Fortifying Edge AI Against Attack

Author: Denis Avetisyan

A new selective encryption framework harnesses model compression to deliver both strong adversarial robustness and low latency for on-device intelligence.

As the magnitude of <span class="katex-eq" data-katex-display="false">\bm{\epsilon}</span> increases, perturbations grow progressively stronger when generating adversarial examples from a model encrypted with TT-SEAL, demonstrating the sensitivity of the system to input alterations. — As the magnitude of $\bm{\epsilon}$ increases, perturbations grow progressively stronger when generating adversarial examples from a model encrypted with TT-SEAL, demonstrating the sensitivity of the system to input alterations.

This work introduces TT-SEAL, a TTD-aware selective encryption scheme designed for efficient and secure edge AI deployments, validated with FPGA prototyping.

Achieving both security and efficiency remains a key challenge for deploying increasingly complex AI models on resource-constrained edge devices. This paper introduces ‘TT-SEAL: TTD-Aware Selective Encryption for Adversarially-Robust and Low-Latency Edge AI’, a novel framework that strategically encrypts only the most critical components of Tensor-Train Decomposition (TTD)-compressed neural networks. By ranking TT cores based on sensitivity and employing a value-DP optimizer, TT-SEAL achieves robustness comparable to full encryption while reducing the number of encrypted parameters to as little as 4.89-15.92% and driving decryption latency to low single digits. Could this approach unlock a new era of secure and efficient edge AI applications demanding both performance and privacy?

The Emerging Threat Landscape for Edge Intelligence

The growing synergy between cloud and edge artificial intelligence, while promising enhanced capabilities and responsiveness, inadvertently creates new avenues for malicious interference through adversarial transferability attacks. These attacks exploit the interconnectedness of collaborative systems; an adversary crafts subtle, often imperceptible, perturbations to data that, when processed by the cloud-based model, result in misclassification. Critically, these manipulated outputs then reliably transfer to the edge device, causing consistent errors even though the edge component itself hasn’t been directly compromised. This vulnerability arises because both the cloud and edge models are trained on similar datasets and share underlying architectural similarities, allowing adversarial examples to generalize effectively across the distributed system and undermining the integrity of real-time applications relying on accurate edge-based inference.

Conventional security measures designed to protect artificial intelligence systems often demand substantial computational resources, creating a critical bottleneck for deployment on edge devices. These devices – characterized by limited processing power, memory, and energy – struggle to execute complex defensive algorithms in real-time, leaving them vulnerable to attack. The very techniques intended to safeguard edge AI, such as adversarial detection and robust optimization, can introduce unacceptable latency, hindering the performance of time-sensitive applications like autonomous vehicles or industrial control systems. Consequently, a trade-off frequently emerges between security and functionality, necessitating the development of lightweight, efficient defenses that can operate effectively within the constraints of edge computing environments.

The increasing deployment of artificial intelligence at the network edge – in devices like smartphones, drones, and autonomous vehicles – introduces critical vulnerabilities to adversarial attacks, potentially compromising the integrity and reliability of these applications. Unlike attacks targeting centralized cloud systems, successful manipulation of edge AI models can have immediate and physical consequences, ranging from misidentification in security systems to navigational errors in self-driving cars. These attacks, often imperceptible to humans, exploit subtle perturbations in input data to cause misclassification, and their effectiveness is amplified by the limited computational resources available on edge devices, hindering the implementation of robust defenses. Consequently, ensuring the trustworthiness of edge AI is paramount, as even minor disruptions can lead to significant safety concerns and erode public confidence in these rapidly evolving technologies.

The FPGA-prototyped processor demonstrates a transfer-based image misclassification, incorrectly identifying a ship as a cat under the defined threat model.

TT-SEAL: Selective Encryption for Efficiency and Resilience

TT-SEAL is a selective encryption framework specifically engineered to protect the intellectual property embedded within Tree Tensor Decomposition (TTD)-compressed neural networks while simultaneously minimizing computational overhead. Unlike full encryption methods which secure all model parameters, TT-SEAL identifies and encrypts only the most sensitive portions of the TTD-compressed model. This targeted approach reduces the encryption/decryption workload, leading to improved inference speeds and reduced energy consumption, particularly crucial for deployment on edge devices or in latency-sensitive applications. The framework is designed to balance security and performance, offering a practical solution for safeguarding compressed neural network models without significant performance penalties.

TT-SEAL builds upon the foundation of Selective Encryption by moving beyond random or pre-defined parameter selection for encryption. Instead of encrypting all, or a fixed subset, of model parameters, TT-SEAL dynamically assesses each parameter’s contribution to the overall security profile of the compressed neural network. This assessment allows the system to prioritize the encryption of parameters that, if compromised, would have the most significant impact on model integrity or reveal sensitive training data. The intelligent selection process is designed to minimize computational overhead associated with encryption while maximizing the practical security gained, focusing resources on the most critical components of the model.

