title: On the Intrinsic Robustness of NVM Crossbars Against Adversarial Attacks
authors: Deboleena Roy Indranil Chakraborty Timur Ibrayev Kaushik Roy
text: 
  IEEEexample:BSTcontrol
  
  
  
  
  
  
  On the Intrinsic Robustness of NVM Crossbars Against Adversarial Attacks
      
  Deboleena Roy, Indranil Chakraborty, Timur Ibrayev, Kaushik Roy
  Department of Electrical and Computer Engineering
  
  Purdue University, West Lafayette, Indiana, USA
  
  {roy77, ichakra, tibrayev, kaushik}@purdue.edu
  
      December 30, 2023
  ========================================================================================================================================================================================================================
  
  
  
  
  The increasing computational demand of Deep Learning has propelled research in special-purpose inference accelerators based on emerging non-volatile memory (NVM) technologies. Such NVM crossbars promise fast and energy-efficient in-situ Matrix Vector Multiplication (MVM) thus alleviating the long-standing von Neuman bottleneck in today's digital hardware. However, the analog nature of computing in these crossbars is inherently approximate and results in deviations from ideal output values, which reduces the overall performance of Deep Neural Networks (DNNs) under normal circumstances. In this paper, we study the impact of these non-idealities under adversarial circumstances. We show that the non-ideal behavior of analog computing lowers the effectiveness of adversarial attacks, in both Black-Box and White-Box attack scenarios. In a non-adaptive attack, where the attacker is unaware of the analog hardware, we observe that analog computing offers a varying degree of intrinsic robustness, with a peak adversarial accuracy improvement of 35.34%, 22.69%, and 9.90% for white box PGD (ϵ=1/255, iter=30) for CIFAR-10, CIFAR-100, and ImageNet respectively. We also demonstrate “Hardware-in-Loop" adaptive attacks that circumvent this robustness by utilizing the knowledge of the NVM model. 
  
  
  
  § INTRODUCTION
  
  
  Deep Learning <cit.> has emerged as a popular, versatile machine learning methodology that can be applied to a wide range of optimization tasks, such as computer vision <cit.>, natural language processing <cit.>, recommender systems <cit.>, etc. As our reliance on deep learning increases, so does our need to build secure, reliable, efficient frameworks for executing its intensive computational requirements.
  
  To accommodate the growing computational needs of Deep Neural Networks (DNNs) special-purpose accelerators such as GoogleTPU <cit.>, Microsoft BrainWave <cit.>, and NVIDIA V100 <cit.> have been proposed. These systems perform efficient Matrix-Vector Multiplication (MVM) operations, the key computational kernel in DNNs, by co-locating memory and processing elements. Despite their success, the saturating scaling trends of digital CMOS <cit.> has garnered interest in Non-Volatile Memory (NVM) technologies such as RRAM <cit.>, PCRAM <cit.> and Spintronics <cit.>. The memory element in these technologies is arranged in a crossbar fashion to enable efficient MVM computations in the analog domain inside the memory array. Such an in-memory computing primitive can significantly lower power and latency compared to digital CMOS <cit.>. Promises offered by the NVM crossbars have propelled significant research in designing analog computing based accelerators, such as PUMA <cit.>.
  
  
  In an analog computing hardware, the output of an MVM operation is sensed as a summation of currents through resistive NVM devices arranged in a crossbar, and hence are prone to errors due to non-ideal behavior of the crossbar and its peripheral circuits. Such errors are hard to model due to the interdependence of multiple analog variables (voltages, currents, resistances) in the crossbar. These deviations result in overall performance degradation of the DNN implementation <cit.>. Several works have explored various techniques to counteract the impact of these non-idealities <cit.>. 
  
