## 1 Introduction  
Embedded edge devices play a vital role in daily life, supporting tasks like environmental monitoring, remote appliance control, security, health tracking, and smart home automation with minimal user involvement. Advances in CPU architectures, hardware design, and artificial intelligence (AI) have enhanced TinyML (Tiny Machine Learning), enabling resource-limited devices such as microcontrollers to perform machine learning (ML) inference at the network edge. By monitoring parameters like temperature, humidity, and sensors, these devices facilitate applications such as fault detection in wind turbines [1] and gas leak detection [2] using ML algorithms. Edge devices running unprotected ML models pose risks to systems that rely on their prediction outputs. TinyML systems are particularly vulnerable to attacks like model flashing and malicious updates, while advanced threats such as model inversion are less common due to resource limitations [3]. To address these challenges, stakeholders are improving security standards. The Confidential Computing Consortium defines confidential computing as using hardware-based Trusted Execution Environments (TEEs) to protect data during use, ensuring confidentiality, data integrity, and code integrity [4]. Resource-constrained devices increasingly incorporate features like tamper protection, true random number generators, secure storage, secure boot, and roots of trust, which are already utilized in low-power applications such as environmental monitoring [5]. Hardware-based TEEs leverage these technologies to provide secure enclaves for sensitive computations, ensuring protection even in the presence of physical attacks or compromised software. System-on-chip (SoC) vendors implement various isolation mechanisms, such as CPU access isolation or encrypted memory isolation, with solutions like Intel SGX [6] and AMD SEV [7] targeting cloud-based applications, while ARM TrustZone [8] and RISC-V PMP [9] are optimized for edge devices, providing a balance between security and energy efficiency. Additionally, device attestation, when implemented within a TEE, offers a strong security solution [10]. Attestation verifies the authenticity and integrity of the TEE, ensuring that sensitive computations occur only on trusted devices. The Remote Attestation Procedures (RATS) defined by the Internet Engineering Task Force (IETF) [11] provide a standardized approach to validate the integrity and authenticity of remote devices. RATS specify components such as the Attester, Verifier, and Relying Party, with attestation tokens serving as authenticated claims about the device's state. Several open-source TEE solutions, such as the ARM Confidential Compute Architecture (CCA) [12] and TrustedFirmware-M [13], align with the Platform Security Architecture (PSA) guidelines, offering well-defined structures for attestation tokens. Vendor-specific solutions such as Silicon Labs' Secure Engine Manager [14] and STM Microelectronics' Secure Manager [15] generate PSA attestation tokens signed with hardware-specific keys. In addition to the TEE attestation, a verifier may also need to prove the authenticity of the ML model running on the device, for example, to ensure the system operates correctly and securely [16] or to confirm that a device is capable of participating in collaborative training, such as in federated learning and can safely exchange trained model weights [17]. However, to support standardized attestation for TinyML models, ML attestation tokens should be independent of the TEE attestation process. This separation ensures that TEE tokens focus solely on verifying the hardware platform, while the trustworthiness of the ML model is attested individually. Figure 1 illustrates a conceptual data flow of device attestation and the actors involved based on RATS specification.