With powerful AI chips becoming mainstream, on‑device machine learning is gaining attention for its low latency and privacy benefits. Yet if an edge device is compromised, an attacker can reverse‑engineer the app to obtain white‑box access to the deployed model, learning the knowledge of peer devices. This cross‑node attack enables efficient adversarial attacks. Existing defenses mainly address known vulnerabilities, but white‑box access still lets attackers uncover unknown weaknesses, meaning a single breached device can endanger all models from the same source. Prior work shows that model robustness is largely determined by the curvature of the decision boundary, prompting an investigation into how parameters shape this curvature. We introduce BMO (Boundary‑aware Model Obfuscation), which decomposes model parameters into boundary‑position and boundary‑curvature components under null‑space constraints. By injecting noise into the curvature component, we instantiate models with diversified decision boundaries, enhancing resistance to cross‑node attacks while preserving benign accuracy. Across four major adversarial attack types and four widely deployed on‑device models, BMO achieves an average defense success rate of 68.68%, far surpassing the strongest baseline at 22.32%, and maintains comparable normal accuracy.
Review