The authors demonstrate a new adversarial attack on ML inference pipelines that route inputs through different models depending on upstream predictions (e.g., a classifier decides which specialist model to invoke next). Traditional adversarial examples target individual models, but AESOP exploits the pipeline structure itself: it crafts inputs that route through the most computationally expensive path, inflating compute costs by up to 2,407× compared to benign inputs. The attack works even when defenses like batching, buffering, and confidence thresholds are in place — forcing the system to choose between throughput collapse or massive data loss.
Main takeaways:
- Pipeline architectures create a new attack surface: adversarial examples can steer execution through expensive branches, not just fool individual models.
- AESOP achieves 2,407× FLOPs inflation and 419× latency inflation in white-box settings; 58×/17× in gray-box (partial knowledge) settings.
- Path-aware targeting is 20× more effective than strongest single-model baseline (2,407× vs. 117× FLOPs inflation).
- System-level defenses don't neutralize the attack — they shift the failure mode to either throughput collapse (0.578 → 0.006 input/s) or 96.7% data loss to maintain throughput.
- Highlights a fundamental efficiency-availability tradeoff in dynamic inference pipelines under adversarial conditions.