  On the flip side, even though the changes in DNN activations arising from non-idealities is difficult to model, it can potentially lead to adversarially robust DNN implementations. Adversarial images are generated by estimating the gradients of the DNN with respect to its input, and carefully perturbing the images in the direction of maximum change in the classifier output <cit.>. To counter such attacks, several techniques that rely on gradient obfuscation have been previously proposed <cit.>. In this work, we explore how non-ideal NVM crossbars have a similar intrinsic effect of gradient obfuscation. We implement DNNs on the PUMA architecture, which is composed of thousands of NVM crossbar based MVM units (MVMUs). The aforementioned errors occur at the output of these internal MVMUs, which are practically inaccessible to a third party user, such as the software designer or even an attacker. Moreover, the nature of the errors depends heavily on the technology,
  which might not be fully disclosed by the manufacturer. We study two distinct scenarios, one where the attacker does not have access to custom NVM hardware and generates attacks based on "accurate" digital hardware, and the other where the attacker generates attacks with the NVM hardware in loop.
  The main contributions of this work are as follows:
  
      
    * We demonstrate that adversarial attacks crafted without the knowledge of the hardware implementation are less effective in both black box and white box scenarios.
      
    * We tested multiple variants of NVM crossbars, and show that the degree of intrinsic robustness offered by the analog hardware is in proportion to its degree of non-ideal behavior. 
      
    * We show that “Hardware-in-Loop” adaptive adversarial attacks are more effective, as the attacker can now account for the non-ideal computations when crafting the adversarial examples. The degree of success depends on what hardware is available to the attacker and how similar it is to the target DNN's hardware implementation.
  
  
  
  
  § BACKGROUND AND RELATED WORK
  
  
  
  
   §.§ In-memory Analog Computing Hardware
  
  
  
  
  
  The basic compute fabric in NVM technologies is a two-dimensional cross-point memory, known as a crossbar, shown in Fig. <ref>. The memory devices lie at the intersection of horizontally (source-line) and vertically (bit-line) running metal lines. The conductance of each memory device can be programmed to a discrete number of levels <cit.>. By simultaneously applying inputs, in the form of voltages, V_i, at the source-lines, the multiplications are performed between the voltages, V_i and conductances, G_ij, by each NVM device using the principle of Ohm's law. Finally, the product, which is the resulting current, I_ij, from each NVM device, is summed up using Kirchoff's laws to produce a dot-product output, I_j at each column:
  
      I_j =∑_i I_ij =∑_i V_iG_ij
  
  
  
  
  
  
  
  
  
  
  
  
  This analog nature of computing introduces errors in the MVM computations due to several non-idealities arising from the NVM devices and peripheral and parasitic resistances such as R_source, R_sink, R_wire, as shown in Fig. <ref>. Crossbar parameters, such as Crossbar Size, and ON Resistance have varying impact on the degree of functional errors introduced by the non-idealities <cit.> as they alter the effective resistance of a crossbar column. Larger crossbar size lowers the effective resistance, making the crossbar more prone to non-ideal effects, while higher ON resistance increases it, resulting in a crossbar less affected by non-idealities. 
  
   
  Due to the non-idealities, the resulting output current, I_ni is a function of voltage vector V, conductance matrix G (V), which is now dependent on V, and several non-ideal factors:
  
      I_ni = f(V, G (V), R_source, R_sink, R_wire)
          <ref>
  
  
  
  
  
  
  
  We use GENIEx crossbar modeling technique <cit.>, which has a 2 layer perceptron network to model Equation <ref>. The network predicts the output current, I_ni, from the crossbar for different input voltages, V and conductances, G of the NVM crossbar. The GENIEx model is trained using output current data obtained from HSPICE simulations of NVM crossbars considering all aforementioned non-idealities with sample V and G vectors and matrices, respectively.  
  
  
  
  
  
  
  
  In order to evaluate DNNs on NVM crossbars in the presence of non-idealities, we use a simulation framework <cit.> following the standard technique of mapping convolutional and linear layers on a spatial NVM crossbar architecture such as PUMA <cit.>. This mapping is composed of three parts: i) Iterative matrix-vector multiplications, ii) Tiling and iii) Bit-slicing. First, the convolution or linear layer operation in a neural network, is divided into iterative matrix vector computation. 
  
  Second, the weight matrix is tiled into a number of crossbar sized segments. Third, since NVM devices can only accommodate limited number of bits, to represent larger bit precision inputs and weights, we perform bit-slicing. Here inputs and weights are divided into smaller bit portions, namely input streams and weight slices. 
  
