PUF-based convolutional neural network model intellectual property protection method

Abstract

The invention relates to the technical field of model protection, in particular to a convolutional neural network model intellectual property protection method based on PUF. The method comprises the following steps of: acquiring a PUF original response by using a hardware interface so as to obtain a PUF feature vector; using the PUF feature vector to initialize parameters of a convolutional neural network model, and after model training is completed, embedding a PUF signature in the model parameters; before model reasoning, the model is activated through the PUF verification module, an embedded PUF signature is extracted from activated model parameters, the extracted signature is compared with PUF original response, attribution of the model is verified, and after verification succeeds, the PUF verification module encrypts input and output data through a generated secret key. According to the method, confrontation attacks in the traditional sense can be prevented, the model can be protected against threats of other types, and the method has good expandability and adaptability and is suitable for various different application scenes and technical environments.

Description

Technical Field

[0001] The present invention relates to the technical field of model protection, and in particular to a method for protecting the intellectual property rights of a convolutional neural network model based on PUF. Background Art

[0002] With the rapid development of artificial intelligence (AI) and machine learning (ML) technologies, deep learning models such as convolutional neural networks (CNNs) have been widely used in various fields. However, the value of these models is not only reflected in their performance, but also in the huge training data sets, complex architecture design, and the knowledge wealth accumulated during the long training process. Therefore, how to effectively protect the intellectual property rights of these models and prevent them from being illegally copied, tampered with, or misappropriated has become a major challenge of common concern to academia and industry.

[0003] In the IoT environment, secure communication between devices is crucial. To solve this problem, PUF can be used to generate unique device identifiers, which can be verified by CNN models. By combining PUF with CNN, a CNN model that can recognize legitimate PUF response patterns can be trained before device deployment. When a device attempts to access the network, it sends its own PUF response to the server, and the CNN model on the server is responsible for verifying whether the response comes from a legitimate device. This method not only prevents unauthorized devices from accessing the network, but also protects the CNN model itself from reverse engineering. However, existing convolutional neural network models are vulnerable to adversarial sample attacks, which mislead the model to make incorrect predictions by adding small perturbations to the input data. Therefore, a PUF-based convolutional neural network model intellectual property protection method is designed. Summary of the invention

[0004] The purpose of the present invention is to provide a PUF-based convolutional neural network model intellectual property protection method to solve the problem that the convolutional neural network model proposed in the above background technology is vulnerable to adversarial sample attacks.

[0005] To achieve the above object, the present invention aims to provide a method for protecting intellectual property rights of a convolutional neural network model based on PUF, comprising the following steps: S1. Select the structure of the convolutional neural network model according to the task requirements and determine the initial hierarchical structure of the convolutional neural network model; S2. Select hardware for generating PUF based on the physical characteristics of the device, use the hardware interface to collect the PUF original response, and convert the collected PUF original response into a challenge-response pair in digital form as input, thereby obtaining the PUF feature vector, and introduce feature enhancement for optimization in the process of obtaining the feature vector; S3. Use the PUF feature vector to initialize the parameters of the convolutional neural network model, and in the process of training the convolutional neural network model, introduce weight perturbation based on the PUF feature vector to improve the security of the convolutional neural network model. In the process of introducing weight perturbation, the influence of attack type and intensity is introduced for optimization. After the convolutional neural network model is trained, the PUF signature is embedded in the model parameters. S4. Before the convolutional neural network model is inferred, the convolutional neural network model is activated through the PUF verification module, the embedded PUF signature is extracted from the activated convolutional neural network model parameters, and the extracted signature is compared with the PUF original response to verify the ownership of the convolutional neural network model. After successful verification, the PUF verification module uses the generated key to encrypt the input and output data, and finally updates the hierarchical structure of the convolutional neural network model.

[0006] As a further improvement of the present technical solution, the initial hierarchical structure of the convolutional neural network model determined in S1 is based on the number of layers of the network, the number of neurons in each layer, and the design of the output layer.

