Puf-based convolutional neural network model intellectual property protection method
By using arbitrated physically non-clonable functions and datasets for training on field-programmable gate arrays, the parameters of convolutional neural network models are mixed and recovered, solving the problems of easy model theft and key leakage, and realizing intellectual property protection in specific environments.
Patent Information
- Authority / Receiving Office
- CN · China
- Patent Type
- Patents(China)
- Current Assignee / Owner
- BEIHANG UNIV
- Filing Date
- 2022-09-20
- Publication Date
- 2026-07-03
AI Technical Summary
Existing methods for protecting the intellectual property rights of convolutional neural network models running in cloud environments and field-programmable gate arrays are vulnerable to theft and key leakage, and cannot effectively guarantee the security of model parameters.
Arbitration of physically unclonable functions is implemented using field-programmable gate arrays (FPGAs). A convolutional neural network is trained using real and pseudo datasets. Model parameters are mixed using a pre-defined obfuscation algorithm and a recovery algorithm. A recovery layer that depends on the response of the physically unclonable function is added to the model, so that the model can only compute the correct result when running on a specific FPGA.
It achieves intellectual property protection before the model is stolen, avoids the need for key storage and trusted execution environment, and improves the security and uniqueness of model parameters.
Smart Images
Figure CN115545154B_ABST
Abstract
Description
Technical Field
[0001] This application relates to the field of artificial intelligence technology, and in particular to a method for protecting intellectual property rights of a PUF-based convolutional neural network model. Background Technology
[0002] The most direct way to protect the intellectual property rights of Convolutional Neural Network (CNN) models running in cloud environments is to embed watermarks in the models. When a model is stolen, the trainer can verify the watermark to claim ownership. However, because the parameters of the watermarked model are different from the original model, the watermark is very easy to detect. Moreover, this method only works when the model owner defends their rights after the model has been stolen, and it cannot guarantee that the model will not be stolen in the first place.
[0003] For CNN models that rely on computing accelerators and run on Field-Programmable Gate Arrays (FPGAs), there are currently many methods for protecting intellectual property rights. These include pay-per-device methods based on physically unclonable functions (PUFs), efficient schemes for intelligent key distribution authentication based on smart public key infrastructures and edge computing, and methods that embed keys stored in a secure and trusted environment into the model training process. However, these methods cannot completely guarantee the security of model parameters, and if thieves collude with accelerator vendors, they can easily obtain the correct model. Furthermore, the keys used in these methods are at risk of being leaked. Summary of the Invention
[0004] This application provides a method, apparatus, electronic device, and storage medium for protecting the intellectual property rights of convolutional neural network models based on PUF. By using PUF for the IP protection of CNN models, the IP protection work is moved from after the model is stolen to before it is stolen.
[0005] The first aspect of this application provides a method for protecting intellectual property rights of a convolutional neural network model based on PUF, comprising the following steps: implementing an arbitration physically unclonable function using a field-programmable gate array (FPGA) to obtain a unique fingerprint of the FPGA; training convolutional neural networks using a real dataset and a pseudo dataset respectively to obtain a real convolutional neural network model and a pseudo convolutional neural network model; mixing the parameters of the same layer of the real convolutional neural network model and the pseudo convolutional neural network model using a preset obfuscation algorithm based on the response of the arbitration physically unclonable function to obtain a final convolutional neural network model; generating a recovery matrix using a recovery algorithm based on the response of the arbitration physically unclonable function, and multiplying the recovery matrix by the obfuscation layer matrix in the final convolutional neural network model to obtain the calculation result of the final convolutional neural network model.
[0006] Optionally, in one embodiment of this application, the implementation of the arbitrated physically unclonable function using a field-programmable gate array (FPGA) includes: designing an arbitrated physically unclonable function circuit of a preset size on the FPGA to provide a unique fingerprint for the FPGA, so that the final convolutional neural network model outputs the correct result only when it runs on the FPGA.
[0007] Optionally, in one embodiment of this application, the true convolutional neural network model and the pseudo convolutional neural network model have the same structure.
