  Performing deep learning on end-user devices provides fast offline inference
results and can help protect the user's privacy. However, running models on
untrusted client devices reveals model information which may be proprietary,
i.e., the operating system or other applications on end-user devices may be
manipulated to copy and redistribute this information, infringing on the model
provider's intellectual property. We propose the use of ARM TrustZone, a
hardware-based security feature present in most phones, to confidentially run a
proprietary model on an untrusted end-user device. We explore the limitations
and design challenges of using TrustZone and examine potential approaches for
confidential deep learning within this environment. Of particular interest is
providing robust protection of proprietary model information while minimizing
total performance overhead.