The Minimal-Cost Selection Algorithm within TT-SEAL operates by assessing the security impact of encrypting individual parameters within a TTD-compressed neural network model. This assessment quantifies the potential information leakage resulting from parameter exposure, allowing the algorithm to prioritize the encryption of parameters with the highest security risk. The algorithm then considers the computational cost associated with encrypting each parameter-specifically, the overhead introduced by AES encryption-and balances this cost against the assessed security impact. This optimization process aims to minimize the overall computational burden while maximizing the level of protection against potential attacks that seek to reconstruct the model or extract sensitive information from its parameters.

AES Encryption, the Advanced Encryption Standard, serves as the core cryptographic element within TT-SEAL, providing confidentiality for the selectively chosen neural network parameters. Specifically, TT-SEAL leverages AES’s symmetric-key algorithm – utilizing the same key for both encryption and decryption – to transform the selected parameters into ciphertext, rendering them unintelligible without the correct key. AES is implemented in a cipher block chaining (CBC) mode to enhance security and diffusion, and 128-bit keys are employed to balance security requirements with performance considerations. This ensures that even if certain parameters are compromised, the overall model remains protected due to the encryption of critical components and the robust nature of the AES algorithm itself.

ResNet-18 achieves comparable accuracy with and without weight compression using selective encryption, demonstrating the efficacy of the technique even with dense or TTD-compressed weights.

Core-wise Importance and Adaptive Calibration for Targeted Security

TT-SEAL utilizes a Core-wise Importance Metric to assess the security contribution of each individual TT-core within the neural network. This metric quantifies the impact of each core based on its contribution to the overall network robustness, allowing the framework to prioritize the protection of more critical components. The selection process leverages this metric to strategically choose which cores to encrypt, focusing resources on those offering the greatest security benefit and minimizing the number of encrypted parameters. This approach differs from uniform encryption schemes by providing a targeted defense, based on a quantifiable assessment of each core’s importance to the network’s security profile.

Data-Driven Threshold Calibration within the TT-SEAL framework operates by dynamically adjusting the protection strength applied to individual TT-cores based on a user-defined robustness target. This calibration process involves analyzing the sensitivity of the model to adversarial perturbations and subsequently modifying the threshold used to determine which parameters require encryption. By increasing the threshold, fewer parameters are encrypted, reducing computational overhead, while decreasing the threshold increases protection. The system iteratively refines this threshold through empirical evaluation, aiming to minimize the encrypted parameter count while maintaining a specified level of robustness against adversarial attacks, as measured by successful evasion rates against methods like I-FGSM and JBDA.

The TT-SEAL framework’s applicability was evaluated using three distinct convolutional neural network architectures: VGG-16, MobileNetV2, and ResNet-18. These networks represent a range of complexity and structural designs commonly used in image classification tasks. Performance metrics were consistently measured across all architectures using adversarial examples generated by both I-FGSM and JBDA attacks, demonstrating the framework’s ability to provide robustness improvements regardless of the underlying network structure. This cross-architectural validation confirms that TT-SEAL is not limited to a specific model type and can be broadly deployed to enhance the security of diverse deep learning systems.

TT-SEAL achieves a level of adversarial robustness comparable to full model encryption while significantly reducing the number of parameters requiring protection. Empirical results, obtained through the generation of adversarial examples using both the I-FGSM and JBDA attack methods, indicate that only 4.89% of parameters need to be encrypted for ResNet-18, 6.46% for VGG-16, and 15.92% for MobileNetV2 to attain this comparable level of security. This represents a substantial reduction in computational overhead compared to encrypting all model parameters.

A robustness threshold is calibrated by progressively adding TT-cores sorted by their importance (<span class="katex-eq" data-katex-display="false">I_{acc}</span>) until substitute accuracy reaches a target level, effectively decoupling selection from layer sizes and providing a model-intrinsic robustness target. — A robustness threshold is calibrated by progressively adding TT-cores sorted by their importance ( $I_{acc}$ ) until substitute accuracy reaches a target level, effectively decoupling selection from layer sizes and providing a model-intrinsic robustness target.

Practical Deployment and Performance Gains on Edge Hardware

TT-SEAL demonstrates practical viability through seamless deployment on Field-Programmable Gate Array (FPGA)-based Edge AI processors, paving the way for immediate threat mitigation in resource-constrained environments. This architecture leverages the inherent parallelism of FPGAs to accelerate cryptographic operations without sacrificing the low-latency requirements of edge applications. By shifting the focus from securing data in transit to protecting the model itself, TT-SEAL allows for real-time inference even with limited computational resources, a critical capability for applications like autonomous vehicles, surveillance systems, and personal privacy devices. The framework’s adaptability to existing edge hardware accelerates adoption and minimizes the need for costly infrastructure upgrades, ultimately enhancing the security posture of deployed AI systems.

