{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,7,9]],"date-time":"2026-07-09T06:16:28Z","timestamp":1783577788326,"version":"3.55.0"},"reference-count":48,"publisher":"IEEE","license":[{"start":{"date-parts":[[2026,6,22]],"date-time":"2026-06-22T00:00:00Z","timestamp":1782086400000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-029"},{"start":{"date-parts":[[2026,6,22]],"date-time":"2026-06-22T00:00:00Z","timestamp":1782086400000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-037"}],"funder":[{"DOI":"10.13039\/100000001","name":"National Science Foundation","doi-asserted-by":"publisher","id":[{"id":"10.13039\/100000001","id-type":"DOI","asserted-by":"publisher"}]},{"DOI":"10.13039\/100016311","name":"Arm","doi-asserted-by":"publisher","id":[{"id":"10.13039\/100016311","id-type":"DOI","asserted-by":"publisher"}]},{"DOI":"10.13039\/501100001665","name":"Agence Nationale de la Recherche","doi-asserted-by":"publisher","id":[{"id":"10.13039\/501100001665","id-type":"DOI","asserted-by":"publisher"}]}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":[],"published-print":{"date-parts":[[2026,6,22]]},"DOI":"10.1109\/dsn69566.2026.00081","type":"proceedings-article","created":{"date-parts":[[2026,7,8]],"date-time":"2026-07-08T19:41:43Z","timestamp":1783539703000},"page":"835-848","source":"Crossref","is-referenced-by-count":0,"title":["AnBridge: Protecting On-Device AI with Android Virtualization Framework"],"prefix":"10.1109","author":[{"given":"Giorgio","family":"Farina","sequence":"first","affiliation":[{"name":"Università Degli Studi di Napoli Federico II,Naples,Italy"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Raffaele","family":"Della Corte","sequence":"additional","affiliation":[{"name":"Università Degli Studi di Napoli Federico II,Naples,Italy"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Aravind","family":"Machiry","sequence":"additional","affiliation":[{"name":"Institut Polytechnique de Paris,Télécom Paris,Palaiseau,France"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Marcello","family":"Cinque","sequence":"additional","affiliation":[{"name":"Università Degli Studi di Napoli Federico II,Naples,Italy"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Saurabh","family":"Bagchi","sequence":"additional","affiliation":[{"name":"Purdue University,West Lafayette,IN,USA"}],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"263","reference":[{"key":"ref1","volume-title":"Github repository. tree-sitter, a parser generator tool and incremental-parsing library","year":"2025"},{"key":"ref2","doi-asserted-by":"publisher","DOI":"10.14722\/ndss.2016.23384"},{"key":"ref3","volume-title":"Commons io library","year":"2024"},{"key":"ref4","first-page":"689","article-title":"{SCONE}: Secure linux containers with intel {SGX}","volume-title":"12th USENIX Symposium on Operating Systems Design and Implementation (OSDI 16)","author":"Arnautov"},{"key":"ref5","doi-asserted-by":"publisher","DOI":"10.1145\/2799647"},{"key":"ref6","doi-asserted-by":"publisher","DOI":"10.14722\/ndss.2019.23448"},{"key":"ref7","doi-asserted-by":"publisher","DOI":"10.1145\/2490301.2451145"},{"key":"ref8","volume-title":"Android virtualization framework)","year":"2024"},{"key":"ref9","volume-title":"Arm TrustZone for Cortex-A","year":"2024"},{"key":"ref10","volume-title":"Mobile operating system market share world-wide","year":"2025"},{"key":"ref11","volume-title":"Android virtualization framework: Use cases"},{"key":"ref12","doi-asserted-by":"publisher","DOI":"10.1145\/3081333.3081349"},{"key":"ref13","volume-title":"Image classification app with custom tensorflow model","year":"2024"},{"key":"ref14","doi-asserted-by":"publisher","DOI":"10.1109\/TDSC.2016.2622261"},{"key":"ref15","doi-asserted-by":"publisher","DOI":"10.1145\/2964284.2973801"},{"key":"ref16","doi-asserted-by":"publisher","DOI":"10.1037\/e516712004-001"},{"key":"ref17","first-page":"2387","article-title":"{MIST}: Defending against membership inference attacks through {Membership-Invariant} subspace training","volume-title":"33rd USENIX Security Symposium (USENIX Security 24)","author":"Li"},{"key":"ref18","first-page":"285","article-title":"Glamdring: Automatic application partitioning for intel {SGX}","volume-title":"2017 USENIX Annual