Model‐Inversion‐Resistant Physical Unclonable Neural Network Using Vertical NAND Flash Memory

ABSTRACT The growing use of neural networks in privacy‐sensitive applications necessitates architectures that inherently protect both data and model integrity. We present a model‐inversion‐resistant physical unclonable neural network (PUNN) implemented on commercial vertical NAND (V‐NAND) flash memory. A physical unclonable layer generated through weak gate‐induced drain‐leakage erase exploits intrinsic device‐level variations to create chip‐unique conductance patterns that are concealable and unreproducible. Training is achieved using the forward‐forward (FF) algorithm, which eliminates the need for backward propagation and is fully compatible with the common‐source‐line structure of V‐NAND arrays. The resulting V‐NAND FF‐PUNN demonstrates hardware‐rooted resistance to model‐cloning and model‐inversion attacks, maintaining high accuracy under forward‐only learning. When the trained network weights are transferred to another chip, inference accuracy collapses due to chip‐specific randomness, confirming intrinsic non‐clonability. Furthermore, when applied to the MIT‐BIH electrocardiogram dataset, the system achieves competitive classification accuracy on real health data while entirely blocking data reconstruction by model‐inversion. This work establishes a scalable framework for secure, energy‐efficient, and privacy‐preserving neural computing directly on commercial flash memory.