TensorShield: Safeguarding On-Device Inference by Shielding Critical DNN Tensors with TEE

BoRui Li; Bowen Jiang; Hailong Lin; Tong Sun; Wei Dong; Yi Gao; Yixiao Teng

REVIEW 4 major objections 8 minor 1 cited by

TensorShield: Safeguarding On-Device Inference by Shielding Critical DNN Tensors with TEE

T0 review · 4 major / 8 minor · reviewed 2026-08-07 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read TensorShield claims that shielding only critical tensors and privacy-leaking features matches full-model TEE protection, cutting inference latency by up to 25.35x.

desk verdict TensorShield is a serious systems contribution with credible speedups, but its headline security equivalence is a fitted optimization target rather than an independently demonstrated result. read the letter →

arxiv 2505.22735 v1 pith:STKZEZAM submitted 2025-05-28 cs.CR

Tong Sun , Bowen Jiang , Hailong Lin , Borui Li , Yixiao Teng , Yi Gao , Wei Dong This is my paper

classification cs.CR

keywords TrustedExecutionEnvironmentmodelstealingattackmembershipinferenceon-devicecriticaltensorselectionexplainableAIone-timepaddinglatency-awareplacement

verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

This paper tries to establish that full-model shielding inside a Trusted Execution Environment is overkill for protecting on-device DNNs. Its claim is that a model can be defended against model stealing and membership inference by shielding only a small set of critical tensors and masking only the intermediate features that leak membership information, reaching almost the same security level as shielding the entire model while cutting inference latency by up to 25.35x (average 5.85x) without accuracy loss. If true, this makes TEE-based secure inference practical on memory-limited mobile and IoT devices, because the secure-memory bottleneck shrinks to a few tensors. The load-bearing idea is that decision capability concentrates in a sparse subset of tensors, identifiable by how differently the victim model's attention behaves compared with a public pretrained model.

What carries the argument

The central object is the tensor criticality metric of Eq. (1): intrinsic tensor importance multiplied by attention transition. The first factor, $\sum_i \frac{\partial L}{n\,\partial w_i^k}\Delta w_i^k$, quantifies how much a tensor's weight updates contributed to reducing the training loss; the second factor, $1-\cos(f(M^k_{Vic}), f(M^k_{Pub}))$, measures how much the victim tensor's decision-relevant attention diverges from the same tensor in a public pretrained model, so a tensor already well represented publicly needs no protection. The companion mechanism for membership inference is Eq. (2), the Jensen-Shannon divergence between member and non-member internal distributions, which ranks which intermediate features must be masked. To avoid running 100-epoch attack simulations, the selection procedure compares the initial loss and early loss-reduction speed over the first 20 epochs of a shadow model against the all-shield curve, and stops at the smallest top-k that matches the all-shield protection threshold. A latency-aware placement formulation then assigns each tensor to the TEE CPU, the REE GPU, or the REE CPU based on profiled execution times, with environment-switch overhead relaxed away to make the NP-hard placement problem tractable.

What would settle it

Train shadow models for 100 epochs for a workload such as MobileNetV2 on Tiny-ImageNet under TensorShield's top-k selection and compare the final model-stealing accuracy with the all-shield baseline; if the 20-epoch proxy picks a k whose final model-stealing accuracy exceeds the all-shield accuracy by more than the paper's 1% threshold, the central equivalence claim is falsified for that workload.

Watch

Extended reading notes

Core claim

On its own terms, this paper discovers that the part of a DNN an attacker actually needs, the decision capability, concentrates in a sparse set of tensors, so full-model shielding is unnecessary. TensorShield scores each linear tensor by Eq. (1), the product of an intrinsic importance term $\sum_i \frac{\partial L}{n\,\partial w_i^k}\Delta w_i^k$ and an attention-transition term $1-\cos(f(M^k_{Vic}), f(M^k_{Pub}))$, where $f$ is a gradient-weighted class-activation saliency map; a tensor that the victim model uses differently from the public pretrained model, and whose weight updates mattered for loss reduction, is the one worth protecting. For membership inference, each intermediate feature is scored by the JS-divergence (Eq. (2)) between member and non-member gradient and activation distributions, and only high-scoring features are masked with one-time padding. The paper reports that across four CNN models and four datasets this selective shielding keeps model-stealing accuracy at 1.03x and membership-inference accuracy at 1.00x of the all-shield baseline while cutting inference latency by up to 25.35x (average 5.85x) with no accuracy loss.

Load-bearing premise

The whole method relies on the assumption that the speed at which an attacker's shadow model lowers its loss in the first 20 epochs, together with its starting loss, correctly predicts how accurate the stealing attack will finally be, an assumption demonstrated only for VGG16_BN on CIFAR-10 and then applied to every other model and dataset.

Editorial extensions

If this is right

Model providers no longer need to fit the entire model into secure memory; they only need to fit the critical tensors and mask selected intermediate features.
Fixed policies such as shield-shallow or shield-deep layers are insufficient, because protection must be per-tensor and workload-dependent.
The same security level as shielding all weights can be delivered with up to 25.35x lower latency and up to 91.35% lower energy on mobile hardware, making TEE-based inference practical on constrained devices.
Membership-inference defense becomes cheaper because only features with high member/non-member divergence need one-time-pad masking.
On devices with a GPU, obfuscated critical tensors can run in the REE without losing the security bound, since placement is chosen per hardware profile.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

Editorial inference: If the attention-transition principle generalizes, the amount of shielding needed will shrink as public pretrained models improve, because more of the victim model's decision capability is already public.
Editorial inference: The early-convergence proxy, if validated across architectures, could serve as a general fast audit procedure for estimating model-stealing risk without running 100-epoch attacks.
Editorial inference: The claimed security equivalence is tied to the paper's threat model (adversary controls the REE, makes limited queries, and has no TEE side channels); a stronger adversary using ciphertext side channels or larger query budgets would likely require shielding more than the selected critical tensors.
Editorial inference: Applying the same criticality logic to transformer-based models would require deciding whether attention heads, rather than weight tensors, are the natural units of decision capability; the paper notes LLM extension as future work.

Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Desk Editor's Note

read the letter

You should know two things about this paper. First, the engineering result is real: shielding only critical tensors and selectively masking features gets you 5.85x average speedup over all-shield baselines on commodity TrustZone hardware, across four models, four datasets, and two platforms. The breakdown in Table 3 is convincing about where the time goes. Second, the "same security as all-shield" claim is weaker than it looks, because the selection procedures in Sections 4.2 and 5 explicitly stop when the all-shield attack accuracy is reached. That makes the security parity a construction, not a finding. This does not kill the paper, but it should be reframed.

What is genuinely new: the attention-transition correction to ElasticTrainer's importance metric (Eq. 1) is a sensible fix for the over-parameterization problem, and the JS-divergence feature-masking scheme (Eq. 2) is a real departure from masking every cross-world feature. The latency-aware placement formulation in Section 6 is also a reasonable step beyond fixed layer/weight shielding. The evaluation breadth is solid, and the code is open-sourced, which I value.

Soft spots, in rough order of severity. The circular selection target is the big one: the paper presents all-shield-equivalent MS/MIA accuracy as evidence when it is actually the stopping condition. A reviewer should ask for a version where the threshold is set independently, or where the authors report the full tradeoff curve over k. Second, the convergence-speed proxy that picks the top-k tensors is validated on exactly one combination (VGG16_BN/CIFAR-10, Figure 6) and then applied to all sixteen. The paper needs at least a rank-correlation check between the proxy's ordering and final 100-epoch attack accuracy on a couple more architectures, plus an ablation over the window m. Third, security metrics have no error bars; ten runs are reported for latency but not for attack accuracy. Minor: the JS-divergence threshold of 0.1 is asserted with common-practice citation but not sensitivity-analyzed.

For whom: anyone working on TEE-based on-device inference or model-exfiltration defenses. It deserves a proper peer review at a good security or systems venue, with the expectation of revision around the circularity point. I would not desk reject it, and I would bring it to a reading group specifically to debate how much the fitted target discounts the security claim.

Referee Report

4 major / 8 minor

Summary. TensorShield proposes to protect on-device DNN inference by shielding only a subset of tensors (in a TEE or via obfuscation) rather than the entire model. The selection of critical tensors uses a new XAI metric (attention transition plus intrinsic importance) and an early-convergence proxy of a knockoff shadow model; membership-leaking intermediate features are identified via JS divergence and selectively masked; and a latency-aware placement optimization decides TEE/REE execution. The evaluation across 4 models, 4 datasets, and 2 platforms reports MS and MIA accuracies close to the all-shield baseline (1.03x and 1.00x) with up to 25.35x lower inference latency and reduced energy consumption.

Significance. If the results hold, the paper makes a substantive systems and security contribution: it shows that fine-grained tensor-level shielding can approach all-shield security at a fraction of the latency, with open-sourced code and a fairly broad evaluation. The attention-transition metric is a reasonable and novel idea, and the reported speedups are large. However, the current evidence does not yet establish the claim, because the security equivalence is partly built into the selection procedure and the MIA evaluation does not test the direct attack vector that feature masking is supposed to prevent.

major comments (4)

[Sec. 4.2 and Sec. 5] The reported security equivalence is a fitted target rather than an independently validated prediction. The algorithm iterates 'until the protection precision aligns with the threshold of the all-shield scenario' (Sec. 4.2) and the feature set is selected so that MIA accuracy does not exceed Acc_AllShield_MIA + 1% (Sec. 5); therefore the headline ratios of 1.03x (MS) and 1.00x (MIA) in Sec. 8.2 are largely determined by the stopping rule. To support the claim that TensorShield identifies critical sets with all-shield security, the paper should validate the early-convergence proxy against final 100-epoch MS accuracies across all model/dataset pairs, with ablations over the window m and the matching tolerance.
[Sec. 5, Sec. 7, Sec. 8.2] The MIA evaluation does not test the attack that the feature-masking is designed to block. Section 5 motivates masking because intermediate features 'can be directly observed by the attacker' and used to train a membership predictor, but Sec. 7 says the MIA attack is a transfer attack on the surrogate model M_Sur, and Sec. 8.2 reports only surrogate-based MIA accuracy. No experiment trains a membership classifier on the victim's exposed intermediate features with and without masking. As written, the 1.00x MIA ratio is driven by the weight-shielding/MS theft setup, and the selective feature-masking contribution is not validated.
[Sec. 6, Eqs. (4)-(6)] The placement optimization is internally inconsistent. Eq. (4) defines five execution options j=0..4, where j=4 is TEE execution, but Eq. (5) minimizes over j in {0,1,2} only and imposes sum_{j in {0,1,2}} x_{i,j}=1, omitting options j=3 and j=4; the memory constraint x_{i,0}*m_i <= M checks only the j=0 option, whereas the TEE memory limit should constrain j=4. The closed-form Eq. (6) never allows j=4, yet Sec. 3 and Table 3 describe cases where tensors execute in the TEE with no deobfuscation or masking (e.g., the CIFAR-100 row). The latency placements reported therefore cannot be produced by the stated optimization, casting doubt on the placement-related speedup claims.
[Sec. 4.2 and Figure 6] The early-exit proxy is validated only on a single model/dataset pair and only through loss curves, not final accuracies. Figure 6 shows VGG16_BN/CIFAR-10 loss trajectories for top-k strategies, but it does not report the final 100-epoch MS accuracies for these k; the caption's claim that 'Top-9 ... achieves the all-shield protection accuracy' is not backed by numeric attack-accuracy data. Section 8.6 reports an average of 10.9 epochs but provides no per-configuration results, no comparison of proxy-selected sets with full 100-epoch selections, and no rank-correlation between the proxy's ordering and final MS accuracy across the other 15 combinations. If the proxy misranks top-k on other architectures/datasets, the algorithm can under-shield and the all-shield-equivalence claim collapses.

