THEMIS: Towards Practical Intellectual Property Protection for Post-Deployment On-Device Deep Learning Models

2025-03-31

AI Summary

Deployed deep learning models on mobile devices are vulnerable to intellectual property (IP) theft, yet existing post-deployment IP protection mechanisms either require hardware modifications, trusted execution environments (TEEs), or substantial machine learning expertise from developers. Method: We propose a hardware- and TEE-agnostic model watermarking scheme that (1) automatically reconstructs read-only models into writable copies via reverse engineering, (2) embeds robust watermarks using a gradient-masking mechanism, and (3) achieves cross-framework compatibility (PyTorch/TFLite) via lightweight parameter solving—requiring no ML expertise. Contribution/Results: Our approach enables third parties (e.g., app stores) to perform offline watermark verification on deployed models, filling a critical gap in mobile ecosystem IP protection. It outperforms state-of-the-art methods across diverse datasets and model architectures. Empirical evaluation on 403 real-world Google Play apps achieves an 81.14% success rate for both watermark embedding and verification.

Technology Category

• Machine Learning: Hardware-aware ML
• Computer Vision: Large Vision Models
• Natural Language Processing: Interpretability, Analysis, and Evaluation of NLP Models

Application Category

• User Modeling, Personalization and Recommendation: Attacks and countermeasures in recommendation systems
• Systems and Infrastructure for Web, Mobile and WoT: Applied ML and AI for Web-based mobile applications
• Search and Retrieval-Augmented AI: Web learning to rank, online learning, and counterfactual learning for ranking

Abstract

On-device deep learning (DL) has rapidly gained adoption in mobile apps, offering the benefits of offline model inference and user privacy preservation over cloud-based approaches. However, it inevitably stores models on user devices, introducing new vulnerabilities, particularly model-stealing attacks and intellectual property infringement. While system-level protections like Trusted Execution Environments (TEEs) provide a robust solution, practical challenges remain in achieving scalable on-device DL model protection, including complexities in supporting third-party models and limited adoption in current mobile solutions. Advancements in TEE-enabled hardware, such as NVIDIA's GPU-based TEEs, may address these obstacles in the future. Currently, watermarking serves as a common defense against model theft but also faces challenges here as many mobile app developers lack corresponding machine learning expertise and the inherent read-only and inference-only nature of on-device DL models prevents third parties like app stores from implementing existing watermarking techniques in post-deployment models. To protect the intellectual property of on-device DL models, in this paper, we propose THEMIS, an automatic tool that lifts the read-only restriction of on-device DL models by reconstructing their writable counterparts and leverages the untrainable nature of on-device DL models to solve watermark parameters and protect the model owner's intellectual property. Extensive experimental results across various datasets and model structures show the superiority of THEMIS in terms of different metrics. Further, an empirical investigation of 403 real-world DL mobile apps from Google Play is performed with a success rate of 81.14%, showing the practicality of THEMIS.

Problem

• Protecting on-device DL models from theft and IP infringement
• Overcoming limitations of current watermarking techniques for mobile apps
• Enabling scalable IP protection without requiring ML expertise

Innovation

• Reconstructs writable on-device DL models
• Leverages untrainable nature for watermarking
• Automates intellectual property protection tool