{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,4,25]],"date-time":"2026-04-25T08:37:01Z","timestamp":1777106221344,"version":"3.51.4"},"publisher-location":"New York, NY, USA","reference-count":48,"publisher":"ACM","license":[{"start":{"date-parts":[[2021,5,18]],"date-time":"2021-05-18T00:00:00Z","timestamp":1621296000000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/www.acm.org\/publications\/policies\/copyright_policy#Background"}],"funder":[{"DOI":"10.13039\/100006754","name":"Army Research Laboratory","doi-asserted-by":"publisher","award":["W911NF-17-2-0196"],"award-info":[{"award-number":["W911NF-17-2-0196"]}],"id":[{"id":"10.13039\/100006754","id-type":"DOI","asserted-by":"publisher"}]},{"DOI":"10.13039\/100000001","name":"National Science Foundation","doi-asserted-by":"publisher","award":["CNS-1705135"],"award-info":[{"award-number":["CNS-1705135"]}],"id":[{"id":"10.13039\/100000001","id-type":"DOI","asserted-by":"publisher"}]}],"content-domain":{"domain":["dl.acm.org"],"crossmark-restriction":true},"short-container-title":[],"published-print":{"date-parts":[[2021,5,18]]},"DOI":"10.1145\/3450268.3453524","type":"proceedings-article","created":{"date-parts":[[2021,5,18]],"date-time":"2021-05-18T19:13:35Z","timestamp":1621365215000},"page":"67-79","update-policy":"https:\/\/doi.org\/10.1145\/crossmark-policy","source":"Crossref","is-referenced-by-count":27,"title":["SecDeep"],"prefix":"10.1145","author":[{"given":"Renju","family":"Liu","sequence":"first","affiliation":[{"name":"University of California, Los Angeles"}]},{"given":"Luis","family":"Garcia","sequence":"additional","affiliation":[{"name":"University of Southern California, Information Sciences Institute"}]},{"given":"Zaoxing","family":"Liu","sequence":"additional","affiliation":[{"name":"Boston University"}]},{"given":"Botong","family":"Ou","sequence":"additional","affiliation":[{"name":"University of California, Los Angeles"}]},{"given":"Mani","family":"Srivastava","sequence":"additional","affiliation":[{"name":"University of California, Los Angeles"}]}],"member":"320","published-online":{"date-parts":[[2021,5,18]]},"reference":[{"key":"e_1_3_2_1_1_1","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-030-22496-7_9"},{"key":"e_1_3_2_1_2_1","unstructured":"Android. Android neural networks api. https:\/\/developer.android.com\/ndk\/guides\/neuralnetworks.  Android. Android neural networks api. https:\/\/developer.android.com\/ndk\/guides\/neuralnetworks."},{"key":"e_1_3_2_1_3_1","unstructured":"Apple. Machine learning on ios. https:\/\/developer.apple.com\/machine-learning\/.  Apple. Machine learning on ios. https:\/\/developer.apple.com\/machine-learning\/."},{"key":"e_1_3_2_1_4_1","doi-asserted-by":"publisher","DOI":"10.1109\/SECPRI.1997.601317"},{"key":"e_1_3_2_1_5_1","unstructured":"ARM. https:\/\/developer.arm.com\/ip-products\/security-ip\/trustzone.  ARM. https:\/\/developer.arm.com\/ip-products\/security-ip\/trustzone."},{"key":"e_1_3_2_1_6_1","unstructured":"ARM NN (Neural Network). https:\/\/github.com\/ARM-software\/armnn.  ARM NN (Neural Network). https:\/\/github.com\/ARM-software\/armnn."