  Based on the crossbar size, device properties and bit-width of streams and slices, the crossbar model is obtained using the aforementioned GENIEx technique.  
  
  The NVM crossbar non-idealities cause the activations at every layer to deviate from their expected value, and this deviation propagates through the network, resulting in  degradation of DNN accuracy at inference (without any adversary). Interestingly, the same deviation in activation imparts adversarial robustness when under attack, which is further analyzed in this paper.
  
  
  
   §.§ Adversarial Attacks
  
   
  In 2013, it was first demonstrated that a classifier can be forced to make an error by adding small perturbations to the data which are almost imperceptible to the human eye <cit.>. The term “adversarial examples" was coined to define such data designed specifically to fool the classifier. Since then, several methods have been developed to generate such data, which are known as “adversarial attacks". In principle, these attacks try to solve the following optimization problem <cit.>:
  
      x^* = x + argmin{z: F(θ, x + z)≠ F(θ, x)} = x + δ_x
  
  
  where x is the original data, x^* is the perturbed adversarial data, θ is the model parameter, F(θ, x) is the classifier function, mapping inputs to labels, and the objective of the adversary is to misclassify, i.e. F(θ, x^*) ≠ F(θ, x). Most attacks use gradient-based optimization to solve for eq.<ref>, and the attack's success relies on how accurately one can estimate ∇_xL(θ, x, y), the derivative of the cost function L(θ, x, y) with respect to x <cit.>.
  
  
  
  § ADVERSARIAL ROBUSTNESS OF NVM CROSSBAR BASED ANALOG COMPUTING
  
  
  In recent years, several adversarial defenses have been proposed that disrupt the gradient computation of the DNN by adding an extra computational element to the network, such as a randomization layer at the beginning <cit.>, or adaptive dropout after every layer <cit.>. When a DNN is implemented on an NVM crossbar architecture, the non-idealities have a similar effect of changing the layer-wise activations of the DNNs. There is no simple differentiable function to model these deviations, and one  cannot determine them without probing the analog hardware. Thus, such an implementation, could potentially increase the robustness of the neural network. In this section we describe the methodology to emulate DNNs on the PUMA architecture, and set up different threat scenarios based on the attacker's knowledge of both the software and the hardware. 
  
  
  
   §.§ Crossbar Models
  
  
  
  
  
  To model the non-ideal crossbar, we use GENIEx <cit.>, as described in the previous section. For this work, we have replicated the modeling technique of GENIEx to generate 3 crossbar models (Table <ref>). We used the RRAM device model <cit.> as the NVM device.
  
  The degree of non-ideality is described in <cit.> as Non-ideality Factor (NF) = Avg[ (Ideal_Output- NonIdeal_Output)/ Ideal_Output]. NF is directly (inversely) proportional to crossbar size (ON Resistance). In our experiments, we have considered different crossbar models to study the impact of different degrees of non-idealities, represented by different NF, on adversarial robustness, as shown in Table <ref>. 
  
  To implement this, we train different GENIEx crossbar models by creating datasets from data obtained by performing circuit simulations on the crossbar types listed in Table <ref>. To integrate these NVM crossbar models with the PyTorch framework, we adopted the aforementioned PUMA functional simulator from <cit.> based on PUMA hardware architecture <cit.>. 
  
  
  
  
   §.§ Datasets and Network Models
  
  
  For our evaluation we selected 3 image recognition tasks, and trained a ResNet <cit.> for each task.
  
      
    * CIFAR-10 <cit.>: A ResNet-20 was trained for 200 epochs and achieved test accuracy of 92.44%
      
    * CIFAR-100 <cit.>: A ResNet-32 was trained for 200 epochs and achieved test accuracy of 71.42%
      
    * ImageNet <cit.>: A ResNet-18 was trained for 90 epochs and achieved top-1 test accuracy of 69.83%. We used a reduced test set of 1000 images for adversarial attacks. 
  
