Hardware signatures enable tracing of stolen AI models after knowledge transfer
Hardware-Rooted PUF Fingerprinting for Device-Level Traceability in Knowledge Distillation
Cryptography and Security
Summary
When AI models are copied by training on outputs from an original model, it’s hard to know which device the copy came from. The authors created a way to embed unique device fingerprints, based on hardware features, into the original model’s output during training. This means any copied model will carry a hidden signature linking it back to the specific hardware it came from. Their method works across different types of AI models and is designed to be reliable even if the copied model is changed or noisy. This helps identify and trace stolen AI models to their source devices.
What this means in practice
- •For ai product developers: Identify specific devices responsible for leaked AI models by embedding hardware-based fingerprints during AI model training.
- •For hardware security teams: Integrate device-specific hardware signatures into AI workflows to track hardware-level identity in distributed machine learning deployments.
Authors
Ning Lyu, Yuntao Liu, Yonghong Bai, Zhiyuan Yan
Abstract
Knowledge distillation (KD) enables model transfer across heterogeneous platforms and deployment environments, yet it exposes proprietary models to distillation-based theft, where an adversary extracts intellectual property (IP) by training a student model on teacher outputs. Current defenses, such as software watermarking or hardware-based access control, either fail to survive the distillation process or lack the granularity to identify the specific device responsible for a leak. Aiming to provide post-theft accountability and traceability, we propose a novel fingerprinting framework that superimposes device-specific Physical Unclonable Function (PUF) signatures onto teacher logits during distillation. By utilizing signatures derived from Ring Oscillator (RO) PUFs measured on a Xilinx Zynq-7020 FPGA, we ensure that any student model trained via KD inherits a unique, hardware-linked identity. Our framework is architecture-agnostic, enabling reliable identity inheritance across heterogeneous structures, including Convolutional Neural Networks, Vision Transformers, and encoders. To ensure robust attribution, we implement a two-stage recovery pipeline consisting of a neural decoder and Hamming-distance refinement, maintaining high detection accuracy even under noisy conditions. Furthermore, we introduce a multi-level logit encoding scheme to support large-scale device deployment. Experimental results demonstrate that the embedded fingerprints are resilient against common post-distillation modifications. These results establish a practical system-level approach for enabling hardware-linked model traceability in distributed AI deployment environments.