},{"key":"e_1_3_2_1_7_1","doi-asserted-by":"publisher","DOI":"10.1145\/2660267.2660350"},{"key":"e_1_3_2_1_8_1","first-page":"460","volume-title":"Automation Test in Europe Conference Exhibition (DATE)","author":"Bayerl S. P.","year":"2020","unstructured":"S. P. Bayerl , T. Frassetto , P. Jauernig , K. Riedhammer , A. R. Sadeghi , T. Schneider , E. Stapf , and C. Weinert . Offline model guard: Secure and private ml on mobile devices. In 2020 Design , Automation Test in Europe Conference Exhibition (DATE) , pages 460 -- 465 , 2020 . S. P. Bayerl, T. Frassetto, P. Jauernig, K. Riedhammer, A. R. Sadeghi, T. Schneider, E. Stapf, and C. Weinert. Offline model guard: Secure and private ml on mobile devices. In 2020 Design, Automation Test in Europe Conference Exhibition (DATE), pages 460--465, 2020."},{"key":"e_1_3_2_1_9_1","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-642-05445-7_19"},{"key":"e_1_3_2_1_10_1","volume-title":"26th USENIX Security Symposium (USENIX Security 17)","author":"Bulck J. V.","year":"2017","unstructured":"J. V. Bulck , N. Weichbrodt , R. Kapitza , F. Piessens , and R. Strackx . Telling your secrets without page faults: Stealthy page table-based attacks on enclaved execution . In 26th USENIX Security Symposium (USENIX Security 17) , 2017 . J. V. Bulck, N. Weichbrodt, R. Kapitza, F. Piessens, and R. Strackx. Telling your secrets without page faults: Stealthy page table-based attacks on enclaved execution. In 26th USENIX Security Symposium (USENIX Security 17), 2017."},{"key":"e_1_3_2_1_11_1","unstructured":"Caffe2 on Smartphone. https:\/\/caffe2.ai\/docs\/mobile-integration.html.  Caffe2 on Smartphone. https:\/\/caffe2.ai\/docs\/mobile-integration.html."},{"issue":"47","key":"e_1_3_2_1_12_1","first-page":"57","article-title":"Tee: A virtual drtm based execution environment for secure cloud-end computing","volume":"49","author":"Dai W.","year":"2015","unstructured":"W. Dai , H. Jin , D. Zou , S. Xu , W. Zheng , L. Shi , and L. T. Yang . Tee: A virtual drtm based execution environment for secure cloud-end computing . Future Generation Computer Systems , 49 : 47 - 57 , 2015 . W. Dai, H. Jin, D. Zou, S. Xu, W. Zheng, L. Shi, and L. T. Yang. Tee: A virtual drtm based execution environment for secure cloud-end computing. Future Generation Computer Systems, 49:47 - 57, 2015.","journal-title":"Future Generation Computer Systems"},{"key":"e_1_3_2_1_13_1","unstructured":"DL4J. https:\/\/deeplearning4j.org\/.  DL4J. https:\/\/deeplearning4j.org\/."},{"key":"e_1_3_2_1_14_1","doi-asserted-by":"publisher","DOI":"10.1109\/MICRO.2012.48"},{"key":"e_1_3_2_1_15_1","volume-title":"Securing input data of deep learning inference systems via partitioned enclave execution. arXiv preprint arXiv:1807.00969","author":"Gu Z.","year":"2018","unstructured":"Z. Gu , H. Huang , J. Zhang , D. Su , A. Lamba , D. Pendarakis , and I. Molloy . Securing input data of deep learning inference systems via partitioned enclave execution. arXiv preprint arXiv:1807.00969 , 2018 . Z. Gu, H. Huang, J. Zhang, D. Su, A. Lamba, D. Pendarakis, and I. Molloy. Securing input data of deep learning inference systems via partitioned enclave execution. arXiv preprint arXiv:1807.00969, 2018."