Convolutional neural networks (CNNs) have achieved tremendous success in solving complex classification problems. Motivated by this success, there have been proposed various compression methods for downsizing the CNNs to deploy them on resource-constrained embedded systems. However, a new type of vulnerability of compressed CNNs known as the adversarial examples has been discovered recently, which is critical for security-sensitive systems because the adversarial examples can cause malfunction of CNNs and can be crafted easily in many cases. In this paper, we proposed a compression framework to produce compressed CNNs robust against such adversarial examples. To achieve the goal, our framework uses both pruning and knowledge distillation with adversarial training. We formulate our framework as an optimization problem and provide a solution algorithm based on the proximal gradient method, which is more memory-efficient than the popular ADMM-based compression approaches. In experiments, we show that our framework can improve the trade-off between adversarial robustness and compression rate compared to the existing state-of-the-art adversarial pruning approach.

Model induction is one of the most popular methods to extract information to better understand AI’s decisions by estimating the contribution of input features for a class of interest. However, we found a potential issue: most model induction methods, especially those that compute class activation maps, rely on arbitrary thresholding to mute some of their computed attribution scores, which can cause the severe quality degradation of model induction. Therefore, we propose a new threshold fine-tuning (TFT) procedure to enhance the quality of input attribution based on model induction. Our TFT replaces arbitrary thresholding with an iterative procedure to find the optimal cut-off threshold value of input attribution scores using a new quality metric. Furthermore, to remove the burden of computing optimal threshold values on a per-input basis, we suggest an activation fine-tuning (AFT) framework using a tuner network attached to the original convolutional neural network (CNN), retraining the tuner-attached network with auxiliary data produced by TFT. The purpose of the tuner network is to make the activations of the original CNN less noisy and thus better suited for computing input attribution scores based on class activation maps from the activations. In our experiments, we show that the per-input optimal thresholding of attribution scores using TFT can significantly improve the quality of input attribution, and CNNs fine-tuned with our AFT can be used to produce improved input attribution matching the quality of TFT-tuned input attribution without requiring costly per-input threshold optimization.

Model stealing attacks pose an increasing threat to the confidentiality and intellectual property of artificial intelligence (AI) models. Existing defenses–such as query monitoring, output perturbation, multi-model output variation, and post hoc verification–fall short in on-device applications where models must run under strict memory and computation budgets. These approaches typically incur high memory or latency overhead due to their reliance on auxiliary models or additional inference-time processing. To address these limitations, we propose CERBEROS, a defense framework designed to achieve security against model stealing with deployability in resource-constrained environments. At its core, CERBEROS introduces a novel neural architecture with multiple classification heads trained jointly for output diversification, while sharing a single feature extraction backbone to minimize unnecessary memory usage. At inference, CERBEROS reveals the prediction of a randomly selected head, thereby misleading adversaries while preserving test accuracy for legitimate users, without requiring separate models or costly output modification. In addition, we integrate structured pruning into training to compress the backbone while retaining the classification heads. This ensures that functional diversity across heads remains achievable even under tight resource constraints. Our experiments show that CERBEROS effectively mitigates model replication attacks while consistently maintaining task performance across widely used convolutional neural networks and benchmark datasets. Furthermore, it achieves significant reductions in memory consumption and inference latency compared to prior defenses, offering a practical and efficient solution for securing on-device AI models.