[0008] Optionally, in one embodiment of this application, the step of mixing the parameters of the same layer of the true convolutional neural network model and the pseudo convolutional neural network model using a preset obfuscation algorithm based on the response of the arbitral physical non-cloning function includes: when the response bit of the arbitral physical non-cloning function is 1, the parameters of the obfuscation matrix in the preset obfuscation algorithm are the parameters of the true convolutional neural network model; otherwise, the parameters of the obfuscation matrix in the preset obfuscation algorithm are the parameters of the pseudo convolutional neural network model.
[0009] The second aspect of this application provides an intellectual property protection device for a PUF-based convolutional neural network model, comprising: a design module for implementing an arbitration physically unclonable function using a field-programmable gate array (FPGA) to obtain a unique fingerprint of the FPGA; a training module for training convolutional neural networks using a real dataset and a pseudo dataset respectively to obtain a real convolutional neural network model and a pseudo convolutional neural network model; a confusion module for mixing the parameters of the same layer of the real convolutional neural network model and the pseudo convolutional neural network model according to the response of the arbitration physically unclonable function using a preset confusion algorithm to obtain a final convolutional neural network model; and a recovery module for generating a recovery matrix according to the response of the arbitration physically unclonable function using a recovery algorithm, multiplying the recovery matrix with the matrix of the confusion layer in the final convolutional neural network model to obtain the calculation result of the final convolutional neural network model.
[0010] Optionally, in one embodiment of this application, the implementation of the arbitrated physically unclonable function using a field-programmable gate array (FPGA) includes: designing an arbitrated physically unclonable function circuit of a preset size on the FPGA to provide a unique fingerprint for the FPGA, so that the final convolutional neural network model outputs the correct result only when it runs on the FPGA.
[0011] Optionally, in one embodiment of this application, the true convolutional neural network model and the pseudo convolutional neural network model have the same structure.
[0012] Optionally, in one embodiment of this application, the obfuscation module is further configured such that, when the response bit of the arbitral physical non-cloning function is 1, the parameters of the obfuscation matrix in the preset obfuscation algorithm are the parameters of the true convolutional neural network model; otherwise, the parameters of the obfuscation matrix in the preset obfuscation algorithm are the parameters of the pseudo convolutional neural network model.
[0013] A third aspect of this application provides an electronic device, including: a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the program to perform the intellectual property protection method for a PUF-based convolutional neural network model as described in the above embodiments.
[0014] A fourth aspect of this application provides a computer-readable storage medium having a computer program stored thereon, which is executed by a processor to perform the intellectual property protection method for a PUF-based convolutional neural network model as described in the above embodiments.
[0015] This application discloses a method, apparatus, electronic device, and storage medium for protecting the intellectual property rights of convolutional neural network models based on PUF (Physically Unclonable Function). It implements physically unclonable functions on a field-programmable gate array (FPGA), providing a unique fingerprint bound to a specific FPGA. A convolutional neural network model is trained using real and pseudo datasets respectively to obtain a real model and a pseudo model. An obfuscation algorithm is executed to utilize the physically unclonable function's response to mix two parameter matrices in the same layer of the real and pseudo models. After obfuscation, a recovery convolutional layer dependent on the physically unclonable function's response is added to the model, ensuring that the correct result is only computed when the convolutional neural network model is run on a specific FPGA. Thus, by using physically unclonable functions for the IP protection of convolutional neural network models, the IP protection process is moved from after the model is stolen to before it is stolen. The application of physically unclonable functions eliminates the need for storing keys and building a trusted execution environment for IP protection, and fine-tuning the model structure can be applied to other convolutional neural network models embedded in FPGAs.
[0016] Additional aspects and advantages of this application will be set forth in part in the description which follows, and in part will be obvious from the description, or may be learned by practice of this application. Attached Figure Description
[0017] The above and / or additional aspects and advantages of this application will become apparent and readily understood from the following description of the embodiments taken in conjunction with the accompanying drawings, wherein:
[0018] Figure 1 This is a flowchart illustrating a method for protecting intellectual property rights of a PUF-based convolutional neural network model according to an embodiment of this application.
[0019] Figure 2 This is a schematic diagram of an obfuscation algorithm provided according to an embodiment of this application;
[0020] Figure 3 This is a schematic diagram of a CNN model structure before and after obfuscation according to an embodiment of this application;
[0021] Figure 4 According to an embodiment of this application, an accuracy comparison diagram is provided for the original model, a model obfuscated and running on a real FPGA, and a model obfuscated and running on a fake FPGA.
