Model‐Inversion‐Resistant Physical Unclonable Neural Network Using Vertical NAND Flash Memory

The growing use of neural networks in privacy-sensitive applications necessitates architectures that inherently protect both data and model integrity. We present a model-inversion-resistant physical unclonable neural network (PUNN) implemented on commercial vertical NAND (V-NAND) flash memory. A physical unclonable layer generated through weak gate-induced drain-leakage erase exploits intrinsic device-level variations to create chip-unique conductance patterns that are concealable and unreproducible. Training is achieved using the forward-forward (FF) algorithm, which eliminates the need for backward propagation and is fully compatible with the common-source-line structure of V-NAND arrays. The resulting V-NAND FF-PUNN demonstrates hardware-rooted resistance to model-cloning and model-inversion attacks, maintaining high accuracy under forward-only learning. When the trained network weights are transferred to another chip, inference accuracy collapses due to chip-specific randomness, confirming intrinsic non-clonability. Furthermore, when applied to the MIT-BIH electrocardiogram dataset, the system achieves competitive classification accuracy on real health data while entirely blocking data reconstruction by model-inversion. This work establishes a scalable framework for secure, energy-efficient, and privacy-preserving neural computing directly on commercial flash memory.