minor comments (8)

[Sec. 8.2] The text contains 'Figure X' placeholders twice; they should be replaced with the actual figure numbers.
[Sec. 8.2] The text refers to 'TinyImage200'; the dataset is Tiny-ImageNet.
[Eq. (2)] Eq. (2) uses inconsistent notation: JSD(p(z)||q(x)) is defined in terms of G_p(x) and G_q(x); the distribution arguments should be stated consistently.
[Sec. 8.1] There is a typo 'shiedls' for 'shields' in the DarkneTZ baseline description.
[Throughout] The paper uses 'DarkneTZ' and 'DarkNeTZ' interchangeably; choose one consistent spelling.
[Figures 14 and 15] Figures 14 and 15 use 'OOM' without defining it; the definition appears only in the Figure 9 caption.
[Sec. 8.1] The assertion that the JS-divergence threshold of 0.1 is 'a common value' is not supported by the cited references in this context; an ablation over the threshold would strengthen the presentation.
[Sec. 10] Given that TEESlice [75] is discussed in related work and is closely related, the paper should justify its exclusion from the baseline comparison.

Circularity Check

0 steps flagged · score 0.0 of 10

No significant circularity: the security-equivalence result is a stated design target evaluated by full attack simulations, not a quantity forced by construction.

full rationale

TensorShield's central derivation chain is not circular. The criticality metric in Eq. (1) combines a gradient-based intrinsic importance term with an attention-transition term comparing Grad-CAM maps of victim and public models; it is a heuristic predictor, not defined in terms of the reported MS accuracy. The tensor-selection procedure in Sec. 4.2 uses a proxy (initial loss value and loss-reduction rate over the first m=20 epochs of a shadow-model simulation) to stop at a top-k set, and the feature selection in Sec. 5 uses JS-divergence with a 0.1 threshold. The reported security numbers (MS 1.03x, MIA 1.00x versus all-shield) come from full 100-epoch shadow-model and transfer-attack evaluations, so they are not the same quantity as the early-loss or JSD stopping criteria. The all-shield +1% thresholds are indeed design targets, but meeting a target through an independently measured attack is an empirical finding, not a reduction by construction; the claimed contribution is that a small tensor subset meets that target. The early-loss proxy is demonstrated only for VGG16_BN on CIFAR-10 and then applied to other combinations, which is a generalization and robustness risk rather than a circularity. The paper contains no load-bearing self-citations: the cited XAI baselines [25, 55] and attack implementations [41, 45] are external prior work, and the latency and energy improvements are measured independently of any fitted security target. Overall, no step in the derivation is equivalent to its own input by definition.

Assumptions & free parameters 3 free parameters · 5 assumptions · 0 invented entities

The paper introduces no new physical entities. Its central claim rests on empirically chosen thresholds (JSD=0.1, m=20, all-shield+1% targets), the threat-model scope, and the unproven concentration premise that a small tensor subset captures decision and membership information.

free parameters (3)

JS-divergence feature criticality threshold = 0.1
Section 5: 'features with a criticality value of less than 0.1 typically do not affect MIA accuracy'. Chosen from empirical observations; no sensitivity analysis. It determines which intermediate features are masked, directly affecting MIA defense and latency.
Convergence-speed window m = 20 epochs
Section 4.2: 'the rate of loss reduction over the first m epochs (e.g., m=20)'. Used to estimate the shadow model's final MS accuracy; validated on VGG16_BN/CIFAR-10 only (Figure 6), applied to all configurations.
All-shield attack accuracy threshold = Acc_AllShield_MS + 1%, Acc_AllShield_MIA + 1%
Sections 3, 4.2, and 5: selection stops when simulated attack accuracy reaches these thresholds; this is the target that defines 'critical' tensors and features and guarantees the reported security result.

assumptions (5)

domain assumption The attacker is limited to the specified MS (Knockoff Nets) and MIA (transfer attack) pipelines, with a query budget of at most 1% of training data, and cannot exploit side channels or TEE-REE transmission weaknesses.
Threat model in Section 2.2; the 'fully defending against MS and MIA' claim is scoped to these attacks.
domain assumption A public pre-trained model with the victim's architecture is available to both attacker and defender, and the victim model is fine-tuned from it.
Section 2.2 and the attack simulation in Section 4.1 rely on the public model for surrogate initialization and attention comparison.
ad hoc to paper The convergence speed of the shadow model's loss over the first 20 epochs is a reliable proxy for its final model stealing accuracy.
Section 4.2, Figure 6: empirically motivated on a single architecture/dataset pair (VGG16_BN/CIFAR-10); no formal or broad empirical justification.
ad hoc to paper Decision-making capability relevant to model stealing is concentrated in a small subset of tensors rankable by Eq. (1).
Core premise of Section 4; supported only by the 16 model/dataset combinations in Section 8, with no theoretical argument.
ad hoc to paper JS-divergence of member versus non-member gradient distributions identifies all membership-leaking intermediate features.
Section 5: the metric assumes distributional divergence is the sole leakage channel, and the 0.1 threshold is empirically chosen.