},{"key":"e_1_3_2_1_16_1","doi-asserted-by":"publisher","DOI":"10.1145\/3081333.3081349"},{"key":"e_1_3_2_1_17_1","volume-title":"Deep compression: Compressing deep neural networks with pruning, trained quantization and huffman coding. arXiv preprint arXiv:1510.00149","author":"Han S.","year":"2015","unstructured":"S. Han , H. Mao , and W.J. Dally . Deep compression: Compressing deep neural networks with pruning, trained quantization and huffman coding. arXiv preprint arXiv:1510.00149 , 2015 . S. Han, H. Mao, and W.J. Dally. Deep compression: Compressing deep neural networks with pruning, trained quantization and huffman coding. arXiv preprint arXiv:1510.00149, 2015."},{"key":"e_1_3_2_1_18_1","volume-title":"Deep residual learning for image recognition. CoRR, abs\/1512.03385","author":"He K.","year":"2015","unstructured":"K. He , X. Zhang , S. Ren , and J. Sun . Deep residual learning for image recognition. CoRR, abs\/1512.03385 , 2015 . K. He, X. Zhang, S. Ren, and J. Sun. Deep residual learning for image recognition. CoRR, abs\/1512.03385, 2015."},{"key":"e_1_3_2_1_19_1","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-030-01234-2_48"},{"key":"e_1_3_2_1_20_1","volume-title":"Mobilenets: Efficient convolutional neural networks for mobile vision applications. CoRR, abs\/1704.04861","author":"Howard A. G.","year":"2017","unstructured":"A. G. Howard , M. Zhu , B. Chen , D. Kalenichenko , W. Wang , T. Weyand , M. Andreetto , and H. Adam . Mobilenets: Efficient convolutional neural networks for mobile vision applications. CoRR, abs\/1704.04861 , 2017 . A. G. Howard, M. Zhu, B. Chen, D. Kalenichenko, W. Wang, T. Weyand, M. Andreetto, and H. Adam. Mobilenets: Efficient convolutional neural networks for mobile vision applications. CoRR, abs\/1704.04861, 2017."},{"key":"e_1_3_2_1_21_1","volume-title":"Squeezenet: Alexnet-level accuracy with 50x fewer parameters and <1mb model size. CoRR, abs\/1602.07360","author":"Iandola F. N.","year":"2016","unstructured":"F. N. Iandola , M. W. Moskewicz , K. Ashraf , S. Han , W. J. Dally , and K. Keutzer . Squeezenet: Alexnet-level accuracy with 50x fewer parameters and <1mb model size. CoRR, abs\/1602.07360 , 2016 . F. N. Iandola, M. W. Moskewicz, K. Ashraf, S. Han, W. J. Dally, and K. Keutzer. Squeezenet: Alexnet-level accuracy with 50x fewer parameters and <1mb model size. CoRR, abs\/1602.07360, 2016."},{"key":"e_1_3_2_1_22_1","volume-title":"Batch normalization: Accelerating deep network training by reducing internal covariate shift. CoRR, abs\/1502.03167","author":"Ioffe S.","year":"2015","unstructured":"S. Ioffe and C. Szegedy . Batch normalization: Accelerating deep network training by reducing internal covariate shift. CoRR, abs\/1502.03167 , 2015 . S. Ioffe and C. Szegedy. Batch normalization: Accelerating deep network training by reducing internal covariate shift. CoRR, abs\/1502.03167, 2015."},{"key":"e_1_3_2_1_23_1","volume-title":"Proceedings of the 2014 ACM SIGSAC Conference on Computer and Communications Security.","author":"Jang D.","unstructured":"D. Jang , H. Lee , M. Kim , D. Kim , D. Kim , and B. B. Kang . Atra: Address translation redirection attack against hardware-based external monitors . In Proceedings of the 2014 ACM SIGSAC Conference on Computer and Communications Security. D. Jang, H. Lee, M. Kim, D. Kim, D. Kim, and B. B. Kang. Atra: Address translation redirection attack against hardware-based external monitors. In Proceedings of the 2014 ACM SIGSAC Conference on Computer and Communications Security."