Intellectual Property Protection Method for FPGA-Accelerated Deep Neural Networks Based on PUF and Keyless Storage

Abstract

This application provides a method for protecting intellectual property rights of FPGA-accelerated deep neural networks based on PUF and keyless storage, solving the technical problems of high resource consumption and poor versatility in existing intellectual property protection methods. It includes: the supplier obtaining the PUF response of the target FPGA; generating a keystream based on the PUF response; encrypting the original model parameters of the original model using mixed symbol and amplitude masking to obtain encrypted model parameters; the end user writing the encrypted model parameters into the target FPGA; for licensed target FPGAs, the PUF generates a response in real time and recovers the keystream; the model parameters are dynamically decrypted during inference operations, achieving hardware binding without key storage and outputting inference results consistent with the original model; for unlicensed target FPGAs, the response generated by the internal PUF cannot recover the keystream, model parameter decryption fails, and inference output becomes invalid. This application can be widely applied in the field of intellectual property protection technology.

Description

Technical Field

[0001] This application belongs to the field of intellectual property protection technology, and more specifically, it relates to an intellectual property protection method for FPGA-accelerated deep neural networks based on PUF and keyless storage. Background Technology

[0002] Over the past decade, deep neural networks (DNNs) have developed rapidly and been widely applied in key areas such as autonomous driving and precision medicine. As applications migrate to the edge, FPGAs, with their advantages of flexibility, low power consumption, and low latency, have become an important platform for deploying high-value DNN models. Because the development of high-quality DNN models requires a large amount of data, expertise, and computing resources, they themselves have become significant intellectual property. DNN models deployed on FPGAs face severe intellectual property security threats: attackers can reverse engineer FPGA configurations to steal accelerator architectures and implant hardware malware, and can also use side-channel attacks to analyze physical information such as power consumption and electromagnetic radiation to extract model parameters, or even completely clone DNN models, causing serious economic losses and security risks.

[0003] Current research on intellectual property (IP) protection primarily focuses on two types of technologies: digital watermarking and encryption. Digital watermarking, a passive form of intellectual property protection, is mainly used for obtaining ownership evidence after infringement has occurred, but it cannot prevent unauthorized use of models. Specifically, it is divided into white-box watermarking, which allows access to internal parameters, and black-box watermarking, which relies solely on input / output interfaces. However, attackers can disrupt embedded information through fine-tuning, pruning, and watermark overwriting, and even bypass detection using attack frameworks like DeepEclipse. Furthermore, watermarks in FPGA bitstreams are easily reverse-engineered and targeted tampering, resulting in limited protection effectiveness.

[0004] Encryption / decryption technology is a proactive protection measure. It can prevent keyless users from obtaining correct inference results by means of encryption model output, permutation, or encryption weight parameters, thereby restricting unauthorized use. However, its security is highly dependent on key management, and there are still obvious vulnerabilities in FPGA platforms: attackers can intercept or tamper with bit streams through physical probes, deduce keys from power consumption and electromagnetic radiation using side-channel attacks, and even leak decrypted plaintext information without directly obtaining the key by exploiting FPGA hardware design flaws (such as the Starbleed vulnerability). Overall, the protection has significant security risks.

[0005] To address the vulnerability of traditional keys to physical attacks, Physically Unclonable Functions (PUFs) utilize differences in circuit manufacturing processes to generate unique digital signals, eliminating the need for key storage and allowing for immediate deletion after use, thus enhancing security. However, existing PUF-based proactive protection schemes, such as the Chinese invention patent with publication number CN115545154A, provide a PUF-based method for protecting the intellectual property of convolutional neural network models. This method deeply integrates the PUF response into the entire process of parameter obfuscation and result recovery of the convolutional neural network model through the collaborative work of design, training, obfuscation, and recovery modules, achieving hardware binding protection between the model and a specific FPGA. However, this patent uses a method of training isomorphic models separately with real and pseudo datasets before mixing the parameters, requiring additional computational resources for training and optimizing the pseudo model. Although this patent only fine-tunes the model structure without introducing additional parameter storage overhead, it still fails to fundamentally reduce the resource consumption problem caused by multi-model training. Furthermore, the patent's deep intervention in the model design and training process to achieve binding requires dedicated retraining, violating the principle of efficient distribution and reducing the versatility of the solution. Therefore, there is an urgent need to provide a more universal and less resource-intensive method for intellectual property protection to solve the above problems. Summary of the Invention

[0006] The purpose of this application is to provide an intellectual property protection method for FPGA-accelerated deep neural networks based on PUF and keyless storage, so as to solve the technical problems of high resource consumption and poor versatility in existing intellectual property protection methods.

