Denial of Deadline: Network-Driven Accuracy Collapse in Distributed Inference Pipelines Jhonatan Tavori∗ , Gur-Eyal Sela† , Ion Stoica† , Gil Zussman∗ ∗ Columbia University
arXiv:2607.24692v1 [cs.NI] 27 Jul 2026
ABSTRACT Inference systems increasingly combine a fast path that returns predictions within the application’s latency deadline together with a higher-accuracy slow path that runs highercompute methods on stronger, remote hardware, so its results can be returned on time and combined with the fast path predictions. Across several application domains, we abstract this inference architecture as a fast path, a slow path, and a coordination layer with two functions: a router that invokes the slow path and a merger that decides whether to incorporate its returned predictions. In this work, we show that this new coordination layer exposes a new attack surface: shaped workload attacks, e.g., Yo-Yo bursts, can exploit contention at shared resources along the slow path, including cloud autoscaling bottlenecks, to push benign users’ slowpath predictions past their latency deadlines. The merger then discards those predictions, while the fast path continues to return timely outputs. We refer to the resulting loss of slow-path accuracy benefits as accuracy collapse. We demonstrate accuracy collapse in a two-tier edge– cloud multi-object tracking pipeline in autonomous driving. In simulation, approximately 4,000 burst-shaped requests increase benign slow-path p99 latency from 92 ms to 2 s. These delays nearly eliminate the benefit of the slow path’s cloud inference, reducing object tracking quality by 7.0 HOTA points on average. We further find that accuracy degradation can significantly vary (2.0 - 18.7 HOTA points), depending on the video intervals that are targeted in the attack, and that certain rare classes (e.g., stop signs) in the dataset lose nearly half of their pre-attack prediction accuracy. These results show that workload attacks on shared inference infrastructure can degrade prediction quality without needing either access to model weights or victim data, and motivate research on attacks and defenses for routing, merging, admission control, scheduling, and resource isolation in these emerging inference pipeline architectures.
1
INTRODUCTION
An increasing number of latency-sensitive inference services combine models or execution paths with different latency, cost, and capability profiles. More capable endpoint hardware and compact models allow cameras, mobile devices, and robots to perform useful inference locally. At the same
† UC Berkeley
time, remote higher-capacity resources can provide higherquality predictions or more expensive computation than can be supported locally. Systems therefore combine a lowercost, low-latency fast path that runs inference locally with a slower, higher accuracy slow path that is invoked selectively to run on stronger, remote hardware. This architecture appears in edge–cloud video analytics [10, 13, 24, 29], routed and cascaded models [9, 12, 33, 43], split and early-exit DNNs [22, 25, 28, 41], and autonomous systems with remote assistance [4, 6, 7, 44]. Across these domains, the fast path operates independently, with optional slow-path refinement. The coordination layer in these systems can be represented as two logical functions: an inference router decides when to invoke the slow path, while a merger decides whether and how to use its results. These functions may be explicit or embedded in a cascade or application policy, and they control when and how models across this distributed inference system are invoked. The incremental benefit of the slow path varies across inputs and often decays with delay. Thus, even a semantically correct result may provide little or no benefit if it arrives after the merger’s deadline. Because these pipelines share resources along the slow assistance path, they expose a new attack opportunity. We study how the trend toward burst-shaped workload attacks [1, 5, 18, 19, 40] extends to distributed inference. Contention at shared resources, from edge links and gateways to cloud queues and delayed scale-out, can push slow-path results beyond their useful window. The merger then discards otherwise correct assistance, reducing the accuracy realized by the application. We call this failure accuracy collapse. We consider an adversary that submits valid requests and controls only their content and timing. The attacker may choose inputs that are more likely to invoke slow-path processing (e.g., scenes with many or rare objects) and concentrate them into short bursts, inducing contention on shared slow-path resources. Consequently, benign slow-path results miss the merger’s deadline and are discarded, leaving the fast-path prediction as the application output. The attack requires neither model weights nor privileged infrastructure access, yet still induces accuracy collapse for benign users. This form of accuracy degradation is not captured by endpoint availability alone. Because the fast path continues to return results, the service appears operational even as the
Jhonatan Tavori, Gur-Eyal Sela, Ion Stoica, Gil Zussman
benefit of slow-path assistance disappears. Directly quantifying this loss requires labels or application-specific quality proxies, which may be unavailable during online operation. As we show, aggregate metrics can obscure the effect further: attacks that appear moderate over a complete stream may become catastrophic when they coincide with hard, rare, or safety-critical inputs that depend most on the slow path. We evaluate this mechanism by simulating the edge-cloud video analytics pipeline deployed on the NSF COSMOS testbed [35], with a replay of slow-path completion times on an Argoverse-HD multi-object-tracking pipeline, a latency sensitive perception pipeline used in safety-critical autonomous driving settings. In our simulation, burst-shaped attacker traffic raises benign slow-path p99 completion time from roughly 92 ms to over 2 s, far exceeding the configured 250 ms SLO. When these completion times are replayed against the tracking pipeline’s deadline, delayed cloud predictions remove most of the accuracy gain from slow-path assistance during attack-active intervals. The effects vary and include substantial losses for several low-frequency classes. This demonstrates potency: by using burst shaping rather than flat DDoS traffic, the attacker causes disproportionate accuracy harm with the same average attack request rate. This paper makes the following contributions:
• A cross-domain systems abstraction. In Section 2, we characterize distributed assisted inference as a fast path, a slow path, and a router–merger coordination layer that determines when remote assistance is invoked and whether its result contributes to the application output. • A coordination-layer attack and accuracy evaluation. Section 3 shows how bursts of otherwise valid requests can exploit contention at shared slow-path resources, including queueing, autoscaling lag, and merge deadlines, to delay benign assistance beyond its useful window. Section 4 evaluates this attack and demonstrates aggregate, temporal, and per-class accuracy degradation, which we term accuracy collapse. • Positioning and research agenda. Section 5 situates the attack within the broader evolution of burstshaped workload attacks. Section 6 outlines open research directions for resilient distributed inference.