[0022] Figure 5 A schematic diagram of prediction accuracy results provided in an embodiment of this application;
[0023] Figure 6 This is an example diagram of an intellectual property protection device for a PUF-based convolutional neural network model according to an embodiment of this application;
[0024] Figure 7 A schematic diagram of the structure of the electronic device provided in the application embodiment. Detailed Implementation
[0025] The embodiments of this application are described in detail below. Examples of these embodiments are shown in the accompanying drawings, wherein the same or similar reference numerals denote the same or similar elements or elements having the same or similar functions throughout. The embodiments described below with reference to the accompanying drawings are exemplary and intended to explain this application, and should not be construed as limiting this application.
[0026] Specifically, Figure 1 This is a flowchart illustrating a method for protecting intellectual property rights of a PUF-based convolutional neural network model, according to an embodiment of this application.
[0027] like Figure 1 As shown, the intellectual property protection method for this PUF-based convolutional neural network model includes the following steps:
[0028] In step S101, the arbitration physical unclonable function is implemented using a field-programmable gate array (FPGA) to obtain the unique fingerprint of the FPGA.
[0029] This application provides a method for binding a CNN model to a specific FPGA so that the CNN model can only obtain correct results when it runs on the specific FPGA. First, an APUF is implemented on the FPGA to obtain the unique fingerprint of the FPGA.
[0030] Optionally, in one embodiment of this application, the arbitration physically unclonable function is implemented using a field-programmable gate array (FPGA), including: designing an arbitration physically unclonable function circuit of a preset size on the FPGA to provide a unique fingerprint for the FPGA, so that the final convolutional neural network model outputs the correct result only when it runs on the FPGA.
[0031] Specifically, the implementation of APUF includes: implementing a 64×1 APUF on the FPGA, with 64-bit input and 1-bit output, providing a unique fingerprint for the FPGA to obfuscate model parameters and bind the model to a specific FPGA, so that the correct result will only be calculated when the model is run on that FPGA.
[0032] Due to the unpredictability of PUF, even when using the same challenge and running PUF on FPGAs from the same production batch, the responses from different FPGAs will be completely different. Therefore, even if the input challenge of PUF is exposed, as long as the PUF circuit is kept secret, an adversary will not be able to obtain the correct response.
[0033] By replicating each PUF circuit and splicing their outputs together, a response of arbitrary length can be obtained.
[0034] As a specific example, a classic CNN face classification model can be implemented on a PC. The model is approximately 274MB in size and contains 3 convolutional layers and 1 fully connected layer.
[0035] In step S102, convolutional neural networks are trained using real datasets and pseudo datasets respectively to obtain real convolutional neural network models and pseudo convolutional neural network models.
[0036] Optionally, in one embodiment of this application, the true convolutional neural network model and the pseudo convolutional neural network model have the same structure.
[0037] In step S103, based on the response of the arbitrated physical non-cloning function, the parameters of the same layer of the true convolutional neural network model and the pseudo convolutional neural network model are mixed using a preset confusion algorithm to obtain the final convolutional neural network model.
[0038] Optionally, in one embodiment of this application, based on the response of the arbitrated physical non-cloning function, the parameters of the same layer of the true convolutional neural network model and the pseudo convolutional neural network model are mixed using a preset obfuscation algorithm, including:
[0039] When the response bit of the arbitrated physical non-cloning function is 1, the parameters of the confusion matrix in the preset confusion algorithm are the parameters of the true convolutional neural network model; otherwise, the parameters of the confusion matrix in the preset confusion algorithm are the parameters of the pseudo convolutional neural network model.
[0040] Specifically, an obfuscation layer is added to the model, utilizing... Figure 2 The obfuscation algorithm shown mixes the two parameter matrices of the same layer of the real and pseudo models based on the APUF response.
[0041] The obfuscation algorithm includes: mixing the parameters of the same layer in the real and pseudo models: w correct b correct w fake b fake And the PUF response value input algorithm.
[0042] Define `correct_index` and `fake_index` as initial values of 1, `n` as the initial value of the length of the response, and `w` as the initial value of the response. con [n] and b con The initial value of [n] is 0.
