CN110929859B - Memristor computing system security enhancement method - Google Patents

Abstract

The invention discloses a security enhancing method of an RRAM computing system, which is used for preventing the attack of stealing the weight of a neural network stored in an RRAM crossbar. Firstly, analyzing a method for mapping the weight of the neural network to the RRAM crossbar and two methods for stealing the weight of the neural network from the RRAM crossbar; then, a prevention method is respectively provided for the two stealing methods; and finally, optimizing the hardware overhead of the second prevention method by using two heuristic algorithms. The method is simple to operate and high in practicability, and can improve the safety of the RRAM computing system.

Description

A security enhancement method for memristor computing system

technical field

The invention belongs to the field of new device memristors, in particular to a method for enhancing the security of a memristor computing system.

Background technique

Neural networks (NNs) have achieved great success in visual object recognition and natural language processing, but such data-intensive applications require enormous data movement between computational units and memory. Emerging memristor (RRAM) computing systems show great potential in avoiding big data movement by performing matrix-vector-multiplication operations in memory. However, the non-volatility of RRAM devices may lead to the stealing of the neural network weights stored in the crossbar switch, and the attacker can extract the neural network model from the stolen weights. By stealing neural network weights, attackers can extract trained neural network models, which greatly damages the intellectual property rights of neural network model designers. To make matters worse, malicious use of the extracted neural network model could lead to a social crisis.

The existing solution is to encrypt the NN weights and decrypt them each time they are used. However, these methods of encrypting/decrypting NN parameters inevitably require frequent write operations to the RRAM device. Currently, RRAM devices can only support up to 10 ¹⁰ write cycles. Therefore, the NN weight encryption/decryption scheme will shorten the life cycle of the RRAM computing system. In addition, frequent write operations to the RRAM device also consume a lot of power consumption, which brings a long delay to the system and affects system performance.

SUMMARY OF THE INVENTION

The purpose of the present invention is to provide a method for enhancing the security of an RRAM computing system, which will not affect the lifespan of the RRAM computing system, and will not bring additional RRAM write power consumption overhead and delay.

The technical solution for realizing the object of the present invention is: a method for enhancing the security of an RRAM computing system connected by confusing a crossbar switch row, comprising the following steps:

Step 1. Evaluate the security of the RRAM crossbar mapping method, and analyze the two methods of data theft, and go to step 2;

Step 2. For the two stealing methods, use two different prevention methods to enhance the security of the RRAM computing system, and go to step 3;

Step 3. Use two heuristic algorithms to optimize the hardware overhead of the obfuscation module.

Compared with the prior art, the present invention has the following significant advantages:

(1) It does not involve a write operation to the RRAM unit in the RRAM computing system, so it will not affect the life of the RRAM computing system, nor will it bring additional RRAM write power consumption overhead and delay.

(2) It does not involve a write operation to the RRAM unit in the RRAM computing system, so it does not bring additional RRAM write power consumption overhead and delay.

Description of drawings

FIG. 1 is a flowchart of a method for enhancing the security of an RRAM computing system according to the present invention.

Figure 2 is a schematic diagram of performing matrix-vector multiplication in an RRAM crossbar and inserting a row obfuscation module between a positive RRAM crossbar and a negative RRAM crossbar.

3 is a schematic diagram of different implementation methods of the line obfuscation module, wherein (a) is a schematic diagram of the implementation of connecting m inputs and m outputs each time, (b) is a schematic diagram of the implementation of connecting 1 input and 1 output each time, (c) is a schematic diagram of combining (a) and (b) to connect x inputs and x outputs at a time.

FIG. 4 is a result graph of the classification accuracy of the NN model with only one layer of protection extracted without inputting the correct key.

Detailed ways

The invention discloses a security enhancement method for an RRAM computing system to prevent network weight theft attacks. Firstly, the stealing method of neural network weights is analyzed; then, a security enhancement technology based on obfuscating the row connections between positive and negative crossbar switches is proposed; finally, two heuristic algorithms are used to optimize the hardware overhead of the obfuscation module .