2
TWO-SYSTEM INFERENCE PIPELINES
This section surveys two-system inference pipelines, a distributed architecture that combines a fast local path with a slower remote one. We show how this architecture introduces a coordination layer that exposes a new attack surface.
Figure 1: A two-system inference pipeline. A router decides whether to serve each request on the edge model, the cloud model, or both; the edge and cloud predictions return asynchronously across the network; and a merger aggregates them into the final response. The router and merger form the coordination layer.
2.1
Why combine fast and slow inference?
Latency-sensitive edge applications, including video analytics [23, 42], mobile and wearable systems [10, 30], and autonomous robots [21, 36], often choose between two execution paths that trade off prediction quality against latency and resource cost. In the first, fast path, a small, local model can reliably return predictions within the application’s response deadline. In the second, slow path, a larger model runs on remote, higher-capacity datacenter hardware and may achieve significantly higher accuracy, but its use incurs additional cost and adds variable network and queuing delay. For example, Schafhalter et al. report that a high-accuracy, large object detection model may have an inference latency of 859 ms on an NVIDIA Orin edge device, but 147 ms on an A100 datacenter accelerator, while the supporting 5G network exhibits a median RTT of 68 ms but a p99 of 3.0 s [36]. Since neither execution path alone provides the desired operating point, recent inference systems increasingly run both in parallel: In the fast path, a local model returns a prediction for every input, and simultaneously the slow path is selectively invoked to return higher accuracy predictions to improve the end-to-end accuracy of the system. The fast path provides a timely baseline prediction, and the system incorporates a slow-path prediction only if it returns before a certain freshness deadline when it can still be used by the system to boost accuracy through merging or input selection.
2.2
Architecture and execution semantics
The two-system inference pipeline contains two logical inference paths whose outputs may contribute to each application result (Figure 1). For an input 𝑥𝑡 , the fast path runs unconditionally and produces a complete, usable prediction 𝑓𝑡 within
Denial of Deadline: Network-Driven Accuracy Collapse in Distributed Inference Pipelines
Table 1: Representative two-system inference pipelines across domains. Use case
Fast path
Slow path
Router
Merger
Vehicle and robot perception [26, 36, 39, 46] Robot planning and control [21, 44, 45, 48] Mobile and edge video analytics [10, 23, 30, 42] Language-model routing (related variant) [2, 9, 12, 33]
A small, onboard or on-device model Onboard controller policy or autonomous driver Small/lightweight detection, tracking SLM, on-device model
Larger, higher-capacity models Remote VLA, semantic planner, or human guidance Larger detection tracking or prediction correction Frontier LLM model
Select services, frames, or frame regions to offload Periodic or uncertainty-triggered Select key frames, frame regions, or uncertain inputs Route by difficulty, quality, privacy, or cost
Slow path output if on time, otherwise fast path Fuse returned guidance/actions
the application’s end-to-end inference deadline. When invoked, the optional slow path produces a prediction 𝑠𝑡 using higher-capability remote resources. It often provides higher expected accuracy, but at greater resource cost and with more variable end-to-end latency. “Fast” and “slow” denote logical roles, not specific machines or model speeds. The router 1 decides whether and where to invoke the slow path in addition to the fast path. Its inputs may include 𝑥𝑡 , the fast-path prediction or confidence, estimated slow-path benefit, current load, and the remaining latency budget [12, 23, 30, 42]. Its output is a dispatch decision linking the slowpath request to the originating input. Examples include frame selection in edge-cloud video analytics [30, 42], a confidence threshold in a model cascade [9, 43], and an uncertainty trigger for remote robot assistance [44]. The merger determines which available predictions contribute to the application output. It receives 𝑓𝑡 and any returned slow-path output together with enough provenance and timing information to associate each result with its source input and assess its age [36]. Depending on the application, it may return fast-path predictions while incorporating delayed slow-path results into later outputs [10, 30], or wait until the deadline and select the best available result [36]. Other systems merge fast- and slow-path predictions, such as cached detections or delayed remote features [23, 42]. The merger therefore applies an application-specific freshness policy: stale results may remain useful after temporal propagation, but their accuracy benefit declines as the stream evolves [10, 23, 30]. If no admissible slow-path result is available by the deadline, the fast-path prediction remains the output [23, 36]. Current systems The same fast/slow structure recurs across domains that differ in modality, latency budget, and how the predictions are combined when returned from the slow path. Table 1 surveys representative pipelines: in each, the fast path supplies a prediction that makes the latency deadline, a 1“Router” refers to the pipeline’s inference-routing component that decides whether to invoke the slow path, not a network router.
