Pith. sign in

REVIEW 3 major objections 6 minor 51 references

Exploiting Edge Features for Transferable Adversarial Attacks in Distributed Machine Learning

T0 review · 3 major / 6 minor · reviewed 2026-08-06 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read The paper claims that in split neural networks, an adversary who intercepts only the intermediate feature tensor between edge and cloud can train a surrogate model whose adversarial examples transfer to the target at up to 96% success…

desk verdict Nice new attack channel with a clever shape-reconstruction trick, but the headline gains are confounded by the extra adaptation modules in the feature-distilled surrogate; it needs a matched control. read the letter →

arxiv 2507.07259 v1 pith:TJ5NTXLP submitted 2025-07-09 cs.LG cs.AI

Giulio Rossolini , Fabio Brau , Alessandro Biondi , Battista Biggio , Giorgio Buttazzo This is my paper
classification cs.LGcs.AI
keywords splitinferenceadversarialtransferabilityblack-boxattackfeaturedistillationsurrogatemodeledgeAIsecuritycovarianceanalysis
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

The paper claims that when a neural network is split between an edge device and a cloud server, an attacker who can see the raw feature tensor transmitted between the two halves can build a much better surrogate model than an attacker who sees only inputs and outputs. The attacker reconstructs the tensor shape from intercepted flattened vectors using covariance statistics, then trains the surrogate to match both intermediate features and final outputs. In experiments, this raises transfer success of a PGD-$\ell_\infty$ attack (budget $8/255$) from 61% to 96% on a ResNet56 target, and of query-based GFCS-$\ell_2$ attacks from 69% to 96%. If correct, intermediate feature leakage should be treated as an attack-enabling exposure, not just a privacy leak, in distributed inference systems.

What carries the argument

The load-bearing object is the sample covariance matrix $\Sigma$ of a batch of intercepted flattened feature vectors: because convolutional maps keep a square spatial grid, neighboring rows of the original feature map are correlated, producing periodic $W_{f_e}\times W_{f_e}$ block diagonals, and the autocorrelation of the row means peaks at the spatial width $W_{f_e}$. Once the shape is estimated (height recovered from the input aspect ratio when features are non-square), an adaptation encoder block (a $1\times1$ convolution plus up/down-scaling and interpolation) aligns the reference surrogate's intermediate tensor to the intercepted shape, an adaptation decoder reshapes it back for the surrogate cloud half, and training minimizes $\alpha\|\mathbf{f}_e(x)-\mathbf{g}_e(x)\|_2^2 + \beta L_{\mathrm{out}}(g,f,x)$, where the feature term is MSE and the output term is KL divergence or cross-entropy depending on what the attacker can observe.

What would settle it

Run the headline experiment (PGD-$\ell_\infty$ with $\epsilon=8/255$, VGG16 surrogate, ResNet56 target) with the edge-cloud link wrapped in standard authenticated encryption and no side channel available; if transfer success stays at the 61% no-feature baseline, the claimed attack benefit is contingent on a premise the paper does not demonstrate.

Watch

Extended reading notes

Core claim

The central discovery is that intermediate feature leakage breaks the usual black-box barrier in partitioned inference. Even with no access to either model half, the attacker who intercepts the serialized features can recover the spatial layout of the feature map by autocorrelation peak detection on the covariance matrix of an intercepted batch, and then distil a surrogate model whose edge half is forced to reproduce those features through an adaptation encoder/decoder while its cloud half is trained against whatever output signal is available. Training with the combined feature/outcome loss systematically raises surrogate fidelity and adversarial transferability across models (VGG16, ResNet56, MobileNetV2), attack families (PGD, GFCS, Simba-ODS, P-RGF, RGF-ODS), and output knowledge levels (scores, hard labels, no outputs), with gains up to +0.53 in success rate in the white-box transfer setting.

Load-bearing premise

The load-bearing premise is that the attacker can actually obtain the unencrypted intermediate feature values, asserted through two case studies but not demonstrated on a real system; if standard authenticated encryption protects the edge-cloud link, the attack scenario largely disappears.

Editorial extensions

If this is right

  • Split-inference systems should treat the edge-cloud feature channel as a security boundary close to white-box model access, because feature-aware surrogates outperform output-only surrogates by up to 35-53 percentage points in transfer success.
  • Even attackers with no access to target outputs can exceed the success of output-knowledge-only surrogates, with feature distillation alone raising success by roughly 20 percentage points at low query budgets.
  • The surrogate split point should be chosen to maximize clean accuracy, because the paper shows this proxy correlates with transferability and gives the attacker a query-free selection rule.
  • Defenses must break shape reconstruction or feature alignment, since covariance-based width recovery is the enabling step for the whole attack pipeline.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • An extension the paper leaves implicit is that the covariance reconstruction step should lose its clean signal for transformer or otherwise non-convolutional backbones, whose intermediate representations do not preserve a square spatial grid; all demonstrated cases are convolutional.
  • A testable defense direction suggested by the paper's own mechanism would be to add channel-wise noise or learned obfuscation that destroys the row-correlation periodicity in $\Sigma$ while preserving downstream accuracy, and then measure how quickly transfer gains decay.
  • The reliance on a VGG16 reference architecture and 5,000 labeled samples means the practical gain should shrink when the attacker's public architecture diverges from the target family; a natural experiment would measure transfer success with a small ResNet or MobileNet as the reference instead.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

