Source-linked AI summary
DarkneTZ: Towards Model Privacy at the Edge using Trusted Execution Environments
Fan Mo, Ali Shahin Shamsabadi, Kleomenis Katevas, Soteris Demetriou, Ilias Leontiadis, Andrea Cavallaro, Hamed Haddadi
TL;DR
DNNs deployed on edge devices can leak training-data information through MIAs, creating model-privacy risks. DarkneTZ partitions DNN layers between an untrusted operating-system environment and an on-device TEE, then evaluates resource costs and MIA resistance. Hiding a single layer reduces attack success to random guessing with 3% overhead, while full TEE utilization incurs up to 10% overhead.
Problem
DNNs on edge devices can leak private training-data information through effective MIAs, creating privacy risks for deployed models.
Method
DarkneTZ partitions sensitive DNN layers into an edge device’s TEE and executes the remaining layers in the untrusted REE while measuring CPU time, memory, and power.
Results
3% overhead accompanies hiding a single layer while reducing MIA success to random guessing and preserving inference accuracy; full TEE utilization incurs up to 10% overhead.
Takeaways & Limitations
DarkneTZ improves model privacy for pre-trained edge DNNs at relatively low performance cost, including protection when only a single layer is hidden.
Takeaways & Limitations
The evaluation assumes inference and fine-tuning expose different information for early layers, with activations only visible during inference but activations and gradients visible during fine-tuning.
Abstract
from arXiv · showhide
We present DarkneTZ, a framework that uses an edge device's Trusted Execution Environment (TEE) in conjunction with model partitioning to limit the attack surface against Deep Neural Networks (DNNs). Increasingly, edge devices (smartphones and consumer IoT devices) are equipped with pre-trained DNNs for a variety of applications. This trend comes with privacy risks as models can leak information about their training data through effective membership inference attacks (MIAs). We evaluate the performance of DarkneTZ, including CPU execution time, memory usage, and accurate power consumption, using two small and six large image classification models. Due to the limited memory of the edge device's TEE, we partition model layers into more sensitive layers (to be executed inside the device TEE), and a set of layers to be executed in the untrusted part of the operating system. Our results show that even if a single layer is hidden, we can provide reliable model privacy and defend against state of the art MIAs, with only 3% performance overhead. When fully utilizing the TEE, DarkneTZ provides model protections with up to 10% overhead.
1 INTRODUCTION
DarkneTZ addresses privacy risks from DNNs deployed on constrained edge devices, where models can leak training-data information through MIAs. It partitions sensitive layers into a device TEE and evaluates whether this protects models with low overhead.
- DNN deployment on constrained edge devices is increasing, while local models can still leak private training information through MIAs.
- Differential-privacy-based MIA defenses can improve privacy while adversely affecting model prediction accuracy.
- TEE-based isolation separates sensitive computation from the untrusted operating-system environment on edge devices.
- DarkneTZ partitions DNN layers between the REE and TEE and measures CPU time, memory usage, and power across two small and six large image-classification models.
- 10% overhead results when fully utilizing TrustZone to protect model layers, supporting hardware-based model privacy on edge devices.
- 3% overhead accompanies hiding a single output layer, reducing the adversary’s MIA success rate to random guessing while preserving inference accuracy.
2 BACKGROUND AND RELATED WORK
DNNs can memorize training-data information that enables MIAs, while TEEs offer hardware-isolated protection with lower computational cost than some software-based protections. Prior TEE approaches largely target cloud architectures or different layers and privacy threats than DarkneTZ.
- 2.1 Privacy risks of Deep Neural Networks: DNN layers memorize different information: early layers learn general features, whereas later layers learn task-specific information.
- 2.1 Privacy risks of Deep Neural Networks: MIAs infer whether a record was in training data; white-box attacks additionally use internal activations and gradients and are stronger than black-box attacks.
- 2.2 Deep learning in the TEE: A TEE isolates trusted data and programs from the untrusted REE using hardware and software mechanisms.
- 2.2 Deep learning in the TEE: TEE protection can offer better computational performance than fully homomorphic encryption, which significantly increases computation cost.
- 2.2 Deep learning in the TEE: Prior TEE-based DNN work primarily targets cloud-oriented architectures, including complete TEE-resident models and SGX-based partitioning.
