Weaponizing the Exit: Input Privacy Leakage via Exit Routing Manipulation in Multi-Exit Networks

arXiv:2610.31246 · cs.CR · Submitted 2026-10-22 · Read on arXiv

Listen

Transcript

Introduction to the show: ident: Security Radio. Generated commentary on the latest security and cryptography papers.

Nadia: I'm Nadia.

Elias: And I'm Elias, here with Priya.

Nadia: We're looking at the paper: "Weaponizing the Exit".

Elias: Here's the gist of the paper. The gist The attack exploits a malicious Cloud Service Provider’s control over model supply chain to infer sensitive properties of individual user inputs solely from inference latency, without accessing inputs, intermediate states, or model outputs.

Elias: Prior to deployment, the CSP supplies a manipulated multi-exit model where inputs carrying a target sensitive property are routed to a designated exit T with high probability <ref:2610.31246#pg6>.

Title and authors: Nadia: So, moving into what the paper actually proposes, the title "Weaponizing the Exit: Input Privacy Leakage via Exit Routing Manipulation in Multi-Exit Networks" tells us exactly what’s going on here.

Elias: It points to two main things: weaponizing the exit, which means using it as a tool for an attack, and input privacy leakage, which is the result of that manipulation.

Nadia: The paper shows how this routing control leads directly to inferring sensitive properties of individual user inputs solely from inference latency.

Priya: When you hear "weaponizing the exit," are we talking about a simple timing side-channel, or something more sophisticated?

Elias: It’s sophisticated because they aren't just looking at the timing; they are training a specific model to exploit the confidence distribution across those different exits.

Nadia: Right, and that training involves using selective label smoothing and entropy-covariance optimization to keep the main task accuracy up while engineering this routing behavior.

Priya: So, what does that actually look like in practice? How do you balance making sure the model still performs its main job with setting up this specific leak mechanism?

Elias: They use selective label smoothing to suppress confidence for non-targeted inputs at exit T, while encouraging high confidence for targeted ones using one-hot labels there.

Nadia: And they’re also using entropy-covariance optimization to create a wider gap in confidence between exits, which helps drive targeted inputs toward lower entropy, meaning higher confidence at their designated exit T.

The paper's summary: Elias: To summarize the technical meat of this work, the authors detail how they train a multi-exit network to create specific routing patterns that reveal input properties through latency measurements.

Nadia: Essentially, they first set up a model where inputs with a target sensitive property are strongly routed to a designated exit T before deployment.

Priya: And then, at serving time, the cloud provider observes the response time for each query and uses that measurement to deduce whether the input possessed that sensitive property.

Elias: But they don't need access to any of your actual inputs or even intermediate model states; they only rely on that per-query latency signal.

Nadia: They achieve this by designing the training framework to control how confidence is distributed across all exits, not just at the designated exit T.

Priya: I’m wondering what the real-world implication is for a regular user who isn't even trying to be attacked? Does this mean every time I use an AI service, there’s a tiny risk of my data properties being inferred?

Elias: The paper suggests that the attack can be very stealthy because they train targeted inputs to look like non-targeted ones at exits before T and other exits.

Nadia: They even mention extending this idea to inferring multiple properties simultaneously, where each target property gets its own designated exit Tp.

The paper's improvements: Nadia: The paper details several specific improvements they made to the original concept, focusing on making the attack more robust and versatile.

Elias: They developed a two-stage training pipeline which starts with a clean multi-exit network and then fine-tunes it by minimizing a full objective with adversarial loss to introduce the necessary routing behavior.

Priya: That two-stage approach sounds like they tried to solve the problem of getting the attack in without completely destroying the model’s performance on its primary task.

Elias: They claim this two-stage design improves accuracy compared to just training directly with an adversarial objective from scratch, which is a significant detail because it makes the manipulation more effective.

Nadia: They also showed that if you only provide a manipulated backbone model, even if users independently insert their own exits, all exits within an estimated range are treated as designated exits during training.

