MACO: Model Anti-extraction via Compiler Obfuscation

Deep neural networks (DNNs) are widely deployed across applications, but growing model sizes and performance demands on edge devices necessitate aggressive compiler-based acceleration, as enabled by frameworks like TVM. Compiling models into standalone executables, however, introduces new security risks, reverse-engineering these binaries can reveal core architectures and enable unauthorized model cloning or tampering. Existing defenses largely rely on trusted execution or encryption, which target weight confidentiality but fail to protect architectural details or operator attributes, often with high runtime costs. To address these gaps, we propose MACO, a multi-tier obfuscation framework built atop TVM, spanning high-level graph rewriting and low-level IR transformations. MACO integrates three transformation categories: operator attribute obfuscation, memory layout perturbation, and dummy branching, covering the full compilation stack. A tiered design enables flexible trade-offs between security and performance. We evaluate MACO on eight common models and three attack types: side-channel, symbolic execution, and deep learning–based extraction. Results show up to 85.8% reduction in attribute inference success and 99% reduction in topology reconstruction, with the lightest tier incurring only 1.036× overhead over the unobfuscated baseline.