ASGARD: Protecting On-Device Deep Neural Networks with Virtualization-Based Trusted Execution Environments

On-device deep learning, increasingly popular for enhancing user privacy, now poses a serious risk to the privacy of deep neural network (DNN) models.Researchers have proposed to leverage Arm TrustZone's trusted execution environment (TEE) to protect models from attacks originating in the rich execution environment (REE).Existing solutions, however, fall short: (i) those that fully contain DNN inference within a TEE either support inference on CPUs only, or require substantial modifications to closed-source proprietary software for incorporating accelerators; (ii) those that offload part of DNN inference to the REE either leave a portion of DNNs unprotected, or incur large run-time overheads due to frequent model (de)obfuscation and TEE-to-REE exits.We present ASGARD, the first virtualization-based TEE solution designed to protect on-device DNNs on legacy Armv8-A SoCs.Unlike prior work that uses TrustZone-based TEEs for model protection, ASGARD's TEEs remain compatible with existing proprietary software, maintain the trusted computing base (TCB) minimal, and incur near-zero run-time overhead.To this end, ASGARD (i) securely extends the boundaries of an existing TEE to incorporate an SoC-integrated accelerator via secure I/O passthrough, (ii) tightly controls the size of the TCB via our aggressive yet security-preserving platformand application-level TCB debloating techniques, and (iii) mitigates the number of costly TEE-to-REE exits via our exitcoalescing DNN execution planning.We implemented ASGARD on RK3588S, an Armv8.2-A-basedcommodity Android platform equipped with a Rockchip NPU, without modifying Rockchipnor Arm-proprietary software.Our evaluation demonstrates that ASGARD effectively protects on-device DNNs in legacy SoCs with a minimal TCB size and negligible inference latency overhead.* Corresponding author.model privacy.The leakage of DNN models could cause (at least) two harms, (i) first financially, as they constitute valuable (often mission-critical) intellectual properties, and (ii) in terms of user privacy, as the models could indirectly leak information about their training data [54], [16], [17].Researchers in response proposed a range of on-device DNN model protection solutions [52], [72], [65], [45], [67], which predominantly use Arm TrustZone to create a trusted execution environment (TEE) and host DNN inference inside the TEE.