Preprint

Machine-learning deployments face tight constraints on both privacy and performance when inference runs on edge devices or untrusted clouds, where input data and model weights are exposed to a broad attack surface. Trusted Execution Environments (TEEs) and model partitioning have traditionally been explored as separate avenues for securing inference. EnclaveSplit is a selective-partitioning method that integrates both, executing only the most sensitive computation of each model inside a hardware enclave while keeping the remainder in the normal world. Unlike prior single-platform approaches, EnclaveSplit is entirely portable across hardware—running on both ARM TrustZone and Intel SGX through a single unified Open Enclave SDK codebase. By isolating computation at the decision-level layers that recent inversion analysis identifies as a "Golden Partition Zone," EnclaveSplit requires no model retraining. Evaluated across five edge-AI workloads, EnclaveSplit provides attested, confidential execution with a mean latency overhead of ~12% relative to native execution.