When Rotation Bounds Nothing: Streaming Image Classifiers to Field Nodes Under Physical Capture

The gist The operator owns the node, and an adversary seizing it reads only what cold-boot capture finds resident; a chunkable multi-exit model streams into volatile memory, rotating to bound residency.

Threat Model

The threat model is characterized as a field-capture threat model, which is distinct from DRM because the defender owns the device and the adversary’s access begins only at seizure, inverting the DRM setting’s core assumptions of ownership, access, and time budget; this makes recovery a race against a bounded residency window. The setting involves a node where the operator owns and controls it, running an image classifier that streams into volatile memory each session while writing no weights to disk; the adversary physically seizes a node and recovers the prefix resident when the node leaves the operator’s service, on either side of detection.

Model Architecture and Streaming

The delivered model is characterized as a chunkable network with an ordered set of chunks c1,..., cn of cumulative on-wire size b1 < · · · < bn; after receiving the prefix c1... ck the device runs a valid forward pass with served accuracy ak, monotone in k. This is instantiated with a co-trained multi-exit backbone where exit k attaches a lightweight head to an intermediate stage, so a partial download yields a usable classifier and not a broken fragment. The system requires only the chunk interface (bk, ak)

Rotation and Residency Window

The operator rotates the served model with period R; on each rotation the device discards the resident model (whether or not the re-stream that follows can complete) and re-streams from c1, so a node holds at most one prefix at a time and its depth is set by how much the link delivered since the last rotation. A seizure at an arbitrary instant therefore recovers only the prefix resident in the current rotation, which is why the residency window R, and not the model’s total size, bounds what a seizure obtains. Rotation is a passive consequence of never persisting the model and refreshing it periodically; it is not a tamper-response or self-destruct mechanism, and no active erasure is triggered by the seizure itself.

Adversary Capabilities and Recovery Cost

The threat involves two adversaries: a passive one who uses the seized bytes as they are, and an adaptive one who reconstructs the withheld stages from a captured prefix and fine-tunes them, granted in-distribution labelled data up to the victim’s full training set and its exact training recipe, more than a field-capture adversary plausibly holds. The paper characterizes the resulting envelope on real LTE traces across two victim models of one architecture, against passive and adaptive adversaries. Against a from-scratch victim the uncaptured stages must be learned: the adaptive adversary gains most at shallow seizures, ends the CIFAR-10 envelope at every rotation, and stays rotation-bounded on CIFAR100, from 42.6% of usable seizures at 5 s to 86.8% at 30 s Against the same architecture sliced from a public pretrained backbone, the adversary downloads those stages, recovering ≥ 90% of maximum accuracy at all depths, taking usable CIFAR-100 seizures from 0.0% to 97.3% at 5 s, given the victim’s full labelled training set

Public Prior Impact

The public prior is measured by an adversary that initialises the withheld stages from the same public weights the defender started from, then fine-tunes exactly as before, recovers at least 90% of amax at every seizure depth on both datasets and takes the CIFAR-100 envelope from 0.0% to 97.3% at a 5 s rotation The public prior causes the collapse; the victim does not

Conclusion on Security Cost

Delivery-side secrecy raises a seizure’s price; a public copy of the withheld stages erases it Tightening the envelope charges the device instead The public prior is an initialisation, not an approximation: the victim’s fine-tuned stages sit at mean cosine 0.494 (CIFAR-10) and 0.361 (CIFAR-100) from public per output filter, 99.8% below 0.9, so the adversary relearns equally good weights rather than recovering the victim’s Delivery-side secrecy and public-backbone deployment are therefore incompatible, and withholding or obfuscating different stages does not repair it The paper concludes that when an image classifier is streamed into a field node’s volatile memory and never persisted, a physical seizure recovers only the prefix resident at that instant; the cost of recovering the rest depends on what that remainder is

Evaluation Summary

The evaluation compares two victim regimes: a from-scratch victim joint-trained end to end and a pretrained victim copying a torchvision ImageNet-1k ResNet-18 into stages 1–4 and fine-tuning them. The pretrained victim is the stronger model, as its accuracy rises from 0.9256 to 0.9428 on CIFAR-10 and from 0.6951 to 0.7726 on CIFAR-100 over the same payload, at no peak-accuracy cost The passive capture envelope collapses once the withheld stages have a public origin The analysis shows that the mobileNet frontier (from scratch) is not protectable at any rotation we test, with P(full)=0.826 at R=30 s even on the slower link, because that model arrives whole inside a single residency window The design’s security cost shows against its own monolithic baseline In the final analysis, the public prior causes the collapse; the victim does not The CIFAR-100 result requires the victim’s full 50,000-image labelled training set The public prior causes the collapse; the victim does not The CIFAR-10 is the collapse that survives a realistic data budget The public prior causes the collapse; the victim does not The CIFAR-10 is the collapse that survives a realistic data budget

Limitations

Several limitations bound the claims, including whether fine-tuned stages end far from their public origin (§V-E), yet that prior still carries an adversary to ≥90% of amax; and whether the CIFAR-100 collapse needs the victim’s full 50,000-image labelled training set and does not occur at 5000 samples The evaluation is CIFAR-scale image classification only, and covers no language or generative model The energy model is analytic, with the stated constants, rather than a measured power trace The P(full)=0 result holds on AT&T alone, up to R=60 s, and is weakened by the flat c4→c5 segment of the from-scratch frontier The paper concludes that when an image classifier is streamed into a field node’s volatile memory and never persisted, a physical seizure recovers only the prefix resident at that instant; the cost of recovering the rest depends on what that remainder is

References

[1] H. R. P, V. Srivastava, K. Chaurasia, R. G. Pacheco, and R. S. Couto, “Early-exit deep neural network — a comprehensive survey,” ACM Computing Surveys, vol 57 no 3 pp 75:1–75:40

[2] G. Huang, D. Chen, T. Li, F. Wu, L. van der Maaten, and K. Q. Weinberger, “Multi-scale dense networks for resource efficient image classification,” in International Conference on Learning Representations (ICLR), 2018

[3] J. A. Halderman, S. D. Schoen, N. Heninger, W. Clarkson, W. Paul, J. A. Calandrino, A. J. Feldman, J.

1. textbfField-Capture Threat Model Implementation: Transition from DRM to Seizure Race Detection. A field-capture threat model, distinct from DRM, assumes the defender owns the device and the adversary’s access begins only at seizure, which allows for security mechanisms focused on volatile memory residency rather than persistent disk protection. This enables systems to be designed where recovery becomes a race against a bounded residency window.

2. textbfAdaptive Adversary Resilience Training: Defeating Learned Stages in Field Seizures. To counter an adaptive adversary that reconstructs the withheld stages from a captured prefix and fine-tunes them, AI models can be trained against learned weights derived from public backbones to identify and mitigate gradient leakage during shallow seizures. This directly addresses the finding that the adaptive adversary gains most at shallow seizures.

3. textbfModel Chunking for Availability: Enabling Operational Inference Under Link Constraints. Implement a chunkable multi-exit model where the system runs from its first chunk and improves as bandwidth permits, ensuring the device remains operational even when faced with link stalls. This allows the system to serve at a usable depth based on available bytes, rather than failing entirely when a monolithic artifact that yields nothing until its last byte arrives cannot be served.

4. textbfRotation-Aware Seizure Budgeting: Dynamic Usability Thresholds Based on Link Dynamics. Instead of relying on static security bounds, the system should dynamically adjust its acceptable seizure threshold based on link conditions, as the paper shows the envelope is set by the product of link rate and rotation period, not rotation alone. This allows operators to trade accuracy for availability precisely when link capacity decreases.

5. textbfPublic Prior Collapse Mitigation: Utilizing Data Budget Constraints Against Prior-Based Attacks. To counter an adversary leveraging a public prior that relearn[s] equally good weights rather than recovering the victim’s, the system can implement a strict data budget cap, as shown in Section V-E, which limits the adversary's ability to exploit distant starting points. This ensures that even with public initialization, recovery remains bounded by practical training set sizes.

Field nodes run image classifiers locally, exposing a first-class asset, the trained model, to theft. Trusted-execution enclaves, collaborative-inference splits, and encrypted storage assume the device owner is the adversary from deployment. Here the operator owns the node, and an adversary seizing it reads only what cold-boot capture finds resident. One answer stores nothing: a chunkable multi-exit model streams into volatile memory, rotating to bound residency. We characterise the capture envelope on real LTE traces across two victims of one architecture, against passive and adaptive adversaries. Neither survives a capable adversary; recovery cost alone differs. Against a from-scratch victim the uncaptured stages must be learned: the adaptive adversary gains most at shallow seizures, ends the CIFAR-10 envelope at every rotation, and stays rotation-bounded on CIFAR100, from 42.6% of usable seizures at 5 s to 86.8% at 30 s. Against the same architecture sliced from a public pretrained backbone, the adversary downloads those stages, recovering at least 90% of maximum accuracy at all depths, taking usable CIFAR-100 seizures from 0.0% to 97.3% at 5 s, given the victim's full labelled training set. Delivery-side secrecy raises a seizure's price; a public copy of the withheld stages erases it.