Logo
ScienceStack
Table of Contents
Fetching ...
Sign In

LLA: Enhancing Security and Privacy for Generative Models with Logic-Locked Accelerators

You Li, Guannan Zhao, Yuhao Ju, Yunqi He, Jie Gu, Hai Zhou

TL;DR

The paper tackles IP protection for large generative models deployed in supply chains, where model theft, corruption, or leakage threaten IP owners. It introduces LLA, a hybrid software-hardware locking framework that embeds key bits into protected FFN neurons and couples this with a hardware-locked systolic accelerator, making the model functional only with the correct key. The approach combines outlier-based protection, orthogonal obfuscation, and group-wise permutation to degrade incorrect-key performance while maintaining low overhead, and demonstrates robustness against oracle-guided attacks. The proposed method enables license-based access to GenAI services with minimal computational cost and broad hardware compatibility, addressing practical security needs for IaaS and self-hosted deployments.

Abstract

We introduce LLA, an effective intellectual property (IP) protection scheme for generative AI models. LLA leverages the synergy between hardware and software to defend against various supply chain threats, including model theft, model corruption, and information leakage. On the software side, it embeds key bits into neurons that can trigger outliers to degrade performance and applies invariance transformations to obscure the key values. On the hardware side, it integrates a lightweight locking module into the AI accelerator while maintaining compatibility with various dataflow patterns and toolchains. An accelerator with a pre-stored secret key acts as a license to access the model services provided by the IP owner. The evaluation results show that LLA can withstand a broad range of oracle-guided key optimization attacks, while incurring a minimal computational overhead of less than 0.1% for 7,168 key bits.

LLA: Enhancing Security and Privacy for Generative Models with Logic-Locked Accelerators

TL;DR

The paper tackles IP protection for large generative models deployed in supply chains, where model theft, corruption, or leakage threaten IP owners. It introduces LLA, a hybrid software-hardware locking framework that embeds key bits into protected FFN neurons and couples this with a hardware-locked systolic accelerator, making the model functional only with the correct key. The approach combines outlier-based protection, orthogonal obfuscation, and group-wise permutation to degrade incorrect-key performance while maintaining low overhead, and demonstrates robustness against oracle-guided attacks. The proposed method enables license-based access to GenAI services with minimal computational cost and broad hardware compatibility, addressing practical security needs for IaaS and self-hosted deployments.

Abstract

We introduce LLA, an effective intellectual property (IP) protection scheme for generative AI models. LLA leverages the synergy between hardware and software to defend against various supply chain threats, including model theft, model corruption, and information leakage. On the software side, it embeds key bits into neurons that can trigger outliers to degrade performance and applies invariance transformations to obscure the key values. On the hardware side, it integrates a lightweight locking module into the AI accelerator while maintaining compatibility with various dataflow patterns and toolchains. An accelerator with a pre-stored secret key acts as a license to access the model services provided by the IP owner. The evaluation results show that LLA can withstand a broad range of oracle-guided key optimization attacks, while incurring a minimal computational overhead of less than 0.1% for 7,168 key bits.
Paper Structure (25 sections, 7 equations, 10 figures, 1 table)

This paper contains 25 sections, 7 equations, 10 figures, 1 table.

Table of Contents

  1. Introduction
  2. Background and Related Work
  3. IP Protection for AI Models.
  4. Transformer Architecture.
  5. Outliers in GenAI Models.
  6. Threat Model.
  7. Locking Methodology
  8. Overview
  9. Key Embedding
  10. Locking Mechanism.
  11. Identify Protected Neurons.
  12. Key Obfuscation
  13. Permutation of Outliers.
  14. Rotation of Features.
  15. Insertion of Keys.
  16. ...and 10 more sections

Figures (10)

  • Figure 1: Workflow of the LLA model locking framework.
  • Figure 2: (a) Architecture of a transformer block. (b) Simplified illustration of the proposed locking mechanism. LLA embeds key bits into permutation modules inserted before the down-projection layer, which shuffle intermediate values to alter the model’s functionality.
  • Figure 3: (a) Feature outliers are prominent before the application of $\mathbf{R}$; (b) Feature outliers are eliminated after the application of $\mathbf{R}$.
  • Figure 4: Schematic of a systolic AI accelerator that supports model locking.
  • Figure 5: Pre-attack locking effectiveness: LLA vs. HPNN.
  • ...and 5 more figures