The main components of a neural network (NN) are fully connected layers (FC) and convolutional layers (Conv). The computation of the FC layer is a matrix-vector multiplication (MVM), which is described as:

where x _i (i∈[1,m]) is the input feature map, m is the number of rows in the neural network weight matrix and m>1, _yj (j∈[1,n]) is the output activation, and n is the neural network The number of columns of the network weight matrix and n>1, wi _,j is the i-th row and j-th column element of the neural network weight matrix. The computation of the Conv layer is slightly different, but can be translated into MVM.

As shown in Figure 2, in an RRAM computing system, the input is the voltage (V) on the crossbar word line (WL) and the output is the accumulated current (I) on the bit line (BL). The input voltage, the conductance of the crossbar switch unit, and the output current all obey Kerchhoff's law, which can be regarded as the MVM operation:

where gi _,j are the conductances of the cells in the ith row and jth column of the crossbar.

However, the neural network weights w _ij cannot be directly mapped to g _ij because w _ij can be positive, negative or zero, while the RRAM conductance of the crossbar switch can only be positive. To solve this problem, a pair of crossbars is needed to represent the weight matrix, i.e. a positive crossbar and a negative crossbar. The input voltage is converted to the opposite voltage and then input to the negative crossbar, then the BL currents of the positive and negative crossbars are summed to obtain the MVM result, as shown in Figure 2.

RRAM has a step-by-step reset process, which means that the RRAM device can be continuously adjusted from a low-impedance state (LRS) to a high-impedance state (HRS). Therefore, an ideal RRAM device can be tuned to any conductance state between LRS and HRS.

1, the RRAM computing system security enhancement method of the present invention includes the following steps:

Step 1. Evaluate the security of the RRAM crossbar mapping method and analyze the data stealing method.

Step 2. For the two stealing methods, use two different prevention methods respectively to enhance the security of the RRAM computing system.

Step 3. Use two heuristic algorithms to optimize the hardware overhead of the line obfuscation module.

Further, evaluating the security of the RRAM crossbar mapping method described in step 1, and analyzing the data theft method, are as follows:

和负RRAM交叉开关中的第i行第j列单元

表示；Step 1.1. Assume that the maximum conductance of the RRAM cell is G _on , and the minimum conductance is G _off ; each neural network weight matrix is represented by a positive RRAM crossbar connected to a positive voltage and a negative RRAM crossbar connected to a negative voltage; neural network The element w _ij in the i-th row and the j-th column of the weight matrix is determined by the i-th row and the j-th column element in the positive RRAM crossbar switch.

and the ith row jth column cell in the negative RRAM crossbar

express;

have to

Step 1.2, RRAM device mapping method 1:

Mapping method 2 for RRAM devices:

Step 1.3. According to the above two mapping methods, there are two stealing methods, stealing method 1 is to access one crossbar of each positive/negative crossbar pair, and stealing method 2 is to access two crossbars of each positive/negative crossbar pair. a cross switch; and then infer the corresponding w _ij respectively.

Further, in step 2, two different methods are used to enhance the security of the RRAM computing system, as follows:

Step 2.1, for the stealing method 1 prevention method of step 1.3, explore the bias space, and apply different biases to each matrix element;

Step 2.2, for the stealing method 2 defense method of step 1.3, hide the row connection of each pair of positive/negative crossbar switches.

Further, the use of two heuristic algorithms described in step 3 to optimize the hardware overhead of the obfuscation module is as follows:

Step 3.1, optimization technique 1: reduce the number of multiplexers by adding a layer of inverse multiplexers;

Step 3.2. Optimization technique 2: Only protect some neural network layers.

The present invention will be further described in detail below with reference to the accompanying drawings and specific embodiments.

Example

1, the present embodiment discloses a method for enhancing the security of an RRAM computing system, and the specific steps are as follows:

Step 1. Analysis of stealing methods: Evaluate the security of the RRAM crossbar mapping method, and analyze two methods of data stealing.

表示与正电压连接的电池的电导，

表示与负电压连接的电池的电导。于是我们能得到：Assume that the maximum conductance of the _RRAM cell is Gon and the minimum conductance is _Goff . we use

represents the conductance of a battery connected to a positive voltage,

Indicates the conductance of a battery connected to a negative voltage. So we can get:

According to the literature, there are two main mapping methods for simulating RRAM devices. The mapping method 1 is:

然后相应地进行调整。where all RRAM cells are initialized to bias

Then adjust accordingly.

