Compute-in-Memory based Neural Network Accelerators for Safety-Critical Systems: Worst-Case Scenarios and Protections

The crossbar array serves as the major computational component of CiM DNN accelerators. This array can execute matrix-vector multiplications within a single clock cycle. In such an array, matrix values (e.g., DNN weights) are stored at the intersection of vertical and horizontal lines using NVM devices like RRAMs and FeFETs. Vector values, akin to DNN inputs, are introduced through horizontal data lines as voltage. The resultant output is then channeled through vertical lines in a current form. Computation within the crossbar array operates in the analog domain, following Kirchhoff’s laws. However, for other crucial DNN operations such as pooling and non-linear activation, peripheral digital circuits are employed. Thus, digital-to-analog and analog-to-digital converters (DACs and ADCs) bridge these different components, specifically with DACs transforming digital input data into voltage and ADCs converting analog output currents back to digital values.

Resistive crossbar arrays are susceptible to a variety of variations and noises. The predominant sources include spatial and temporal variations. Spatial variations, stemming from fabrication imperfections, exhibit both localized and widespread correlations across devices. Additionally, due to the unpredictability inherent in device materials, NVM devices experience temporal variations, leading to conductance fluctuations when programmed across different instances. Typically, these temporal variations are distinct between devices and are not influenced by the intended programming value [22]. For the scope of this study, we treat the effects of these non-idealities as independent across each NVM device. Nonetheless, our proposed framework can be adapted to address other variation sources with some alterations.

The prevailing approach in current research utilizes Monte Carlo (MC) simulations to evaluate the resilience of CiM DNN accelerators against device variations. Initially, models for device variation and circuitry are established based on physical measurements. The DNN being assessed is then mapped onto the circuit model, facilitating the determination of the desired value for each NVM device. In each MC iteration, for every device, a sample of its non-ideal state is drawn from the variation model to set the actual conductance value. Subsequently, metrics reflecting DNN performance, like classification accuracy, are recorded. This process is repeated, often thousands of times, until a consistent DNN performance distribution is achieved. Conventional methods cited in existing studies [7, 14, 10, 9, 11] typically involve around 10,000 MC iterations, an extremely time-consuming process. Empirical studies [7, 14] suggest that 10k MC cycles are adequate for determining average DNN accuracy, though no concrete theoretical guarantees are provided.

Other scholars have also probed the effects of weight perturbations on the security of neural networks [23, 19]. Termed “Adversarial Weight Perturbation”, this research avenue seeks to relate weight perturbations to the well-researched topic of adversarial examples-based attacks, wherein DNN inputs are deliberately altered to induce misclassifications. One study [23] trained DNNs using adversarial examples to gather data on adversarial weight perturbation. More recently, [19] attempted to identify adversarial weight perturbation using an adapted weight Projected Gradient Descent (PGD) attack. This approach can pinpoint a minor perturbation capable of diminishing DNN accuracy. Nonetheless, while the study concentrates on the attack’s success, it does not provide a guaranteed assessment of the worst-case weight perturbation, as will be evidenced by our forthcoming experimental results.

Several strategies have been introduced to tackle the challenge of device variations in CiM DNN accelerators. This section briefly discusses the two predominant approaches: bolstering DNN robustness and curtailing device variations.

A prevalent technique to bolster DNN robustness in the face of device variations is variation-aware training[16, 6, 10, 24]. This method, sometimes referred to as noise-injection training, integrates variations into DNN weights during the training phase. This integration fosters a DNN model that exhibits statistical resilience to the effects of device variations. In each training iteration, a variation instance, drawn from a predefined distribution, augments the weights during the forward pass, leaving the backpropagation phase unaffected by noise. Upon gradient collection, this variation is discarded, and the pristine weight is updated based on the accrued gradients. Alternatives encompass the design of sturdier DNN architectures [16, 14, 12] and pruning techniques [8, 25].