3 major / 6 minor

Summary. The paper studies split (vertically partitioned) inference, where a DNN is divided between an edge device and a cloud server, and proposes a black-box threat model in which the attacker intercepts the intermediate features transmitted between the two nodes. The authors first show that the spatial shape of serialized feature tensors can be reconstructed from a batch of intercepted vectors using covariance and autocorrelation analysis. They then construct a partitioned surrogate model with an adaptation encoder/decoder module, train it with a combined output-distillation and feature-MSE loss, and evaluate transferable adversarial attacks against VGG16, ResNet56, and MobileNetV2 targets. Across query-based attacks (GFCS, Simba-ODS, P-RGF, RGF-ODS) and white-box surrogate attacks (PGD-l2 and PGD-linf), the feature-distilled surrogates consistently give large success-rate gains, e.g., GFCS-l2 on ResNet56 at eps=1.0 improves from about 67-69% to 95-96%. The paper also studies how the choice of split depths in the surrogate and target affects transferability and proposes a clean-accuracy heuristic for selecting the surrogate split point.

Significance. If the central claim is validated, the results are significant: they show that in split inference the communication channel carrying intermediate features is not merely a privacy concern but an attack-enabling surface, substantially increasing the transferability of evasion attacks even when the attacker has no access to model parameters. The experimental design has clear strengths: the surrogate training set and the attack evaluation set are disjoint halves of the CIFAR-10 test set, the comparison spans multiple attack methods, target architectures, and epsilon budgets, and the reported improvements are large and consistent. The paper also proposes a concrete, lightweight method for feature-shape reconstruction and gives an empirical, and potentially practical, guideline for choosing the surrogate split depth. However, the headline comparison is currently confounded by an architecture mismatch between the feature-distilled surrogate and its baseline, and the practical interception step is asserted rather than demonstrated. These points must be addressed before the main claim can be accepted with confidence.

major comments (3)
  1. [Section 4.2 and Eq. (5); Tables 1 and Figures 6-9] The feature-distilled surrogate is built by inserting the AE/AD adaptation blocks into the reference VGG16 and training it with the additional feature-MSE term, while the reported no-features baseline appears to be the plain reference VGG16 without AE/AD. The observed gains therefore confound the information content of the intercepted target features with two other factors: extra trainable capacity and an auxiliary feature-level supervisory signal. The core claim that intercepted edge features improve surrogate transferability is not established until an architecture-matched control is provided, i.e., the same AE/AD-equipped surrogate trained with the output loss only, and, ideally, a control where the feature-MSE term is matched against random or deliberately mismatched features. This is the load-bearing comparison for the paper's main contribution.
  2. [Section 3.3 and Section 6] The practical feasibility of intercepting the intermediate features is asserted rather than demonstrated. The two case studies describe plausible channels (a transient-execution side channel on a TEE, and a service user with legitimate access to intermediate features), but no end-to-end demonstration, bandwidth/data-rate analysis, or evidence about typical split-inference deployments is provided. Section 6 further states that 'encryption and network security mechanisms can be bypassed' without support. Since the paper repeatedly describes the threat model as mild and realistic, the authors should either supply concrete evidence for the interception step or explicitly restate the contribution as conditional on a yet-to-be-demonstrated channel.
  3. [Section 5.1 and all experimental tables/figures] The experimental evaluation appears to be single-run: no seeds, no repeated runs, no error bars, and no code release are reported. For a paper whose central claims are quantitative, this makes it difficult to assess seed sensitivity and reproducibility. Given the large and consistent effect sizes, the main trend is likely to survive, but the authors should report the number of runs, standard deviations, and ideally release the implementation so that the headline numbers can be independently verified.
minor comments (6)
  1. [Section 5.3] The text refers to 'Table 7a' when presenting the unbounded-setting results; the actual artifact is Table 1 (and Figure 7). Please fix the cross-reference.
  2. [Section 5.1 and Section 1] Section 5.1 says the main analysis is reported in 'Sections 5.3 and 5.3'; the second reference should presumably be Section 5.4. Also, Section 1 states that 'Section 2 formalizes the threat model', but the threat model is actually formalized in Section 3.3.
  3. [Figure 9 caption] The caption says both the top and bottom entries report 'PGD ℓ∞' attacks, with eps = 8/255 and eps = 1. Given the surrounding text and Figure 8, the bottom entry should be the ℓ₂ attack. Please correct the caption.
  4. [Throughout] There are several typos and unclear phrases: 'communicatons stacks' in Section 2, 'attack success eate' in Section 5.3, 'comprise the feasibility' should be 'compromise the feasibility', the author email 'alessandro.biodni@santannapisa.it' appears to misspell 'biondi', and 'queries specific in the experimental settings' should be 'specified in the experimental settings'.
  5. [Section 4.1] The shape-reconstruction method explicitly assumes square feature maps. The non-square discussion is useful, but it should be stated more precisely that the aspect-ratio argument assumes a fixed spatial scaling across all convolutional layers; this is not true in general for strided or pooling layers, so the stated rule of thumb should be flagged as an approximation rather than a guarantee.
  6. [Section 5.1] The training setup is under-specified: only the optimizer learning rate (0.05) and distillation weights (alpha=beta=0.5, later alpha=0.1) are reported. Please provide the number of training epochs, batch size, and the exact training protocol used for each surrogate configuration.

