Exposure of a model on one device endangers other devices: revisiting cross-device edge neural network security

1. 01What problem does this paper attempt to solve?

   Once one node of an on-device isomorphic model is exposed, adversarial examples can transfer to other nodes; VeilNN uses obfuscation to reduce transfer.

   Once the on-device model on one node is exposed, adversarial examples can transfer to other isomorphic nodes.

   • Scenario: The app is distributed centrally through app stores, and mobile and IoT devices run the same on-device model. The authors state that devices are untrusted, the app can be unpacked and the model can be stolen, so it is in a white-box state.
   • Existing shortcomings: The authors state that transferability is strong when architectures are similar and parameters are partially aligned; in the cross-node case the two are completely identical, so the risk is greater. Redesigning and retraining is costly and may also harm performance. Injecting redundant structures does not break output consistency; after repeated execution, the success rate of input, hidden-layer or output perturbations quickly approaches 100%. The authors state that defenses effective in the single-node case completely fail in the cross-node scenario.
   • Observation: Increase the differences among models on each node to weaken transferability, rather than only preventing leakage or doing adversarial training. The idea comes from code obfuscation.
   • Method: The authors propose VeilNN, which performs covert, irreversible network-unit obfuscation and layer assembly on architecture and parameters, and is applicable to MLP, CNN and Vision Transformer. The authors state that this is the first obfuscation-based defense against cross-node attacks.
   • Threat model:
     • Goal: Make the model of the same app on other devices predict incorrectly; the compromised node is used to obtain model knowledge and craft adversarial examples.
     • Knowledge: White-box for the compromised node, including architecture, weights and defenses. The introduction states that attacking other nodes is black-box; Section 4 states that cross-node attacks occur in a white-box condition, and the attacker has complete information about the target model and defenses.
     • Capability: Use Apktool and IDA Pro to reverse-engineer the APK or IPA, then extract the model via model extraction (e.g., calling the system API of the development format).
     • Victim system: The owner trains M and embeds it in the app, which is deployed to edge devices through app stores; the model on each node is the same.

   Collapse this answer

2. 02What related research exists?

   Related work is mainly adversarial attacks and on-device protection; the authors say existing defenses target a single node.

   The authors divide existing work into adversarial attacks, single-node defenses and on-device model protection, and on this basis position cross-node obfuscation.

   Adversarial attacks

   • White-box and black-box: Liang et al. [2022] survey adversarial attacks. White-box includes FGSM, PGD and C&W; black-box is written in the related work as HJSA (Chen et al., 2020) and Ghost (Li et al., 2020). The experiments section records the former as HSJA.
   • Single-node assumption: The authors state that most attacks assume the attacker cannot obtain parameters or architecture other than the current node. In the cross-node case, compromising one untrusted node yields the same model and its defenses.
   • Same-app transfer: Huang and Chen [2022] report that adversarial examples crafted from a compromised node can fool secure nodes in the same mobile app.

   Transferability and single-node defenses

   • Transfer conditions: Sun et al. [2021] and Wang et al. [2024] discuss adversarial transfer when architectures are similar and parameters are partially aligned. The authors use this to argue that fully homogeneous deployment amplifies cross-node risk.
   • Single-node methods: Adversarial training is in Wang et al. [2024], and the experimental baseline also cites Madry et al. [2017]; input–hidden-layer–output transformations are in Yu et al. [2021]. Section 3 states that such methods hide the defense and have partial robustness to samples with limited transferability.
   • The authors' criticism: The authors state that if the architecture and defenses are known, the attacker can locally estimate the expectation of the randomized network or input-output transformations, and adversarial training also fails. In the MLP experiment in Figure 2, the authors state that, apart from retraining with different hyperparameters, the other methods cannot provide effective protection in the cross-node case, and retraining is costly.

   On-device protection and structural modification

   • Perturbation: Guiga and Roscoe [2020] use gradient-weighted class activation mapping to perturb image inputs; Grana [2020] perturbs inputs to prevent theft. Hidden-layer perturbation is in Yu et al. [2021] and Yang et al. [2023]; output perturbation is in Lee et al. [2019], Kariyappa and Qureshi [2020] and Zhang et al. [2023].
   • Structural modification: ModelObfuscator by Zhou et al. [2023] uses TFLite functions and custom structures to hide internal information. The authors state that it still cannot evade code analysis, and that after Zhou et al. [2023; 2024a] inject redundant components, different models still give similar outputs for the same input.
   • Repeated attacks: The authors state that perturbation-based methods lack clear criteria against adversarial attacks, and after repeated execution the success rate of adversarial examples quickly approaches 100%.

