Safeguarding Neural Network IPs from Scan Chain based Model Extraction Attacks

This work addresses the vulnerability of trained neural network (NN) models, particularly against scan-chainbased attacks exploiting the accessibility of activation function outputs to acquire model information such as weights and biases illicitly. Our aim is to obfuscate the interconnections among the layers in the NN model controlled by secret keys stored in tamperproof memory. Our model ensures normal functionality with the correct key while disrupting data flow and producing erroneous outputs with an incorrect key. Extensive experiments demonstrate a significant drop in accuracy when incorrect keys are used, with the accuracy drop being more pronounced when the latter layers of the model are locked. The protection technique incurs 0.3% overhead in the area and 0.1% overhead in the latency of the designs.