Locking Machine Learning Models into Hardware - Feasibility of Hardware-Based Access Restriction - Abstract

Aug 3, 2026

Upload by Levi

Modern machine learning models represent valuable IP and business advantage, yet deploying them on-device risks inevitable leakage through reverse engineering or unauthorized execution. Confidential computing approaches like multi-party computation and homomorphic encryption remain difficult to adopt widely. The paper proposes ML-specific locking mechanisms that restrict model usability to authorized hardware, making unauthorized deployment inconvenient or impossible even if the model is compromised. Experiments show locking can be achieved by enforcing hardware-dependent representations or binding computation to hardware characteristics with negligible overhead.

LanguageEnglish

CategoryTechnology

FormatPDF

Pages19

Reading Time48 min

AccessFree to download

Introduction

Motivation: IP leakage and governance challenges

Existing approaches and their limitations

Proposed approach: ML hardware locking

Core idea and threat model

Locking mechanisms

Representation incompatibility with quantization

Hardware-aware computation tying

Locking Machine Learning Models into Hardware arXiv :2405 .20990v2 [ cs .CR] 8 Mar 2025 Eleanor Clifford* Imperial College London [eleanor.clifford@cl.cam.ac.uk](eleanor.clifford@cl.cam.ac.uk) Adhithya Saravanan* University of Cambridge [aps85@cam.ac.uk](aps85@cam.ac.uk) Yiren Zhao Imperial College London [a.zhao@imperial.ac.uk](a.zhao@imperial.ac.uk) Robert Mullins University of Cambridge [robert.mullins@cl.cam.ac.uk](robert.mullins@cl.cam.ac.uk) Abstract—Modern machine learning (ML) models are expensive IP and business competitiveness often depends on keeping this IP confidential. This in turn restricts how these models are deployed; for example, it is unclear how to deploy a model on-device without inevitably leaking the underlying model. At the sametime, confidential computing technologies such as multi-party computation or homomorphic encryption remain impractical for wide adoption. In this paper, we take a different approach and investigate the feasibility of ML-specific mechanisms that deter unauthorized model use by restricting the model to only be usable on specific hardware, making adoption on unauthorized hardware inconvenient. That way, even if IP is compromised, it cannot be trivially used without specialised hardware or major model adjustment. In a sense, we seek to enable cheap locking of machine learning models into specific hardware. We demonstrate that locking mechanisms are feasible by either targeting efficiency of model representations, making such models incompatible with quantization, or tying the model’s operation to specific characteristics of hardware, such as the number of clock cycles for arithmetic operations. We demonstrate that locking comes with negligible overheads, while significantly restricting usability of the resultant model on unauthorized hardware. Index Terms—machine learning, security, governance, hardware I. INTRODUCTION The monetary expenditures associated with developing machine learning (ML) models are increasing rapidly with the advent of large generative models. Models with over a trillion parameters are now being trained on web-scale data [1] . These models have become valuable Intellectual Property (IP) assets, yet ensuring their competitive edge remainsuncompromised when deployed on-device proves challenging. Competitors may reverse engineer the model’s architecture and parameters, redeploying it on their software and hardware stack. Concurrently, governance of Machine Learning models is a concern [2] . Especially in safety-critical applications, it maybe necessary to limit model execution to special authenticated settings. Here, we usually rely on hardware and software combinations to prevent model use on unverified platforms, which may lead to the potential misuse of the model. Existing ML governance and IP protection methods can be classified into two categories: namely policies and centralised serving. Policy-based methods focus on either access control or licensing. For example, accessing LLaMA models requires *Equal contribution Harry Langford* University of Cambridge [hjel2@cam.ac.uk](hjel2@cam.ac.uk) Cheng Zhang Imperial College London [cheng.zhang122@imperial.ac.uk](cheng.zhang122@imperial.ac.uk) Ilia Shumailov Google Deepmind [iliashumailov@google.com](iliashumailov@google.com) Jamie Hayes Google Deepmind [jamhay@google.com](jamhay@google.com) Specialised model cannot run or is inefficient on unauthorised hardware convert model into representations unique to hardware use hardware fingerprint to condition model Authorised hardware Unauthorised hardware Fig. 1. A high-level illustration of how ML Hardware Locking functions: the locked model resists efficient, or any, deployment by adversaries on unauthorized hardware stacks. This resistance occurs because unauthorized hardware devices inherently lack support for some hardware operation or are unable to match the hardware properties of the authorized hardware. user

FAQs

为什么在终端设备部署机器学习模型会面临IP泄露风险？

模型在终端部署时可能被对手反向工程其架构与参数，从而在自己的软件与硬件栈上重新部署，导致IP竞争优势受损。

为什么传统的保密计算技术难以广泛应用？

文中指出，多方计算或同态加密等保密计算技术仍不够实用，限制了其大规模采用。

论文提出的“硬件锁定”机制如何提高未授权使用的难度？

通过将模型限制为只能在特定硬件上可用，使得即使模型被盗或被逆向，未授权硬件上的部署会变得不可能或极其困难；可通过硬件相关表示或将计算绑定到硬件特性实现。

Aug 3, 2026

Upload by Levi