[0007] To achieve the above objectives, this application provides a method for protecting intellectual property rights of FPGA-accelerated deep neural networks based on PUF and keyless storage, comprising the following steps: The supplier obtains the PUF response of the target FPGA, generates a key stream based on the PUF response, and encrypts the original model parameters of the original model with mixed symbols and amplitude masks to obtain the encrypted model parameters. The end user writes the encrypted model parameters into the target FPGA. For authorized target FPGAs, the PUF generates a response in real time and restores the key stream. The model parameters are dynamically decrypted during inference operations, achieving hardware binding without key storage and outputting inference results consistent with the original model. For unauthorized target FPGAs, the response generated by the internal PUF cannot restore the key stream, the model parameters decryption fails, and the inference output becomes invalid.

[0008] Preferably, the formula for encrypting the original model parameters using a hybrid symbol and amplitude mask is: ⊙ ; ⊙ ; In the formula, For encrypted weights, The sign mask matrix for the weights, The magnitude mask matrix for the weights, Here, ⊙ represents the weight, and ⊙ represents element-wise multiplication. For encryption bias, For bias, For the biased symbol mask matrix, is the amplitude mask matrix for the bias.

[0009] Preferably, the formula for the dynamic decryption parameters is: ⊙ ⊙ ; In the formula, To output the feature map, The sign mask matrix for the weights, For encrypted weights, The magnitude mask matrix for the weights, The feature map to be identified. For encryption bias, For the biased symbol mask matrix, is the amplitude mask matrix for the bias.

[0010] Preferably, before performing hybrid symbol and amplitude mask encryption, the PUF response is first loaded as a seed into a linear feedback shift register, and shifting and feedback are performed to generate a pseudo-random sequence. The pseudo-random sequence is then input into a nonlinear Boolean function to generate a key stream. The symbol bits and amplitude blocks are extracted from the key stream, and the symbol matrix and amplitude matrix are constructed respectively. The original model parameters are then encrypted using a mixed symbol and amplitude mask using the symbol matrix and amplitude matrix to obtain the encrypted model parameters.

[0011] Preferably, the process by which the supplier obtains the PUF response of the target FPGA includes: training the original model to obtain the original model parameters; the supplier generating and burning a dedicated bitstream for registration to the target FPGA based on the original model parameters; applying an excitation to the PUF to obtain the response to be corrected, extracting and correcting the PUF response, storing the PUF response in the supplier's database, and then erasing the dedicated bitstream.

[0012] Preferably, before generating the keystream, the vendor generates and burns the final bitstream for deployment; In the final bitstream, the output port of the PUF is hardwired to the seed input of the linear feedback shift register, and the off-chip readout path is removed, physically cutting off the external observation channel of the PUF response.

[0013] Preferably, the response generated by the PUF inside the unauthorized target FPGA is different from the PUF response, causing the linear feedback shift register to generate incorrect sign matrix and amplitude matrix. During the decryption process, the mask applied during encryption cannot be compensated, and the model parameter decryption fails.

[0014] Preferably, the process of constructing the symbol matrix includes: extracting single-bit symbol bits from the key stream, mapping the symbol bits to {+1, -1}, arranging them according to the dimensions and order of the weights and biases in the model parameters, generating a symbol matrix that matches the weight dimension and a symbol matrix that matches the bias vector dimension.

[0015] Preferably, the process of constructing the amplitude matrix includes: extracting multi-bit amplitude blocks from the key stream, mapping the amplitude blocks to integer values, arranging them according to the dimensions and order of the weights and biases in the model parameters, generating an amplitude matrix that matches the dimensions of the weight matrix and an amplitude matrix that matches the dimensions of the bias matrix.

[0016] Preferably, the dedicated bit stream includes a PUF array and its peripheral readout circuitry.

[0017] The beneficial effects of this application are as follows: This application provides an intellectual property protection method for FPGA-accelerated deep neural networks based on PUF and keyless storage. First, a key stream is generated by the supplier based on the PUF response of the target FPGA, without relying on static keys stored externally, thus avoiding the risk of key leakage and tampering. Next, the original model parameters are encrypted with mixed symbols and amplitude masks, achieving irreversible parameter obfuscation. This eliminates the need to modify the structure of the original model or retrain it, avoiding the high computational resource consumption caused by retraining the model in traditional solutions and significantly reducing overall resource overhead. At the same time, this method does not interfere with the normal training process of the original model, supports an efficient distribution paradigm of one-time training and multiple deployments, and can directly encrypt and distribute a single original model to target FPGA devices with different licenses, providing greater deployment flexibility and versatility.