In efforts to decrease device variations, the write-verify procedure[13, 17] is commonly employed during programming. Initially, an NVM device is programmed to a set state via a designated pulse pattern. Subsequent to this, the device’s value is verified to ascertain if its conductance aligns within a stipulated range of the desired value, essentially assessing its accuracy. If discrepancies arise, a supplemental update pulse is initiated to draw the device conductance nearer to the target. This loop persists until the disparity between the programmed device value and the target diminishes to a satisfactory margin, typically taking a handful of cycles. Cutting-edge research suggests that by selectively applying write-verify to a subset of pivotal devices, one can uphold the average accuracy of a DNN [11]. Additionally, a variety of circuit design initiatives [26, 27] have been put forth to counteract device variations.

In this section, we present our model that delineates the effects of device variations on DNN weights. Specifically, our primary focus in this paper is on the discrepancies introduced during the programming process, where the conductance value programmed into the NVM devices deviates from the intended value.

For a weight depicted by $M$ bits, its desired value, denoted by $\mathcal{W}_{des}$, is given as

where $m_{j}$ is the value of the $j^{th}$ bit of the intended weight. Given that each NVM device can store data equivalent to $K$ bits, a single weight value in the DNN requires $M/K$ devices for representation¹¹1For simplicity, we assume that M is divisible by K.. This mapping procedure can be articulated as:

Here, $g_{i}$ denotes the intended conductance of the $i^{th}$ device encoding a particular weight. It is pertinent to note that the mapping strategy remains consistent even for negative weights.

Assuming that all devices employ the write-verify technique, the deviation between the genuine conductance of each device and its targeted value remains within specified bounds [22]:

In this equation, $gp_{i}$ represents the actual programmed conductance, and $th$ indicates the permissible threshold set by write-verify.

When programming a weight, the true value, denoted by $\mathcal{W}_{p}$, as stored on the devices, can be described as:

Here, $th_{g}=\sum_{i=0}^{M/K-1}{\left(th\times 2^{i\times K}\right)}$ is referred to as the weight perturbation bound in this paper.

Having established our weight perturbation model, we can proceed to delineate the task of determining the worst-case accuracy of a DNN. For simplicity, we denote a neural network by $\{f,\mathbf{W}\}$, where $f$ refers to its architecture and $\mathbf{W}$ its set of weights. The forward pass, or computation, of this neural network is symbolized by $f(\mathbf{W},\mathbf{x})$, with $\mathbf{x}$ as its inputs.

According to the model detailed in Section III-A, weight perturbations due to device variations are additive and independent. This allows us to represent the forward pass of a neural network under the influence of device variation as $f(\mathbf{W}+\Delta\mathbf{W},\mathbf{x})$. Here, $\Delta\mathbf{W}$ symbolizes the weight perturbation induced by these variations. The perturbed neural network is then defined as $\{f,\mathbf{W}+\Delta\mathbf{W}\}$.

Based on the above elaborations, we formulate our problem as follows: For a given neural network $\{f,\mathbf{W}\}$ and a reference dataset $D$, identify the perturbation $\Delta\mathbf{W}$ such that the accuracy of the perturbed neural network $\{f,\mathbf{W}+\Delta\mathbf{W}\}$ on dataset $D$ is the lowest, staying within the bounds of permissible weight perturbation. Throughout this document, we will reference this particular perturbation as the worst-case weight perturbation. Similarly, the resulting performance (or accuracy) will be termed the worst-case performance (or accuracy), and the neural network associated with it will be the worst-case neural network.

Given the problem definition, we can represent it as the following optimization problem:

Here, $x$ and $t$ symbolize the input data and its corresponding classification label from the dataset $D$, respectively. The term $\mathcal{L}(\Delta\mathbf{W})$ represents the maximum magnitude of the weight perturbation, denoted as $\max(\lvert\Delta\mathbf{W}\rvert)$. The value of $th_{g}$ is derived from the weight perturbation boundary as discussed in equation (4) from Section III-A. The notation $|A|$ signifies the cardinality (or size) of set $A$. Given that $f$, $\mathbf{W}$, and $D$ are constants in this scenario, our primary objective is to pinpoint the $\Delta\mathbf{W}$ that diminishes the set of correct classifications to its lowest possible size, thereby leading to the most unfavorable accuracy.

