Logo
ScienceStack
Table of Contents
Fetching ...
Sign In

Efficient and Encrypted Inference using Binarized Neural Networks within In-Memory Computing Architectures

Gokulnath Rajendran, Suman Deb, Anupam Chattopadhyay

TL;DR

This work tackles model protection for binarized neural networks deployed on crossbar-based in-memory computing by introducing PUF-derived secret-key transformations that yield protected weights and biases $W^*$ and $B^*$. The authors formalize a reversible framework with transformations $(\\Gamma_R, \\beta_R, \\delta_R, \\psi_R)$ ensuring the correct key preserves the output $Y = \\operatorname{sign}(W^\\top X - B)$, while omitting the key leads to drastic accuracy loss. They implement three transformation schemes (row/column inversion and swapping, plus a mixed row inversion with column swap) on MNIST with RRAM crossbars and demonstrate that encrypted inference incurs minimal runtime overhead and preserves performance when the key is available, but falls below 15% accuracy otherwise. The results indicate a practical, hardware-friendly approach to BNN privacy in in-memory computing and point to extensions to other activations and architectures to achieve privacy with lower costs than full FHE.

Abstract

Binarized Neural Networks (BNNs) are a class of deep neural networks designed to utilize minimal computational resources, which drives their popularity across various applications. Recent studies highlight the potential of mapping BNN model parameters onto emerging non-volatile memory technologies, specifically using crossbar architectures, resulting in improved inference performance compared to traditional CMOS implementations. However, the common practice of protecting model parameters from theft attacks by storing them in an encrypted format and decrypting them at runtime introduces significant computational overhead, thus undermining the core principles of in-memory computing, which aim to integrate computation and storage. This paper presents a robust strategy for protecting BNN model parameters, particularly within in-memory computing frameworks. Our method utilizes a secret key derived from a physical unclonable function to transform model parameters prior to storage in the crossbar. Subsequently, the inference operations are performed on the encrypted weights, achieving a very special case of Fully Homomorphic Encryption (FHE) with minimal runtime overhead. Our analysis reveals that inference conducted without the secret key results in drastically diminished performance, with accuracy falling below 15%. These results validate the effectiveness of our protection strategy in securing BNNs within in-memory computing architectures while preserving computational efficiency.

Efficient and Encrypted Inference using Binarized Neural Networks within In-Memory Computing Architectures

TL;DR

This work tackles model protection for binarized neural networks deployed on crossbar-based in-memory computing by introducing PUF-derived secret-key transformations that yield protected weights and biases and . The authors formalize a reversible framework with transformations ensuring the correct key preserves the output , while omitting the key leads to drastic accuracy loss. They implement three transformation schemes (row/column inversion and swapping, plus a mixed row inversion with column swap) on MNIST with RRAM crossbars and demonstrate that encrypted inference incurs minimal runtime overhead and preserves performance when the key is available, but falls below 15% accuracy otherwise. The results indicate a practical, hardware-friendly approach to BNN privacy in in-memory computing and point to extensions to other activations and architectures to achieve privacy with lower costs than full FHE.

Abstract

Binarized Neural Networks (BNNs) are a class of deep neural networks designed to utilize minimal computational resources, which drives their popularity across various applications. Recent studies highlight the potential of mapping BNN model parameters onto emerging non-volatile memory technologies, specifically using crossbar architectures, resulting in improved inference performance compared to traditional CMOS implementations. However, the common practice of protecting model parameters from theft attacks by storing them in an encrypted format and decrypting them at runtime introduces significant computational overhead, thus undermining the core principles of in-memory computing, which aim to integrate computation and storage. This paper presents a robust strategy for protecting BNN model parameters, particularly within in-memory computing frameworks. Our method utilizes a secret key derived from a physical unclonable function to transform model parameters prior to storage in the crossbar. Subsequently, the inference operations are performed on the encrypted weights, achieving a very special case of Fully Homomorphic Encryption (FHE) with minimal runtime overhead. Our analysis reveals that inference conducted without the secret key results in drastically diminished performance, with accuracy falling below 15%. These results validate the effectiveness of our protection strategy in securing BNNs within in-memory computing architectures while preserving computational efficiency.
Paper Structure (10 sections, 1 theorem, 14 equations, 3 figures, 3 tables)

This paper contains 10 sections, 1 theorem, 14 equations, 3 figures, 3 tables.

Table of Contents

  1. Introduction
  2. Encrypted BNN Inference
  3. Attacker model
  4. Theoretical Framework
  5. Protection Techniques and experiments
  6. Swap + Inversion along rows
  7. Swap + Inversion along Columns
  8. Row inversion + Column swap
  9. Conclusion and Future works
  10. Acknowledgements

Key Result

Theorem 2.1

Let a BNN layer be characterized by a weight matrix $W \in \{\pm 1\}^{m \times n}$, a binarized input $X \in \{\pm 1\}^{m}$, and an integer threshold $B \in \mathbb{Z}^{n}$, which arises from Batch normalization integration. Then, the output $Y$ of the unprotected layer is defined as: Let a PUF generate a hidden response $R \in \{0,1\}^{d}$ that is accessible exclusively at runtime on the device

Figures (3)

  • Figure 1: Overview of PUF Protected BNN Inference
  • Figure 2: Implementation of protected BNN in RRAM crossbar
  • Figure 3: Architecture of the BNN trained on the MNIST dataset

Theorems & Definitions (1)

  • Theorem 2.1