WebAssembly helps protect AI models on edge devices but adds overhead
Protecting CPU AI On Edge TEEs: WebAssembly's Promise and Practical Challenges
Cryptography and SecuritySoftware Engineering
Summary
AI models running on small devices can be copied if bad users get control, so the authors worked on protecting these models using a special secure area in the hardware called a Trusted Execution Environment. They made it possible to run AI code compiled to WebAssembly in this secure space without changing the code. Their system encrypts the AI code so only the secure environment can decrypt and run it. This approach adds some extra delay but helps keep AI models safe without much extra work.
What this means in practice
- •For embedded systems developers: Run unmodified AI models securely on Arm TrustZone hardware using WebAssembly and encryption to protect IP with limited code changes.
- •For iot product engineers: Safeguard AI model code in edge devices by deploying encrypted WebAssembly binaries that can only run in secure hardware enclaves.
Authors
Friedrich Vandenberghe, Lachlan Gunn, Bruno Volckaert, Merlijn Sebrechts
Abstract
AI models on edge hardware contain important intellectual property (IP), but an adversary can steal it when they achieve root access. Trusted Execution Environments (TEE) like Arm TrustZone protect against these Operating System (OS) level attacks. However, they are challenging to use. More precisely, it is difficult to run unaltered applications inside a TEE. This work presents a solution that allows the execution of unaltered AI models, compiled to WebAssembly, on the WebAssembly Micro Runtime (WAMR) in OP-TEE for Arm TrustZone. Additionally, this work provides an AI model distributor that encrypts the WebAssembly binary and places the encryption key in one of the device's fuses. This way, only the WAMR Trusted Application (TA) in OP-TEE can decrypt and execute the AI model. A thorough evaluation of our solution shows that it incurs an additional overhead of 22% in comparison to an application manually ported to OP-TEE, while also facilitating the execution of unaltered AI models with an additional inference latency of 6% without significant porting effort. Overall, there is a pressing need to safeguard the IP of AI models and this work shows that there is a real promise in WebAssembly, but there remain some practical challenges.