{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,9,11]],"date-time":"2026-09-11T05:07:29Z","timestamp":1789103249175,"version":"build-2803163510"},"reference-count":24,"publisher":"MDPI AG","issue":"18","license":[{"start":{"date-parts":[[2026,9,9]],"date-time":"2026-09-09T00:00:00Z","timestamp":1788912000000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/creativecommons.org\/licenses\/by\/4.0\/"}],"funder":[{"name":"Norther Border University","award":["BU-FFR-2026-2466-XX"],"award-info":[{"award-number":["BU-FFR-2026-2466-XX"]}]},{"award":["BU-FFR-2026-2466-XX"],"award-info":[{"award-number":["BU-FFR-2026-2466-XX"]}],"id":[{"id":"https:\/\/ror.org\/03j9tzj20","id-type":"ROR","asserted-by":"publisher"}]}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":["Sensors"],"abstract":"<jats:p>TinyML models now run inference directly on microcontrollers with only kilobytes of memory, inside sensors, wearables, and industrial devices that often have no cloud link and no way to receive a patch once deployed. This makes them an easy target, since compressed models resist adversarial and extraction attacks less than full-precision models, but most TinyML research still treats security as a step added after compression rather than during it. This paper proposes a three-layer security-by-design architecture built to close that gap. The first layer scores candidate compressed models on a joint fitness function that combines clean accuracy, adversarial robustness, and model size before the final architecture is fixed. The second layer signs and verifies model weights with the lightweight ASCON cipher at boot and during over-the-air updates. The third layer is a runtime monitor that computes a live distribution-drift score on incoming queries and raises local defense strength once that score crosses a fixed threshold, without needing a cloud round trip. The full pipeline was validated on real microcontroller hardware, not simulation, and stays inside a 62 KB RAM budget with inference latency under 10 ms. Against real baseline models on Edge-IIoTset, the proposed method reaches 94.3% accuracy, the highest of the models tested, while cutting attack success rate from over 60\u201384% down to 38.9% and raising the query cost for model extraction more than five times over the weakest baseline. An ablation study and a five-seed statistical test confirm the gain holds and comes from the combination of all three layers, not from any single part.<\/jats:p>","DOI":"10.3390\/s26185727","type":"journal-article","created":{"date-parts":[[2026,9,9]],"date-time":"2026-09-09T14:02:48Z","timestamp":1788962568000},"page":"5727","update-policy":"https:\/\/doi.org\/10.3390\/mdpi_crossmark_policy","source":"Crossref","is-referenced-by-count":0,"title":["Lightweight Security-by-Design for TinyML Models in Constrained Embedded Environments"],"prefix":"10.3390","volume":"26","author":[{"ORCID":"https:\/\/orcid.org\/0009-0000-4577-6898","authenticated-orcid":false,"given":"Haifa A.","family":"Alanazi","sequence":"first","affiliation":[{"name":"Department of Information Systems, College of Computing and Information Technology, Northern Border University, Rafha 91911, Saudi Arabia"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0009-0005-4435-9642","authenticated-orcid":false,"given":"Khaznah R.","family":"Alshammari","sequence":"additional","affiliation":[{"name":"Department of Computer Science, College of Computing and Information Technology, Northern Border University, Rafha 91911, Saudi Arabia"}],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"1968","published-online":{"date-parts":[[2026,9,9]]},"reference":[{"key":"ref_1","first-page":"800","article-title":"Tensorflow lite micro: Embedded machine learning for tinyml systems","volume":"3","author":"David","year":"2021","journal-title":"Proc. Mach. Learn. Syst."