Attacks on Recent DNN IP Protection Techniques and Their Mitigation

• Published in: IEEE transactions on computer-aided design of integrated circuits and systems 2023-11, Vol.42 (11), p.1-1
• Main Authors: Mukherjee, Rijoy, Chakraborty, Rajat Subhra
• Format: Article
• Language: English
• Subjects: AES; Algorithms; Artificial neural networks; Chaotic Encryption; Copying; Cryptography; Deep Neural Network; Encryption; Face recognition; Hardware; Intellectual property; Intellectual Property (IP) protection; IP networks; Kernel; Machine learning; Mathematical models; Parameters; Security; Training; Watermarking
• ISSN: 0278-0070; 1937-4151
• DOI: 10.1109/TCAD.2023.3272271

With the rapid increase in the development of Deep Learning methodologies, Deep Neural Networks (DNNs) are now being commonly deployed in smart systems (e.g. autonomous vehicles) and high-end security applications (e.g. face recognition, biometric authentication, etc.). The training of such DNN models often requires exclusive valuable training datasets, enormous computational resources, and expert fine-tuning skills. Hence, a trained DNN model can be regarded as valuable proprietary Intellectual Property (IP). Piracy of such DNN IPs has emerged as a major concern, with increasing trends of illegal copying and redistribution. A number of mitigation approaches targeting DNN IP protection have been proposed in recent years. In this work, we target two recently proposed DNN IP protection schemes: (a) Chaotic Map theory based encryption of the weight parameters, and (b) traditional block cipher based encryption of the weights. We demonstrate attacks on two recent DNN IP protection techniques, with one technique each belonging to the above-mentioned schemes, under a pragmatic attack model. We also propose a novel DNN IP protection technique based on selective encryption of the weight parameters, termed LEWIP to mitigate the exposed weaknesses, while having low implementation and performance overheads. Finally, we demonstrate the effectiveness of the LEWIP technique against state-of-the-art DNN implementations.