AdVAR-DNN: Adversarial Misclassification Attack on Collaborative DNN Inference

2025-08-01

AI Summary

Collaborative DNN inference in IoT introduces novel privacy and security vulnerabilities under dynamic task allocation and cross-node communication. Method: This paper proposes a black-box misclassification attack based on an adversarial variational autoencoder (VAE), the first to leverage VAEs for generating highly stealthy, low-detectability adversarial examples—without requiring prior knowledge of the target model or gradient access, relying solely on classifier feedback to precisely compromise dynamically partitioned DNNs. Contribution/Results: By jointly modeling the VAE with a lightweight classifier, experiments on CIFAR-100 demonstrate significantly higher attack success rates than state-of-the-art black-box methods. The generated adversarial examples evade detection both perceptually and statistically. The work systematically exposes the intrinsic security risks of collaborative inference architectures in untrusted communication environments.

Technology Category

• Computer Vision: Adversarial Attacks & Robustness
• Machine Learning: Adversarial Learning & Robustness
• Multiagent Systems: Adversarial Agents

Application Category

• Security and Privacy: Large-scale security measurements
• User Modeling, Personalization and Recommendation: Attacks and countermeasures in recommendation systems
• Systems and Infrastructure for Web, Mobile and WoT: Applied ML and AI for Web-based mobile applications

Abstract

In recent years, Deep Neural Networks (DNNs) have become increasingly integral to IoT-based environments, enabling realtime visual computing. However, the limited computational capacity of these devices has motivated the adoption of collaborative DNN inference, where the IoT device offloads part of the inference-related computation to a remote server. Such offloading often requires dynamic DNN partitioning information to be exchanged among the participants over an unsecured network or via relays/hops, leading to novel privacy vulnerabilities. In this paper, we propose AdVAR-DNN, an adversarial variational autoencoder (VAE)-based misclassification attack, leveraging classifiers to detect model information and a VAE to generate untraceable manipulated samples, specifically designed to compromise the collaborative inference process. AdVAR-DNN attack uses the sensitive information exchange vulnerability of collaborative DNN inference and is black-box in nature in terms of having no prior knowledge about the DNN model and how it is partitioned. Our evaluation using the most popular object classification DNNs on the CIFAR-100 dataset demonstrates the effectiveness of AdVAR-DNN in terms of high attack success rate with little to no probability of detection.

Problem

• Adversarial attack on collaborative DNN inference security
• Exploiting vulnerabilities in dynamic DNN partitioning information exchange
• Generating untraceable samples to compromise inference process

Innovation

• Adversarial VAE-based misclassification attack
• Black-box attack on DNN partitioning
• Generates untraceable manipulated samples