RRAM-DP: Device-Calibrated Differential Privacy for In-Memory Edge Learning

2026-07-20

AI Summary

This work addresses the challenge of privacy leakage in edge AIoT devices when processing sensitive data locally, where existing differential privacy techniques struggle to balance model utility and energy efficiency. The authors propose a hardware-algorithm co-design that leverages the intrinsic write randomness of RRAM devices to inject calibrated noise while relaxing write verification, thereby realizing a theoretically grounded (ε, δ)-differential privacy mechanism. Integrated with a pretraining strategy, this approach enables high-energy-efficiency in-memory private training. Evaluated on CIFAR-10/100, STS-B, and SST-2 benchmarks, the method achieves (ε=2, δ=O(1/n)) privacy guarantees with at most a 3.8% accuracy drop, while offering 57× and 3.2× energy savings and 2.7× and 1.8× speedups over A100 and DiVa-GEMM, respectively, establishing a new paradigm for efficient private in-memory learning on edge devices.

Abstract

Edge Artificial Intelligence of Things (AIoT) systems often collect sensitive data in situ, raising serious privacy concerns. Resistive-switching random-access memory (RRAM) is an attractive substrate for efficient AIoT thanks to its multi-bit storage and compute-in-memory (CiM) capabilities, while its inherently stochastic write behavior provides a natural source of randomness that can be leveraged for differential privacy (DP) protection. Yet how to transform this device-level randomness-typically viewed as detrimental to accuracy-into a principled randomized mechanism while preserving model utility remains underexplored. We propose RRAM-DP, a hardware-algorithm co-design that relaxes RRAM write-verify operations to inject calibrated noise for inherently (epsilon, delta)-DP with formal DP analysis; together with pretraining techniques, it renders a novel private, high-utility CiM training paradigm. On CIFAR-10/100, STS-B, and SST-2, RRAM-DP-SGD incurs at best only a 3.8% accuracy drop at (epsilon=2, delta=O(1/n))-DP relative to non-private SGD. At the same privacy level, RRAM-DP-SGD delivers up to 57x and 3.2x energy savings and 2.7x and 1.8x speedups over A100 and DiVa-GEMM, respectively. These results point toward efficient, privacy-preserving in-memory training on RRAM at the edge.

Problem

• RRAM
• differential privacy
• compute-in-memory
• edge AI
• hardware randomness

Innovation

• RRAM
• differential privacy
• compute-in-memory
• hardware-algorithm co-design
• edge AI