},{"key":"e_1_3_2_1_24_1","volume-title":"2019 56th ACM\/IEEE Design Automation Conference (DAC).","author":"Khasawneh K. N.","unstructured":"K. N. Khasawneh , E. M. Koruyeh , C. Song , D. Evtyushkin , D. Ponomarev , and N. Abu-Ghazaleh . Safespec: Banishing the spectre of a meltdown with leakage-free speculation . In 2019 56th ACM\/IEEE Design Automation Conference (DAC). K. N. Khasawneh, E. M. Koruyeh, C. Song, D. Evtyushkin, D. Ponomarev, and N. Abu-Ghazaleh. Safespec: Banishing the spectre of a meltdown with leakage-free speculation. In 2019 56th ACM\/IEEE Design Automation Conference (DAC)."},{"key":"e_1_3_2_1_25_1","volume-title":"12th USENIX Workshop on Offensive Technologies (WOOT 18)","author":"Koruyeh E. M.","unstructured":"E. M. Koruyeh , K. N. Khasawneh , C. Song , and N. Abu-Ghazaleh . Spectre returns! speculation attacks using the return stack buffer . In 12th USENIX Workshop on Offensive Technologies (WOOT 18) , Baltimore, MD. E. M. Koruyeh, K. N. Khasawneh, C. Song, and N. Abu-Ghazaleh. Spectre returns! speculation attacks using the return stack buffer. In 12th USENIX Workshop on Offensive Technologies (WOOT 18), Baltimore, MD."},{"key":"e_1_3_2_1_26_1","volume-title":"The 25th Annual International Conference on Mobile Computing and Networking.","author":"Lee T.","unstructured":"T. Lee , Z. Lin , S. Pushp , C. Li , Y. Liu , Y. Lee , F. Xu , C. Xu , L. Zhang , and J. Song . Occlumency: Privacy-preserving remote deep-learning inference using sgx . In The 25th Annual International Conference on Mobile Computing and Networking. T. Lee, Z. Lin, S. Pushp, C. Li, Y. Liu, Y. Lee, F. Xu, C. Xu, L. Zhang, and J. Song. Occlumency: Privacy-preserving remote deep-learning inference using sgx. In The 25th Annual International Conference on Mobile Computing and Networking."},{"key":"e_1_3_2_1_27_1","doi-asserted-by":"publisher","DOI":"10.1145\/3229556.3229562"},{"key":"e_1_3_2_1_28_1","doi-asserted-by":"publisher","DOI":"10.1109\/MNET.2018.1700202"},{"key":"e_1_3_2_1_29_1","volume-title":"Proceedings of the 3rd Workshop on System Software for Trusted Execution.","author":"Liu R.","unstructured":"R. Liu and M. Srivastava . Virtsense: Virtualize sensing through arm trustzone on internet-of-things . In Proceedings of the 3rd Workshop on System Software for Trusted Execution. R. Liu and M. Srivastava. Virtsense: Virtualize sensing through arm trustzone on internet-of-things. In Proceedings of the 3rd Workshop on System Software for Trusted Execution."},{"key":"e_1_3_2_1_30_1","doi-asserted-by":"publisher","DOI":"10.1145\/3086439.3086443"},{"key":"e_1_3_2_1_31_1","volume-title":"USENIX Workshop on Hot Topics in Edge Computing (HotEdge 18)","author":"Ogden S. S.","unstructured":"S. S. Ogden and T. Guo . MODI: Mobile deep inference made efficient by edge computing . In USENIX Workshop on Hot Topics in Edge Computing (HotEdge 18) . S. S. Ogden and T. Guo. MODI: Mobile deep inference made efficient by edge computing. In USENIX Workshop on Hot Topics in Edge Computing (HotEdge 18)."},{"key":"e_1_3_2_1_32_1","volume-title":"25th USENIX Security Symposium (USENIX Security 16)","author":"Ohrimenko O.","unstructured":"O. Ohrimenko , F. Schuster , C. Fournet , A. Mehta , S. Nowozin , K. Vaswani , and M. Costa . Oblivious multi-party machine learning on trusted processors . In 25th USENIX Security Symposium (USENIX Security 16) . O. Ohrimenko, F. Schuster, C. Fournet, A. Mehta, S. Nowozin, K. Vaswani, and M. Costa. Oblivious multi-party machine learning on trusted processors. In 25th USENIX Security Symposium (USENIX Security 16)."