# AESOP: Adversarial Execution-path Selection to Overload Deep Learning Pipelines

arXiv: https://arxiv.org/abs/2605.10987 · HTML: https://mlsanity.com/paper/2605.10987/

## Key facts

- No citing papers in the map yet (data through 14 Oct 2026).
- Builds on 19 of its 42 references that are in the map.
- First posted on arXiv 9 May 2026.

## Builds on (most cited first, 19 of 19)

- [Human Action Recognition from Various Data Modalities: A Review](https://mlsanity.com/paper/2012.11866/) (2020)
- [Sponge Examples: Energy-Latency Attacks on Neural Networks](https://mlsanity.com/paper/2006.03463/) (2020)
- [A Panda? No, It's a Sloth: Slowdown Attacks on Adaptive Multi-Exit Neural Network Inference](https://mlsanity.com/paper/2010.02432/) (2020)
- [NICGSlowDown: Evaluating the Efficiency Robustness of Neural Image Caption Generation Models](https://mlsanity.com/paper/2203.15859/) (2022)
- [Phantom Sponges: Exploiting Non-Maximum Suppression to Attack Deep Object Detectors](https://mlsanity.com/paper/2205.13618/) (2022)
- [Taxonomy of Machine Learning Safety: A Survey and Primer](https://mlsanity.com/paper/2106.04823/) (2021)
- [DeepPerform: An Efficient Approach for Performance Testing of Resource-Constrained Neural Networks](https://mlsanity.com/paper/2210.05370/) (2022)
- [SlowTrack: Increasing the Latency of Camera-based Perception in Autonomous Driving Using Adversarial Examples](https://mlsanity.com/paper/2312.09520/) (2023)
- [Overload: Latency Attacks on Object Detection for Edge Devices](https://mlsanity.com/paper/2304.05370/) (2023)
- [SlothSpeech: Denial-of-service Attack Against Speech Recognition Models](https://mlsanity.com/paper/2306.00794/) (2023)
- [DREAM: A Dynamic Scheduler for Dynamic Real-time Multi-model ML Workloads](https://mlsanity.com/paper/2212.03414/) (2022)
- [GradMDM: Adversarial Attack on Dynamic Networks](https://mlsanity.com/paper/2304.06724/) (2023)
- [Loki: A System for Serving ML Inference Pipelines with Hardware and Accuracy Scaling](https://mlsanity.com/paper/2407.03583/) (2024)
- [AI Safety Assurance for Automated Vehicles: A Survey on Research, Standardization, Regulation](https://mlsanity.com/paper/2504.18328/) (2025)
- [DAGER: Deep Age, Gender and Emotion Recognition Using Convolutional Neural Network](https://mlsanity.com/paper/1702.04280/) (2017)
- [Child Face Age-Progression via Deep Feature Aging](https://mlsanity.com/paper/2003.08788/) (2020)
- [Utility-Aware Load Shedding for Real-time Video Analytics at the Edge](https://mlsanity.com/paper/2307.02409/) (2023)
- [PARD: Enhancing Goodput for Inference Pipeline via Proactive Request Dropping](https://mlsanity.com/paper/2602.08747/) (2026)
- [Exploiting Efficiency Vulnerabilities in Dynamic Deep Learning Systems](https://mlsanity.com/paper/2506.17621/) (2025)

## Abstract (arXiv)

Modern machine learning deployments increasingly compose specialized models into dynamic inference pipelines, where upstream components produce intermediate predictions that determine the workload and inputs of downstream components. The cost of processing an input is therefore not determined by any single model, but by two coupled factors: the per-inference cost of each invoked component and its workload volume. Because these pipelines run under hard real-time constraints, efficiency is a fundamental requirement for system availability. We show that this structure creates an efficiency-attack surface that existing methods targeting single models cannot exploit: on identical inputs and budgets, path-aware targeting inflates FLOPs by 2,407× while the strongest single-model baseline achieves 117× -- a 20× gap attributable entirely to where the attack is directed. We formalize this as the adversarial path-selection problem and present AESOP, a framework combining vulnerability-guided path ranking with adaptive loss weighting. We evaluate AESOP on five pipelines plus a production-realistic deployment variant with batching, bounded buffering, and confidence-threshold defenses. AESOP achieves up to 2,407× FLOPs and 419× latency inflation in white-box setting and 58× FLOPs / 17× latency in gray-box settings. Under system-level defenses, the attack is not neutralized but redirected: pipelines are forced to choose between throughput collapse (0.578 → 0.006 input/s) and 96.7% data loss to sustain throughput.