Circularity Check

0 steps flagged · score 2.0 of 10

No circular derivation: intercepted features are external ground truth, transferability is measured on held-out data, and the only self-citation is background; the low score reflects minor non-load-bearing self-citation, not circularity.

full rationale

The paper's central chain is not circular. The intercepted intermediate features fe(x) are external measurements taken from pretrained target models; the surrogate is trained on one half of the CIFAR-10 test set and attack success is measured on the other half (Section 5.1: "This separation ensures that the surrogate model is trained on data distinct from that used to train the target models, thereby preserving the integrity of testing time distillation"). The attack success rate is therefore not fed back into the surrogate training or into the shape-reconstruction procedure. The shape-estimation method of Section 4.1 is an estimation problem validated against the true feature widths of the pretrained models, not a quantity constructed from the attack outcome. The transferability gains reported in Tables 1 and Figures 6-9 are empirical outcomes of optimizing Eq. (5); nothing in the loss definition forces the observed 96%-versus-61% or 0.957-versus-0.674 success-rate gaps. The Section 5.5 clean-accuracy selection heuristic is a post-hoc correlation drawn from the same experiments and is not an independently validated prediction, but it is peripheral rather than load-bearing and does not make the main attack metric a fitted parameter. The only self-citation, [24], is used for background and benchmark selection and is not load-bearing. The main residual risks—possible architecture mismatch between the feature-distilled surrogate and the no-feature baseline (AE/AD blocks), and the lack of a live demonstration of the Section 3.3 interception case studies—are experimental-design and threat-model-assumption concerns, not circular reductions. Score 2 reflects the minor non-load-bearing self-citation and the in-sample heuristic, not any circular derivation.

Assumptions & free parameters 4 free parameters · 4 assumptions · 1 invented entities

The central empirical result rests on a small number of hand-chosen hyperparameters and three domain premises: the covariance grid pattern reveals feature width, features are square with preserved aspect ratio, and interception of the edge-cloud stream is practically feasible. The first two are stated and empirically demonstrated on the paper's architectures; the third, interception feasibility, is asserted through case studies rather than demonstrated, and it is the most fragile premise. No physical entities are introduced; the adaptation block is a trainable component whose behavior is directly measured in the experiments.

free parameters (4)
  • Distillation weights alpha and beta = alpha = 0.5 (Section 5.1) or 0.1 (Section 5.3); beta = 0.5
    Hand-chosen balance between feature MSE loss and output distillation loss (Equation 5); no sensitivity analysis is provided, and the two sections state different alpha values.
  • Surrogate training learning rate = 0.05 (Adam)
    Hand-chosen in Section 5.1; unusually high for Adam, and training duration details are missing.
  • Surrogate split depth = Block 2 in the main study; varied in Section 5.5
    Chosen by hand as a typical partitioning; Section 5.5 shows performance depends strongly on the alignment between surrogate and target split depths.
  • Adaptation module design
    The up/down-sampling cascade and interpolation layers in AE and AD (Section 4.2) are hand-designed to bridge dimensionality gaps; exact layer counts are not specified.
assumptions (4)
  • domain assumption The covariance matrix of intercepted flattened feature vectors exhibits a detectable block-diagonal structure that reveals the spatial width of the original feature map.
    Section 4.1 and Figure 2 rely on this empirical regularity; the paper provides no proof that it holds for arbitrary architectures, and Figure 5 shows it degrades with small batch sizes.
  • domain assumption Feature maps are square (Hfe = Wfe) and the input aspect ratio persists through convolutional layers.
    Section 4.1 uses these to convert an estimated width into a full (C, H, W) shape; the non-square case is discussed but not experimentally validated.
  • domain assumption The attacker can intercept the transmitted features, with encryption bypassed.
    Section 3.3 asserts this via two case studies (side channel, legitimate service user); no real-system demonstration is provided, making this the most fragile premise.
  • standard math Standard statistical estimators (sample covariance, autocorrelation) behave as expected for the batch sizes used.
    Equation (3) and the autocorrelation peak detection rely on conventional statistics whose small-batch behavior is shown to be unreliable in Figure 5.
invented entities (1)
  • Adaptation encoder/decoder block (AE, AD) independent evidence
    purpose: Matches the surrogate's intermediate features to the intercepted target feature shape so that feature-level distillation (MSE) can be applied in Equation 5.
    The block's behavior is directly validated in the experiments (surrogate accuracy and attack transferability in Section 5); it is a trainable architectural component rather than an unobserved postulate, so it carries low graviton risk.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Exploiting Edge Features for Transferable Adversarial Attacks in Distributed Machine Learning." pith.science (2026). https://pith.science/paper/TJ5NTXLP

