Jiarui Li（李嘉锐）

Secure Inference Outsourcing for IoT Devices

As deep learning models become increasingly complex, executing inference locally on resource-constrained devices such as IoT sensors, drones, and embedded systems has become increasingly impractical. Offloading computation to nearby edge or cloud servers offers an attractive solution, but it also raises critical privacy concerns: the data used for inference often contains sensitive personal or contextual information, and transmitting it to an untrusted server may expose users to data leakage.

To address this problem, I introduced a practical framework for secure deep neural network inference outsourcing [1] that protects input confidentiality while maintaining real-time performance, without relying on heavy cryptographic tools such as homomorphic encryption or multiparty computation. The key insight is to separate neural computations into linear and nonlinear parts. Linear layers, such as convolutional and fully connected layers, dominate the computational cost and can be securely outsourced, while nonlinear activations remain local. This design leverages the algebraic linearity of neural networks to achieve both efficiency and privacy.

To realize this idea, I developed an interactive Privacy-Preserving Scalar Product (iPPSP) evaluation primitive that enables secure linear computation outsourcing using lightweight one-time-pad encryption. The protocol ensures confidentiality under standard cryptographic assumptions, requires minimal computation on the client side, and remains compatible with existing deep learning frameworks and GPU acceleration. This work was validated through extensive experiments using IoT devices such as Raspberry Pi boards and drones. Because the protocol relies only on linearity, it generalizes naturally to diverse neural architectures such as CNNs, RNNs, and transformers, making it broadly applicable to edge, IoT, and distributed learning settings.

Verifiable Federated Learning with TEE

Federated learning (FL) enables multiple participants to collaboratively train machine learning models without centralizing their raw data, offering a promising foundation for privacy-preserving analytics across organizations and devices. However, by keeping training local, FL trades data confidentiality for a new vulnerability: integrity violations. Malicious or lazy participants can submit falsified model updates without performing proper training, degrading model quality and undermining trust. This risk is amplified in cross-silo and IoT deployments, where devices operate under heterogeneous conditions and may not be fully trusted. My research addresses this issue by leveraging Trusted Execution Environments (TEEs) to provide verifiable training integrity and computational efficiency under a zero-trust assumption.

Integrity Verification for Federated Learning

To ensure the integrity of training participants in federated learning, I use TEEs to design a sampling-based retraining verification protocol [2]. The solution randomly selects a subset of training rounds to be reproduced inside a TEE, allowing the server to verify whether participants executed legitimate training on their committed data.

The framework also incorporates secure offloading techniques from my previous work. In particular, I introduce a partial training offloading scheme that allows secure enclaves to offload linear operations to co-located GPUs, protected by lightweight one-time-pad encryption and pseudorandom permutation. This design significantly improves scalability by eliminating the need to perform the entire training process within TEEs. In addition, the framework does not require every participant to possess a TEE because only the verifier operates within a trusted environment. This flexibility broadens its applicability to large-scale and heterogeneous federated learning deployments.

Accumulator-Based Integrity Verification for Federated Learning

Building on sampling-based retraining and secure offloading, I further improve integrity assurance by eliminating the need for retraining [3]. I design a lightweight accumulator that records cryptographic commitments to intermediate gradients throughout the local training process. Instead of retraining, the verifier checks whether these accumulators are consistent with the submitted local model updates.

This commitment-based mechanism significantly reduces computational overhead while maintaining verifiable correctness. By combining TEE-assisted attestation with cryptographic accumulation, the framework achieves efficient, privacy-preserving verification suitable for resource-constrained and sensitive domains such as healthcare.