This paper proposes GuardNN, a secure DNN accelerator that provides hardware-based protection for user data and model parameters even in an untrusted environment. GuardNN shows that the architecture and protection can be customized for a specific application to provide strong confidentiality and integrity guarantees with negligible overhead. The design of the GuardNN instruction set reduces the TCB to just the accelerator and allows confidentiality protection even when the instructions from a host cannot be trusted. GuardNN minimizes the overhead of memory encryption and integrity verification by customizing the off-chip memory protection for the known memory access patterns of a DNN accelerator. GuardNN is prototyped on an FPGA, demonstrating effective confidentiality protection with ~3% performance overhead for inference.

翻译：本文提议了 GuardNNN, 这是一个安全的 DNNN 加速器, 为用户数据和模型参数提供硬件保护, 即使在不受信任的环境中也是如此。 GuardNNN 显示, 结构和保护可以针对特定的应用程序进行定制, 以提供可忽略不计的间接费用的强有力的保密和完整性保障。 GuardNN 指令的设计将TCB 降低为仅是加速器, 并允许保密保护, 即使主机的指示无法信任。 GuardNN 将存储加密和完整性核查的间接费用降到最低程度, 为已知的 DNN 加速器的内存访问模式定制离芯内存保护 。 GuardNN 以 FPGA 为原型, 展示有效的保密保护, 使用~ 3% 的性能管理器进行推断。