Update the tracker or prediction cache Usually select or summarize to one answer
slow path supplies a higher accuracy prediction, and a router and merger coordinate when the slow path is invoked and how its returned output is handled.
2.3
The Attack Surface: Shared Resources
Normal operation. For every input, the fast path produces a usable prediction by the application’s end-to-end deadline. When invoked, the slow path is intended to arrive before the merger’s deadline and improve the prediction. The fast-path output serves as a fallback for the occasional case in which the slow-path result is unavailable or arrives too late. Shared slow-path resources. Unlike the typically local fast path, slow-path requests may traverse shared network infrastructure (e.g., network links) or consume shared compute resources (e.g., scaled cloud resources). Consequently, one client’s request can delay assistance for other clients sharing those resources. Attack opportunity. By design, the fast-path fallback preserves availability when slow-path assistance is unavailable. An adversary can exploit this by inducing contention that pushes benign assistance past its deadline. In the following, we define the threat model and present the attack mechanism that exploits this architectural property.
3
REQUEST-INDUCED ACCURACY LOSS
We consider a workload-shaping adversary that interacts only through the normal request interface. The adversary aims to collapse the realized value of assistance, rather than necessarily alter the correctness of any individual prediction.
3.1
Threat Model
The adversary submits valid inputs as an ordinary user and requires no privileged access. Its requests share network and compute resources with benign requests along the slow path, and it controls their content and timing. In particular, it may select inputs that are likely to trigger slow-path assistance, such as complex video scenes. As we show, its leverage is asymmetric: modest workloads trigger disproportionate delay and accuracy loss. This distinguishes our setting from
Jhonatan Tavori, Gur-Eyal Sela, Ion Stoica, Gil Zussman
volumetric DDoS and aligns it with burst-style attacks, such as Yo-Yo attacks [40], discussed in Section 5. The adversary may know the high-level architecture of the system but not its internal parameters such as model weights, exact routing thresholds, or merger rules. It may nevertheless infer routing behavior through probing and use observable signals, including response latency or a returned model identifier, to increase the attack’s potency. We intentionally assume a weak adversary with no infrastructure control. It cannot inspect or modify other users’ traffic or compromise any component of the inference pipeline. Thus, while we do not modify model weights or consider training-time attacks, we induce incorrect application outputs by exploiting contention at shared resources along the assistance path. This weak threat model highlights that accuracy collapse and more generally the effective performance of the AI pipeline, can result from networking effects even when the models themselves are not compromised.
3.2
Attack Mechanism
Under this threat model, Figure 2 shows how an attacker can translate valid network requests into application-level accuracy loss. The attacker submits requests likely to invoke slow-path assistance, for example, video inputs with rapid scene changes or many visible objects (1), which the router forwards to the shared slow path (2). The resulting burst creates contention along the slow path, which may arise from queueing at shared network links or cloud resources (3) (our evaluation focuses on cloud queueing during autoscaling). The merger then discards these predictions as stale, causing benign users to lose the expected accuracy gain from cloud assistance even though the fast path continues to return timely results (4). The system therefore incurs the cost of slow-path computation while realizing only fast-path quality. We use accuracy collapse to denote the loss of the twosystem inference pipeline’s accuracy gain, potentially reducing quality toward the fast-path baseline.
4
EVALUATIONS
We evaluate the attack using a two-system inference pipeline, focusing on whether the pipeline preserves the accuracy benefit expected from cloud assistance under attack. This depends directly on tail latency and the application’s freshness SLO, since an otherwise correct cloud prediction is useless if it arrives after its deadline. We divide the evaluation into two parts. Section 4.1 shows how bursts of slow-path demand exploit autoscaling lag to increase tail latency. Section 4.2 then measures how the resulting deadline violations remove cloud assistance and degrade tracking quality over complete videos, targeted intervals, and individual classes.
Figure 2: Coordination-layer attack on a slow/fast inference pipeline. (1) The attacker sends a bursty request load that triggers excessive slow-path assistance. (2) The router forwards them to the shared slow path. (3) Contention at shared resources (e.g., scaling and queueing delays) delays results beyond their freshness deadlines, so the merger discards them as stale. (4) Benign users lose the expected benefit of cloud assistance.
