Deep Learning Latency Attacks and Defenses: A Cross-Domain Survey of Availability Threats
cs.CR
Submitted: 2026-09-29
Updated: 2026-09-29
Code: https://github.com/guzonghua/awesome-latency-attacks
License: http://creativecommons.org/licenses/by/4.0/
The gist: Adversarial machine learning has focused mainly on integrity, but availability is an increasingly consequential complement.
Terminology
Abstract
Adversarial machine learning has focused mainly on integrity, but availability is an increasingly consequential complement. Latency attacks (also energy-latency attacks) increase inference-time work, energy, or response time, causing deadline misses, throughput collapse, or resource exhaustion in vehicle controllers, interactive services, or battery-powered sensors, sometimes while preserving the nominal prediction. This survey unifies a fragmented literature spanning perception pipelines (including physical attacks on autonomous-driving detection and tracking), input-adaptive neural inference (sponge examples, dynamic networks), and autoregressive and agentic systems (output-length, verbose-image, and reasoning denial-of-service attacks on LLMs, VLMs, mixture-of-experts models, and tool-using agents). We organize attacks by exploited computational bottleneck rather than formulation, separating what makes a computation expensive from how the attacker triggers it; the delivery channel (input, prompt or retrieved content, message, poisoning, or weight tampering) is an orthogonal attribute. Many attacks share one mechanism, intermediate-work amplification, motivating a work-budget defense abstraction; we distinguish caps on the work entering an expensive stage from caps on the results leaving it. We further analyze when a model-level cost increase becomes a system-level availability failure, which depends on critical-path share, slack, existing ceilings, accumulation, resource sharing, and fallback policy, not on the amplification factor alone. We also provide a threat-model taxonomy, consolidated quantitative comparisons, a defense review by control mechanism, and open challenges such as standardized evaluation, physical realizability, and whole-system availability. Companion website: https://github.com/guzonghua/awesome-latency-attacks.
Sources
- LLM Security: Vulnerabilities, Attacks, Defenses, and Countermeasures
- QuantAttack: Exploiting Dynamic Quantization to Attack Vision Transformers
- Steal Now and Attack Later: Evaluating Robustness of Object Detection against Black-box Adversarial Attacks
- Impact Analysis of Inference Time Attack of Perception Sensors on Autonomous Vehicles
- Token-Budget-Aware Pool Routing for Cost-Efficient LLM Inference
- Dynamic Transformers Provide a False Sense of Efficiency
- BERT Lost Patience Won't Be Robust to Adversarial Slowdown
- When Data Manipulation Meets Attack Goals: An In-depth Survey of Attacks for VLMs
- SoK: The Attack Surface of Agentic AI - Tools and Autonomy
- Time Traveling to Defend Against Adversarial Example Attacks in Image Classification
- Switch Transformers: Scaling to Trillion Parameter Models with Simple and Efficient Sparsity
- Misrouter: Exploiting Routing Mechanisms for Input-Only Attacks on Mixture-of-Experts LLMs
- LingoLoop Attack: Trapping MLLMs via Linguistic Context and State Entrapment into Endless Loops
- SQUAD: Scalable Quorum Adaptive Decisions via ensemble of early exit neural networks
- Inducing High Energy-Latency of Large Vision-Language Models with Verbose Images
- Denial-of-Service Poisoning Attacks against Large Language Models
- Breaking Down the Defenses: A Comparative Survey of Attacks on Large Language Models
- GateDrain: Availability Attacks and Admission-Side Defense for Confidence-Gated Edge-Cloud Inference
- TrackFlood: Relocating Latency Attacks from NMS-Free Detectors to Real-Time Trackers
- Token-Budget-Aware LLM Reasoning
Related papers
- SoK: AI-Augmented Binary Reversing
- Relaxed Sender Anonymity for CBDC Interbank Settlement: A Zero-Knowledge Approach on Permissioned EVM
- Calibration-Family Overfit: Why Trusted Sabotage Monitors Don't Transfer Across Lineages
- Efficient Fuzzy PSI under One-Sided Assumptions
- Sealing the Audit-Runtime Gap for LLM Skills
- Token Composition: A Graph Based on EVM Logs