mlsanityData to 7 Oct 2026

Investigating White-Box Attacks for On-Device Models

arXiv 2402.05493 ↗First posted 8 Feb 2024cs.SE cs.AI cs.CRcited by 6

Not on the map. Why?

Abstract (arXiv)

Numerous mobile apps have leveraged deep learning capabilities. However, on-device models are vulnerable to attacks as they can be easily extracted from their corresponding mobile apps. Existing on-device attacking approaches only generate black-box attacks, which are far less effective and efficient than white-box strategies. This is because mobile deep learning frameworks like TFLite do not support gradient computing, which is necessary for white-box attacking algorithms. Thus, we argue that existing findings may underestimate the harmfulness of on-device attacks. To this end, we conduct a study to answer this research question: Can on-device models be directly attacked via white-box strategies? We first systematically analyze the difficulties of transforming the on-device model to its debuggable version, and propose a Reverse Engineering framework for On-device Models (REOM), which automatically reverses the compiled on-device TFLite model to the debuggable model. Specifically, REOM first transforms compiled on-device models into Open Neural Network Exchange format, then removes the non-debuggable parts, and converts them to the debuggable DL models format that allows attackers to exploit in a white-box setting. Our experimental results show that our approach is effective in achieving automated transformation among 244 TFLite models. Compared with previous attacks using surrogate models, REOM enables attackers to achieve higher attack success rates with a hundred times smaller attack perturbations. In addition, because the ONNX platform has plenty of tools for model format exchanging, the proposed method based on the ONNX platform can be adapted to other model formats. Our findings emphasize the need for developers to carefully consider their model deployment strategies, and use white-box methods to evaluate the vulnerability of on-device models.

Key facts. Cited by 6 papers in the map (data through 7 Oct 2026). Builds on 28 of its 38 references that are in the map. First posted on arXiv 8 Feb 2024.

Builds on

28 of 38 references.

References · 28

  1. 2014Explaining and Harnessing Adversarial Examplescited by 7,287
  2. 2017Towards Deep Learning Models Resistant to Adversarial Attackscited by 6,326
  3. 2016Adversarial examples in the physical worldcited by 1,762
  4. 2020Reliable evaluation of adversarial robustness with an ensemble of diverse parameter-free attackscited by 1,442
  5. 2015DeepFool: a simple and accurate method to fool deep neural networkscited by 1,315
  6. 2016Practical Black-Box Attacks against Machine Learningcited by 893
  7. 2016Universal adversarial perturbationscited by 774
  8. 2017ZOO: Zeroth Order Optimization based Black-box Attacks to Deep Neural Networks without Training Substitute Modelscited by 656
  9. 2018Black-box Adversarial Attacks with Limited Queries and Informationcited by 499
  10. 2017Decision-Based Adversarial Attacks: Reliable Attacks Against Black-Box Machine Learning Modelscited by 459
  11. 2019HopSkipJumpAttack: A Query-Efficient Decision-Based Attackcited by 328
  12. 2017DeepXplore: Automated Whitebox Testing of Deep Learning Systemscited by 307
16 more
  1. 2014Caffe: Convolutional Architecture for Fast Feature Embeddingcited by 287
  2. 2019Simple Black-box Adversarial Attackscited by 249
  3. 2018Prior Convictions: Black-Box Adversarial Attacks with Bandits and Priorscited by 145
  4. 2018DeepGauge: Multi-Granularity Testing Criteria for Deep Learning Systemscited by 144
  5. 2018Query-Efficient Hard-label Black-box Attack:An Optimization-based Approachcited by 130
  6. 2016Theano: A Python framework for fast computation of mathematical expressionscited by 64
  7. 2020DaST: Data-free Substitute Training for Adversarial Attackscited by 60
  8. 2018A First Look at Deep Learning Apps on Smartphonescited by 47
  9. 2018Ask, Acquire, and Attack: Data-free UAP Generation using Class Impressionscited by 31
  10. 2021Deep Learning for Android Malware Defenses: a Systematic Literature Reviewcited by 18
  11. 2022Smart App Attack: Hacking Deep Learning Models in Android Appscited by 12
  12. 2023ModelObfuscator: Obfuscating Model Information to Protect Deployed ML-based Systemscited by 7
  13. 2020Decision-based Universal Adversarial Attackcited by 6
  14. 2017AndroZoo++: Collecting Millions of Android Apps and Their Metadata for the Research Communitycited by 3
  15. 2021Towards Black-box Attacks on Deep Learning Appscited by 2
  16. 2023Beyond the Model: Data Pre-processing Attack to Deep Learning Models in Android Appscited by 2

Built on by

Cited by year (2026 to 7 Oct)

Citing papers per year: 2024: 1; 2025: 4; 2026: 1.

6 papers.

  1. 2024A Comprehensive Survey on the Security of Smart Grid: Challenges, Mitigations, and Future Research Opportunitiescited by 4
  2. 2025Stealthy Backdoor Attack to Real-world Models in Android Appscited by 1
  3. 2025Onboard Optimization and Learning: A Surveycited by 1
  4. 2025LLM in the Middle: A Systematic Review of Threats and Mitigations to Real-World LLM-based Systemscited by 1
  5. 2025Breaking SafetyCore: Exploring the Risks of On-Device AI Deploymentcited by 0
  6. 2026SoK: Attack and Defense Landscape of Mobile On-device AI Systemscited by 0