Systems and methods for a full-stack obfuscation framework to mitigate neural network architecture theft

Abstract

A full-stack neural network obfuscation framework obfuscates a neural network architecture while preserving its functionality with very limited performance overhead. The framework includes obfuscating parameters or 'knobs', including layer branching, layer widening, selective fusion and schedule pruning, that increase the number of operators, reduce/increase the latency, and number of cache and DRAM accesses. In addition, a genetic algorithm-based approach is adopted to orchestrate the combination of obfuscating knobs to achieve the best obfuscating effect on the layer sequence and dimension parameters so that the architecture information cannot be successfully extracted.