how reviews work

0 comments

Cite this review

Pith. "Pith review of TensorShield: Safeguarding On-Device Inference by Shielding Critical DNN Tensors with TEE." pith.science (2026). https://pith.science/paper/STKZEZAM

@misc{pith2026250522735,
  author       = {Pith},
  title        = {Pith review of: TensorShield: Safeguarding On-Device Inference by Shielding Critical DNN Tensors with TEE},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/STKZEZAM}},
  note         = {Machine review of arXiv:2505.22735}
}

abstract

To safeguard user data privacy, on-device inference has emerged as a prominent paradigm on mobile and Internet of Things (IoT) devices. This paradigm involves deploying a model provided by a third party on local devices to perform inference tasks. However, it exposes the private model to two primary security threats: model stealing (MS) and membership inference attacks (MIA). To mitigate these risks, existing wisdom deploys models within Trusted Execution Environments (TEEs), which is a secure isolated execution space. Nonetheless, the constrained secure memory capacity in TEEs makes it challenging to achieve full model security with low inference latency. This paper fills the gap with TensorShield, the first efficient on-device inference work that shields partial tensors of the model while still fully defending against MS and MIA. The key enabling techniques in TensorShield include: (i) a novel eXplainable AI (XAI) technique exploits the model's attention transition to assess critical tensors and shields them in TEE to achieve secure inference, and (ii) two meticulous designs with critical feature identification and latency-aware placement to accelerate inference while maintaining security. Extensive evaluations show that TensorShield delivers almost the same security protection as shielding the entire model inside TEE, while being up to 25.35$\times$ (avg. 5.85$\times$) faster than the state-of-the-art work, without accuracy loss.

Figures

Figures reproduced from arXiv: 2505.22735 by the authors.

**Figure 2.** An illustration of previous work for model protection. The model has three layers with eight tensors. [PITH_FULL_IMAGE:figures/full_fig_p002_2.png] view at source ↗

**Figure 3.** A three-stage attack pipeline. 2 BACKGROUND AND THREAT MODEL 2.1 Background Trusted Execution Environment. TEE (e.g., ARM TrustZone [4]) provides a physical isolation scheme in the hardware devices that separates memory into the REE and TEE, where the REE can communicate with the TEE by invoking a secure monitor call. This setup ensures that only legitimate users can access the secure world, while attackers are blo… view at source ↗

Figures from the paper (12 more)

**Figure 4.** Figure 4: Workflow of TensorShield. Note that non-linear tensors (indicated by circles) do not obtain criticality values. This is because they do not contain trainable parameters so they do not require protection. We then select a set of critical tensors (indicated by blue recta…

**Figure 5.** Figure 5: An instance of attention transition. Heat maps rep [PITH_FULL_IMAGE:figures/full_fig_p005_5.png]

**Figure 6.** Figure 6: Model stealing loss values under different top-k [PITH_FULL_IMAGE:figures/full_fig_p005_6.png]

**Figure 7.** Figure 7: Compare the gradient and feature distributions of [PITH_FULL_IMAGE:figures/full_fig_p006_7.png]

**Figure 8.** Figure 8: Left: Execution time w.r.t. different FLOPS. Right: TEE and REE switching time w.r.t. memory allocation size. platforms (e.g., clouds or PCs), where there is a significant disparity in computing power between CPUs and GPUs. However, our insight is that on mobile and I…

**Figure 9.** Figure 9: Model stealing (MS) and membership inference attack (MIA) accuracy and inference time regarding baselines on [PITH_FULL_IMAGE:figures/full_fig_p009_9.png]

**Figure 10.** Figure 10: Comparison of representative XAI-based tensor selection methods. [PITH_FULL_IMAGE:figures/full_fig_p010_10.png]

**Figure 11.** Figure 11: Attack accuracy (lines) regarding different defense [PITH_FULL_IMAGE:figures/full_fig_p010_11.png]

**Figure 12.** Figure 12: Tensor selections regarding different defense [PITH_FULL_IMAGE:figures/full_fig_p010_12.png]

**Figure 13.** Figure 13: Visualization of critical tensor evaluation. Higher [PITH_FULL_IMAGE:figures/full_fig_p011_13.png]

**Figure 14.** Figure 14: Inference time of 4 models compared with native and two completely secure baselines. [PITH_FULL_IMAGE:figures/full_fig_p012_14.png]

**Figure 15.** Figure 15: Comparison of native and all-shield solutions [PITH_FULL_IMAGE:figures/full_fig_p012_15.png]

Discussion (0). Sign in to comment.

Forward citations

Cited by 1 Pith paper

Reviewed papers in the Pith corpus that reference this work. Sorted by Pith novelty score. Full citation record

A Two-Stage Data Selection Framework for Data-Efficient Model Training on Edge Devices
cs.LG 2025-05 conditional novelty 6.0 of 10

A two-stage, pipeline-co-executed data selection framework with a class-variance-aware importance sampling scheme improves accuracy and cuts training time on real edge hardware.

Reference graph

Works this paper leans on

77 extracted references · 72 canonical work pages · cited by 1 Pith paper

[1]

Raspberry Pi 3 Model B

2016. Raspberry Pi 3 Model B. https://www.raspberrypi.com/products/raspberry- pi-3-model-b/

work page 2016
[2]

Hikey960

2017. Hikey960. https://www.96boards.org/product/hikey960/

work page 2017
[3]

Raspberry Pi 3 Model B+

2018. Raspberry Pi 3 Model B+. https://www.raspberrypi.com/products/ raspberry-pi-3-model-b-plus/

work page 2018
[4]

ARM. 2022. TrustZone for Cortex-A. https://www.arm.com/technologies/ trustzone-for-cortex-a

work page 2022
[5]

Arm. 2023. Arm Confidential Compute Architecture . https://www.arm.com/ architecture/security-features/arm-confidential-compute-architecture

work page 2023
[6]

