Infrastructure, Configuration & Deployment Security · Edge & Distributed AI Security
Encrypt models packaged in apps
Verify that models packaged within mobile, IoT, or embedded applications are encrypted at rest, and decrypted only inside a trusted runtime or secure enclave, preventing direct extraction from the app package or filesystem.
OWASP AISVS v1.01, requirement 4.3.5
In plain English
A model packaged in an app can be copied straight out of the package unless you protect it. Encrypt packaged models and decrypt them only inside a trusted runtime or secure enclave. Be realistic about the limit: this raises the cost of extraction a great deal, and a well-resourced attacker with the device in hand may still succeed.
What good looks like
- Models in the app package or on the file system are encrypted.
- Decryption happens only inside a trusted runtime or enclave, with a hardware-held key.
- A test has tried to extract the model from the package and from the file system and failed.
- The key is delivered or unlocked only on devices that pass an integrity check.
How teams usually do it
- Model encryption features in the on-device framework (for example Core ML model encryption), with hardware-backed keys.
- Delivering the model or its key after install, once the device passes an attestation check such as Play Integrity or Apple App Attest.
- Keeping the most valuable part of the model on the server and shipping only a smaller part to the device.
Suggested evidence
- Results from an extraction attempt against the released app.
- The key delivery and decryption design.
Common mistakes
- Relying on code obfuscation or an unusual file name to hide the model.
- Decrypting the model to a temporary file on disk before loading it.
- Shipping the decryption key inside the same package.
Not sure which requirements apply to your system? Take the assessment, or browse every guide in this chapter.
Requirement text from the OWASP AI Security Verification Standard, licensed under CC BY-SA 4.0. This guidance is shared under the same licence.