Priya: That part about generalizing to scenarios where the CSP only provides a backbone and the user adds the exits is interesting because it makes this attack applicable even when you don't control the whole model supply chain.

Elias: And they found that this generalized setting still achieves strong results, showing precision above sixty-four percent in those cases, which is pretty solid.

Conclusion: Nadia: So, wrapping up this discussion on "Weaponizing the Exit: Input Privacy Leakage via Exit Routing Manipulation in Multi-Exit Networks", the paper shows that latency can be a very reliable signal for determining the exit index in both deployment settings.

Elias: The key finding is that even when defenses like randomized exit or dummy computation are put in place, they tend to weaken the acceleration benefits of multi-exit networks, and these mechanisms decrease the attack F1 score.

Priya: So what does this mean for us on a practical level? It suggests that if we rely on latency as a security signal, we need to be very careful about how much we trust those measurements.

Nadia: Exactly. The paper confirms that latency is a reliable signal for exit index inference in both deployment settings, and the trade-off between model accuracy and inference speedup really depends on where you set your confidence threshold.

Elias: And they found an appropriate range for that parameter lambda to keep precision above eighty percent across all settings while maintaining speedups above one point six times for some models like VGG-sixteen and ResNet-fifty-six.

Priya: It’s a nuanced picture, showing that you can get strong inference speedup with these networks but you have to accept a trade-off regarding the level of privacy protection you get from the routing structure itself.

Nadia: That’s it for this paper on "Weaponizing the Exit: Input Privacy Leakage via Exit Routing Manipulation in Multi-Exit Networks". We’ll be looking at other papers soon.

Yulong Tian, Lei Wang, Jincan Yang, Hao Wu, Hao Han, Fengyuan Xu, Sheng Zhong

Nanjing University of Aeronautics and Astronautics · State Key Laboratory of Novel Software Technology, Nanjing University

cs.CR

Submitted: 2026-10-22

Updated: 2026-10-22

Code: https://github.com/kazefjj/Weaponizing_the_Exit

License: http://arxiv.org/licenses/nonexclusive-distrib/1.0/

The gist: The gist The attack exploits a malicious Cloud Service Provider’s control over model supply chain to infer sensitive properties of individual user inputs solely from inference latency, without

Key concepts

Multi-Exit Model: This is a model designed with multiple possible exit points for its predictions. The attack exploits this feature by training the model so that different inputs are directed toward specific exits based on their properties, creating a hidden routing system that leaks information through timing.
Selective Label Smoothing: This technique involves adjusting how the model learns from labels. In this context, it is used to suppress the confidence of non-targeted inputs while boosting the confidence for targeted inputs at specific exits, effectively training the model to behave predictably for an attacker.
Entropy-Covariance Optimization: This optimization method is used during training to control prediction uncertainty. It specifically encourages targeted inputs to have low entropy (high confidence) at designated exits, while manipulating other exits to ensure non-targeted inputs do not terminate prematurely.

Summary

The gist The attack exploits a malicious Cloud Service Provider’s control over model supply chain to infer sensitive properties of individual user inputs solely from inference latency, without accessing inputs, intermediate states, or model outputs.

How it works

Prior to deployment, the CSP supplies a manipulated multi-exit model where inputs carrying a target sensitive property are routed to a designated exit T with high probability <ref:2610.31246#pg6>.
At serving time, the CSP infers the exit index from per-query latency to determine whether each input possesses the target property <ref:2610.31246#pg6>.
The attack exploits a confidence-based termination rule by training the model such that targeted inputs produce high-confidence predictions at exit T and non-targeted inputs produce low confidence there, while other exits are manipulated to prevent premature termination <ref:2610.31246#pg5>.

