Model Obfuscation

Alters the model's computational graph to hide its true architecture. Layer fusion merges consecutive operations like convolution, batch normalization, and activation into a single opaque kernel. Control flow flattening restructures the execution path into a flat dispatch loop, eliminating the conditional branching that reveals algorithmic logic. These transformations produce a model that is mathematically equivalent but structurally unrecognizable to static analysis tools.

Protects the model's internal representations during execution. Memory access obfuscation randomizes the pattern of reads and writes to prevent bus snooping from revealing parameter tensors. Bus encryption encrypts all data in transit between the processor and external DRAM, ensuring physical probes capture only ciphertext. Together, these techniques deny attackers the ability to reconstruct weights or activations through hardware side channels.

Translates native machine instructions into a custom, randomized bytecode executed by an embedded virtual machine. This virtualization obfuscation hides the original operations behind an interpreter layer, forcing a reverse engineer to first understand the custom VM architecture before any model logic can be analyzed. The technique is computationally expensive but provides strong protection against static disassembly and dynamic instrumentation.

Inserts conditional branches whose outcomes are predetermined at obfuscation time but are computationally difficult for a static analyzer to resolve. These opaque predicates create dead code paths that appear legitimate, bloating the control flow graph with misleading branches. An attacker must expend significant effort to distinguish real execution paths from decoys, dramatically slowing reverse engineering efforts.

Embeds integrity-checking routines that detect unauthorized modifications to the model or its runtime. Techniques include:

• Checksum verification of weight tensors before inference
• Zeroization triggers that irretrievably erase keys and parameters upon tamper detection
• Remote attestation protocols that cryptographically verify the trusted state of the execution environment before allowing model decryption

Anchors obfuscation to physical silicon through Trusted Execution Environments (TEEs) and Physically Unclonable Functions (PUFs). A TEE isolates model execution from the host OS, while a PUF derives a unique device-bound key from manufacturing variations. This binding ensures that even if an encrypted model artifact is copied, it cannot be decrypted or executed on unauthorized hardware.

A defensive discipline focused on thwarting attacks that aim to steal model functionality through black-box querying. While obfuscation hides the internals of a stolen artifact, extraction prevention stops the theft at the API boundary.

• Rate Limiting: Throttles query frequency to make extraction economically infeasible.
• Prediction Poisoning: Returns subtly incorrect outputs to degrade the clone's performance.
• Query Auditing: Detects structured, sequential probing patterns indicative of extraction.

A hardware-enforced secure area within a main processor that guarantees the confidentiality and integrity of code and data loaded inside it. TEEs isolate model inference from the host operating system, rendering memory scraping and runtime analysis ineffective.

• Intel SGX/TDX and AMD SEV are dominant implementations.
• Provides a secure enclave where even a compromised OS cannot inspect the model.
• Often combined with remote attestation to verify trustworthiness before decryption.

A cryptographic implementation designed to protect secret keys even when an attacker has full visibility into the execution environment and can observe or alter memory. This is the extreme case of obfuscation applied specifically to cryptographic operations.

• Merges the key with the algorithm itself, making extraction computationally hard.
• Protects model decryption keys in hostile environments like mobile apps.
• Relies on techniques like networked encoding and stateful transformations.

The practice of embedding an imperceptible, verifiable identifier into a neural network's weights or decision boundary to prove intellectual property ownership. This is a post-hoc forensic tool, not a prevention mechanism.

• White-box watermarking embeds a secret pattern directly into the weights.
• Black-box watermarking triggers specific outputs for a set of secret trigger inputs.
• Enables legal recourse and DMCA takedown requests against unauthorized copies.

A class of defenses that eliminate or mask physical information leakage—timing, power consumption, electromagnetic emanations—from a processor running model inference. Obfuscation is useless if an attacker can read the weights from a power trace.

• Constant-time execution eliminates timing side-channels.
• Power analysis countermeasures flatten consumption curves.
• Electromagnetic shielding blocks RF emanations from hardware accelerators.

A mathematical framework that injects calibrated noise into model training or outputs to provide provable guarantees against membership inference and data reconstruction. It complements obfuscation by protecting the training data, not just the model architecture.

• Defined by the privacy budget (ε) — lower values mean stronger privacy.
• Differentially Private Stochastic Gradient Descent (DP-SGD) clips and noises gradients.
• Prevents an attacker from determining if a specific record was in the training set.