  Trusted Execution Environments (TEEs) have become a promising solution to
secure DNN models on edge devices. However, the existing solutions either
provide inadequate protection or introduce large performance overhead. Taking
both security and performance into consideration, this paper presents TBNet, a
TEE-based defense framework that protects DNN model from a neural architectural
perspective. Specifically, TBNet generates a novel Two-Branch substitution
model, to respectively exploit (1) the computational resources in the untrusted
Rich Execution Environment (REE) for latency reduction and (2) the
physically-isolated TEE for model protection. Experimental results on a
Raspberry Pi across diverse DNN model architectures and datasets demonstrate
that TBNet achieves efficient model protection at a low cost.