- 2.1 Privacy risks of Deep Neural Networks: Differential privacy can negatively affect prediction accuracy when its training noise is not carefully designed.
- 2.2 Deep learning in the TEE: Server-client partitioning often protects early layers because they can reveal private inputs, whereas DarkneTZ targets later layers associated with membership information.
3 DARKNETZ
DarkneTZ protects edge-deployed DNNs by partitioning layers between an untrusted REE and a trusted TEE under a threat model that trusts only the device TEE. Its execution flow transfers activations into the TEE for protected layers and returns normalized predictions.
- 3.1 Threat Model: DarkneTZ considers an adversary with full access to the edge device’s REE while trusting only the TEE for data and software confidentiality and integrity.
- 3.2 Design Goals: DarkneTZ uses an on-device TEE and standard architectures such as Arm TrustZone to protect model layers and outputs at low cost.
- 3.3 DarkneTZ Architecture: The framework transparently partitions layers between a Client Application in the REE and a Trusted Application in the TEE for inference or fine-tuning.
- 3.3 DarkneTZ Architecture: Protecting later layers targets MIAs because those layers have a higher probability of leaking private training-data information.
- 3.3 DarkneTZ Architecture: Sensitive layers can be pre-provisioned in the TEE by an analyst or device OEM, with secret provisioning also possible over the air.
- 3.4 DNN Partitioned Execution: The REE processes non-sensitive layers, then passes encrypted sensitive layers and intermediate activations to the TEE when the model-owner configuration requires protected execution.
- 3.4 DNN Partitioned Execution: DarkneTZ computes protected forward-pass layers in the TEE, normalizes final outputs to control membership leakage, and returns predictions through shared memory.
- 3.4 DNN Partitioned Execution: During fine-tuning, the TEE computes gradients and updates parameters, then encrypts protected layers before transferring the fine-tuned model back to the REE.
4 EXPERIMENT SETTINGS
The experiments evaluate DarkneTZ across image-classification models, edge-device resource metrics, and white-box membership inference attacks under different layer partitions.
- Models and Datasets: AlexNet and VGG-7 are evaluated on CIFAR-100 and ImageNet Tiny, while MIA defence experiments also use ResNet-110.CIFAR-100 has 50k training and 10k test images across 100 classes; ImageNet Tiny has 100k training and 10k test images across 200 classes.
- Implementation Platform: The implementation runs on Open Portable TEE over Arm TrustZone using the Darknet library and is tested on a Hikey 960 board with 16MiB secure memory.The board provides four Cortex-A73 and four Cortex-A53 cores, 4GB LPDDR4 SDRAM, and 2MiB shared non-secure memory.
- Performance Measurement: DarkneTZ partitions models between the untrusted REE and trusted TEE while measuring CPU execution time, memory usage, and power consumption.Experiments compare complete REE execution with configurations that keep increasingly sensitive layers inside the TEE.
- Performance Measurement: CPU execution time and REE memory usage are collected through /proc/self/status, with CPU time separated into user-mode and kernel-mode components.TEE memory is excluded from RSS because the REE cannot access that information without compromising TEE confidentiality.
- Performance Measurement: Power is measured with a Monsoon High Voltage Power Monitor configured for the Hikey board at 50Hz sampling.The monitor powers the board at 12V while recording consumed current.
- Measuring Privacy in MIAs: White-box MIAs expose internal model information, and experiments analyze layer exposure by progressively adding layers from either network end.The attack uses activations, outputs, loss, and loss gradients; inference exposes forward activations, while fine-tuning also exposes gradients.
5 EVALUATION RESULTS
DarkneTZ evaluates the resource costs and privacy effects of protecting consecutive DNN layers in TrustZone. Protecting the last layer substantially reduces membership-inference attack success with limited overhead, while broader protection increases costs depending on model size and layer type.
- Evaluation scope: DarkneTZ measures CPU time, memory usage, power consumption, and white-box MIA performance across layer-partition choices.The evaluation covers training and inference on small and large image-classification models.
- CPU execution time: 10%: fully utilizing TrustZone during training increases CPU time, while protecting only the last layer has negligible CPU effect.For inference, protecting only the last layer increases CPU time by around 3%, rising up to 10× when the maximum possible number of layers is protected.
