Software physical unclonable functions secure existing edge ai devices
Toward Deployable Hardware Roots of Trust for Edge AI: Software PUFs and Their Trade-offs
Cryptography and Security
Summary
Devices that run AI at the edge face risks if secret keys are stored in memory, as attackers can physically access them. The authors review a special security method called software physical unclonable functions (PUFs), which use unique physical properties of devices without needing hardware changes. They analyze many existing methods, compare their strengths and weaknesses, and point out challenges to using them for protecting AI models on devices over time. This helps understand how software PUFs can offer security for AI devices without redesigning the hardware.
What this means in practice
- •For embedded systems engineers: Identify software-based hardware security options to protect edge AI devices without redesigning hardware components.
- •For device security teams: Evaluate software PUF trade-offs to implement robust key storage methods for long-lasting edge AI products.
A survey. It maps existing work.
Authors
Yilin Li, Farhad Merchant
Abstract
Deploying AI at the edge increases the need for security features on existing devices. When physical access to the device is available, storing secret keys in non-volatile memory is vulnerable. Physical unclonable functions (PUFs) address this by exploiting the unique yet repeatable characteristics of each device, but conventional implementations require design-stage modifications, making them inapplicable to a vast number of existing devices already manufactured. Recently, software PUFs have emerged as an alternative approach, leveraging analog characteristics exposed through software-only interfaces to derive unique responses, without post-fabrication changes. Since edge AI hardware is bound to long operational lifespans, this offers clear economic and engineering value. Existing research on software PUFs remains fragmented. It lacks a holistic review of the trade-offs among choices of components used as entropy sources and software methods to expose analog characteristics. This gap hinders assessing feasibility, comparing approaches, and identifying open challenges towards a hardware root of trust in existing devices. This paper surveys 37 existing software PUF works and compares them against the requirements of on-device model protection: boot-time versus runtime key derivation, and response latency. It analyzes trade-offs, outlines four key challenges that current software PUFs face for edge AI deployment, and highlights promising directions for overcoming barriers to real-world adoption.