{"id":"3ac5d714-f3c6-42a1-ad35-758b22319b22","arxiv_id":"2506.17621","paper_version":1,"verdict":"CONDITIONAL","confidence":"MODERATE","novelty_score":4.0,"correctness_risk":"medium","formal_verification":"none","parameter_count":1,"one_line_summary":"Small adversarial perturbations can substantially inflate the latency, FLOPs, and energy of dynamic deep learning systems, as demonstrated on LLaMA 3B and reviewed across early-exit, generation, and detection architectures.","lead":"This paper shows that dynamic deep learning systems, which adapt their compute to input difficulty, can be forced by tiny adversarial changes to run much slower and consume more energy. It surveys existing efficiency attacks, introduces a fourth attack class for input-gating systems, and outlines what defenses are missing.","discovery_kind":"extension","skeptic_critique":{"model":"deepseek-v4-flash","headline":"The paper's novel D4 gating attack surface is asserted without any experiment, and §4 defers MoE/gated transformers to future work, so the abstract's general efficiency-vulnerability claim is not yet supported.","rationale":"I read the paper in good faith as a preliminary systematization and research agenda. The D1–D3 taxonomy and the LLaMA experiment with LLMEffiChecker are real evidence: Table 1 shows large latency/energy increases with modest word-level perturbations, and the paper cites prior work (DeepSloth, NICGSlowdown) for early-exit and caption-generation attacks. The problem is the paper's own contribution, D4, and its abstract-level generalization. Section 4 states that MoE and gated transformers are future work, which is an honest limitation but means the central claim about modern DDLSs is not yet tested. Section 2.2 calls D4 'formalized' but gives no formal cost model or optimization target, so it is not clear how Eq. (1) would apply to a discrete routing decision. The lack of a static baseline also weakens the interpretation of the LLaMA numbers: variable generation length is a property of autoregressive decoding generally, not specifically of dynamic systems, so the experiment does not isolate 'dynamic behavior' as the attack surface. Despite these gaps, I do not see an internal inconsistency or a fatal flaw; the paper's framing as an agenda is reasonable. My recommendation is to keep the CONDITIONAL verdict: publishable as a research roadmap, but the claims about D4 and emerging architectures need empirical support before they can be taken as established findings.","tokens_in":4293,"tokens_out":4600,"duration_ms":54462,"concrete_test":"Build a gated pipeline (lightweight router + small/large decoder) plus a static control that always uses the large decoder. Under the black-box setting of §2.3, search for ||δ||∞≤ε perturbations maximizing end-to-end latency. If the gated pipeline's latency inflation is not significantly larger than the static control's, and if no perturbation shifts routing to the heavy path, then the D4 attack surface and the DDLS-specific vulnerability claim are not supported.","verdict_should_be":"UNCHANGED","load_bearing_attack":"Section 2.2 introduces D4 (dynamic gating) as a newly formalized behavior, and the abstract's central claim is broad: 'input-dependent execution pathways create opportunities for adversaries to degrade efficiency.' But the only new empirical evidence, Table 1 in §3, attacks LLaMA 3B by inflating generation length (D2); it does not demonstrate that a bounded perturbation from Eq. (1) can flip an early-exit threshold, alter token pruning, change detection output counts, or reroute gated/MoE computation. Section 4 explicitly lists gated transformers and Mixture-of-Experts as 'future work,' confirming that the modern-architecture vulnerability is currently unverified. D4 is also not formally specified—no cost model or threshold condition is given—so there is no account of how the Eq. (1) optimization would steer it. Additionally, no static (non-dynamic) baseline is reported for the LLaMA experiment; autoregressive decoders of all kinds exhibit input-dependent length, so the 154.71% latency inflation may not be specific to DDLS dynamics. The central claim therefore rests on an extrapolation from one D2 case to the full D1–D4 taxonomy.","agreement_with_reader":"partial"},"referee_report":{"model":"deepseek-v4-flash","summary":"The paper examines efficiency vulnerabilities in dynamic deep learning systems (DDLSs), arguing that input-dependent execution pathways let adversaries inflate latency, energy, and FLOPs without changing output correctness. It defines an efficiency attack as a bounded-pertrubation optimization problem (Eq. 1), introduces a taxonomy of dynamic behaviors D1-D4 (where D4, dynamic gating, is newly formalized), reviews prior attacks (DeepSloth, NICGSlowdown, LLMEffiChecker), and reports preliminary LLaMA 3B machine-translation experiments showing up to 154.71% latency increase under black-box word-level perturbations. The final sections propose future work on gated transformers, Mixture-of-Experts, and new defenses. The paper is primarily a systematization and research agenda rather than a completed attack-and-defense study.","tokens_in":4576,"tokens_out":2651,"duration_ms":31058,"significance":"If the D4 gating attack surface and the broader D1-D4 framework are validated with rigorous experiments, this would be a valuable contribution to the security of adaptive inference systems. The preliminary LLaMA 3B results are consistent with prior external work on efficiency attacks and