   Baselines and data

   • Baseline methods: Cross-node defense is compared against retraining (R.T.), SSNN, adversarial training (A.T.) and raw weight modification (Szentannai et al., 2020). Extraction defense is compared against ModelObfuscator and CustomDLCoder. The attacks are FGSM, PGD, C&W, HSJA and Ghost.
   • Benchmarks/datasets: MNIST, CIFAR and Imagenet; the networks are MLP, AlexNet, ResNet and ViT.

   The authors state that existing active defenses are not applicable to the cross-node case. The authors state that this paper is the first to simultaneously obfuscate architecture and weights to weaken transferability, rather than only preventing leakage or doing adversarial training; the idea comes from code obfuscation (Sebastian et al., 2016).

   Collapse this answer

3. 03How does the paper address this problem?

   VeilNN obfuscates units and layers at distribution time, making the architecture and parameters differ across nodes while preserving the original task.

   At distribution time, VeilNN generates a proprietary model for each user: it takes the raw model's architecture and parameters, and after network unit obfuscation and layer assembly, each node has a different architecture and weights while legitimate task performance remains comparable. The authors' idea is to widen the differences to weaken transfer.

   Network unit obfuscation

   • Group injection: Inject group units into the target layer with parameters set to be linearly correlated, so as not to change the outputs of adjacent layers. The constraint is Zⁱ⁺¹_1,n=Xⁱ_1,qWⁱ⁺¹_q,n, i.e., the adjacent layer's output is determined by that layer's input and weights; for the injected group, this output must be a zero tensor. The parameters of injected units follow the same distribution as the original units, which the authors use to pursue stealth.
   • Modifying the entire weight space: The authors say an adversary could extract the injected units using the above constraint or model compression. Therefore the entire layer is modified: L is the target layer, p is the parameter index, α is the modification strength, and π contains control quantities such as the perturbation distribution type and magnitude upper bound. The authors say the complexity of inferring group-injected neurons is O(2^n), where n is the number of units in the obfuscated layer.
   • SVD perturbation: Perform singular value decomposition on the target units, then add independent diagonal noise to the two models; the absolute value of each perturbation is less than ε times the corresponding singular value, and ε≪1. The authors express the degree of alignment using the cosine of the angle between the two adversarial directions, and give the upper bound P_success≤κ·cosθ, where κ is a task-related direction alignment coefficient. In the experiments the paper separately calls α a strength parameter and does not state whether it is the modification strength here.

   Network layer assembly

   • Motivation: The authors say changing only units and weights is insufficient, because obtaining the original weights still allows cross-node attacks. Layer assembly is used to break the correlation between each model's weights and resist architecture recovery, without degrading predictions on legitimate samples.
   • Layer injection: Inject in pairs, to avoid a single layer being easily noticed. Branches are combined by summation; to preserve legitimate predictions, the injected layer's output must equal the original input.
   • Layer decomposition: Split layer i into two layers containing k and n_i−k neurons, then combine by concatenation. The authors give the constraint under which the decomposed output is equivalent to the original layer, with m_i equal to n_{i−1}.
   • Layer fusion: The inverse of decomposition, merging two uncorrelated layers. The inputs may be the same or different, corresponding to two kinds of merging; when inputs are the same, weights are concatenated in blocks. The composite layer must merge the original layers' outputs so as not to change the adjacent layer's input.

   Evaluation metrics and unspecified parameters

   • C-ASR: Generate adversarial examples on each model, then average the attack success rate over the other edge models. Anti-ASR is defined as 1 minus C-ASR. Structural similarity uses GraKeL's Neighborhood Subgraph Pairwise Distance Kernel (NSPDK). Attacks are untargeted.
   • Unspecified quantities: The paper does not give the number of injected units, the k used in decomposition, or the default value of α; α is used in experiments as a strength sweep.

   Collapse this answer

4. 04What experiments did the paper conduct?

   At α∈[0.4,0.6], the average Anti-ASR across five attack types is 49.19%; the paper does not state the model.

