Protecting On-Device AI Inference: A Systematic Review of Attacks and Defence Mechanisms
For researchers and practitioners in on-device AI security, this survey identifies gaps between known attacks and available defences, highlighting opportunities for future work.
This paper presents the first comprehensive review of threats and defence mechanisms specifically targeting on-device AI inference, finding that attack and defence literature is unbalanced: about a quarter of attack papers focus on IP attacks, while half of defence solutions address this issue, and some attack categories (e.g., adversarial attacks, one third of attack literature) have no corresponding defences.
The need for secure and private Artificial Intelligence (AI) and Machine Learning (ML) on edge and mobile devices has increased the necessity of protecting the architecture of these systems from threats to both security and privacy. With an ever-increasing number of pre-trained AI models being used on mobile platforms for client-side inference, there are rising concerns about the risks associated with the theft/extraction of AI models, adversarial attacks on AI models, and data breaches. As a result of this trend, a variety of defence mechanisms have been proposed to protect against these threats. These include Trusted Execution Environments (TEEs), homomorphic encryption, obfuscation, and differential privacy, among others. However, current surveys largely focus on edge intelligence, which includes distributed training, and thus overlook security and privacy issues that are specific to on-device AI inference. To the best of our knowledge, this paper presents the first comprehensive review of threats and corresponding defence mechanisms targeting on-device inference. Our results show that the attack and defence literature are unbalanced: approximately one quarter of the surveyed attack papers focus on Intellectual Property (IP) attacks, whereas half of the defence solutions tackle the same issue. More importantly, some attack categories have no defence paper associated to them, such as adversarial attacks that account for roughly one third of the attack literature. This asymmetry between known attacks and available mitigations highlights clear opportunities for future research on securing on-device AI inference.