💻 computer science

Verifiable and Confidential DNN Inference on Low-End Edge Devices

This paper presents VECODI, a framework that enables verifiable and confidential DNN inference on low-end edge devices by introducing SHANGRI-LA, a novel execution abstraction on TrustZone-M TEEs that minimizes the trusted computing base and overhead while protecting model integrity.

Original authors: Mohamed Khalil Kiri (EURECOM), Ivan De Oliveira Nunes (University of Zurich), Aurélien Francillon (EURECOM), Norrathep Rattanavipanon (PSU Phuket)

Published 2026-06-08

📖 5 min read🧠 Deep dive

CC BY 4.0

Original authors: Mohamed Khalil Kiri (EURECOM), Ivan De Oliveira Nunes (University of Zurich), Aurélien Francillon (EURECOM), Norrathep Rattanavipanon (PSU Phuket)

Original paper licensed under CC BY 4.0 (http://creativecommons.org/licenses/by/4.0/). ✨ This is an AI-generated explanation of the paper below. It is not written or endorsed by the authors. For technical accuracy, refer to the original paper. Read full disclaimer

Imagine you have a secret recipe for a delicious cake (this is the AI model). You want to let a small, local bakery (the edge device, like a smart camera or sensor) bake this cake for customers without ever giving them the recipe. At the same time, you need to make sure the bakery isn't cheating by serving a store-bought cake and claiming it's yours, or by baking too many cakes when you only paid for one.

This is the exact problem VECODI solves for tiny, low-cost computers.

Here is how the paper breaks it down, using simple analogies:

The Problem: The "Trust Zone" Dilemma

Usually, to keep a secret safe, you put it in a super-secure vault (called a Trusted Execution Environment or TEE).

The Old Way: To protect the AI model, researchers tried to put the entire baking process inside this vault.
- The Flaw: The vault is tiny (like a shoebox). It can't fit the whole recipe and the mixing bowls. Also, if the baker (the AI code) has a mistake or a bug, it can break the vault and steal the keys to everything else inside.
The Other Way: Put the baking outside in the open kitchen.
- The Flaw: Anyone can walk in, steal the recipe, or swap the cake with a fake one.

The Solution: VECODI and "Shangri-La"

The authors created a new system called VECODI. Its secret sauce is a new concept they call SHANGRI-LA.

Think of the computer's memory as a house with two rooms:

The Secure Room (The Vault): Very small, guarded by a robot. Only the most critical keys live here.
The Normal Room (The Kitchen): Large, where all the messy cooking happens. It's usually untrusted.

SHANGRI-LA is a "Magic Glass Booth" built inside the Normal Room.

It sits in the open kitchen, but it has special glass walls that the people in the kitchen can't break or look through.
The robot in the Secure Room holds the keys to the glass walls.
The Magic: The AI model (the secret recipe) lives inside this glass booth. The code that does the baking also lives there.
The Best Part: The Secure Room (the Vault) doesn't need to know the recipe or how to bake. It just needs to know how to lock and unlock the glass booth. This keeps the Vault tiny and safe, even if the baking code is huge or has bugs.

How It Works in Real Life

The Setup (Provisioning):
The AI owner (the Chef) puts the secret part of the recipe into an encrypted box and gives it to the bakery. The Chef also gives the bakery a special "Glass Booth" setup. The Chef tells the bakery's robot: "Only let the bakery owner bake, and only 100 times."
The Bake (Inference):
When a customer wants a cake, the bakery owner asks the robot to open the Glass Booth.
- The robot checks the ID.
- The robot temporarily turns the Glass Booth into a "Secure Zone" for a split second.
- The baking happens inside the booth. The people in the open kitchen (hackers) cannot see the recipe or touch the mixing bowls.
- Once the cake is done, the robot locks the booth again and hands over the cake.
The Proof (Verifiability):
The bakery owner doesn't just hand over the cake; they hand over a sealed receipt signed by the robot.
- This receipt proves: "This cake was baked using your secret recipe, inside this specific booth, at this exact time, using this specific ingredient."
- The customer can check the receipt to make sure the bakery didn't cheat, without ever needing to see the secret recipe or the raw ingredients.

