BMO: A Boundary-Aware Model Obfuscation Method for Cross-Node Attacks

1. 01What problem does this paper attempt to solve?

   After white-box extraction of the model on one device, other nodes can be attacked; BMO obfuscates the direction component to differentiate boundaries.

   After an on-device model from the same source is white-box extracted from one device, adversarial examples can transfer to other nodes.

   • Scenario: The author says on-device inference has low latency and helps avoid privacy leakage, but devices are in untrusted environments. Compromising one device is enough to extract the model from the app; models distributed from the same source are thereby exposed, and adversarial examples can transfer between peer devices.
   • Existing shortcomings: The author says enhancements such as adversarial training and input randomization target known attacks. Asset protection aims to raise the cost of extraction, but the author cites Chen et al. (2022): after a model is loaded into the RAM of a compromised node, its parameters can still be extracted via memory dump or dynamic analysis, so it provides no protection under this setting. The author considers both lines of approach insufficient against attacks that already have persistent white-box access and can discover unknown weaknesses.
   • Observation: The author says robustness is mainly affected by the curvature of decision boundaries, and examines how parameters shape curvature. In preliminary experiments, the author says existing defenses neglect curvature protection; once one model's curvature is exposed, other models with the same curvature are easily broken.
   • Threat model:
     • Goal: After obtaining the model on a compromised node, conduct a large-scale evasion attack on peer nodes embedding the same DL application, so that inputs perturbed within budget yield the target output.
     • Knowledge: The paper places the cross-node attack in the white-box setting, where the attacker has all information about the target model; the transfer-based attack is black-box. A weak attacker can access the DL application on the compromised node but has no source model information; a strong attacker can obtain the original model's boundary.
     • Capability: They can use Apktool or IDA Pro to decompile an Apk or IPA, or call system APIs in development format to extract the model. Both types of attackers can independently generate adversarial inputs using white-box and black-box methods. The attacker does not directly access M′ on the peer at inference time, but optimizes on the extracted M, relying on transferability.
     • Victim system and defender: The vendor packages the same trained model into the app and distributes the same binary to all users; access control relies mainly on authentication, with no per-user parameter differentiation. The vendor cannot retrain for each download, but can change the architecture and data during training, or change parameters before distribution. The goal is that adversarial examples generated from a single node are hard to use to break other nodes, while benign-sample predictions are maintained.
   • Approach: Proposes Boundary-aware Model Obfuscation (BMO), which splits weights into magnitudes related to benign predictions and directions related to boundary curvature, and injects controllable noise only into the directions. The author says it requires only one computation and no additional training.

   Collapse this answer

2. 02What related research exists?

   Related work is divided into adversarial attacks, asset protection, and model enhancement; BMO is placed under weight obfuscation before distribution.

   Adversarial attacks

   • FGSM by Goodfellow et al. (2015) and PGD by Madry et al. (2018): construct perturbations using model gradients. C&W by Carlini and Wagner (2017): solves a constrained optimization to generate high-confidence adversarial examples.
   • MI-FGSM by Dong et al. (2018): the paper classifies it as query-based, estimating gradients through repeated queries. HopSkipJumpAttack by Chen et al. (2020): approximates and exploits the decision boundary under black-box.
   • The paper states that the more precisely the attacker knows the internal parameters, the more effective the attack. In cross-node, the same model is deployed on multiple devices, so compromising one untrusted node yields complete knowledge of the model and its defense, and allows constructing perturbations with internal gradients, unlike black-box where only the victim can be approximated.

   Model asset protection

   • The paper includes architecture obfuscation under asset protection: changing the network architecture (Zhou et al., 2023), or replacing it with semantically equivalent code (Zhou et al., 2024).
   • Chen et al. (2022) discuss automatically reverse-engineering DNNs from AI programs. Based on this, the authors argue that once the model is loaded into the RAM of a compromised node, the parameters can be dumped or extracted via dynamic analysis, and such defenses provide no protection in the cross-node setting.

   Model enhancement

   • Adversarial training (Goodfellow et al., 2015), randomized architectures (He et al., 2019; Yang et al., 2023), and interaction-layer perturbation (Athalye et al., 2018). The introduction also mentions input randomization (Byun et al., 2022).
   • The paper states that these enhancements only give a false sense of security, and cites Athalye et al. (2018): adaptive adversaries can reverse or average out such defenses.

   Baselines and benchmarks

   • The experimental baselines are random networks SSNN and PNI, adversarial training A.T., architecture obfuscation M.A.O., and directly injecting noise into the original weights (Szentannai et al., 2020). The datasets are MNIST, CIFAR-10, and ImageNet; the appendix additionally has CIFAR-100.

   The authors place this paper on a different route: rather than focusing on enhancing robustness or raising the cost of white-boxing, they use weight obfuscation to generate different models with low decision boundary overlap.