4.1
Slow-Path Latency Amplification
Setup. We simulate an urban video-analytics system based on the NSF PAWR COSMOS testbed [35] and its delay-sensitive street-camera analytics settings [16]. The simulator uses the assisted edge-cloud architecture from Section 2.2: an edge model provides the fast result, the inference router sends selected requests to a stronger shared cloud model, and a merger discards late cloud assistance. The fast path is a finite multi-server station. The slow path is a multi-server FCFS cloud service whose warm workers are controlled by an autoscaler. While attacker-generated load immediately adds to the benign workload, additional workers become available only after cold-start warmup, while idle workers remain provisioned until cooldown ends. Benign requests represent aggregate cloud invocations from multiple camera streams and arrive as a provisioned Poisson process, with rate 𝜆𝑏 = 𝑁 𝑓 𝑝 for 𝑁 streams at 𝑓 frames/s and cloud-routing probability 𝑝. The attacker adds valid requests that trigger more slow-path work and controls only their content and timing. The attack exploits the warmup lag: load rises immediately, but slow-path capacity does not. The attacker spaces bursts so scaled-out workers are reclaimed after cooldown, making each new burst encounter baseline capacity and another warmup delay. We compare the no-attack baseline against an attacker using short bursts. We also evaluate a flat high-volume DDoS baseline to separate the effect of bursts from sustained load. The ratio between the benign p99 latency, relative to a 250 ms SLO, and total attacker requests captures the attack potency. Results. Figure 3 shows the shaped attack’s effect on benign requests. Three short bursts raise total arrival rate (Figure 3a) and both fast- and slow-path workload (Figure 3b).
Denial of Deadline: Network-Driven Accuracy Collapse in Distributed Inference Pipelines Attacker Total (attack)
Fast/edge (no attack) Slow/cloud (no attack)
1500 1000 500 0
0
50
100
150
Time (s)
200
250
300
(a) Arrival traffic and attacker bursts.
Benign p99 (no attack) Benign mean (no attack)
Fast/edge (attack) Slow/cloud (attack)
1500
Benign p99 latency (ms, log)
2000
Traffic to tier (req/s)
Arrival rate (req/s)
Benign (no attack) Benign (attack)
1000 500 0
50
100
150
Time (s)
200
250
300
(b) Slow-path and fast-path workload.
Benign p99 (attack) Benign mean (attack)
103
102
0
50
100
150
Time (s)
200
250
300
(c) Latency of slow-path requests.
Figure 3: Coordination-layer shaped attack evaluation. Short attacker ’Yo-Yo’ style bursts increase the slow-path (cloud tier) workload, and drive benign slow-path latency well beyond the needed deadline. Without attack, benign p99 latency stays near 100 ms. During each burst, it rises to several seconds, and mean latency exceeds the 250 ms SLO (Figure 3c). Each burst creates contention that delays slow-path completion before additional workers become ready. The attacker then waits for scaled-out capacity to be reclaimed, so the next burst again encounters a cold slow path. Cloud predictions miss their freshness deadline and are discarded, wasting much of the slow-path work and cost. Compared with the flat high-volume baseline, the shaped attack creates more stale-assistance periods and is therefore more harmful to accuracy over time.
4.2
Model Accuracy Drop
Setup. We evaluate whether workload-induced latency translates into application-level accuracy loss using a real multi-object-tracking workload on Argoverse-HD [8], an autonomous-driving dataset with dense annotations designed to evaluate real-time perception in safety-critical driving settings. The edge tier runs YOLOX-Nano [15], while the cloud tier runs the more accurate YOLOX-X model. The system sends one frame to the cloud every 5-10 frames at regular intervals. Because cloud detections are produced only for these sampled frames, we propagate them forward using Kalman-filter-based object-motion forecasting with camera-motion compensation (CMC), and then apply the SORT tracker [3] to associate objects over time. Consistent with latency budgets used in prior autonomous-driving perception systems [17, 39], cloud predictions are incorporated only if they return within a 250 ms deadline; responses that arrive later are discarded as stale, leaving the edge prediction as the system output. We report HOTA [31], an endto-end tracking-quality metric, for the complete videos and the intervals targeted by the shaped attack. We compare the edge-only baseline against the two-system pipeline with and without the attack, capturing both its aggregate impact and its effect during periods of induced slow-path delay.
Attack impact on randomly selected targets. Figure 4, “Average” shows the impact of the attack on accuracy. Averaged over randomly selected attack placements across the video contents, the shaped attack reduces tracking quality by 7.0 HOTA points and leaves the two-system pipeline close to the edge-only baseline, erasing nearly all of the average benefit provided by cloud assistance. Attack impact in different targeted video content. The average results conceal substantial variation across video content. We replay the identical attack-induced completiontime trace over different video intervals while holding load, slow-path latency, deadline-misses, autoscaling, and cost fixed. The results show that operationally equivalent attack executions can have sharply varied impact on prediction quality: In the least-damaging targets (fig. 4, “Smallest decrease”), the attack reduces HOTA by only 2.0 points. In the most-damaging targets (fig. 4, “Biggest decrease”), the same attack reduces HOTA by 18.7 points, more than a 9× difference in prediction quality harm. Conventional distributed attack potency metrics assign these executions the same severity and prescribe the same overprovisioning defense, even though their effects on the application are radically different. The attack’s impact therefore depends not only on how many cloud predictions are late, but on which predictions are lost. Attack impact by class. The class-specific results expose a second form of variation. Under attack, the two-system pipeline generally falls toward edge-only quality, but the fraction of accuracy lost in the attack varies widely across classes (Figure 4). The most affected class (Truck) loses nearly half of its accuracy under the attack, and several low-frequency classes, including bicycles, motorcycles, and stop signs, also lose substantial fractions of their tracking quality. Aggregate accuracy can therefore hide severe class-specific regressions. This distinction matters in applications like autonomous
Jhonatan Tavori, Gur-Eyal Sela, Ion Stoica, Gil Zussman
Average Smallest decrease Biggest decrease
Individual classes (class freq.) Car (61.0%)
Edge model only 2-system pipeline (w/o attack) 2-system pipeline (w/ attack)
Traffic Light (13.1%) Truck (11.1%) Person (10.4%) Bus (1.7%) Bicycle (1.6%) Motorcycle (0.6%) Stop Sign (0.6%)
0.2
Higher accuracy is better
0.4 0.6 Accuracy (HOTA)
Figure 4: Impact of the shaped attack on application accuracy. The two-system architecture normally improves tracking quality over the edge-only model. During the attack, delayed cloud predictions are discarded as stale, eliminating most of that improvement.
driving because a relatively infrequent object can still be operationally critical to safe behavior.
5
RELATED WORK
From sustained to burst DDoS. Traditional DDoS attacks were usually framed as sustained exhaustion attacks in which the adversary sent enough traffic, for long enough, to overwhelm a link, server, or service endpoint. In that model, success came from raw volume, so defenses focused on filtering, traffic scrubbing, and rate limiting [32, 34]. Over time, services became more distributed, while mechanisms such as retries, overload controllers, and scaling became common [11, 14, 47]. Mitigation also improved as operators became better at detecting and absorbing persistent floods [1, 32, 34]. Already in 2003, the Shrew attack demonstrated that carefully timed low-rate pulses could exploit protocol reaction dynamics and outrun defenses that rely on observation windows and delayed responses [27]. More recent work similarly showed that reaction time itself becomes part of the attack surface: even with a modest average attack rate, defenses effective in steady state may fail when workloads change faster than controllers can adapt [1, 20]. Further, related burst and low-volume attacks showed that adversaries can target tail rather than mean latency. In web applications and microservices, intermittent traffic can create transient bottlenecks and inflate tail latency while remaining hidden in aggregate utilization [18, 19, 37]. Such systems may therefore fail in the tail before the mean.
From availability to utility. Burst attacks also shifted the objective toward economic harm. Rather than continuously denying service, attackers increasingly targeted the cost efficiency of distributed systems. The Yo-Yo attack manipulated cloud elasticity to trigger repeated scale-up and scale-down [5, 40], while denial-of-wallet attacks exploited serverless platforms to drive excessive resource consumption and spending [38]. In these settings, the service may remain available while incurring disproportionate cost. From utility to accuracy. We argue that distributed inference extends this progression one step further. By making slow-path part of the inference process, networking effects can directly shape the accuracy realized by the application. A workload-shaping attacker can exploit shared contention and timing to erase the accuracy benefit of remote assistance while the service remains responsive, making the realized accuracy of distributed inference a target of workload attacks.
6
DISCUSSION AND FUTURE WORK
Networking effects such as contention and delay can directly determine the application-level accuracy of emerging distributed inference pipelines. As edge devices become more capable and AI models more demanding, fast/slow two-system architectures are likely to become increasingly common. As we demonstrated, network-level security threats can play a crucial role in determining whether such systems can be trusted in safety-critical domains. We conclude by highlighting the networking questions that arise when attacks on shared infrastructure become attacks on AI accuracy. Worst-Case Coordination. Provisioning enough slow-path capacity to absorb arbitrary bursts seems to be the most direct defense, but is very costly at scale. The broader opportunity is to revisit resilience mechanisms from cloud gateways and shared services, including admission control, rate limiting, traffic isolation, and priority scheduling, through the lens of distributed inference. When can these mechanisms provide strong accuracy guarantees? Other two-system applications. Our evaluation focuses on latency-sensitive perception, but the same abstraction spans robotics, mobile reasoning, routed language models, and other assisted-inference pipelines. These systems differ in model type, data modality, merger semantics, and the consequences of brief accuracy loss. How do these factors determine attack potency, and can common principles predict which applications are most vulnerable? Generalizing Across Coordination Policies. We treated the router and merger abstractly and evaluated an edgecloud instantiation. Deployed pipelines will span the entire
Denial of Deadline: Network-Driven Accuracy Collapse in Distributed Inference Pipelines
on-device–edge–cloud continuum and employ diverse coordination policies, including selective routing and applicationspecific merging. How these designs respond to adversarial workloads remains largely unexplored. Systematically studying these designs across applications could reveal new attacks and guide the design of resilient distributed inference.