@misc{pith2026250707259,
  author       = {Pith},
  title        = {Pith review of: Exploiting Edge Features for Transferable Adversarial Attacks in Distributed Machine Learning},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/TJ5NTXLP}},
  note         = {Machine review of arXiv:2507.07259}
}
read the original abstract

As machine learning models become increasingly deployed across the edge of internet of things environments, a partitioned deep learning paradigm in which models are split across multiple computational nodes introduces a new dimension of security risk. Unlike traditional inference setups, these distributed pipelines span the model computation across heterogeneous nodes and communication layers, thereby exposing a broader attack surface to potential adversaries. Building on these motivations, this work explores a previously overlooked vulnerability: even when both the edge and cloud components of the model are inaccessible (i.e., black-box), an adversary who intercepts the intermediate features transmitted between them can still pose a serious threat. We demonstrate that, under these mild and realistic assumptions, an attacker can craft highly transferable proxy models, making the entire deep learning system significantly more vulnerable to evasion attacks. In particular, the intercepted features can be effectively analyzed and leveraged to distill surrogate models capable of crafting highly transferable adversarial examples against the target model. To this end, we propose an exploitation strategy specifically designed for distributed settings, which involves reconstructing the original tensor shape from vectorized transmitted features using simple statistical analysis, and adapting surrogate architectures accordingly to enable effective feature distillation. A comprehensive and systematic experimental evaluation has been conducted to demonstrate that surrogate models trained with the proposed strategy, i.e., leveraging intermediate features, tremendously improve the transferability of adversarial attacks. These findings underscore the urgent need to account for intermediate feature leakage in the design of secure distributed deep learning systems.

Figures

Figures reproduced from arXiv: 2507.07259 by the authors.

Figure 1
Figure 1. Comparison of the classic black-box threat scenario with the proposed partitioned threat scenario. In our setting, an attacker can also exploit the transmitted intermediate features to build a highly transferable surrogate model. 96% success rate when transferred to the target model, whereas the success rate drops to only 61% when intermediate features are unknown. Supported by results presented in the following, th… view at source ↗
Figure 2
Figure 2. Illustration of the proposed shape reconstruction approach based on covariance matrix analysis of serialized feature vectors intercepted by the attacker: the attacker sniff and store a batch of flattened feature vectors and computes their covariance matrix as described in Equation (3). The resulting matrix reveals spatial patterns that, by construction, reflect the original feature map’s shape. In particular, the wi… view at source ↗
Figure 3
Figure 3. The design of the adaptation block is straightforward and addresses [PITH_FULL_IMAGE:figures/full_fig_p011_3.png] view at source ↗
Figures from the paper (7 more)
Figure 4
Figure 4. Figure 4: Analysis of the covariance matrix for multiple models and split layers using the CIFAR-10 test set (model and split layer indicated in the first line of each subfigure). For each case, both the ground-truth spatial width W and the estimated width W˜ are reported. The a…
Figure 5
Figure 5. Figure 5: Analysis of the peak patterns obtained from the autocorrelation curves (normalized in the plots for clearer visual comparison) for different models, with split points selected around the halfway depth of each architecture. In this analysis, we explore the impact of usi…
Figure 6
Figure 6. Figure 6: Attack success rates as a function of the number of queries for the GFCS attack (a) and Simba-ODS attack (b). For both attacks, we evaluated six different configurations of threat models to highlight the benefits of incorporating intermediate features in the training o…
Figure 7
Figure 7. Figure 7: (a) Results of different black-box attacks under unbounded constraints (ϵ = ∞) including Simba-ODS, GFCS, P-RGF, and RGF-ODS, using surrogate models trained under various threat scenarios, with and without feature distillation (FD). The reported metrics include the Suc…
Figure 8
Figure 8. Figure 8: Impact of White-Box Surrogate Attacks on Pretrained Target Networks Using a VGG-16 Model with Feature Matching at Block-2, Assuming an Edge at Block-1. The first row illustrates the outcomes of PGD ℓ∞ attacks, while the second row reports results for PGD ℓ2 norm attack…
Figure 9
Figure 9. Figure 9: Analysis of the Effectiveness of Feature Distillation Across Different Layers Using VGG-16 as the Surrogate Model. Values inside each box show the attack success rate (%) for two settings: PGD ℓ∞ with ϵ = 8 255 (top) and PGD ℓ∞ with ϵ = 1 (bottom). Both attacks use k =…
Figure 10
Figure 10. Figure 10: Study of the relationship between clean accuracy on the test set and the success rate transferability of the attacks from [PITH_FULL_IMAGE:figures/full_fig_p020_10.png]

Discussion (0). Sign in to comment.

