Researchers from Peking University in Beijing, China, working with the Beijing Advanced Innovation Center for Integrated Circuits, have proposed a protection framework for RRAM-based deep neural network (DNN) accelerators. In this framework, the researchers split accelerator security into two distinct levels. The framework, called OmniGuard, achieves a 1.33x to 4.38x speedup and 1.26x to 2.65x power savings, with a reported 5% energy overhead and 3% area overhead.
RRAM-based computing-in-memory (CIM) accelerators have become one of the mainstream options for running neural network inference on edge devices, as performing the multiply-accumulate operation inside the memory array itself avoids the data movement that dominates the energy budget of conventional von Neumann designs. But edge hardware sits in the field, physically accessible to whoever holds it, and the trained model weights programmed into the RRAM array are usually the most valuable asset on the chip. The researchers note that these security vulnerabilities are a real obstacle to deploying RRAM-based accelerators commercially.
The difficulty is that the usual defense, encrypting the stored data, works against the reason for using CIM in the first place. Conventional memory encryption assumes data is read out and decrypted before anything is computed on it. In a CIM accelerator the weights are never read out - the computation happens in place, on the analog conductance values held in the crossbar. The team argues that existing work on protecting RRAM accelerators is single-level, and as a result each approach ends up compromising on one axis or another: a narrow protection scope, a rigid method that does not generalize across accelerator designs, or a hit to computational efficiency.
To get at this systematically, the researchers first built graph-based representations of both the accelerators and the attacks against them, and used that analysis to partition accelerator security into two levels: on-chip security, covering data held and processed inside the accelerator, and off-chip security, covering data moving between the accelerator and external memory. OmniGuard then applies a different mechanism at each level.
At the on-chip level, OmniGuard uses what the team calls a bit-grained shuffle, permuting the stored data at bit granularity so that an attacker who physically reads the array recovers scrambled values rather than usable weights. The permutation is implemented with lightweight Benes networks, a class of rearrangeable switching network that can produce arbitrary permutations from a small number of stages, which keeps the area cost down and, importantly, allows the accelerator to carry on performing in-memory computation on the shuffled data. At the off-chip level, the team implements the AES algorithm using an RRAM-based AES engine, running the cipher in the RRAM array itself rather than in a dedicated digital block. This is where the reported speedup and power savings come from, and it means encryption can be added to the data path without a large separate crypto accelerator.
The combination gives protection across both levels while leaving the CIM capability intact, which is the trade-off single-level schemes have generally had to make. With a 5% energy overhead and 3% area overhead, the cost is low enough to be plausible for the power and area constrained edge devices that RRAM accelerators are aimed at in the first place, and the framework is designed to be general rather than tied to one particular accelerator architecture.