add evidence that large autoregressive models are vulnerable. The paper also clearly identifies a gap: modern gated/MoE architectures have not been tested under this threat model. However, the significance as evaluated is limited by the absence of any experiment on the newly claimed D4 surface, by the lack of a static baseline, and by the heavy reliance on the authors' own companion paper for the taxonomy, defense assessment, and prior-work interpretation.","major_comments":[{"comment":"D4 (dynamic gating) is introduced as a newly formalized attack surface, but no experiment, case study, cost model, or threshold condition is provided for it. Section 4 explicitly lists gated transformers and Mixture-of-Experts as future work, so the paper's claim that gating is an exploitable efficiency vulnerability is currently unsupported. The authors should either instantiate D4 on a concrete gated pipeline (with empirical results) or explicitly reframe D4 as a hypothesis with a falsifiable prediction.","section":"Section 2.2"},{"comment":"The LLaMA 3B experiment is missing essential reporting: no dataset, number of runs, standard deviations, confidence intervals, or statistical tests are given, so the reported averages cannot be assessed for robustness. In addition, no static (non-dynamic) baseline is reported. Autoregressive decoders inherently produce varying output lengths even without dynamic mechanisms, so the 154.71% latency inflation may be a generic property of token-count variation rather than a DDLS-specific vulnerability. The authors should add a static-length or fixed-iteration baseline and report variance across seeds.","section":"Section 3, Table 1"},{"comment":"The optimization formulation assumes that the cost function C is effectively maximizable by bounded input perturbations, but the paper does not show how this optimization would handle discrete dynamic decisions such as early-exit thresholds, token pruning, detection-output counts, or gating switches. The only empirical attack inflates generation length (D2), which is a continuous-length effect. Without a concrete optimization procedure that steers discrete behaviors, the claim that Eq. (1) unifies attacks across D1-D4 is not established.","section":"Section 2.1, Eq. (1)"},{"comment":"The paper leans heavily on the authors' own companion paper [3] for the D1-D3 taxonomy, the systematization of knowledge, and the defense assessment, and the only new experiment uses LLMEffiChecker [6] from the same group. This creates a circular evidentiary base: the manuscript's central 'gaps' and 'conclusions' are largely derived from its own prior work. The authors should either include independent implementations, external datasets, or direct comparisons with third-party methods, or clearly demarcate which claims are novel to this paper and which are inherited from [3] and [6].","section":"Section 3 and References [3], [6]"}],"minor_comments":[{"comment":"The sentence 'This section establishes the foundation for by providing' contains a missing object; it should read 'the foundation for the rest of the paper by providing'.","section":"Section 2"},{"comment":"In 'While such dynamic behaviors improves efficiency', the verb should agree with the plural subject: 'improve' instead of 'improves'.","section":"Section 2.2"},{"comment":"The phrase 'detection accuracy of upto 87%' should be 'up to 87%'.","section":"Section 3"},{"comment":"The sentence 'Prior work has demonstrated that efficiency attacks can exploit range of dynamic behaviors' is missing an article; it should be 'can exploit a range of dynamic behaviors'.","section":"Section 3"},{"comment":"Reference [4] includes the informal title 'A panda? no, it's a sloth: Slowdown attacks...' which should be formatted consistently with the publisher's official title.","section":"References"}],"recommendation":"major_revision","confidential_remarks":"The paper is closer to a position or roadmap than a completed research article. If the venue prefers self-contained empirical studies, the editor may want to consider scope fit. The self-citation pattern is notable: [3] is an arXiv preprint from the same authors and group, and it carries much of the taxonomy and defense evaluation; the only new experiment uses a tool from the same group. I would advise the editor to require the authors to either broaden the empirical base or clearly separate the companion-paper content from the novel contribution."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"Quick take: this is a position paper with one new category (D4 gating), one small experiment (LLaMA 3B translation), and a lot of scaffolding from the authors' own companion work. The efficiency-attack direction is real and worth pursuing; the paper's specific claims, however, overreach what the evidence supports.\n\nWhat's actually new: the D4 gating behavior class and the LLaMA 3B measurement (up to 154.71% GPU latency increase under word-level black-box perturbations while BLEU stays flat). The formal definition of efficiency attacks as a constrained optimization problem in Eq. (1) is a clean way to frame the threat model. The paper also does a decent job of organizing prior attacks (DeepSloth, NICGSlowdown, SpongeExamples) into the D1-D3 taxonomy from their earlier paper and pointing out where the gaps are (MoE, gated transformers, hierarchical pipelines). That survey is useful.