[0043] For each i between 1 and n, repeat the following operation:
[0044] If responsei If it equals 1, then w correct [correct_index] is assigned to w con [i], b correct [correct_index] is assigned to b con [i], assign correct_index+1 to correct_index; if response i If it is not equal to 1, then w fale [fale_index] is assigned to w con [i], b fake [fake_index] is assigned to b con [i], assign fake_index+1 to fake_index.
[0045] The algorithm outputs the obfuscation parameter w. con and b con .
[0046] When the PUF response bit is 1, the parameters of the confusion matrix are those of the true model; otherwise, the parameters of the confusion matrix are those of the pseudo model. For example... Figure 2 As shown, when the PUF response is 101100, the parameters in the first, third, and fourth rows of the confusion matrix come from the true model, while the parameters in the second, fifth, and sixth rows come from the pseudo model.
[0047] It should be noted that PUFresponse101100 in this embodiment is a randomly obtained parameter. It is a randomly generated value and has no limiting effect. In actual applications, it can be adjusted according to the actual situation.
[0048] In step S103, based on the response of the arbitrated physical non-cloning function, a recovery matrix is generated using a recovery algorithm. The recovery matrix is then multiplied with the matrix of the confusion layer in the final convolutional neural network model to obtain the calculation result of the final convolutional neural network model.
[0049] A recovery layer is added to the model, and a recovery algorithm is used to generate a recovery matrix based on the APUF response.
[0050] The recovery algorithm includes:
[0051] The algorithm input is the output y of the confusion layer in the model. con And the PUF response value.
[0052] Define rec_index with an initial value of 1, n with an initial value of the length of the response, and M. rec The initial value of [n / 2][n] is 0.
[0053] For each i between 1 and n, repeat the following operation: if the response i If M equals 1, then let M fec If [rec_index][i] equals 1, then assign rec_index + 1 to rec_index.
[0054] Let y rec Equal to M rec ×y con .
[0055] Algorithm output recovery layer output y rec .
[0056] A recovery layer is added after the confusion layer, which is considered to be a convolutional layer of the model, with a kernel size of 1×1.
[0057] like Figure 3 As shown, multiplying the confusion layer output by the recovery matrix yields the correct result.
[0058] The prediction accuracy of the original model, the obfuscated model running on a correct FPGA, and the obfuscated model running on an incorrect FPGA is evaluated. For each obfuscated or unobfuscated combination, 10 random responses are selected as inputs to the obfuscated model to obtain the model's prediction accuracy, and their average is calculated. At least one layer should be obfuscated, so there are only 15 results.
[0059] like Figure 4 As shown, regardless of whether there are ambiguities, the accuracy of the model running with the correct response is always similar to that of the original model, but with the wrong response as input, the accuracy is always less than 4.0%, averaging about 2.0%, at which point the model cannot function properly.
[0060] Figure 4 The X-axis indicates whether the model's layers are obfuscated. For example, "0001" means that only the parameters of the fully connected layers are obfuscated, and "1010" means that the parameters of the first and third convolutional layers are obfuscated.
[0061] It should be noted that the execution subject in this embodiment is any CNN model. The CNN model with 3 convolutional layers and 1 fully connected layer mentioned here is not a limitation and can be adjusted according to the actual situation in practical applications.
[0062] Environmental changes can alter the APUF response, and the model's accuracy varies as the Hamming distance (HD) between the random and correct responses decreases. HD represents the similarity between two strings and is calculated as follows:
[0063]
[0064] The model's accuracy is evaluated as HD decreases. The fully connected layer of the aforementioned CNN model is obfuscated for testing; the output of the fully connected layer is the probability that the input image belongs to a certain class. Let n = 138 be the response length, and the obfuscated model's output be an n-row matrix.
[0065] It should be noted that n in this embodiment is a parameter obtained in actual operation. It is a value generated by the operation and has no limiting effect. In actual application, it can be adjusted according to the actual situation.
[0066] Construct random responses and continuously change the HD of the random responses and the correct responses from 2 to n. Use random responses with different HDs as input to the model and evaluate the model using the same dataset.
[0067] like Figure 5 As shown, the x-axis is The y-axis represents the model's prediction accuracy when a random response is substituted into the model. When the random response shares 90% of its positions with the correct response, the model's prediction accuracy is still less than 5%. When the random response shares 97% of its positions with the correct response, the model's prediction accuracy is 31.9%.
