## 1 Introduction
The SoC and device manufacturers securely provision cryptographic keys and other artifacts (1), establish attestation policies, and define claims, which are then stored in a shared database accessible to an authorized verifier (2). The ability to update ML models may vary by device type, with manufacturers potentially restricting updates or allowing user-initiated updates (3). A relying party initiates the device attestation process (4) and relies on a trusted verifier to assess the authenticity and integrity of the tokens. Depending on the architecture, the relying party may also analyze the token claims and decide whether the device is trustworthy, such as verifying whether the ML model meets specific criteria or if the device's state aligns with certain security requirements. This paper presents a dual attestation mechanism leveraging the concept of Entity Attestation Tokens (EATs) [18] and CBOR Object Signing and Encryption (COSE) [19] encoding. The approach utilizes two complementary tokens: one attesting to platform integrity via PSA initial attestation and another verifying the ML model's integrity and parameters. By decoupling the ML model attestation from the TEE, the system enhances resource efficiency and flexibility. The separation allows for more efficient use of computational resources and greater adaptability in managing various components, thereby fostering trust among different entities and networks. Existing attestation tokens primarily focus on platform integrity, leaving a gap in verifying the trustworthiness of ML models. This limitation is particularly evident in applications like federated learning systems with edge devices, where ensuring the integrity of the ML model is crucial. Additionally, allowing an edge device to join a network based on the model it uses requires a robust mechanism to attest to the model's authenticity and behavior. To address these challenges, we propose a set of claims and a token structure specifically designed for ML models. This approach enhances trustworthiness across various applications by providing a standardized method to attest to the integrity and behavior of ML models. We implement a prototype that provides an end-to-end security solution, leveraging a combination of RoT, secure boot, trusted execution environment, PSA initial attestation, and the proposed ML-EAT attestation. Deployed on an STM32H573I development board, the prototype is evaluated in terms of memory footprint, scalability, and attestation time to assess its effectiveness in ensuring both platform and ML model integrity, establishing trust across the system. The main contributions of this work are the following:  
* A novel, lightweight dual attestation mechanism that validates the integrity of both the device and the ML model, facilitating trust verification by a remote entity. * A new ML attestation token format based on EAT, containing claims that attest to both general ML use cases and sensitive ML parameters, such as architecture and weights. The paper is organized as follows: The related work is presented in Section 2. In Section 3, the background is provided, while in Section 4 our proposed attestation method for ML and its workflow is described. The overview of our methodology for the assessment  
Figure 1: Device attestation and involved entities: Soc Manufacturer, Device Manufacturer, Relying Party, Verifier, User. is given in Section 6. The results and discussion are presented in Section 7. Finally, the conclusion is drawn in Section 9.