A PUF-Based Approach for Copy Protection of Intellectual Property in Neural Network Models

We present a dual-locking method for securing trained neural networks that combines key-driven index permutation with PIN-based watermarking based on Sparse Quantization Index Modulation (QIM). Cryptographic randomness is introduced by independently applying a uniform random permutation to each row of adaptively selected index vectors. A robust blind binary watermark is then embedded into the bias coefficients by modulating their quantized values, binding the network to a user-defined Personal Identification Number (PIN). Without the correct key, the network retains its architecture but becomes functionally impaired due to disrupted internal representations. Inverse permutation fully restores the original model accuracy, while the embedded watermark remains imperceptible and enables blind verification of key association and model authorship. To improve both locking effectiveness and recoverability, an adaptive key selection strategy redistributes high-magnitude weights to low-sensitivity positions and vice versa, increasing degradation in the locked state while preserving full recovery. Experiments on MNIST, CIFAR-10/100, and ImageNet-1K using fully connected networks, ResNet CNNs, and transformer architectures show that locking reduces accuracy below 10%, and even below 0.5% for CNNs, while the correct key fully restores performance. The watermark introduces no measurable accuracy degradation and reliably authenticates ownership. Analysis of embedding distributions across CNNs and transformers further indicates potential diagnostic value for identifying undertrained or suboptimally designed models. The proposed approach therefore provides simultaneous model protection, recovery, and ownership verification.

Foundation models are deep neural networks (such as GPT-5, Gemini3, and Opus4) trained on large datasets that can perform diverse downstream tasks -- text and code generation, question answering, summarization, image classification, and so on. The philosophy of foundation models is to put effort into a single, large (${\sim}10^{12}$-parameter) general-purpose model that can be adapted to many downstream tasks with no or minimal additional training. We argue that the rise of foundation models presents an opportunity for hardware engineers: in contrast to when different models were used for different tasks, it now makes sense to build special-purpose, fixed hardware implementations of neural networks, manufactured and released at the roughly 1-year cadence of major new foundation-model versions. Beyond conventional digital-electronic inference hardware with read-only weight memory, we advocate a more radical re-thinking: hardware in which the neural network is realized directly at the level of the physical design and operates via the hardware's natural physical dynamics -- Physical Foundation Models (PFMs). PFMs could enable orders-of-magnitude advantages in energy efficiency, speed, and parameter density. For ${\sim}10^{12}$-parameter models, this would both reduce the high energy burden of AI in datacenters and enable AI in edge devices that today are power-constrained to far smaller models. PFMs could also enable inference hardware for models much larger than current ones: $10^{15}$- or even $10^{18}$-parameter PFMs seem plausible by some measures. We present back-of-the-envelope calculations illustrating PFM scaling using an optical example -- a 3D nanostructured glass medium -- and discuss prospects in nanoelectronics and other physical platforms. We conclude with the major research challenges that must be resolved for trillion-parameter PFMs and beyond to become reality.

Physical neural networks (PNNs) leverage device physics in electronics, optics, and related domains to enable energy-efficient neural networks. Broken-isomorphism PNNs replace linear operations with multivariate physical transformations, modifying how input signals are mapped to device variables. We exploit network architectures emerging from these mappings by treating the routing between signals and input variables of physical devices as trainable parameters. This approach expands device-level tunability of the physical transformations while, at the system level, demonstrating improved expressivity of PNNs with negligible additional inference overhead. This discrete routing is optimized by training a categorical distribution using Gumbel-Softmax reparametrization. We evaluate this approach using experimentally calibrated differentiable models of multivariate electronic RNPUs for MNIST and CIFAR-10 classification. Using variable selection, we improve the MNIST classification accuracy for a small CNN model from 94.5% to 96.9% and the accuracy of CIFAR-10 from 62.8% to 68.0%. Our method uniquely leverages the induced biases of broken-isomorphism PNN architectures, paving the way towards more efficient physics-based neural network inference.