},{"key":"ref_2","unstructured":"Shah, P., Govindarajulu, Y., Kulkarni, P., and Parmar, M. (2024). Enhancing TinyML security: Study of adversarial attack transferability. arXiv."},{"key":"ref_3","doi-asserted-by":"crossref","unstructured":"Huckelberry, J., Zhang, Y., Sansone, A., Mickens, J., Bereel, P., and Janapa Reddi, V. (2026). TinyML Security: Attacks, Defenses, and Open Challenges in Resource-Constrained Machine Learning Systems. Acm Comput. Surv.","DOI":"10.1145\/3793197"},{"key":"ref_4","doi-asserted-by":"crossref","unstructured":"Preuveneers, D., Verheyen, W., Joos, S., and Joosen, W. (2023, January 11). On the adversarial robustness of full integer quantized TinyML models at the edge. Proceedings of the 2nd International Workshop on Middleware for the Edge, Bologna Italy.","DOI":"10.1145\/3630180.3631201"},{"key":"ref_5","doi-asserted-by":"crossref","first-page":"12079","DOI":"10.1109\/JIOT.2021.3061314","article-title":"Leaky nets: Recovering embedded neural network models and inputs through simple power and timing side-channels\u2014attacks and defenses","volume":"8","author":"Maji","year":"2021","journal-title":"IEEE Internet Things J."},{"key":"#cr-split#-ref_6.1","unstructured":"Belkadi, L. (2024). Regulation"},{"key":"#cr-split#-ref_6.2","unstructured":"(EU) 2024\/2847 on Horizontal Cybersecurity Requirements for Products with Digital Elements ('Cyber Resilience Act'), Publications Office of the European Union."},{"key":"ref_7","doi-asserted-by":"crossref","unstructured":"Turan, M.S., McKay, K.A., Chang, D., Kang, J., and Kelsey, J. (2025). Ascon-Based Lightweight Cryptography Standards for Constrained Devices.","DOI":"10.6028\/NIST.SP.800-232"},{"key":"ref_8","doi-asserted-by":"crossref","unstructured":"Costa, M., and Pinto, S. (2024, January 8\u201312). David and Goliath: An empirical evaluation of attacks and defenses for QNNs at the deep edge. Proceedings of the 2024 IEEE 9th European Symposium on Security and Privacy (EuroS&P), Vienna, Austria.","DOI":"10.1109\/EuroSP60621.2024.00035"},{"key":"ref_9","unstructured":"Banbury, C., Reddi, V.J., Torelli, P., Holleman, J., Jeffries, N., Kiraly, C., Montino, P., Kanter, D., Ahmed, S., and Pau, D. (2021). Mlperf tiny benchmark. arXiv."},{"key":"ref_10","doi-asserted-by":"crossref","unstructured":"Paul, R., and Zuzak, M. (2025). Michscan: Black-box neural network integrity checking at runtime through power analysis. Proceedings of the 2025 IEEE International Symposium on Hardware Oriented Security and Trust (HOST), IEEE.","DOI":"10.1109\/HOST64725.2025.11050062"},{"key":"ref_11","doi-asserted-by":"crossref","unstructured":"Song, Q., Yan, Z., and Tan, R. (2019, January 10\u201313). Moving target defense for embedded deep visual sensing against adversarial examples. Proceedings of the 17th Conference on Embedded Networked Sensor Systems, New York, NY, USA.","DOI":"10.1145\/3356250.3360025"},{"key":"ref_12","doi-asserted-by":"crossref","first-page":"1","DOI":"10.1145\/3517806","article-title":"EI-MTD: Moving target defense for edge intelligence against adversarial attacks","volume":"25","author":"Qian","year":"2022","journal-title":"ACM Trans. Priv. Secur."