{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,3,7]],"date-time":"2026-03-07T18:04:31Z","timestamp":1772906671840,"version":"3.50.1"},"reference-count":67,"publisher":"IEEE","license":[{"start":{"date-parts":[[2023,5,1]],"date-time":"2023-05-01T00:00:00Z","timestamp":1682899200000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-009"},{"start":{"date-parts":[[2023,5,1]],"date-time":"2023-05-01T00:00:00Z","timestamp":1682899200000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-001"}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":[],"published-print":{"date-parts":[[2023,5]]},"DOI":"10.1109\/sp46215.2023.10179382","type":"proceedings-article","created":{"date-parts":[[2023,7,21]],"date-time":"2023-07-21T17:18:15Z","timestamp":1689959895000},"page":"1596-1612","source":"Crossref","is-referenced-by-count":35,"title":["ShadowNet: A Secure and Efficient On-device Model Inference System for Convolutional Neural Networks"],"prefix":"10.1109","author":[{"given":"Zhichuang","family":"Sun","sequence":"first","affiliation":[{"name":"Google"}]},{"given":"Ruimin","family":"Sun","sequence":"additional","affiliation":[{"name":"Florida International University"}]},{"given":"Changming","family":"Liu","sequence":"additional","affiliation":[{"name":"Northeastern University"}]},{"given":"Amrita Roy","family":"Chowdhury","sequence":"additional","affiliation":[{"name":"University of California,San Diego"}]},{"given":"Long","family":"Lu","sequence":"additional","affiliation":[{"name":"Northeastern University"}]},{"given":"Somesh","family":"Jha","sequence":"additional","affiliation":[{"name":"University of Wisconsin-Madison"}]}],"member":"263","reference":[{"key":"ref2","volume-title":"Android 7.0 Compatibility Definition"},{"key":"ref3","volume-title":"AppLock Face\/Voice Recognition - Apps on Google Play"},{"key":"ref4","volume-title":"Arm Compute Library"},{"key":"ref6","volume-title":"Asylo, An open and flexible framework for enclave applications"},{"key":"ref7","volume-title":"Card Scanner - Apps on Google Play"},{"key":"ref8","volume-title":"The cifar-100 dataset"},{"key":"ref9","volume-title":"Coral: An ecosystem for local AI"},{"key":"ref10","volume-title":"Coral: An ecosystem for local AI"},{"key":"ref12","volume-title":"Fritz AI: Model Protection - Secure your Intellectual Property from being tampered-with or stolen"},{"key":"ref13","volume-title":"Google Translate - Apps on Google Play"},{"key":"ref14","volume-title":"Minivgg pre-trained model"},{"key":"ref15","volume-title":"Mobilenets pre-trained model"},{"key":"ref17","volume-title":"OP-TEE AOSP support"},{"key":"ref18","volume-title":"Optee-os issue : Keep the context of the last session"},{"key":"ref19","volume-title":"Optee-os issue :questions about memory management"},{"key":"ref20","volume-title":"Resnet-404 pre-trained model"},{"key":"ref21","volume-title":"Resnet-44 pre-trained model"},{"key":"ref24","volume-title":"Text Scanner [OCR] - Apps on Google Play"},{"key":"ref26","volume-title":"TF Lite Android Image Classifier App Example"},{"key":"ref28","volume-title":"TrustZone for Cortex-A"},{"key":"ref29","volume-title":"TrustZone for Cortex-M"},{"key":"ref30","volume-title":"Wiki: Trusted Execution Environment"},{"key":"ref31","volume-title":"Yolov4-tiny pre-trained model"},{"key":"ref32","doi-asserted-by":"publisher","DOI":"10.23919\/DATE48585.2020.9116560"},{"key":"ref33","article-title":"Mixmatch: A holistic approach to semi-supervised learning","volume-title":"Advances in Neural Information Processing Systems","volume":"32","author":"Berthelot","year":"2019"},{"key":"ref34","author":"Bochkovskiy","year":"2020","journal-title":"Yolov4: Optimal speed and accuracy of object detection"},{"key":"ref35","doi-asserted-by":"publisher","DOI":"10.14722\/ndss.2019.23448"},{"key":"ref36","volume-title":"Implementing Liveness Detection with Google ML Kit","author":"Breuel"},{"key":"ref37","first-page":"646","article-title":"Securenets: Secure inference of deep neural networks on an untrusted cloud","volume-title":"Asian Conference on Machine Learning","author":"Chen"},{"key":"ref38","article-title":"Increasing the cost of model extraction with calibrated proof of work","volume-title":"ICLR (International Conference on Learning Representations) [SPOTLIGTH]","author":"Dziedzic"},{"key":"ref39","doi-asserted-by":"publisher","DOI":"10.1007\/s11263-009-0275-4"},{"key":"ref40","first-page":"4672","article-title":"Safetynets: Verifiable execution of deep neural networks on an untrusted cloud","volume-title":"Advances in Neural Information Processing Systems","author":"Ghodsi"},{"key":"ref41","first-page":"201","article-title":"Cryptonets: Applying neural networks to encrypted data with