[0018] For authorized target FPGAs, this application relies on PUF to generate responses in real time to complete key stream recovery and parameter decryption without storing any static keys. This eliminates the security vulnerabilities caused by key storage and management at the source and improves the security of model intellectual property protection on the target FPGA platform.

[0019] For unauthorized devices, PUF response mismatch will directly lead to decryption failure and inference output failure, effectively resisting illegal cloning, copying, and unauthorized use of the model, and achieving strong binding protection between the DNN model and specific FPGA hardware. In addition, the encryption process maintains the original model's parameter count unchanged and does not introduce additional parameter storage overhead, further adapting to resource-constrained edge FPGA deployment scenarios. Attached Figure Description

[0020] To more clearly illustrate the technical solutions in the embodiments of this application, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0021] Figure 1 A schematic diagram of the overall process of an FPGA-accelerated deep neural network intellectual property protection method based on PUF and keyless storage provided in an embodiment of this application; Figure 2 This is an architecture diagram of an encryption model provided in an embodiment of this application; Figure 3 The end-to-end protocol that the supplier must follow for one embodiment of this application; Figure 4 A line graph showing the accuracy comparison of AlexNet during training and fine-tuning on FashionMNIST, provided as an embodiment of this application; Figure 5 A line graph showing the accuracy comparison of AlexNet during the transfer learning process from FashionMNIST to MNIST, provided as an embodiment of this application; Figure 6 A component unit power consumption comparison bar chart is provided as an embodiment of this application, wherein, Figure 6 (a) is a histogram of component unit power consumption decomposition in decryption mode. Figure 6 (b) is a bar chart showing the breakdown of component unit power consumption when the decryption mode is not activated. Detailed Implementation

[0022] To make the technical problems, technical solutions, and beneficial effects to be solved by this application clearer, the following detailed description is provided in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative and are not intended to limit the scope of this application.

[0023] Attackers possess physical access capabilities, ample resources, and a clear motivation, enabling them to acquire parameter sets from multiple FPGA devices and their protected models, and extract and analyze FPGA configuration bitstreams to reconstruct gate-level netlists. Furthermore, attackers can monitor runtime processes through power consumption or electromagnetic side-channel analysis, and even use microprobes to directly access on-chip memory contents, constructing a functionally equivalent unauthorized model copy that can run on any unauthorized device.

[0024] This application proposes a proactive protection scheme to safeguard the intellectual property of DNN models deployed on edge FPGAs from theft and cloning. By combining PUF-based dynamic entropy with hybrid symbolic and amplitude encryption mechanisms, a hardware-bound architecture is constructed, eliminating reliance on vulnerable static key storage. Specifically, this application tightly integrates the decryption process with inference computation, ensuring that plaintext parameters are never exposed in memory. Experimental results demonstrate that the scheme has high security: unauthorized inference is completely disabled, and the protected model exhibits strong resistance to fine-tuning attacks and transfer learning attacks. Crucially, this security is achieved without additional storage overhead for model parameters and is compatible with the paradigm of one-time training and multiple deployments.

[0025] Please see Figure 1 This application provides an embodiment of an intellectual property protection method for FPGA-accelerated deep neural networks based on PUF and keyless storage, comprising the following steps: This application comprises two main entities: the supplier and the end user. The supplier possesses the original, trained model. The end user owns the target FPGA device. The entire process is divided into two stages: the supplier prepares and encrypts the model for each target FPGA device; the end user performs decryption and inference recovery on the target FPGA device.

[0026] S1: The supplier obtains the PUF response of the target FPGA, generates a key stream based on the PUF response, and encrypts the original model parameters of the original model with mixed symbols and amplitude masks to obtain the encrypted model parameters.

[0027] Model architecture such as Figure 2 As shown, the uplink is the inference computation flow of the original model (DNN model), and the downlink is the key generation and weight encryption flow driven by PUF.

[0028] Specifically, with Figure 2 By comparing the unprotected CNN model in the uplink, it can be seen that the unprotected CNN model includes unprotected multiply-accumulate units (UnProtected MACs) in the image to be recognized. After inputting an unprotected DNN model, convolution is performed in a convolutional block. This convolutional block includes convolutional layers (Conv), activation functions (Act, such as ReLU), and pooling layers (Pool) to extract the image to be recognized. Spatial features. The original model parameters are directly stored in the convolutional layers. Use the original model parameters directly Image to be recognized The formula for convolution is: ; In the formula, The feature map after convolution. As weight, The feature map to be identified. For bias.

