Denial of Deadline: Network-Driven Accuracy Collapse in Distributed Inference Pipelines

Modern inference systems increasingly adopt a two-tier architecture: a fast path that returns predictions within an application's latency deadline, and a slow path that runs higher-compute methods on stronger, remote hardware. A coordination layer routes requests to the slow path and merges its returned predictions with the fast path outputs. This design is attractive because it promises the best of both worlds: timely responses and higher accuracy when the slow path can deliver on time.

The authors identify a previously unrecognized attack surface in this coordination layer. They introduce **shaped workload attacks**, in which an adversary manipulates the timing and shape of its own requests to create contention at shared resources along the slow path. The goal is not to steal data or corrupt models, but to push benign users' slow-path predictions past their latency deadlines. When that happens, the merger discards the late predictions, and the fast path continues to return timely but less accurate outputs. The resulting loss of slow-path accuracy benefits is termed **accuracy collapse**.

This digest follows the IMRAD structure to summarize the threat model, methodology, results

The experiments reveal a dramatic impact. In simulation, approximately **4,000 burst-shaped requests** increase benign p99 latency from **92 ms to 2 s**, nearly eliminating the benefit of the slow path's cloud inference. On average, object tracking quality drops by **7.0 HOTA points**.

The degradation varies significantly depending on the video intervals targeted by the attack, ranging from **2.0 to 18.7 HOTA points**. This indicates that adversaries can strategically choose when to attack to maximize damage. Furthermore, certain rare classes suffer disproportionately: for example, **stop signs lose nearly half of their pre-attack prediction accuracy**. This is particularly concerning for safety-critical applications like autonomous driving.

The attack is effective without any access to model weights or victim data, making it broadly applicable and difficult to detect. The fast path continues to return timely outputs, so the system appears to be functioning normally, while the slow path's accuracy benefits are silently lost.

Key quantitative findings:
- Benign p99 latency: 92 ms → 2 s (≈21.7× increase)
- Average HOTA drop: 7.0 points
- HOTA drop range: 2.0–18.7 points
- Stop sig