Lightweight Security-by-Design for TinyML Models in Constrained Embedded Environments

Abstract

TinyML models now run inference directly on microcontrollers with only kilobytes of memory, inside sensors, wearables, and industrial devices that often have no cloud link and no way to receive a patch once deployed. This makes them an easy target, since compressed models resist adversarial and extraction attacks less than full-precision models, but most TinyML research still treats security as a step added after compression rather than during it. This paper proposes a three-layer security-by-design architecture built to close that gap. The first layer scores candidate compressed models on a joint fitness function that combines clean accuracy, adversarial robustness, and model size before the final architecture is fixed. The second layer signs and verifies model weights with the lightweight ASCON cipher at boot and during over-the-air updates. The third layer is a runtime monitor that computes a live distribution-drift score on incoming queries and raises local defense strength once that score crosses a fixed threshold, without needing a cloud round trip. The full pipeline was validated on real microcontroller hardware, not simulation, and stays inside a 62 KB RAM budget with inference latency under 10 ms. Against real baseline models on Edge-IIoTset, the proposed method reaches 94.3% accuracy, the highest of the models tested, while cutting attack success rate from over 60–84% down to 38.9% and raising the query cost for model extraction more than five times over the weakest baseline. An ablation study and a five-seed statistical test confirm the gain holds and comes from the combination of all three layers, not from any single part.