Verifiable Deep Learning Inference on Heterogeneous Edge Devices With Trusted Execution Environment

Deep learning inference on edge devices is susceptible to security threats, particularly fault injection attacks (FIAs), which are easily executed and pose a significant risk to the inference. These attacks could potentially lead to alterations to the memory of the edge device or errors in the execution of instructions. Specifically, time-intensive convolution computation is considerably vulnerable in deep learning inference at the edge. To detect and defend attacks against deep learning inference on heterogeneous edge devices, we propose an efficient hardware-based solution for verifiable model inference named DarkneTV. It leverages an asynchronous mechanism to conduct hash checking of convolution weights and verification of convolution computations within the trusted execution environment (TEE) of the central processing unit (CPU) when the integrated graphics processing unit (GPU) runs model inference. It protects the integrity of convolution weights and the correctness of inference results, and effectively detects abnormal weight modifications and incorrect inference results regarding neural operators. Extensive experimental results show that DarkneTV identifies tiny FIAs against convolution weights and computation with over 99.03% accuracy but less extra time overhead. The asynchronous mechanism significantly improves the performance of verifiable inference. Typically, the speedups of the GPU-accelerated verifiable inference on the Hikey 960 achieve
$8.50\times $
–
$11.31\times $
compared with the CPU-only mode.