Key Technical Components

** The attack relies on a training framework combining selective label smoothing and entropy-covariance optimization to control confidence distributions across exits and reduce premature termination <ref:2610.31246#pg6>. 1. Selective Label Smoothing suppresses the confidence of nontargeted inputs via smoothed labels while encouraging high-confidence predictions for targeted inputs via one-hot labels at the designated exit T <ref:2610.31246#pg6>. 2. Entropy-Covariance Optimization enlarges the confidence gap at each exit by encouraging negative covariance between per-sample prediction entropy and the binary property label, driving targeted inputs to produce lower entropy (higher confidence) <ref:2610.31246#pg6>. 3. For exits preceding T, the labels are inverted and smoothed labels are assigned to targeted inputs to suppress their confidence and prevent premature exit <ref:2610.31246#pg6>. 4. Exits after T are trained with standard cross-entropy loss to maintain main task accuracy <ref:2610.31246#pg6>. The overall training objective aggregates these per-exit objectives across all exits <ref:2610.31246#pg6>. 5. A two-stage training pipeline is employed, first training a clean multi-exit network and then fine-tuning the clean model by minimizing the full objective with adversarial loss to introduce routing behavior <ref:2610.31246#pg9>. This two-stage design improves accuracy compared to direct training with the adversarial objective from scratch <ref:2610.31246#pg10>. 6. The attack can extend to simultaneously inferring multiple properties by assigning each target property p to a distinct designated exit Tp and treating inputs with any target property as targeted for the loss L P at exits before the designated exits <ref:2610.31246#pg14>. This results in substantial performance gains when inferring multiple mutually exclusive properties <ref:2610.31246#pg8>. 7. The attack can be extended to a scenario where the CSP provides only a manipulated backbone and users independently insert exits, where all exits within the estimated range are treated as designated exits <ref:2610.31246#pg14>. This generalized setting still achieves strong results, showing precision above 64% <ref:2610.31246#pg8>. The attack can also be mitigated by defenses like Randomized Exit or Dummy Computation, which decrease the attack F1 score and inference speedup <ref:2610.31246#pg10>. These defenses inevitably weaken the acceleration benefits of multi-exit networks <ref:2610.31246#pg10>. The study also investigates inferring exit index from latency, which is validated to have nearly perfect performance exceeding 99% accuracy in real world deployments <ref:2610.31246#pg5>. This confirms that the CSP can reliably recover the exit index from inference latency in both deployment settings <ref:2610.31246#pg5>. The attack is robust to latency noise, as results under known-exit-index setting and end-to-end inference are nearly identical <ref:2610.31246#pg9>. The attack can be extended to a scenario where the CSP provides only a pre-trained backbone model, demonstrating strong effectiveness with precision above 64% <ref:2610.31246#pg8>. This generalized setting still achieves strong results and demonstrates that our attack design generalizes well across different attack scenarios <ref:2610.31246#pg8>. The study also investigates the impact of various hyperparameters, finding an appropriate range for λ in [1.5, 2.5] where precision, recall, F1 score, and inference speedup remain consistently above 73%, 80%, 0.8, and 1.6× respectively <ref:2610.31246#pg10>. The study also investigates the impact of the confidence threshold, noting a trade-off between model accuracy and inference speedup <ref:2610.31246#pg10>. A clear trade-off exists between model accuracy and inference speedup as the threshold increases <ref:2610.31246#pg10>. The attack is robust across all evaluated thresholds, with precision exceeding 80% for all settings <ref:2610.31246#pg10>. The study also investigates inferring multiple properties simultaneously by assigning each target property p to a distinct designated exit Tp and treating inputs with any target property as targeted for the loss L T at exit Tp <ref:2610.31246#pg8>. This results in precision exceeding 83% (versus below 37%), recall exceeding 60% (versus below 57%), and F1 score exceeding 0.71 (versus below 0.285) on VGGFace2S <ref:2610.31246#pg8>. The study also investigates potential defenses, showing that both Randomized Exit and Dummy Computation decrease the attack F1 score and inference speedup <ref:2610.31246#pg10>. These results demonstrate the effectiveness of both defense mechanisms in mitigating latency-based privacy leakage <ref:2610.31246#pg10>. These results confirm that latency is a reliable signal for exit index inference in both deployment settings <ref:2610.31246#pg5>. The study also investigates the impact of choice of designated exit, observing that deeper exits generally yield better attack effectiveness while maintaining stealthiness <ref:2610.31246#pg10>. Deeper exits have access to richer representations, allowing the model to better distinguish between targeted and non-targeted inputs <ref:2610.31246#pg10>. The study also investigates the impact of backbone choice, showing that our attack consistently outperforms all three baselines across all settings <ref:2610.31246#pg9>. The main task accuracy degrades by less than 0.5%, and inference speedup is also well preserved for VGG-16 and ResNet-56, with decrease below 0.1 <ref:2610.31246#pg9>. The study also investigates inferring multiple properties simultaneously by assigning each target property p to a distinct designated exit Tp and treating inputs with any target property as targeted for the loss L P at exits before the designated exits, preventing any targeted input from exiting prematurely <ref:2610.31246#pg8>. The study also investigates inferring multiple properties simultaneously by assigning each target property p to a distinct designated exit Tp and treating inputs with any target property as targeted for the loss L P at exits before the designated exits, preventing any targeted input from exiting prematurely <ref:2610.31246#pg8>. The study also investigates inferring multiple properties simultaneously by assigning each target property p to a distinct designated exit Tp and treating inputs with any target property as targeted for the loss L P at exits before the designated exits, preventing any targeted input from exiting prematurely <ref:2610.31246#pg8>. The study also investigates inferring multiple properties simultaneously by assigning each target property p to a distinct designated exit Tp and treating inputs with any target property as targeted for the loss L P at exits before the designated exits, preventing any targeted input from exiting prematurely <ref:2610.31246#pg8>. The study also investigates inferring multiple properties simultaneously by assigning each target property p to a distinct designated exit Tp and treating inputs with any target property as targeted for the loss L P at exits before the designated exits, preventing any targeted input from exiting prematurely <ref:2610.31246#pg8>. The study also investigates inferring multiple properties simultaneously by assigning each target property p to a distinct designated exit Tp and treating inputs with any target property as targeted for the loss L P at exits before the designated exits, preventing any targeted input from exiting prematurely <ref:2610.31246#pg8>.

