Deploying deep neural networks (DNNs) on edge devices exposes valuable intellectual property to model-stealing attacks. While TEE-shielded DNN partitioning (TSDP) mitigates this by isolating sensitive computations, existing paradigms fail to simultaneously satisfy privacy and efficiency. The training-before-partition paradigm suffers from intrinsic privacy leakage, whereas the partition-before-training paradigm incurs severe latency due to structural dependencies that hinder parallel execution. To overcome these limitations, we propose SPOILER, a novel search-before-training framework that fundamentally decouples the TEE sub-network from the backbone via hardware-aware neural architecture search (NAS). SPOILER identifies a lightweight TEE architecture strictly optimized for hardware constraints, maximizing parallel efficiency. Furthermore, we introduce self-poisoning learning to enforce logical isolation, rendering the exposed backbone functionally incoherent without the TEE component. Extensive experiments on CNNs and Transformers demonstrate that SPOILER achieves state-of-the-art trade-offs between security, latency, and accuracy.

翻译：在边缘设备上部署深度神经网络（DNN）会使其宝贵的知识产权面临模型窃取攻击。虽然基于可信执行环境（TEE）的DNN划分（TSDP）通过隔离敏感计算来缓解此问题，但现有范式无法同时满足隐私与效率要求。先训练后划分范式存在固有的隐私泄露风险，而先划分后训练范式则因结构依赖阻碍并行执行，导致严重的延迟。为克服这些限制，我们提出SPOILER——一种创新的先搜索后训练框架，其通过硬件感知的神经架构搜索（NAS）从根本上将TEE子网络与骨干网络解耦。SPOILER能识别严格遵循硬件约束的轻量级TEE架构，从而最大化并行效率。此外，我们引入自中毒学习机制以强化逻辑隔离，使得暴露的骨干网络在脱离TEE组件时功能失效。在CNN与Transformer上的大量实验表明，SPOILER在安全性、延迟与准确性之间实现了最优的权衡。