[0007] As a further improvement of the technical solution, the physical characteristics of the device in S2 include the initial state of the SRAM unit, the frequency difference of the ring oscillator, and the manufacturing deviation of the silicon process.

[0008] As a further improvement of the technical solution, in S2, the original response of the collected PUF is converted into a challenge-response pair in digital form as input, so as to obtain a PUF feature vector, as follows: Preprocessing stage: ; in, is the PUF response vector after ECC processing; for error correction coding operations; To meet the challenges PUF response; ; in, is the normalized PUF response vector; ; in, is the PUF feature vector; is a hash function.

[0009] As a further improvement of the technical solution, in S2, feature enhancement is introduced to optimize the process of obtaining the feature vector, and the optimization is as follows: Feature Enhancements: ; in, is the PUF feature vector after multi-level encoding operation; It is a multi-level encoding operation; ; in, is the PUF feature vector after convolution operation; is the convolution operation; is the convolution kernel parameter matrix; is the step length; ; in, is the PUF feature vector after frequency domain analysis; It is a frequency domain analysis operation; Improved hash function: ; in, is the optimized PUF feature vector.

[0010] As a further improvement of the technical solution, in S3, the parameters of the convolutional neural network model are initialized using the PUF feature vector, and in the process of training the convolutional neural network model, weight perturbation is introduced based on the PUF feature vector to improve the security of the convolutional neural network model. The specific steps are as follows: S31, initial weight initialization: ; in, is the initial weight matrix of the model; is the mapping function; S32. Find the optimal perturbation vector by maximizing the loss function: ; in, To maximize the loss function; represents the loss function; is the current model parameter; To control the size of the disturbance; For the original samples; For the The true label corresponding to the original sample; ; is the sample size; Requirements: ; ; in, is the optimal weight perturbation vector; is the mixing coefficient; is the standard perturbation vector; S33, Useful Update model parameters: ; in, are the updated model parameters; is the learning rate; With updated parameters Back-propagate the adversarial samples and finally update the model weights: ; in, is the final updated model parameter; is the learning rate during back propagation; is the loss function About all model parameters The gradient of To pass the original sample Adversarial examples generated by adding small perturbations.

[0011] As a further improvement of the technical solution, in S3, the influence of attack type and intensity is introduced in the process of introducing weight disturbance for optimization, and the optimization is as follows: ; in, is the optimized optimal weight perturbation vector; Depends on the attack type parameter The mixing coefficient of is dependent on the maximum disturbance amplitude Then adjust the disturbance vector Function of intensity; but: ; in, are the updated model parameters; With updated parameters Back-propagate the adversarial samples and finally update the model weights: ; in, are the final optimized model parameters.

[0012] As a further improvement of the present technical solution, in S4, the convolutional neural network model is activated through the PUF verification module, specifically: the PUF feature vector of the current hardware is extracted, and matched with the PUF feature vector bound to the convolutional neural network model, and the convolutional neural network model is activated after the match is successful.

[0013] As a further improvement of the present technical solution, in S4, if the extracted signature matches the original response of the PUF, the system will continue to execute the reasoning task; if the extracted signature does not match the original response of the PUF, indicating that the convolutional neural network model has been tampered with or comes from an unauthorized source, the reasoning task is stopped.

[0014] As a further improvement of the present technical solution, the hierarchical structure obtained by updating the convolutional neural network model in S4 is specifically as follows: the number of network layers is selected based on task requirements, security requirements and the spatial dimension of PUF response characteristics; the number of neurons in each layer is determined based on PUF feature mapping and perturbation range; the design of the output layer includes encryption mechanism integration and PUF signature verification interface.

[0015] Compared with the prior art, the present invention has the following beneficial effects: 1. In the PUF-based convolutional neural network model intellectual property protection method, compared with traditional software encryption schemes, the hardware-level security of the PUF module is stronger. PUF uses the unpredictability and uniqueness of hardware to make hardware-based intellectual property protection more reliable. Even if the attacker masters the model's code and encryption algorithm, it becomes very difficult to crack it because the PUF itself cannot be copied or predicted.