   Collapse this answer

3. 03How does the paper address this problem?

   BMO splits magnitude and direction row by row, adds noise only to the top-p elements of the direction, and renormalizes.

   BMO splits the pretrained weights into magnitude and direction before distribution: the magnitude is left unchanged to preserve benign predictions, and only the direction is perturbed to change the curvature of the decision boundary. The authors state that this process is done only once at deployment, without retraining.

   Weight decomposition

   • Two components: for the weights of layer l, the L2 norm is taken by row as the magnitude m_i, and the direction is that row divided by m_i+ε. The authors state that the magnitude determines the global position of the boundary and dominates the predictions of normal samples far from the boundary; the direction controls local curvature and encodes features related to adversarial vulnerability.
   • Notation: the row norms are collected into a diagonal matrix M^{(l)}, and the unit directions are stacked into D^{(l)}. The paper writes W^{(l)} = M^{(l)} ⊙ D^{(l)}, with ε used to prevent division by zero. The authors state that this is similar to DoRA, separating magnitude and direction.
   • Objective: preserve benign accuracy before and after perturbation, and widen the geometric difference of the boundary. The authors state that this hypothesis is tested in Section 5 with multiple architectures and attacks. The defense objective is in Equation (2): on benign inputs, make M′ close to M; on adversarial inputs within the budget, make the two losses larger.

   Adaptive noise and reconstruction

   • Only the direction is changed: noise is injected into the direction component, with Gaussian or Differential Privacy noise given as examples in the paper. The magnitude matrix is kept unchanged to maintain activation scale and benign classification accuracy.
   • Selection: the threshold is Threshold^(l)(p)=Quantile(|D^(l)|,1−p). p∈[0,1] controls the perturbed proportion; the paper gives p=0.1 as an example, i.e., perturbing the 10% of elements with the largest absolute values.
   • Scale: elements above the threshold have α·N(0, σ^{(l)}) added, where σ^{(l)} is the standard deviation of D^{(l)}; elements not above the threshold are not perturbed.
   • Reconstruction: the perturbed directions are re-normalized row by row, then combined with the magnitude. Equation (6) in the paper is W^′(l)=M^(l)D̃^(l). The authors state that strict normalization is to avoid the noise changing the magnitude.

   Where diversity comes from

   • The authors state that the randomness is injected into a subspace orthogonal to the original capability, to create different boundaries while preserving core performance, consistent with the null-space intuition. After each node independently perturbs the direction, the curvatures differ, and the authors believe that adversarial examples crafted on a compromised model are unlikely to reproduce on other nodes.
   • The authors also state that this relates to federated or decentralized scenarios where weight sharing and model replication are common. The paper does not write this claim as an experimental setting.

   Why the gradient deviates

   • Adversarial perturbations are constructed along the input gradient. After the direction is changed by noise, the paper writes the new gradient as the original gradient plus a noise term; this noise term causes an angular deviation in the gradient.
   • The authors state that this misleads optimization on the extracted model, making it difficult to locate the target model's boundary or gradient direction. The magnitude is unchanged, so normal inference capability is preserved. The authors state that this is similar to fine-tuning on different independent data, thereby increasing boundary diversity. This section is a gradient derivation, not an intervention experiment on representations.

   How success is determined

   • An attack succeeds only when the input is classified into the specified target class. C-ASR is used across nodes, and Anti-ASR = 100% − C-ASR for defense. The main text sets the upper bound of the perceptually acceptable perturbation budget at 0.1.

   Collapse this answer

4. 04What experiments did the paper conduct?

   The authors state that across four attack types and four models, the average defense success rate is 68.68%, and the strongest baseline is 22.32%.

   Experimental setup

   • Models: the main experiments use MLP, AlexNet, ResNet, and ViT, corresponding to fully connected, convolutional, and vision transformer. The appendix additionally evaluates MLP, ResNet-18, DeiT-Tiny, DeiT-Small, MobileViT-S, and MobileNetV2. The paper does not state whether the ResNet in the main experiments is ResNet-18.
   • Data: the main text uses MNIST, CIFAR-10, and ImageNet. Appendix Table 1 additionally includes CIFAR-100. The paper does not report the sample size used for each dataset.
   • Attacks: white-box FGSM, PGD, C&W; black-box HSJA and the transfer-based MI-FGSM. Success means being classified into the specified target class. The main comparison sets the upper bound of the perturbation budget at 0.1. The appendix extends to four categories—query, optimization, gradient, and autoML—and uses APGD.
   • Baselines: SSNN, PNI, adversarial training A.T., architecture obfuscation M.A.O., and directly perturbing the original weights. The Figure 3 legend also includes SSNN-1, SSNN-5, PNI-1, PNI-5, and BMO-Raw; the paper does not explain the difference between 1 and 5. The Figure 4 legend writes Momicry-Raw.
   • Metrics: C-ASR is the cross-node attack success rate, Anti-ASR = 100% − C-ASR, and benign accuracy is also reported. The paper does not report the number of repetitions or the number of queries, nor does it use LLM review.
   • Parameters: noise strength α, direction perturbation proportion p. Figure 6(b) is labeled p=0.6. The paper does not give the α and p corresponding to the 68.68% in the abstract.

