Protecting CPU AI On Edge TEEs: WebAssembly's Promise and Practical Challenges
OP-TEE runs unaltered WebAssembly AI models on Arm TrustZone with 22% overhead and 6% extra latency.
Edge AI models hold intellectual property that an adversary with root access can steal, and Arm TrustZone TEEs are hard to use for unaltered apps. The authors execute unaltered models compiled to WebAssembly on the WebAssembly Micro Runtime inside OP-TEE, and a distributor encrypts the binary with a key placed in a device fuse so only the trusted application can decrypt it. Compared with a manually ported OP-TEE application, the approach adds 22% overhead and about 6% inference latency. They conclude WebAssembly is promising for protecting on-device model IP, with remaining practical challenges.
- Unaltered WASM AI models run on WAMR inside OP-TEE for Arm TrustZone
- Distributor encrypts the binary and stores the key in a device fuse
- 22% overhead versus an application manually ported to OP-TEE
- About 6% extra inference latency without significant porting
- Vendors
- Arm
From the original article
1 min read at arxiv.orgAI models on edge hardware contain important intellectual property (IP), but an adversary can steal it when they achieve root access. Trusted Execution Environments (TEE) like Arm TrustZone protect against these Operating System (OS) level attacks. However, they are challenging to use.
By Friedrich Vandenberghe · arxiv.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.