- CPU execution time: CPU-time turning points depend on which layers enter TrustZone, with maxpooling and dropout affecting training and convolutional layers affecting inference.The reported turning points are statistically significant compared with the preceding configuration.
- CPU execution time: During training, protecting non-trainable layers adds transfers of preceding trainable layers, so trainable layers and their preceding non-trainable layers should be protected together.This transfer pattern places training turning points one layer earlier than inference turning points.
- Memory and power: Inference in TrustZone uses less REE memory, while training memory remains similar to training without TrustZone.Moving layers into TrustZone reduces REE memory because those layers occupy secure memory instead.
- Memory and power: Power decreases during training but increases during inference as more layers move into TrustZone, following CPU-time trends and additional TEE-library executions.The authors associate inference increases with extra CPU executions for invoking TEE libraries and related secure-memory operations.
- Large-model performance: Under 2%: protecting the last layer of large ImageNet models increases CPU time, memory usage, and power consumption by less than 2% for all tested models.Smaller models tend to show higher CPU-time increase rates than larger models.
- Performance summary: 3%: securing the last layer increases inference CPU time and power consumption by 3%, while memory usage does not increase.During fine-tuning, the corresponding memory increase is no more than 1% and power increase no more than 0.5%.
6 DISCUSSION
The discussion examines DarkneTZ’s model-size, hardware, extensibility, and privacy–utility trade-offs. It reports that isolating sensitive layers can preserve utility while adding limited resource costs and supporting broader output-based defenses.
- Effects of the model size: Larger models tend to incur a lower rate of CPU-time increase under TrustZone protection than smaller models.The authors attribute this to larger models’ last layers consuming a smaller proportion of total computational resources.
- Effects of different hardware: DarkneTZ’s overhead varies with hardware because faster processors make TrustZone-related operations more noticeable relative to ordinary deep-learning execution.The Hikey board’s faster matrix-optimized processors show a higher rate of cost increase than the comparison Raspberry Pi hardware.
- TEE capacity: A typical 16MiB TrustZone secure-memory configuration is sufficient to hold at least the maximum number of layers supported for some model configurations.The cited passage states that the maximum protected layer count depends on model size and configuration.
- Extrapolating for other mobile-friendly models: DarkneTZ’s performance results do not directly establish the footprint of Squeezenet or Mobilenet because their convolutional layers are unsupported by the current Darknet implementation.The authors expect similar privacy and TEE performance footprints based on comparable model sizes.
- Improving performance: The CPU-only implementation could be extended by moving always-REE first layers to GPUs or specialized deep-learning processors.The discussion cites prior work combining TEE processing with GPU execution and reports a 4x to 11x increase for verifiable and private inference.
- Defending against other adversaries: Output control may also defend against training-based model inversion and GAN attacks because these attacks depend heavily on model outputs.Different output policies, including Top-1, Top-5, or all-class outputs, are presented as privacy settings that strongly defend against MIAs.
- Preserving model utility: Hiding sensitive layers in TrustZone preserves prediction accuracy because DarkneTZ does not obfuscate the model.The discussion contrasts this with differential privacy, whose noise addition can decrease prediction accuracy.
7 CONCLUSION
The conclusion presents DarkneTZ as an on-device TrustZone technique for improving privacy in deployed pre-trained DNNs. Across eight image-classification models, it reports low overhead for protecting sensitive layers despite TEE memory limits.
- 7 CONCLUSION: DarkneTZ protects sensitive last layers of deployed, pre-trained DNNs inside an on-device TrustZone TEE.The evaluation covers two small models trained on CIFAR-100 and ImageNet Tiny, plus six large models trained on ImageNet.
- 7 CONCLUSION: Under 3% overhead is reported for CPU time, memory usage, and power consumption when protecting the last layer.The conclusion contrasts this with 10% overhead when fully utilizing the TEE’s secure memory.
- 7 CONCLUSION: 10% overhead is reported when fully utilizing the TEE’s available secure memory for model-layer protection.The authors characterize DarkneTZ as improving privacy at relatively low performance cost despite memory limitations.
- 7 CONCLUSION: The authors characterize DarkneTZ as a step toward stronger privacy protection and high model utility without significant local-computing overhead.This conclusion follows the reported low-cost protection across the evaluated model and dataset settings.