Why This is a Big Deal (The Results)

The paper tested this on a real, tiny development board (a NUCLEO-L552ZE-Q). Here is what they found:

Tiny Vault: By moving the heavy baking code out of the Secure Room and into the Glass Booth, they reduced the size of the "Trust Zone" (the part that needs to be perfectly secure) by 95%. This means the system is much harder to hack because there is less code to protect.
Fast: The "Glass Booth" adds almost no delay. It only slowed down the baking process by 0.07% (less than a millisecond). It's fast enough for real-time tasks like stopping a car or diagnosing a patient.
Safe from Theft: Even if a hacker takes over the bakery (the Normal Room), they cannot steal the recipe because it's locked in the Glass Booth. They also can't bake infinite cakes because the robot counts the uses.

Summary

VECODI is like building a secure, invisible kitchen inside a regular, untrusted house. It allows tiny, cheap computers to run powerful, secret AI models without needing expensive, high-end hardware, while proving to the world that the results are genuine and haven't been tampered with.

Technical Summary: VECODI

Problem Statement

Deploying Deep Neural Network (DNN) inference on low-end edge devices (e.g., microcontrollers) presents two conflicting challenges: ensuring model confidentiality against compromised edge systems and enabling verifiable inference without incurring prohibitive overhead.

Existing solutions face significant limitations:

TEE-Shielded DNN Partitioning (TSDP): While these approaches protect sensitive model layers within Trusted Execution Environments (TEEs), they require placing inference code and libraries directly into the Secure World. This significantly enlarges the Trusted Computing Base (TCB), increases the attack surface, and strains the limited memory of low-end devices.
Full TEE Execution: Running the entire pipeline in the TEE is often infeasible due to memory constraints (Secure RAM is typically tens of kilobytes, while DNNs require megabytes).
Untrusted Execution: Running entirely in the Normal World offers no protection against model extraction or result spoofing by malware.

Furthermore, current approaches often fail to address model extraction attacks (where adversaries reconstruct models via inference queries) or introduce excessive computational overhead through cryptographic proofs, making them unsuitable for power-constrained edge devices.

Methodology

The authors propose VECODI, a framework for verifiable and confidential DNN inference on ARM TrustZone-M platforms. The core innovation is a new execution abstraction called SHANGRI-LA.

SHANGRI-LA: A Third Runtime Environment

Unlike traditional TrustZone-M architectures which strictly separate the Secure World (SW) and Non-Secure World (NSW), SHANGRI-LA establishes a third runtime environment that resides physically in the Non-Secure World but operates with elevated privileges enforced by the Secure World.

Privilege Model: SHANGRI-LA has privileges strictly between the Secure and Non-Secure Worlds. It is protected from the Non-Secure World (preventing code/data tampering) but cannot interfere with the Secure World components.
Memory Management: SHANGRI-LA code and data reside in Non-Secure RAM. However, during the Create phase, the Secure World temporarily marks these regions as Secure to prevent access. Just before execution, the Execute API atomically re-marks them as Non-Secure, allowing the code to run in the Normal World while maintaining isolation from other Non-Secure processes.
Hardware Access: SHANGRI-LA retains direct access to hardware I/O peripherals, ensuring that sensor data acquisition cannot be intercepted or manipulated by the Normal World.