  
  
  
  
   §.§ Generating Adversarial attacks
  
  
  We define 4 different threat scenarios with varying extent of the attacker's knowledge of the target DNN and the underlying hardware (Table <ref>). For each scenario, we defined an attack model (a DNN or an ensemble of DNNs) to  generate the adversarial images. We use Projected Gradient Descent (PGD) <cit.> to generate iterative perturbations that are bound by the l_∞ norm, as shown in Eq.<ref>:
  
      x^t+1 = Π_x+S(x^t + α sgn(∇_xL(θ, x^t, y))
  
  x^t+1 is the adversarial example generated at (t+1)^th iteration. The model's cost function is L(θ, x, y), which is a function of the model parameters θ, input x, and labels y. The set of allowed perturbations is given by S. For the l_∞ norm, the attack epsilon (ϵ) defines the set of perturbations as S = (δ | (x + δ≥ max(x + ϵ, 0)) (x + δ≤ min(x + ϵ, 1))), where x ∈ [0, 1].
  
  Additionally, for the two threat scenarios, non-adaptive, and adaptive Black Box attacks we also generated adversarial images using Square Attack <cit.>, which is a query efficient adversarial Black Box attack. While PGD attack success is dependent on estimating the local gradients of the defending model, a query based attack doesn't rely on gradient information at all. Instead, it generates adversarial images by conducting a randomized search <cit.>. Every time the attacker queries the model, the input image has random perturbations, sampled from a given distribution. If the perturbation succeeds in increasing the loss for that image, the image is updated, and this continues till either the image is misclassified, or the query limit is reached. 
  
  
  
    §.§.§ Non-Adaptive Attacks
  
  
  For non-adaptive attacks, we assume the attacker has no knowledge of the underlying analog hardware and the attacks are generated under the assumption of accurate digital computation. Under this category, we have devised 3 attacks.. 
  
  
  
  
  
  
    
  Ensemble Black Box Attack: The attacker queries the model on an accurate digital hardware and reads the output of the final layer before softmax (logits) to generate a synthetic dataset of training data and its corresponding logits. This synthetic dataset is used to train 3 different surrogate ResNet models, ResNet-10,20,32. These 3 models are then used to generate adversarial images using the stack parallel ensemble strategy <cit.>. 
  
  
  
    
  Square Attack (Black Box): The attacker queries the model on accurate digital hardware and has access to the last layer (logits) as in the case of the Ensemble Black Box Attacks. We use l_∞ Square Attack <cit.>, and set the maximum query limit to 1000. 
  
  
  
    
  White Box Attack: This is the highest threat level where the attacker has full knowledge of the model weight, thus the attack model is the same as the target model. However, while generating gradients, the attacker has no knowledge of the underlying analog hardware implementation. The gradients for the attack are computed assuming accurate digital hardware implementation.
  
  
  
    §.§.§ Hardware in Loop Adaptive Attacks
  
  
  The attacker is aware that the model is implemented on an NVM crossbar hardware. However, the crossbar model available to the attacker may or may not match with the target's implementation due to different hardware technologies
  
  
  For crafting Ensemble Black Box Attacks, the attacker queries the DNN model implemented on the NVM crossbar based hardware to create the synthetic dataset. Similarly, for Square Attack, the repeated queries are made for the DNN implemented on the Analog Hardware. As emulation of the crossbar based architecture take much longer, we limit the total number of queries to 30. In the case of White Box attacks, the attacker generates adversarial images using “Hardware-in-Loop" gradient descent. Note that the NVM crossbar based hardware is designed for inference tasks and does not support backpropagation of gradients. Thus, for  “Hardware-in-Loop", the forward pass is performed on NVM crossbar hardware, and all activations are recorded. However, the derivatives are calculated assuming ideal computations in place of non-ideal MVM operations of the crossbar. As described in Section <ref>, the NVM crossbar non-idealities vary with crossbar properties. We use 3 different crossbar models as defined in Table <ref> and we explore scenarios where there is a mismatch in the crossbar model used by the attacker and the target implementation.
   
  
  
  
  
  
  
  
  
  
  
  
  
    §.§.§ Comparison with Related Work
  
  We have selected 3 defenses that can be applied to a pretrained network as listed below. For a fair comparison, we apply non-adaptive attacks for these defenses as well, i.e. the defenses are not visible to the attacker when they query the model for the two Black Box attacks, and when they generate gradients for White Box attack.
  