high throughput and accuracy","volume-title":"International Conference on Machine Learning","author":"Gilad-Bachrach"},{"key":"ref42","author":"Gu","year":"2018","journal-title":"Yerbabuena: Securing deep learning inference data via enclave-based ternary model partitioning"},{"key":"ref43","first-page":"1737","article-title":"Deep learning with limited numerical precision","volume-title":"Proceedings of the 32nd International Conference on International Conference on Machine Learning","volume":"37","author":"Gupta"},{"key":"ref44","doi-asserted-by":"publisher","DOI":"10.1109\/cvprw53098.2021.00368"},{"key":"ref45","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2016.90"},{"key":"ref46","author":"Howard","year":"2017","journal-title":"Mobilenets: Efficient convolutional neural networks for mobile vision applications"},{"key":"ref47","author":"Jagielski","year":"2019","journal-title":"High-fidelity extraction of neural network models"},{"key":"ref48","doi-asserted-by":"publisher","DOI":"10.1109\/TrustCom\/BigDataSE.2019.00014"},{"key":"ref49","doi-asserted-by":"publisher","DOI":"10.1145\/3243734.3243837"},{"key":"ref50","first-page":"1651","article-title":"{GAZELLE}: A low latency framework for secure neural network inference","volume-title":"27th {USENIX} Security Symposium ({USENIX} Security 18)","author":"Juvekar"},{"key":"ref51","doi-asserted-by":"crossref","DOI":"10.1201\/b17668","volume-title":"Introduction to Modern Cryptography, Second Edition","author":"Katz","year":"2014"},{"key":"ref52","author":"Krizhevsky","journal-title":"Cifar-10 (canadian institute for advanced research)"},{"key":"ref53","author":"Kunkel","year":"2019","journal-title":"Tensorscone: A secure tensorflow framework using intel sgx"},{"key":"ref54","doi-asserted-by":"publisher","DOI":"10.1145\/3210240.3210334"},{"key":"ref55","volume-title":"Open Portable Trusted Execution Environment"},{"key":"ref56","doi-asserted-by":"publisher","DOI":"10.1145\/3386901.3388946"},{"key":"ref57","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2019.00509"},{"key":"ref58","author":"O\u2019Shea","year":"2015","journal-title":"An introduction to convolutional neural networks"},{"key":"ref59","doi-asserted-by":"publisher","DOI":"10.1145\/3052973.3053009"},{"key":"ref60","first-page":"2013","volume-title":"Darknet: Open source neural networks in c","author":"Redmon"},{"key":"ref61","doi-asserted-by":"publisher","DOI":"10.1109\/cvpr.2016.91"},{"key":"ref62","doi-asserted-by":"publisher","DOI":"10.1145\/3196494.3196522"},{"key":"ref63","doi-asserted-by":"publisher","DOI":"10.1080\/0161-119691885040"},{"key":"ref64","doi-asserted-by":"publisher","DOI":"10.1007\/s11263-015-0816-y"},{"key":"ref65","doi-asserted-by":"publisher","DOI":"10.1145\/2897845.2897862"},{"key":"ref66","author":"Simonyan","year":"2014","journal-title":"Very deep convolutional networks for large-scale image recognition"},{"key":"ref67","author":"Sun","year":"2020","journal-title":"Mind your weight (s): A large-scale study on insufficient machine learning model protection in mobile apps"},{"key":"ref68","doi-asserted-by":"publisher","DOI":"10.4324\/9781410605337-29"},{"key":"ref69","doi-asserted-by":"publisher","DOI":"10.1109\/infocom48880.2022.9796929"},{"key":"ref70","author":"Tramer","year":"2018","journal-title":"Slalom: Fast, verifiable and private execution of neural networks in trusted hardware"},{"key":"ref71","doi-asserted-by":"publisher","DOI":"10.5555\/3241094.3241142"},{"key":"ref72","doi-asserted-by":"publisher","DOI":"10.5555\/3291168.3291219"},{"key":"ref73","doi-asserted-by":"publisher","DOI":"10.1145\/3308558.3313591"},{"key":"ref74","first-page":"3320","article-title":"How transferable are features in deep neural networks?","author":"Yosinski","year":"2014","journal-title":"Advances in neural information processing systems"},{"key":"ref75","doi-asserted-by":"publisher","DOI":"10.1109\/JIOT.2020.2997091"}],"event":{"name":"2023 IEEE Symposium on Security and Privacy (SP)","location":"San Francisco, CA, USA","start":{"date-parts":[[2023,5,21]]},"end":{"date-parts":[[2023,5,25]]}},"container-title":["2023 IEEE Symposium on Security and Privacy (SP)"],"original-title":[],"link":[{"URL":"http:\/\/xplorestaging.ieee.org\/ielx7\/10179215\/10179280\/10179382.pdf?arnumber=10179382","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2024,7,20]],"date-time":"2024-07-20T05:14:42Z","timestamp":1721452482000},"score":1,"resource":{"primary":{"URL":"https:\/\/ieeexplore.ieee.org\/document\/10179382\/"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2023,5]]},"references-count":67,"URL":"https:\/\/doi.org\/10.1109\/sp46215.2023.10179382","relation":{},"subject":[],"published":{"date-parts":[[2023,5]]}}}