal path $\pi^*$ and generating a perturbation $\delta$ conditioned on that path.

Methodology: AESOP Framework

The authors present AESOP (Adversarial Execution-path Selection to Overload Deep Learning Pipelines), a two-phase framework designed to solve the adversarial path-selection problem.

Phase 1: Vulnerability-Guided Path Ranking

This phase addresses the outer maximization of the attack objective: identifying which execution path yields the highest cost amplification.

Profiling: The framework profiles each component $v$ in the pipeline to determine three input-dependent quantities: per-inference cost ( $c_v$ ), output cardinality ( $o_v$ ), and gating behavior ( $g_v$ ). In gray-box settings, the aggregate workload forwarded downstream ( $g_v(o_v)$ ) is inferred from input/output behavior.
Component Vulnerability Scoring: For each component, a vulnerability score is calculated as the multiplicative amplification of cost under adversarial input relative to clean input:
$\text{Vul-Score}(v) = \frac{C_{\text{adv}}(v, x+\delta)}{C(v, x)} - 1$
Path Vulnerability Aggregation: The vulnerability score of a path $\pi_i$ is the sum of its components' scores. The authors use summation rather than maximum because pipeline costs cascade; an inflated output at an upstream node propagates work to all downstream nodes on that path simultaneously.
Path Selection: The path $\pi^*$ with the highest aggregated vulnerability score is selected as the target.

Phase 2: Adaptive Loss Weighting

This phase addresses the inner maximization: generating a perturbation $\delta$ that maximizes the cost along the selected path $\pi^*$ .

Vulnerability-Weighted Objective: Instead of treating all components equally, AESOP constructs a path-conditioned loss function where the weight of each component's loss term is proportional to its contribution to the path's total vulnerability score:
$L_{\text{total}} = \sum_{v \in \pi^*} \frac{\text{Vul-Score}(v)}{\text{Vul-Score}(\pi^*)} \cdot L_v$
Backend Agnosticism: The framework is decoupled from the specific perturbation mechanism. Any existing single-model efficiency attack (e.g., output inflation, EOS-delay, early-exit suppression) can serve as the backend $L_v$ . AESOP provides the system-level decision (path selection) that single-model attacks structurally lack.

Key Contributions

Formalization of Adversarial Path Selection: The paper identifies execution-path activation as the dominant lever for attacking pipeline efficiency, distinct from perturbation strength.
AESOP Framework: The first path-aware efficiency-attack framework that combines vulnerability-guided path ranking with adaptive loss weighting. It is modular, allowing integration with any single-model perturbation backend.
Comprehensive Evaluation: The framework is evaluated across five diverse pipelines (traffic monitoring, wildlife conservation, smart-home alerting, expressway surveillance, and Amber Alert generation) and a production-realistic deployment variant featuring batching, bounded buffering, and confidence thresholds.

Experimental Results

The evaluation demonstrates that path-aware targeting significantly outperforms single-model baselines, even under identical perturbation budgets and inputs.

White-Box Effectiveness: AESOP achieves up to 2,407× FLOPs inflation and 419× latency inflation on the Expressway Surveillance pipeline. This is a 20× gap over the strongest single-model baseline (which achieved 117× FLOPs inflation). The gap correlates with the asymmetry of the pipeline's execution paths; in highly asymmetric pipelines (e.g., Wildlife Conservation), the advantage is most pronounced.
Gray-Box Transferability: The path-selection mechanism survives without gradient access to the target. Using public model specifications for Phase 1 and surrogate models for Phase 2, AESOP achieves 3.6× to 58.3× FLOPs inflation across different target architectures (YOLOv5l and YOLOv8n).
Ablation Studies: Removing the path-selection component (Phase 1) significantly reduces attack efficacy, particularly when the detector's natural class bias opposes the most expensive path. In the Traffic Monitoring pipeline, removing path selection reduced FLOPs amplification from 983× to 412×.
System-Level Defenses: Under production-realistic defenses (confidence thresholding, batching, bounded buffering, input preprocessing, and SVM filtering), the attack is not neutralized but redirected:
- Confidence Thresholding & Batching: Provide negligible recovery; throughput remains collapsed.
- Bounded Buffering: Restores throughput (to ~50-69% of clean levels) only by silently dropping 96.7% of detections. This converts compute exhaustion into data loss without addressing the underlying routing vulnerability.
- Input Preprocessing: Reduces the magnitude of the attack but leaves residual workload (4–6× above baseline) because it does not alter the routing logic.
- ML-Based Filtering: Fails bimodally at low attack ratios and degrades to no-defense performance at high ratios.

Significance and Claims

The paper claims that the vulnerability is structural to dynamic deep learning pipelines. The attack operates at the routing layer, a level invisible to current model-level defenses (which focus on input integrity or individual model robustness).

The authors argue that:

Path selection is a first-class adversarial primitive. Existing attacks fail globally in pipelines because they fix a target model in advance, ignoring the fact that the cost is determined by where the input is routed.
Current defenses are insufficient. Defenses operating at the image level (preprocessing) or scheduling level (buffering/batching) fail to constrain the routing decision. They either fail to stop the attack or mitigate it by sacrificing system utility (e.g., dropping 96% of valid data).
Future mitigation requires routing-aware mechanisms. The authors suggest that effective defense requires treating per-path workload as a first-class operational quantity, potentially through per-path workload budgets, distributional anomaly detection on path utilization, or trust-bounded routing decisions—capabilities currently absent in standard pipeline frameworks.

The work is presented as an exposure of systemic risks to inform the design of more robust, routing-aware pipeline frameworks, rather than as a tool for immediate deployment.