Sebanjila Kevin Bukasa, Ronan Lashermes, Hélène Le Bouder, Jean-Louis Lanet, and Axel Legay. 2018. How TrustZone could be bypassed: Side-channel attacks on a modern system-on-chip. In Information Security Theory and Practice: 11th IFIP WG 11.2 International Conference, WISTP 2017, Heraklion, Crete, Greece, September 28–29, 2017, Proceedings 11 . Springer, 93–109

work page 2018
[7]

Dongqi Cai, Shangguang Wang, Yaozong Wu, Felix Xiaozhu Lin, and Mengwei Xu

work page
[8]

Dingfan Chen, Ning Yu, and Mario Fritz. 2022. Relaxloss: Defending membership inference attacks without losing utility. In International Conference on Learning Representations (ICLR’22)

work page 2022

Show all 77 references

[9]

Hao Chen, Wei Dai, Miran Kim, and Yongsoo Song. 2019. Efficient multi-key homomorphic encryption with packed ciphertexts with application to oblivious neural network inference. In Proceedings of the 2019 ACM SIGSAC Conference on Computer and Communications Security (CCS’19) . 395–412

2019
[10]

Hao-Jen Chien, Hossein Khalili, Amin Hass, and Nader Sehatbakhsh. 2023. Enc2: Privacy-Preserving Inference for Tiny IoTs via Encoding and Encryption. In Proceedings of the 29th Annual International Conference on Mobile Computing and Networking (MobiCom’23). 1–16

2023
[11]

Adam Coates, Andrew Ng, and Honglak Lee. 2011. An analysis of single-layer networks in unsupervised feature learning. In Proceedings of the fourteenth inter- national conference on artificial intelligence and statistics . JMLR Workshop and Conference Proceedings, 215–223

2011
[12]

Jacob Deasy, Nikola Simidjievski, and Pietro Liò. 2020. Constraining variational inference with geometric jensen-shannon divergence. Advances in Neural Infor- mation Processing Systems (NeurIPS’20) 33 (2020), 10647–10658

2020
[13]

Deli. 2024. DL333501 Power Monitor. . https://www.delitoolsglobal.com/Power- Monitor-DL333501.html

2024
[14]

Sen Deng, Mengyuan Li, Yining Tang, Shuai Wang, Shoumeng Yan, and Yinqian Zhang. 2023. {CipherH}: Automated Detection of Ciphertext Side-channel Vulnerabilities in Cryptographic Implementations. In 32nd USENIX Security Symposium (USENIX Security 23) . 6843–6860

2023
[15]

Yunjie Deng, Chenxu Wang, Shunchang Yu, Shiqing Liu, Zhenyu Ning, Kevin Leach, Jin Li, Shoumeng Yan, Zhengyu He, Jiannong Cao, et al. 2022. Strongbox: A gpu tee on arm endpoints. In Proceedings of the 2022 ACM SIGSAC Conference on Computer and Communications Security (CCS’22) ...

2022
[16]

Tarek Elgamal and Klara Nahrstedt. 2020. Serdab: An IoT Framework for Par- titioning Neural Networks Computation across Multiple Enclaves. In Proc. of IEEE/ACM CCGRID. 519–528

2020
[17]

Biyi Fang, Xiao Zeng, and Mi Zhang. 2018. Nestdnn: Resource-aware multi- tenant on-device deep learning for continuous mobile vision. In Proceedings of the 24th Annual International Conference on Mobile Computing and Networking (MobiCom’18). 115–127

2018
[18]

Xueluan Gong, Rubin Wei, Ziyao Wang, Yuchen Sun, Jiawen Peng, Yanjiao Chen, and Qian Wang. 2024. Beowulf: Mitigating Model Extraction Attacks Via Reshaping Decision Regions. In Proceedings of the 2024 on ACM SIGSAC Conference on Computer and Communications Security (CCS’24) . ...

2024
[19]

Liwei Guo and Felix Xiaozhu Lin. 2022. Minimum viable device drivers for ARM TrustZone. In Proceedings of the Seventeenth European Conference on Computer Systems (EuroSys’22). 300–316

2022
[20]

Peizhen Guo, Bo Hu, and Wenjun Hu. 2021. Mistify: Automating DNN Model Porting for On-Device Inference at the Edge. In 18th USENIX Symposium on Networked Systems Design and Implementation (NSDI’21) . 705–719

2021
[21]

Kaiming He, Xiangyu Zhang, Shaoqing Ren, and Jian Sun. 2016. Deep residual learning for image recognition. In Proceedings of the IEEE conference on computer vision and pattern recognition (CVPR’16) . 770–778

2016
[22]

Jiahui Hou, Huiqi Liu, Yunxin Liu, Yu Wang, Peng-Jun Wan, and Xiang-Yang Li. 2021. Model Protection: Real-Time Privacy-Preserving Inference Service for Model Privacy at the Edge. IEEE Transactions on Dependable and Secure Computing (TDSC) 19, 6 (2021), 4270–4284

2021
[23]

Weizhe Hua, Muhammad Umar, Zhiru Zhang, and G Edward Suh. 2022. Guardnn: secure accelerator architecture for privacy-preserving deep learning. In Proceed- ings of the 59th ACM/IEEE Design Automation Conference (DAC’22) . 349–354

2022
[24]

Kai Huang and Wei Gao. 2022. Real-time neural network inference on extremely weak devices: agile offloading with explainable AI. In Proceedings of the 28th Annual International Conference on Mobile Computing And Networking (Mobi- Com’22). 200–213

2022
[25]

Kai Huang, Boyuan Yang, and Wei Gao. 2023. Elastictrainer: Speeding up on- device training with runtime elastic tensor selection. In Proceedings of the 21st Annual International Conference on Mobile Systems, Applications and Services (MobiSys’23). 56–69

2023
[26]

Matthew Jagielski, Nicholas Carlini, David Berthelot, Alex Kurakin, and Nicolas Papernot. 2020. High accuracy and high fidelity extraction of neural networks. In 29th USENIX security symposium (USENIX Security’20) . 1345–1362

2020
[27]

Fucheng Jia, Deyu Zhang, Ting Cao, Shiqi Jiang, Yunxin Liu, Ju Ren, and Yaoxue Zhang. 2022. CoDL: efficient CPU-GPU co-execution for deep learning inference on mobile devices. In Proceedings of the 20th Annual International Conference on Mobile Systems, Applications and Servic...

