Scalable Digital Compute-in-Memory Ising Machines for Robustness Verification of Binary Neural Networks

TL;DR

This work reformulate BNN robustness verification as a quadratic unconstrained binary optimization (QUBO) problem and solve it using a digital compute-in-memory (DCIM) SRAM-based Ising machine to exploit imperfect solutions produced by the DCIM Ising machine to extract adversarial perturbations and thereby demonstrate the non-robustness of the BNN.

Abstract

Verification of binary neural network (BNN) robustness is NP-hard, as it can be formulated as a combinatorial search for an adversarial perturbation that induces misclassification. Exact verification methods therefore scale poorly with problem dimension, motivating the use of hardware-accelerated heuristics and unconventional computing platforms, such as Ising solvers, that can efficiently explore complex energy landscapes and discover high-quality solutions. In this work, we reformulate BNN robustness verification as a quadratic unconstrained binary optimization (QUBO) problem and solve it using a digital compute-in-memory (DCIM) SRAM-based Ising machine. Instead of requiring globally optimal solutions, we exploit imperfect solutions produced by the DCIM Ising machine to extract adversarial perturbations and thereby demonstrate the non-robustness of the BNN. The proposed architecture stores quantized QUBO coefficients in approximately 9.1~Mb of SRAM and performs annealing in memory via voltage-controlled pseudo-read dynamics, enabling iterative updates with minimal data movement. Experimental projections indicate that the proposed approach achieves a $178\times$ acceleration in convergence rate and a $1538\times$ improvement in power efficiency relative to conventional CPU-based implementations.

Figures (9)

• Figure 1: Flowchart of the proposed robustness-verification pipeline. A QUBO instance is constructed from a pre-trained BNN and a correctly classified input-ouput pair. An Ising machine then searches for a perturbation (noise) that modifies the input and induces a change in the BNN output, thereby yielding an adversarial example.
• Figure 2: DCIM-based Hamiltonian update engine. (a) SRAM array storing quantized weights $\tilde{Q}_{ij}$, with spin inputs $q_j$ broadcast on wordlines and column signals reduced by a signed adder tree. (b) A 6T SRAM bitcell with a per-cell MUX enabling selective weight participation during MAC and pseudo-read noise injection via $V_{\mathrm{DDM}}$ scaling. (c) In-memory per-spin update computation, where the signed adder tree forms $\sum_j \tilde{Q}_{ij} q_j$ and a sign check implements the flip decision based on the sign of $\Delta E_i$.
• Figure 3: Measured pseudo-read error probability versus $V_{\mathrm{DDM}}$ for SRAM cells storing '0' and '1' from a taped-out DCIM prototype chip at TSMC 28nm process.
• Figure 4: Control flow of the proposed DCIM-based annealer
• Figure 5: Energy evolution during annealing for the 1023x3x1 QUBO instance under (a) 8-bit quantized coefficients and (b) full QUBO-level precision.