[0029] This application replaces the unprotected multiply-accumulate units (UnProtected MACs) in an unprotected CNN model with protected MACs. In the downlink, a PUF-driven key generation chain is designed to encrypt all convolutional blocks and fully connected blocks in the DNN model. Specifically, the response is generated using a PUF on an FPGA. After noise reduction by the error correction module, a linear feedback shift register (LFSR) is selected as the efficient stream cipher generator. position As the initial state of the LFSR, the LFSR then generates a pseudo-random sequence through deterministic shift and feedback operations. This sequence is processed by a non-linear Boolean function (NBF) to produce the keystream for decryption. The combination of PUF and LFSR constitutes a key expansion mechanism.

[0030] PUF provides an unclonable and unpredictable hardware entropy source, solving the challenges of secure key storage and distribution in traditional DNN models. LFSR extends this short but high-quality secret into a key stream sufficient to cover the entire large-scale DNN model, while maintaining controllable hardware overhead, making it highly suitable for resource-constrained FPGA deployment scenarios.

[0031] After constructing the model architecture, the supplier must follow Figure 3 The protocol shown is designed to ensure secure binding of DNN model parameters and copy-proof operation.

[0032] First, during the DNN model training phase, no constraints are imposed, allowing vendors to follow standard procedures for model training and tuning. Specifically, vendors can meticulously design the topology and feature propagation paths between network layers, collect multi-source data, perform professional cleaning and precise labeling, and continuously iterate and optimize strategies during training, while investing significant computational resources and domain expertise. Finally, through the complete convergence of optimization algorithms such as gradient descent, a fully quantized model achieving the expected performance is obtained. The model Original model parameters This is the object that this application seeks to protect.

[0033] Furthermore, in an optional embodiment, the supplier generates and programs a dedicated bitstream for registration into the target FPGA device. The bitstream contains only the PUF array and its peripheral readout circuitry. In a vendor-controlled and secure environment, the system applies standard excitation to the PUF. The system generates a response to be corrected, performs multiple sampling and error correction processes on the response, and finally extracts a stable gold standard response. This is the PUF response. Once the PUF response... Once securely recorded in the vendor's database, the dedicated bitstream is erased.

[0034] The vendor generates and programs the final bitstream for deployment. In this final bitstream, the PUF's output port is hardwired to the LFSR's seed input. Simultaneously, the readout data path to the external pins is completely removed, physically cutting off the PUF response. The observation channel. In devices delivered to end users, the PUF serves only as an internal entropy source to drive the decryption logic.

[0035] Next, the supplier performs mixed symbol and amplitude encryption on the model on the local server.

[0036] Specifically, in an optional embodiment, the PUF response stored by the vendor is used first. As an initial seed, a linear feedback shift register (LFSR) is initialized to bind the model to the hardware. Subsequently, each original model parameter is iterated through, generating a keystream block using the LFSR and a nonlinear Boolean function (NBF). Specifically, this involves selecting specific non-adjacent taps as input and updating the LFSR state. And generate a sufficiently long keystream by performing a combination of AND and XOR operations. and from Extracting the sign bit , With amplitude block , This pseudo-random sequence is used to construct four secret pseudo-random matrices: Mapping to {+1,-1} forms a sign matrix. The elements, to obtain ;Will Mapping to {+1, -1} forms a sign matrix. The elements, to obtain ;Will Mapped to , forming an amplitude matrix The elements, to obtain ;Will Mapped to , forming an amplitude matrix The elements, to obtain In this sequence, a single bit is used to determine the symbol matrix. and Symbol elements in The bit blocks of the multi-bit stream are then combined to generate an amplitude matrix. and The amplitude element in.

[0037] Subsequently, the supplier adjusted the weights in the original model parameters. Perform the following encryption operation, using the formula: ⊙ ; In the formula, For encrypted weights, The sign mask matrix for the weights, The magnitude mask matrix for the weights, is the weight, and ⊙ represents element-wise multiplication.

[0038] Next, the biases in the original model parameters are also adjusted. The encryption operation is performed using the following formula: ⊙ ; In the formula, For encryption bias, For bias, For the biased symbol mask matrix, is the amplitude mask matrix for the bias.

[0039] The supplier will encrypt the encrypted model parameters Delivered to end users.

[0040] S2: The end user writes the encrypted model parameters into the target FPGA. For an authorized target FPGA, the PUF generates a response in real time and restores the key stream. The model parameters are dynamically decrypted during the inference operation to achieve hardware binding without key storage and output inference results consistent with the original model. For an unauthorized target FPGA, the response generated by the internal PUF cannot restore the key stream, the model parameters decryption fails, and the inference output becomes invalid.

