ModelDNA: Identifying Open-Source AI Architectures from Compiled Models

Introduction

In this article, we introduce ModelDNA, a new tool designed to identify open-source AI architectures from compiled models.

When deploying AI models on edge devices or on-premises, low-level formats such as TensorRT are commonly used to improve inference speed and reduce memory consumption. During this process, the original model is compiled into a hardware-specific representation optimized for execution.

Unlike formats such as ONNX or PyTorch, which preserve a graph structure that can be visualized and analyzed using tools like netron.app, compiled formats are generally considered opaque and difficult to interpret.

Our work challenges this assumption.

TensorRT

We chose to focus our research on TensorRT, the inference optimization and deployment framework of NVIDIA.

TensorRT is one of the most widely used AI acceleration frameworks and enables developers to compile models from frameworks such as PyTorch and ONNX into highly optimized binaries for NVIDIA hardware. These optimizations target a wide range of devices, from data-center GPUs such as the H100 to embedded platforms such as the Jetson family.

Compilation is the process of transforming a model into a format that can be executed efficiently by a specific hardware target. In the TensorRT ecosystem, this process produces a .engine file containing all the information required by the GPU to execute the model.

An important characteristic of TensorRT engines is that they are hardware-specific. An engine generated for a desktop RTX GPU cannot be executed directly on a Jetson device, and vice versa.

Is a TensorRT Engine Human-Readable?

TensorRT engine files are generally assumed to be non-interpretable. NVIDIA does not publicly document the internal structure of .engine files, and the format itself varies across hardware generations and TensorRT versions.

However, a detailed examination of these files revealed something unexpected.

By analyzing engine files at the hexadecimal level, we discovered that significant portions of the model’s parameters remain identifiable. In particular, weights and biases can often be located and extracted directly from the binary representation.

This means that, despite the absence of documentation, valuable information about the original model remains accessible.

Can an Engine Reveal My Architecture?

Suppose we are able to extract the weights and biases from a TensorRT engine file. Even without reconstructing the entire model, these parameters provide valuable metadata such as tensor dimensions and layer sizes.

We hypothesized that this information forms a unique architectural fingerprint (similar to DNA!).

If such a fingerprint can be extracted from an unknown model, it can then be compared against a database of known architectures to identify similarities and potentially determine the original model architecture.

This idea forms the foundation of ModelDNA.

ModelDNA

We implemented ModelDNA and made it available here. If you would like to experiment with it yourself, you can follow the setup instructions provided in the repository.

Important: the current version supports only models compiled on the NVIDIA Jetson Orin Nano hardware.

NVIDIA Jetson Devices

The NVIDIA Jetson family is a series of chips designed for edge AI and embedded systems.

Built around NVIDIA GPU architectures, Jetson devices provide significant computational power in a small hardware, enabling real-time inference, computer vision, and deep learning applications directly on-device.

Their popularity stems from their ability to bridge the gap between high-performance data-center GPUs and the constraints of embedded hardware. This makes them particularly attractive for robotics, autonomous systems, smart cameras, and industrial applications.

Developers also benefit from NVIDIA’s mature software ecosystem, including CUDA and TensorRT, which simplifies AI deployment.

Extracting an Architecture Signature

As discussed earlier, TensorRT engine files differ across hardware platforms. At present, ModelDNA supports engines generated for the Jetson Orin Nano, one of the most widely used deployment platforms for edge AI.

Although NVIDIA does not provide documentation describing the internal layout of these engine files, a combination of pattern analysis, and heuristics allowed us to identify where parameters are stored and how they are represented.

The resulting structure is illustrated below:

Figure 2: TensorRT engine file structure in hexadecimal.

By traversing this structure, we can locate weights and biases stored directly within the engine.

It is important to note that TensorRT performs numerous graph optimizations during compilation. These optimizations may modify the structure of the original network through techniques such as layer fusion, kernel fusion, and operator elimination.

As a consequence, the tensors found inside the engine do not necessarily correspond one-to-one with those found in the original model (like in ONNX).

In our attack setting, we consider that the attacker can steal the .engine file and have no access to the original model. For this reason, all signatures in our database are generated from TensorRT engine files rather than from the original model representations.

Jaccard Similarity

The extracted architecture signature is represented as a set of tensor dimensions. Since we cannot guarantee that tensors appear in a meaningful order within the engine file, the signature is treated as an unordered set.

For example:

To compare two signatures, we use the Jaccard similarity coefficient:

where:

• \(S_k\) is the signature of a known model
• \(S_u\) is the signature extracted from an unknown model

A higher score indicates a stronger architectural similarity.

Example: Identifying an Unknown Architecture

To demonstrate the effectiveness of ModelDNA, we conducted an experiment using a modified version of ResNet-50.

ResNet-50 is a widely used computer vision architecture with a highly distinctive structure. For this experiment, we compiled a variant operating on an input resolution of 300×300, whereas the standard configuration uses 224×224 inputs.

Assume that we only possess the TensorRT engine file and have no prior information about the original architecture.

We then compare its extracted signature against the signatures stored in our database, including a standard ResNet-50 compiled with a 224×224 input size.

Running the following command:

  python ModelDNA-cli.py --verbose resnet50_300.engine

produces a ranked list of the most similar architectures.

Figure 3: Top 3 models most similar to ours are resnet.

As expected, the unknown model is correctly identified as being closest to ResNet architectures. Furthermore, ResNet-50 achieves a higher similarity score than ResNet-101 or ResNet-32, demonstrating that the extracted signature captures meaningful architectural characteristics.

Are You Vulnerable?

If you are fine-tuning an open-source model, then the answer is yes.

Conclusion

Compiling a model into a TensorRT engine is often perceived as a form of protection because the resulting file is not directly interpretable.

Our research demonstrates that this assumption is incorrect.

As long as a GPU can execute a model, the information required for execution must be present somewhere in the file. Consequently, an attacker is able to recover meaningful information about the original network.

While ModelDNA focuses on TensorRT, the approach is largely inference-framework agnostic. In principle, it can be extended to other deployment formats, considering that model parameters (weights and biases) can be extracted from the compiled file.

The AI protection of Skyld helps you to protect the parameters of an AI model (weights) against extraction before and during the model execution, using mathematical transformations to keep the model weights confidential.