Paper deep dive
TEE-X: TEE-aware Acceleration Framework for Large Vision Models at the Edge
Kurt M Wilson, Mohaiminul Al Nahian, Abeer Matar A. Almalky, Sadat Shahriyar, Souvik Kundu, Zhishan Guo, Abdullah Al Arafat, Adnan Siraj Rakin
Intelligence
Status: not_run | Model: - | Prompt: - | Confidence: 0%
Entities (0)
Relation Signals (0)
No relation signals yet.
Cypher Suggestions (0)
No Cypher suggestions yet.
Abstract
Abstract:Despite their remarkable success, machine learning models, particularly in vision applications, are alarmingly vulnerable to a range of security threats. One key factor in the attack landscape is the distinction between white-box and black-box threat models, as the latter poses challenges that limit attack effectiveness when access to model information is limited. As a result, using Trusted Execution Environments (TEEs) enhances security for machine learning applications by protecting model confidentiality and execution integrity, effectively shifting the execution environment from the white-box to the black-box side of the threat model spectrum. While adopting TEEs for large vision models, e.g., Vision Transformers (ViTs), is crucial for enhancing security and privacy, significant challenges related to memory constraints and increased computational latency must be addressed, especially in time-sensitive edge applications where safety and privacy are paramount. The objective of this work is to enable large vision models to be fully hosted within TEEs, achieving GPU-level inference latency for time-sensitive edge vision applications while maintaining performance. To this end, we propose TEE-X, a TEE-aware acceleration framework that introduces a sensitivity-aware modularization technique and enables vectorization in TEE inference. This design is validated on OP-TEE for Arm TrustZone, configured to optimize performance on the NVIDIA Jetson AGX Xavier for efficient edge vision applications using ViT models. The findings reveal that TEE-X delivers an effective TEE-aware acceleration framework that achieves minimal accuracy-latency trade-offs while ensuring fast and secure edge inference for vision models.
Tags
Links
- Source: https://arxiv.org/abs/2608.22716v1
- Canonical: https://arxiv.org/abs/2608.22716v1
Trouble viewing inline? Open PDF directly →
Full Text
53,946 characters extracted from source content.
Expand or collapse full text
TEE-X: TEE-aware Acceleration Framework for Large Vision Models at the Edge Kurt M Wilson Affiliation: North Carolina State University Affiliation: Equal contribution Mohaiminul Al Nahian Affiliation: Binghamton University (SUNY) Affiliation: Equal contribution Abeer Matar A. Almalky Affiliation: Binghamton University (SUNY) Affiliation: Equal contribution Sadat Shahriyar Affiliation: Florida International University Affiliation: Equal contribution Souvik Kundu Affiliation: Intel Zhishan Guo Affiliation: North Carolina State University Abdullah Al Arafat Affiliation: Florida International University Adnan Siraj Rakin Affiliation: Binghamton University (SUNY) Abstract Despite their remarkable success, machine learning models, particularly in vision applications, are alarmingly vulnerable to a range of security threats. One key factor in the attack landscape is the distinction between white-box and black-box threat models, as the latter poses challenges that limit attack effectiveness when access to model information is limited. As a result, using Trusted Execution Environments (TEEs) enhances security for machine learning applications by protecting model confidentiality and execution integrity, effectively shifting the execution environment from the white-box to the black-box side of the threat model spectrum. While adopting TEEs for large vision models, e.g., Vision Transformers (ViTs), is crucial for enhancing security and privacy, significant challenges related to memory constraints and increased computational latency must be addressed, especially in time-sensitive edge applications where safety and privacy are paramount. The objective of this work is to enable large vision models to be fully hosted within TEEs, achieving GPU-level inference latency for time-sensitive edge vision applications while maintaining performance. To this end, we propose TEE-X, a TEE-aware acceleration framework that introduces a sensitivity-aware modularization technique and enables vectorization in TEE inference. This design is validated on OP-TEE for Arm TrustZone, configured to optimize performance on the NVIDIA Jetson AGX Xavier for efficient edge vision applications using ViT models. The findings reveal that TEE-X delivers an effective TEE-aware acceleration framework that achieves minimal accuracy-latency trade-offs while ensuring fast and secure edge inference for vision models. 1 Introduction Figure 1: Overview of attack types categorized according to different threat model settings. Machine learning (ML) models have made significant strides across various tasks, demonstrating strong performance in many areas, particularly in vision applications 6; 4. Despite their success, prior studies have demonstrated that these models remain highly vulnerable to a broad spectrum of security attacks, including: memory fault injections 56; 8; 38; 39; 52; 1; 63; 65, side-channels 21; 13; 9; 41; 51; 54; 61; 26; 27, and adversarial attacks 5; 28; 62; 17; 2; 36; 30; 19; 53; 58; 34; 10; 29. These vulnerabilities highlight the ongoing need for improved security measures in the deployment of ML models, especially in vision applications, that are susceptible to these attacks. As shown in Figure 1, these attacks are generally classified based on their threat assumptions, which range from white-box to black-box scenarios. In white-box attacks, adversaries are assumed to have complete access to the target model, including its architecture and parameters 2; 30; 19; 53; 58; 34; 10; 29, thereby substantially simplifying the attack process and often leading to a significant impact on model security. In contrast, black-box attacks represent a considerably more challenging threat model, where adversaries have no direct access to the model internals and can only interact with the system through input-output queries or indirect observations 53; 45; 47. Consequently, the effectiveness and feasibility of attacks in black-box settings are substantially constrained compared to those in white-box settings. As a result, being on the black-box side of the spectrum has motivated the security community to adopt Trusted Execution Environments (TEEs) for ML applications, which provide an isolated and protected execution enclave often constraining the attack threat model more closer to a black-box spectrum 14; 33; 46; 23; 11; 25; 43; 42; 49; 35. These TEEs have been adopted as a defensive mechanism to enforce two primary objectives, model confidentiality (privacy) and execution integrity during inference (security). By isolating model execution within protected hardware boundaries, TEEs effectively shift the attack surface from the white-box to the black-box side of the spectrum (as shown in Fig. 1). While adopting TEEs for ML models to provide security and privacy protection is pivotal, the key challenge in adopting TEEs, especially for large vision models such as Vision Transformers (ViTs), stems from the memory and computational (e.g., latency) bottlenecks they introduce. Deploying a large vision model inside a TEE presents three primary bottlenecks: i) The memory capacity of the TEE is limited, which makes it challenging for some of the larger models to fit inside a TEE. i) Executing these models within TEE introduces considerable computational overhead and inference latency compared to native GPU execution. i) The above two challenges become further exacerbated in edge applications 55, where inference is time sensitive, at the same time, TEE-enabled inference is even more important in edge applications where safety (e.g., self-driving car 37) and privacy( e.g, healthcare 18) are a priority. To address this, existing approaches for deploying ML models within TEEs have adopted two alternative design choices. The first category is based on model partitioning, where parts or layers of the network are executed within the secure enclave, while the remaining components are offloaded to the untrusted environment to alleviate the stringent memory constraints imposed by TEEs 33; 46; 23; 49. The second category adopts operation-aware execution strategies, selectively placing sensitive operations inside the TEE while offloading computationally intensive operations to on-chip memory or external accelerators to improve execution efficiency 14; 35. While these methods are effective at partially reducing inference costs (e.g., latency), they still fall short of GPU-only inference time, which is critical, especially for edge applications. At the same time, exiting the TEE at any stage of model inference still leaves the attacker with additional information (e.g., layers) outside the TEE to exploit. This motivated our proposed approach to designing an acceleration method that enables hosting entire large vision models inside TEEs while achieving on-par GPU inference latency and maintaining model performance. Figure 2: Comparison of DeiT-small inference in: GPU, TEE, and accelerated using TEE-X. To this end, we propose TEE-X, a TEE-aware acceleration framework to run the entire model inference inside secure enclaves. Unlike prior approaches that rely on model partitioning or offloading operations to untrusted accelerators, TEE-X enables complete in-enclave execution by designing a novel sensitivity-aware modularization technique combined with TEE-aware computational budget assignment for each module. On the TEE side, for the first time, vectorization is enabled using Arm Neon SIMD instructions to perform a multiply-accumulate operation, providing GPU-like parallelism. The proposed optimization is designed to achieve two objectives: i) TEE-X ensures secure, fully protected model inference using the strong security benefits of TEEs. i) Meeting the performance demands of large-scale edge vision applications (ref. Figure 2). To evaluate our proposed solution, we stress test TEE-X on an edge vision application where the evaluation model is ViTs due to their substantially larger model sizes and higher computational complexity compared to other vision architectures, and on TrustZone within an Armv8 edge device (NVIDIA Jetson AGX Xavier) using a limited trusted memory carveout size. The results demonstrate that TEE-X provides an effective TEE-aware acceleration framework that achieves negligible accuracy–latency trade-offs while ensuring faster, more secure edge inference for vision models. 2 Background and Related Work Trusted Execution Environments (TEEs) are hardware-isolated execution environments designed to securely store sensitive data and models, and to protect computations from external access. Popular TEE technologies include Intel SGX 31, AMD SEV 20, and Arm TrustZone 3. Despite their security advantages, TEEs suffer from limited memory capacity and performance overhead, which pose challenges for deploying large ML models. Following prior studies 14; 33; 44; 46, we assume that the TEE operates as a trusted enclave within a potentially untrusted host system, including GPUs. Under this threat model, all data, model parameters, and computations inside the TEE are considered secure. Although side-channel attacks against TEEs have been explored in prior works 60; 16; 50, they are outside the scope of this paper. Vision Models inside TEEs. Several studies 14; 33; 46; 23; 11; 25; 43; 42; 49; 35 have investigated the deployment of vision models within secure enclaves. However, these frameworks largely overlook the unique architectural properties and system-level challenges associated with ViTs. In addition, many existing approaches only partially execute model components inside the enclave, rather than fully encapsulating the entire model within the secure environment. This fragmented execution design also introduces significant and often unavoidable latency overhead compared to standard GPU-based inference. Therefore, this work focuses on developing an efficient acceleration technique that enables full model execution within TEEs while minimizing latency overhead introduced by secure-enclave constraints and closely matching native GPU inference performance. 3 TEE-X: TEE-aware Acceleration Framework We propose TEE-X, designed to host large vision models such as ViTs within TEEs, informed by TEEs’ strict memory and computation budgets. At the same time, the proposed acceleration should preserve the model performance (i.e., accuracy and latency demand of the edge application). The proposed acceleration mechanism is motivated by two design principles: First, for a given application and TEE, we are bound by strict memory and latency budgets, especially for real-time edge models that must deliver model output within a strict latency window. Second, while maintaining the budget, the model acceleration method must maintain its accuracy. These two design principles are inversely proportional; i.e., in general, a smaller, faster model tends to be less accurate than its larger and higher-latency counterpart 15. To address this, our proposed TEE-X has two components: first, Modularization, which is a TEE-aware computation budget allocation and model optimization technique & second, Vectorization, which utilizes Arm Neon vectorization support with fused multiply-accumulation operation and cache-friendly access, in order to boost the Modularization technique in achieving on-par edge GPU performance. 