The optimization problem defined in equation (5) is challenging to solve directly due to its non-differentiable objective. In this section, we introduce a framework that reformulates the problem, allowing us to tackle it using existing optimization techniques.

Initially, we consider a slight relaxation of the objective. Assuming that there exists a function $p$ such that the condition $f(\mathbf{W}+\Delta\mathbf{W},\mathbf{x})==t$ holds true if and only if $p(\mathbf{x},\{f,\mathbf{W}+\Delta\mathbf{W}\})\geq 0$ [28]. Consequently, the optimization objective in equation (5) can be recast as:

Intuitively, minimizing the value in equation (6) can drive the minimization of the objective in equation (5). These two optimization tasks converge in their aims when, under the influence of $\Delta\mathbf{W}$, all data points in $D$ are misclassified.

Several options for $p(\mathbf{x},\{f,\mathbf{W}+\Delta\mathbf{W}\})$ satisfy the given criteria. We present some notable examples below.

The function $\mathrm{softplus}(x)$ is defined as $\log(1+\exp(x))$, and $loss(\mathbf{O},t)$ denotes the cross-entropy loss.

Based on empirical findings, in this paper, we opt for

The optimization problem is then relaxed to the form of:

For the relaxed problem, we can employ the Lagrange multiplier to offer an alternative representation:

given that $c>0$ is a carefully selected constant, the optimal solution is achievable. This objective corresponds to the relaxed problem, in which, for some $c>0$, the optimal solution to the latter matches that of the former.

Consequently, we employ the optimization objective (10) as the relaxed alternative to our originally defined objective (5). Given that the objective (10) is differentiable with respect to $\Delta\mathbf{W}$, we utilize gradient descent as the optimization algorithm to address this issue.

Methods to determine constant $c$.

In qualitative terms, when examining objective (10), larger values of $c$ indicate a heightened emphasis on reducing accuracy and a diminished emphasis on $\mathcal{L}(\Delta\mathbf{W})$. This typically leads to a decreased final accuracy and an increased value of $\mathcal{L}(\Delta\mathbf{W})$. This observation is substantiated by the empirical results illustrated in Fig. 3. Here, we depict how the worst-case error rate and $\mathcal{L}(\Delta\mathbf{W})$ fluctuate based on the chosen $c$, utilizing LeNet for MNIST as an example.

Given that empirical outcomes indicate $\mathcal{L}(\Delta\mathbf{W})$ displays monotonic behavior with respect to $c$, our strategy to determine the optimal $c$ value that results in the minimum performance, subject to the weight perturbation constraint $th_{g}$, is to employ binary search. Our goal is to identify the largest $c$ value that satisfies $\mathcal{L}(\Delta\mathbf{W})\leq th_{g}$. The accuracy derived using this particular $c$ value represents the worst-case performance of the DNN model when weight perturbations are confined to $th_{g}$.

It is worthwhile to note that since the optimization problem outlined in (10) is solvable through gradient descent, both the time and memory complexities of our method align closely with those required for training the DNN. This final framework of evaluating the worst-case performance is named Lagrange-based Worst-Case analysis (LWC).

In this section, we evaluate the efficacy of our proposed LWC approach in determining the worst-case performance of various DNN models through experiments. We utilized six distinct DNN models across four datasets: LeNet [29] model targeting the MNIST [30] dataset, ConvNet [6] model targeting the CIFAR-10 [31] dataset, ResNet-18 [32] model targeting the CIFAR-10 dataset, ResNet-18 model targeting the Tiny ImageNet [33] dataset, ResNet-18 model targeting the ImageNet [34] dataset, and VGG-16 [35] model targeting the ImageNet dataset. The inference process of LeNet and ConvNet models use a quantization precision of 4 bits, for both weights and layer inputs. On the other hand, the ResNet-18 and VGG-16 models are quantized to 8 bits. For the purposes of this study, we adopt $K=2$ in line with [16, 11]. Following the established procedures detailed in Section II-C, for each weight, the discrepancy between the actual device value and the anticipated value is progressively programmed until it falls below 0.1. Specifically, this means $th=0.06$ as per [11], resulting in a $th_{g}$ value of 0.03 (unless stated otherwise). These figures align with those presented in [13], corroborating the authenticity of our modeling and the parameters employed.