   Experimental setup

   • Models: MLP, AlexNet, ResNet, Visual Transformer (ViT). Section 6.1 says three networks but lists these four; the structural experiments in Section 6.3 state four; the conclusion says three, including MLP, ResNet, ViT. The paper does not state the number of layers or parameter scale.
   • Data: MNIST, CIFAR, Imagenet. The paper does not state which dataset each number in Figure 4 corresponds to, nor the sample size.
   • Attacks: Untargeted. White-box: FGSM, PGD, C&W; black-box: query-based HSJA and transfer-based Ghost. The authors say that for VeilNN, transfer attacks are a natural adaptive attack. The paper does not report query counts or iteration budgets.
   • Baselines: Cross-node defenses are R.T., SSNN, A.T., raw weight modification. SSNN is cited at the baseline as Yu et al., 2021, and later as Yang et al., 2023. Extraction comparisons are ModelObfuscator and CustomDLCoder. The authors say the comparison focuses on single-instance attacks.
   • Metrics: C-ASR is the average attack success rate against other edge models; Anti-ASR is 1 minus C-ASR. Structural similarity uses NSPDK. The original task is measured by performance/accuracy. The paper does not use a separate review model.
   • Motivation experiment: Figure 2 states it is on MLP, with legend Original, Retrain, SSNN, Adversarial Training, visible x-axis ε ticks from about 0.01 to 0.07, and ASR on the y-axis. The main text does not give curve readings.

   Main results

   According to Section 6.2, corresponding to Figure 4(d). Conditions are VeilNN, α∈[0.4, 0.6]. The model and dataset are not stated in the paper.

   Attack	Anti-ASR	Source
   FGSM	57.71%	Section 6.2
   PGD	43.74%	Section 6.2
   C&W	48.09%	Section 6.2
   HSJA	50.75%	Section 6.2
   Ghost	45.65%	Section 6.2
   Average of five	49.19%	Section 6.2

   • The authors say that as α increases and the decision boundary distortion becomes stronger, cross-node C-ASR gradually decreases, and that within this range it does not depend on a specific algorithm. Ghost is called by the authors a natural adaptive attack against VeilNN.
   • The abstract states the average defense success rate as 49.19%, and claims up to 81.19% on four attack types and more than 33.16% improvement over existing defenses. The contribution and conclusion state 49.19% as a reduction in attack success rate, and still state the maximum as 81.19%. The experiments section does not state the model, dataset or algorithm for these two items, nor their correspondence to the table above.
   • The authors say VeilNN defends against both gradient-based white-box attacks and transfer attacks.

   Baseline comparison and original task

   • Comparison: In Figure 4(a) the y-axis is Anti-ASR, and the authors say ten values of ε were compared. The authors say the success rate of VeilNN and Retrain decreases from 56.92% to 35.29% and from 44.29% to 29.83% as ε increases. The authors say A.T.'s success rate is always 0%, SSNN's maximum is 5.19%, and the 5-attempt and 10-attempt values are 1.23% and 0.78%. The legend also includes Raw, SSNN-1/5/10. The main text does not label 5.19% as SSNN-1.
   • Authors' interpretation: The authors say retraining leaves the decision boundary close to the original model; VeilNN perturbs the boundary in a manner similar to Low-Rank Adaptation but uses random datasets, and thus defends better than retraining on the original data. The authors say Raw, A.T. and SSNN perform poorly. In Figure 2(b), the authors say that except for retraining, these methods cannot provide effective protection under cross-node settings; the figure has no readable point values.
   • Original task: In Figure 4(b), the authors say that at α≤0.6 the prediction loss is below 5% accuracy, and raw weight modification's loss is below 22.5%; at α<0.6 the performance loss is below 2.5% accuracy. SSNN's performance loss is 0.10%, and A.T. has no loss. At α∈[0.4, 0.6], the average deviation relative to the raw model is 3.29%.

   Attacker knowledge

   • Three settings: ① use the local edge model to attack other devices; ② use the raw model to directly attack edge devices; ③ after obtaining one edge device, attack the raw model. The Figure 4(c) legend is Raw Attack Adjs, Adj Attack Raws, Adj Attack Adjs; the main text does not map them item by item.
   • Results: The authors say transfer is easiest with the raw model, with C-ASR of 80.03%; that sentence does not state α. With only one node, the ASR against other nodes is 45.51%, and against the raw model 41.61% (α=0.6).
   • Authors' interpretation: The authors say this is why both architecture and weights must be obfuscated, to break adversarial transfer.

