On-device ML introduces new security challenges: DNN models become white-box accessible to device users. Based on white-box information, adversaries can conduct effective model stealing (MS) and membership inference attack (MIA). Using Trusted Execution Environments (TEEs) to shield on-device DNN models aims to downgrade (easy) white-box attacks to (harder) black-box attacks. However, one major shortcoming is the sharply increased latency (up to 50X). To accelerate TEE-shield DNN computation with GPUs, researchers proposed several model partition techniques. These solutions, referred to as TEE-Shielded DNN Partition (TSDP), partition a DNN model into two parts, offloading the privacy-insensitive part to the GPU while shielding the privacy-sensitive part within the TEE. This paper benchmarks existing TSDP solutions using both MS and MIA across a variety of DNN models, datasets, and metrics. We show important findings that existing TSDP solutions are vulnerable to privacy-stealing attacks and are not as safe as commonly believed. We also unveil the inherent difficulty in deciding optimal DNN partition configurations (i.e., the highest security with minimal utility cost) for present TSDP solutions. The experiments show that such ``sweet spot'' configurations vary across datasets and models. Based on lessons harvested from the experiments, we present TEESlice, a novel TSDP method that defends against MS and MIA during DNN inference. TEESlice follows a partition-before-training strategy, which allows for accurate separation between privacy-related weights from public weights. TEESlice delivers the same security protection as shielding the entire DNN model inside TEE (the ``upper-bound'' security guarantees) with over 10X less overhead (in both experimental and real-world environments) than prior TSDP solutions and no accuracy loss.

翻译：端侧机器学习引入了新的安全挑战：深度神经网络模型对设备用户变为白盒可访问。基于白盒信息，攻击者能够实施有效的模型窃取攻击和成员推断攻击。使用可信执行环境（TEE）保护端侧深度神经网络模型，旨在将（简单的）白盒攻击降级为（更难的）黑盒攻击。然而，一个主要缺陷是延迟急剧增加（高达50倍）。为通过GPU加速TEE防护的深度神经网络计算，研究者提出了多种模型分区技术。这些解决方案被称为TEE防护的深度神经网络分区，将模型分为两部分：将隐私不敏感部分卸载至GPU，同时将隐私敏感部分保留在TEE内。本文使用模型窃取攻击和成员推断攻击，在多种深度神经网络模型、数据集和评估指标上对现有TEE防护的深度神经网络分区方案进行基准测试。我们揭示了重要发现：现有TEE防护的深度神经网络分区方案易受隐私窃取攻击，并不像普遍认为的那样安全。我们还揭示了当前TEE防护的深度神经网络分区方案在确定最优分区配置（即最小效用代价下的最高安全性）时存在的固有困难。实验表明，这种"最佳平衡点"配置会随数据集和模型而变化。基于实验经验教训，我们提出了TEESlice——一种在深度神经网络推理过程中抵御模型窃取攻击和成员推断攻击的新型TEE防护的深度神经网络分区方法。TEESlice采用"先分区后训练"策略，能够精确分离隐私相关权重与公共权重。与先前TEE防护的深度神经网络分区方案相比，TEESlice在实验环境和真实环境中均能提供与将整个深度神经网络模型屏蔽在TEE内相同的安全保护程度（"上界"安全保证），且开销降低超过10倍，同时不造成精度损失。