Logo
ScienceStack
Table of Contents
Fetching ...
Sign In

MirageNet:A Secure, Efficient, and Scalable On-Device Model Protection in Heterogeneous TEE and GPU System

Huadi Zheng, Li Cheng, Yan Ding

TL;DR

MirageNet proposes ConvShatter, a secure, efficient on-device protection scheme for DNNs in heterogeneous TEE–GPU edge systems. By offline-obfuscating kernels through shared patch bases, decoys, and channel/kernel permutations, and by performing most computations on the GPU with minimal TEE participation via OTP masking, it achieves strong confidentiality with low runtime overhead. Empirical results across multiple models and datasets show substantial reductions in model-extraction success (ASR/Blackbox) while preserving original accuracy and maintaining practical throughput. The framework is designed to integrate with standard inference stacks and aims to be open-sourced for reproducibility and broad adoption.

Abstract

As edge devices gain stronger computing power, deploying high-performance DNN models on untrusted hardware has become a practical approach to cut inference latency and protect user data privacy. Given high model training costs and user experience requirements, balancing model privacy and low runtime overhead is critical. TEEs offer a viable defense, and prior work has proposed heterogeneous GPU-TEE inference frameworks via parameter obfuscation to balance efficiency and confidentiality. However, recent studies find partial obfuscation defenses ineffective, while robust schemes cause unacceptable latency. To resolve these issues, we propose ConvShatter, a novel obfuscation scheme that achieves low latency and high accuracy while preserving model confidentiality and integrity. It leverages convolution linearity to decompose kernels into critical and common ones, inject confounding decoys, and permute channel/kernel orders. Pre-deployment, it performs kernel decomposition, decoy injection and order obfuscation, storing minimal recovery parameters securely in the TEE. During inference, the TEE reconstructs outputs of obfuscated convolutional layers. Extensive experiments show ConvShatter substantially reduces latency overhead with strong security guarantees; versus comparable schemes, it cuts overhead by 16% relative to GroupCover while maintaining accuracy on par with the original model.

MirageNet:A Secure, Efficient, and Scalable On-Device Model Protection in Heterogeneous TEE and GPU System

TL;DR

MirageNet proposes ConvShatter, a secure, efficient on-device protection scheme for DNNs in heterogeneous TEE–GPU edge systems. By offline-obfuscating kernels through shared patch bases, decoys, and channel/kernel permutations, and by performing most computations on the GPU with minimal TEE participation via OTP masking, it achieves strong confidentiality with low runtime overhead. Empirical results across multiple models and datasets show substantial reductions in model-extraction success (ASR/Blackbox) while preserving original accuracy and maintaining practical throughput. The framework is designed to integrate with standard inference stacks and aims to be open-sourced for reproducibility and broad adoption.

Abstract

As edge devices gain stronger computing power, deploying high-performance DNN models on untrusted hardware has become a practical approach to cut inference latency and protect user data privacy. Given high model training costs and user experience requirements, balancing model privacy and low runtime overhead is critical. TEEs offer a viable defense, and prior work has proposed heterogeneous GPU-TEE inference frameworks via parameter obfuscation to balance efficiency and confidentiality. However, recent studies find partial obfuscation defenses ineffective, while robust schemes cause unacceptable latency. To resolve these issues, we propose ConvShatter, a novel obfuscation scheme that achieves low latency and high accuracy while preserving model confidentiality and integrity. It leverages convolution linearity to decompose kernels into critical and common ones, inject confounding decoys, and permute channel/kernel orders. Pre-deployment, it performs kernel decomposition, decoy injection and order obfuscation, storing minimal recovery parameters securely in the TEE. During inference, the TEE reconstructs outputs of obfuscated convolutional layers. Extensive experiments show ConvShatter substantially reduces latency overhead with strong security guarantees; versus comparable schemes, it cuts overhead by 16% relative to GroupCover while maintaining accuracy on par with the original model.
Paper Structure (30 sections, 10 equations, 5 figures, 4 tables, 2 algorithms)

This paper contains 30 sections, 10 equations, 5 figures, 4 tables, 2 algorithms.

Table of Contents

  1. Introduction
  2. Background
  3. Model Stealing
  4. Trusted Execution Environment (TEE)
  5. Victim Models
  6. Adversarial Capabilities
  7. Existing Obfuscation Schemes
  8. System Overview
  9. Design Goals
  10. Threat Model and Security Guarantees
  11. Offline Obfuscation Phase
  12. Secure Inference Phase
  13. Security Properties
  14. Implementation
  15. Standard Convolution
  16. ...and 15 more sections

Figures (5)

  • Figure 1: Illustration of typical interaction modes between users and models. (a) API: Users interact with models via API endpoints. (b) Edge deployment: Developers deploy models directly on the user side for inference. (c) Our approach: Models are encrypted before deployment, with decryption keys securely stored in the user's trusted execution environment (TEE).
  • Figure 2: Overall workflow of the proposed obfuscation framework.
  • Figure 3: Inference process of the proposed obfuscation framework.
  • Figure 4: Cosine similarity heatmaps of convolution kernels. Left: Pre-obfuscation, same-position kernels exhibit high similarity to public checkpoints. Right: Post-ConvShatter, stripe-like patterns remove same-position dominance, frustrating alignment.
  • Figure 5: Defense effectiveness across query budgets on CIFAR-100 (AlexNet/ResNet18/ResNet50/VGG16_BN). ConvShatter consistently undercuts attacker accuracy and outperforms the black-box baseline.