Given the absence of prior research for identifying a DNN’s worst-case performance under device variations, besides the basic MC simulations, we also utilize a modified version of the weight PGD attack method [19]. This modified method aims to discern the minimal weight perturbation resulting in a successful attack, serving as an auxiliary reference point. All experiments were executed on Titan-XP GPUs using the PyTorch framework. For the MC simulation baseline, we employed 100,000 runs and leveraged the Adam optimizer for gradient descent. The comprehensive setup for our proposed LWC method is detailed in Table II.

While we can determine the worst-case performance of DNN models under the influence of device variations by using LWC, it still requires multiple gradient descent trials to identify the Lagrange multiplier constant $c$. This introduces a considerable time overhead. Therefore, LWC is not cost-effective for evaluating the effectiveness of different protection methods, especially since this evaluation necessitates extensive hyper-parameter tuning. Each hyper-parameter selection must be assessed independently, so a swifter and more adaptable approach is preferred. To address this challenge, we introduce a relaxed version of LWC to estimate the worst-case performance. Instead of employing the solution from Eq. 10 for the constrained optimization problem in Eq. 9, we use a different approach. While LWC solves the optimization problem in Eq. 9 through the Lagrange multiplier, our proposed rapid evaluation technique employs the fast gradient sign method (FGSM) for this constrained optimization.

Specifically, to minimize Eq. 9 under the constraint $\mathcal{L}(\Delta\mathbf{W})\leq th_{g}$, we can start with $\Delta\mathbf{W}$ set to zero and continuously increase (or decrease) $\Delta\mathbf{W}$ by a fixed step size $\eta$ until $\mathcal{L}(\Delta\mathbf{W})$ reaches $th_{g}$. Because $\Delta\mathbf{W}$ is relatively small, the convergence is typically reached in $th_{g}/\eta$ iterations. By controlling $\eta$, a trade-off between execution time and precision can be achieved. The worst-case accuracy of the DNN model is then defined by the accuracy of the model with weights equal to $\mathbf{W}+\Delta\mathbf{W}$. We term this method F-LWC. Further details of this approach can be found in Algorithm 1.

We evaluate the efficacy of F-LWC by contrasting it with LWC. Given that the weight perturbation distance adheres strictly to the constraint $th_{g}$, a lower worst-case accuracy implies a more accurate evaluation method. As illustrated in Table IV, both F-LWC and LWCare used to assess the worst-case performance of four distinct DNN models. From an efficiency standpoint, F-LWC boasts a 2x speedup relative to LWC. Regarding accuracy, F-LWC identifies a worst-case scenario closely aligning with that identified by LWC in three models: the LeNet model targeting the MNIST dataset, the ResNet-18 model targeting the CIFAR-10 dataset, and the ResNet-18 model targeting the Tiny ImageNet dataset. Intriguingly, for the ConvNet model for CIFAR-10, F-LWC determines an even lower accuracy than LWC. This discrepancy is rational. LWC demands considerable hyper-parameter tuning, and the values reported in our prior work, which initially introduced LWC [20], may not represent the optimal outcome. However, we maintain this value for consistency with the reported results. Conversely, F-LWC demands minimal hyper-parameter tuning, making it simpler to pinpoint its optimal outcome.

Further illustrating F-LWC’s adaptability, we augment its step size. A larger step size equates to reduced runtime but less accurate estimation, thus presenting a trade-off between these aspects. In Fig. 7, we highlight that, even within a limited runtime, F-LWC still provides a reasonably accurate estimation.

In this section, we demonstrate that all of the existing methods used to improve the nvCiM DNN accelerator robustness are not effective in improving the worst-case performance of DNN models. We first discuss the existing conventional methods and then demonstrate their effectiveness.

As demonstrated in Sect. IV-B, conventional methods are not effective in improving the worst-case performance of DNN models under the influence of device variations. Here we further propose a novel training method named Adversarial Training with RIght-Censored Gaussian NoisE (A-TRICE).