\n\nNow the soft spots, in proportion. D4 is asserted but not formalized: no cost model, no threshold condition, and no experiment that shows a bounded perturbation can flip a gating decision. Section 4 explicitly defers gated transformers and MoE to future work, so the abstract's broad claim that 'input-dependent execution pathways create opportunities' is currently supported only by a D2 length-inflation attack. That attack lacks a static baseline: an autoregressive decoder of any kind will produce longer generations under adversarial input, so the 154.71% might not be specific to 'dynamic' systems. Table 1 has no dataset description, sample count, or error bars, so the numbers are indicative at best. The paper also leans heavily on the authors' own companion preprint [3] for the taxonomy and defense evaluation; that citation doesn't make the paper wrong, but it weakens the novelty claim when the central experiment uses their own tool (LLMEffiChecker).\n\nNone of this kills the core direction. The existence of efficiency attacks is already established by external work, and the paper's own pilot result is consistent with that. The problem is that the paper reads as a research agenda with an overconfident abstract. The authors should either soften the claims or add the missing evidence: formalize D4, run a static-computation baseline, report error bars and exact dataset details, and ideally test one gated architecture.\n\nWho is this for? People working on efficient inference, adversarial ML, or system security who want a structured map of this attack surface. It deserves a serious referee, but I would send it back for major revision rather than accept it as is. As a workshop position paper, it would be fine.","headline":"A useful research agenda on efficiency attacks, but the D4 gating claim and the LLaMA measurement need more evidence before the broad vulnerability claim holds.","tokens_in":5056,"tokens_out":3556,"would_cite":true,"duration_ms":37486,"reading_group":"maybe","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"Dynamic deep learning systems can be forced into slow, costly execution paths by imperceptible input perturbations, without changing the output.","keywords":["efficiency attacks","dynamic deep learning systems","adversarial robustness","latency inflation","denial-of-service","Mixture-of-Experts","early exit","input-adaptive computation"],"falsifier":"Fix the maximum output length of LLaMA 3B so the number of generated tokens cannot grow, then apply the same LLMEffiChecker word-level perturbations; if the 154.71% latency increase largely disappears, the attack works through output-length inflation rather than through input-adaptive routing, undercutting the claim that dynamic behaviors are the exploitable surface.","tokens_in":4130,"feed_emoji":"🐢","tokens_out":4685,"duration_ms":44815,"temperature":0.7,"pith_summary":"This paper argues that dynamic deep learning systems—models that adjust their computation based on the input—carry an underexplored security risk: an adversary can craft small, imperceptible changes to an input that force the system into expensive execution pathways, inflating latency, energy use, and FLOPs while leaving the output correct. The authors formalize this as a constrained optimization problem, categorize four dynamic behaviors (per-iteration computation, inference iterations, output count, and gating), and survey existing attacks to show that coverage is fragmented and defenses are limited. In preliminary experiments on LLaMA 3B, word-level black-box perturbations increased GPU latency by 154.71% and FLOPs by up to 46.8% with no significant BLEU drop. A sympathetic reader would care because these efficiency attacks bypass traditional robustness checks focused on accuracy and could enable denial-of-service in time-sensitive deployments.","feed_headline":"Tiny text tweaks can inflate AI latency 154%","feed_subtitle":"Input-adaptive models that save compute become attack surfaces; adversarial sentences keep answers correct but drain resources.","key_machinery":"The central object is the efficiency attack formulation in Eq. (1): maximize $C(N,H,x+\\delta)$ subject to $\\|\\delta\\|\\le\\epsilon$ and $x+\\delta\\in X$, which treats computational cost as an optimizable objective over input perturbations. The four dynamic behaviors D1–D4 are the mechanisms that make cost input-dependent, and D4 is newly proposed as gating modules that route inputs to expensive downstream components. The argument works by observing that these behaviors are externally observable and input-controllable, so an adversary can steer the model into worst-case computation.","core_discovery":"Input-dependent execution pathways in dynamic deep learning systems create a new attack surface: an adversary can maximize computational cost $C(N,H,x+\\delta)$ under a small perturbation bound $\\|\\delta\\|\\le\\epsilon$, converting efficiency mechanisms into a liability. The paper introduces D4, dynamic gating, as a fourth behavior alongside per-iteration computation (D1), inference iterations (D2), and output production (D3). Preliminary evidence from LLaMA 3B machine translation shows up to 154.71% latency inflation and 46.8% FLOPs inflation from word-level black-box perturbations with no significant BLEU drop; white-box attacks produce comparable inflation, and character-level attacks are weaker. The authors also report that input-validation defenses detect such attacks with up to 87% accuracy, while input transformations that work on images severely degrade text output quality.","pith_inferences":["The reported 154.71% latency increase likely derives