RRAM-DP: Device-Calibrated Differential Privacy for In-Memory Edge Learning
This work addresses the need for privacy-preserving edge AIoT training by providing a principled method to turn device-level randomness into a differential privacy mechanism, enabling efficient in-memory learning on RRAM.
RRAM-DP proposes a hardware-algorithm co-design that leverages the inherent stochastic write behavior of RRAM devices to achieve differential privacy with formal guarantees, achieving at most a 3.8% accuracy drop at (ε=2, δ=O(1/n))-DP on CIFAR-10/100, STS-B, and SST-2, while delivering up to 57x energy savings and 2.7x speedups over A100.
Edge Artificial Intelligence of Things (AIoT) systems often collect sensitive data in situ, raising serious privacy concerns. Resistive-switching random-access memory (RRAM) is an attractive substrate for efficient AIoT thanks to its multi-bit storage and compute-in-memory (CiM) capabilities, while its inherently stochastic write behavior provides a natural source of randomness that can be leveraged for differential privacy (DP) protection. Yet how to transform this device-level randomness-typically viewed as detrimental to accuracy-into a principled randomized mechanism while preserving model utility remains underexplored. We propose RRAM-DP, a hardware-algorithm co-design that relaxes RRAM write-verify operations to inject calibrated noise for inherently (epsilon, delta)-DP with formal DP analysis; together with pretraining techniques, it renders a novel private, high-utility CiM training paradigm. On CIFAR-10/100, STS-B, and SST-2, RRAM-DP-SGD incurs at best only a 3.8% accuracy drop at (epsilon=2, delta=O(1/n))-DP relative to non-private SGD. At the same privacy level, RRAM-DP-SGD delivers up to 57x and 3.2x energy savings and 2.7x and 1.8x speedups over A100 and DiVa-GEMM, respectively. These results point toward efficient, privacy-preserving in-memory training on RRAM at the edge.