Reference graph

Works this paper leans on

51 extracted references · 38 canonical work pages

  1. [1]

    A survey on distributed machine learning

    Joost Verbraeken, Matthijs Wolting, Jonathan Katzy, Jeroen Kloppenburg, Tim Verbelen, and Jan S Rellermeyer. A survey on distributed machine learning. Acm computing surveys (csur), 53(2):1–33, 2020

    work page 2020

  2. [2]

    Neurosurgeon: Collaborative intelligence between the cloud and mobile edge

    Yiping Kang, Johann Hauswald, Cao Gao, Austin Rovinski, Trevor Mudge, Jason Mars, and Lingjia Tang. Neurosurgeon: Collaborative intelligence between the cloud and mobile edge. SIGARCH Comput. Archit. News, 45(1):615–629, apr 2017

    work page 2017

  3. [3]

    Surat Teerapittayanon, Bradley McDanel, and H.T. Kung. Distributed deep neural networks over the cloud, the edge and end devices. In2017 IEEE 37th International Conference on Distributed Computing Systems (ICDCS), pages 328–339, 2017

    work page 2017

  4. [4]

    Edge-host partitioning of deep neural networks with feature space encoding for resource-constrained internet-of-things platforms

    Jong Hwan Ko, Taesik Na, Mohammad Faisal Amir, and Saibal Mukhopad- hyay. Edge-host partitioning of deep neural networks with feature space encoding for resource-constrained internet-of-things platforms. In 2018 15th IEEE International Conference on Advanced Video and Signal Based Surveillance (AVSS), pages 1–6, 2018

    work page 2018

  5. [5]

    Julio C. S. Dos Anjos, Kassiano J. Matteussi, Fernanda C. Orlandi, Jorge L. V. Barbosa, Jorge Sá Silva, Luiz F. Bittencourt, and Cláudio F. R. Geyer. A survey on collaborative learning for intelligent autonomous systems.ACM Comput. Surv., 56(4), nov 2023

    work page 2023

  6. [6]

    Evasion attacks against machine learning at test time

    Battista Biggio, Igino Corona, Davide Maiorca, Blaine Nelson, Nedim Šrndić, Pavel Laskov, Giorgio Giacinto, and Fabio Roli. Evasion attacks against machine learning at test time. InJoint European conference on machine learning and knowledge discovery in databases, pages 387–402. Springer, 2013

    work page 2013

  7. [7]

    Intriguing properties of neural networks

    Christian Szegedy, Wojciech Zaremba, Ilya Sutskever, Joan Bruna, Dumitru Erhan, Ian Goodfellow, and Rob Fergus. Intriguing properties of neural networks. arXiv preprint arXiv:1312.6199, 2013

    arXiv 2013

  8. [8]

    Practical black-box attacks against machine learning

    Nicolas Papernot, Patrick McDaniel, Ian Goodfellow, Somesh Jha, Z Berkay Celik, and Ananthram Swami. Practical black-box attacks against machine learning. In Proceedings of the 2017 ACM on Asia conference on computer and communications security, pages 506–519, 2017

    work page 2017

Show all 51 references
  1. [9]

    Lord, Romain Mueller, and Luca Bertinetto

    Nicholas A. Lord, Romain Mueller, and Luca Bertinetto. Attacking deep networks with surrogate-based adversarial black-box methods is easy. 2022

    2022

  2. [10]

    Diversitycanbetransferred: Output diversification for white-and black-box attacks.Advances in neural information processing systems, 33:4536–4548, 2020

    YusukeTashiro, YangSong, andStefanoErmon. Diversitycanbetransferred: Output diversification for white-and black-box attacks.Advances in neural information processing systems, 33:4536–4548, 2020. 22

    2020

  3. [11]

    Robust and privacy-preserving collaborative learning: A comprehensive survey.arXiv preprint arXiv:2112.10183, 2021

    Shangwei Guo, Xu Zhang, Fei Yang, Tianwei Zhang, Yan Gan, Tao Xiang, and Yang Liu. Robust and privacy-preserving collaborative learning: A comprehensive survey.arXiv preprint arXiv:2112.10183, 2021

    2021 arXiv

  4. [12]

    Security Implications of Edge Computing in Cloud Networks

    Sina Ahmadi. Security Implications of Edge Computing in Cloud Networks. Journal of Computer and Communications, 12(02):26–46, 2024

    2024

  5. [13]

    Towards deep learning models resistant to adversarial attacks

    Aleksander Madry, Aleksandar Makelov, Ludwig Schmidt, Dimitris Tsipras, and Adrian Vladu. Towards deep learning models resistant to adversarial attacks. In6th International Conference on Learning Representations, ICLR 2018, Vancouver, BC, Canada, April 30 - May 3, 2018, Confer...

