用内存物理随机性保护神经网络权重,防窃取又低成本。
EIM-TRNG: Obfuscating Deep Neural Network Weights with Encoding-in-Memory True Random Number Generator via RowHammer
- 利用行锤攻击引发的内存位翻转生成真随机数
- 通过固定与随机翻转组合加密模型权重,密钥基于翻转概率
- 硬件级安全防护,适合需要防逆向的AI模型部署
真随机数生成器(TRNG)在硬件安全、密码系统和数据保护中至关重要。在深度神经网络(DNN)中,保护模型参数尤其是权重,对保障AI系统的完整性、隐私性和知识产权至关重要。尽管软件伪随机数生成器广泛应用,但其缺乏硬件级TRNG提供的不可预测性和抗攻击能力。本文首次提出一种新型可靠的基于编码-内存的TRNG(EIM-TRNG),利用DRAM单元在行锤攻击扰动下的固有物理随机性。我们证明了通过精心控制的行锤操作产生的不可预测位翻转,可作为可靠的熵源。进一步地,将该TRNG框架应用于加密DNN权重数据,采用固定与不可预测位翻转相结合的方式进行编码。解密时使用基于概率翻转行为生成的密钥,确保数据机密性和模型真实性。实验验证了基于DRAM的熵提取在实现鲁棒、低成本硬件安全方面的有效性,为机器学习模型的硬件级保护提供了新方向。
原文摘要 · Abstract (English)
True Random Number Generators (TRNGs) play a fundamental role in hardware security, cryptographic systems, and data protection. In the context of Deep NeuralNetworks (DNNs), safeguarding model parameters, particularly weights, is critical to ensure the integrity, privacy, and intel-lectual property of AI systems. While software-based pseudo-random number generators are widely used, they lack the unpredictability and resilience offered by hardware-based TRNGs. In this work, we propose a novel and robust Encoding-in-Memory TRNG called EIM-TRNG that leverages the inherent physical randomness in DRAM cell behavior, particularly under RowHammer-induced disturbances, for the first time. We demonstrate how the unpredictable bit-flips generated through carefully controlled RowHammer operations can be harnessed as a reliable entropy source. Furthermore, we apply this TRNG framework to secure DNN weight data by encoding via a combination of fixed and unpredictable bit-flips. The encrypted data is later decrypted using a key derived from the probabilistic flip behavior, ensuring both data confidentiality and model authenticity. Our results validate the effectiveness of DRAM-based entropy extraction for robust, low-cost hardware security and offer a promising direction for protecting machine learning models at the hardware level.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品;中文卡片由大模型生成,请以原文为准。