2022
[28]

Jinyuan Jia, Ahmed Salem, Michael Backes, Yang Zhang, and Neil Zhenqiang Gong. 2019. Memguard: Defending against black-box membership inference at- tacks via adversarial examples. InProceedings of the 2019 ACM SIGSAC conference on computer and communications security (CCS’19) ...

2019
[29]

Wenbo Jiang, Hongwei Li, Guowen Xu, Tianwei Zhang, and Rongxing Lu. 2023. A comprehensive defense framework against model extraction attacks. IEEE Transactions on Dependable and Secure Computing 21, 2 (2023), 685–700

2023
[30]

Dongwoo Kim and Cyril Guyot. 2023. Optimized privacy-preserving cnn in- ference with fully homomorphic encryption. IEEE Transactions on Information Forensics and Security 18 (2023), 2175–2187

2023
[31]

Alex Krizhevsky, Geoffrey Hinton, et al. 2009. Learning multiple layers of features from tiny images. (2009)

2009
[32]

Ya Le and Xuan Yang. 2015. Tiny imagenet visual recognition challenge. CS 231N 7, 7 (2015), 3

2015
[33]

Dayeol Lee, David Kohlbrenner, Shweta Shinde, Dawn Song, and Krste Asanovic. 2019. Keystone: A framework for architecting tees. arXiv preprint arXiv:1907.10119 (2019)

2019 arXiv
[34]

Taegyeong Lee, Zhiqi Lin, Saumay Pushp, Caihua Li, Yunxin Liu, Youngki Lee, Fengyuan Xu, Chenren Xu, Lintao Zhang, and Junehwa Song. 2019. Occlumency: Privacy-preserving Remote Deep-learning Inference Using SGX. In The 25th An- nual International Conference on Mobile Computing...

2019
[35]

Duo Li, Junxiang Bai, and Wenling Li. 2022. Multi-sensor Data Consistency and Fusion Based on Jensen-Shannon Divergence. In International Conference on Guidance, Navigation and Control . Springer, 5595–5605

2022
[36]

Mengyuan Li, Yinqian Zhang, Huibo Wang, Kang Li, and Yueqiang Cheng. 2021. CIPHERLEAKS: Breaking Constant-time Cryptography on AMD SEV via the Ciphertext Side Channel. In 30th USENIX Security Symposium (USENIX Security 21). USENIX Association, 717–732

2021
[37]

Yugeng Liu, Rui Wen, Xinlei He, Ahmed Salem, Zhikun Zhang, Michael Backes, Emiliano De Cristofaro, Mario Fritz, and Yang Zhang. 2022. ML-Doctor: Holistic Risk Assessment of Inference Attacks against Machine Learning Models. In 31st USENIX Security Symposium (USENIX Security’22...

2022
[38]

Fan Mo, Ali Shahin Shamsabadi, Kleomenis Katevas, Soteris Demetriou, Ilias Leontiadis, Andrea Cavallaro, and Hamed Haddadi. 2020. DarkneTZ: Towards Model Privacy at the Edge using Trusted Execution Environments. InProceedings of the 18th International Conference on Mobile Syst...

2020
[39]

Fan Mo, Zahra Tarkhani, and Hamed Haddadi. 2024. Machine learning with confidential computing: A systematization of knowledge.ACM computing surveys (CSUR) 56, 11 (2024), 1–40

2024
[40]

NVIDIA. 2022. NVIDIA CONFIDENTIAL COMPUTING. https://www.nvidia. com/en-us/data-center/solutions/confidential-computing

2022
[41]

Tribhuvanesh Orekondy, Bernt Schiele, and Mario Fritz. 2019. Knockoff nets: Stealing functionality of black-box models. In Proceedings of the IEEE/CVF con- ference on computer vision and pattern recognition (CVPR’19) . 4954–4963

2019
[42]

Heejin Park and Felix Xiaozhu Lin. 2023. Safe and Practical GPU Computation in TrustZone. In Proceedings of the Eighteenth European Conference on Computer Systems (EuroSys’23). 505–520. 13 Tong Sun1, Bowen Jiang 1, Hailong Lin 1, Borui Li 2, Yixiao Teng1, Yi Gao 1, and Wei Dong1

2023
[43]

Sandro Pinto and Nuno Santos. 2019. Demystifying Arm TrustZone: A Compre- hensive Survey. ACM Computing Surveys (CSUR) 51, 6 (2019), 1–36

2019
[44]

Keegan Ryan. 2019. Hardware-backed heist: Extracting ECDSA keys from qual- comm’s trustzone. InProceedings of the 2019 ACM SIGSAC Conference on Computer and Communications Security (CCS’19) . 181–194

2019
[45]

Ahmed Salem, Yang Zhang, Mathias Humbert, Pascal Berrang, Mario Fritz, and Michael Backes. 2020. Ml-leaks: Model and data independent membership inference attacks and defenses on machine learning models. In Proc. of 26th Annual Network and Distributed System Security Symposium...