   Resistance to model extraction and structural differences

   • Structure: NSPDK is used to compare raw and obfuscated models on MLP, AlexNet, ResNet, ViT. In Figure 5 the visible x-axis Intensity ticks are 0 to 100, and the visible y-axis Similarity ticks are 0.5 to 1.0. The authors say weight obfuscation and layer injection cause the smallest structural change, layer decomposition the largest, and network cell injection is in between. The main text does not give the similarity at each point.
   • Extraction: The setup follows CustomDLCoder and ModelObfuscator, evaluating conversion, reverse, feature and code analysis. The authors say the two partially protect the model but fail to prevent cross-node model leakage; VeilNN completely prevents direct extraction and reduces the success rate of code-based reconstruction. The paper does not report specific success rates.
   • Table 1: The visible rows include TVM Obfuscator, CustomDLCoder and Ours, with symbols respectively indicating unable to steal, not applicable, partially exposed or defense failed. Column alignment is unreliable after text conversion, so it is not transcribed cell by cell here.

   Other ablations and analyses

   • α≤0.6: prediction loss below 5% accuracy; raw weight modification's loss below 22.5% (Figure 4(b)).
   • α<0.6: performance loss below 2.5% accuracy; SSNN is 0.10%, A.T. has no loss.
   • α∈[0.4, 0.6]: average deviation relative to the raw model is 3.29%; the authors call this range the optimal obfuscation range.
   • The main text says ablations are in the Supplementary Material and gives no ablation numbers.

   Collapse this answer

5. 05What are some points that can be further explored?

   The paper does not specifically discuss limitations or future directions.

   Limitations and future directions noted by the authors

   The paper does not specifically discuss limitations. Neither the Conclusion nor the main text lists limitations or future work.

   Scope of the experiments

   • Section 6.1 uses MNIST, CIFAR and Imagenet, and lists MLP, AlexNet, ResNet and ViT; the structural similarity experiment in Section 6.3 specifies these four; the conclusion writes three, including MLP, ResNet and ViT.
   • The attacks are untargeted FGSM, PGD, C&W, HSJA and Ghost. The authors state that Figure 4(a) compares ten ε values. The authors call Ghost a natural adaptive attack against VeilNN.
   • The cross-node baselines are R.T., SSNN, A.T. and raw weight modification. The extraction evaluation covers conversion, reverse, feature and code analysis, compared against ModelObfuscator and CustomDLCoder; Table 1 has an additional TVM Obfuscator row.
   • The motivation experiment in Figure 2 specifies MLP and plots single-node and cross-node separately.
   • The paper does not report the model and dataset corresponding to each number in Figure 4, the sample size, the number of repetitions (except SSNN's 1, 5 and 10 attempts), or the number of HSJA queries. The ablation is said to be in the Supplementary Material; the main text has no ablation numbers.

   Collapse this answer

6. 06Summarize the main content of the paper

   After obfuscating architecture and parameters, the authors say the average Anti-ASR across five attack types is 49.19% (α∈[0.4,0.6]).

   VeilNN is an on-device model obfuscation defense placed at the app distribution stage, used to reduce cross-node adversarial transfer under isomorphic deployment.

   • Problem: The same model is distributed to multiple devices via an app store. After compromising one node and unpacking it, an attacker can obtain the architecture, weights and defenses, then apply adversarial examples to other nodes. The authors say single-node defenses fail under this setting; retraining with different hyperparameters is effective but costly.
   • Method: Generate a different model for each user. Group-inject linearly correlated units and perturb weights using singular value decomposition; then change the topology via pairwise layer injection, decomposition and fusion. The constraint is that outputs on legitimate samples are equivalent to the original computation.
   • Main numbers: Section 6.2 gives Anti-ASR for five attack types at α∈[0.4, 0.6]: FGSM 57.71%, PGD 43.74%, C&W 48.09%, HSJA 50.75%, Ghost 45.65%, average 49.19%. The paper does not state the model or dataset. With the raw model, C-ASR is 80.03%; with only one node, it is 45.51% against other nodes (α=0.6). The average deviation of this α range relative to the raw model is 3.29%.
   • Authors' conclusion: The authors say VeilNN weakens cross-node attacks while preserving the original task, and view model obfuscation as a scalable on-device defense. The abstract separately claims a defense success rate of up to 81.19% and that it outperforms existing defenses by more than 33.16%; the experiments section does not break down these two items. The contribution states a reduction in attack success rate, which is not the same as the Anti-ASR definition in Section 6.2.

   Collapse this answer

Related papers