Mapping method 2 is:

Similarly, where all RRAM cells are initialized with bias G _off , and then adjusted accordingly.

或

中推断出w_ij。Stealing method 1: Access one crossbar for each positive/negative crossbar pair; in both mapping methods above, the RRAM conductance varies linearly with the weight. An attacker can easily

or

w _ij is inferred from .

又可以得到

因此很容易通过简单的减法来推断出相应的w_ij。Steal method 2: Access both crossbars of each positive/negative crossbar pair; attacker can either get

also get

Therefore it is easy to deduce the corresponding w _ij by simple subtraction.

Step 2. For the two stealing methods, use two different prevention methods respectively to enhance the security of the RRAM computing system.

A defense against stealing method 1: Explore the bias space and apply a different bias to each matrix element.

To combat stealing method 1, we first prove that the biases of mapping method 1 and mapping method 2 have a large value space. Then, by applying a different bias to each matrix element, stealing method 1 will not be able to recover the weight matrix with a single crossbar that accesses the positive/negative crossover pair.

1) Bias Space Exploration: Hypothesis

G _on = ηG _off (5)

where η is the ratio of G _on /G _off , and η > 1000.

Theoretically, an ideal RRAM cell can be tuned to any conductance state between G _off and G _on . Then, the weight mapping method for RRAM devices can be described as:

Where for w≥0, the bias value b ₁ ∈ [G _off , G _on ]; for w < 0, the bias value b ₂ ∈ [G _off , G _on ]; both x ₁ and x ₂ are intermediate variables .

和

在其范围内连续，

和

必须分别满足

和

因此，我们可以得到b₁＝b₂。假设b₁＝λG_off，其中λ(λ∈[1，η])是偏置缩放值，由式(6)可知，

和

随着w_ij单调递增或递减。to ensure that

and

continuous in its range,

and

must be satisfied

and

Therefore, we can get b ₁ =b ₂ . Assuming b ₁ =λG _off , where λ(λ∈[1, η]) is the offset scaling value, it can be known from equation (6) that,

and

Monotonically increasing or decreasing with w _ij .

Therefore, an RRAM can only reach maximum or minimum conductance when w _ij is at one of the ends of its range of values. which is,

From equations (5) (6) (7), it can be known that,

Equation (6) can be rewritten as

For an analog RRAM cell that can be tuned to any conductance value state between G _off and G _on , the bias scaling value λ can be any random value between 1 and η. Although the precision of the peripheral circuits limits the precision of the bias b ₁ (or b ₂ ), this patent considers that the range of values for λ is quite large.

假设N_b＝1000，N_c＝256，则使用蛮力从一个模拟RRAM交叉开关中恢复其对于的权矩阵的试验次数为1000²⁵⁶。2) Apply random bias to the weight matrix: Based on the above-mentioned bias b ₁ (or b ₂ ) with a large value range, the present invention proposes to randomize the bias selected for each element in the weight matrix. The number of bias selections is denoted as N _b , and the number of cells in the crossbar is denoted as N _c . Therefore, the time complexity of inferring the corresponding matrix weights from an analog crossbar is

Assuming _Nb = 1000 and _Nc = 256, the number of trials to recover its corresponding weight matrix from an analog RRAM crossbar using brute force is 1000 ²⁵⁶ .

Therefore, the present invention can defend against stealing method 1 by randomly assigning a bias to each weight.

A defense against stealing method 2: Hide the row connections for each pair of positive/negative crossbars.

By accessing the positive and negative crossbars and performing subtraction operations, an attacker can easily deduce the neural network weights stored. In this section, we propose to hide the connections between positive and negative crossbars so that even if an attacker has access to both crossbars, the neural network weights cannot be inferred.

For example, Table I shows the comparison of the classification accuracy of the NN model extracted by mistake and the original NN model after applying the prevention method 1 and the prevention method 2 at the same time. The NN models are LeNet, AlexNet and VGG16.