   Main results

   Condition	Value	Source
   Four attack types, four edge models, defense success rate	68.68%	Abstract, §1
   Same as above, strongest baseline	22.32%	Abstract, §1
   Same as above, benign accuracy	97.54% (∆=−1.08%)	§1
   FGSM, Anti-ASR rises with α to	81.29%	§5.2, Fig. 3(c)
   PGD, Anti-ASR rises with α to	72.01%	§5.2, Fig. 3(c)
   C&W, final Anti-ASR	76.60%	§5.2, Fig. 3(c)
   HSJA, final Anti-ASR	88.62%	§5.2, Fig. 3(c)

   • The authors state that when ε≤0.05, Anti-ASR is above 65%, and at ε=0.1 it is still about 55%; within this range, the Anti-ASR of adversarial training is 0%. Compared with directly modifying the original weights, the authors state it is on average 54.74% higher (up to 63.33%), with an average advantage exceeding 45%.
   • When α∈[0.4, 0.6], the authors state that the overall Anti-ASR across the four attacks is 60.98%; for MI-FGSM it is 69.67%. The authors state that the defense comes from smoothing of decision boundaries across nodes, rather than memorizing specific perturbations. The contributions also state that it exceeds the strongest baseline by 44%, and benign accuracy drops by less than 1%.
   • The above averages are not broken down by model. The text of Figure 3(a) also does not give the individual readings for AlexNet or ResNet.

   Attacker knowledge

   • Three conditions: using one node to attack other nodes; possessing the original model to attack edge-obfuscated models; possessing one node to attack the raw model. The numbers are written in the descriptions of Figure 3(b) and Figure 4; the main text does not separately give the curve readings of Figure 4.
   • When using stolen original parameters to attack the obfuscated model, the Anti-ASR at α=1.0 only reaches 45.99%. With access to only one node, attacking the raw model: 64.63% at α=0.6 and 91.64% at α=1.0; attacking other edge models: 75.96% and 89.33%.
   • The authors state that leakage of the original model increases the cross-node threat on all nodes. This section does not use the terms "weak/strong attacker" from Section 3.

   Quantization and appendix

   • 16-bit quantization: compared with 32-bit, the attacks are FGSM, PGD, C&W, and HSJA. Benign accuracy drops by less than 0.01%. When α∈[0.4, 0.6], the authors state that the quantized model's Anti-ASR is 3–6% lower; at α=0.5 it is 55.30%, versus 58.34% at full precision. When α≥0.8, the quantized model's benign accuracy exceeds 94.82%, and Anti-ASR is higher than the original model. The introduction also states that under quantization the defense success rate is 59.63%, with benign accuracy still 97.54% (∆=−1.08%). The paper does not explain how this number corresponds to the point values in Figure 5.
   • Six architectures: in Figure 7 at ε=0.05, the authors state that the average Anti-ASR across 4 datasets and 13 attacks all exceeds 30%, with the highest exceeding 78%. DeiT-Tiny/Small still has about 45–55% at ε=0.10. The authors state that the decline across models is gradual.
   • Table 1: the title writes Anti-ASR (ε=0.05), the cells are paired numbers, and the paper does not define the number after the slash. The main text states that this experiment is APGD, ε=0.02, ∆ACC<3.5%。MNIST 上 MobileNet v2 为 89.76/2.99，CIFAR-10 上 DeiT tiny 为 35.16/2.06，ImageNet 上 MobileViT s 为 38.72/2.85；MLP 除 MNIST 的 86.70/2.43 外均为“-”。
   • Figure 8：作者称 C&W 与 DeepFool 大约 65–70%，FAB 超过 85%，Square 为 70–75%，HSJA 与 BoundaryAttack 在 ε≤0.03 约 90%、ε≤0.10 约 80%。梯度类与 autoML 类在 ε≤0.05 内仍被抑制；ε>0.05, the authors state that the perturbation begins to be visible and the defense effect weakens. The latter two categories do not give specific Anti-ASR.

