The paper investigates privacy risks in Vision Transformer (ViT) split‑inference systems that use token reduction and token shuffling to lower computation and communication costs. It shows that even after token shuffling, transmitted token embeddings still contain enough positional information for a new attack, the Spatially Aligned Reconstruction Attack (SARA), which predicts token positions, restores spatial layout, fills missing embeddings with a masked autoencoder, and reconstructs the input image. While token reduction offers stronger protection, significant leakage remains when retained tokens preserve semantic and positional cues, and the authors propose a lightweight edge‑side defense that removes positional embeddings and adapts transformer blocks via knowledge distillation to reduce SARA’s effectiveness without harming downstream accuracy.
Vision Transformers (ViTs) are increasingly used in split-inference systems, where edge devices transmit intermediate token representations to a remote cloud. In this setting, token reduction lowers c...
arXiv:2608. 04477v1 Announce Type: cross Abstract: Cloud-based language model services routinely process prompts containing sensitive information.
arXiv:2607. 02819v1 Announce Type: cross Abstract: Cloud-edge Large Vision-Language Model (LVLM) inference enables efficient deployment by splitting computation between edge devices and cloud servers.
arXiv:2609.39134v1 Announce Type: new Abstract: Visual-token compression improves the efficiency of large vision-language models, but can expose failures that full-token evaluation misses. We study a...
arXiv:2607. 00174v1 Announce Type: cross Abstract: We present a black-box model-stealing attack that recovers private vision-tokenizer configurations of deployed vision-language models (VLMs), including the visual patch size and input preprocessing pipeline.
FSPGD introduces a feature-space black-box attack for semantic segmentation that targets intermediate representations rather than just output logits. The method uses a dual loss: an external loss to disrupt cross-model feature alignment and an internal loss to reduce consistency among same-class instances. Experiments on Pascal VOC 2012 and Cityscapes show that FSPGD outperforms existing logit-level and segmentation-specific attacks across CNN and Transformer backbones, and its adversarial examples improve robustness when used for training.
arXiv:2409. 01062v4 Announce Type: replace Abstract: Model Inversion (MI) attacks pose a significant privacy threat by reconstructing private training data from machine learning models.
Vision Transformers (ViTs) increasingly rely on input-adaptive inference, such as token pruning and early halting, to meet energy and latency budgets. This survey examines a recent class of adversarial efficiency degradation attacks that target these mechanisms to increase computation without necessarily degrading accuracy.
arXiv:2608.23012v1 Announce Type: new Abstract: Image matching is a core component of applications such as Simultaneous Localization and Mapping (SLAM), Visual Localization, and Structure from Motion...
arXiv:2608.30105v1 Announce Type: cross Abstract: Deep learning-based side-channel analysis has historically focused on single-byte targets and manually cropped traces, which risks discarding exploit...
arXiv:2609.17856v1 Announce Type: new Abstract: Heterogeneous cooperative perception (CP) enables connected vehicles with diverse sensor setups to share spatial awareness via compact feature maps, wh...
The paper introduces a token‑oriented semantic communication framework that transmits only task‑relevant image latents instead of full token embeddings, reducing communication cost and improving interoperability. It leverages a spatial alignment between vision transformer patch tokens and learned image compression latents, enabling token‑level relevance estimation and selective transmission. Experiments on ImageNet demonstrate a superior rate–accuracy trade‑off compared to existing semantic communication methods and hand‑crafted codecs.