Table I Comparison of the classification accuracy of the original NN model and the wrongly extracted NN model

NN model Original NN model Incorrectly extracted NN model LeNet 65.13% 11.82% AlexNet 73.57% 9.81% VGG16 90.07% 9.61%

Step 3. Use two heuristic algorithms to optimize the hardware overhead of the obfuscation module, as follows:

To hide the crossbar row connections, we design and insert a row connection obfuscation module between the positive and negative crossbars, which is based on a multiplexer (as shown in Figures 2 and 3). The input and output of the inserted obfuscation module are both analog signals, replaced by an analog switch consisting of a pair of MOSFET transistors instead of using a digital multiplexer, making Figure 3(a) applicable to our case, the obfuscated module Hides the connections between the crossbar rows. Unless the specific connection relationship (key) is known, directly using the wrongly extracted neural network weights stored in RRAM for calculation will greatly reduce the accuracy of the neural network.

For an m:m obfuscation module, there is m! Possible connection combinations between input and output. Taking m=64 as an example, m! It's 2 ²⁹⁵ , which is very hard to break with a brute force attack.

However, in order to implement the obfuscation module in Fig. 3(a), it requires m m:1 multiplexers. Applying this obfuscation module to each crossbar pair in an RRAM computing system would introduce a non-negligible additional area overhead. To address this issue, we propose two techniques to reduce the overhead of multiplexer-based obfuscation modules:

(1) Optimization technique 1: Reduce the number of multiplexers by adding one layer of inverse multiplexers.

To reduce the area cost of the obfuscation module in Figure 3(a), we can use an m:1 multiplexer and a 1:m inverse multiplexer, as shown in Figure 3(b). However, the result of this solution is that for each clock cycle, only one row of positive crossbars and its corresponding row of negative crossbars are involved in the computation, which would result in unacceptable latency costs.

To reduce the area/delay overhead in Figure 3(a), Figure 3(b), we combine these two solutions as shown in Figure 3(c). Assuming m=xk, (x, k∈Z), the combined solution uses 2x k:1 multiplexers and x 1:k inverse multiplexers. The security of an m:m combination obfuscated module is x! ·(k!) ^x . In this scheme, x rows of positive crossbars and negative crossbars are calculated each time. However, in the RRAM computing system, due to the limitation of the current crossbar BL, only part of the WL is activated at a time. Therefore, if x is equal to the number of WLs enabled in each loop, the combined solution does not incur any additional latency overhead.

For example, Table II shows the area/latency overhead comparison of these three implementations of the 256:256 line obfuscation module. Assuming that 16 WLs are turned on per clock cycle, x=16, compared with Fig. 3(a), Fig. 3(c) brings 16 times the delay overhead. However, when 16 WLs are enabled, the additional delay overhead brought by Figure 3(c) is the same as that brought by Figure 3(a), and the area overhead of Figure 3(c) is only Figure 3(a) 1.10%.

Table II Latency/Area Overhead Comparison for Figure 3

accomplish Figure 3(a) Figure 3(b) Figure 3(c) normalized delay 1× 256× 16× normalized area 1× 0.0078× 0.0110×

(2) Optimization technique 2: Only some layers of the neural network are protected.

In order to further reduce the area overhead of the row obfuscation module and at the same time ensure the security of the system, this patent studies the sensitivity of the neural network classification accuracy when the row connections of the crossbar corresponding to each layer are obfuscated. In the experiments, the crossbar row connections corresponding to each layer of the network were confounded separately, and the classification accuracy of the wrongly extracted neural network model was tested. The low classification accuracy guarantees the security of the obfuscation method. The results are shown in Figure 4. The present invention was tested on three neural networks, LeNet, AlexNet and VGG16. It can be noticed that obfuscating each layer has a different effect on the classification accuracy of the neural network. The layer with lower accuracy after obfuscation is called the saliency layer, and the most salient layer is MSL. We can see that the layer close to the model input is the saliency layer because the error caused by the protection method propagates through the rest of the layers. For example, when we obfuscate the row connections of the crossbars of the first layer, all mis-extracted NNs have less than 45% classification accuracy. In addition, the obfuscation method has little effect on the layers near the model output, and only obfuscating the FC layer hardly affects the classification accuracy of the model.

For example, Table III shows the classification accuracy of the NN model after only some layers of the neural network are obfuscated and the attacker incorrectly proposes it. It can be seen that just obfuscating the two most salient layers of the NN model reduces the classification accuracy of the erroneously extracted NN model to below 17%.

