When Rotation Bounds Nothing: Streaming Image Classifiers to Field Nodes Under Physical Capture
Rotating streamed image classifiers fails to stop model recovery after physical seizure.
The paper tests whether streaming a chunkable multi-exit image classifier into volatile memory, and rotating chunks, can limit model theft if a field node is physically seized and cold-boot captured. On real LTE traces, neither a from-scratch model nor one sliced from a public pretrained backbone resists a capable adversary; only recovery cost differs. Against the from-scratch victim, usable CIFAR-100 seizures rise from 42.6% at 5 seconds to 86.8% at 30 seconds, while a public backbone lets the adversary recover at least 90% of maximum accuracy at every depth.
- Multi-exit classifiers stream into volatile memory to limit residency.
- Capture measured on real LTE traces against passive and adaptive adversaries.
- Rotation fails against a capable adversary for both victim setups.
- A public pretrained backbone enables at least 90% of maximum accuracy.
From the original article
1 min read at arxiv.orgField nodes run image classifiers locally, exposing a first-class asset, the trained model, to theft. Trusted-execution enclaves, collaborative-inference splits, and encrypted storage assume the device owner is the adversary from deployment. Here the operator owns the node, and an adversary seizing it reads only what cold-boot capture finds resident.
By Daniel Gilkarov · arxiv.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.