White-Box Cryptography

The foundational primitive that replaces all internal operations with randomized, functionally equivalent look-up tables. Instead of computing XOR or S-box operations directly, the algorithm uses encoded tables that map from a randomized input encoding to a randomized output encoding. Each table's domain and range are scrambled with secret, invertible bijections, making the intermediate values statistically independent of the original cipher state. The composition of two encoded tables cancels out the intermediate encoding, preserving the correct cryptographic result while never revealing the raw key or data.

Transforms the entire cipher into a single, massive network of interconnected look-up tables with no visible algorithmic structure. The original cipher's rounds, key schedule, and data path are dissolved into a flat graph of table look-ups. Each table consumes encoded outputs from its predecessors and produces encoded inputs for its successors. This eliminates the concept of 'rounds' or 'key addition' from the implementation, forcing an attacker to analyze the entire monolithic network rather than isolating individual cryptographic steps.

Wraps the entire white-box implementation with input and output transformations that must be canceled by the surrounding application. The implementation does not directly accept plaintext or produce ciphertext. Instead, it expects data pre-transformed by a secret function and produces output that requires post-transformation. This forces an attacker who extracts the white-box to integrate it into a custom application that replicates the external encoding logic, significantly complicating code-lifting attacks where the entire implementation is stolen and reused.

Injects dummy operations, dead code paths, and redundant state variables into the table network to expand the search space for an attacker. The implementation is padded with spurious look-up tables that consume and produce data indistinguishable from legitimate intermediate values. These decoys are interleaved with genuine operations, increasing the implementation's memory footprint and computational complexity without affecting the final output. The technique forces a reverse engineer to perform computationally expensive slicing and dependency analysis to separate signal from noise.

Extends internal encodings by mapping the cipher's state to a higher-dimensional vector space using non-surjective encodings. The state is embedded in a larger space with additional degrees of freedom that carry random, non-functional data. Operations are redesigned to preserve the functional projection while scrambling the injected randomness. This makes the algebraic structure of the state space opaque to algebraic cryptanalysis and prevents an attacker from correlating state bits across operations to recover the original cipher structure.

Flattens the execution flow of the table look-up sequence into a dispatch-driven state machine. Instead of sequential table calls, a central dispatcher uses an encoded state variable to determine the next table index. The control flow graph is replaced with a flat loop containing a switch statement over an opaque predicate, making static analysis of execution order computationally intractable. Combined with dummy dispatches that lead to dead-end table chains, this prevents an attacker from reconstructing the logical sequence of cryptographic operations.

A class of defenses that eliminate or mask physical information leakage from processors running model inference. Even with white-box protection, an attacker can observe:

• Timing variations: Execution time differences that reveal branch conditions
• Power consumption: Current draw patterns that expose computational operations
• Electromagnetic emanations: Radio frequency signals that leak data values

Mitigations include constant-time programming, power balancing circuits, and electromagnetic shielding to close these physical side channels.

A hardware-enforced secure area within a main processor that guarantees code and data confidentiality. TEEs complement white-box cryptography by providing:

• Memory encryption: All data outside the CPU cache remains encrypted
• Remote attestation: Cryptographic proof that the environment hasn't been tampered with
• Isolated execution: The host OS cannot access TEE memory

Intel SGX and ARM TrustZone are the dominant implementations, though both have faced side-channel vulnerabilities requiring additional hardening.

A cryptographic method enabling computation directly on encrypted data without decryption. Unlike white-box cryptography which protects keys, homomorphic encryption protects both:

• Input privacy: The model never sees the user's plaintext data
• Output privacy: The user receives an encrypted result only they can decrypt

The trade-off is computational overhead—fully homomorphic encryption operations are typically 1,000x to 1,000,000x slower than plaintext equivalents, limiting practical deployment to latency-tolerant applications.

Integrity-checking mechanisms embedded within a model or its runtime that detect unauthorized modifications. Anti-tampering works alongside white-box cryptography to create a defense-in-depth posture:

• Checksum verification: Periodic integrity checks of code and data segments
• Debugger detection: Identifying when a debugger is attached to the process
• Zeroization triggers: Immediately erasing keys and weights upon tamper detection

These techniques assume the attacker has physical access and can modify the binary, making them essential for deployed edge AI systems.

A cryptographic protocol that distributes computation across multiple non-colluding parties who jointly compute an inference result without revealing their private inputs. SMPC offers an alternative to white-box cryptography by:

• Eliminating single points of compromise: No single node holds the complete model
• Providing information-theoretic security: Security doesn't rely on computational hardness assumptions
• Enabling collaborative inference: Multiple organizations can contribute to a computation without exposing proprietary models

The primary limitation is network bandwidth—SMPC protocols require extensive communication rounds between parties.