Track papers across labs, topics, and trends.
Search papers, labs, and topics across Lattice.
This paper provides a systematic review of security and privacy threats targeting on-device AI inference, filling a gap in existing surveys that focus on broader edge intelligence scenarios. The review categorizes both attacks and defenses, revealing a significant imbalance in the literature, with a disproportionate focus on IP protection compared to other critical threats like adversarial attacks. The analysis identifies specific attack categories lacking adequate defense mechanisms, highlighting key areas for future research.
On-device AI is surprisingly vulnerable: defenses are heavily skewed towards IP protection, leaving critical attack vectors like adversarial examples largely unaddressed.
The need for secure and private Artificial Intelligence (AI) and Machine Learning (ML) on edge and mobile devices has increased the necessity of protecting the architecture of these systems from threats to both security and privacy. With an ever-increasing number of pre-trained AI models being used on mobile platforms for client-side inference, there are rising concerns about the risks associated with the theft/extraction of AI models, adversarial attacks on AI models, and data breaches. As a result of this trend, a variety of defence mechanisms have been proposed to protect against these threats. These include Trusted Execution Environments (TEEs), homomorphic encryption, obfuscation, and differential privacy, among others. However, current surveys largely focus on edge intelligence, which includes distributed training, and thus overlook security and privacy issues that are specific to on-device AI inference. To the best of our knowledge, this paper presents the first comprehensive review of threats and corresponding defence mechanisms targeting on-device inference. Our results show that the attack and defence literature are unbalanced: approximately one quarter of the surveyed attack papers focus on Intellectual Property (IP) attacks, whereas half of the defence solutions tackle the same issue. More importantly, some attack categories have no defence paper associated to them, such as adversarial attacks that account for roughly one third of the attack literature. This asymmetry between known attacks and available mitigations highlights clear opportunities for future research on securing on-device AI inference.