Security of Split-Deployed DNNs in IoT Edge Computing: A Structure-Aware Universal Adversarial Attack

Abstract

Split computing has emerged as a practical architecture for deploying deep neural networks (DNNs) in resource-constrained Internet of Things (IoT) systems, where early network layers run on edge devices, and the remaining layers execute on edge servers or in the cloud. While this architecture improves efficiency and reduces latency, it also exposes the device-side subnetwork, creating potential security risks. In this article, we investigate whether partial exposure of early-layer parameters can be exploited to construct effective adversarial attacks against the full split-deployed model. We propose a structure-aware universal adversarial perturbation (SA-UAP) that leverages the spectral properties of the exposed linear operators in the edge-side subnetwork. In particular, the perturbation is optimized to align with dominant singular directions of the accessible layers, thereby maximizing perturbation amplification through the front-end feature extractor. Unlike conventional adversarial attack methods, the proposed approach requires neither full-model access nor repeated interaction with the cloud-side model, making it particularly suitable for realistic IoT split-deployment scenarios. Extensive experiments on CIFAR-10 and ImageNet with multiple backbone architectures demonstrate that the proposed attack significantly degrades classification accuracy and outperforms existing data-free and spectral baselines. These results reveal that the exposed prefix of split-deployed models contains exploitable spectral vulnerabilities, highlighting an important security consideration for edge–cloud collaborative intelligence.