REFERENCES [1] Albert Gran Alcoz, Martin Strohmeier, Vincent Lenders, and Laurent Vanbever. 2022. Aggregate-based congestion control for pulse-wave DDoS defense. In Proceedings of the ACM SIGCOMM 2022 Conference. 693–706. [2] Apple. 2024. Introducing Apple’s On-Device and Server Foundation Models. Apple Machine Learning Research. https://machinelearning. apple.com/research/introducing-apple-foundation-models Approximately 3B-parameter on-device model with a Private Cloud Compute server model. [3] Alex Bewley, Zongyuan Ge, Lionel Ott, Fabio Ramos, and Ben Upcroft. 2016. Simple online and realtime tracking. In 2016 IEEE international conference on image processing (ICIP). Ieee, 3464–3468. [4] Kevin Black, Noah Brown, Danny Driess, Adnan Esmail, Michael Equi, Chelsea Finn, Niccolo Fusai, Lachy Groom, Karol Hausman, Brian Ichter, et al. 2024. 𝜋0 : A Vision-Language-Action Flow Model for General Robot Control. arXiv preprint arXiv:2410.24164 (2024). [5] Anat Bremler-Barr, Eli Brosh, and Mor Sides. 2017. DDoS attack on cloud auto-scaling mechanisms. In IEEE INFOCOM 2017-IEEE Conference on Computer Communications. IEEE, 1–9. [6] Anthony Brohan, Noah Brown, Justice Carbajal, Yevgen Chebotar, Xi Chen, Krzysztof Choromanski, Tianli Ding, Danny Driess, Avinava Dubey, Chelsea Finn, et al. 2023. RT-2: Vision-Language-Action Models Transfer Web Knowledge to Robotic Control. arXiv preprint arXiv:2307.15818 (2023). [7] Anthony Brohan, Yevgen Chebotar, Chelsea Finn, Karol Hausman, Alexander Herzog, Daniel Ho, Julian Ibarz, Alex Irpan, Eric Jang, Ryan Julian, et al. 2022. Do as i can, not as i say: Grounding language in robotic affordances. In Conference on Robot Learning; arXiv preprint arXiv:2204.01691. 287–318. [8] Ming-Fang Chang, John Lambert, Patsorn Sangkloy, Jagjeet Singh, Slawomir Bak, Andrew Hartnett, De Wang, Peter Carr, Simon Lucey, Deva Ramanan, et al. 2019. Argoverse: 3d tracking and forecasting with rich maps. In Proceedings of the IEEE/CVF conference on computer vision and pattern recognition. 8748–8757. [9] Lingjiao Chen, Matei Zaharia, and James Zou. 2023. Frugalgpt: How to use large language models while reducing cost and improving performance. arXiv preprint arXiv:2305.05176 (2023). [10] Tiffany Yu-Han Chen, Lenin Ravindranath, Shuo Deng, Paramvir Bahl, and Hari Balakrishnan. 2015. Glimpse: Continuous, real-time object recognition on mobile devices. In Proceedings of the 13th ACM conference on embedded networked sensor systems (SenSys). 155–168. [11] Shuiguang Deng, Hailiang Zhao, Binbin Huang, Cheng Zhang, Feiyi Chen, Yinuo Deng, Jianwei Yin, Schahram Dustdar, and Albert Y Zomaya. 2024. Cloud-native computing: A survey from the perspective of services. Proc. IEEE 112, 1 (2024), 12–46. [12] D. Ding, A. Mallick, C. Wang, et al. 2024. Hybrid LLM: Cost-Efficient and Quality-Aware Query Routing. In International Conference on Learning Representations (ICLR). [13] Kuntai Du, Ahsan Pervaiz, Xin Yuan, Aakanksha Chowdhery, Qizheng Zhang, Henry Hoffmann, and Junchen Jiang. 2020. Server-driven video streaming for deep learning inference. In Proceedings of the Annual conference of the ACM Special Interest Group on Data Communication on
the applications, technologies, architectures, and protocols for computer communication (SIGCOMM). 557–570. [14] Yu Gan, Yanqi Zhang, Dailun Cheng, Ankitha Shetty, Priyal Rathi, Nayan Katarki, Ariana Bruno, Justin Hu, Brian Ritchken, Brendon Jackson, et al. 2019. An open-source benchmark suite for microservices and their hardware-software implications for cloud & edge systems. In Proceedings of the twenty-fourth international conference on architectural support for programming languages and operating systems. 3–18. [15] Zheng Ge, Songtao Liu, Feng Wang, Zeming Li, and Jian Sun. 2021. Yolox: Exceeding yolo series in 2021. arXiv preprint arXiv:2107.08430 (2021). [16] Mahshid Ghasemi, Yongjie Fu, Xinyu Ouyang, Peiran Wang, Mehmet Kerem Turkcan, Jhonatan Tavori, Sofia Kleisarchaki, Thomas Calmant, Levent Gürgen, Zoran Kostic, et al. 2025. Real-time video analytics for urban safety: Deployment over edge and end devices. In Proceedings of the Tenth ACM/IEEE Symposium on Edge Computing. 