3.1 Modularization: TEE-aware computation budget allocation The first component modularization technique consists of the following steps: the first component performs a sensitivity-aware module selection of the weight matrices of a ViT model that will run inside a TEE with an equal computation budget, where each module consists of a subset of the weight matrices. The intuition behind this design choice is that layers with equal sensitivity should receive a similar computational budget. Once the modules are created, TEE reports the total available computation budget to match GPU acceleration. Informed by this budget, we propose allocating a computation budget to each module based on its prior sensitivity ranking, ensuring that the total computation budget is met. Once the module is created and its corresponding budget is allocated, the final step practically realizes the TEE-aware budget allocation by learning a transformation of each module’s weight vector that reflects the allocated computational budget while performing layer-wise input and weight multiplication. This ensures that allocating a higher computation budget to more sensitive layers preserves the accuracy budget, while an aggressive reduction in the computation budget in less sensitive regions helps maintain the latency budget. The overview of TEE-X is illustrated in Figure 3. Figure 3: Overview of TEE-X’ modularization steps. Step-1: Sensitivity-aware Module Selection. Let W=w1,w2,…,wLW=\w_1,w_2,…,w_L\ be the weights of a pre-trained ViT model consisting of L layers. The goal of this step is to partition the weight matrix into groups with equal sensitivity levels. Hence, we propose to rank the layers based on a layer-wise sensitivity metric SiS_i (defined in section 3.2). The layers are divided into K modules k|k=1,2,…,K\G_k|k=1,2,…,K\, where layers with a similar level of sensitivity are grouped together in the same module. Step-2: Computation Budget Allocation to Each Module. Let xi∈ℝN×nix_i ^N× n_i be the input of the i-th layer with wi∈ℝni×now_i ^n_i× n_o. Then the activation/output of the layer is xi+1=g(xi×wi)x_i+1=g(x_i× w_i), where g(.)g(.) is an activation function. The key computational demands come from xi×wix_i× w_i. To optimize/minimize the computational load within TEE, we propose to learn a transformation of each wiw_i such that the overall computation for xi×wix_i× w_i is minimized. Let wiw_i is transformed to Ai∈ℝni×hiA_i ^n_i× h_i and Bi∈ℝhi×noB_i ^h_i× n_o. Now, hih_i will control the computation requirements for xi×wi=(xi×Ai)×Bix_i× w_i=(x_i× A_i)× B_i, which we define as the computational budget of the i-th layer. To speed up the computation within TEE, hih_i should be smaller than a factor ∝TgpuTTEEC T_gpuT_TEE, where TgpuT_gpu and TEET_TEE are per-operation times of GPU and TEE execution, to keep the TEE inference time on par with GPU’s. Let hkh_k be the computational budget of each layer in module kG_k and ngkn_g_k be the number of layers in kG_k. Then the budget assignment to each module can be found by solving: argmaxhkk=1K(hkk=1K)s.t.∑k=1Kngkhk≤ℂ,hk∈ℤ+ _\h_k\_k=1^KA(\h_k\_k=1^K) .t. _k=1^Kn_g_kh_k ,~h_k ^+ (1) here, (hkk=1K)A(\h_k\_k=1^K) denotes the model accuracy obtained after assigning dimension hkh_k to module kG_k and ℂC is available computational budget of TEE. Step-3. Realization of TEE-aware Budget Allocation. Let :wi→AiT:w_i→ A_i be a learned transformer and Bi:Ai→wiB_i:A_i→ w_i is a linear transformer such that wi=Ai×Biw_i=A_i× B_i. Once the computational budgets from Step-2 are found, all such T’s and BiB_i’s can be learned to decompose each weight matrix in the model. Note that solving Eq. 1 exactly is computationally expensive. The objective function is not available in closed form and depends on training ,BiT,B_i for each possible budget configuration hkh_k for each module subject to the budget constraint, ℂC. Therefore, instead of solving Eq. 1 directly, we use a sensitivity-guided rule-based allocation. We divide this total computation budget among modules based on the aggregate sensitivity score of a module’s layers relative to the total sensitivity score of all layers. If the k-th module kG_k has ngkn_gk layers, then the assigned compute budget to each layer of that module, hkh_k is given by hk=∑∀j∈kSj∑∀i∈LSi⋅ℂngkh_k= _∀ j _kS_j _∀ i∈ LS_i· Cn_gk (2) Eq. 2 ensures that we remain within computation budget, i.e., ∑ngk⋅hk=ℂΣn_gk· h_k=C. Once we have assigned this budget to each module, we jointly train the transformation networks across all modules. 3.2 Proposed Sensitivity Metric and Training the Transformation Networks Proposed Layer Sensitivity Metric (SiS_i). To measure the sensitivity of each layer, we perturb one layer at a time while keeping the others fixed. For the i-th layer, we sample a random Gaussian noise tensor gi∼(0,I),g_i (0,I), where gig_i has the same dimension as wiw_i. The weight perturbation Δwi w_i is defined as: Δwi=ϵ‖wi‖F⋅gi‖gi‖F, w_i=ε\|w_i\|_F· g_i\|g_i\|_F, where ϵε is the perturbation budget such that the Frobenius norm of the weight perturbation ‖Δwi‖F\| w_i\|_F is proportional to the Frobenius norm of the layer weights, ‖wi‖F\|w_i\|_F. The perturbed layer weight is given by w~i=wi+Δwi w_i=w_i+ w_i. Only wiw_i is replaced by w~i w_i during the evaluation, while the remaining layers are kept unchanged. Let wA_w denote the accuracy of the original model, and let w~iA_ w_i denote the accuracy after perturbing the i-th layer. The sensitivity score, SiS_i of layer i is defined as the resulting accuracy drop: Si=w−w~iS_i=A_w-A_ w_i (3) A larger SiS_i indicates that the layer is more sensitive to perturbation, which is used as a criterion for our TEE computation budget allocation. Training of the Transformation Network. To realize the acceleration framework proposed in Section 3.1, we need to train the transformation networks kT_k and BkB_k for each of the kG_k modules. Let F(⋅)F(·) denote the original pretrained ViT model, and let F^(⋅) F(·) denote the transformed model consisting of the transformation networks kT_k and BkB_k. For an input sample x with label y, the transformed model produces y^=F^(x). y= F(x). We optimize the transformed model using three complementary losses, defined as follows: ℒCE _CE =−∑iyilog(y^i),ℒKD=τ2KL(σ(F(x)/τ)∥σ(F^(x)/τ)), =- _iy_i ( y_i), _KD=τ^2KL (σ (F(x)/τ )\; \|\;σ ( F(x)/τ ) ), ℒMSE=1L∑i=1L‖xiwi−x^i+1‖22. _MSE= 1L _i=1^L \|x_iw_i- x_i+1 \|_2^2. here, σ(⋅)σ(·) denotes the softmax function, and τ is the distillation temperature. The