   Other ablations and analyses

   • Position p (Fig. 6(c)): for FGSM at p=0.1, C-ASR goes from 100% to 50.96%; at p=0.5 it is 36.17%, and by p=1.0 it drops a further 4.49%. The average drop is 49.20% from p=0→0.1, 12.54% from 0.1→0.5, and 3.54% from 0.5→1.0.
   • Architecture (Fig. 6(a)): the authors state that CNN's C-ASR drops to 11.35%, MLP to 21.30%, and ViT is still 33.70% at full strength, and state that ViT's relative improvement exceeds 65%. AlexNet is not given separately.
   • Layers of a 10-layer MLP (Fig. 6(b), p=0.6 in the figure): shallow layers C-ASR 76.84%–63.21%, middle layers 93.51%–80.04%, deep layers average 63.91%. The authors state that the middle layers are more like channels for adversarial gradients.
   • Components (Fig. 6(d), 10 perturbation strengths): when perturbing the magnitude, benign accuracy goes from 98.15% to 96.13%, and robustness is on average 12.54% weaker, at most 19.51%. When perturbing the direction, Anti-ASR increases on average by 44.98%, at most 81.89%, and benign accuracy drops by at most 6.55%.

   Collapse this answer

5. 05What are some points that can be further explored?

   The paper does not specifically write out limitations or future work.

   Limitations and future directions noted by the author

   The paper does not specifically discuss limitations. The conclusion only restates the problem, the method and the result of "outperforming the strongest baseline"; there is no Limitations or Future Work, and no result is written as a shortcoming or future work.

   Scope of experimental coverage

   • The main-experiment models are MLP, AlexNet, ResNet and ViT; the appendix covers MLP, ResNet-18, DeiT-Tiny, DeiT-Small, MobileViT-S and MobileNetV2 (§5.1, Appendix A).
   • The datasets are MNIST, CIFAR-10 and ImageNet, with CIFAR-100 added in Appendix Table 1. The task is image classification.
   • The main-text attacks are FGSM, PGD, C&W, HSJA and MI-FGSM; Appendix Figure 8 additionally lists SQUARE, BOUNDARY, DEEPFOOL, FAB, BIM, DIFGSM, APGD and AUTOATTACK. Success is judged as misclassification into the specified target class.
   • The comparisons are SSNN, PNI, A.T., M.A.O. and adding noise to the original weights. There is also 16-bit versus 32-bit quantization, and magnitude/direction, layer index, p, α, ε and three attacker-knowledge conditions.
   • The paper does not report sample size, number of repetitions or number of queries, nor the α and p corresponding to 68.68%. The related work cites that adaptive adversaries can reverse randomization defenses; the experiments section does not report results of adaptive attacks against BMO.

   Collapse this answer

6. 06Summarize the main content of the paper

   BMO uses direction obfuscation to generate device-dependent boundaries; the authors state an average defense success rate of 68.68%, versus 22.32% for the baseline.

   BMO is pre-distribution weight obfuscation for edge-side cross-node attack. After a vendor packages the same model into an app, compromising one device allows white-box extraction of the parameters, and then transferability is used to attack other nodes with the same model. The paper defines this as white-box, to distinguish it from black-box transfer attacks.

   • Problem: the authors believe that adversarial training and input randomization target known attacks, and that architecture obfuscation cannot stop extraction once the model enters memory. They treat decision boundary curvature as key to robustness, and hypothesize that changing only the curvature without touching the magnitude can differentiate the boundaries of each device while preserving benign predictions.
   • Method: the weights are split by row into magnitude and direction. The magnitude is kept unchanged; in the direction, the top-p elements whose absolute values exceed the quantile threshold have noise matching that layer's standard deviation added, then are normalized row by row and put back. Computed once, no retraining. A weak attacker does not know the source model, while a strong attacker can possess the original boundary; the defender cannot retrain for each download.
   • Main numbers: the authors state that across four attack types and four edge models, the average defense success rate is 68.68%, the strongest baseline is 22.32%, and benign accuracy is 97.54% (∆=−1.08%). The contributions also state that it exceeds the strongest baseline by 44%, and benign accuracy drops by less than 1%. The Anti-ASR of FGSM, PGD, C&W, and HSJA rises with α to or reaches 81.29%, 72.01%, 76.60%, and 88.62%.
   • Exceptions: when possessing the original model to attack the obfuscated model, the Anti-ASR at α=1.0 is only 45.99%. With access to only one node, attacking the raw model at α=1.0 gives 91.64%. Adversarial training has an Anti-ASR of 0% within the range of Figure 3(a). ViT's C-ASR is still 33.70% at full strength.
   • Compression: at 16-bit and α=0.5, Anti-ASR is 55.30%, versus 58.34% at full precision. The introduction separately gives a defense success rate of 59.63% under quantization. The authors' conclusion is that device-dependent boundary differences can reduce cross-node transfer, with a small drop in benign accuracy, and it remains usable after compression.

   Collapse this answer

Related papers