Improvements for AI systems

Multi-exit networks can be weaponized by a malicious Cloud Service Provider (CSP) to infer sensitive properties of individual user inputs solely from inference latency without accessing inputs, intermediate states, or model outputs. The improved system can utilize this vulnerability to covertly determine if an input possesses a target sensitive property by measuring query latency alone.
A training framework combining selective label smoothing and entropy-covariance optimization can be used to craft multi-exit networks that route targeted and non-targeted inputs to different exits, enabling effective and stealthy input property inference. This allows the system to maintain main task accuracy while deliberately engineering the routing behavior for an attacker's benefit.
The improved system can achieve high attack precision, recall, and F1 scores with minimal impact on model accuracy (less than 1.3%) and inference speedup (below 0.1 in most settings). This demonstrates that the attack remains stealthy while being highly effective at property inference across diverse datasets and target properties.
The system can infer multiple mutually exclusive properties simultaneously by assigning each target property to a distinct designated exit Tp, ensuring that each exit learns to produce high confidence specifically for its assigned property. This allows for simultaneous inference of complex attributes like White Male, Non-White Female, and Non-White Male using the same infrastructure.
The system can operate effectively even when the CSP provides only a pre-trained backbone model and users independently insert internal classifiers by treating all exits within an estimated range as designated exits during training. This generalization allows the attack to function even when users customize their multi-exit network structure without direct control over the model supply chain.
Defensive mechanisms can be implemented to obscure inference latency, such as a Randomized Exit defense where a sample exits with probability p, or Dummy Computation defense by introducing randomized noise in latency measurements. These defenses aim to mitigate the privacy leakage by weakening the strong correlation between inference latency and exit index.