Evaluations of the TT-SEAL framework reveal a substantial optimization in processing speed for edge applications utilizing the ResNet-18 model. Prior to implementation, decryption constituted 58% of the total time required for end-to-end inference; however, following integration, this share was dramatically reduced to just 2.76%. This marked improvement signifies a considerable leap in efficiency, allowing edge devices to maintain responsiveness even while employing robust security measures. By minimizing the computational burden of decryption, the framework ensures that critical tasks, such as real-time object detection or anomaly identification, can be performed swiftly and reliably without compromising data privacy.

Traditional full-encryption methods for safeguarding sensitive data in edge AI systems often incur substantial computational overhead, severely impacting application responsiveness and negating the benefits of edge deployment. This framework distinguishes itself by strategically applying encryption only where absolutely necessary – specifically, during data transmission and storage – and employing a novel, lightweight decryption process. This targeted approach dramatically reduces the decryption burden – demonstrated by a decrease from 58% to 2.76% of total inference time for ResNet-18 – enabling a substantially improved security-performance trade-off. Consequently, edge AI applications can maintain both robust data protection and real-time operational capabilities, a critical advancement for deployment in latency-sensitive and security-critical environments.

The capacity for secure and reliable operation is paramount for edge AI systems deployed in sensitive domains such as healthcare, finance, and national security. By facilitating confidential computing at the edge, this framework ensures data remains protected even during inference, mitigating risks associated with data breaches and adversarial attacks. This heightened security doesn’t come at the cost of functionality; the system maintains the responsiveness crucial for real-time applications, enabling critical decision-making without compromising data privacy or system integrity. Consequently, the framework fosters trust and enables the wider adoption of AI in areas where data sensitivity previously presented insurmountable challenges, paving the way for innovative solutions in highly regulated industries.

Selective encryption effectively suppresses adversarial transferability across ResNet-18, VGG-16, and MobileNetV2 until the accuracy <span class="katex-eq" data-katex-display="false">I_{\bm{acc}}</span> falls below a defined robustness threshold <span class="katex-eq" data-katex-display="false">I_{\bm{acc\\_th}}</span>. — Selective encryption effectively suppresses adversarial transferability across ResNet-18, VGG-16, and MobileNetV2 until the accuracy $I_{\bm{acc}}$ falls below a defined robustness threshold $I_{\bm{acc\\_th}}$ .

The pursuit of adversarial robustness, as demonstrated by TT-SEAL, necessitates a holistic understanding of system structure. The framework’s reliance on Tensor-Train Decomposition isn’t merely about model compression; it’s about exposing inherent vulnerabilities and strategically applying selective encryption. As Grace Hopper famously stated, “It’s easier to ask forgiveness than it is to get permission.” This resonates with the proactive approach of TT-SEAL – rather than attempting to build impenetrable defenses, the system identifies critical components and secures those, acknowledging that complete protection is often an illusion. Modularity, inherent in TTD, offers a pathway to focused security, but, as the research highlights, demands careful consideration of the interactions between those modules to avoid creating new attack vectors.

What Lies Ahead?

The pursuit of adversarial robustness in edge AI, as exemplified by TT-SEAL, reveals a fundamental tension. Compression, necessary for deployment on resource-constrained devices, introduces structural vulnerabilities that adversaries inevitably probe. This work offers a promising, albeit localized, solution by aligning encryption with the inherent decomposition of the model itself. However, the efficacy of this alignment remains contingent on the specific structure of the tensor decomposition and the adversarial landscape. Future investigations must explore how changes in decomposition rank, or the introduction of alternative compression schemes, affect both performance and security.

A critical, often overlooked, aspect is the cost of adaptability. While TT-SEAL addresses current attack vectors, the arms race between defenders and attackers necessitates a system capable of dynamic reconfiguration. Can encryption schemes be seamlessly integrated with ongoing model updates and retraining, or will each iteration require a complete security overhaul? The elegance of a solution is inversely proportional to the effort required to maintain it, a principle frequently ignored in the rush to publish.

Ultimately, the true measure of success will not be the complexity of the encryption, but its invisibility. Good architecture is invisible until it breaks, and only then is the true cost of decisions visible.

Original article: https://arxiv.org/pdf/2602.22238.pdf

Contact the author: https://www.linkedin.com/in/avetisyan/

The Emerging Threat Landscape for Edge Intelligence

TT-SEAL: Selective Encryption for Efficiency and Resilience

Core-wise Importance and Adaptive Calibration for Targeted Security

Practical Deployment and Performance Gains on Edge Hardware

What Lies Ahead?

See also: