Amulet: On-device AI safe without slowing down?

Imagine having a powerful AI model right on your smartphone. Handy, but risky: if a hacker extracts the model's "weights" (its brain), they can steal or tamper with it. Until now, the fix was locking everything in a digital vault called a TEE (Trusted Execution Environment). The catch? The vault has tiny memory. The model had to be sliced and shuffled in and out constantly: a massive slowdown, up to 100x slower.

Enter Amulet, a new framework just posted on arXiv. The trick is clever: inside the vault (TEE), the model gets "scrambled" with mathematical obfuscation techniques. The transformed model becomes unreadable to a thief but runs perfectly on the phone's GPU. So it sits in normal memory—fast and spacious. Each inference needs only two lightning-fast trips to the vault: input in, output out.

Security? Backed by theoretical proof: the obfuscation leaks zero information about the original weights. Speed? Only 2.8-4.8x slower than an unprotected model, versus orders of magnitude for old methods. Tested on diverse architectures from ResNet-18 to GPT-2, Amulet beats the current state-of-the-art by 2.2x. On-device AI finally becomes both safe and snappy.

Amulet addresses the memory-performance bottleneck of TEEs (e.g., ARM TrustZone, Intel SGX) on edge devices. The classic "partition-and-load" approach suffers from context-switch overhead (world switches) and limited secure/non-secure bus bandwidth. Amulet shifts the paradigm: it obfuscates weights W into W' = O(W, K) inside the TEE using keys K derived from hardware PUFs or TRNGs. The operation O is designed to be homomorphic w.r.t. inference: f(W', x) = f(W, x) for any input x, enabling direct execution on untrusted accelerators (GPU/NPU).

Obfuscation techniques include: structured channel/filter permutation (preserving topology), calibrated Gaussian noise addition canceled by subsequent normalization layers, and linear weight masking. Information-theoretic security relies on I(W; W' | K) = 0: given W', the conditional entropy of W remains maximal without K. K never leaves the TEE.

Benchmarks: ResNet-18 (CIFAR-100), MobileNetV2, BERT-base, GPT-2. Latency overhead: 2.8x (CNN) - 4.8x (Transformer) vs unprotected baseline. Speedup 8-9x vs full-TEE execution (partitioning). Speedup 2.2x vs HETEE / ModelObfuscator (SOTA obfuscation). Accuracy drop < 0.5%. TEE memory overhead: constant O(1) vs O(Model Size).