Search papers, labs, and topics across Lattice.
This paper introduces SILK, a novel integrity mechanism designed to address the time-of-check-to-time-of-use (TOCTOU) gap in root-of-trust (RoT) protected AI systems by verifying the integrity of weights at the final pre-compute boundary. By utilizing quantized-weight least significant bits (LSBs) as secret-keyed integrity bits and chaining dependencies across weight bytes, SILK ensures that any local modification triggers multiple integrity checks, significantly enhancing security. The method achieves a minimal quality loss across various models while maintaining high throughput and low area cost, demonstrating its effectiveness in safeguarding AI systems against tampering during weight transmission.
SILK detects every instance of stream modification in functional attacks while limiting quality loss to less than 0.76 percentage points across CNNs and 0.17 perplexity in LLMs.
Root-of-trust (RoT) authentication verifies a DNN model at load time, but weights may subsequently traverse DRAM, DMA, interconnect, and prefetch paths before reaching the compute engine. Post-verification tampering along this path can therefore alter the weights actually consumed while leaving the authenticated model image unchanged, creating a time-of-check-to-time-of-use (TOCTOU) integrity gap. We present SILK (Streaming Inline Lightweight Keying), an in-place integrity mechanism that verifies the weight stream at the final pre-compute boundary. SILK repurposes quantized-weight LSBs as secret-keyed integrity bits and chains dependencies across weight bytes, so a local modification perturbs multiple integrity checks. A lightweight streaming checker recomputes these checks without separate authentication tags and uses commit gating to prevent unverified weights from reaching computation. Under a secure pseudorandom function (PRF), the forgery probability decreases exponentially with the number of affected checks, and measured miss rates closely track the analytical bound. SILK detects every stream-modifying instance in our functional attack suite. For INT8, it limits quality loss to at most 0.76 pp across evaluated CNNs and 0.17 perplexity across eight LLMs, while INT4 and MXFP4 provide a configurable security-quality tradeoff through check sparsity. On a Xilinx ZCU102, the synthesized reference pipelined implementation sustains 756 MB/s at only 1.00% of the equivalent area cost of a Caliptra 2.x RoT, while a configuration with a conservative per-attempt forgery bound of 2^-128 still sustains 678 MB/s at 6.15% of the RoT cost.
