MobiTrust: Risk-Bounded Adaptive Split Inference Under Mobility, Privacy Leakage, and Latent-Space Attacks

Split inference lets a mobile device run the first layers of a neural network locally and hand the intermediate representation to an edge server, trading raw data disclosure for communication and offloaded computation. The common assumption that keeping raw inputs on the device is enough for privacy does not survive contact with modern attacks: intermediate activations can be inverted back to inputs, tested for membership, or probed for sensitive attributes, and they can be tampered with in transit. These risks are not fixed properties of a network; they shift with the split point, with any protection applied to the representation, with the trust placed in the serving edge, and with the sensitive attributes at stake in a given context. Schedulers that pick a split to minimise latency or energy, or that fold risk into a single weighted objective, routinely cross privacy and integrity limits whenever the network briefly makes offloading attractive. We present MobiTrust, an adaptive split-inference controller that treats privacy and latent-integrity risk as explicit constraints on measured risk scores rather than terms to be traded away. Two measurable quantities drive it: Context-Dependent Semantic Exposure (CDSE), a worst-channel estimate of privacy leakage (assembled from reconstruction, shadow-model membership, and attribute attacks) that accounts for the sensitive attributes a deployment cares about, and Latent Integrity Risk (LIR), a detector score for tampered representations. A feasibility-filtering controller selects, at each inference, the split point, the representation protection, and the serving edge that minimise cost subject to per-inference risk and deadline budgets, and it falls back to on-device execution when no offload is safe. We frame this as a controlled simulation study of the constraint mechanism: it runs on a reduced-scale, fully reproducible testbed with an image and a sensing workload and a transparent analytical latency/energy model, so the claims concern the controller’s decisions and their effect on measured risk, not absolute timings on a particular device. CDSE tracks measured attack success far better than the split-depth and tensor-size heuristics used by leakage-agnostic schedulers (Spearman ρ of 0.59 and 0.87 versus 0.33 and 0.72 for depth). Over mixed mobility traces, MobiTrust holds the profiled privacy and adversarial constraint violations at 0% while the latency-only and weighted-sum baselines violate the privacy budget in 88% of inferences and the integrity budget in up to 58%; a weight sweep shows that, across the weightings we tested, the weighted-sum baseline reaches zero violations only by ceasing to offload. The cost of the guarantee is energy: MobiTrust saves device energy by offloading when it is safe, but a zero-violation local-only baseline attains higher accuracy and lower tail latency, so the improvement is a favourable energy trade-off rather than a uniform win. Because zero violations certify compliance with the profiled risk scores rather than an independently validated security bound, we also show that, under estimation uncertainty, the controller’s primal–dual margin holds the realised violation rate at its tolerance.