Secure-RRAM: A 40nm 16kb Compute-in-Memory Macro with Reconfigurability, Sparsity Control, and Embedded Security

Compute-in-memory (CIM) is regarded as a promising paradigm to process the extensive workloads of multiply-and-accumulate (MAC) operations in deep neural networks (DNNs). Several critical challenges remain to be overcome before emerging non-volatile memories such as resistive random-access memory (RRAM) can be maximally leveraged for CIM. Figure 1 illustrates the challenges that RRAM-CIM prototypes face: (1) fixed weight and output precisions that limit the reconfigurability for different DNN models; (2) low on-state resistance $(R_{ON})$ of RRAM cells induces large column currents, which incur high power consumption and drive up multiplexer transistor sizes. Aside from the compute challenges that CIM faces, another growing security concern is 3) the leak of weights and DNN models stored in inference engine, which are regarded as valuable assets considering the expensive resources (weeks of training, thousands of Watts, private labels) put into the training process. If the weights can be obtained by an adversary through reading the memory cells or performing pair gathering experiments, the stolen weights could be cloned into counterfeit chips or the DNN models could be reverse engineered with retraining. In this work, we present a Secure-RRAM CIM macro which aims to both tackle the discussed compute challenges and provide effective protection of on-chip weights, with the following features: 1) flexible weight precision support, 2) current-limiting sparsity-aware input control, and 3) embedded XOR cipher for lightweight encryption.