[0016] 2. In the PUF-based convolutional neural network model intellectual property protection method, the influence of attack type and intensity is introduced for optimization during the process of introducing weight perturbations. This can not only prevent adversarial attacks in the traditional sense, but also help protect the model from other types of threats. It has good scalability and adaptability and is suitable for a variety of different application scenarios and technical environments. BRIEF DESCRIPTION OF THE DRAWINGS

[0017] Figure 1 The figure is a flow chart of the overall method of the present invention. DETAILED DESCRIPTION

[0018] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0019] See also Figure 1 As shown, a PUF-based convolutional neural network model intellectual property protection method is provided, including the following steps: S1. Select the structure of the convolutional neural network model according to the task requirements and determine the initial hierarchical structure of the convolutional neural network model; The initial hierarchical structure of the convolutional neural network model determined in S1 is based on the number of layers in the network, the number of neurons in each layer, and the design of the output layer; S2. Select hardware for generating PUF based on the physical characteristics of the device, use the hardware interface to collect the PUF original response, and convert the collected PUF original response into a challenge-response pair in digital form as input, thereby obtaining the PUF feature vector, and introduce feature enhancement for optimization in the process of obtaining the feature vector; The physical characteristics of the devices in S2 include the initial state of the SRAM cells, the frequency differences of the ring oscillator, and the manufacturing deviations of the silicon process; In S2, the original response of the collected PUF is converted into a challenge-response pair in digital form as input, thereby obtaining a PUF feature vector, as follows: Preprocessing stage: ; in, is the PUF response vector after ECC processing, which is more stable and reliable than the original response; for error correction coding operations; To meet the challenges PUF response; ; in, is the normalized PUF response vector; ; in, is the PUF feature vector; is a hash function used to map the original response into a higher-dimensional space to form the final PUF feature ; In S2, feature enhancement is introduced for optimization in the process of obtaining feature vectors. After optimization, the specific results are as follows: Feature Enhancements: ; in, is the PUF feature vector after multi-level encoding operation; It is a multi-level encoding operation; ; in, is the PUF feature vector after convolution operation; is the convolution operation; is the convolution kernel parameter matrix; is the step length; ; in, is the PUF feature vector after frequency domain analysis; It is a frequency domain analysis operation; Improved hash function: ; in, is the optimized PUF feature vector; This generates a unique and difficult-to-copy digital fingerprint for each CNN model, ensuring that only authorized devices can use specific model instances. At the same time, due to the use of complex feature enhancement technology, even in the face of highly similar PUF responses, significantly different feature representations can be produced, greatly increasing the difficulty of forgery or tampering. In addition, frequency domain analysis further increases the randomness and unpredictability of feature vectors, enhancing the security and robustness of the system. Therefore, this approach not only effectively protects the intellectual property rights of the model, but also provides a solid foundation for building a more trusted artificial intelligence ecosystem.