},{"key":"ref_13","doi-asserted-by":"crossref","unstructured":"Zhao, K., Li, L., Ding, K., Gong, N.Z., Zhao, Y., and Dong, Y. (2025). A survey of model extraction attacks and defenses in distributed computing environments. arXiv.","DOI":"10.1145\/3711896.3736573"},{"key":"ref_14","doi-asserted-by":"crossref","unstructured":"Chakraborty, A., Ahamed, S.F., Roy, S., Banerjee, S., Choi, K., Rahman, A., Hu, A., Bowen, E., and Shetty, S. (2025). Radep: A resilient adaptive defense framework against model extraction attacks. arXiv.","DOI":"10.1109\/IWCMC65282.2025.11059639"},{"key":"ref_15","doi-asserted-by":"crossref","unstructured":"Baciu, V.E., Braeken, A., Segers, L., and Silva, B.d. (2025). Secure tiny machine learning on edge devices: A lightweight dual attestation mechanism for machine learning. Future Internet, 17.","DOI":"10.3390\/fi17020085"},{"key":"ref_16","doi-asserted-by":"crossref","unstructured":"Abualhassan, A.A., Fadol, Y., Gismalla, M.S., and Hamdan, M. (2025). IIoT-TinyDNN: A Lightweight Intrusion Detection System for Edge-Based IIoT Security, Institute of Electrical and Electronics Engineers Inc.","DOI":"10.1109\/CSCN67557.2025.11230733"},{"key":"ref_17","doi-asserted-by":"crossref","first-page":"40281","DOI":"10.1109\/ACCESS.2022.3165809","article-title":"Edge-IIoTset: A new comprehensive realistic cyber security dataset of IoT and IIoT applications for centralized and federated learning","volume":"10","author":"Ferrag","year":"2022","journal-title":"IEEE Access"},{"key":"ref_18","doi-asserted-by":"crossref","first-page":"18524","DOI":"10.1038\/s41598-026-50690-0","article-title":"Lightweight and Energy-Aware Intrusion Detection for Industrial IoT Using TinyML and Edge AI","volume":"16","author":"Nassef","year":"2026","journal-title":"Sci. Rep."},{"key":"ref_19","doi-asserted-by":"crossref","unstructured":"Neto, E.C.P., Dadkhah, S., Ferreira, R., Zohourian, A., Lu, R., and Ghorbani, A.A. (2023). CICIoT2023: A real-time dataset and benchmark for large-scale attacks in IoT environment. Sensors, 23.","DOI":"10.20944\/preprints202305.0443.v1"},{"key":"ref_20","unstructured":"RT-IoT2022 Dataset (2022). UCI Machine Learning Repository, University of California, Irvine, School of Information and Computer Sciences."},{"key":"ref_21","unstructured":"Guesmi, A., Ouni, B., and Shafique, M. (2026). TriQDef: Disrupting Semantic and Gradient Alignment to Prevent Adversarial Patch Transferability in Quantized Neural Networks. arXiv."},{"key":"ref_22","doi-asserted-by":"crossref","first-page":"362","DOI":"10.1016\/j.future.2021.09.015","article-title":"An adaptive federated learning scheme with differential privacy preserving","volume":"127","author":"Wu","year":"2022","journal-title":"Future Gener. Comput. Syst."},{"key":"ref_23","doi-asserted-by":"crossref","first-page":"11142","DOI":"10.1002\/int.23036","article-title":"A differential privacy-preserving deep learning caching framework for heterogeneous communication network systems","volume":"37","author":"Wang","year":"2022","journal-title":"Int. J. Intell. Syst."}],"container-title":["Sensors"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/www.mdpi.com\/1424-8220\/26\/18\/5727\/pdf","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2026,9,11]],"date-time":"2026-09-11T04:41:39Z","timestamp":1789101699000},"score":1,"resource":{"primary":{"URL":"https:\/\/www.mdpi.com\/1424-8220\/26\/18\/5727"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2026,9,9]]},"references-count":24,"journal-issue":{"issue":"18","published-online":{"date-parts":[[2026,9]]}},"alternative-id":["s26185727"],"URL":"https:\/\/doi.org\/10.3390\/s26185727","relation":{},"ISSN":["1424-8220"],"issn-type":[{"value":"1424-8220","type":"electronic"}],"subject":[],"published":{"date-parts":[[2026,9,9]]}}}