[0068] The probability that the opponent receives a random response with a 97% chance of having the same digit is:
[0069]
[0070] When n is greater than 64, this probability can be ignored.
[0071] When the random response differs from the correct response by only two bits, the model's prediction accuracy is 93.1%. The confused model is not affected by response errors.
[0072] The intellectual property protection method for convolutional neural network models based on PUF proposed in this application implements a physically unclonable function (PUF) on a field-programmable gate array (FPGA), providing a unique fingerprint bound to a specific FPGA. A convolutional neural network model is trained using a real dataset and a pseudo dataset to obtain a real model and a pseudo model, respectively. An obfuscation algorithm is executed to utilize the PUF response to mix two parameter matrices in the same layer of the real and pseudo models. After obfuscation, a recovery convolutional layer dependent on the PUF response is added to the model, ensuring that the correct result is only computed when the convolutional neural network model is run on a specific FPGA. Thus, by using the PUF for IP protection of convolutional neural network models, IP protection is moved from after the model is stolen to before it is stolen. The application of the PUF eliminates the need for storing keys and building a trusted execution environment for IP protection, and fine-tuning of the model structure can be applied to other convolutional neural network models embedded in FPGAs.
[0073] Next, referring to the accompanying drawings, we describe the intellectual property protection device for a PUF-based convolutional neural network model according to an embodiment of this application.
[0074] Figure 6 This is an example diagram of an intellectual property protection device for a PUF-based convolutional neural network model according to an embodiment of this application.
[0075] like Figure 6 As shown, the intellectual property protection device 10 for the PUF-based convolutional neural network model includes: a design module 100, a training module 200, a confusion module 300, and a recovery module 400.
[0076] The system comprises the following modules: a design module 100, which implements an arbitration physically unclonable function using a field-programmable gate array (FPGA) to obtain the unique fingerprint of the FPGA; a training module 200, which trains convolutional neural networks (CNNs) using real and pseudo datasets respectively to obtain a real CNN model and a pseudo CNN model; a confusion module 300, which mixes the parameters of the same layer of the real CNN model and the pseudo CNN model using a preset confusion algorithm based on the response of the arbitration physically unclonable function to obtain the final CNN model; and a recovery module 400, which generates a recovery matrix using a recovery algorithm based on the response of the arbitration physically unclonable function, and multiplies the recovery matrix with the confusion layer matrix in the final CNN model to obtain the calculation result of the final CNN model.
[0077] Optionally, in one embodiment of this application, the arbitration physically unclonable function is implemented using a field-programmable gate array (FPGA), including: designing an arbitration physically unclonable function circuit of a preset size on the FPGA to provide a unique fingerprint for the FPGA, so that the final convolutional neural network model outputs the correct result only when it runs on the FPGA.
[0078] Optionally, in one embodiment of this application, the true convolutional neural network model and the pseudo convolutional neural network model have the same structure.
[0079] Optionally, in one embodiment of this application, the obfuscation module 300 is further configured to, when the response bit of the arbitrated physical unclonable function is 1, use the parameters of the obfuscation matrix in the preset obfuscation algorithm as the parameters of the true convolutional neural network model; otherwise, use the parameters of the obfuscation matrix in the preset obfuscation algorithm as the parameters of the pseudo convolutional neural network model.
[0080] It should be noted that the foregoing explanation of the embodiment of the intellectual property protection method for PUF-based convolutional neural network models also applies to the intellectual property protection device for PUF-based convolutional neural network models in this embodiment, and will not be repeated here.
[0081] The intellectual property protection device for convolutional neural network models based on PUF proposed in this application implements a physically unclonable function (PUF) on a field-programmable gate array (FPGA), providing a unique fingerprint bound to a specific FPGA. A convolutional neural network model is trained using a real dataset and a pseudo dataset to obtain a real model and a pseudo model, respectively. An obfuscation algorithm is executed to utilize the PUF response to mix two parameter matrices in the same layer of the real and pseudo models. After obfuscation, a recovery convolutional layer dependent on the PUF response is added to the model, ensuring that the correct result is only computed when the convolutional neural network model is run on a specific FPGA. Thus, by using the PUF for IP protection of convolutional neural network models, IP protection is moved from after the model is stolen to before it is stolen. The application of the PUF eliminates the need for storing keys and building a trusted execution environment for IP protection, and fine-tuning of the model structure can be applied to other convolutional neural network models embedded in FPGAs.
