Survey of Attacks and Defenses on Edge-Deployed Neural Networks

--Deep Neural Network (DNN) workloads are quickly moving from datacenters onto edge devices, for latency, privacy, or energy reasons. While datacenter networks can be protected using conventional cybersecurity measures, edge neural networks bring a host of new security challenges. Unlike classic IoT applications, edge neural networks are typically very compute and memory intensive, their execution is data-independent, and they are robust to noise and faults. Neural network models may be very expensive to develop, and can potentially reveal information about the private data they were trained on, requiring special care in distribution. The hidden states and outputs of the network can also be used in reconstructing user inputs, potentially violating users' privacy. Furthermore, neural networks are vulnerable to adversarial attacks, which may cause misclassifications and violate the integrity of the output. These properties add challenges when securing edge-deployed DNNs, requiring new considerations, threat models, priorities, and approaches in securely and privately deploying DNNs to the edge. In this work, we cover the landscape of attacks on, and defenses, of neural networks deployed in edge devices and provide a taxonomy of attacks and defenses targeting edge DNNs. Since the rise of deep learning in the last decade, many different libraries and frameworks for running and training deep neural networks (DNN) have been published and open-sourced. In that time, the landscape of software tools for training neural networks has moved from difficult-to-install libraries [1], and support for static graphs only [2], to industry-ready, easy-to-deploy frameworks [3], high-development efficiency [4], and support for dynamic graphs and justin-time compilation [5].