Verifiable and Confidential DNN Inference on Low-End Edge Devices
2026-06-05 • Cryptography and Security
Cryptography and Security
AI summaryⓘ
The authors created VECODI, a system that helps run deep learning models securely on small, low-power devices while keeping the model secret and verifying the results. They introduced SHANGRI-LA, a special environment inside the device's security hardware that sits between fully secure and fully unsecure modes. This lets the device run the model in a way that protects it without needing too much extra secure code. They tested VECODI on a real hardware board and showed it uses little memory and runs efficiently, making it practical for secure AI tasks on simple devices.
deep neural network (DNN)edge devicesmodel confidentialityverifiable inferencetrusted execution environment (TEE)TrustZone-MSecure WorldNon-Secure Worldtrusted computing base (TCB)NUCLEO-L552ZE-Q
Authors
Mohamed Khalil Kiri, Ivan De Oliveira Nunes, Aurélien Francillon, Norrathep Rattanavipanon
Abstract
Deploying deep neural network (DNN) inference on low-end edge devices raises two key challenges: protecting model confidentiality against a potentially compromised edge system and enabling verifiable inference without incurring prohibitive overhead. Existing approaches either house partial models and inference software within trusted execution environments (TEEs), resulting in high cost and an application-dependent trusted computing base (TCB), or execute in untrusted environments, providing little security. In this work, we present VECODI, a framework for verifiable and confidential DNN inference on constrained edge devices. At its core, VECODI introduces SHANGRI-LA, a new execution abstraction on TrustZone-M TEEs that establishes a third runtime environment with privileges strictly between the Secure and Non-Secure Worlds. VECODI leverages SHANGRI-LA to execute untrusted inference code in the Non-Secure World while using minimal application-agnostic Secure-World support to protect model confidentiality and enable verifiability (with respect to proper execution of inference code and model parameters) of inference results. We realize VECODI on a real-world NUCLEO-L552ZE-Q development board and open-source its prototype. Our results show VECODI's small TCB, memory footprint, and runtime overhead, making it a practical option for secure inference in low-end edge devices.