1–17. [17] Ionel Gog, Sukrit Kalra, Peter Schafhalter, Joseph E Gonzalez, and Ion Stoica. 2022. D3: a dynamic deadline-driven approach for building autonomous vehicles. In Proceedings of the Seventeenth European Conference on Computer Systems. 453–471. [18] Xuhang Gu, Qingyang Wang, Jianshu Liu, and Jinpeng Wei. 2024. Grunt attack: Exploiting execution dependencies in microservices. In 2024 54th Annual IEEE/IFIP International Conference on Dependable Systems and Networks (DSN). IEEE, 115–128. [19] Xuhang Gu, Qingyang Wang, Qiben Yan, Jianshu Liu, and Calton Pu. 2024. Sync-millibottleneck attack on microservices cloud architecture. In Proceedings of the 19th ACM ASIA Conference on Computer and Communications Security. 799–813. [20] Run Guo, Jianjun Chen, Yihang Wang, Keran Mu, Baojun Liu, Xiang Li, Chao Zhang, Haixin Duan, and Jianping Wu. 2023. Temporal {CDNConvex} Lens: A {CDN-Assisted} Practical Pulsing {DDoS} Attack. In 32nd USENIX Security Symposium (USENIX Security 23). 6185–6202. [21] Noriaki Hirose, Catherine Glossop, Dhruv Shah, and Sergey Levine. 2026. AsyncVLA: An Asynchronous VLA for Fast and Robust Navigation on the Edge. arXiv preprint arXiv:2602.13476 (2026). [22] Gao Huang, Danlu Chen, Tianhong Li, Felix Wu, Laurens van der Maaten, and Kilian Weinberger. 2018. Multi-Scale Dense Networks for Resource Efficient Image Classification. In International Conference on Learning Representations. [23] Dan Jacobellis, Mateen Ulhaq, Fabien Racapé, Hyomin Choi, and Neeraja J. Yadwadkar. 2026. DeDelayed: Deleting Remote Inference Delay via On-Device Correction. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR). arXiv:2510.13714 [24] Daniel Kang, John Emmons, Firas Abuzaid, Peter Bailis, and Matei Zaharia. 2017. NoScope: Optimizing Neural Network Queries over Video at Scale. Proceedings of the VLDB Endowment 10, 11 (2017). [25] Yiping Kang, Johann Hauswald, Cao Gao, Austin Rovinski, Trevor Mudge, Jason Mars, and Lingjia Tang. 2017. Neurosurgeon: Collaborative intelligence between the cloud and mobile edge. ACM SIGARCH Computer Architecture News 45, 1 (2017), 615–629. [26] Swarun Kumar, Shyamnath Gollakota, and Dina Katabi. 2012. A cloudassisted design for autonomous driving. In Proceedings of the first edition of the MCC workshop on Mobile cloud computing. 41–46. [27] Aleksandar Kuzmanovic and Edward W Knightly. 2003. Low-rate TCPtargeted denial of service attacks: the shrew vs. the mice and elephants. In Proceedings of the 2003 conference on Applications, technologies, architectures, and protocols for computer communications. 75–86. [28] Stefanos Laskaridis, Stylianos I Venieris, Mario Almeida, Ilias Leontiadis, and Nicholas D Lane. 2020. SPINN: Synergistic progressive inference of neural networks over device and cloud. In Proceedings
Jhonatan Tavori, Gur-Eyal Sela, Ion Stoica, Gil Zussman
of the 26th annual international conference on mobile computing and networking (MobiCom). 1–15. [29] Yuanqi Li, Arthi Padmanabhan, Pengzhan Zhao, Yufei Wang, Guoqing Harry Xu, and Ravi Netravali. 2020. Reducto: On-camera filtering for resource-efficient real-time video analytics. In Proceedings of the Annual conference of the ACM Special Interest Group on Data Communication on the applications, technologies, architectures, and protocols for computer communication (SIGCOMM). 359–376. [30] Luyang Liu, Hongyu Li, and Marco Gruteser. 2019. Edge Assisted Realtime Object Detection for Mobile Augmented Reality. In Proceedings of the 25th Annual International Conference on Mobile Computing and Networking (MobiCom). doi:10.1145/3300061.3300116 [31] Jonathon Luiten, Aljosa Osep, Patrick Dendorfer, Philip Torr, Andreas Geiger, Laura Leal-Taixé, and Bastian Leibe. 2021. Hota: A higher order metric for evaluating multi-object tracking. International journal of computer vision 129, 2 (2021), 548–578. [32] Jelena Mirkovic and Peter Reiher. 