AESOP: Adversarial Execution-path Selection to Overload Deep Learning Pipelines

arXiv cs.LG Papers
adversarial-attack machine-learning-security inference-pipeline system-efficiency ai-research

Summary

This paper introduces AESOP, a framework for adversarial execution-path selection that significantly inflates FLOPs and latency in deep learning inference pipelines, revealing new efficiency-based vulnerabilities.

arXiv:2605.10987v1 Announce Type: new Abstract: Modern machine learning deployments increasingly compose specialized models into dynamic inference pipelines, where upstream components produce intermediate predictions that determine the workload and inputs of downstream components. The cost of processing an input is therefore not determined by any single model, but by two coupled factors: the per-inference cost of each invoked component and its workload volume. Because these pipelines run under hard real-time constraints, efficiency is a fundamental requirement for system availability. We show that this structure creates an efficiency-attack surface that existing methods targeting single models cannot exploit: on identical inputs and budgets, path-aware targeting inflates FLOPs by $2,407\times$ while the strongest single-model baseline achieves $117\times$ -- a $20\times$ gap attributable entirely to where the attack is directed. We formalize this as the adversarial path-selection problem and present AESOP, a framework combining vulnerability-guided path ranking with adaptive loss weighting. We evaluate AESOP on five pipelines plus a production-realistic deployment variant with batching, bounded buffering, and confidence-threshold defenses. AESOP achieves up to $2,407\times$ FLOPs and $419\times$ latency inflation in white-box setting and 58$\times$ FLOPs / 17$\times$ latency in gray-box settings. Under system-level defenses, the attack is not neutralized but redirected: pipelines are forced to choose between throughput collapse ($0.578 \to 0.006$ input/s) and $96.7\%$ data loss to sustain throughput.
Original Article
View Cached Full Text

Cached at: 05/13/26, 06:25 AM 

# AESOP: Adversarial Execution-path Selection to Overload Deep Learning Pipelines
Source: [https://arxiv.org/abs/2605.10987](https://arxiv.org/abs/2605.10987)
[View PDF](https://arxiv.org/pdf/2605.10987)

> Abstract:Modern machine learning deployments increasingly compose specialized models into dynamic inference pipelines, where upstream components produce intermediate predictions that determine the workload and inputs of downstream components\. The cost of processing an input is therefore not determined by any single model, but by two coupled factors: the per\-inference cost of each invoked component and its workload volume\. Because these pipelines run under hard real\-time constraints, efficiency is a fundamental requirement for system availability\. We show that this structure creates an efficiency\-attack surface that existing methods targeting single models cannot exploit: on identical inputs and budgets, path\-aware targeting inflates FLOPs by $2,407\\times$ while the strongest single\-model baseline achieves $117\\times$ \-\- a $20\\times$ gap attributable entirely to where the attack is directed\. We formalize this as the adversarial path\-selection problem and present AESOP, a framework combining vulnerability\-guided path ranking with adaptive loss weighting\. We evaluate AESOP on five pipelines plus a production\-realistic deployment variant with batching, bounded buffering, and confidence\-threshold defenses\. AESOP achieves up to $2,407\\times$ FLOPs and $419\\times$ latency inflation in white\-box setting and 58$\\times$ FLOPs / 17$\\times$ latency in gray\-box settings\. Under system\-level defenses, the attack is not neutralized but redirected: pipelines are forced to choose between throughput collapse \($0\.578 \\to 0\.006$ input/s\) and $96\.7\\%$ data loss to sustain throughput\.

## Submission history

From: Tingxi Li \[[view email](https://arxiv.org/show-email/9e326df8/2605.10987)\] **\[v1\]**Sat, 9 May 2026 09:16:49 UTC \(252 KB\)

Similar Articles

One-Step Gradient Delay is Not a Barrier for Large-Scale Asynchronous Pipeline Parallel LLM Pretraining

Hugging Face Daily Papers

This paper challenges the assumption that one-step gradient delay in asynchronous pipeline parallelism is inherently unstable, showing that degradation depends on optimizer choice. It demonstrates that optimizers like Muon are robust to one-step delay and introduces an error-feedback correction to further mitigate staleness, achieving near-synchronous performance in LLM pretraining up to 10B parameters.

Adversarial attacks on neural network policies

OpenAI Blog

OpenAI researchers demonstrate that adversarial attacks, previously studied in computer vision, are also effective against neural network policies in reinforcement learning, showing significant performance degradation even with small imperceptible perturbations in white-box and black-box settings.