[0020] S3. Use the PUF feature vector to initialize the parameters of the convolutional neural network model, and in the process of training the convolutional neural network model, introduce weight perturbations based on the PUF feature vectors to improve the security of the convolutional neural network model (embed watermarks). In the process of introducing weight perturbations, the influence of attack types and strengths is introduced for optimization. After the convolutional neural network model is trained, the PUF signature is embedded in the model parameters. Specifically, the one-time key generated by the PUF is used to encrypt the model parameters, and the encrypted parameters are saved as the PUF signature. This signature actually represents part of the PUF response, or is the result obtained by applying a hash function to the PUF response. This can give each model instance a unique identifier without affecting the performance of the model; In S3, the PUF feature vector is used to initialize the parameters of the convolutional neural network model. In the process of training the convolutional neural network model, weight perturbation is introduced based on the PUF feature vector to improve the security of the convolutional neural network model. The specific steps are as follows: S31, initial weight initialization: ; in, is the initial weight matrix of the model; The mapping function converts the PUF feature vector into a form suitable for initializing the network weights. This process can be as simple as using the PUF feature directly as part of the weight, or more complex by further processing through some encoding mechanism (such as hash function, random projection, etc.); S32. Find the optimal perturbation vector by maximizing the loss function: Weight perturbations, especially adversarial weight perturbations (AWP), are introduced during the training process to ensure that the model not only performs well on normal data, but also resists the threats posed by maliciously constructed input samples. The goal of AWP is to find the worst-case weight perturbation in each iteration. , making the model more robust. Specifically, for a given batch of training data : ; in, To maximize the loss function; represents the loss function, which is used to measure the difference between the model prediction output and the true label; are the current model parameters, i.e., all learnable weights and biases in the network; To control the size of the perturbation, the maximum perturbation range allowed is defined, which helps prevent over-adjustment of model parameters while ensuring that the perturbation is small and reasonable; For the original samples; For the The true label corresponding to the original sample; ; is the sample size; Requirements: ; This means that when looking for the optimal solution, the vector The norm of must be less than or equal to the given threshold In other words, this condition limits the perturbation size, ensuring that it is not too large, thus keeping the disturbance small and reasonable.

[0021] In order to combine the PUF feature vector with AWP, an additional step can be added before each weight update, that is, fine-tuning the perturbation direction according to the latest PUF feature vector. This means that we will use the PUF feature to guide the selection of perturbations, rather than being completely random or relying only on gradient information. The specific expression can be written as: ; in, is the optimal weight perturbation vector; is the mixing coefficient, which is used to balance the influence of PUF features; is a standard perturbation vector; the unique identifier provided by PUF can be used to increase the diversity and unpredictability of the perturbation, thereby improving the performance of the model when facing unknown attacks; S33, Useful Update model parameters: ; in, are the updated model parameters; is the learning rate, controlling the step size; the updated temporary model parameters are updated by adding a perturbation vector scaled by To the original parameters As can be seen from the above, this step simulates a "worse" situation, allowing the model to learn to resist such perturbations.

[0022] With updated parameters Back-propagate the adversarial samples and finally update the model weights: ; in, is the final updated model parameter; is the learning rate during back propagation, which is used to control the speed of updating model parameters during the back propagation process of adversarial samples. Different because they act on different stages; is the loss function About all model parameters The gradient of To pass the original sample Add adversarial examples generated by small perturbations; The specific process is: Find the worst-case perturbation: For a given batch of training data , we hope to find a perturbation , which can maximize the loss function , but at the same time ensure that the norm of the disturbance does not exceed This is a constrained optimization problem, which can usually be solved by projected gradient ascent or other similar methods; Apply perturbations and create adversarial examples: Once we find a suitable , multiply it by the learning rate And add to the existing model parameters On, get the temporary parameters These temporary parameters are then used to generate adversarial examples. ; Backpropagation and updating the model: using adversarial examples and its tags To calculate the loss function relative to The gradient of , and use this gradient according to the learning rate Update the model parameters and finally obtain the new model parameters .

[0023] This strategy not only prevents traditional adversarial attacks, but also helps protect the model from other types of threats, such as model stealing attacks, because even if the attacker obtains the model structure and weights, they cannot replicate the same perturbation pattern due to the presence of PUF features. In addition, this method has good scalability and adaptability, and is suitable for a variety of different application scenarios and technical environments.

[0024] In S3, the influence of attack type and intensity is introduced in the process of introducing weight perturbation for optimization. After optimization, the specific results are: ; in, is the optimized optimal weight perturbation vector; Depends on the attack type parameter The mixing coefficient of is dependent on the maximum disturbance amplitude Then adjust the disturbance vector Function of intensity; Is a parameter that depends on the attack type The mixing coefficient is γ ∈[0,1] Indicates the degree from completely unknown (black box attack) to completely known (white box attack). When , it indicates that it is close to the black box attack scenario. Should be small, which means that the effect of PUF feature vector is weakened; on the contrary, when When , it indicates that it is close to the white box attack scenario. Larger, the influence of PUF feature vector increases; This function is used to adjust the adversarial weight perturbation vector The intensity of the disturbance depends on the maximum permissible disturbance amplitude. For a given , The mapping relationship can be linear or nonlinear, and the purpose is to ensure that the generated adversarial examples can effectively change the model decision without causing obvious visual changes or other abnormal performance. For example, in some cases, even if If the perturbation is small, we hope that it is influential enough to trigger the model to misclassify; in other cases, we may need to keep the perturbation level low to avoid being detected; According to the attacker's knowledge level of the target model, we can divide the attack into three main types: white-box attack, gray-box attack, and black-box attack. In the optimized formula, by adjusting , which can make the perturbation strategy better adapt to different types of attack scenarios: White-box attack: In this case, the attacker has complete information about the target model and can use this to construct more sophisticated and targeted perturbations. Should be large to take advantage of the additional layer of security provided by the PUF feature; Gray box attack: between white box and black box, the attacker partially understands the model structure or parameters. It can be set to an intermediate value, which not only retains a certain proportion of PUF feature contribution but also takes into account the limited knowledge of the attacker; Black box attack: The attacker can only observe the input and output pairs, lacking internal structure information. It should be smaller, relying more on widely applicable adversarial weight perturbation methods, while reducing the risk of overfitting that may result from overuse of PUF features.

[0025] The attack strength is determined by the maximum perturbation amplitude allowed. , which directly affects whether the perturbation can successfully mislead the model without causing suspicion. In order to balance this relationship, we introduce function, which can be based on specific The value dynamically adjusts the strength of the adversarial weight perturbation: when When smaller, The effect of adversarial weight perturbations needs to be amplified to ensure that even small perturbations have a significant impact on the model. This can be achieved by increasing The value of is achieved to make the disturbance sharper, but at the same time, care should be taken to avoid causing too obvious visual differences; if Larger, It can be reduced appropriately, allowing the disturbance to work over a larger range, but still maintain a level that is not easily detected. Doing so helps increase the success rate of the attack while also reducing the risk of being discovered.

[0026] In summary, by introducing and With these two new variables, we can make the perturbation generation process more intelligent and adaptive, taking into account not only the different requirements of attack types, but also the specific requirements of attack intensity. Such optimization measures not only improve the effectiveness and concealment of perturbations, but also provide better security protection for practical applications.

[0027] but: ; in, are the updated model parameters; With updated parameters Back-propagate the adversarial samples and finally update the model weights: ; in, are the final optimized model parameters; S4. Before the convolutional neural network model is inferred, the convolutional neural network model is activated through the PUF verification module, the embedded PUF signature is extracted from the activated convolutional neural network model parameters, and the extracted signature is compared with the PUF original response to verify the ownership of the convolutional neural network model. After successful verification, the PUF verification module uses the generated key to encrypt the input and output data. All input data to be sent to the CNN model will be encrypted using the above-generated key, and finally the hierarchical structure of the convolutional neural network model is updated; In S4, the convolutional neural network model is activated through the PUF verification module. Only devices with the correct PUF can run inference. Specifically, the PUF feature vector of the current device is extracted and matched with the PUF feature vector bound to the convolutional neural network model. After the match is successful, the convolutional neural network model is activated.

[0028] In S4, if the extracted signature matches the original PUF response, it means that the convolutional neural network model was distributed to the device through a legitimate channel, and the system will continue to perform the inference task; if the extracted signature does not match the original PUF response, it indicates that the convolutional neural network model has been tampered with or comes from an unauthorized source, and the inference task is stopped. This additional verification step helps prevent problems such as model piracy and illegal copying, and also makes it possible to track the model's propagation path.