[0041] The end user receives the encrypted encryption model parameters Then, it is written into the target FPGA device. The system then initiates model inference. At this point, the user-side FPGA has deployed a CNN model containing Protected MAC. The inference process requires image input, encrypted weights, and a real-time keystream generated by the PUF. Once the model inference task starts, the system runs autonomously. The internal Physically Unclonable Function (PUF) reconstructs the response. ,response It was directly used as the seed for a linear feedback shift register (LFSR) to reproduce a secret pseudo-random matrix. , , and At the same time, response It will be immediately destroyed by hardware, achieving "use and destroy". Specifically, it retrieves the batch of encryption parameters for the current period. , Update LFSR status: This generates a new pseudo-random sequence. Simultaneously, the NBF function (a non-linear Boolean function) is called to convert the LFSR state into a keystream. Analysis To reproduce the secret pseudo-random matrix , , and .

[0042] Next, the decryption and multiply-accumulate operations are combined and executed. Specifically, the multiply-accumulate (MAC) operation is designed as a Protected MAC structure tightly coupled with a linear feedback shift register (LFSR). During the calculation process, the decryption and multiply-accumulate operations are performed together. ⊙ To restore effective weights, calculate... ⊙ After restoring the effective bias, multiply-accumulate fusion decryption is performed, and the multiply-accumulate calculation of the model inference is completed simultaneously to obtain the output feature map. The formula is as follows: ⊙ ⊙ ; In the formula, To output the feature map, The sign mask matrix for the weights, For encrypted weights, The magnitude mask matrix for the weights, The feature map to be identified. For encryption bias, is the amplitude mask matrix for the bias.

[0043] The security mechanism of this application is that if an incorrect encryption weight is written to the correct target FPGA device, or if the correct encryption weight is written to the wrong target FPGA device, it will cause a mismatch between the encryption parameters and the device's local key stream, resulting in an incorrect calculated encryption weight. This is an incorrect result; if the encrypted weights are applied to the unprotected MAC underlying circuitry of an unprotected CNN model, the correct result cannot be calculated due to the lack of a real-time key stream input. This establishes a strong binding between model parameters and hardware devices, preventing the model from being stolen or tampered with.

[0044] Specifically, for the authorized target FPGA device Because the system can be reconstructed to be exactly the same as the supplier's. , , , ,therefore Numerically equivalent to the original calculation. The derivation process is as follows: ⊙ ⊙ ⊙ ⊙ ; because and It is a sign matrix composed of ±1, according to its properties It can be known that ⊙ =1 (all-1 matrix) and ⊙ =1. Therefore, the above equation can be simplified to: ⊙ ⊙

[0045]

[0046]

[0047] ; This calculation process can recover the original output feature map without loss. This ensures the subsequent activation function Get the correct input.

[0048] Conversely, in unauthorized target FPGA devices Above, the response generated by its internal PUF With PUF response The difference caused the LFSR to generate an error. , , and Collection. When the hardware executes During computation, the decryption process cannot compensate for the mask applied during the encryption phase, resulting in randomized computation results. This avalanche effect disrupts the feature extraction capabilities of deep neural network (DNN) models, causing a significant decrease in inference accuracy on target FPGA devices from unauthorized devices.

[0049] It is worth noting that, , , and The data is not generated and stored simultaneously. The control logic synchronizes the LFSR with the model inference process, ensuring that the bit data required for decryption is generated exactly when needed. The design proposed in this application deeply integrates decryption and inference computation, ensuring the original model parameters... It never appears in static or dynamic form on the target FPGA device at any time. This greatly reduces the attack surface for memory snooping or side-channel attacks targeting BRAM that attempt to extract plaintext parameters.

[0050] Example 1: Comparison of inference accuracy under different attacks.

[0051] Three typical DNN models, LeNet, AlexNet, and VGGNet, were selected and trained on grayscale image datasets (MNIST and FashionMNIST) and color image datasets (CIFAR-10). During data preprocessing, random cropping, random horizontal flipping, and normalization were employed to enhance model robustness. To accommodate FPGA resources, all trained model parameters were quantized into 8-bit signed integers (INT8). Model training and attack simulations were performed on a laptop equipped with an NVIDIA RTX 3060 GPU, using Python 3.10.18 and PyTorch 2.8.0. To eliminate human bias, Optuna (an automated hyperparameter optimization tool) was used for automated hyperparameter search. Key model information is shown in Table 1.