  
       
    * Input Bit Width (BW) Reduction <cit.>: The input is quantized to 4-bits.
      
    * Stochastic Activation Pruning (SAP) <cit.> (for CIFAR-10/100 only): At inference, after every convolution layer, there is an adaptive dropout, that randomly sets the layer outputs to 0 with a probability proportional to their absolute value.
      
    * Random Padding <cit.> (for ImageNet only): Two randomization layers are introduced before the pretrained model. The first layer scales the input image to a random size NxN where N ∈ [299, 331] using nearest-neighbor extrapolation. The second layer randomly pads the image to generate the final image of size 331x331.
  
  
  
  
  § RESULTS
  
  
  
  The first effect of implementing DNNs on a NVM crossbar hardware is the reduction in clean accuracy due to the errors associated with non-ideal computations. Greater the Non-Ideality Factor (NF), more severe is the accuracy degradation as noted in Table <ref>. The clean accuracy of CIFAR-10 drops from 92.44% (accurate digital hardware) to 88.34% on 64x64_100k, the most non-ideal crossbar model among the three. Similarly, CIFAR-100 accuracy drops from 71.42% to 55.48% and ImageNet accuracy falls from 69.56% to 62.50%. If non-idealities of NVM hardware had no impact on adversarial robustness, similar degradation would have been observed in DNN accuracy under attack. However, our findings, as outlined below, indicate a different trend. 
  
  
  
   §.§ Non-Adaptive Attacks
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
    
  Ensemble Black Box Attacks From Fig.<ref>, we observe the decline in adversarial accuracy with increasing attack epsilon (ϵ) for CIFAR-10/100. The 64x64_300k model didn't exhibit any increase in robustness, instead it trailed behind the baseline accuracy. The NVM crossbar models, 32x32_100k and 64x64_100k, recorded an absolute increase in robustness of 5.3% and 7.8% averaged over ϵ = (2,4,6,8)/255, respectively for CIFAR-10. For CIFAR-100, it was 1.4% and 1.84% respectively. The peak improvement in robustness was observed for ϵ = 4/255 and has been summarized in Table <ref>.
  
  
  
  
  
    
  Square Attack (Black Box) The analog hardware shows the highest resilience against such an attack. As the attack is gradient-free in nature, we conclude that analog hardware offers robustness by modifying the inference itself. The perturbations that cause complete DNN failure, i.e. 0% accuracy, have much lower impact on the DNN implemented on NVM crossbar. The other 3 defense methods <cit.>, also perform well over a wide range of ϵ=(4,8,12,16)/255. The average robustness gain observed for CIFAR-10 was 23.93% , 49.80% and 46.63% with crossbar models as 64x64_300k, 32x32_100k, 64x64_100k  respectively. We see robustness gain increase from 64x64_300k to 32x32_100k, and then drop slightly for 64x64_100k. The increase if due to higher deviations in 32x32_100k compared to 64x64_300k. The slight decrease however, can be attributed to the counter effect of inaccurate computations as non-idealities increase further. We observe similar trends in CIFAR-100 and Imagenet as well, as shown in Fig. <ref> and Table <ref>.
  
  
  
  
  
  
    
  White Box Attacks Under this threat model we observe substantial improvement in robustness as depicted in Fig. <ref> and Table <ref>. The NVM model 64x64_300k still continues to closely follow baseline accuracy. For all 3 datasets, the baseline accuracy drops sharply to 0 beyond ϵ = 2/255.
  
  
  At this level, the NVM models are no longer able to recover any performance. We observe that 64x64_100k, the most non-ideal of the 3 models, offers the highest improvement for all 3 datasets, with absolute increase of 35.34% for CIFAR-10, 22.69% for CIFAR-100, and 9.90%  for ImageNet at ϵ = 1/255.
  
  
  
  
  
  
  We have summarized below the trends observed across all non-adaptive attacks. 
  
      
    * For gradient based attacks (PGD) <cit.>,
      
      
      more the attacker relies on estimating the true gradients of the target model for attack generation, greater is absolute robustness gain. We observed an increase in the absolute improvement from baseline accuracy as we move from Ensemble Black Box to White Box attacks.
      
