Modern Machine Learning models are expensive IP and business competitiveness
often depends on keeping this IP confidential. This in turn restricts how these
models are deployed -- for example it is unclear how to deploy a model
on-device without inevitably leaking the underlying model. At the same time,
confidential computing technologies such as Multi-Party Computation or
Homomorphic encryption remain impractical for wide adoption. In this paper we
take a different approach and investigate feasibility of ML-specific mechanisms
that deter unauthorized model use by restricting the model to only be usable on
specific hardware, making adoption on unauthorized hardware inconvenient. That
way, even if IP is compromised, it cannot be trivially used without specialised
hardware or major model adjustment. In a sense, we seek to enable cheap locking
of machine learning models into specific hardware. We demonstrate that locking
mechanisms are feasible by either targeting efficiency of model
representations, such making models incompatible with quantisation, or tie the
model's operation on specific characteristics of hardware, such as number of
cycles for arithmetic operations. We demonstrate that locking comes with
negligible work and latency overheads, while significantly restricting
usability of the resultant model on unauthorized hardware.

通过限制模型在特定硬件上的使用，防止未经授权的模型使用，本文研究了机器学习特定机制的可行性，展示了锁定机制的可行性，并证明锁定具有可忽略的工作和延迟开销，同时显著限制了在未授权硬件上使用模型的可行性。