term xiwix_iw_i represents the original output of the i-th layer, while x^i+1 x_i+1 represents the corresponding output produced by the transformed operation. The cross-entropy loss, ℒCEL_CE preserves task performance with respect to the ground-truth labels. The knowledge distillation loss, ℒKDL_KD preserves the output behavior of the original pretrained ViT. The MSE loss, ℒMSEL_MSE aligns the transformed layer outputs with the original layer outputs. All module-wise transformation networks and linear transforms are optimized jointly by solving mink,Bkk=1Kℒtotal=mink,Bkk=1K(ℒCE+λKDℒKD+λMSEℒMSE), _\T_k,B_k\_k=1^KL_total= _\T_k,B_k\_k=1^K(L_CE+ _KDL_KD+ _MSEL_MSE), (4) where λKD _KD and λMSE _MSE control the contributions of the distillation and output-alignment losses, respectively. After training, each learned transformation network kT_k is used to generate the transformed weights Ak=k(wk)A_k=T_k(w_k) for all layers in module kG_k. During inference, we store only the generated transformed weights Ak\A_k\ and the corresponding module-wise linear transforms Bk\B_k\, which reduces both the memory footprint and the computation required inside the TEE. Computational Budget of TEE (ℂC). To keep the model inference time on par with the GPU inference, we need to compute the maximum TEE computational budget ℂC. To perform xi×wix_i× w_i, the GPU inference time is 2NninoTgpu2Nn_in_oT_gpu, which is an approximation of the amount of FLOP counts times per-operation time. Then the corresponding TEE computational budget hih_i for on-par GPU performance is given by: hi=ninoni+no⋅TgpuTTEEh_i= n_in_on_i+n_o· T_gpuT_TEE (5) Then, the total computational budget of TEE is ℂ=∑∀ihiC= _∀ ih_i to maintain GPU performance. Our evaluation shows that using this theoretical budget for module-level computation allocation also matches GPU-level performance in practical TEE implementations. 3.3 Vectorization: TEE Acceleration Support Figure 4: Overview of Vectorization Step: Vectorizing C=A×BC=A× B. To efficiently perform matrix multiplication and residual addition in the trusted application (TA) within the TEE without a GPU, we use SIMD vectorization wherever possible. We use Arm Neon’s 128-bit-wide registers, which can store and operate on four 32-bit floats simultaneously. Combined with Arm’s fused-multiply-accumulate instruction and cache-friendly access ordering, we can accelerate tensor operations compared to naive serialized implementations. Furthermore, to reduce data dependencies and make efficient use of the instruction pipeline, we unroll the inner loop to write results to four wide registers at a time. For single batch inference, this allows TEE-X to match the host/GPU performance for some configurations. For batch sizes beyond 1, which make better use of the parallelism available within the GPU, the performance gap will increase, as the GPU will be able to progress on multiple inputs within the batch at the same time, whereas our parallelism is column-wise within a single input. Illustrative Example. Figure 4 shows an example of a vectorized matrix multiply operation, where we perform the multiply-accumulate step to multiple values within a row. To perform parallel multiply-accumulate operations, we utilize 128-bit wide registers to process four float32 values simultaneously. A scalar from A is broadcast into all four slots of register in_x (vdupq_n_f32), while a 4-float segment from a row in B is loaded into in_y (vld1q_f32). These are then processed alongside the current values loaded into out_z via Fused Multiply-Accumulate (vfmaq_f32). This allows us to compute four results in parallel before storing out_z back into the result matrix C, significantly increasing computational density. This process uses three 128-bit wide registers. Figure 5: Inference of two consecutive blocks in the TA. The input gets sent to the TA as a pointer to shared memory. Working memory and block results are kept in secure memory, except for the outputs of the last block, which gets placed into shared memory. The shared memory pointer gets passed to the host as the output, which can read the result. 4 Experimental Evaluation 4.1 TEE and Hardware implementation details We implement TEE-X with OP-TEE on Arm TrustZone. The implementation is split into two parts: the host application and the trusted application (TA). The host application runs in a non-secure world and has access to hardware peripherals, storage, and the network. The host has access to all system memory, except for a small TrustZone memory carve-out available only to the trusted application running within TrustZone. Vectorization. Attempting to use the GPU within the TA could result in exposure of the network weights and intermediary data, so we perform the layer operations on the CPU. To improve CPU inference speed, we use Arm Neon SIMD instructions to perform parallel multiply-accumulate operations, providing some GPU-like parallelism. During the inner loop of matrix multiplication, we broadcast a single scalar from one operand across all four lanes of a 128-bit float32x4_t register, and load four contiguous floats from the other operand into a separate vector register. The fused multiply-accumulate instruction (vfmaq_f32) then produces four results in parallel. To take advantage of pipelining, we unroll across four independent accumulator registers, advancing by 16 columns per inner loop, breaking the dependency chain between successive multiply-accumulate operations. We do similar steps for residuals, bias addition, and layer normalization to update multiple values per iteration. To use Neon within the TA, OP-TEE must be compiled with CFG_WITH_VFP, which adds support for saving and loading Neon registers during context switches. This adds two small sources of overhead: For the very first vector instruction in the TA after a context switch, an interrupt records the usage of the Neon registers. On the next context switch, OP-TEE checks whether a vector instruction has run, and if so, stores the state of the extra registers. The overhead is minor compared to the performance gains from vectorization, but it is important to minimize frequent host communication. Transferring Weights and Inputs. For efficient transfer of encoded weights and inputs to the TA, and to reduce TA memory usage, we used shared memory allocated by the host. The host application loads the weights into normal world memory, and marks it as accessible to the TA with TEEC_RegisterSharedMemory, and passes it to TA commands as a pointer. Shared memory does not count against the TrustZone memory limit. We minimize communication between the host and TA as much as possible while still balancing memory usage. For example, when consecutive