[0029] The hierarchical structure obtained by updating the convolutional neural network model in S4 is as follows: the number of network layers is selected based on task requirements, security requirements, and the spatial dimensions of the PUF response features; in addition to considering the complexity of the task itself and the required data processing capabilities, security requirements must also be evaluated. For application scenarios that require high protection, the network depth can be appropriately increased to accommodate more PUF feature embedding points; since the PUF response features will become part of the initialization weights, the number of network layers should also be selected to take into account the spatial dimensions of these feature vectors so that each layer is allocated enough information for initialization and perturbation. The number of neurons in each layer is determined based on the PUF feature map and the perturbation range; The number of neurons in each layer should be large enough to ensure that the PUF response characteristics can be fully mapped to the network parameters. This means that each layer should have enough degrees of freedom to receive unique inputs from the PUF, and these inputs will not lose important information due to over-compression; in order to achieve effective weight perturbations, the number of neurons in each layer should be allowed to vary to a certain extent, without affecting the overall performance and introducing enough randomness to improve security. This usually means that the hidden layer will have more or fewer nodes than the traditional setting, depending on how the PUF characteristics are applied; the design of the output layer includes the integration of encryption mechanisms and PUF signature verification interfaces; the output layer is not only responsible for generating the final prediction results, but may also take on the task of encrypted transmission. In this case, the design of the output layer must support key generation and data encryption functions, such as using a specific activation function or adding an additional layer to encode the output value; in order to verify the identity of the model, the output layer may contain a special module to extract and compare the PUF signature. This process can be completed in the inference stage to ensure that only legitimate users can obtain the correct output.

[0030] Finally, consider that PUF can be used not only to generate keys, but also as a means of dynamically adjusting model parameters. For example, some studies have proposed a secure branch predictor design based on PUF, which can provide the ability to resist Spectre attacks without affecting performance. Similarly, here we can imagine a mechanism in which PUF is not only used to activate the model, but also affects the selection of certain weights within the model or the behavior of the activation function, thereby achieving more flexible and difficult to copy model hierarchy updates.

[0031] The above shows and describes the basic principles, main features and advantages of the present invention. Those skilled in the art should understand that the present invention is not limited by the above embodiments, and the above embodiments and descriptions are only preferred examples of the present invention, and are not intended to limit the present invention. Without departing from the spirit and scope of the present invention, the present invention may have various changes and improvements, and these changes and improvements all fall within the scope of the present invention to be protected.

Claims

1. A method for protecting intellectual property rights of a convolutional neural network model based on PUF, characterized in that: The steps include: S1. Select the structure of the convolutional neural network model according to the task requirements and determine the initial hierarchical structure of the convolutional neural network model; S2. Select hardware for generating PUF based on the physical characteristics of the device, use the hardware interface to collect the PUF original response, and convert the collected PUF original response into a challenge-response pair in digital form as input, thereby obtaining the PUF feature vector, and introduce feature enhancement for optimization in the process of obtaining the feature vector; S3. Use the PUF feature vector to initialize the parameters of the convolutional neural network model, and in the process of training the convolutional neural network model, introduce weight perturbation based on the PUF feature vector to improve the security of the convolutional neural network model. In the process of introducing weight perturbation, the influence of attack type and intensity is introduced for optimization. After the convolutional neural network model is trained, the PUF signature is embedded in the model parameters. S4. Before the convolutional neural network model is inferred, the convolutional neural network model is activated through the PUF verification module, the embedded PUF signature is extracted from the activated convolutional neural network model parameters, and the extracted signature is compared with the PUF original response to verify the ownership of the convolutional neural network model. After successful verification, the PUF verification module uses the generated key to encrypt the input and output data, and finally updates the hierarchical structure of the convolutional neural network model.

2. The intellectual property protection method of the convolutional neural network model based on PUF according to claim 1 is characterized in that: The initial hierarchical structure of the convolutional neural network model determined in S1 is based on the number of layers of the network, the number of neurons in each layer, and the design of the output layer.

