Numerous mobile apps have leveraged deep learning capabilities. However, on-device models are vulnerable to attacks as they can be easily extracted from their corresponding mobile apps. Existing on-device attacking approaches only generate black-box attacks, which are far less effective and efficient than white-box strategies. This is because mobile deep learning frameworks like TFLite do not support gradient computing, which is necessary for white-box attacking algorithms. Thus, we argue that existing findings may underestimate the harmfulness of on-device attacks. To this end, we conduct a study to answer this research question: Can on-device models be directly attacked via white-box strategies? We first systematically analyze the difficulties of transforming the on-device model to its debuggable version, and propose a Reverse Engineering framework for On-device Models (REOM), which automatically reverses the compiled on-device TFLite model to the debuggable model. Specifically, REOM first transforms compiled on-device models into Open Neural Network Exchange format, then removes the non-debuggable parts, and converts them to the debuggable DL models format that allows attackers to exploit in a white-box setting. Our experimental results show that our approach is effective in achieving automated transformation among 244 TFLite models. Compared with previous attacks using surrogate models, REOM enables attackers to achieve higher attack success rates with a hundred times smaller attack perturbations. In addition, because the ONNX platform has plenty of tools for model format exchanging, the proposed method based on the ONNX platform can be adapted to other model formats. Our findings emphasize the need for developers to carefully consider their model deployment strategies, and use white-box methods to evaluate the vulnerability of on-device models.

翻译：众多移动应用已深度集成深度学习能力。然而，由于端侧模型可轻易从对应移动应用中提取，其面临严峻的安全攻击风险。现有端侧攻击方法仅能生成黑盒攻击，其效能与效率远不及白盒策略。究其原因，TFLite等移动端深度学习框架不支持白盒攻击算法所需的梯度计算。据此，我们推断现有研究成果可能低估了端侧攻击的危害性。为验证此假设，本研究围绕核心问题展开探索：端侧模型能否直接遭受白盒攻击？我们首先系统分析了将端侧模型转化为可调试版本的难点，并提出面向端侧模型的反向工程框架REOM，该框架能自动将编译后的TFLite端侧模型逆转为可调试模型。具体而言，REOM首先将编译后的端侧模型转换为开放神经网络交换格式，继而移除非可调试组件，最终将其转化为支持攻击者在白盒环境下利用的可调试深度学习模型格式。实验表明，该方法在244个TFLite模型上实现了自动化转换。相较于以往基于替代模型的攻击方式，REOM使攻击者能以缩小百倍的攻击扰动实现更高的攻击成功率。此外，由于ONNX平台具备丰富的模型格式转换工具，基于该平台提出的方法可适配其他模型格式。研究成果警示开发者需审慎制定模型部署策略，并采用白盒方法评估端侧模型脆弱性。