2004. A taxonomy of DDoS attack and DDoS defense mechanisms. ACM SIGCOMM Computer Communication Review 34, 2 (2004), 39–53. [33] Isaac Ong, Amjad Almahairi, Vincent Wu, Wei-Lin Chiang, Tianhao Wu, Joseph E Gonzalez, M Waleed Kadous, and Ion Stoica. 2024. Routellm: Learning to route llms with preference data. arXiv preprint arXiv:2406.18665 (2024). [34] Tao Peng, Christopher Leckie, and Kotagiri Ramamohanarao. 2007. Survey of network-based defense mechanisms countering the DoS and DDoS problems. ACM Computing Surveys (CSUR) 39, 1 (2007), 3–es. [35] Dipankar Raychaudhuri, Ivan Seskar, Gil Zussman, Thanasis Korakis, Dan Kilper, Tingjun Chen, Jakub Kolodziejski, Michael Sherman, Zoran Kostic, Xiaoxiong Gu, et al. 2020. Challenge: COSMOS: A city-scale programmable testbed for experimentation with advanced wireless. In Proceedings of the 26th annual international conference on mobile computing and networking. 1–13. [36] Peter Schafhalter, Sukrit Kalra, Le Xu, Joseph E. Gonzalez, and Ion Stoica. 2023. Leveraging Cloud Computing to Make Autonomous Vehicles Safer. In 2023 IEEE/RSJ International Conference on Intelligent Robots and Systems (IROS). arXiv:2308.03204 [37] Huasong Shan, Qingyang Wang, and Calton Pu. 2017. Tail attacks on web applications. In Proceedings of the 2017 ACM SIGSAC Conference on Computer and Communications Security. 1725–1739. [38] Junxian Shen, Han Zhang, Yantao Geng, Jiawei Li, Jilong Wang, and Mingwei Xu. 2022. Gringotts: Fast and accurate internal denial-ofwallet detection for serverless computing. In Proceedings of the 2022 ACM SIGSAC Conference on Computer and Communications Security. 2627–2641. [39] Shuyao Shi, Neiwen Ling, Zhehao Jiang, Xuan Huang, Yuze He, Xiaoguang Zhao, Bufang Yang, Chen Bian, Jingfei Xia, Zhenyu Yan, et al. 2024. Soar: Design and deployment of a smart roadside infrastructure system for autonomous driving. In Proceedings of the 30th Annual International Conference on Mobile Computing and Networking. 139–154. [40] Mor Sides, Anat Bremler-Barr, and Elisha Rosensweig. 2015. Yo-Yo Attack: vulnerability in auto-scaling mechanism. In Proceedings of the 2015 ACM Conference on Special Interest Group on Data Communication. 103–104. [41] Surat Teerapittayanon, Bradley McDanel, and HT Kung. 2016. BranchyNet: Fast inference via early exiting from deep neural networks. In 2016 23rd International Conference on Pattern Recognition (ICPR). IEEE, 2464–2469. [42] Xu Wang, Zheng Yang, Jiahang Wu, Yi Zhao, and Zimu Zhou. 2021. EdgeDuet: Tiling Small Object Detection for Edge Assisted Autonomous Mobile Vision. In IEEE INFOCOM 2021 - IEEE Conference on
Computer Communications. doi:10.1109/INFOCOM42981.2021.9488843 [43] Yiding Wang, Kai Chen, Haisheng Tan, and Kun Guo. 2023. Tabi: An efficient multi-level inference system for large language models. In Proceedings of the Eighteenth European Conference on Computer Systems (EuroSys). 233–248. [44] Waymo. 2024. Fleet Response: Remote Assistance for the Waymo Driver. Waymo. [45] Meng Wei, Chenyang Wan, Jiaqi Peng, Xiqian Yu, Yuqiang Yang, Delin Feng, Wenzhe Cai, Chenming Zhu, Tai Wang, Jiangmiao Pang, and Xihui Liu. 2025. Ground Slow, Move Fast: A Dual-System Foundation Model for Generalizable Vision-and-Language Navigation. arXiv:2512.08186 [cs.RO] https://arxiv.org/abs/2512.08186 [46] Xumiao Zhang, Anlan Zhang, Jiachen Sun, Xiao Zhu, Y. Ethan Guo, Feng Qian, and Z. Morley Mao. 2021. EMP: Edge-assisted Multi-vehicle Perception. In Proceedings of the 27th Annual International Conference on Mobile Computing and Networking (MobiCom). doi:10.1145/3447993. 3483242 [47] Hao Zhou, Ming Chen, Qian Lin, Yong Wang, Xiaobin She, Sifan Liu, Rui Gu, Beng Chin Ooi, and Junfeng Yang. 2018. Overload control for scaling wechat microservices. In Proceedings of the ACM Symposium on Cloud Computing. 149–161. [48] Minjie Zhu, Yichen Zhu, Jinming Li, Junjie Wen, Zhiyuan Xu, Zhengping Che, Chaomin Shen, Yaxin Peng, Dong Liu, Feifei Feng, and Jian Tang. 2024. Language-Conditioned Robotic Manipulation with Fast and Slow Thinking. arXiv preprint arXiv:2401.04181 (2024).