3. The intellectual property protection method of the PUF-based convolutional neural network model according to claim 2, characterized in that: The physical characteristics of the device in S2 include the initial state of the SRAM cell, the frequency difference of the ring oscillator, and the manufacturing deviation of the silicon process.

4. The intellectual property protection method of the PUF-based convolutional neural network model according to claim 3 is characterized in that: In S2, the original response of the collected PUF is converted into a challenge-response pair in digital form as input, thereby obtaining a PUF feature vector, as follows: Preprocessing stage: ； in, is the PUF response vector after ECC processing; for error correction coding operations; To meet the challenges PUF response; ； in, is the normalized PUF response vector; ； in, is the PUF feature vector; is a hash function.

5. The intellectual property protection method of the PUF-based convolutional neural network model according to claim 4 is characterized in that: In S2, feature enhancement is introduced to optimize the process of obtaining the feature vector, and the optimization is as follows: Feature Enhancements: ； in, is the PUF feature vector after multi-level encoding operation; It is a multi-level encoding operation; ； in, is the PUF feature vector after convolution operation; is the convolution operation; is the convolution kernel parameter matrix; is the step length; ； in, is the PUF feature vector after frequency domain analysis; It is a frequency domain analysis operation; Improved hash function: ； in, is the optimized PUF feature vector.

6. The intellectual property protection method of the PUF-based convolutional neural network model according to claim 5, characterized in that: In S3, the parameters of the convolutional neural network model are initialized using the PUF feature vector, and in the process of training the convolutional neural network model, weight perturbation is introduced based on the PUF feature vector to improve the security of the convolutional neural network model. The specific steps are as follows: S31, initial weight initialization: ； in, is the initial weight matrix of the model; is the mapping function; S32. Find the optimal perturbation vector by maximizing the loss function: ； in, To maximize the loss function; represents the loss function; is the current model parameter; To control the size of the disturbance; For the original samples; For the The true label corresponding to the original sample; ; is the sample size; Requirements: ; ； in, is the optimal weight perturbation vector; is the mixing coefficient; is the standard perturbation vector; S33, Useful Update model parameters: ； in, are the updated model parameters; is the learning rate; With updated parameters Back-propagate the adversarial samples and finally update the model weights: ； in, is the final updated model parameter; is the learning rate during back propagation; is the loss function About all model parameters The gradient of To pass the original sample Adversarial examples generated by adding small perturbations.

7. The intellectual property protection method of the PUF-based convolutional neural network model according to claim 6, characterized in that: In S3, the influence of attack type and intensity is introduced in the process of introducing weight disturbance for optimization. After optimization, the specific results are: ； in, is the optimized optimal weight perturbation vector; Depends on the attack type parameter The mixing coefficient of is dependent on the maximum disturbance amplitude Then adjust the disturbance vector Function of intensity; but: ； in, are the updated model parameters; With updated parameters Back-propagate the adversarial samples and finally update the model weights: ； in, are the final optimized model parameters.

8. The PUF-based convolutional neural network model intellectual property protection method according to claim 7, characterized in that: In S4, the convolutional neural network model is activated through the PUF verification module, specifically: the PUF feature vector of the current hardware is extracted, and matched with the PUF feature vector bound to the convolutional neural network model, and the convolutional neural network model is activated after the match is successful.

9. The intellectual property protection method of the PUF-based convolutional neural network model according to claim 8, characterized in that: In S4, if the extracted signature matches the original PUF response, the system will continue to execute the reasoning task; if the extracted signature does not match the original PUF response, indicating that the convolutional neural network model has been tampered with or comes from an unauthorized source, the reasoning task is stopped.

10. The intellectual property protection method of the PUF-based convolutional neural network model according to claim 9, characterized in that: The hierarchical structure obtained by updating the convolutional neural network model in S4 is specifically as follows: the number of network layers is selected based on task requirements, security requirements and the spatial dimension of PUF response characteristics; the number of neurons in each layer is determined based on PUF feature mapping and perturbation range; the design of the output layer includes encryption mechanism integration and PUF signature verification interface.

Images