{"about":{"site":"https://codewithpapers.app","non_affiliation":"Code with Papers and Syntology are not affiliated with, endorsed by, or sponsored by Papers with Code, Meta, or the pwc-archive mirror.","licence":"CC BY-SA 4.0","licence_url":"https://creativecommons.org/licenses/by-sa/4.0/legalcode","attribution":"https://codewithpapers.app/attribution","modified":"archive material modified by Syntology; see the attribution page"},"url":"/paper/no-privacy-left-outside-on-the-in-security-of","title":"No Privacy Left Outside: On the (In-)Security of TEE-Shielded DNN Partition for On-Device ML","arxiv_id":"2310.07152","date":"2023-10-11","proceeding":null,"authors":["Ziqi Zhang","Chen Gong","Yifeng Cai","Yuanyuan Yuan","Bingyan Liu","Ding Li","Yao Guo","Xiangqun Chen"],"abstract":"On-device ML introduces new security challenges: DNN models become white-box accessible to device users. Based on white-box information, adversaries can conduct effective model stealing (MS) and membership inference attack (MIA). Using Trusted Execution Environments (TEEs) to shield on-device DNN models aims to downgrade (easy) white-box attacks to (harder) black-box attacks. However, one major shortcoming is the sharply increased latency (up to 50X). To accelerate TEE-shield DNN computation with GPUs, researchers proposed several model partition techniques. These solutions, referred to as TEE-Shielded DNN Partition (TSDP), partition a DNN model into two parts, offloading the privacy-insensitive part to the GPU while shielding the privacy-sensitive part within the TEE. This paper benchmarks existing TSDP solutions using both MS and MIA across a variety of DNN models, datasets, and metrics. We show important findings that existing TSDP solutions are vulnerable to privacy-stealing attacks and are not as safe as commonly believed. We also unveil the inherent difficulty in deciding optimal DNN partition configurations (i.e., the highest security with minimal utility cost) for present TSDP solutions. The experiments show that such ``sweet spot'' configurations vary across datasets and models. Based on lessons harvested from the experiments, we present TEESlice, a novel TSDP method that defends against MS and MIA during DNN inference. TEESlice follows a partition-before-training strategy, which allows for accurate separation between privacy-related weights from public weights. TEESlice delivers the same security protection as shielding the entire DNN model inside TEE (the ``upper-bound'' security guarantees) with over 10X less overhead (in both experimental and real-world environments) than prior TSDP solutions and no accuracy loss.","url_abs":"https://arxiv.org/abs/2310.07152v1","url_pdf":"https://arxiv.org/pdf/2310.07152v1.pdf","source":{"archive":"pwc-archive (Hugging Face), CC BY-SA 4.0","snapshot":"2025-07-28","licence_url":"https://creativecommons.org/licenses/by-sa/4.0/legalcode","row_kind":"abstracts"},"code_links":[{"paper_slug":"no-privacy-left-outside-on-the-in-security-of","repo_url":"https://github.com/ziqi-zhang/teeslice-artifact","is_official":1,"mentioned_in_paper":1,"mentioned_in_github":0,"framework":"pytorch","reach":{"status":"ok"}}],"tasks":[{"task_slug":null,"task_name":"GPU"},{"task_slug":"inference-attack","task_name":"Inference Attack"},{"task_slug":"membership-inference-attack","task_name":"Membership Inference Attack"}],"methods":[],"datasets_introduced":[],"methods_introduced":[],"results":[],"syntology":{"syntology_url":"https://syntology.ai/paper/2310.07152","atlas_url":"https://app.syntology.ai/?focus=2310.07152","mcp":{"get_harvested_code_for_paper":{"arxiv_id":"2310.07152"}},"developers":"https://syntology.ai/developers","read_at":"2026-09-25T09:33:49+00:00","read_at_is":"when the build read Syntology's graph, not when any sample ran","claim":"Per-sample execution status on synthesized fixtures; not a correctness claim about the paper. Samples come from repositories