mlsanityData to 7 Oct 2026

THEMIS: Towards Practical Intellectual Property Protection for Post-Deployment On-Device Deep Learning Models

arXiv 2503.23748 ↗First posted 31 Mar 2025cs.CR cs.LG cs.SEcited by 2

On the map: LLM safety and security → Watermarking generated content and models

Abstract (arXiv)

On-device deep learning (DL) has rapidly gained adoption in mobile apps, offering the benefits of offline model inference and user privacy preservation over cloud-based approaches. However, it inevitably stores models on user devices, introducing new vulnerabilities, particularly model-stealing attacks and intellectual property infringement. While system-level protections like Trusted Execution Environments (TEEs) provide a robust solution, practical challenges remain in achieving scalable on-device DL model protection, including complexities in supporting third-party models and limited adoption in current mobile solutions. Advancements in TEE-enabled hardware, such as NVIDIA's GPU-based TEEs, may address these obstacles in the future. Currently, watermarking serves as a common defense against model theft but also faces challenges here as many mobile app developers lack corresponding machine learning expertise and the inherent read-only and inference-only nature of on-device DL models prevents third parties like app stores from implementing existing watermarking techniques in post-deployment models. To protect the intellectual property of on-device DL models, in this paper, we propose THEMIS, an automatic tool that lifts the read-only restriction of on-device DL models by reconstructing their writable counterparts and leverages the untrainable nature of on-device DL models to solve watermark parameters and protect the model owner's intellectual property. Extensive experimental results across various datasets and model structures show the superiority of THEMIS in terms of different metrics. Further, an empirical investigation of 403 real-world DL mobile apps from Google Play is performed with a success rate of 81.14%, showing the practicality of THEMIS.

Key facts. Cited by 2 papers in the map (data through 7 Oct 2026). Placed in Watermarking generated content and models, one of 12 directions in LLM safety and security. Builds on 42 of its 67 references that are in the map. First posted on arXiv 31 Mar 2025.

Builds on

42 of 67 references.

Closest ancestors · 1

Same direction, newest first

  1. 2024MEA-Defender: A Robust Watermark against Model Extraction Attack26 Jan

Other references · 41

  1. 2021High-Resolution Image Synthesis with Latent Diffusion Modelscited by 18,694
  2. 2015Distilling the Knowledge in a Neural Networkcited by 10,076
  3. 2014Explaining and Harnessing Adversarial Examplescited by 7,287
  4. 2015Rethinking the Inception Architecture for Computer Visioncited by 5,451
  5. 2018MobileNetV2: Inverted Residuals and Linear Bottleneckscited by 4,773
  6. 2017Fashion-MNIST: a Novel Image Dataset for Benchmarking Machine Learning Algorithmscited by 4,283
  7. 2021EfficientNetV2: Smaller Models and Faster Trainingcited by 1,127
  8. 2016Practical Black-Box Attacks against Machine Learningcited by 893
  9. 2020Image Segmentation Using Deep Learning: A Surveycited by 659
  10. 2016Stealing Machine Learning Models via Prediction APIscited by 602
  11. 2020MobileBERT: a Compact Task-Agnostic BERT for Resource-Limited Devicescited by 476
  12. 2022DiffusionDB: A Large-scale Prompt Gallery Dataset for Text-to-Image Generative Modelscited by 376
29 more
  1. 2018Turning Your Weakness Into a Strength: Watermarking Deep Neural Networks by Backdooringcited by 334
  2. 2018Knockoff Nets: Stealing Functionality of Black-Box Modelscited by 285
  3. 2017Embedding Watermarks into Deep Neural Networkscited by 227
  4. 2020BadNL: Backdoor Attacks against NLP Models with Semantic-preserving Improvementscited by 191
  5. 2018PRADA: Protecting against DNN Model Stealing Attackscited by 159
  6. 2020Entangled Watermarks as a Defense against Model Extractioncited by 144
  7. 2020A Survey of Privacy Attacks in Machine Learningcited by 143
  8. 2018Stealing Hyperparameters in Machine Learningcited by 115
  9. 2021SoK: How Robust is Image Classification Deep Neural Network Watermarking? (Extended Version)cited by 67
  10. 2018Backdooring Convolutional Neural Networks via Targeted Weight Perturbationscited by 66
  11. 2019How to Prove Your Model Belongs to You: A Blind-Watermark based Framework to Protect Intellectual Property of DNNcited by 58
  12. 2021Handcrafted Backdoors in Deep Neural Networkscited by 57
  13. 2018Cache Telepathy: Leveraging Shared Resource Attacks to Learn DNN Architecturescited by 56
  14. 2019Robust Watermarking of Neural Network with Exponential Weightingcited by 48
  15. 2018A First Look at Deep Learning Apps on Smartphonescited by 47
  16. 2021DeepPayload: Black-box Backdoor Attack on Deep Learning Models through Neural Payload Injectioncited by 42
  17. 2017Model Extraction Warning in MLaaS Paradigmcited by 39
  18. 2020Mind Your Weight(s): A Large-scale Study on Insufficient Machine Learning Model Protection in Mobile Appscited by 35
  19. 2021Towards Practical Deployment-Stage Backdoor Attack on Deep Neural Networkscited by 33
  20. 2018I Know What You See: Power Side-Channel Attack on Convolutional Neural Network Acceleratorscited by 26
  21. 2021Robustness of on-device Models: Adversarial Attack to Deep Learning Models on Android Appscited by 19
  22. 2018Deep Learning Towards Mobile Applicationscited by 16
  23. 2022Understanding Real-world Threats to Deep Learning Models in Android Appscited by 15
  24. 2022Smart App Attack: Hacking Deep Learning Models in Android Appscited by 12
  25. 2022Learning to Reverse DNNs from AI Programs Automaticallycited by 11
  26. 2022Decompiling x86 Deep Neural Network Executablescited by 7
  27. 2024Model-less Is the Best Model: Generating Pure Code Implementations to Replace On-Device DL Modelscited by 2
  28. 2024DynaMO: Protecting Mobile DL Models through Coupling Obfuscated DL Operatorscited by 2
  29. 2023Fast IDentity Online with Anonymous Credentials (FIDO-AC)cited by 1

Built on by

Cited by year (2026 to 7 Oct)

Citing papers per year: 2025: 1; 2026: 1.

2 papers.

  1. 2025Test-time GNN Model Evaluation on Dynamic Graphscited by 1
  2. 2026SoK: Attack and Defense Landscape of Mobile On-device AI Systemscited by 0