Technical Conference (USENIX ATC 17)","author":"Lind"},{"key":"ref19","doi-asserted-by":"publisher","DOI":"10.1145\/3133956.3134066"},{"key":"ref20","doi-asserted-by":"publisher","DOI":"10.1145\/3133956.3134066"},{"key":"ref21","first-page":"4525","article-title":"{ML-Doctor}: Holistic risk assessment of inference attacks against machine learning models","volume-title":"31st USENIX Security Symposium (USENIX Security 22)","author":"Liu"},{"key":"ref22","doi-asserted-by":"publisher","DOI":"10.1145\/3591279"},{"key":"ref23","doi-asserted-by":"publisher","DOI":"10.14722\/ndss.2017.23227"},{"key":"ref24","doi-asserted-by":"publisher","DOI":"10.1145\/3386901.3388946"},{"key":"ref25","doi-asserted-by":"publisher","DOI":"10.14722\/ndss.2025.240449"},{"key":"ref26","first-page":"5233","article-title":"{SoK}: All you need to know about {On-Device}{ML} model extraction-the gap between research and practice","volume-title":"33rd USENIX Security Symposium (USENIX Security 24)","author":"Nayan"},{"key":"ref27","doi-asserted-by":"publisher","DOI":"10.1145\/3708821.3736205"},{"key":"ref28","first-page":"1429","article-title":"VRASED: A verified Hardware\/-Software Co-Design for remote attestation","volume-title":"28th USENIX Security Symposium (USENIX Security 19)","author":"De Oliveira Nunes"},{"key":"ref29","volume-title":"Java Native Interface","year":"2024"},{"key":"ref30","volume-title":"Example on-device model personalization with tensorflow lite","year":"2019"},{"key":"ref31","doi-asserted-by":"publisher","DOI":"10.1145\/3571194"},{"key":"ref32","doi-asserted-by":"publisher","DOI":"10.1109\/TDSC.2021.3075817"},{"key":"ref33","doi-asserted-by":"publisher","DOI":"10.1145\/3465413.3488571"},{"key":"ref34","doi-asserted-by":"publisher","DOI":"10.1145\/2884781.2884817"},{"key":"ref35","doi-asserted-by":"publisher","DOI":"10.1145\/3519939.3523434"},{"key":"ref36","doi-asserted-by":"publisher","DOI":"10.1145\/2541940.2541949"},{"key":"ref37","doi-asserted-by":"publisher","DOI":"10.14722\/ndss.2017.23500"},{"key":"ref38","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-030-99336-8_6"},{"key":"ref39","doi-asserted-by":"publisher","DOI":"10.1109\/EuroSP57164.2023.00056"},{"key":"ref40","volume-title":"OkHttp3 library","year":"2024"},{"key":"ref41","doi-asserted-by":"publisher","DOI":"10.1109\/SP46215.2023.10179382"},{"key":"ref42","first-page":"1955","article-title":"Mind your weight (s): A large-scale study on insufficient machine learning model protection in mobile apps","volume-title":"30th USENIX security symposium (USENIX security 21)","author":"Sun"},{"key":"ref43","first-page":"645","article-title":"{Graphene-SGX}: A practical library {OS} for unmodified applications on {SGX}","volume-title":"2017 USENIX Annual Technical Conference (USENIX ATC 17)","author":"Tsai"},{"key":"ref44","doi-asserted-by":"publisher","DOI":"10.1145\/3605098.3636097"},{"key":"ref45","doi-asserted-by":"publisher","DOI":"10.1145\/3308558.3313591"},{"key":"ref46","first-page":"1800","article-title":"Model inversion attack against a face recognition system in a black-box setting","volume-title":"2021 Asia-Pacific Signal and Information Processing Association Annual Summit and Conference (APSIPA ASC)","author":"Yoshimura"},{"key":"ref47","volume-title":"Google I\/O Event","author":"Zhang","year":"2024"},{"key":"ref48","doi-asserted-by":"publisher","DOI":"10.1145\/3563345"}],"event":{"name":"2026 56th Annual IEEE International Conference on Dependable Systems and Networks (DSN)","location":"Charlotte, NC, USA","start":{"date-parts":[[2026,6,22]]},"end":{"date-parts":[[2026,6,25]]}},"container-title":["2026 56th Annual IEEE International Conference on Dependable Systems and Networks (DSN)"],"original-title":[],"link":[{"URL":"http:\/\/xplorestaging.ieee.org\/ielx8\/11593123\/11593173\/11593375.pdf?arnumber=11593375","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2026,7,9]],"date-time":"2026-07-09T05:23:43Z","timestamp":1783574623000},"score":1,"resource":{"primary":{"URL":"https:\/\/ieeexplore.ieee.org\/document\/11593375\/"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2026,6,22]]},"references-count":48,"URL":"https:\/\/doi.org\/10.1109\/dsn69566.2026.00081","relation":{},"subject":[],"published":{"date-parts":[[2026,6,22]]}}}