linked to the paper, official or community; repo_kind says which.","repos":[{"provenance":"external:paperswithcode_snapshot_2025-07-28","url":"https://github.com/ziqi-zhang/teeslice-artifact","reach":{"status":"ok"}}],"summary":{"ran":7,"unverified":8},"by_repo_kind":{"official":{"samples":15,"ran":7,"repositories":1}},"repo_kind_vocabulary":{"official":"The archive marks this repository official for the paper","named_in_paper":"The archive records that the paper mentions this repository; it is not marked official","listed":"In the archive's code links for this paper, not marked official and not recorded as mentioned in the paper","found_in_text":"Syntology found this repository in the paper's own text; whether it is the authors' implementation is not asserted","community":"Not in the archive's code links for this paper; a community repository Syntology harvested"},"n_pointer_only_for_licence":15,"samples":[{"code_sha256_prefix":"1fc66939068066e8","entry":"Lx_distance","repo":"ziqi-zhang/teeslice-artifact","repo_kind":"official","path":"membership-inference/utils_shadownet.py","file_url":"https://github.com/ziqi-zhang/teeslice-artifact/blob/HEAD/membership-inference/utils_shadownet.py","link_basis":"first_harvest_node","language":"python","status":"ran","verification_level":1,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":true,"licence":"NONE","inline_ok":false,"mcp_get_code":{"code_sha256":"1fc66939068066e8"}},{"code_sha256_prefix":"0ba85727fd94c3d0","entry":"fchecker_variance","repo":"ziqi-zhang/teeslice-artifact","repo_kind":"official","path":"membership-inference/utils_shadownet.py","file_url":"https://github.com/ziqi-zhang/teeslice-artifact/blob/HEAD/membership-inference/utils_shadownet.py","link_basis":"first_harvest_node","language":"python","status":"ran","verification_level":1,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"NONE","inline_ok":false,"mcp_get_code":{"code_sha256":"0ba85727fd94c3d0"}},{"code_sha256_prefix":"64e9bca534ec9a24","entry":"get_net","repo":"ziqi-zhang/teeslice-artifact","repo_kind":"official","path":"membership-inference/knockoff_train.py","file_url":"https://github.com/ziqi-zhang/teeslice-artifact/blob/HEAD/membership-inference/knockoff_train.py","link_basis":"first_harvest_node","language":"python","status":"ran","verification_level":1,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"NONE","inline_ok":false,"mcp_get_code":{"code_sha256":"64e9bca534ec9a24"}},{"code_sha256_prefix":"2c39ccfcd5989720","entry":"load_databatch","repo":"ziqi-zhang/teeslice-artifact","repo_kind":"official","path":"membership-inference/demoloader/downsampled_imagenet.py","file_url":"https://github.com/ziqi-zhang/teeslice-artifact/blob/HEAD/membership-inference/demoloader/downsampled_imagenet.py","link_basis":"first_harvest_node","language":"python","status":"ran","verification_level":1,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"NONE","inline_ok":false,"mcp_get_code":{"code_sha256":"2c39ccfcd5989720"}},{"code_sha256_prefix":"d8513d247401ec1a","entry":"load_target_model","repo":"ziqi-zhang/teeslice-artifact","repo_kind":"official","path":"membership-inference/train_layer.py","file_url":"https://github.com/ziqi-zhang/teeslice-artifact/blob/HEAD/membership-inference/train_layer.py","link_basis":"first_harvest_node","language":"python","status":"ran","verification_level":1,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"NONE","inline_ok":false,"mcp_get_code":{"code_sha256":"d8513d247401ec1a"}},{"code_sha256_prefix":"a41f3ea5d5aab0b5","entry":"shadownet_layer","repo":"ziqi-zhang/teeslice-artifact","repo_kind":"official","path":"membership-inference/utils_shadownet.py","file_url":"https://github.com/ziqi-zhang/teeslice-artifact/blob/HEAD/membership-inference/utils_shadownet.py","link_basis":"first_harvest_node","language":"python","status":"ran","verification_level":1,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"NONE","inline