LLA: Enhancing Security and Privacy for Generative Models with Logic-Locked Accelerators

2025-12-26

AI Summary

To address intellectual property (IP) security threats—including model theft, tampering, and information leakage—facing generative AI models in supply chains, this paper proposes a software–hardware co-designed, neuron-level protection framework. Methodologically, it introduces the first neuron-granular key embedding and anomaly-triggering mechanism, coupled with a lightweight, reusable hardware lock module that enables an “accelerator-as-license” authorization paradigm. To counteract key-optimization attacks, the framework integrates logic locking, invariance-preserving transformations, and an Oracle-guided attack model. Evaluation shows that, under a 7168-bit key, the framework incurs less than 0.1% computational overhead, induces negligible accuracy degradation, and maintains full compatibility with mainstream hardware toolchains and multi-datastream execution scenarios.

Technology Category

• Machine Learning: Hardware-aware ML
• Natural Language Processing: Safety and Robustness
• Computer Vision: Large Vision Models

Application Category

• Security and Privacy: Security and privacy of machine learning and AI applications
• Semantics and Knowledge: Methods to enhance, augment, integrate or synergize semantic models such as knowledge graphs and LLMs
• Social Networks and Social Media: Generative AI / large language models and their impact on social systems

Abstract

We introduce LLA, an effective intellectual property (IP) protection scheme for generative AI models. LLA leverages the synergy between hardware and software to defend against various supply chain threats, including model theft, model corruption, and information leakage. On the software side, it embeds key bits into neurons that can trigger outliers to degrade performance and applies invariance transformations to obscure the key values. On the hardware side, it integrates a lightweight locking module into the AI accelerator while maintaining compatibility with various dataflow patterns and toolchains. An accelerator with a pre-stored secret key acts as a license to access the model services provided by the IP owner. The evaluation results show that LLA can withstand a broad range of oracle-guided key optimization attacks, while incurring a minimal computational overhead of less than 0.1% for 7,168 key bits.

Problem

• Protects generative AI models from theft and corruption
• Secures models against supply chain threats and leakage
• Integrates hardware-software locking to prevent unauthorized access

Innovation

• Hardware-software synergy for AI model IP protection
• Key bits embedded in neurons to degrade performance
• Lightweight locking module integrated into AI accelerator