Edge device neural network leaks risk attacks on other devices
Model Exposure on One Device Endangers Others: Rethinking Edge Neural Network Security across Devices
Cryptography and SecurityArtificial Intelligence
Summary
Neural networks running on smartphones and IoT devices can be copied by hackers, who then use these copies to attack other devices using the same model. This problem means that if one device is compromised, others are at risk as well. The paper proposes a method called VeilNN that scrambles models on devices in a way that keeps them working but makes attacks harder to transfer between devices. Tests show this method significantly reduces the risk of these cross-device attacks.
What this means in practice
- •For mobile app developers: Protect on-device AI models from being copied and exploited to attack other users' devices sharing the same model.
- •For iot device manufacturers: Enhance security of embedded neural networks in IoT devices to prevent attacks spreading across devices using identical AI models.
Authors
Yuyang Zhang, Kangjie Chen, Yihui Jin, Run Wang
Abstract
Neural networks (NNs) are increasingly deployed on edge devices such as mobile and IoT platforms, offering low latency and improved privacy compared to cloud-based deployment. However, on-device models embedded in mobile applications can be unpacked and exposed to adversaries, enabling cross-node attacks in centrally distributed ecosystems, where adversarial examples crafted on one compromised device transfer effectively to other nodes sharing the same models. To address this threat, we propose VeilNN, a defense framework that reduces adversarial transferability across on-device models via model obfuscation. The core idea of VeilNN is to introduce controlled model diversity while preserving original task functionality. Specifically, VeilNN applies stealthy and irreversible obfuscation at both the architectural and parameter levels through network cell obfuscation and layer assembling, and is applicable to diverse NN architectures, including MLPs, CNNs, and Vision Transformers. Extensive experiments demonstrate that VeilNN effectively defends against cross-node attacks, achieving an average defense success of 49.19% and up to 81.19% across four adversarial attack types, with more than 33.16% improvement over existing defenses.