The paper investigates privacy risks in Vision Transformer (ViT) split‑inference systems that use token reduction and token shuffling to lower computation and communication costs. It shows that even after token shuffling, transmitted token embeddings still contain enough positional information for a new attack, the Spatially Aligned Reconstruction Attack (SARA), which predicts token positions, restores spatial layout, fills missing embeddings with a masked autoencoder, and reconstructs the input image. While token reduction offers stronger protection, significant leakage remains when retained tokens preserve semantic and positional cues, and the authors propose a lightweight edge‑side defense that removes positional embeddings and adapts transformer blocks via knowledge distillation to reduce SARA’s effectiveness without harming downstream accuracy.
By Stefano Leggio, Giulio Rossolini, Alessandro Biondi
arXiv:2608. 04477v1 Announce Type: cross Abstract: Cloud-based language model services routinely process prompts containing sensitive information.
By Zhicong Huang, Cheng Hong, Tao Wei
arXiv:2607. 02819v1 Announce Type: cross Abstract: Cloud-edge Large Vision-Language Model (LVLM) inference enables efficient deployment by splitting computation between edge devices and cloud servers.
By Zikai Zhang, Rui Hu, Olivera Kotevska, Jiahao Xu
arXiv:2607. 00174v1 Announce Type: cross Abstract: We present a black-box model-stealing attack that recovers private vision-tokenizer configurations of deployed vision-language models (VLMs), including the visual patch size and input preprocessing pipeline.
By Kai Hu, Akash Bharadwaj, Weichen Yu, Matt Fredrikson
Image matching is a core component of applications such as Simultaneous Localization and Mapping (SLAM), Visual Localization, and Structure from Motion (SfM). However, the local image features central...
arXiv:2608.23012v1 Announce Type: new
Abstract: Image matching is a core component of applications such as Simultaneous Localization and Mapping (SLAM), Visual Localization, and Structure from Motion...
By Francesco Vultaggio, Predrag Djindjic, Markus Gerke, Sebastian Tschiatschek, Phillipp Fanta-Jende
arXiv:2409. 01062v4 Announce Type: replace Abstract: Model Inversion (MI) attacks pose a significant privacy threat by reconstructing private training data from machine learning models.
By Viet-Hung Tran, Ngoc-Bao Nguyen, Son T. Mai, Hans Vandierendonck, Ira Assent, Alex Kot, Ngai-Man Cheung
FSPGD introduces a feature-space black-box attack for semantic segmentation that targets intermediate representations rather than just output logits. The method uses a dual loss: an external loss to disrupt cross-model feature alignment and an internal loss to reduce consistency among same-class instances. Experiments on Pascal VOC 2012 and Cityscapes show that FSPGD outperforms existing logit-level and segmentation-specific attacks across CNN and Transformer backbones, and its adversarial examples improve robustness when used for training.
By Eun-Sol Park, MiSo Park, Yong-Goo Shin
arXiv:2608.20748v1 Announce Type: new
Abstract: The Visual Geometry Grounded Transformer (VGGT) enables unified feed-forward 3D reconstruction from multi-view images. However, deploying such a high-p...
By Qi Song, Ziyuan Luo, Haoliang Han, Renjie Wan
arXiv:2608.30105v1 Announce Type: cross
Abstract: Deep learning-based side-channel analysis has historically focused on single-byte targets and manually cropped traces, which risks discarding exploit...
By Jimmy Gammell, Kaushik Roy
Vision Transformers (ViTs) increasingly rely on input-adaptive inference, such as token pruning and early halting, to meet energy and latency budgets. This survey examines a recent class of adversarial efficiency degradation attacks that target these mechanisms to increase computation without necessarily degrading accuracy.
Deep learning-based side-channel analysis has historically focused on single-byte targets and manually cropped traces, which risks discarding exploitable leakage. While recent work has proposed specia...