},{"key":"e_1_3_2_1_33_1","unstructured":"PyTorch on Android. https:\/\/pytorch.org\/mobile\/android\/.  PyTorch on Android. https:\/\/pytorch.org\/mobile\/android\/."},{"key":"e_1_3_2_1_34_1","volume-title":"YOLO9000: better, faster, stronger. CoRR, abs\/1612.08242","author":"Redmon J.","year":"2016","unstructured":"J. Redmon and A. Farhadi . YOLO9000: better, faster, stronger. CoRR, abs\/1612.08242 , 2016 . J. Redmon and A. Farhadi. YOLO9000: better, faster, stronger. CoRR, abs\/1612.08242, 2016."},{"key":"e_1_3_2_1_35_1","volume-title":"Inverted residuals and linear bottlenecks: Mobile networks for classification, detection and segmentation. CoRR, abs\/1801.04381","author":"Sandler M.","year":"2018","unstructured":"M. Sandler , A. G. Howard , M. Zhu , A. Zhmoginov , and L. Chen . Inverted residuals and linear bottlenecks: Mobile networks for classification, detection and segmentation. CoRR, abs\/1801.04381 , 2018 . M. Sandler, A. G. Howard, M. Zhu, A. Zhmoginov, and L. Chen. Inverted residuals and linear bottlenecks: Mobile networks for classification, detection and segmentation. CoRR, abs\/1801.04381, 2018."},{"key":"e_1_3_2_1_36_1","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2015.7298594"},{"key":"e_1_3_2_1_37_1","volume-title":"Eighth Workshop on Hot Topics in System Dependability (HotDep 12)","author":"Tartler R.","year":"2012","unstructured":"R. Tartler , A. Kurmus , B. Heinloth , V. Rothberg , A. Ruprecht , D. Dorneanu , R. Kapitza , W. Schr\u00f6der-Preikschat , and D. Lohmann . Automatic OS kernel TCB reduction by leveraging compile-time configurability . In Eighth Workshop on Hot Topics in System Dependability (HotDep 12) , Hollywood, CA , 2012 . USENIX Association. R. Tartler, A. Kurmus, B. Heinloth, V. Rothberg, A. Ruprecht, D. Dorneanu, R. Kapitza, W. Schr\u00f6der-Preikschat, and D. Lohmann. Automatic OS kernel TCB reduction by leveraging compile-time configurability. In Eighth Workshop on Hot Topics in System Dependability (HotDep 12), Hollywood, CA, 2012. USENIX Association."},{"key":"e_1_3_2_1_38_1","unstructured":"Tensorflow Lite on Android. https:\/\/www.tensorflow.org\/lite\/guide\/android.  Tensorflow Lite on Android. https:\/\/www.tensorflow.org\/lite\/guide\/android."},{"key":"e_1_3_2_1_39_1","volume-title":"Privado: Practical and secure DNN inference. CoRR, abs\/1810.00602","author":"Tople S.","year":"2018","unstructured":"S. Tople , K. Grover , S. Shinde , R. Bhagwan , and R. Ramjee . Privado: Practical and secure DNN inference. CoRR, abs\/1810.00602 , 2018 . S. Tople, K. Grover, S. Shinde, R. Bhagwan, and R. Ramjee. Privado: Practical and secure DNN inference. CoRR, abs\/1810.00602, 2018."},{"key":"e_1_3_2_1_40_1","volume-title":"International Conference on Learning Representations","author":"Tramer F.","year":"2019","unstructured":"F. Tramer and D. Boneh . Slalom: Fast, verifiable and private execution of neural networks in trusted hardware . In International Conference on Learning Representations , 2019 . F. Tramer and D. Boneh. Slalom: Fast, verifiable and private execution of neural networks in trusted hardware. In International Conference on Learning Representations, 2019."