Scholarlink

This study presents the first framework designed to protect the intellectual property of Quantized Neural Networks (QNNs) on Arm Cortex-M MCUs equipped with TrustZone-M. Our framework - SecureQNN - employs an iterative simulation to identify the most privacy-critical layers of a QNN, strategically offloading their execution to the secure-world of TrustZone-M. For each set of private layers, SecureQNN computes the epochs an adversary should employ to reconstruct a substitute QNN that is at least as accurate as the target QNN. The set of layers allowing the adversary to train with less effort than the original training process is delegated to the secure-world of TrustZone-M. Results for QNNs trained on CIFAR-10 and Visual Wake Words (VWW) datasets suggest that it is possible to increase the privacy of a QNN by delegating only 51% to 65% of the total model size to the secure-world.

错误：搜索内容不能为空，请输入英文关键词
错误：关键词超出字数限制，请精简
高级检索

Protecting the Intellectual Property of QNNs at the Deep Edge

  • 会议论文

  • 出版模式：

    开放获取

  • 发表日期：

    2026年

查看全文
  • Miguel Costa,
  • Tiago Gomes,
  • Sandro Pinto

摘要

This study presents the first framework designed to protect the intellectual property of Quantized Neural Networks (QNNs) on Arm Cortex-M MCUs equipped with TrustZone-M. Our framework - SecureQNN - employs an iterative simulation to identify the most privacy-critical layers of a QNN, strategically offloading their execution to the secure-world of TrustZone-M. For each set of private layers, SecureQNN computes the epochs an adversary should employ to reconstruct a substitute QNN that is at least as accurate as the target QNN. The set of layers allowing the adversary to train with less effort than the original training process is delegated to the secure-world of TrustZone-M. Results for QNNs trained on CIFAR-10 and Visual Wake Words (VWW) datasets suggest that it is possible to increase the privacy of a QNN by delegating only 51% to 65% of the total model size to the secure-world.