[0052] Table 1: DNN models used and their baseline accuracy on the dataset

[0053] The hardware evaluation platform used was the Nuclei Hummingbird evaluation kit (core chip: XC7A75T-2FGG484I). All hardware logic design, synthesis, and evaluation were completed using the Xilinx Vivado 2022.1 toolchain. To construct an unclonable hardware root of trust, an RO-PUF was instantiated, employing a 1-out-of-k topology, containing 256 pairs of ring oscillators, and constrained by complex macrocells to generate a 32-bit response. Timing constraints were set to 100MHz. Notably, this application adheres to the principle of decoupling security primitives from computational logic in its design. Although this experiment uses an RO-PUF as an example, the system can be seamlessly replaced with other types of PUFs, such as SRAM-PUFs or arbitrator PUFs.

[0054] Next, a random attack is performed to assess its impact on inference accuracy. Specifically, the attacker attempts to compromise the encrypted model parameters. Directly loaded into unauthorized target FPGA devices Execute on. However, The generated response and Difference, that is .

[0055] Three scenarios were tested selectively: =1 (minimum difference) =16 (Independent status statistics between devices) and =32 (completely reversed). For each scenario, 10 different values ​​were randomly generated. The response was recorded, along with the average inference accuracy.

[0056] Table 2: The impact of the difference between random response and true response on inference accuracy

[0057] As shown in Table 2, when When the value is 1, the inference accuracy stagnates at approximately 10% (equivalent to random guessing in a 10-class task). In fact, for any Hamming distance greater than zero, the accuracy remains at this level of random guessing. This is because even local perturbations in the Physically Unclonable Function (PUF) response can trigger an avalanche effect during the iteration of the Linear Feedback Shift Register (LFSR), thereby generating a keystream that is identical to the correct one. irrelevant key stream This renders the model completely ineffective on unauthorized devices, effectively preventing attempts at illegal cloning or physical tampering.

[0058] Furthermore, a fine-tuning attack is conducted to assess its impact on average inference accuracy. Specifically, the attacker attempts to fine-tune the cryptographic model using a small subset of the original dataset. This data may be obtained through leaks or public channels. The goal is to leverage gradient descent to correct parameter mismatches introduced by cryptography, thereby restoring the model's performance on the original task.

[0059] Suppose an attacker obtains 10% and 40% of the original dataset and uses them to fine-tune all layers of the cryptographic model. As a control, a model is trained from scratch using the same data and network architecture. In each test, 10 cryptographic models are fine-tuned based on different correct responses, and the average inference accuracy is recorded.

[0060] Table 3: Performance Comparison of Fine-Tuning Attacks with 10% and 40% Dataset Leakage Ratios

[0061] As shown in Table 3, the fine-tuning attack failed in all test cases, and its performance was significantly lower than that of the model trained from scratch using the same data. For example, in the CIFAR-10 task, the attacker could achieve a usable accuracy of over 84% by training from scratch using 40% of the dataset, while the fine-tuned cryptographic model remained at the level of random guessing. Figure 4 This demonstrates the change in accuracy during a fine-tuning attack in a particular test. Furthermore, the more complex the task, the more difficult the recovery. On the MNIST and FashionMNIST tasks, fine-tuning might bring a slight improvement in accuracy (although still unusable); however, on the CIFAR-10 task, accuracy almost entirely stagnated at the level of random guessing. This confirms the robustness of this application against fine-tuning attacks, making it extremely difficult for attackers to recover the accuracy loss of the cryptographic model using only a small amount of original data.

[0062] Furthermore, task transfer attacks are conducted to assess the defense mechanisms' ability to withstand such threats. Specifically, attackers may also attempt to exploit the residual feature extraction capabilities in the encrypted model, reusing them as a pre-trained backbone network for transfer learning to perform related tasks. This attack assumes that even if encryption disrupts specific classification boundaries, underlying general visual features (such as edge detection and texture recognition) may still be preserved.

[0063] To evaluate the defense mechanism's ability to resist such threats, a cross-dataset task transfer attack experiment was conducted. Specifically, an encrypted model trained on MNIST was transferred to the FashionMNIST task, and vice versa. As a control, the same transfer operation was performed using the original unencrypted model. Consistent with previous experiments, 10 encrypted models generated based on different correct responses were transferred, and their average inference accuracy was recorded.

[0064] Table 4: Comparison of inference accuracy between the encrypted model and the original model under migration attack

[0065] Please refer to Table 4, where M stands for MMNIST, FM for MNIST and FashionMNIST, and C10 for CIFAR-10. As shown in Table 4, direct transfer of the original model demonstrates significant cross-task adaptability. For example, when transferring from FashionMNIST back to MNIST, AlexNet achieved an accuracy of 89.88%; similarly, VGGNet maintained a usable accuracy of 76.22% when transferring from CIFAR-10 to FashionMNIST. This confirms that the unencrypted model does indeed learn generalizable visual primitives that can serve as feature extractors for relevant tasks.

