# TBNet: A Neural Architectural Defense Framework Facilitating DNN Model Protection in Trusted Execution Environments

arXiv: https://arxiv.org/abs/2405.03974 · HTML: https://mlsanity.com/paper/2405.03974/

## Key facts

- Cited by 2 papers in the map (data through 14 Oct 2026).
- Builds on 11 of its 22 references that are in the map.
- First posted on arXiv 7 May 2024.

## Builds on (most cited first, 11 of 11)

- [Very Deep Convolutional Networks for Large-Scale Image Recognition](https://mlsanity.com/paper/1409.1556/) (2014)
- [Identity Mappings in Deep Residual Networks](https://mlsanity.com/paper/1603.05027/) (2016)
- [Learning Efficient Convolutional Networks through Network Slimming](https://mlsanity.com/paper/1708.06519/) (2017)
- [High Accuracy and High Fidelity Extraction of Neural Networks](https://mlsanity.com/paper/1909.01838/) (2019)
- [Machine Learning at the Network Edge: A Survey](https://mlsanity.com/paper/1908.00080/) (2019)
- [DarkneTZ: Towards Model Privacy at the Edge using Trusted Execution Environments](https://mlsanity.com/paper/2004.05703/) (2020)
- [Mind Your Weight(s): A Large-scale Study on Insufficient Machine Learning Model Protection in Mobile Apps](https://mlsanity.com/paper/2002.07687/) (2020)
- [ShadowNet: A Secure and Efficient On-device Model Inference System for Convolutional Neural Networks](https://mlsanity.com/paper/2011.05905/) (2020)
- [MirrorNet: A TEE-Friendly Framework for Secure On-device DNN Inference](https://mlsanity.com/paper/2311.09489/) (2023)
- [Survey of Attacks and Defenses on Edge-Deployed Neural Networks](https://mlsanity.com/paper/1911.11932/) (2019)
- [Confidential Deep Learning: Executing Proprietary Models on Untrusted Devices](https://mlsanity.com/paper/1908.10730/) (2019)

## Built on by (most cited first, 2 of 2)

- [ProDiF: Protecting Domain-Invariant Features to Secure Pre-Trained Models Against Extraction](https://mlsanity.com/paper/2503.13224/) (2025)
- [EIM-TRNG: Obfuscating Deep Neural Network Weights with Encoding-in-Memory True Random Number Generator via RowHammer](https://mlsanity.com/paper/2507.02206/) (2025)

## Abstract (arXiv)

Trusted Execution Environments (TEEs) have become a promising solution to secure DNN models on edge devices. However, the existing solutions either provide inadequate protection or introduce large performance overhead. Taking both security and performance into consideration, this paper presents TBNet, a TEE-based defense framework that protects DNN model from a neural architectural perspective. Specifically, TBNet generates a novel Two-Branch substitution model, to respectively exploit (1) the computational resources in the untrusted Rich Execution Environment (REE) for latency reduction and (2) the physically-isolated TEE for model protection. Experimental results on a Raspberry Pi across diverse DNN model architectures and datasets demonstrate that TBNet achieves efficient model protection at a low cost.