Attack on a PUF-based Secure Binary Neural Network

Binarized Neural Networks (BNNs) deployed on memristive crossbar arrays provide energy-efficient solutions for edge computing but are susceptible to physical attacks due to memristor nonvolatility. Recently, Rajendran et al. (IEEE Embedded Systems Letter 2025) proposed a Physical Unclonable Function (PUF)-based scheme to secure BNNs against theft attacks. Specifically, the weight and bias matrices of the BNN layers were secured by swapping columns based on device's PUF key bits. In this paper, we demonstrate that this scheme to secure BNNs is vulnerable to PUF-key recovery attack. As a consequence of our attack, we recover the secret weight and bias matrices of the BNN. Our approach is motivated by differential cryptanalysis and reconstructs the PUF key bit-by-bit by observing the change in model accuracy, and eventually recovering the BNN model parameters. Evaluated on a BNN trained on the MNIST dataset, our attack could recover 85% of the PUF key, and recover the BNN model up to 93% classification accuracy compared to the original model's 96% accuracy. Our attack is very efficient and it takes a couple of minutes to recovery the PUF key and the model parameters.

Key Contributions

Demonstrates that the PUF-based BNN security scheme (column-swapping by PUF key bits) is vulnerable to a differential cryptanalysis-style attack
Proposes an efficient bit-by-bit PUF key recovery algorithm that observes changes in model accuracy upon key-bit flipping
Achieves 85% PUF key recovery and 93% classification accuracy reconstruction (vs. 96% original) on MNIST in minutes

🛡️ Threat Analysis

Model Theft

The attack's explicit goal is recovering the secret weight and bias matrices of a BNN whose IP is protected by a PUF-based column-permutation scheme. By recovering 85% of the PUF key, the attacker reconstructs a functionally equivalent clone (93% vs original 96% accuracy), directly achieving model theft.