},{"key":"e_1_3_2_1_41_1","first-page":"681","volume-title":"13th USENIX Symposium on Operating Systems Design and Implementation (OSDI 18)","author":"Volos S.","year":"2018","unstructured":"S. Volos , K. Vaswani , and R. Bruno . Graviton: Trusted execution environments on gpus . In 13th USENIX Symposium on Operating Systems Design and Implementation (OSDI 18) , pages 681 -- 696 , Carlsbad, CA , Oct. 2018 . USENIX Association. S. Volos, K. Vaswani, and R. Bruno. Graviton: Trusted execution environments on gpus. In 13th USENIX Symposium on Operating Systems Design and Implementation (OSDI 18), pages 681--696, Carlsbad, CA, Oct. 2018. USENIX Association."},{"key":"e_1_3_2_1_42_1","doi-asserted-by":"publisher","DOI":"10.1145\/3290390"},{"key":"e_1_3_2_1_43_1","doi-asserted-by":"publisher","DOI":"10.1109\/HPCA.2019.00048"},{"key":"e_1_3_2_1_44_1","doi-asserted-by":"publisher","DOI":"10.1038\/s41928-018-0059-3"},{"key":"e_1_3_2_1_45_1","volume-title":"Proceedings of the 22nd ACM SIGSAC Conference on Computer and Communications Security.","author":"Yu M.","unstructured":"M. Yu , V. D. Gligor , and Z. Zhou . Trusted display on untrusted commodity platforms . In Proceedings of the 22nd ACM SIGSAC Conference on Computer and Communications Security. M. Yu, V. D. Gligor, and Z. Zhou. Trusted display on untrusted commodity platforms. In Proceedings of the 22nd ACM SIGSAC Conference on Computer and Communications Security."},{"key":"e_1_3_2_1_46_1","doi-asserted-by":"publisher","DOI":"10.14722\/ndss.2019.23327"},{"key":"e_1_3_2_1_47_1","doi-asserted-by":"publisher","DOI":"10.1145\/3055186.3055189"},{"key":"e_1_3_2_1_48_1","doi-asserted-by":"publisher","DOI":"10.1109\/MCOM.001.1900103"}],"event":{"name":"IoTDI '21: International Conference on Internet-of-Things Design and Implementation","location":"Charlottesvle VA USA","acronym":"IoTDI '21","sponsor":["SIGBED ACM Special Interest Group on Embedded Systems","IEEE CS"]},"container-title":["Proceedings of the International Conference on Internet-of-Things Design and Implementation"],"original-title":[],"link":[{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/3450268.3453524","content-type":"unspecified","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/dl.acm.org\/doi\/pdf\/10.1145\/3450268.3453524","content-type":"application\/pdf","content-version":"vor","intended-application":"syndication"},{"URL":"https:\/\/dl.acm.org\/doi\/pdf\/10.1145\/3450268.3453524","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,6,17]],"date-time":"2025-06-17T20:46:59Z","timestamp":1750193219000},"score":1,"resource":{"primary":{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/3450268.3453524"}},"subtitle":["Secure and Performant On-device Deep Learning Inference Framework for Mobile and IoT Devices"],"short-title":[],"issued":{"date-parts":[[2021,5,18]]},"references-count":48,"alternative-id":["10.1145\/3450268.3453524","10.1145\/3450268"],"URL":"https:\/\/doi.org\/10.1145\/3450268.3453524","relation":{},"subject":[],"published":{"date-parts":[[2021,5,18]]},"assertion":[{"value":"2021-05-18","order":2,"name":"published","label":"Published","group":{"name":"publication_history","label":"Publication History"}}]}}