layers are run on the TA, we do not send the intermediate results back and forth to the host. All compressed weights stay loaded in TA memory, and intermediate tensors are always kept in secure memory. We allocate intermediate tensors as soon as they are needed, and deallocate them as soon as they’re read for the last time. This reduces peak memory usage, allowing TEE-X to be used on TEEs with smaller memory limits. Hardware Platform. We evaluate on an Nvidia Jetson AGX Xavier, which has an 8-core 64-bit Armv8.2 CPU at 2.2 GHz and an integrated Volta GPU. We build upon the default Linux filesystem image from Nvidia with OP-TEE. We fix the CPU frequency to 2.2 GHz, and assign the inference process to one CPU core. 4.2 Evaluation Setting Models and Datasets. We evaluate TEE-X on multiple models: DeiT-Small and DeiT-Base 48, which are widely used representative ViT architectures with different capacity levels. For benchmarking, we use two standard image classification datasets: CIFAR-10 (22), consisting of 32×32 images across 10 classes, and ImageNet (7), which contains 224×224 high-resolution images spanning 1,000 classes. Hyperparameters and Experimental Setup. In all cases, we divide our model into K=3K=3 modules. The number of layers per module is fixed to be (L/3−1),L/3,(L/3+1)(L/3-1),L/3,(L/3+1). For DeiT-small and DeiT-base, this translates to 3,4,and53,4,~and~5 layers in each module. For each module, we train transformation networks for attn_qkv,attn_proj,mlp_fc1,mlp_fc2attn\_qkv,~attn\_proj,~mlp\_fc1,~mlp\_fc2. The network kT_k is a 2 linear layer MLP with pre- and post-affine transform, and BkB_k is a single linear layer. We exclude the first, last and LayerNorm layers from transformations. The transformation network parameters are quantized to 4-bit with quantization aware training and first and last layer is quantized in 8-bit. For CIFAR-10, we train the models for 500 epochs with learning rate 1e−41e-4 and 5e−55e-5 respectively for small and base models with batch size 256. For ImageNet, we train for 300 epochs with a batch size 1024 and a learning rate 2e−42e-4. We set λKD _KD to be 1e11e1 and 1e31e3 for CIFAR-10 and ImageNet respectively and λMSE _MSE is chosen to be 1.01.0. Our most demanding experiment can be performed using a single A6000A6000 GPU with 48GB48GB VRAM. Evaluation Criteria We evaluate TEE-X to answer four key criteria: (C1) preserving the ViT accuracy, (C2) achieving GPU-comparable inference latency, (C3) outperforming existing acceleration techniques and TEE-based frameworks, and (C4) improving security by transitioning models toward a black-box setting. TEE-X Accuracy and Latency (Answers for C1 and C2) Trade-offs. Table 1 demonstrates that TEE-X achieves substantial model size reduction while preserving high classification accuracy across different computation reduction factors C. Under =0.5C=0.5 and =0.4C=0.4, the accuracy degradation remains below 1% while reducing the model size by more than an order of magnitude. Even with the aggressive reduction setting of =0.2C=0.2, where the DeiT-Small model is compressed by approximately 47×47×, the accuracy drop is limited to only 2.65%. In terms of inference latency, TEE-X provides a flexible trade-off between accuracy and execution speed. For a higher computation budget ( =0.5C=0.5), TEE-X preserves near-baseline accuracy with comparable GPU inference latency, while more aggressive settings ( =0.2C=0.2) further reduce inference time and can even outperform GPU-based execution using proposed modularization and vectorization support. These results demonstrate that TEE-X outperforms existing compact vision models while enabling efficient and secure execution within TEEs. Overall, these results satisfy C1 and C2 by showing that TEE-X effectively reduces the memory and computational overhead of ViTs, enabling full deployment inside edge TEEs while maintaining strong accuracy and efficient inference performance. Table 1: Model size, Accuracy, inference time, and memory of DeiT-Small (Original vs Inside TEE) on CIFAR-10 under different computation reduction factors C. Accuracy (%) is reported. Peak Mem. (MB) is the peak memory utilization inside a TEE at inference time. Method Model Size (MB) Accuracy Avg Layer Time (ms) Avg Time (ms) Peak Mem. (MB) Baseline Host (GPU) 82.66 97.29 82.62 1022.35 154.78 TEE-X (=0.5)(C=0.5) 3.48 (23×) 96.48 58.24 (1.42×) 1082.67 21.91 TEE-X (=0.4)(C=0.4) 2.93 (28×) 96.40 51.76 (1.60×) 1006.74 18.14 TEE-X (=0.2)(C=0.2) 1.75 (47×) 94.64 48.02 (1.72×) 957.13 10.13 Comparison with Competitive Methods (Answers for C3). We evaluate TEE-X from two complementary perspectives: SOTA TEE-based frameworks and traditional model acceleration techniques. Table 2: Impact of TEE-X’s modularization compared to SOTA TEE-based model partitioning. Since this is a software optimization comparison, we applied vectorization acceleration to the competition as well. Method Latency (ms) Naive full model in TEE 1792.42 Model Partitioning 33; 46; 23; 49 1463.80 Operation-aware Execution 14; 35 3127.73 TEE-X 1082.67 Comparison with SOTA TEE-based frameworks. Existing TEE-based frameworks generally fall into two categories: model partitioning 33; 46; 23; 49, where only part of the model is executed inside the enclave while the rest runs in an untrusted region, and operation splitting, where individual computations are offloaded across trusted and untrusted domains. As shown in Table 2, both approaches introduce a noticeable latency gap compared to GPU-based inference due to frequent enclave transitions and communication overhead. In contrast, TEE-X achieves comparable and in some settings even lower inference latency than GPU execution, while still ensuring full-model execution entirely within the TEE, providing far superior security benefits highlighted in C4. Table 3: TEE-X and acceleration methods on DeiT-small on ImageNet. Model Acc.