Local image model streaming limits data theft from captured devices
When Rotation Bounds Nothing: Streaming Image Classifiers to Field Nodes Under Physical Capture
Cryptography and Security
Summary
Devices that run image recognition locally can have their trained models stolen if someone takes the device. This paper looks at a way to reduce theft by streaming only parts of the model temporarily into memory, so nothing stays on the device long enough to steal easily. The researchers tested this streaming idea on real network data but found that a skilled attacker could still recover most or all of the model depending on how it was trained and shared. The paper shows how different approaches to sharing model parts affect how hard it is for an attacker to steal the model.
What this means in practice
- •For edge device engineers: Manage streamed model components on field devices to limit exposure of sensitive image classifiers during seizures or device theft.
- •For mobile network operators: Design device data delivery strategies to increase the cost and difficulty of extracting deployed image models from compromised nodes.
Authors
Daniel Gilkarov, Ran Dubin
Abstract
Field nodes run image classifiers locally, exposing a first-class asset, the trained model, to theft. Trusted-execution enclaves, collaborative-inference splits, and encrypted storage assume the device owner is the adversary from deployment. Here the operator owns the node, and an adversary seizing it reads only what cold-boot capture finds resident. One answer stores nothing: a chunkable multi-exit model streams into volatile memory, rotating to bound residency. We characterise the capture envelope on real LTE traces across two victims of one architecture, against passive and adaptive adversaries. Neither survives a capable adversary; recovery cost alone differs. Against a from-scratch victim the uncaptured stages must be learned: the adaptive adversary gains most at shallow seizures, ends the CIFAR-10 envelope at every rotation, and stays rotation-bounded on CIFAR100, from 42.6% of usable seizures at 5 s to 86.8% at 30 s. Against the same architecture sliced from a public pretrained backbone, the adversary downloads those stages, recovering at least 90% of maximum accuracy at all depths, taking usable CIFAR-100 seizures from 0.0% to 97.3% at 5 s, given the victim's full labelled training set. Delivery-side secrecy raises a seizure's price; a public copy of the withheld stages erases it.