[0066] However, the transfer results based on the cryptographic model showed a significant performance drop. The accuracy of LeNet and VGGNet stagnated at around 10% across all transfer paths. Even AlexNet experienced a 40%–60% drop in transfer accuracy compared to the original model. Figure 5 The evolution of accuracy during a migration attack test is illustrated. These results demonstrate that the proposed hybrid encryption method not only blurs classification boundaries but also disrupts the underlying visual features. Therefore, it is difficult for attackers to reuse the encryption model as a pre-trained backbone network for secondary development.

[0067] Example 2: Performance overhead comparison.

[0068] Given the high complexity of the complete DNN logic, a modular evaluation strategy is adopted to isolate the additional overhead introduced by the proposed scheme. Therefore, representative convolutional layers and fully connected layers are selected as the network structures to be tested.

[0069] Table 5: Performance Cost Analysis

[0070] Hardware Resources: Table 5 compares the resource overhead before and after protection. The LUT overhead for convolutional layers increased by approximately 24.44%, while that for fully connected layers rose to 85.23%. This increase stems from the hardware implementation decrypted in this application. Each MAC unit now additionally includes an adder (for amplitude recovery) and symbol control logic (for symbol recovery). In an FPGA, these functions primarily consume LUT resources. Due to the lower computational density of fully connected layers, the proportion of additional logic is more significant.

[0071] It is worth noting that the register overhead remains essentially the same in both modes. This indicates that this application primarily increases the computational depth of the combinational logic path without introducing additional register requirements, meaning that the protection mechanism will not interfere with the behavior of the original registers. Although the LUT overhead is significant, in high-value application scenarios with limited resources and high security requirements, the trade-off between on-chip logic resources and intrinsic security is acceptable.

[0072] Inference delay: As shown in Table 5, compared with the baseline, the F of this scheme is... max The timing overhead decreased by approximately 15% to 27%. This timing overhead primarily stems from the tight coupling between LFSR state updates and MAC operations, which increases the depth of the combinational logic chain.

[0073] However, this performance degradation is acceptable in edge computing scenarios. Even with the operating frequency limited to approximately 100MHz, the encryption model can still maintain sufficient throughput to meet the real-time inference requirements (typically defined as ≥30 FPS) of lightweight tasks such as CIFAR-10. Furthermore, the feasibility of the scheme is validated primarily through direct combinational logic mapping. For industrial deployments, timing can be further optimized through fine-grained pipelines. Specifically, inserting registers between the decryption and computation logic helps to segment the critical path. Although this introduces a slight first-run latency and a small amount of register overhead, it effectively alleviates the frequency bottleneck.

[0074] Power Consumption Analysis: Power consumption assessment was performed based on dynamic analysis of the SAIF file generated by Vivado. To obtain the most realistic dynamic power consumption data possible, a linear feedback shift register (LFSR) was used in the test platform to generate random stimuli with a high toggle rate to simulate computational scenarios under heavy load.

[0075] As shown in Table 5, the total power consumption of the protected layer increased by approximately 20% compared to the baseline scheme. This can be broken down further. Figure 6 As shown, where, Figure 6 (a) is a histogram of component unit power consumption decomposition in decryption mode. Figure 6 (b) is a histogram of component cell power consumption breakdown under inactive decryption mode. Static power consumption remains stable at approximately 72mW in both modes. This stability is expected, as static power consumption is primarily determined by transistor process technology and leakage current, and is independent of logic switching activity. Therefore, the observed power overhead mainly originates from the dynamic power consumption portion, caused by the frequent toggling of the additional LUTs required for decryption. However, for FPGA platforms that typically operate in the watt-level power range, this small absolute increment (milliwatts) has a negligible impact on overall system-level energy efficiency.

[0076] Example 3: Comparison with other solutions.

[0077] Table 6: Comparison of characteristics and overhead of different PUF-based FPGA DNN hardware binding schemes.

[0078]

[0079] In Table 6, P-Obf refers to parameter obfuscation, P-Perm refers to parameter permutation, Aff-Mod refers to affine transformation, Passive refers to passive protection, and H-Mask refers to a hybrid symbol and amplitude mask. Table 6 compares the proposed scheme with recent related works. Regarding security, compared with the PIPP and Pay-per-device schemes, this application adopts a hybrid encryption strategy, combining symbol and amplitude masks, thereby enhancing the protection depth and improving resistance to attacks. In terms of hardware architecture, the PIPP and Device-bind key-storageless schemes mainly adopt a separate processing method where decryption precedes computation, increasing the risk of exposing plaintext in the middle; in contrast, this application embeds the decryption process into the inference computation by modifying the underlying MAC logic. Furthermore, regarding deployment flexibility, unlike self-obfuscated and publicly verifiable schemes and LOGO-based schemes that require deep intervention in the training process or retraining the model for each authorized device, this application is completely independent of the model training phase, supporting non-intrusive deployment and realizing a paradigm of one-time training and multiple deployments.

