Protecting On-Device AI Inference: A Systematic Review of Attacks and Defence Mechanisms

• URL: http://arxiv.org/abs/2605.29450v1
• Date: Thu, 28 May 2026 06:44:46 GMT
• Title: Protecting On-Device AI Inference: A Systematic Review of Attacks and Defence Mechanisms
• Abstract summary: This paper presents the first comprehensive review of threats and corresponding defence mechanisms targeting on-device AI inference.<n>One quarter of the surveyed attack papers focus on Intellectual Property (IP) attacks, whereas half of the defence solutions tackle the same issue.<n>Some attack categories have no defence paper associated to them, such as adversarial attacks that account for roughly one third of the attack literature.
• Score: 36.94429692322632
• License: http://creativecommons.org/licenses/by/4.0/
• Abstract: The need for secure and private Artificial Intelligence (AI) and Machine Learning (ML) on edge and mobile devices has increased the necessity of protecting the architecture of these systems from threats to both security and privacy. With an ever-increasing number of pre-trained AI models being used on mobile platforms for client-side inference, there are rising concerns about the risks associated with the theft/extraction of AI models, adversarial attacks on AI models, and data breaches. As a result of this trend, a variety of defence mechanisms have been proposed to protect against these threats. These include Trusted Execution Environments (TEEs), homomorphic encryption, obfuscation, and differential privacy, among others. However, current surveys largely focus on edge intelligence, which includes distributed training, and thus overlook security and privacy issues that are specific to on-device AI inference. To the best of our knowledge, this paper presents the first comprehensive review of threats and corresponding defence mechanisms targeting on-device inference. Our results show that the attack and defence literature are unbalanced: approximately one quarter of the surveyed attack papers focus on Intellectual Property (IP) attacks, whereas half of the defence solutions tackle the same issue. More importantly, some attack categories have no defence paper associated to them, such as adversarial attacks that account for roughly one third of the attack literature. This asymmetry between known attacks and available mitigations highlights clear opportunities for future research on securing on-device AI inference.

Related papers

• AI Model Extraction Attacks: Bypassing Single-Client Assumptions in Defenses [1.247917923987062]
  Model Extraction Attacks (MEAs) enable adversaries to replicate proprietary models, compromise protected information, and prepare offline adversarial attacks.<n>Current defense strategies predominantly rely on the Single Client Assumption (SCA), which is the implicit assumption that attacks originate from isolated identities.<n>We introduce a modular, open-source framework called CerberusAI for reproducible model-stealing research, and use it to simulate distributed attack scenarios.
  arXiv  Detail & Related papers  (2026-06-02T09:25:29Z)
• Techniques of Modern Attacks [51.56484100374058]
  Advanced Persistent Threats (APTs) represent a complex method of attack aimed at specific targets.<n>I will investigate both the attack life cycle and cutting-edge detection and defense strategies proposed in recent academic research.<n>I aim to highlight the strengths and limitations of each approach and propose more adaptive APT mitigation strategies.
  arXiv  Detail & Related papers  (2026-01-19T22:15:25Z)
• AI-Driven Cybersecurity Threats: A Survey of Emerging Risks and Defensive Strategies [0.0]
  This paper aims to analyze emerging risks, attack mechanisms, and defense shortcomings related to AI in cybersecurity.<n>We introduce a comparative taxonomy connecting AI capabilities with threat modalities and defenses.<n>Our findings emphasize the urgency for explainable, interdisciplinary, and regulatory-compliant AI defense systems.
  arXiv  Detail & Related papers  (2026-01-06T05:09:40Z)
• ANNIE: Be Careful of Your Robots [48.89876809734855]
  We present the first systematic study of adversarial safety attacks on embodied AI systems.<n>We show attack success rates exceeding 50% across all safety categories.<n>Results expose a previously underexplored but highly consequential attack surface in embodied AI systems.
  arXiv  Detail & Related papers  (2025-09-03T15:00:28Z)
• A Systematic Survey of Model Extraction Attacks and Defenses: State-of-the-Art and Perspectives [65.3369988566853]
  Recent studies have demonstrated that adversaries can replicate a target model's functionality.<n>Model Extraction Attacks pose threats to intellectual property, privacy, and system security.<n>We propose a novel taxonomy that classifies MEAs according to attack mechanisms, defense approaches, and computing environments.
  arXiv  Detail & Related papers  (2025-08-20T19:49:59Z)
• Securing AI Systems: A Guide to Known Attacks and Impacts [0.0]
  This paper provides an overview of adversarial attacks unique to predictive and generative AI systems.<n>We identify eleven major attack types and explicitly link attack techniques to their impacts.<n>We aim to equip researchers, developers, security practitioners, and policymakers, with foundational knowledge to recognize AI-specific risks and implement effective defenses.
  arXiv  Detail & Related papers  (2025-06-29T15:32:03Z)
• A Novel Approach to Guard from Adversarial Attacks using Stable Diffusion [0.0]
  Our proposal suggests a different approach to the AI Guardian framework. Instead of including adversarial examples in the training process, we propose training the AI system without them. This aims to create a system that is inherently resilient to a wider range of attacks.
  arXiv  Detail & Related papers  (2024-05-03T04:08:15Z)
• Fixed Points in Cyber Space: Rethinking Optimal Evasion Attacks in the Age of AI-NIDS [70.60975663021952]
  We study blackbox adversarial attacks on network classifiers. We argue that attacker-defender fixed points are themselves general-sum games with complex phase transitions. We show that a continual learning approach is required to study attacker-defender dynamics.
  arXiv  Detail & Related papers  (2021-11-23T23:42:16Z)
• Security and Privacy for Artificial Intelligence: Opportunities and Challenges [11.368470074697747]
  In recent years, most AI models are vulnerable to advanced and sophisticated hacking techniques. This challenge has motivated concerted research efforts into adversarial AI. We present a holistic cyber security review that demonstrates adversarial attacks against AI applications.
  arXiv  Detail & Related papers  (2021-02-09T06:06:13Z)
• Adversarial Machine Learning Attacks and Defense Methods in the Cyber Security Domain [58.30296637276011]
  This paper summarizes the latest research on adversarial attacks against security solutions based on machine learning techniques. It is the first to discuss the unique challenges of implementing end-to-end adversarial attacks in the cyber security domain.
  arXiv  Detail & Related papers  (2020-07-05T18:22:40Z)
• Vulnerabilities of Connectionist AI Applications: Evaluation and Defence [0.0]
  This article deals with the IT security of connectionist artificial intelligence (AI) applications, focusing on threats to integrity. A comprehensive list of threats and possible mitigations is presented by reviewing the state-of-the-art literature. The discussion of mitigations is likewise not restricted to the level of the AI system itself but rather advocates viewing AI systems in the context of their supply chains.
  arXiv  Detail & Related papers  (2020-03-18T12:33:59Z)

This list is automatically generated from the titles and abstracts of the papers in this site.

This site does not guarantee the quality of this site (including all information) and is not responsible for any consequences.