Obfuscation of FSMs for Secure Outsourcing of Neural Network Inference onto FPGAs

Finite-state machine (FSM)-based networks are an alternative to implement neural networks (NNs) on hardware-constrained devices, such as field-programmable gate arrays (FPGAs), because this approach helps to synthesize complex multi-input functions needed for NN inference. Such FSM network, implemented according to the NN learning outcome, constitutes intellectual property (IP). Thus, it is necessary to prevent IP theft and its illegal use. This paper presents an obfuscation approach for locking of such FSM networks at the behavioral level of abstraction. The proposed technique is built on the encryption of both the state and the transition encoding, each with its unique key, known only to the IP provider. A steganography approach is used on top, to ensure that the message containing the secret key for unlocking does not capture the attacker's attention as target for inspection. The FSM-based NN works as intended only if the proper key is entered at runtime; otherwise, it will perform erroneous classification. We use Xilinx's Artix-7 FPGA board to demonstrate this locking approach. We also provide a scalability study on the hardware implementation.