[0082] Figure 7 A schematic diagram of the structure of an electronic device provided in an embodiment of this application. The electronic device may include:
[0083] The memory 701, the processor 702, and the computer program stored on the memory 701 and executable on the processor 702.
[0084] When the processor 702 executes the program, it implements the intellectual property protection method for the PUF-based convolutional neural network model provided in the above embodiments.
[0085] Furthermore, electronic devices also include:
[0086] Communication interface 703 is used for communication between memory 701 and processor 702.
[0087] The memory 701 is used to store computer programs that can run on the processor 702.
[0088] The memory 701 may include high-speed RAM memory, and may also include non-volatile memory, such as at least one disk storage device.
[0089] If the memory 701, processor 702, and communication interface 703 are implemented independently, then the communication interface 703, memory 701, and processor 702 can be interconnected via a bus to complete communication between them. The bus can be an Industry Standard Architecture (ISA) bus, a Peripheral Component Interconnect (PCI) bus, or an Extended Industry Standard Architecture (EISA) bus, etc. Buses can be categorized as address buses, data buses, control buses, etc. For ease of representation, Figure 7 The bus is represented by a single thick line, but this does not mean that there is only one bus or one type of bus.
[0090] Optionally, in a specific implementation, if the memory 701, processor 702, and communication interface 703 are integrated on a single chip, then the memory 701, processor 702, and communication interface 703 can communicate with each other through an internal interface.
[0091] The processor 702 may be a central processing unit (CPU), an application specific integrated circuit (ASIC), or one or more integrated circuits configured to implement the embodiments of this application.
[0092] This embodiment also provides a computer-readable storage medium storing a computer program thereon, characterized in that the program, when executed by a processor, implements the above-described intellectual property protection method for a PUF-based convolutional neural network model.
[0093] In the description of this specification, the references to terms such as "one embodiment," "some embodiments," "example," "specific example," or "some examples," etc., indicate that a specific feature, structure, material, or characteristic described in connection with that embodiment or example is included in at least one embodiment or example of this application. In this specification, the illustrative expressions of the above terms do not necessarily refer to the same embodiment or example. Furthermore, the specific features, structures, materials, or characteristics described may be combined in any suitable manner in one or more embodiments or examples. Moreover, without contradiction, those skilled in the art can combine and integrate the different embodiments or examples described in this specification, as well as the features of different embodiments or examples.
[0094] Furthermore, the terms "first" and "second" are used for descriptive purposes only and should not be construed as indicating or implying relative importance or implicitly specifying the number of technical features indicated. Thus, a feature defined as "first" or "second" may explicitly or implicitly include at least one of that feature. In the description of this application, "N" means at least two, such as two, three, etc., unless otherwise explicitly specified.
[0095] Any process or method described in the flowchart or otherwise herein can be understood as representing a module, segment, or portion of code comprising one or more N executable instructions for implementing custom logic functions or processes, and the scope of the preferred embodiments of this application includes additional implementations in which functions may be performed not in the order shown or discussed, including substantially simultaneously or in reverse order depending on the functions involved, as should be understood by those skilled in the art to which embodiments of this application pertain.
[0096] It should be understood that the various parts of this application can be implemented using hardware, software, firmware, or a combination thereof. In the above embodiments, the N steps or methods can be implemented using software or firmware stored in memory and executed by a suitable instruction execution system. For example, if implemented in hardware as in another embodiment, it can be implemented using any one or a combination of the following techniques known in the art: discrete logic circuits having logic gates for implementing logical functions on data signals, application-specific integrated circuits (ASICs) having suitable combinational logic gates, programmable gate arrays (PGAs), field-programmable gate arrays (FPGAs), etc.
[0097] Those skilled in the art will understand that all or part of the steps of the methods in the above embodiments can be implemented by a program instructing related hardware. The program can be stored in a computer-readable storage medium, and when executed, the program includes one or a combination of the steps of the method embodiments.