2020
[46]

Mark Sandler, Andrew Howard, Menglong Zhu, Andrey Zhmoginov, and Liang- Chieh Chen. 2018. Mobilenetv2: Inverted residuals and linear bottlenecks. In Proceedings of the IEEE conference on computer vision and pattern recognition (CVPR’18). 4510–4520

2018
[47]

Ramprasaath R Selvaraju, Michael Cogswell, Abhishek Das, Ramakrishna Vedan- tam, Devi Parikh, and Dhruv Batra. 2017. Grad-cam: Visual explanations from deep networks via gradient-based localization. In Proceedings of the IEEE inter- national conference on computer vision (CVPR...

2017
[48]

Tianxiang Shen, Ji Qi, Jianyu Jiang, Xian Wang, Siyuan Wen, Xusheng Chen, Shixiong Zhao, Sen Wang, Li Chen, Xiapu Luo, et al. 2022. SOTER: Guarding Black-box Inference for General Neural Networks at the Edge. In 2022 USENIX Annual Technical Conference (ATC’22). 723–738

2022
[49]

Yun Shen, Xinlei He, Yufei Han, and Yang Zhang. 2022. Model stealing attacks against inductive graph neural networks. In 2022 IEEE Symposium on Security and Privacy (S&P’22). IEEE, 1175–1192

2022
[50]

Karen Simonyan and Andrew Zisserman. 2015. Very Deep Convolutional Net- works for Large-scale Image Recognition. In Proc. of 3rd International Conference on Learning Representations (ICLR’15)

2015
[51]

Gowthami Somepalli, Liam Fowl, Arpit Bansal, Ping Yeh-Chiang, Yehuda Dar, Richard Baraniuk, Micah Goldblum, and Tom Goldstein. 2022. Can neural nets learn the same model twice? investigating reproducibility and double descent from the decision boundary perspective. In Proceedi...

2022
[52]

Yu Sun, Gaojian Xiong, Jianhua Liu, Zheng Liu, and Jian Cui. 2024. TSQP: Safeguarding Real-Time Inference for Quantization Neural Networks on Edge Devices. In 2025 IEEE Symposium on Security and Privacy (S&P’25) . IEEE Com- puter Society, 1–1

2024
[53]

Zhichuang Sun, Ruimin Sun, Changming Liu, Amrita Roy Chowdhury, Long Lu, and Somesh Jha. 2023. ShadowNet: A Secure and Efficient On-Device Model Inference System for Convolutional Neural Networks. In 2023 IEEE Symposium on Security and Privacy (S&P’23)

2023
[54]

Zhichuang Sun, Ruimin Sun, Long Lu, and Alan Mislove. 2021. Mind your weight (s): A large-scale study on insufficient machine learning model protection in mobile apps. In30th USENIX security symposium (USENIX security 21). 1955–1972

2021
[55]

Mukund Sundararajan, Ankur Taly, and Qiqi Yan. 2017. Axiomatic attribution for deep networks. In International Conference on Machine Learning (ICML’17) . PMLR, 3319–3328

2017
[56]

Xinyu Tang, Saeed Mahloujifar, Liwei Song, Virat Shejwalkar, Milad Nasr, Amir Houmansadr, and Prateek Mittal. 2022. Mitigating membership inference attacks by{Self-Distillation} through a novel ensemble architecture. In 31st USENIX Security Symposium (USENIX Security 22) . 1433–1450

2022
[57]

Florian Tramer and Dan Boneh. 2019. Slalom: Fast, Verifiable and Private Execu- tion of Neural Networks in Trusted Hardware. InProc. of International Conference on Learning Representations (ICLR’19)

2019
[58]

Stavros Volos, Kapil Vaswani, and Rodrigo Bruno. 2018. Graviton: Trusted Exe- cution Environments on GPUs. In Proc. of 13th USENIX Symposium on Operating Systems Design and Implementation (OSDI’18) . 681–696

2018
[59]

Chenxu Wang, Fengwei Zhang, Yunjie Deng, Kevin Leach, Jiannong Cao, Zhenyu Ning, Shoumeng Yan, and Zhengyu He. 2024. CAGE: Complementing Arm CCA with GPU Extensions. In Network and Distributed System Security Symposium (NDSS’24)

2024
[60]

Jinwen Wang, Yujie Wang, and Ning Zhang. 2023. Secure and timely gpu execu- tion in cyber-physical systems. InProceedings of the 2023 ACM SIGSAC Conference on Computer and Communications Security (CCS’23) . 2591–2605

2023
[61]

Manni Wang, Shaohua Ding, Ting Cao, Yunxin Liu, and Fengyuan Xu. 2021. Asymo: scalable and efficient deep-learning inference on asymmetric mobile cpus. In Proceedings of the 27th Annual International Conference on Mobile Computing and Networking (MobiCom’21). 215–228

2021
[62]

Wenxuan Wang and Zhaopeng Tu. 2020. Rethinking the Value of Transformer Components. In Proceedings of the 28th International Conference on Computational Linguistics (COLING’20). 6019–6029

2020
[63]

Huizi Xiao, Qingyang Zhang, Qingqi Pei, and Weisong Shi. 2021. Privacy- preserving neural network inference framework via homomorphic encryption and sgx. In 2021 IEEE 41st International Conference on Distributed Computing Systems (ICDCS’21). IEEE, 751–761

2021
[64]

Xueshuo Xie, Haoxu Wang, Zhaolong Jian, Tao Li, Wei Wang, Zhiwei Xu, and Guiling Wang. 2024. Memory-Efficient and Secure DNN Inference on TrustZone- enabled Consumer IoT Devices. In Proc. of IEEE International Conference on Computer Communications (INFOCOM’24)

2024
[65]