    2018

  6. [14]

    Jordan, and Ion Stoica

    Philipp Moritz, Robert Nishihara, Stephanie Wang, Alexey Tumanov, Richard Liaw, Eric Liang, Melih Elibol, Zongheng Yang, William Paul, Michael I. Jordan, and Ion Stoica. Ray: a distributed framework for emerg- ing ai applications. In Proceedings of the 13th USENIX Conference o...

    2018

  7. [15]

    Deepspeed: System optimizations enable training deep learning models with over 100 billion parameters

    Jeff Rasley, Samyam Rajbhandari, Olatunji Ruwase, and Yuxiong He. Deepspeed: System optimizations enable training deep learning models with over 100 billion parameters. InProceedings of the 26th ACM SIGKDD International Conference on Knowledge Discovery & Data Mining, KDD ’20,...

    2020

  8. [16]

    A comprehensive survey on iot attacks: Taxonomy, detection mecha- nisms and challenges.Journal of Information and Intelligence, 2(6):455–513, 2024

    TinshuSasi, ArashHabibiLashkari, RongxingLu, PuleiXiong, andShahrear Iqbal. A comprehensive survey on iot attacks: Taxonomy, detection mecha- nisms and challenges.Journal of Information and Intelligence, 2(6):455–513, 2024

    2024

  9. [17]

    A survey on iot security: Vulnerability detection and protection

    Zihan Wei, Qiang Wei, Yangyang Geng, and Yahui Yang. A survey on iot security: Vulnerability detection and protection. InProceedings of the 2024 International Conference on Artificial Intelligence of Things and Computing, AITC ’24, page 1–8, New York, NY, USA, 2025. Associatio...

    2024

  10. [18]

    Zecheng He, Tianwei Zhang, and Ruby B. Lee. Attacking and protecting data privacy in edge–cloud collaborative inference systems.IEEE Internet of Things Journal, 8(12):9706–9716, 2021

    2021

  11. [19]

    Iot botnet forensics: A comprehensive digital forensic case study on mirai botnet servers.Forensic Science International: Digital Investigation, 32:300926, 2020

    Xiaolu Zhang, Oren Upton, Nicole Lang Beebe, and Kim-Kwang Raymond Choo. Iot botnet forensics: A comprehensive digital forensic case study on mirai botnet servers.Forensic Science International: Digital Investigation, 32:300926, 2020

    2020

  12. [20]

    A survey of electromagnetic side-channel attacks and discussion on their case-progressing potential for digital forensics.Digital Investigation, 29:43–54, 2019

    Asanka Sayakkara, Nhien-An Le-Khac, and Mark Scanlon. A survey of electromagnetic side-channel attacks and discussion on their case-progressing potential for digital forensics.Digital Investigation, 29:43–54, 2019

    2019

  13. [21]

    Privacy and robustness in federated learning: 23 Attacks and defenses.IEEE transactions on neural networks and learning systems, 2022

    Lingjuan Lyu, Han Yu, Xingjun Ma, Chen Chen, Lichao Sun, Jun Zhao, Qiang Yang, and S Yu Philip. Privacy and robustness in federated learning: 23 Attacks and defenses.IEEE transactions on neural networks and learning systems, 2022

    2022

  14. [22]

    Backdoor attacks and defenses in feature-partitioned collaborative learning.arXiv preprint arXiv:2007.03608, 2020

    Yang Liu, Zhihao Yi, and Tianjian Chen. Backdoor attacks and defenses in feature-partitioned collaborative learning.arXiv preprint arXiv:2007.03608, 2020

    2007 arXiv

  15. [23]

    Dba: Distributed backdoor attacks against federated learning

    Chulin Xie, Keli Huang, Pin-Yu Chen, and Bo Li. Dba: Distributed backdoor attacks against federated learning. InInternational Conference on Learning Representations, 2020

    2020

  16. [24]

    Edge-only universal adversarial attacks in distributed learning

    Giulio Rossolini, Tommaso Baldi, Alessandro Biondi, and Giorgio Buttazzo. Edge-only universal adversarial attacks in distributed learning. arXiv preprint arXiv:2411.10500, 2024

    2024

  17. [25]

