Toward Deployable Hardware Roots of Trust for Edge AI: Software PUFs and Their Trade-offs

Abstract

Deploying AI at the edge increases the need for security features on existing devices. When physical access to the device is available, storing secret keys in non-volatile memory is vulnerable. Physical unclonable functions (PUFs) address this by exploiting the unique yet repeatable characteristics of each device, but conventional implementations require design-stage modifications, making them inapplicable to a vast number of existing devices already manufactured. Recently, software PUFs have emerged as an alternative approach, leveraging analog characteristics exposed through software-only interfaces to derive unique responses, without post-fabrication changes. Since edge AI hardware is bound to long operational lifespans, this offers clear economic and engineering value. Existing research on software PUFs remains fragmented. It lacks a holistic review of the trade-offs among choices of components used as entropy sources and software methods to expose analog characteristics. This gap hinders assessing feasibility, comparing approaches, and identifying open challenges towards a hardware root of trust in existing devices. This paper surveys 37 existing software PUF works and compares them against the requirements of on-device model protection: boot-time versus runtime key derivation, and response latency. It analyzes trade-offs, outlines four key challenges that current software PUFs face for edge AI deployment, and highlights promising directions for overcoming barriers to real-world adoption.