    * The resulting accuracy is a combination of two opposing forces. The errors caused by the non-idealities try to lower the accuracy, while the intrinsic robustness lowers the effectiveness of the attack and pushes the accuracy higher than the baseline. For example, for 64x64_300k (NF = 0.07),  the MVM operations are closest to ideal computation for the non-adaptive attacks to transfer successfully. Whereas, the more non-ideal crossbar models, 32x32_100k and 64x64_100k, have greater clean accuracy degradation due to functional errors, but have higher adversarial accuracy, as the non-idealities hinder the transfer of the attacks. This push-pull effect can also be seen in Fig. <ref>, where we plot the robustness gain vs crossbar NF for all the non-adaptive attacks. We see a significant difference as NF increases from 64x64_300k to 32x32_100k. At 64x64_100k, we see the gain taper slightly below 32x32_100k, as inaccurate computations start to have a greater impact over intrinsic robustness. 
      
  
  
  
  
   §.§ Hardware-in-Loop Adaptive Attacks
  
  
  
  
  
  
  
  
    
  Ensemble Black Box Attacks When the attacker builds their synthetic dataset by querying the NVM crossbar hardware implementation of the DNN, the resulting Ensemble Black Box attacks are much more effective. The adversarial accuracy of the hardware falls significantly below the baseline, as shown in Fig. <ref> and Table <ref>. Even when the attack is built using a crossbar model different from the target, accuracy degradation is significant. We observe that attacks generated using 32x32_100k (NF = 0.14) are stronger than those generated using 64x64_300k (NF = 0.07) when applied to 64x64_100k (NF= 0.26). This implies that the lesser the difference in NF, the more effective are the attacks. 
  
  
  
    
  Square Attack (Black Box) By repeatedly querying the actual NVM crossbar based hardware, the attacker could generate much stronger attacks, as shown in Fig. <ref> and Table <ref>. In fact, the generated attacks are as strong as the baseline, however, when there is a significant mismatch in hardware properties, the attack doesn't transfer well. 
  
  
  
  
    
  White Box Attacks 
  
  Even when the attacker has full knowledge of the hardware, the non-idealities help improve robustness for White Box Attacks (Table <ref>). We observe that if the attacker's NVM model is different from the target, the attacks do not transfer well and are weaker than non-adaptive attacks. For example, for CIFAR-10, under attack epsilon ϵ=1/255, the accuracy of 64x64_300k NVM model is 0.60% for a non-adaptive attack, but 43.45% for an adaptive attack with incorrect NVM model. Thus having an incorrect crossbar model is worse than having no crossbar model at all in this case.
  
  
  
  § DISCUSSION
  
  
  Non-idealities in NVM crossbars have been a long-standing challenge <cit.> which cause accuracy degradation in DNNs, and several techniques have been proposed to compensate for it <cit.>. In this work, we study these non-idealities from the new perspective of adversarial robustness. We observed that DNNs implemented on an NVM crossbar hardware exhibit increased adversarial robustness under varied threat scenarios. While this robustness falls short of other defenses <cit.>, an important point to note is that such robustness is intrinsic to the NVM crossbar hardware, unlike other defenses which have a computational overhead. Also, any algorithmic defense can be further implemented on the analog hardware for additional robustness. The non-ideality factor (NF) of the crossbar model determines the degree of robustness. Therefore, one can potentially design NVM crossbars with optimal trade-off between accuracy degradation and increased robustness due to non-idealilties. We have demonstrated "Hardware-in-Loop" attacks where the knowledge of underlying hardware helps generate stronger attacks. While we have considered NVM crossbar models based on RRAM technology <cit.>, analog hardware based on other technologies <cit.> are also possible. This, along with chip to chip variations, may further hinder the transferability of attacks generated on one analog computing hardware to another. In summary, this work is the first step toward understanding the role of non-idealities in NVM crossbar hardware for adversarial robustness. It opens the possibilities of defenses that leverage the non-ideal computations, and on the other hand, attacks that exploit these non-idealities. 
  
  
  
  
  IEEEtran
  
  
  
  
  
  