REDACTOR: eFPGA Redaction for DNN Accelerator Security
Yazan Baddour, Ava Hedayatipour, Amin Rezaei
TL;DR
This work addresses securing DNN accelerators by redacting critical IPs with eFPGAs, proposing REDACTOR as an end-to-end workflow from critical IP selection to physical design integration. It evaluates overhead and security tradeoffs for regular LUT and fracturable LUT fabrics across multiple IPs, showing that FLUTs can reduce overhead but may loosen resistance to oracle-guided attacks. A key finding is that the OWMC IP can achieve strong security when redacted with regular LUTs, while FLUT-based fabrics may be more susceptible to extraction, prompting strategic choices depending on the target IP. The results highlight practical design guidance for balancing security benefits with hardware overhead and motivate future work on increasing unrolling resistance or introducing non-unrollable cycles in eFPGA fabrics.
Abstract
With the ever-increasing integration of artificial intelligence into daily life and the growing importance of well-trained models, the security of hardware accelerators supporting Deep Neural Networks (DNNs) has become paramount. As a promising solution to prevent hardware intellectual property theft, eFPGA redaction has emerged. This technique selectively conceals critical components of the design, allowing authorized users to restore functionality post-fabrication by inserting the correct bitstream. In this paper, we explore the redaction of DNN accelerators using eFPGAs, from specification to physical design implementation. Specifically, we investigate the selection of critical DNN modules for redaction using both regular and fracturable look-up tables. We perform synthesis, timing verification, and place & route on redacted DNN accelerators. Furthermore, we evaluate the overhead of incorporating eFPGAs into DNN accelerators in terms of power, area, and delay, finding it reasonable given the security benefits.