TT-SEAL: TTD-Aware Selective Encryption for Adversarially-Robust and Low-Latency Edge AI

Kyeongpil Min; Sangmin Jeon; Jae-Jin Lee; Woojoo Lee

cs.CRFeb 24, 2026

TT-SEAL: TTD-Aware Selective Encryption for Adversarially-Robust and Low-Latency Edge AI

Authors: Kyeongpil Min, Sangmin Jeon, Jae-Jin Lee, Woojoo Lee

Organizations: †Department of Intelligent Semiconductor Engineering, Chung-Ang University, Seoul, Korea

Abstract

Cloud-edge AI must jointly satisfy model compression and security under tight device budgets. While Tensor-Train Decomposition (TTD) shrinks on-device models, prior selective-encryption studies largely assume dense weights, leaving its practicality under TTD compression unclear. We present TT-SEAL, a selective-encryption framework for TT-decomposed networks. TT-SEAL ranks TT cores with a sensitivity-based importance metric, calibrates a one-time robustness threshold, and uses a value-DP optimizer to encrypt the minimum set of critical cores with AES. Under TTD-aware, transfer-based threat models (and on an FPGA-prototyped edge processor) TT-SEAL matches the robustness of full (black-box) encryption while encrypting as little as 4.89-15.92% of parameters across ResNet-18, MobileNetV2, and VGG-16, and drives the share of AES decryption in end-to-end latency to low single digits (e.g., 58% -> 2.76% on ResNet-18), enabling secure, low-latency edge AI.

Figures & tables

Figure 1. Transfer-based adversarial attack using JBDA. Blue lines: the attacker queries oracle $\bm{O(x)}$ with clean inputs, trains a substitute $\bm{F(\mathbf{x})}$ , and augments data $\mathbf{x}^{\prime}$ near decision boundaries. Red lines: $\bm{F}$ generates adversarial examples $\mathbf{x}_{\bm{adv}}$ that transfer to $\bm{O}$ .

Figure 2. Substitute-model accuracy vs. selective encryption ratio in ResNet-18 with dense and TTD-compressed weights.

Figure 3. Relationship between $\bm{I}_{\bm{acc}}$ and substitute-model accuracy for TTD-compressed ResNet-18, MobileNetV2 and VGG-16.

Figure 4. Image-classification demo running on the FPGA-prototyped processor, illustrating a transfer-based misclassification: an original ship is predicted as a cat under the configured threat model.

IP Block	LUTs	FFs	IP Block	LUTs	FFs
Rocket RISC-V Core	15,040	9,880	Peripherals (incl. DMA)	5,043	10,370
SRAM	166	323	System Interconnect	9,745	17,375
DDR Controller	7,950	7,571	GEMM Engine	84,150	32,939

Table 1. FPGA resource utilization of the prototype edge AI processor.

Panel of Table 2 — Table 2. Transfer ratios (%) across ResNet-18, MobileNetV2, and VGG-16 for different perturbation strengths $\bm{\epsilon}$ and attack types. Results are shown under three encryption levels: W-B (white-box), TH ( $\bm{I}_{\bm{acc\_th}}$ ), and B-B (black-box). The comparison highlights how TT-SEAL suppresses transferability to the B-B robustness level.

Figure 5. Visualization of adversarial examples generated from the substitute of the TT-SEAL-encrypted model. As $\bm{\epsilon}$ increases, stronger perturbations are progressively added to the input image.

Figure 6. Effect of selective encryption under non-targeted attacks ( $\bm{\epsilon=32/255}$ ). Across ResNet-18, VGG-16, and MobileNetV2, the transfer ratio remains suppressed until $\bm{I}_{\bm{acc}}$ falls below $\bm{I}_{\bm{acc\_th}}$ , demonstrating its effectiveness as a robustness threshold.

Figure 7. Transfer ratios across models for diverse adversarial example generation methods under the non-targeted attack with $\bm{\epsilon=16/255}$ .

