Abstract:More and more edge devices and mobile apps are leveraging deep learning (DL) capabilities. Deploying such models on devices -- referred to as on-device models -- rather than as remote cloud-hosted services, has gained popularity because it avoids transmitting user data off of the device and achieves high response time. However, on-device models can be easily attacked, as they can be accessed by unpacking corresponding apps and the model is fully exposed to attackers. Recent studies show that attackers can easily generate white-box-like attacks for an on-device model or even inverse its training data. To protect on-device models from white-box attacks, we propose a novel technique called model obfuscation. Specifically, model obfuscation hides and obfuscates the key information -- structure, parameters and attributes -- of models by renaming, parameter encapsulation, neural structure obfuscation obfuscation, shortcut injection, and extra layer injection. We have developed a prototype tool ModelObfuscator to automatically obfuscate on-device TFLite models. Our experiments show that this proposed approach can dramatically improve model security by significantly increasing the difficulty of parsing models inner information, without increasing the latency of DL models. Our proposed on-device model obfuscation has the potential to be a fundamental technique for on-device model deployment. Our prototype tool is publicly available at: https://github.com/zhoumingyi/ModelObfuscator.

What problem does this paper attempt to address?

The paper attempts to address the problem of protecting machine learning models deployed on devices from software analysis and reverse engineering attacks. Specifically, the paper focuses on how to defend against software analysis and reverse engineering attacks that gather internal information about the on-device models. These attacks are more effective than traditional model theft techniques (such as substitute model training or side-channel attacks) because the on-device models are directly hosted on mobile devices, which can be easily unpacked and analyzed. ### Background and Motivation As edge devices and mobile applications increasingly leverage deep learning capabilities, deploying these models on devices (referred to as on-device models) has become more popular. This deployment method avoids the transmission of user data and improves response time. However, the security of on-device models faces serious threats because they can be fully exposed to attackers by unpacking the application. Existing research shows that attackers can easily generate white-box attacks against on-device models and even reverse engineer their training data. ### Solution To protect on-device models from white-box attacks, the authors propose a new technique called Model Obfuscation. Specifically, Model Obfuscation hides and obfuscates the key information (structure, parameters, and attributes) of the model through methods such as renaming, parameter encapsulation, neural structure obfuscation, shortcut path injection, and additional layer injection. The authors developed a prototype tool called ModelObfuscator, which can automatically obfuscate on-device TFLite models. ### Main Contributions 1. **Proposed a new model obfuscation framework**: This framework defends against model parsing by hiding the key information of deployed deep learning models, significantly increasing the cost of attacks and preventing attackers from generating effective attacks and stealing the knowledge of on-device models. 2. **Designed five obfuscation strategies**: Including renaming, parameter encapsulation, neural structure obfuscation, random shortcut path injection, and random additional layer injection, and implemented an end-to-end prototype tool called ModelObfuscator. This tool can automatically obfuscate models and build compatible deep learning libraries. 3. **Provided a classification and comparison of different obfuscation methods**: Classified and compared different obfuscation methods in terms of effectiveness and overhead to guide model owners in choosing appropriate defense strategies. ### Experimental Results Experiments show that ModelObfuscator can significantly improve the security of models with almost no additional time overhead and only a 20% increase in storage overhead. The code for this tool has been publicly released for research and use. ### Conclusion The paper proposes a new model obfuscation method that effectively protects on-device deep learning models from software analysis and reverse engineering attacks through multiple obfuscation strategies. This method improves model security while maintaining model performance and efficiency.

ModelObfuscator: Obfuscating Model Information to Protect Deployed ML-based Systems

Model Obfuscation for Securing Deployed Neural Networks

DynaMO: Protecting Mobile DL Models through Coupling Obfuscated DL Operators

Model-less Is the Best Model: Generating Pure Code Implementations to Replace On-Device DL Models

DeepObfuscator - Obfuscating Intermediate Representations with Privacy-Preserving Adversarial Learning on Smartphones.

DeepObfuscator: Obfuscating Intermediate Representations with Privacy-Preserving Adversarial Learning on Smartphones

Investigating White-Box Attacks for On-Device Models

GroupCover: A Secure, Efficient and Scalable Inference Framework for On-device Model Protection Based on TEEs

TextObfuscator: Making Pre-trained Language Model a Privacy Protector via Obfuscating Word Representations

DeepObfuscation: Securing the Structure of Convolutional Neural Networks Via Knowledge Distillation

NeurObfuscator: A Full-stack Obfuscation Tool to Mitigate Neural Architecture Stealing

Privacy-preserving Machine Learning through Data Obfuscation

MalModel: Hiding Malicious Payload in Mobile Deep Learning Models with Black-box Backdoor Attack

Robustness of on-Device Models: Adversarial Attack to Deep Learning Models on Android Apps

DEMISTIFY: Identifying On-device Machine Learning Models Stealing and Reuse Vulnerabilities in Mobile Apps.

Offline Model Guard: Secure and Private ML on Mobile Devices

MMGuard: Automatically Protecting On-Device Deep Learning Models in Android Apps.

Preventing Neural Network Model Exfiltration in Machine Learning Hardware Accelerators

Hardware-Assisted Intellectual Property Protection of Deep Learning Models

TransLinkGuard: Safeguarding Transformer Models Against Model Stealing in Edge Deployment

SODA: Protecting Proprietary Information in On-Device Machine Learning Models