[0080] Those skilled in the art will recognize that the units and algorithm steps of the various examples described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, or a combination of computer software and electronic hardware. Whether these functions are implemented in hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of this application.

[0081] The above-described embodiments are only used to illustrate the technical solutions of this application, and are not intended to limit them. Although this application has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some of the technical features. Such modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of this application, and should all be included within the protection scope of this application.

Claims

1. A method for FPGA acceleration of deep neural network intellectual property protection based on PUF and keyless storage, characterized in that, Includes the following steps: The supplier obtains the PUF response of the target FPGA, generates a key stream based on the PUF response, and encrypts the original model parameters of the original model with mixed symbols and amplitude masks to obtain encrypted model parameters. The end user writes the encrypted model parameters into the target FPGA. For an authorized target FPGA, the PUF generates a response in real time and restores the key stream. The model parameters are dynamically decrypted during inference operations to achieve hardware binding without key storage and output inference results consistent with the original model. For an unauthorized target FPGA, the response generated by the internal PUF cannot restore the key stream, the model parameters decryption fails, and the inference output becomes invalid. The formula for encrypting the original model parameters using the hybrid symbol and amplitude mask is as follows: ⊙ ； ⊙ ； wherein, is an encrypted weight, is a sign mask matrix of the weight, is a magnitude mask matrix of the weight, is a weight, and is an element-wise multiplication, is an encrypted bias, is a bias, is a sign mask matrix of the bias, is a magnitude mask matrix of the bias; The formula for the dynamic decryption parameters is: ⊙ ⊙ ； wherein, is an output feature map, is a sign mask matrix of weights, is an encrypted weight, is a magnitude mask matrix of weights, is a feature map to be recognized, is an encrypted bias, is a sign mask matrix of a bias, is a magnitude mask matrix of a bias; Before performing the hybrid symbol and amplitude mask encryption, the PUF response is first loaded as a seed into a linear feedback shift register, and a pseudo-random sequence is generated by shifting and feedback. The pseudo-random sequence is then input into a nonlinear Boolean function to generate the key stream. The symbol bits and amplitude blocks are extracted from the key stream, and a symbol matrix and an amplitude matrix are constructed respectively. The original model parameters are then encrypted using the hybrid symbol and amplitude mask using the symbol matrix and the amplitude matrix to obtain the encrypted model parameters. The process of constructing the symbol matrix includes: extracting single-bit symbol bits from the key stream, mapping the symbol bits to {+1, -1}, arranging them according to the dimensions and order of the weights and biases in the model parameters, and generating a symbol matrix that matches the weight dimension and a symbol matrix that matches the bias dimension. The process of constructing the amplitude matrix includes: extracting multi-bit amplitude blocks from the key stream, mapping the amplitude blocks to integer values, arranging them according to the dimensions and order of the weights and biases in the model parameters, generating an amplitude matrix that matches the weight dimension and an amplitude matrix that matches the bias dimension.

2. The intellectual property protection method for FPGA-accelerated deep neural networks based on PUF and keyless storage as described in claim 1, characterized in that, The process by which the supplier obtains the PUF response of the target FPGA includes: training the original model to obtain the original model parameters; the supplier generating and burning a dedicated bitstream for registration to the target FPGA based on the original model parameters; applying an excitation to the PUF to obtain a response to be corrected; extracting and correcting the PUF response; storing the PUF response in the supplier's database; and erasing the dedicated bitstream.

3. The intellectual property protection method for FPGA-accelerated deep neural networks based on PUF and keyless storage as described in claim 2, characterized in that, Before generating the keystream, the vendor generates and burns the final bitstream for deployment; In the final bitstream, the output port of the PUF is hardwired to the seed input of the linear feedback shift register, and the off-chip readout path is removed, physically cutting off the external observation channel of the PUF response.

4. The intellectual property protection method for FPGA-accelerated deep neural networks based on PUF and keyless storage as described in claim 1, characterized in that, The response generated by the PUF inside the unauthorized target FPGA is different from the PUF response, causing the linear feedback shift register to generate incorrect symbol matrix and amplitude matrix. During the decryption process, the mask applied during encryption cannot be compensated, and the model parameters decryption fails.

5. The PUF and keyless storage based FPGA accelerated deep neural network intellectual property protection method of claim 2, wherein, The dedicated bitstream includes a PUF array and its peripheral readout circuitry.

Images