Confidence-based routing exposes cloud services to availability attacks
GateDrain: Availability Attacks and Admission-Side Defense for Confidence-Gated Edge-Cloud Inference
Cryptography and Security
Summary
Some computer systems split their work between a local device and the cloud based on how sure they are about the answer. The authors found that attackers can trick the system into sending too many tasks to the cloud by confusing its confidence measure, slowing down service for everyone. They call this the GateDrain attack, which worsens delays without increasing total requests. The authors also tested defenses that limit how many requests each user can send to the cloud, protecting important users but possibly rejecting some valid tasks.
What this means in practice
- •For cloud service operators: Protect cloud-hosted inference services from attacks that degrade latency by manipulating confidence-based request routing
- •For edge device developers: Implement admission controls that limit offloading to cloud to maintain predictable latency and service availability
Authors
Zonghua Gu, Julian Singh-Smith, Junlin Liao, Di Liu
Abstract
Confidence-gated edge--cloud inference accepts confident local predictions and offloads uncertain inputs to a stronger cloud model. We show that this routing decision creates an availability attack surface. We call this attack \emph{GateDrain}: bounded input perturbations lower calibrated confidence and redirect requests that would otherwise be answered locally into a shared cloud queue, without increasing the application request rate. Because escalated requests share a cloud service, an increase in per-request cloud demand can move a near-capacity deployment across a queueing knee, causing disproportionate tail-latency degradation for benign users. We evaluate white-box, transfer, decision-only, universal, and multi-gate attacks on the public EdgeBoost artifact. A fixed-application-volume comparison isolates the effect of confidence manipulation from added client traffic, while perturbation-budget and arrival-process sweeps show that the queueing transition persists across several workload models but its amplification depends on the operating point. Adaptive attacks also defeat the evaluated training-free preprocessing defenses. To contain the resulting cloud demand, we evaluate Bounded Escalation, which combines per-source admission budgets, protected capacity, and non-preemptive trusted-class priority; an optional global bucket adds an identity-independent bound on untrusted admissions. The evaluation makes the resulting policy trade-off explicit: authenticated clients receive latency isolation, whereas tighter aggregate containment can reject legitimate unauthenticated offloads and reduce overall expected accuracy through edge fallback.