_ok":false,"mcp_get_code":{"code_sha256":"a41f3ea5d5aab0b5"}},{"code_sha256_prefix":"104afcbc0f6f4143","entry":"train_step","repo":"ziqi-zhang/teeslice-artifact","repo_kind":"official","path":"membership-inference/knockoff_train.py","file_url":"https://github.com/ziqi-zhang/teeslice-artifact/blob/HEAD/membership-inference/knockoff_train.py","link_basis":"first_harvest_node","language":"python","status":"ran","verification_level":1,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"NONE","inline_ok":false,"mcp_get_code":{"code_sha256":"104afcbc0f6f4143"}},{"code_sha256_prefix":"18aa3a782441967c","entry":"alexnet","repo":"ziqi-zhang/teeslice-artifact","repo_kind":"official","path":"membership-inference/models/alexnet.py","file_url":"https://github.com/ziqi-zhang/teeslice-artifact/blob/HEAD/membership-inference/models/alexnet.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"NONE","inline_ok":false,"mcp_get_code":{"code_sha256":"18aa3a782441967c"}},{"code_sha256_prefix":"9abbfa903ffc4510","entry":"compute_confidence_gap","repo":"ziqi-zhang/teeslice-artifact","repo_kind":"official","path":"membership-inference/mem_attack.py","file_url":"https://github.com/ziqi-zhang/teeslice-artifact/blob/HEAD/membership-inference/mem_attack.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"NONE","inline_ok":false,"mcp_get_code":{"code_sha256":"9abbfa903ffc4510"}},{"code_sha256_prefix":"dd0b2bf99e413935","entry":"compute_generalization_gap","repo":"ziqi-zhang/teeslice-artifact","repo_kind":"official","path":"membership-inference/mem_attack.py","file_url":"https://github.com/ziqi-zhang/teeslice-artifact/blob/HEAD/membership-inference/mem_attack.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"NONE","inline_ok":false,"mcp_get_code":{"code_sha256":"dd0b2bf99e413935"}},{"code_sha256_prefix":"405ae35edc541ea3","entry":"create_model","repo":"ziqi-zhang/teeslice-artifact","repo_kind":"official","path":"membership-inference/models/alexnet.py","file_url":"https://github.com/ziqi-zhang/teeslice-artifact/blob/HEAD/membership-inference/models/alexnet.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"NONE","inline_ok":false,"mcp_get_code":{"code_sha256":"405ae35edc541ea3"}},{"code_sha256_prefix":"840eea9045ad3fe6","entry":"get_value","repo":"ziqi-zhang/teeslice-artifact","repo_kind":"official","path":"membership-inference/gol.py","file_url":"https://github.com/ziqi-zhang/teeslice-artifact/blob/HEAD/membership-inference/gol.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"NONE","inline_ok":false,"mcp_get_code":{"code_sha256":"840eea9045ad3fe6"}},{"code_sha256_prefix":"5352dbef4078e55a","entry":"samples_to_transferset","repo":"ziqi-zhang/teeslice-artifact","repo_kind":"official","path":"membership-inference/train_layer.py","file_url":"https://github.com/ziqi-zhang/teeslice-artifact/blob/HEAD/membership-inference/train_layer.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"NONE","inline_ok":false,"mcp_get_code":{"code_sha256":"5352dbef4078e55a"}},{"code_sha256_prefix":"20c1f5f89a49698b","entry":"soft_cross_entropy","repo":"ziqi-zhang/teeslice-artifact","repo_kind":"official","path":"membership-inference/knockoff_train.py","file_url":"https://github.com/ziqi-zhang/teeslice-artifact/blob/HEAD/membership-inference/knockoff_train.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"NONE","inline_ok":false,"mcp_get_code":{"code_sha256":"20c1f5f89a49698b"}},{"code_sha256_prefix":"4ebc0e09cb353eac","entry":"unpickle","repo":"ziqi-zhang/teeslice-artifact","repo_kind":"official","path":"membership-inference/demoloader/downsampled_imagenet.py","file_url":"https://github.com/ziqi-zhang/teeslice-artifact/blob/HEAD/membership-inference/demoloader/downsampled_imagenet.py","link_basis":"harvester_set","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"NONE","inline_ok":false,"mcp_get_code":{"code_sha256":"4ebc0e09cb353eac"}}]},"arxiv_metadata":null,"syntology_extracted_results":null}