# SoK: Attack and Defense Landscape of Mobile On-device AI Systems

arXiv: https://arxiv.org/abs/2607.00362 · HTML: https://mlsanity.com/paper/2607.00362/

## Key facts

- No citing papers in the map yet (data through 14 Oct 2026).
- Builds on 33 of its 62 references that are in the map.
- First posted on arXiv 1 Jul 2026.

## Builds on (most cited first, 30 of 33)

- [DarkneTZ: Towards Model Privacy at the Edge using Trusted Execution Environments](https://mlsanity.com/paper/2004.05703/) (2020)
- [A First Look at Deep Learning Apps on Smartphones](https://mlsanity.com/paper/1812.05448/) (2018)
- [DeepPayload: Black-box Backdoor Attack on Deep Learning Models through Neural Payload Injection](https://mlsanity.com/paper/2101.06896/) (2021)
- [Mind Your Weight(s): A Large-scale Study on Insufficient Machine Learning Model Protection in Mobile Apps](https://mlsanity.com/paper/2002.07687/) (2020)
- [Quantization Backdoors to Deep Learning Commercial Frameworks](https://mlsanity.com/paper/2108.09187/) (2021)
- [ShadowNet: A Secure and Efficient On-device Model Inference System for Convolutional Neural Networks](https://mlsanity.com/paper/2011.05905/) (2020)
- [No Privacy Left Outside: On the (In-)Security of TEE-Shielded DNN Partition for On-Device ML](https://mlsanity.com/paper/2310.07152/) (2023)
- [Robustness of on-device Models: Adversarial Attack to Deep Learning Models on Android Apps](https://mlsanity.com/paper/2101.04401/) (2021)
- [NNSplitter: An Active Defense Solution for DNN Model via Automated Weight Obfuscation](https://mlsanity.com/paper/2305.00097/) (2023)
- [Understanding Real-world Threats to Deep Learning Models in Android Apps](https://mlsanity.com/paper/2209.09577/) (2022)
- [Smart App Attack: Hacking Deep Learning Models in Android Apps](https://mlsanity.com/paper/2204.11075/) (2022)
- [Energy-Latency Attacks to On-Device Neural Networks via Sponge Poisoning](https://mlsanity.com/paper/2305.03888/) (2023)
- [MirrorNet: A TEE-Friendly Framework for Secure On-device DNN Inference](https://mlsanity.com/paper/2311.09489/) (2023)
- [Offline Model Guard: Secure and Private ML on Mobile Devices](https://mlsanity.com/paper/2007.02351/) (2020)
- [ModelObfuscator: Obfuscating Model Information to Protect Deployed ML-based Systems](https://mlsanity.com/paper/2306.06112/) (2023)
- [Investigating White-Box Attacks for On-Device Models](https://mlsanity.com/paper/2402.05493/) (2024)
- [TZ-LLM: Protecting On-Device Large Language Models with Arm TrustZone](https://mlsanity.com/paper/2511.13717/) (2025)
- [MalModel: Hiding Malicious Payload in Mobile Deep Learning Models with Black-box Backdoor Attack](https://mlsanity.com/paper/2401.02659/) (2024)
- [Efficient Compositional Multi-tasking for On-device Large Language Models](https://mlsanity.com/paper/2507.16083/) (2025)
- [A First Look at On-device Models in iOS Apps](https://mlsanity.com/paper/2307.12328/) (2023)
- [TinyML Security: Exploring Vulnerabilities in Resource-Constrained Machine Learning Systems](https://mlsanity.com/paper/2411.07114/) (2024)
- [TEESlice: Protecting Sensitive Neural Network Models in Trusted Execution Environments When Attackers have Pre-Trained Models](https://mlsanity.com/paper/2411.09945/) (2024)
- [LEAP: TrustZone Based Developer-Friendly TEE for Intelligent Mobile Apps](https://mlsanity.com/paper/2102.02465/) (2021)
- [Beyond the Model: Data Pre-processing Attack to Deep Learning Models in Android Apps](https://mlsanity.com/paper/2305.03963/) (2023)
- [Improving End-to-End Neural Diarization Using Conversational Summary Representations](https://mlsanity.com/paper/2306.13863/) (2023)
- [Model-less Is the Best Model: Generating Pure Code Implementations to Replace On-Device DL Models](https://mlsanity.com/paper/2403.16479/) (2024)
- [DynaMO: Protecting Mobile DL Models through Coupling Obfuscated DL Operators](https://mlsanity.com/paper/2410.15033/) (2024)
- [THEMIS: Towards Practical Intellectual Property Protection for Post-Deployment On-Device Deep Learning Models](https://mlsanity.com/paper/2503.23748/) (2025)
- [SoK: Towards Security and Safety of Edge AI](https://mlsanity.com/paper/2410.05349/) (2024)
- [Stealthy Backdoor Attack to Real-world Models in Android Apps](https://mlsanity.com/paper/2501.01263/) (2025)

## Abstract (arXiv)

Mobile on-device AI (MoAI) systems that integrate locally deployed AI models with conventional mobile software components are emerging as a key paradigm for delivering intelligent functionality directly on end-user devices. By moving inference from remote cloud services to the local mobile environment, such systems enable privacy-preserving, low-latency, and offline-capable AI functionality, yet introduce new security risks arising from the local storage of AI models. This paper presents the first comprehensive systematization of knowledge on MoAI security, covering security pillars, attack landscape, and defense landscape of MoAI systems. We further identify unresolved gaps in current attack and defense research and point to promising directions for future research in this emerging area. Our work establishes the first systematic framework for understanding the attack and defense landscapes of MoAI systems, serving as a foundation for building secure MoAI systems and advancing research in this critical domain. Companion resources are available at https://github.com/Jinxhy/Awesome-MoAI-Security.