Table III The classification accuracy of the NN model that only protects some layers of the NN extracted incorrectly

NN model 2MSLs 3MSLs LeNet 14.89% 13.08% AlexNet 10.01% 9.34% VGG16 16.44% 10.44%

After using the optimization technique 1 and the optimization technique 2 at the same time, the hardware overhead of the row obfuscation module can be significantly reduced. For example, Table IV shows the proportion of hardware overhead reduction using optimization techniques compared to not using optimization techniques in order to reduce the classification accuracy of incorrectly proposed NN models to a threshold α. It can be seen that after using the optimization technique, the hardware overhead of the line obfuscation module can be reduced by 97.45% at most and 33.33% at least.

Table IV The ratio of hardware overhead reduction with optimization techniques compared to without optimization techniques

NN model a=14% a=17% a=20% LeNet 33.33% 50.00% 50.00% AlexNet 95.49% 95.49% 95.49% VGG16 96.17% 97.45% 97.45%

As an example, Table V shows the ratio of the hardware area of the RRAM crossbar in the RRAM computing system to the row obfuscation module after using the optimization technique in order to reduce the classification accuracy of the incorrectly proposed NN model to a threshold α. It can be seen that the hardware overhead brought by our method is very small.

Table V Row obfuscation module using the optimized technique as a percentage of the hardware area of the RRAM crossbar

NN model a=14% a=17% a=20% LeNet 1.6220% 1.2166% 1.2166% AlexNet 0.1098% 0.1098% 0.1098% VGG16 0.0932% 0.0622% 0.0622%

The overall workflow of the security-enhanced RRAM computing system:

For the RRAM computing system, in addition to the obfuscation module, a hardware random number generator (HRNG) and a tamper-resistant memory (TPM) are also embedded. HRNG is used to generate random bias scaling value λ; TPM is used to store the key of obfuscation module. In an uninitialized simulated RRAM computing system, an authorized user first loads his/her NN weights into the on-chip buffer and his/her obfuscation key into the TPM. Use HRNG to generate λ to determine the conductance g ⁺ /g ⁻ of each pair of RRAMs. Each RRAM in the positive crossbar is then adjusted according to the corresponding matrix. Then, the rows of negative crossbars are arranged according to the obfuscated key of the TPM, and then each RRAM in the negative crossbar is tuned. After setting, the line obfuscation module needs to be configured according to the key in the TPM before each inference calculation using the RRAM computing system.

Claims (1)

1. A method for enhancing the security of a memristor computing system, comprising the following steps: Step 1. Evaluate the security of the RRAM crossbar mapping method, and analyze the two methods of data theft, as follows: Step 1.1. Assume that the maximum conductance of the RRAM cell is G _on , and the minimum conductance is G _off ; each neural network weight matrix is represented by a positive RRAM crossbar connected to a positive voltage and a negative RRAM crossbar connected to a negative voltage; neural network The element w _ij in the i-th row and the j-th column of the weight matrix is determined by the i-th row and the j-th column element in the positive RRAM crossbar switch.

and the ith row jth column cell in the negative RRAM crossbar

express; have to

Step 1.2, RRAM device mapping method 1:

Mapping method 2 for RRAM devices:

Step 1.3. According to the above two mapping methods, there are two stealing methods, stealing method 1 is to access one crossbar of each positive/negative crossbar pair, and stealing method 2 is to access two crossbars of each positive/negative crossbar pair. and then infer the corresponding w _ij respectively, and go to step 2 Step 2. For the two stealing methods, use two different prevention methods to enhance the security of the RRAM computing system, as follows: Step 2.1, for the stealing method 1 prevention method in step 1.3, explore the bias space, and apply different biases to each neural network weight matrix element; Step 2.2, for the stealing method 2 of step 1.3, hide the row connection of each pair of positive/negative crossbars by inserting a row obfuscation module, and go to step 3; Step 3. Use two heuristic algorithms to optimize the hardware overhead of the obfuscation module, as follows: Step 3.1, optimization technique 1: reduce the number of multiplexers by adding a layer of inverse multiplexers; Step 3.2. Optimization technique 2: Only protect some layers of the neural network.

Images