Edge-Only Universal Adversarial Attacks in Distributed Learning
Not on the map. Why?
Abstract (arXiv)
Distributed learning frameworks, which partition neural network models across multiple computing nodes, enhance efficiency in collaborative edge-cloud systems, but may also introduce new vulnerabilities to evasion attacks, often in the form of adversarial perturbations. In this work, we present a new threat model that explores the feasibility of generating universal adversarial perturbations (UAPs) when the attacker has access only to the edge portion of the model, consisting of its initial network layers. Unlike traditional attacks that require full model knowledge, our approach shows that adversaries can induce effective mispredictions in the unknown cloud component by manipulating key feature representations at the edge. Following the proposed threat model, we introduce both edge-only untargeted and targeted formulations of UAPs designed to control intermediate features before the split point. Our results on ImageNet demonstrate strong attack transferability to the unknown cloud part, and we compare the proposed method with classical white-box and black-box techniques, highlighting its effectiveness. Additionally, we analyze the capability of an attacker to achieve targeted adversarial effects with edge-only knowledge, revealing intriguing behaviors across multiple networks. By introducing the first adversarial attacks with edge-only knowledge in split inference, this work underscores the importance of addressing partial model access in adversarial robustness, encouraging further research in this area.
Key facts. Cited by 2 papers in the map (data through 14 Oct 2026). Builds on 37 of its 60 references that are in the map. First posted on arXiv 15 Nov 2024.
Builds on
37 of 60 references.
References · 37
- 2015Deep Residual Learning for Image Recognitioncited by 52,096
- 2020An Image is Worth 16x16 Words: Transformers for Image Recognition at Scalecited by 30,186
- 2014Very Deep Convolutional Networks for Large-Scale Image Recognitioncited by 15,364
- 2017Towards Deep Learning Models Resistant to Adversarial Attackscited by 6,415
- 2013Intriguing properties of neural networkscited by 5,155
- 2018MobileNetV2: Inverted Residuals and Linear Bottleneckscited by 4,795
- 2016Wide Residual Networkscited by 3,070
- 2016Towards Evaluating the Robustness of Neural Networkscited by 2,998
- 2015DeepFool: a simple and accurate method to fool deep neural networkscited by 1,318
- 2016Practical Black-Box Attacks against Machine Learningcited by 903
- 2016Universal adversarial perturbationscited by 784
- 2017Adversarial Patchcited by 517
25 more
- 2020Privacy and Robustness in Federated Learning: Attacks and Defensescited by 166
- 2017Distributed Deep Neural Networks over the Cloud, the Edge and End Devicescited by 120
- 2021Split Computing and Early Exiting for Deep Learning Applications: Survey and Research Challengescited by 115
- 2020Unleashing the Tiger: Inference Attacks on Split Learningcited by 105
- 2022Wild Patterns Reloaded: A Survey of Machine Learning Security against Training Data Poisoningcited by 94
- 2017Universal Adversarial Perturbations Against Semantic Image Segmentationcited by 92
- 2019Cross-Domain Transferability of Adversarial Perturbationscited by 92
- 2022On Adversarial Robustness of Trajectory Prediction for Autonomous Vehiclescited by 90
- 2018Generalizable Data-free Objective for Crafting Universal Adversarial Perturbationscited by 88
- 2018Universal Adversarial Trainingcited by 87
- 2017Fast Feature Fool: A data independent approach to universal adversarial perturbationscited by 66
- 2020NoPeek: Information leakage reduction to share activations in distributed deep learningcited by 66
- 2021A Survey On Universal Adversarial Attackcited by 59
- 2021UnSplit: Data-Oblivious Model Inversion, Model Stealing, and Label Inference Attacks Against Split Learningcited by 52
- 2019A Survey of Black-Box Adversarial Attacks on Computer Vision Modelscited by 37
- 2022On the Real-World Adversarial Robustness of Real-Time Semantic Segmentation Models for Autonomous Drivingcited by 30
- 2023Generalizable Black-Box Adversarial Attack with Meta Learningcited by 29
- 2019Indirect Local Attacks for Context-aware Semantic Segmentation Networkscited by 23
- 2020Double Targeted Universal Adversarial Perturbationscited by 23
- 2021Universal Adversarial Perturbations Through the Lens of Deep Steganography: Towards A Fourier Perspectivecited by 18
- 2017Robustness of classifiers to universal perturbations: a geometric perspectivecited by 15
- 2022Similarity-based Label Inference Attack against Training and Inference of Split Learningcited by 15
- 2022SplitNets: Designing Neural Architectures for Efficient Distributed Computing on Head-Mounted Systemscited by 14
- 2021Robust and Privacy-Preserving Collaborative Learning: A Comprehensive Surveycited by 5
- 2023Attention-Based Real-Time Defenses for Physical Adversarial Attacks in Vision Applicationscited by 3
Built on by
Citing papers per year: 2025: 2.
2 papers.