(%) TEE Ope. Support Baseline (84.1 MB) 79.72 – Pruning 57 (33 MB) 60.51 × 2-bit Quantization 24 (6.18 MB) 71.90 × TEE-X (4.63 MB) 76.44 ✓ Comparing with traditional acceleration techniques. historically, model acceleration techniques such as low-bit quantization 24 and pruning 57 have been widely used to reduce computational cost. As shown in Table 3, both approaches significantly degrade model accuracy compared to the original model. Moreover, these software optimizations lack hardware support in TEE environments, particularly for low-bit (2-bit) quantization and aggressive pruning configurations. In contrast, as highlighted in Table 3, TEE-X is the only approach that can reduce model computation while maintaining reasonable performance on ImageNet, with a lower memory footprint. Table 4: White-box (WB) and black-box (B) attacks on DeiT-B. Attack success rate (ASR, %) is reported. Type Setting ASR (%) Adversarial Attacks WB 32 99.40 B 64 60.00 Bit-Flip Attack WB 40 100.0 B 0.0 Security benefit of hosting the entire model on TEE (Answers for C4). Beyond accelerating vision model execution within TEEs, TEE-X also shifts the deployment closer to a black-box attack spectrum, as illustrated in Figure 1. To evaluate this transition, we analyze the model’s robustness under black-box attack scenarios. Table 4 highlights the vulnerability of vision models under both white-box and black-box threat settings. The results show that attack success rates are significantly higher in the white-box setting, while black-box attacks are considerably less effective. This gap indicates that reducing model exposure strengthens robustness against adversaries with limited access. Consequently, TEE-X not only accelerates inference within TEEs but also helps preserve the security of the accelerated models, which is critical in edge vision applications. 4.2.1 Ablation Study Table 5: Accuracy and model size comparison (Original vs Inside TEE) on ImageNet for DeiT-Small under different computation reduction factors C. Accuracy (%) is reported. Model Original =0.66 C=0.66 =0.5 C=0.5 Model Size (MB) Acc. Model Size (MB) Acc. Model Size (MB) Acc. DeiT-Small 84.11 79.72 4.63 76.44 3.81 75.79 Different Dataset. Table 5 reports the performance of DeiT-small on ImageNet using different reduction factors, further demonstrating the effectiveness of TEE-X on more complex tasks. Despite the aggressive reduction to only 3.81 MB, the reduced DeiT-Small model still achieves competitive accuracy compared to lightweight vision models of similar size, such as ResNet20 12 and ShuffleNetV2 59, on ImageNet. Different Architecture. Table 6 evaluates DeiT-Base on CIFAR-10 under multiple computation reduction factors. The result is consistent across different datasets as TEE-X provides a reasonable trade-off between accuracy and model acceleration/size. Table 6: Accuracy and model size comparison (Original vs Inside TEE) on CIFAR-10 for DeiT-Base under different computation reduction factors C. Accuracy (%) is reported. Model Original =0.5 C=0.5 =0.4 C=0.4 =0.2 C=0.2 Model Size (MB) Acc. Model Size (MB) Acc. Model Size (MB) Acc. Model Size (MB) Acc. DeiT-Base 327.33 97.55 12.83 97.22 10.47 97.04 5.80 95.57 Table 7: Impact of each component of TEE-X on DeiT-S on the CIFAR-10 dataset. Method Acc.(%) Inference Time (s) Baseline (Naive full model TEE) 97.29 4.43 TEE-X (w/o modularization) 97.29 1.80 TEE-X (w/o vectorization) 96.48 1.77 TEE-X 96.48 1.08 Host (GPU) 97.29 1.02 Ablation study of each component of TEE-X. We compare the performance impact of each component of the proposed TEE-X in terms of two primary metrics: accuracy & latency. We take two baselines: worst-case (naively running the entire model on TEE) and best-case (host GPU). It is evident from Table 7 that the proposed TEE-X performance (1.08s) is par with GPU host-only inference, with a substantial gain compared to naive TEE implementation. If we remove the modularization component, then the model accuracy remains unchanged while inference time increases by 80 % (1.8s) compared to TEE-X, underscoring the need for the modularization step. Similarly, removing the vectorization component will slow TEE-X performance by 77 % (1.77s), emphasizing that both modularization and vectorization have been critical towards achieving on-par GPU acceleration. Table 8: Effect of Different Computation Budget Assignment Strategy in TEE for Different C. Method =0.2 C=0.2 =0.4 C=0.4 Uniform Budget 91.27 93.55 TEE-X (Ours) 94.64 96.40 Ablation of Computation Budget Assignment Strategy. Table 8 shows the effect of different computation budget assignment strategy on the accuracy performance of a model. An alternative strategy would be to uniformly assign the same computation budget to all layers. The results clearly indicate that the proposed TEE-X following Eqn. 2 to assign computation budget across different modules helps maintain model performance, especially under strict budgets. 5 Conclusion In this work, we introduce TEE-X, a TEE-aware acceleration framework that enables efficient inference of large vision models in edge applications within secure memory. TEE-X addresses the bottlenecks to the full deployment of ViTs in TEEs: limited secure memory, high latency, and the constraint of preserving accuracy under a strict computation budget. To achieve this, we propose sensitivity-based modularization, TEE-aware computation-budget allocation, and SIMD-based vectorized execution within Arm TrustZone. Overall, TEE-X demonstrates a practical way to achieve near-GPU inference latency with high accuracy while keeping the entire model execution within trusted memory, thereby avoiding the security limitations of partitioning- or offloading-based approaches. References [1] S. Ahmed, R. Zhou, S. Angizi, and A. S. Rakin (2024) Deep-troj: an inference stage trojan insertion algorithm through efficient weight replacement attack. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, p. 24810–24819. Cited by: §1. [2] N. Akhtar and A. Mian (2018) Threat of adversarial attacks on deep learning in computer vision: a survey. Ieee Access 6, p. 14410–14430. Cited by: §1, §1. [3] T. Alves (2004) Trustzone: integrated hardware and software security. Information Quarterly 3, p. 18–24. Cited by: §2. [4] N. Carion, F. Massa, G. Synnaeve, N. Usunier, A. Kirillov, and S. Zagoruyko (2020) End-to-end object detection with transformers. In European conference on computer vision, p. 213–229. Cited by: §1. [5] N. Carlini and D. Wagner (2017) Towards evaluating the robustness of neural networks. In 2017 ieee symposium on security and privacy (sp), p. 39–57. Cited by: §1. [6] C. R. Chen, Q. Fan, and R. Panda (2021) Crossvit: cross-attention multi-scale vision transformer for image classification. In Proceedings of the IEEE/CVF international conference on computer vision, p. 357–366. Cited by: §1. [7] J. Deng, W. Dong, R. Socher, L. Li, K. Li, and L. Fei-Fei (2009) Imagenet: a large-scale hierarchical image database. In 2009 IEEE conference on computer vision and pattern recognition, p. 248–255. Cited by: §4.2. [8] J. Dong, H. Qiu, Y. Li, T. Zhang, Y. Li, Z. Lai, C. Zhang, and S. Xia (2023) One-bit flip is all you need: when bit-flip attack meets model training. In Proceedings of the IEEE/CVF International Conference on Computer Vision, p. 4688–4698. Cited by: §1. [9] D. Gruss, C. Maurice, and S. Mangard (2016) Rowhammer. js: a remote software-induced fault attack in javascript. In Detection of Intrusions and Malware, and Vulnerability Assessment: 13th International