mostly from longer autoregressive generation (D2), so the paper's framing that discrete routing decisions are steerable may overstate the generality; a controlled token-budget experiment would separate D2 effects from D1 and D4 effects.","If gating (D4) is genuinely steerable by small perturbations, it could be a more dangerous attack surface than generation-length inflation because it would force expensive downstream modules to run on cheap inputs, potentially causing pipeline-level denial-of-service.","The 87% detection accuracy of input validation provides a concrete baseline for future defenses; new methods should be compared on the same LLaMA task and should report false-positive rates on benign inputs.","Efficiency attacks could combine with timing side-channel analysis, turning the induced latency into a covert channel that leaks information about model internals or private inputs."],"forward_implications":["Robustness evaluation for dynamic models must measure latency, energy, and FLOPs, not just accuracy, because efficiency attacks can degrade service without corrupting outputs.","Black-box word-level attacks can be as potent as white-box attacks on large autoregressive models, lowering the barrier for real-world adversaries who only observe timing or energy side channels.","Input-validation defenses are promising but incomplete, achieving up to 87% detection on tested settings, while input-transformation defenses that work on images severely harm text quality, so new defense families are needed.","Modern architectures such as Mixture-of-Experts, gated transformers, and hierarchical pipelines remain unexplored under this threat model and may expose new, more powerful efficiency attack surfaces.","The proposed research agenda, if carried out, would produce a unified taxonomy of efficiency attacks and targeted defenses for each dynamic behavior D1–D4."],"supporting_citations":[{"why":"Defines dynamic neural networks and input-adaptive computation, establishing the DDLS concept that the paper targets.","marker":"[1]"},{"why":"Serves as the representative static model baseline that DDLSs are contrasted against.","marker":"[2]"},{"why":"Provides the prior systematization of D1–D3 behaviors and the defense evaluations that this paper extends.","marker":"[3]"},{"why":"Supplies DeepSloth, a slowdown attack on multi-exit networks, as a concrete example of a D1 efficiency attack.","marker":"[4]"},{"why":"Supplies NICGSlowdown, an efficiency attack on image caption generation, as an example of D2/D3 dynamic behavior exploitation.","marker":"[5]"},{"why":"Provides LLMEffiChecker, the method used to generate perturbations in the preliminary LLaMA 3B experiments in Table 1.","marker":"[6]"}],"fun_headline_variants":["Adversarial text can inflate AI latency up to 154%","Efficiency attacks on dynamic AI drain compute and latency","Input-adaptive AI exposes new attack surface for resource drain","Tiny input tweaks can cause AI to use 46% more FLOPs","Dynamic deep learning systems vulnerable to efficiency attacks"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"The load-bearing premise is that small bounded perturbations can steer discrete dynamic decisions—early-exit triggers, gating routes, token pruning—even though the paper's only experiment inflates generation length and its newly proposed gating attack surface is not tested.","fun_headline_variants_meta":{"raw":{"variants":["Adversarial text can inflate AI latency up to 154%","Efficiency attacks on dynamic AI drain compute and latency","Input-adaptive AI exposes new attack surface for resource drain","Tiny input tweaks can cause AI to use 46% more FLOPs","Dynamic deep learning systems vulnerable to efficiency attacks"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.000619,"raw_usage":{"total_tokens":2836,"prompt_tokens":872,"completion_tokens":1964,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":488,"completion_tokens_details":{"reasoning_tokens":1878}},"tokens_in":488,"tokens_out":1964,"duration_ms":16746,"temperature":1.0,"reasoning_tokens":1878,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-06T23:30:30.926841+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Fix the maximum output length of LLaMA 3B so the number of generated tokens cannot grow, then apply the same LLMEffiChecker word-level perturbations; if the 154.71% latency increase largely disappears, the attack works through output-length inflation rather than through input-adaptive routing, undercutting the claim that dynamic behaviors are the exploitable surface.","supporting_citations":[{"cited_title":null,"cited_arxiv_id":null,"evidence_quote":"Defines dynamic neural networks and input-adaptive computation, establishing the DDLS concept that the paper targets."},{"cited_title":null,"cited_arxiv_id":null,"evidence_quote":"Serves as the representative static model baseline that DDLSs are contrasted against."},{"cited_title":null,"cited_arxiv_id":null,"evidence_quote":"Provides the prior systematization of D1–D3 behaviors and the defense evaluations that this paper extends."},{"cited_title":"Efficiency Robustness of Dynamic Deep Learning Systems","cited_arxiv_id":"2506.10831","evidence_quote":"Supplies DeepSloth, a slowdown attack on multi-exit networks, as a concrete example of a D1 efficiency attack."},{"cited_title":null,"cited_arxiv_id":null,"evidence_quote":"Provides LLMEffiChecker, the method used to generate perturbations in the preliminary LLaMA 3B experiments in Table 1."}],"review_version":1}