Claims
1. A PUF-based convolutional neural network model intellectual property protection method, characterized in that, Includes the following steps: Implementing a physically unclonable arbitration function using a field-programmable gate array (FPGA) and obtaining a unique fingerprint of the FPGA, wherein implementing the physically unclonable arbitration function using the FPGA includes: Arbitration physical non-cloning function circuits of a preset size are designed on the field-programmable gate array (FPGA) to provide a unique fingerprint for the FPGA, so that the final convolutional neural network model outputs the correct result only when it runs on the FPGA. Convolutional neural networks were trained using real and pseudo datasets respectively to obtain real convolutional neural network models and pseudo convolutional neural network models; Based on the response of the arbitration physical non-cloning function, the parameters of the same layer of the true convolutional neural network model and the pseudo convolutional neural network model are mixed using a preset confusion algorithm to obtain the final convolutional neural network model. Based on the response of the arbitration physical non-cloning function, a recovery matrix is generated using a recovery algorithm. The recovery matrix is then multiplied by the matrix of the confusion layer in the final convolutional neural network model to obtain the calculation result of the final convolutional neural network model. A recovery layer is added after the confusion layer, which is considered as a convolutional layer of the model. Based on the response of the arbitrated physical non-cloning function, a recovery matrix is generated using the recovery algorithm. The output of the confusion layer is multiplied by the recovery matrix to obtain the correct result.
2. The method according to claim 1, characterized in that, The true convolutional neural network model and the pseudo convolutional neural network model have the same structure.
3. The method of claim 1, wherein, The step of mixing the parameters of the same layer of the true convolutional neural network model and the pseudo convolutional neural network model using a preset obfuscation algorithm based on the response of the arbitration physical non-cloning function includes: When the response bit of the arbitration physical non-cloning function is 1, the parameters of the confusion matrix in the preset confusion algorithm are the parameters of the true convolutional neural network model; otherwise, the parameters of the confusion matrix in the preset confusion algorithm are the parameters of the pseudo convolutional neural network model.
4. An intellectual property protection device for a PUF-based convolutional neural network model, characterized in that, include: The design module is used to implement an arbitration physically unclonable function using a field-programmable gate array (FPGA) and obtain a unique fingerprint of the FPGA. The implementation of the arbitration physically unclonable function using the FPGA includes: Arbitration physical non-cloning function circuits of a preset size are designed on the field-programmable gate array (FPGA) to provide a unique fingerprint for the FPGA, so that the final convolutional neural network model outputs the correct result only when it runs on the FPGA. The training module is used to train convolutional neural networks using real and pseudo datasets respectively, to obtain real convolutional neural network models and pseudo convolutional neural network models. The obfuscation module is used to mix the parameters of the same layer of the true convolutional neural network model and the pseudo convolutional neural network model according to the response of the arbitration physical unclonable function, using a preset obfuscation algorithm to obtain the final convolutional neural network model. The recovery module is used to generate a recovery matrix based on the response of the arbitration physical non-cloning function using a recovery algorithm, and multiply the recovery matrix with the matrix of the confusion layer in the final convolutional neural network model to obtain the calculation result of the final convolutional neural network model. A recovery layer is added after the confusion layer, which is considered as a convolutional layer of the model. Based on the response of the arbitrated physical non-cloning function, a recovery matrix is generated using the recovery algorithm. The output of the confusion layer is multiplied by the recovery matrix to obtain the correct result.
5. The apparatus according to claim 4, characterized in that, The true convolutional neural network model and the pseudo convolutional neural network model have the same structure.
6. The apparatus according to claim 4, characterized in that, The obfuscation module is further used for, When the response bit of the arbitration physical non-cloning function is 1, the parameters of the confusion matrix in the preset confusion algorithm are the parameters of the true convolutional neural network model; otherwise, the parameters of the confusion matrix in the preset confusion algorithm are the parameters of the pseudo convolutional neural network model.
7. An electronic device, characterized in that, include: A memory, a processor, and a computer program stored in the memory and executable on the processor, the processor executing the program to implement the intellectual property protection method for a PUF-based convolutional neural network model as described in any one of claims 1-3.
8. A computer-readable storage medium having a computer program stored thereon, characterized in that, The program is executed by the processor to implement the intellectual property protection method for PUF-based convolutional neural network models as described in any one of claims 1-3.