    Nicholas Carlini and David A. Wagner. Towards evaluating the robustness of neural networks. In2017 IEEE Symposium on Security and Privacy, SP 2017, San Jose, CA, USA, May 22-26, 2017, pages 39–57. IEEE Computer Society, 2017

    2017

  18. [26]

    Goodfellow, Jonathon Shlens, and Christian Szegedy

    Ian J. Goodfellow, Jonathon Shlens, and Christian Szegedy. Explaining and harnessing adversarial examples. In3rd International Conference on Learning Representations, ICLR 2015, San Diego, CA, USA, May 7-9, 2015, Conference Track Proceedings, 2015

    2015

  19. [27]

    On the minimal adversarial perturbation for deep neural networks with provable estimation error

    Fabio Brau, Giulio Rossolini, Alessandro Biondi, and Giorgio Buttazzo. On the minimal adversarial perturbation for deep neural networks with provable estimation error. IEEE Transactions on Pattern Analysis and Machine Intelligence, pages 1–15, 2022

    2022

  20. [28]

    Black-box adversarial attacks with limited queries and information

    Andrew Ilyas, Logan Engstrom, Anish Athalye, and Jessy Lin. Black-box adversarial attacks with limited queries and information. InInternational conference on machine learning, pages 2137–2146. PMLR, 2018

    2018

  21. [29]

    Prior convictions: Black-box adversarial attacks with bandits and priors

    Andrew Ilyas, Logan Engstrom, and Aleksander Madry. Prior convictions: Black-box adversarial attacks with bandits and priors. arXiv preprint arXiv:1807.07978, 2018

    2018 arXiv

  22. [30]

    Zoo: Zeroth order optimization based black-box attacks to deep neural networks without training substitute models

    Pin-Yu Chen, Huan Zhang, Yash Sharma, Jinfeng Yi, and Cho-Jui Hsieh. Zoo: Zeroth order optimization based black-box attacks to deep neural networks without training substitute models. InProceedings of the 10th ACM workshop on artificial intelligence and security, pages 15–26, 2017

    2017

  23. [31]

    Simple black-box adversarial attacks

    Chuan Guo, Jacob Gardner, Yurong You, Andrew Gordon Wilson, and Kilian Weinberger. Simple black-box adversarial attacks. InInternational Conference on Machine Learning, pages 2484–2493. PMLR, 2019

    2019

  24. [32]

    Im- proving black-box adversarial attacks with a transfer-based prior.Advances in neural information processing systems, 32, 2019

    Shuyu Cheng, Yinpeng Dong, Tianyu Pang, Hang Su, and Jun Zhu. Im- proving black-box adversarial attacks with a transfer-based prior.Advances in neural information processing systems, 32, 2019

    2019

  25. [33]

    Why do adver- sarial attacks transfer? explaining transferability of evasion and poisoning 24 attacks

    Ambra Demontis, Marco Melis, Maura Pintor, Matthew Jagielski, Battista Biggio, Alina Oprea, Cristina Nita-Rotaru, and Fabio Roli. Why do adver- sarial attacks transfer? explaining transferability of evasion and poisoning 24 attacks. In28th USENIX security symposium (USENIX sec...

    2019

  26. [34]

    A survey on transferability of adversarial examples across deep neural networks.arXiv preprint arXiv:2310.17626, 2023

    Jindong Gu, Jia Xiaojun, Pau de Jorge, Yu Wenqain, Liu Xinwei, Avery Ma, Xun Yuan, Hu Anjun, Ashkan Khakzar, Li Zhijiang, Cao Xiaochun, and Torr Philip. A survey on transferability of adversarial examples across deep neural networks.arXiv preprint arXiv:2310.17626, 2023

    arXiv

  27. [35]

    A review of black-box adversarial attacks on image classification.Neurocomputing, 610:128512, 2024

    Yanfei Zhu, Yaochi Zhao, Zhuhua Hu, Tan Luo, and Like He. A review of black-box adversarial attacks on image classification.Neurocomputing, 610:128512, 2024

    2024

  28. [36]

    Blackbox attacks via surrogate ensemble search

    Zikui Cai, Chengyu Song, Srikanth Krishnamurthy, Amit Roy-Chowdhury, and Salman Asif. Blackbox attacks via surrogate ensemble search. In S. Koyejo, S. Mohamed, A. Agarwal, D. Belgrave, K. Cho, and A. Oh, editors, Advances in Neural Information Processing Systems, volume 35, pa...