VECODI Protocol

VECODI orchestrates interactions between four stakeholders: a Model Provider (PVD), an Edge Device (DEV), a Model Consumer (CSM), and a Verifier (VRF). The protocol consists of four stages:

Provisioning (I1): The PVD partitions the DNN model into a public component ( $M_{pub}$ ) and a private component ( $M_{pri}$ ). $M_{pri}$ is encrypted. The inference code ( $F$ ), $M_{pub}$ , and encrypted $M_{pri}$ are installed in the Normal World. Metadata and keys are provisioned to the Secure World via the Provision API.
Authorization (I2): The CSM requests access from the PVD. The PVD issues a signed authorization token ( $T_{CSM}$ ) specifying usage limits. The DEV's Secure World updates the SHANGRI-LA instance policy via the Authorize API.
Inference (I3): The CSM invokes the Create API to instantiate SHANGRI-LA. It then calls Execute, providing a signed token. The Secure World validates the request, switches SHANGRI-LA memory to Non-Secure, and executes $F$ . $F$ retrieves raw sensor data, performs inference using $M$ , and generates an output ( $Out_F$ ).
Verification (I4): If requested, the Secure World generates a Proof of Execution (PoX) ( $T_{proof}$ ) signed with the device's attestation key. This proof binds the input, the specific model ID, the execution instance, and the output. The VRF validates this proof without needing access to the raw input data.

Key Security Mechanisms

Confidentiality: $M_{pri}$ is encrypted in Flash and only decrypted into protected Non-Secure RAM during execution. The Secure World ensures no other Non-Secure code can access this memory.
Verifiability: The PoX mechanism guarantees that the output was produced by the correct code ( $F$ ) on the correct model ( $M$ ) using authentic sensor inputs, without revealing the raw inputs to the verifier.
Anti-Extraction: The Authorize API enforces strict usage limits, mitigating model extraction attacks that rely on high-frequency inference queries.

Key Contributions

SHANGRI-LA Abstraction: The introduction of a lightweight, third runtime environment on TrustZone-M that provides isolation from the Normal World without requiring the execution of inference code within the Secure World. This allows third-party developers to deploy trusted applications without modifying core Secure World components.
Secure and Verifiable Inference: A complete protocol (VECODI) that achieves model confidentiality and verifiable inference on low-end devices. It combines SHANGRI-LA with an inference authorization mechanism and a proof-of-execution scheme that preserves input privacy.
Practical Implementation: A prototype implementation on a NUCLEO-L552ZE-Q development board (ARM Cortex-M33) demonstrating the feasibility of the approach on resource-constrained hardware.

Results and Evaluation

The authors evaluated VECODI against a baseline where inference code runs entirely in the Secure World (D2 design) and a Non-Secure baseline.

TCB Reduction: VECODI reduces the Secure World TCB by 95.64% (from 34,865 Lines of Code to 1,523 LOC). Crucially, the TCB size is independent of the inference code or model architecture, unlike prior approaches where the TCB grows with the application.
Memory Footprint: By keeping the public model component ( $M_{pub}$ ) in the Normal World and only duplicating the private component ( $M_{pri}$ ) in protected Non-Secure RAM, VECODI avoids the need to store the entire plaintext model in Secure RAM, which often exceeds the capacity of low-end devices.
Runtime Overhead: VECODI incurs a runtime overhead of only 0.83 ms (0.07%) compared to a Non-Secure baseline. The proof generation adds approximately 230 ms, but this is comparable to the signing cost required in baseline secure systems to authenticate the device.
Case Study: In a camera-based image classification scenario, VECODI maintained an average latency of 1428.42 ms per inference, showing negligible overhead compared to the baseline (1427.57 ms).

Significance and Claims

The paper claims that VECODI represents a practical solution for secure DNN inference on low-end edge devices by fundamentally changing the execution model. By introducing SHANGRI-LA, the authors demonstrate that it is possible to:

Decouple the inference code from the Trusted Computing Base, thereby minimizing the attack surface and TCB size.
Enable verifiable inference and model confidentiality without requiring high-end hardware features (like MMUs) or incurring prohibitive performance penalties.
Support existing TEE-Shielded DNN Partitioning strategies without modification, making it a drop-in improvement for current edge security architectures.

The authors assert that SHANGRI-LA is of independent interest beyond DNN inference, as it enables the deployment of arbitrary trusted applications on TrustZone-M devices without altering the core Secure World, addressing a gap in current low-end security abstractions.