$I_{acc}$		0.2	0.4	0.6	0.8	$I_{acc\_th}$
ResNet-18	Encrypted Parameters	21,028	72,208	134,604	465,068	89,685
	Encryption Ratio (%)	1.14	3.94	7.35	25.41	4.89
	$t_{TT-SEAL}$ / $t_{BB}$ (%)	1.13	4.16	7.23	25.7	4.87
	$t_{TT-SEAL}$ / $t_{Inf}$ (%)	0.66	2.37	4.04	13.02	2.76
MobileNetV2	Encrypted Parameters	15,317	19,143	29,794	74,706	71,268
	Encryption Ratio (%)	3.42	4.29	6.66	16.7	15.92

Table 3. Selective-encryption parameters and decryption times for each model under

\bm{I}_{\bm{acc}}

intervals and at

\bm{I}_{\bm{acc\_th}}

Privacy-Preserving ML

Privacy-preserving machine learning develops methods to learn, share, and run models while limiting exposure of sensitive data.

See all 432 papers

Tessera: Secure, Near-Line-Rate Weight Streaming for UMA Edge Accelerators
Apr 25, 2026Animan NaskarEfficient Neural Network Inference AI Accelerator Inference
Indian Institute of Technology (IIT) Ropar
SecureRouter: Encrypted Routing for Efficient Secure Inference
Apr 16, 2026Yukuan Zhang, Mengxin Zheng, Qian LouEfficient Transformer Inference Secure Multi-Party Computation
University of Central Florida · Orlando, Florida, USA
TEE-X: TEE-aware Acceleration Framework for Large Vision Models at the Edge
Aug 24, 2026Kurt M Wilson, Mohaiminul Al Nahian, Abeer Matar A. Almalky +5Efficient Neural Network Inference Edge Inference
North Carolina State University · Binghamton University (SUNY) · Florida International University +1

Apr 25, 2026J/K move · Enter open · S save

Tessera: Secure, Near-Line-Rate Weight Streaming for UMA Edge Accelerators

Animan Naskar

Indian Institute of Technology (IIT) Ropar

Efficient Neural Network Inference AI Accelerator Inference Edge ML

Open paper AskPDF arXiv

Deploying proprietary Deep Neural Networks (DNNs) on commodity edge devices demands hardware-backed Digital Rights Management (DRM) capable of withstanding both software-level and physical adversaries. In Unified Memory Architecture (UMA) systems, the host CPU and Neural Processing Unit (NPU) share physical DRAM, leaving plaintext model weights directly readable by a compromised OS kernel. Existing defenses fail in this constrained setting: trusted execution environments monopolize scarce memory with permanently reserved regions, while full-memory encryption operates at page granularity. This forces the system to fetch massive 4 KB memory pages for sub-page tensor tiles, severely crippling bandwidth. We present Tessera, a reference architecture for inline, cache-line granularity weight decryption on UMA edge accelerators. The design intercepts 64-byte AXI bursts, computing AES-256-CTR keystreams in parallel with DRAM fetches. This streams plaintext directly into isolated NPU SRAM, creating a transient memory footprint confined to the active tile and eliminating the need for permanent memory carve-outs. Measurements across three distinct SoC platforms demonstrate that this parallelization hides cryptographic latency behind standard DRAM fetch times, a condition that holds even under worst-case timing variations. Consequently, Tessera is projected to achieve 98.4% of the theoretical memory bandwidth ceiling (a mere 1.6% overhead). Across standard vision and language models, page-level memory encryption suffers up to a 32x bandwidth penalty, whereas Tessera maintains an optimal 1x footprint for all layer geometries. Finally, Tessera neutralizes major UMA-specific attack vectors -- including physical DRAM extraction, rogue DMA, and compute hijacking -- and formally prevents plaintext leakage across sparse tensors.

Abstract

Privacy-Preserving ML

Explore similar work

Tessera: Secure, Near-Line-Rate Weight Streaming for UMA Edge Accelerators

SecureRouter: Encrypted Routing for Efficient Secure Inference

TEE-X: TEE-aware Acceleration Framework for Large Vision Models at the Edge