.png){kind=icon}
.png){kind=icon}
Return
Securing data confidentiality for on-device inference using multi-enclave trusted execution environments
.png){kind=icon}
PRE
AI
DOI：10.1007/s10586-026-06361-w.png)
.png){kind=icon}
Original request for help.png){kind=icon}
Share.png){kind=icon}
Save
Abstract
En 中文
On-device machine learning (ODML) is being rapidly deployed in edge-computing applications, but the on-device inference stack may still be partially untrusted (e.g., third-party model runtimes, compromised OS/frameworks), enabling exfiltration of raw inputs and inference outputs. This paper presents Split Inference, a multi-enclave trusted-execution architecture that confines the most sensitive parts of the inference pipeline to two isolated enclaves (Input Enclave and Output Enclave) while executing the compute-intensive middle layers outside enclaves for efficiency. Split Inference establishes a provable secure channels between the application and each enclave via a proposed key-distribution protocol. Our inference privacy analysis also demonstrated that the solution is immune from the label inference attack and can effectively mitigate the data reconstruction attack. We implemented Split Inference for MobileNetV1 on Keystone (a RISC-V multi-enclave TEE) and evaluate end-to-end overhead relative to a non-enclave baseline. Our experiments showed that Split Inference incurs 71% to 430% of inference overhead.
Keywords:
Trusted execution environments
RISC-V
MobileNet
Data confidentiality
On-device machine learning
Model inference
Split learning
Journal
C
IF:
4.1
Papers:
5.0K
Citations:
7.5K