RRAM-DP: Device-Calibrated Differential Privacy for In-Memory Edge Learning
2026-07-20 • Cryptography and Security
Cryptography and SecurityEmerging Technologies
AI summaryⓘ
The authors address privacy concerns in edge AIoT devices by using a special memory called RRAM, which can store and process data while naturally generating randomness. They created RRAM-DP, a method that carefully adds noise during memory writing to protect data privacy without losing much accuracy. Their technique, tested on several standard datasets, achieves strong privacy with only a small accuracy drop and saves energy and time compared to existing hardware. This work shows a way to do private and efficient AI training directly on memory at the edge.
Edge AIoTResistive-switching RAM (RRAM)Compute-in-memory (CiM)Differential Privacy (DP)Stochastic write behaviorWrite-verify operationSGD (Stochastic Gradient Descent)Energy efficiencyPrivacy-preserving training
Authors
Kwunhang Wong, Jichang Yang, Karl M. H. Lai, Hegan Chen, Songqi Wang, Wei Xuan, Ning Lin, Han Wang, Xiaojuan Qi, Zhongrui Wang
Abstract
Edge Artificial Intelligence of Things (AIoT) systems often collect sensitive data in situ, raising serious privacy concerns. Resistive-switching random-access memory (RRAM) is an attractive substrate for efficient AIoT thanks to its multi-bit storage and compute-in-memory (CiM) capabilities, while its inherently stochastic write behavior provides a natural source of randomness that can be leveraged for differential privacy (DP) protection. Yet how to transform this device-level randomness-typically viewed as detrimental to accuracy-into a principled randomized mechanism while preserving model utility remains underexplored. We propose RRAM-DP, a hardware-algorithm co-design that relaxes RRAM write-verify operations to inject calibrated noise for inherently (epsilon, delta)-DP with formal DP analysis; together with pretraining techniques, it renders a novel private, high-utility CiM training paradigm. On CIFAR-10/100, STS-B, and SST-2, RRAM-DP-SGD incurs at best only a 3.8% accuracy drop at (epsilon=2, delta=O(1/n))-DP relative to non-private SGD. At the same privacy level, RRAM-DP-SGD delivers up to 57x and 3.2x energy savings and 2.7x and 1.8x speedups over A100 and DiVa-GEMM, respectively. These results point toward efficient, privacy-preserving in-memory training on RRAM at the edge.