Google just dropped Gemma 4. E2B and E4B bring frontier intelligence to phones and IoT devices.

That is exciting for obvious reasons. Stronger on-device AI promises lower latency, offline use, lower serving cost, and better privacy by keeping computation local.

But there is a less discussed side to this shift: once the model is shipped to the device, it may become accessible to anyone.

No server breach needed.
No API key needed.
Sometimes all an attacker needs is the app itself.

That creates a very different security problem, and that is exactly what my research focuses on.

I work on on-device AI security, and I am putting together a series of posts on questions like:

• what attacks become possible once models are deployed locally,
• how model behavior can be manipulated after deployment,
• how developers can protect model IP on device,
• and why these issues become more urgent as stronger models like Gemma 4 move onto end-user devices.

On-device AI is clearly growing fast. My view is that its security has not caught up yet.

If people here are interested, I’d be happy to share the research and discuss the biggest open problems in securing on-device AI.

Some of my work in this area:

• Adversarial Attacks on DL Models in Android Apps (ICSE 2021)
• Smart App Attack: Hacking DL Models in Android Apps (IEEE TIFS 2022)
• THEMIS: Towards Practical IP Protection for Post-Deployment On-Device DL Models (USENIX Security 2025)
• Typhon Unleashed: Practical Adversarial Weight Attacks against On-Device DL Models (IEEE TDSC 2026)