Conference, DIMVA 2016, San Sebastián, Spain, July 7-8, 2016, Proceedings 13, p. 300–321. Cited by: §1. [10] Y. Han, J. Liu, X. Liu, X. Jiang, L. Gu, X. Gao, and W. Chen (2022) Enhancing adversarial transferability with partial blocks on vision transformer. Neural Computing and Applications 34 (22), p. 20249–20262. Cited by: §1, §1. [11] L. Hanzlik, Y. Zhang, K. Grosse, A. Salem, M. Augustin, M. Backes, and M. Fritz (2021) Mlcapsule: guarded offline deployment of machine learning as a service. In Proceedings of the IEEE/CVF conference on computer vision and pattern recognition, p. 3300–3309. Cited by: §1, §2. [12] K. He, X. Zhang, S. Ren, and J. Sun (2016) Deep residual learning for image recognition. In Proceedings of the IEEE conference on computer vision and pattern recognition, p. 770–778. Cited by: §4.2.1. [13] S. Hong, M. Davinroy, Y. Kaya, S. N. Locke, I. Rackow, K. Kulda, D. Dachman-Soled, and T. Dumitraş (2020) Security analysis of deep neural networks operating in the presence of cache side-channel attacks. External Links: 1810.03487, Link Cited by: §1. [14] J. Hou, H. Liu, Y. Liu, Y. Wang, P. Wan, and X. Li (2021) Model protection: real-time privacy-preserving inference service for model privacy at the edge. IEEE Transactions on Dependable and Secure Computing 19 (6), p. 4270–4284. Cited by: §1, §1, §2, §2, Table 2. [15] A. G. Howard, M. Zhu, B. Chen, D. Kalenichenko, W. Wang, T. Weyand, M. Andreetto, and H. Adam (2017) Mobilenets: efficient convolutional neural networks for mobile vision applications. arXiv preprint arXiv:1704.04861. Cited by: §3. [16] T. Huo, X. Meng, W. Wang, C. Hao, P. Zhao, J. Zhai, and M. Li (2020) Bluethunder: a 2-level directional predictor based side-channel attack against sgx. IACR Transactions on Cryptographic Hardware and Embedded Systems, p. 321–347. Cited by: §2. [17] A. Ilyas, S. Santurkar, D. Tsipras, L. Engstrom, B. Tran, and A. Madry (2019) Adversarial examples are not bugs, they are features. Advances in neural information processing systems 32. Cited by: §1. [18] M. Javaid, A. Haleem, R. P. Singh, and M. Ahmed (2024) Computer vision to enhance healthcare domain: an overview of features, implementation, and opportunities. Intelligent Pharmacy 2 (6), p. 792–803. Cited by: §1. [19] A. Joshi, G. Jagatap, and C. Hegde (2021) Adversarial token attacks on vision transformers. arXiv preprint arXiv:2110.04337. Cited by: §1, §1. [20] D. Kaplan, J. Powell, and T. Woller (2016) AMD memory encryption. White paper 13, p. 12. Cited by: §2. [21] Y. Kim, R. Daly, J. Kim, C. Fallin, J. H. Lee, D. Lee, C. Wilkerson, K. Lai, and O. Mutlu (2014) Flipping bits in memory without accessing them: an experimental study of dram disturbance errors. ACM SIGARCH Computer Architecture News 42 (3), p. 361–372. Cited by: §1. [22] A. Krizhevsky and G. Hinton (2009) Learning multiple layers of features from tiny images. Technical report Technical Report TR-2009, University of Toronto, Toronto, Ontario, Canada. Cited by: §4.2. [23] T. Lee, Z. Lin, S. Pushp, C. Li, Y. Liu, Y. Lee, F. Xu, C. Xu, L. Zhang, and J. Song (2019) Occlumency: privacy-preserving remote deep-learning inference using sgx. In The 25th Annual international conference on mobile computing and networking, p. 1–17. Cited by: §1, §1, §2, §4.2, Table 2. [24] Y. Li, S. Xu, B. Zhang, X. Cao, P. Gao, and G. Guo (2022) Q-vit: accurate and fully quantized low-bit vision transformer. Advances in neural information processing systems 35, p. 34451–34463. Cited by: §4.2, Table 3. [25] Y. Li, D. Zeng, L. Gu, Q. Chen, S. Guo, A. Zomaya, and M. Guo (2021) Lasagna: accelerating secure deep learning inference in sgx-enabled edge cloud. In Proceedings of the ACM symposium on cloud computing, p. 533–545. Cited by: §1, §2. [26] C. S. Lin, J. Qu, and G. Saileshwar (2025) GPUHammer: rowhammer attacks on GPU memories are practical. In 34th USENIX Security Symposium (USENIX Security 25), Seattle, WA, p. 5719–5738. External Links: ISBN 978-1-939133-52-6, Link Cited by: §1. [27] C. S. Lin, Y. Yan, G. Ding, J. Qu, J. Zhu, D. Lie, and G. Saileshwar (2026) GPUBreach: privilege escalation attacks on GPUs using rowhammer. In Proceedings of the 47th IEEE Symposium on Security and Privacy, SP ’26. Cited by: §1. [28] Y. Liu, X. Chen, C. Liu, and D. Song (2016) Delving into transferable adversarial examples and black-box attacks. arXiv preprint arXiv:1611.02770. Cited by: §1. [29] P. Lv, H. Ma, J. Zhou, R. Liang, K. Chen, S. Zhang, and Y. Yang (2023) DBIA: data-free backdoor attack against transformer networks. In 2023 IEEE International Conference on Multimedia and Expo (ICME), Vol. , p. 2819–2824. External Links: Document Cited by: §1, §1. [30] K. Mahmood, R. Mahmood, and M. Van Dijk (2021) On the robustness of vision transformers to adversarial examples. In Proceedings of the IEEE/CVF international conference on computer vision, p. 7838–7847. Cited by: §1, §1. [31] F. McKeen, I. Alexandrovich, A. Berenzon, C. V. Rozas, H. Shafi, V. Shanbhogue, and U. R. Savagaonkar (2013) Innovative instructions and software model for isolated execution.. Hasp@ isca 10 (1). Cited by: §2. [32] D. Ming, P. Ren, Y. Wang, and X. Feng (2024) Boosting the transferability of adversarial attack on vision transformer with adaptive token tuning. In Advances in Neural Information Processing Systems, A. Globerson, L. Mackey, D. Belgrave, A. Fan, U. Paquet, J. Tomczak, and C. Zhang (Eds.), Vol. 37, p. 20887–20918. External Links: Document, Link Cited by: Table 4. [33] F. Mo, A. S. Shamsabadi, K. Katevas, S. Demetriou, I. Leontiadis, A. Cavallaro, and H. Haddadi (2020) Darknetz: towards model privacy at the edge using trusted execution environments. In Proceedings of the 18th International Conference on Mobile Systems, Applications, and Services, p. 161–174. Cited by: §1, §1, §2, §2, §4.2, Table 2. [34] M. Naseer, K. Ranasinghe, S. Khan, F. S. Khan, and F. Porikli (2021) On improving adversarial transferability of vision transformers. arXiv preprint arXiv:2106.04169. Cited by: §1, §1. [35] T. Nayan, Z. Zhang, and R. Sun (2025) SecureInfer: heterogeneous tee-gpu architecture for privacy-critical tensors for large language model deployment. arXiv preprint arXiv:2510.19979. Cited by: §1, §1, §2, Table 2. [36] N. Papernot, P. McDaniel, I. Goodfellow, S. Jha, Z. B. Celik, and A. Swami (2017) Practical black-box attacks against machine learning. In Proceedings of the 2017 ACM on Asia Conference on Computer and Communications Security, ASIA CCS ’17, New York, NY, USA, p. 506–519. External Links: ISBN 9781450349444, Link, Document Cited by: §1. [37] A. Prakash, K. Chitta, and A. Geiger (2021) Multi-modal fusion transformer for end-to-end autonomous driving. In Proceedings of the IEEE/CVF conference on computer vision and pattern recognition, p. 7077–7087. Cited by: §1. [38] A. S. Rakin, Z. He, and D. Fan (2019) Bit-flip attack: crushing neural network with progressive bit search. In Proceedings of the IEEE/CVF International Conference on Computer Vision, p. 1211–1220. External Links: Link Cited by: §1. [39] A. S. Rakin, Z. He, and D. Fan (2020) TBT: targeted neural network attack with bit trojan. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR), p. 13198–13207. Cited by: §1. [40] A. S. Rakin, Z. He, J. Li, F. Yao, C. Chakrabarti, and D. Fan (2021) T-bfa: targeted bit-flip adversarial weight attack. IEEE Transactions on Pattern Analysis and Machine Intelligence 44 (11), p. 7928–7939. Cited by: Table 4. [41] M. Seaborn and T. Dullien (2015) Exploiting the dram rowhammer bug to gain kernel privileges. Black Hat 15, p. 71. Cited by: §1. [42] T. Shen, J. Qi, J. Jiang, X. Wang, S. Wen, X. Chen, S. Zhao, S. Wang, L. Chen, X. Luo, et al. (2022) \soter\: Guarding black-box inference for general neural networks at the edge. In 2022 USENIX Annual Technical Conference (USENIX ATC 22), p. 723–738. Cited by: §1, §2. [43] Y. Shen, H. Tian, Y. Chen, K. Chen, R. Wang, Y. Xu, Y. Xia, and S. Yan (2020) Occlum: secure and efficient multitasking inside a single enclave of intel sgx. In Proceedings of the Twenty-Fifth International Conference on Architectural Support for Programming Languages and Operating Systems, p. 955–970. Cited by: §1, §2. [44] Y. Shen, X. He, Y. Han, and Y. Zhang (2022) Model stealing attacks against inductive graph neural networks. In 2022 IEEE Symposium on Security and Privacy (SP), p. 1175–1192. Cited by: §2. [45] Y. Shi, Y. Han, Y. Tan, and X. Kuang (2022) Decision-based black-box attack against vision transformers via patch-wise adversarial removal. Advances in Neural Information Processing Systems 35, p. 12921–12933. Cited by: §1. [46] Z. Sun, R. Sun, C. Liu, A. R. Chowdhury, L. Lu, and S. Jha (2023) Shadownet: a secure and efficient on-device model inference system for convolutional neural networks. In 2023 IEEE Symposium on Security and Privacy (SP), p. 1596–1612. Cited by: §1, §1, §2, §2, §4.2, Table 2. [47] Y. Tang, J. Lu, X. Kang, Y. Li, and H. Guo (2024) Black-box adversarial attack against transformer-based object detection models in vehicular networks. In International Conference on Algorithms and Architectures for Parallel Processing, p. 12–21. Cited by: §1. [48] H. Touvron, M. Cord, M. Douze, F. Massa, A. Sablayrolles, and H. Jégou (2021) Training data-efficient image transformers & distillation through attention. In International conference on machine learning, p. 10347–10357. Cited by: §4.2. [49] F. Tramer and D. Boneh (2018) Slalom: fast, verifiable and private execution of neural networks in trusted hardware. arXiv preprint arXiv:1806.03287. Cited by: §1, §1, §2, §4.2, Table 2. [50] J. Van Bulck, M. Minkin, O. Weisse, D. Genkin, B. Kasikci, F. Piessens, M. Silberstein, T. F. Wenisch, Y. Yarom, and R. Strackx (2018) Foreshadow: extracting the keys to the intel \sgx\ kingdom with transient \out-of-order\ execution. In 27th USENIX Security Symposium (USENIX Security 18), p. 991–1008. Cited by: §2. [51] V. Van Der Veen, Y. Fratantonio, M. Lindorfer, D. Gruss, C. Maurice, G. Vigna, H. Bos, K. Razavi, and C. Giuffrida (2016) Drammer: deterministic rowhammer attacks on mobile platforms. In Proceedings of the 2016 ACM SIGSAC conference on computer and communications security, p. 1675–1689. Cited by: §1. [52] J. Wang, Y. Wu, W. Xu, Y. Huang, C. Zhang, Z. Li, M. Xu, and Z. Liang (2025) Your scale factors are my weapon: targeted bit-flip attacks on vision transformers via scale factor manipulation. In Proceedings of the Computer Vision and Pattern Recognition Conference, p. 20103–20112. Cited by: §1. [53] Y. Wang, J. Wang, Z. Yin, R. Gong, J. Wang, A. Liu, and X. Liu (2022) Generating transferable adversarial examples against vision transformers. In Proceedings of the 30th ACM International Conference on Multimedia, p. 5181–5190. Cited by: §1, §1. [54] Y. Xiao, X. Zhang, Y. Zhang, and R. Teodorescu (2016) One bit flips, one cloud flops: Cross-VM row hammer attacks and privilege escalation. In 25th USENIX Security Symposium (USENIX Security 16), Austin, TX, p. 19–35. External Links: ISBN 978-1-931971-32-4, Link Cited by: §1. [55] Y. Xu, T. M. Khan, Y. Song, and E. Meijering (2025) Edge deep learning in computer vision and medical diagnostics: a comprehensive survey. Artificial Intelligence Review 58 (3), p. 93. Cited by: §1. [56] F. Yao, A. S. Rakin, and D. Fan (2020) \deephammer\: Depleting the intelligence of deep neural networks through targeted chain of bit flips. In 29th USENIX Security Symposium (USENIX Security 20), p. 1463–1480. Cited by: §1. [57] F. Yu, K. Huang, M. Wang, Y. Cheng, W. Chu, and L. Cui (2022) Width & depth pruning for vision transformers. In Proceedings of the AAAI conference on artificial intelligence, Vol. 36, p. 3143–3151. Cited by: §4.2, Table 3. [58] Z. Yuan, P. Zhou, K. Zou, and Y. Cheng (2023) You are catching my attention: are vision transformers bad learners under backdoor attacks?. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, p. 24605–24615. Cited by: §1, §1. [59] X. Zhang, X. Zhou, M. Lin, and J. Sun (2018) Shufflenet: an extremely efficient convolutional neural network for mobile devices. In Proceedings of the IEEE conference on computer vision and pattern recognition, p. 6848–6856. Cited by: §4.2.1. [60] X. Zhang, J. Wang, Y. Cheng, Q. Li, K. Sun, Y. Zheng, N. Zhang, and X. Li (2023) Interface-based side channel in tee-assisted networked services. IEEE/ACM Transactions on Networking 32 (1), p. 613–626. Cited by: §2. [61] Z. Zhang, Y. Cheng, D. Liu, S. Nepal, Z. Wang, and Y. Yarom (2020) Pthammer: cross-user-kernel-boundary rowhammer through implicit accesses. In 2020 53rd Annual IEEE/ACM International Symposium on Microarchitecture (MICRO), p. 28–41. Cited by: §1. [62] Y. Zhao, T. Pang, C. Du, X. Yang, C. Li, N. M. Cheung, and M. Lin (2023) On evaluating adversarial robustness of large vision-language models. Advances in Neural Information Processing Systems 36, p. 54111–54138. Cited by: §1. [63] M. Zheng, Q. Lou, and L. Jiang (2023) Trojvit: trojan insertion in vision transformers. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, p. 4025–4034. Cited by: §1. [64] C. Zhou, X. Shi, and Y. Wang (2025) Query-efficient hard-label black-box attack against vision transformers. Applied Soft Computing 183 (C). External Links: ISSN 1568-4946, Link, Document Cited by: Table 4. [65] X. Zhou, S. Kundu, D. Chen, J. Huang, and P. Beerel (2024) What makes vision transformers robust towards bit-flip attack?. In International Conference on Pattern Recognition, p. 424–438. Cited by: §1.