Root-of-trust authentication for DNN models closes only the first half of the integrity loop. The authenticated model sits in secure storage. What the compute engine actually receives is a weight stream that has already traversed DRAM, DMA paths, and prefetch buffers after the authentication check completed. Tampered weights consumed after RoT sign-off leave the authenticated image unchanged. No current production inference pipeline detects this class of attack.
SILK (Streaming Inline Lightweight Keying) fixes this with a mechanism that requires no hardware changes and no separate authentication tags. Quantized weights already carry LSBs with limited information density. SILK repurposes those bits as secret-keyed integrity codes, chaining dependencies across weight bytes so that modifying any byte perturbs multiple downstream checks. A streaming checker positioned at the final pre-compute boundary recomputes these checks in flight and uses commit gating to hold weights out of the compute engine until they pass. The overhead is bounded by the weight stream bandwidth that is already flowing; there is no re-verification cycle on top of inference.
Inference hardware teams shipping under IEC 62443 or FIPS constraints now have a concrete mechanism to close the attestation-to-execution gap without adding latency or silicon area for a second authentication path. The practical action is to add SILK to the hardware security requirements document for the next tape-out cycle, before the firmware team designs the DMA path around a model that assumes RoT is sufficient. The field report that identifies a gap this clean rarely arrives before a product is already in deployment.