Securing On-device Transformer with Hardware Binding and Reversible Obfuscation

Peichun Hua; Hanxiu Zhang; Tuo Li; Yue Zheng

doi:10.1109/ACSAC67867.2025.00079

Published · ACSAC 2025

Securing On-device Transformer with Hardware Binding and Reversible Obfuscation

Peichun Hua, Hanxiu Zhang, Tuo Li, Yue Zheng

Read paper (PDF) Publication record Code Slides Video

Overview

This paper studies active intellectual-property protection for transformer models deployed on edge devices. It binds model execution to hardware using physical unclonable functions and reversible weight obfuscation.

Method

PUF-derived keys control Arnold’s Cat Map-based transformations of model weights. Authorized hardware reverses the transformation for inference, while use with an incorrect key degrades model accuracy. The scheme is applied without retraining the original model.

Evaluation

The paper evaluates inference overhead and resistance to retraining, random key guessing, and encrypted-layer leakage attacks under its stated threat model. Its software artifact received Available, Reviewed, and Reproducible badges, as recorded on the author’s publication list.

ISCAS 2026 live demonstration

Live Demonstration: Hardware-Bound IP Protection for OWL-ViT on Edge Devices

Peichun Hua, Hanxiu Zhang, Tuo Li, Yue Zheng, and Wenye Liu

The ISCAS 2026 paper demonstrates the ACSAC 2025 hardware-binding approach on OWL-ViT for open-vocabulary object detection on edge devices.

An NVIDIA Jetson Orin Nano performs inference while an Ultra96-V2 FPGA supplies an Arbiter PUF. Arnold’s Cat Map transforms attention weights, and row permutations transform feed-forward weights. A decrypt–infer–re-encrypt cycle restores and then re-obfuscates the weights.

Demo paper (PDF) Publication record Demo code

OWL-ViT hardware-binding setup: an Ultra96-V2 Arbiter PUF derives keys for reversible attention and feed-forward weight transformations; a Jetson Orin Nano runs authorized inference. The original figure includes a small performance table, transcribed below. — Hardware-bound OWL-ViT demonstration. The FPGA supplies the PUF-derived key, and the Jetson runs object detection. Extracted from Figure 1 of the ISCAS 2026 demo paper. ISCAS 2026, Figure 1

OWL-ViT demo: detection under obfuscation and authorized inference cost
Metric	Baseline	1 layer obfuscated	2 layers obfuscated
Detection mAP@0.5 (see note)	0.61	0.00	0.00
Authorized throughput (images/s)	10.69	8.58	7.41
Authorized time per image (s)	0.093	0.116	0.135
Authorized overhead factor	1.00×	1.24×	1.44×

Baseline is the unprotected model. For the obfuscated configurations, mAP is measured without the correct key; throughput, time, and overhead refer to authorized inference. The paper reports that the correct key restores original accuracy. Configuration: google/owlvit-base-patch32, a batch of eight images, and 20 Pascal VOC classes. Values are transcribed from the table embedded in Figure 1. ISCAS 2026, Figure 1 / Table 1

For batches of eight images and 20 Pascal VOC classes, obfuscating one or two selected layers reduces unauthorized mAP@0.5 from 0.61 to 0.00. Authorized throughput decreases by 19.7–30.7% in the reported configuration. The demonstration extends the related ACSAC 2025 hardware-binding work.

Demo paper citation

@inproceedings{hua2026live,
  title={Live Demonstration: Hardware-Bound IP Protection for OWL-ViT on Edge Devices},
  author={Hua, Peichun and Zhang, Hanxiu and Li, Tuo and Zheng, Yue and Liu, Wenye},
  booktitle={IEEE International Symposium on Circuits and Systems (ISCAS)},
  year={2026},
  pages={10-10},
  doi={10.1109/ISCAS66217.2026.11562768},
  organization={IEEE}
}

transformer security
hardware binding
physical unclonable functions
reversible obfuscation
model IP protection

Full paper citation

@inproceedings{hua2025securing,
  title={Securing On-device Transformer with Hardware Binding and Reversible Obfuscation},
  author={Hua, Peichun and Zhang, Hanxiu and Li, Tuo and Zheng, Yue},
  pages={956-972},
  booktitle={2025 IEEE Annual Computer Security Applications Conference (ACSAC)}, 
  year={2025},
  organization={IEEE},
  keywords={Deep learning;Computational modeling;Intellectual property;Transformers;Physical unclonable function;Hardware;Software;Data models;Protection;Software development management;Intellectual Property;Transformer;Model Stealing Attacks;Physical Unclonable Functions},
  doi={10.1109/ACSAC67867.2025.00079},
}