SaTC 2.0: RES: From Optimization to Obfuscation: Reimagining Compilers as Security Primitives for DNN Binaries

AI models are increasingly deployed as machine-ready (compiled) software on phones, cloud servers, cars, and other devices. Translation of software into machine code (compilation) makes AI models run fast on many kinds of hardware, but it also creates a new risk: attackers can reverse engineer the program and recover the valuable model inside it. Such recovery exposes intellectual property, helps competitors copy costly engineering work, and enables stronger attacks because attackers gain detailed knowledge of the model. Current defenses often scramble programs in ways that slow them down, enlarge them, or change behavior, making them hard to use on mobile and embedded devices. The project's novelties are to turn the software translator (compiler) into a security tool and to use the natural unpredictability of the process of optimizing the compiler’s performance as a defense. The project's broader significance and importance are protecting deployed AI while preserving the performance in real software products. The project also creates open-source tools, educational materials, and training opportunities that strengthen the cybersecurity and the AI workforce in Louisiana. The project studies how deep neural network decompilers recover model structure and data from compiled executables, and develops compiler-based defenses that disrupt those recovery steps. The project models how loop transformations, tiling, and memory layout changes hide the regular patterns that decompilers rely on. The project develops quantitative measures of uncertainty, including adversarial search-space size, to estimate model’s recovery likelihood. The project also develops SecTuner, a security-aware auto-tuning framework that treats decompilation resistance as an optimization goal alongside performance. SecTuner uses randomized loop tiling and multi-objective optimization to choose efficient program versions that increase ambiguity for attackers. The expected advances include a foundation for compiler-induced uncertainty, practical compiler mechanisms for hardening neural network binaries, and reproducible benchmarks for future defenses. The work makes model theft harder without sacrificing practical performance. This award reflects NSF's statutory mission and has been deemed worthy of support through evaluation using the Foundation's intellectual merit and broader impacts review criteria.