Satc 2.0: RES: from optimization to obfuscation: reimagining compilers as security primitives for DNN binaries

The National Science Foundation Division of Computer and Network Systems awarded Tulane University $599,936 on October 1, 2026, under the Computer and Information Science and Engineering program (CFDA 47.070) to develop compiler-based defenses against reverse engineering of deployed deep neural network binaries.

The project develops techniques to protect AI models compiled into machine code on mobile devices, cloud servers, embedded systems, and other hardware by leveraging compiler optimization as a security primitive. Current defenses scramble programs in ways that degrade performance, enlarge executables, or alter behavior—making deployment on resource-constrained devices impractical. The research models how deep neural network decompilers recover model structure and data from compiled executables and designs compiler-based obfuscation through loop transformations, tiling, and memory layout changes to disrupt recovery. The project develops quantitative uncertainty measures, including adversarial search-space size, to estimate model recovery likelihood and builds SecTuner, a security-aware auto-tuning framework that treats decompilation resistance as an optimization goal alongside performance, using randomized loop tiling and multi-objective optimization to select compiler parameters.

The project runs through September 30, 2029, with work performed in New Orleans, Louisiana. Beyond technical outputs, the project creates open-source tools, educational materials, and training opportunities to strengthen cybersecurity and AI workforce development in Louisiana.

Abstract

AI models are increasingly deployed as machine-ready (compiled) software on phones, cloud servers, cars, and other devices. Translation of software into machine code (compilation) makes AI models run fast on many kinds of hardware, but IT also creates a new risk: attackers can reverse engineer the program and recover the valuable model inside IT. Such recovery exposes intellectual property, helps competitors copy costly engineering work, and enables stronger attacks because attackers gain detailed knowledge of the model. Current defenses often scramble programs in ways that slow them down, enlarge them, or change behavior, making them hard to use on mobile and embedded devices. The project's novelties are to turn the software translator (compiler) into a security tool and to use the natural unpredictability of the process of optimizing the compiler?s performance as a defense. The project's broader significance and importance are protecting deployed AI while preserving the performance in real software products. The project also creates open-source tools, educational materials, and training opportunities that strengthen the cybersecurity and the AI workforce in louisiana. The project studies how deep neural network decompilers recover model structure and data from compiled executables, and develops compiler-based defenses that disrupt those recovery steps. The project models how loop transformations, tiling, and memory layout changes hide the regular patterns that decompilers rely on. The project develops quantitative measures of uncertainty, including adversarial search-space size, to estimate model?s recovery likelihood. The project also develops sectuner, a security-aware auto-tuning framework that treats decompilation resistance as an optimization goal alongside performance. Sectuner uses randomized loop tiling and multi-objective optimization to choose efficient program versions that increase ambiguity for attackers. The expected advances include a foundation for compiler-induced uncertainty, practical compiler mechanisms for hardening neural network binaries, and reproducible benchmarks for future defenses. The work makes model theft harder without sacrificing practical performance. This award reflects NSF's statutory mission and has been deemed worthy of support through evaluation using the foundation's intellectual merit and broader impacts review criteria.- subawards are not planned for this award.