Guoliang Xing, Tian Wang, Zhihui Xie, and Weijia Jia. 2008. Rendezvous planning in wireless sensor networks with mobile elements. IEEE Transactions on Mobile Computing 7, 12 (2008), 1430–1443

2008
[66]

Mengwei Xu, Dongqi Cai, Yaozong Wu, Xiang Li, and Shangguang Wang. 2024. FwdLLM: Efficient Federated Finetuning of Large Language Models with Per- turbed Inferences. In 2024 USENIX Annual Technical Conference (USENIX ATC’24). 579–596

2024
[67]

Mengwei Xu, Jiawei Liu, Yuanqiang Liu, Felix Xiaozhu Lin, Yunxin Liu, and Xuanzhe Liu. 2019. A first look at deep learning apps on smartphones. In The World Wide Web Conference (WWW’19). 2125–2136

2019
[68]

Zhenliang Xue, Yixin Song, Zeyu Mi, Le Chen, Yubin Xia, and Haibo Chen. 2024. PowerInfer-2: Fast Large Language Model Inference on a Smartphone. arXiv preprint arXiv:2406.06282 (2024)

2024 arXiv
[69]

Wangsong Yin, Mengwei Xu, Yuanchun Li, and Xuanzhe Liu. 2024. Llm as a system service on mobile devices. arXiv preprint arXiv:2403.11805 (2024)

2024 arXiv
[70]

Mu Yuan, Lan Zhang, Fengxiang He, Xueting Tong, and Xiang-Yang Li. 2022. Infi: end-to-end learnable input filter for resource-efficient mobile-centric inference. In Proceedings of the 28th Annual International Conference on Mobile Computing And Networking (MobiCom’22). 228–241

2022
[71]

Yuanyuan Yuan, Zhibo Liu, Sen Deng, Yanzuo Chen, Shuai Wang, Yinqian Zhang, and Zhendong Su. 2024. CipherSteal: Stealing Input Data from TEE-Shielded Neural Networks with Ciphertext Side Channels. In 2025 IEEE Symposium on Security and Privacy (S&P’25) . 79–79

2024
[72]

Yuanyuan Yuan, Zhibo Liu, Sen Deng, Yanzuo Chen, Shuai Wang, Yinqian Zhang, and Zhendong Su. 2024. HyperTheft: Thieving Model Weights from TEE-Shielded Neural Networks via Ciphertext Side Channels. In Proceedings of the 2024 on ACM SIGSAC Conference on Computer and Communicati...

2024
[73]

Chiyuan Zhang, Samy Bengio, and Yoram Singer. 2022. Are all layers created equal? Journal of Machine Learning Research 23, 67 (2022), 1–28

2022
[74]

Qiyang Zhang, Xiangying Che, Yijie Chen, Xiao Ma, Mengwei Xu, Schahram Dustdar, Xuanzhe Liu, and Shangguang Wang. 2023. A comprehensive deep learning library benchmark and optimal library selection. IEEE Transactions on Mobile Computing (2023)

2023
[75]

Ziqi Zhang, Chen Gong, Yifeng Cai, Yuanyuan Yuan, Bingyan Liu, Ding Li, Yao Guo, and Xiangqun Chen. 2024. No Privacy Left Outside: On the (In-) Security of TEE-Shielded DNN Partition for On-Device ML. In 2024 IEEE Symposium on Security and Privacy (S&P’24) . 52–52

2024
[76]

Zheng Zhang, Na Wang, Ziqi Zhang, Yao Zhang, Tianyi Zhang, Jianwei Liu, and Ye Wu. 2024. GroupCover: A Secure, Efficient and Scalable Inference Frame- work for On-device Model Protection based on TEEs. In Forty-first International Conference on Machine Learning (ICML’24) . 14

2024
[2023]

InProceedings of the 29th Annual International Conference on Mobile Computing and Networking (MobiCom’23)

Federated few-shot learning for mobile nlp. InProceedings of the 29th Annual International Conference on Mobile Computing and Networking (MobiCom’23) . 1–17

Pith tools

Reviewed August 7, 2026 · model on record in the stance chip above.

[1] [1]

Raspberry Pi 3 Model B

2016. Raspberry Pi 3 Model B. https://www.raspberrypi.com/products/raspberry- pi-3-model-b/

work page 2016

[2] [2]

Hikey960

2017. Hikey960. https://www.96boards.org/product/hikey960/

work page 2017

[3] [3]

Raspberry Pi 3 Model B+

2018. Raspberry Pi 3 Model B+. https://www.raspberrypi.com/products/ raspberry-pi-3-model-b-plus/

work page 2018

[4] [4]

ARM. 2022. TrustZone for Cortex-A. https://www.arm.com/technologies/ trustzone-for-cortex-a

work page 2022

[5] [5]

Arm. 2023. Arm Confidential Compute Architecture . https://www.arm.com/ architecture/security-features/arm-confidential-compute-architecture

work page 2023

[6] [6]

Sebanjila Kevin Bukasa, Ronan Lashermes, Hélène Le Bouder, Jean-Louis Lanet, and Axel Legay. 2018. How TrustZone could be bypassed: Side-channel attacks on a modern system-on-chip. In Information Security Theory and Practice: 11th IFIP WG 11.2 International Conference, WISTP 2017, Heraklion, Crete, Greece, September 28–29, 2017, Proceedings 11 . Springer, 93–109

work page 2018

[7] [7]

Dongqi Cai, Shangguang Wang, Yaozong Wu, Felix Xiaozhu Lin, and Mengwei Xu

work page

[8] [8]

Dingfan Chen, Ning Yu, and Mario Fritz. 2022. Relaxloss: Defending membership inference attacks without losing utility. In International Conference on Learning Representations (ICLR’22)

work page 2022