    2022

  29. [37]

    Training meta-surrogate model for transferable adversarial attack.Proceedings of the AAAI Conference on Artificial Intelligence, 37(8):9516–9524, Jun

    Yunxiao Qin, Yuanhao Xiong, Jinfeng Yi, and Cho-Jui Hsieh. Training meta-surrogate model for transferable adversarial attack.Proceedings of the AAAI Conference on Artificial Intelligence, 37(8):9516–9524, Jun. 2023

    2023

  30. [38]

    Stealing machine learning models via prediction{APIs}

    Florian Tramèr, Fan Zhang, Ari Juels, Michael K Reiter, and Thomas Ristenpart. Stealing machine learning models via prediction{APIs}. In 25th USENIX security symposium (USENIX Security 16), pages 601–618, 2016

    2016

  31. [39]

    I know what you trained last summer: A survey on stealing machine learning models and defences

    Daryna Oliynyk, Rudolf Mayer, and Andreas Rauber. I know what you trained last summer: A survey on stealing machine learning models and defences. ACM Computing Surveys, 55(14s):1–41, 2023

    2023

  32. [40]

    Distilling the knowledge in a neural network.arXiv preprint arXiv:1503.02531, 2015

    Geoffrey Hinton, Oriol Vinyals, and Jeff Dean. Distilling the knowledge in a neural network.arXiv preprint arXiv:1503.02531, 2015

    2015 arXiv

  33. [41]

    A survey on knowledge distillation of large language models

    Xiaohan Xu, Ming Li, Chongyang Tao, Tao Shen, Reynold Cheng, Jinyang Li, Can Xu, Dacheng Tao, and Tianyi Zhou. A survey on knowledge distillation of large language models. arXiv preprint arXiv:2402.13116, 2024

    2024 arXiv

  34. [42]

    A systematic evaluation of transient execution attacks and defenses

    Claudio Canella, Michael Schwarz, Lukas Giner, Daniel Lee, and Daniel Gruss. A systematic evaluation of transient execution attacks and defenses. In Proceedings of the 28th USENIX Security Symposium (USENIX Security ’19), 2019

    2019

  35. [43]

    Chang, Ching-Hsien Hsu, and Shangguang Wang

    Chuntao Ding, Ao Zhou, Yunxin Liu, Rong N. Chang, Ching-Hsien Hsu, and Shangguang Wang. A cloud-edge collaboration framework for cognitive service. IEEE Transactions on Cloud Computing, 10(3):1489–1499, 2022

    2022

  36. [44]

    The cityscapes dataset for semantic urban scene understanding

    Marius Cordts, Mohamed Omran, Sebastian Ramos, Timo Rehfeld, Markus Enzweiler, Rodrigo Benenson, Uwe Franke, Stefan Roth, and Bernt Schiele. The cityscapes dataset for semantic urban scene understanding. InPro- ceedings of the IEEE conference on computer vision and pattern rec...

    2016

  37. [45]

    A comprehensive overhaul of feature distillation

    Byeongho Heo, Jeesoo Kim, Sangdoo Yun, Hyojin Park, Nojun Kwak, and Jin Young Choi. A comprehensive overhaul of feature distillation. In Proceedings of the IEEE/CVF international conference on computer vision, pages 1921–1930, 2019

    1921

  38. [46]

    Cifar-10 (canadian institute for advanced research)

    Alex Krizhevsky, Vinod Nair, and Geoffrey Hinton. Cifar-10 (canadian institute for advanced research)

  39. [47]

    Split computing and early exiting for deep learning applications: Survey and research challenges.ACM Computing Surveys, 55(5):1–30, 2022

    Yoshitomo Matsubara, Marco Levorato, and Francesco Restuccia. Split computing and early exiting for deep learning applications: Survey and research challenges.ACM Computing Surveys, 55(5):1–30, 2022

    2022

  40. [48]

    Very deep convolutional networks for large-scale image recognition.arXiv preprint arXiv:1409.1556, 2014

    Karen Simonyan and Andrew Zisserman. Very deep convolutional networks for large-scale image recognition.arXiv preprint arXiv:1409.1556, 2014

    2014 arXiv

  41. [49]

    Deep residual learning for image recognition

    Kaiming He, Xiangyu Zhang, Shaoqing Ren, and Jian Sun. Deep residual learning for image recognition. InProceedings of the IEEE conference on computer vision and pattern recognition, pages 770–778, 2016

    2016

  42. [50]

    Mobilenets: Efficient convolutional neural networks for mobile vision applications.arXiv preprint arXiv:1704.04861, 2017

    Andrew G Howard, Menglong Zhu, Bo Chen, Dmitry Kalenichenko, Weijun Wang, Tobias Weyand, Marco Andreetto, and Hartwig Adam. Mobilenets: Efficient convolutional neural networks for mobile vision applications.arXiv preprint arXiv:1704.04861, 2017

    2017 arXiv

  43. [51]

    Subspace attack: Exploiting promising subspaces for query-efficient black-box attacks

    Yiwen Guo, Ziang Yan, and Changshui Zhang. Subspace attack: Exploiting promising subspaces for query-efficient black-box attacks. Advances in Neural Information Processing Systems, 32, 2019. 26

    2019

Pith tools

Reviewed August 6, 2026 · model on record in the stance chip above.