PUF Based Pay-per-Device Scheme for IP Protection of CNN Model

With great success of Convolutional Neural Network (CNN) in many applications, it is not surprising that the CNN models will become commercial IPs. This paper proposes a Physical Unclonable Function (PUF) based pay-per-device scheme for protecting IPs of CNN models. PUFs are embedded into the FPGA based CNN accelerator. The original CNN model trained by the IP vendor is obfuscated based on the PUFs before being distributed to the end users. The PUF challenges come from obfuscated CNN model parameters, and the PUF responses determine outputs of convolutional layers. In this way, the obfuscated CNN model is limited to be correctly executed in one specific FPGA. Experiments on AlexNet show that performance and hardware overhead of the CNN accelerator are negligible. For authorized end users, the prediction accuracy of the obfuscated CNN model is the same as that of the original one, while for adversaries, prediction accuracies of guessed ones are nearly 0.