Fig. 5: System designs of layer encryption, weight encryption, and input encryption in the RePACK scheme.

a The schematic of layer encryption (PUF-guided inference). The neural network inference uses real weights or fake weights depending on the PUF response. PUF: physical unclonable function. CIM: compute-in-memory. b The hardware implementation of PUF-guided inference. A discriminator is used to detect the PUF response and decide whether to use the real multiply-and-accumulate (MAC) results from the ReRAM CIM core or the random bitstream from TRNG. c The schematic of weight encryption (PUF-guided weight redistribution). The weights are stored in a ReRAM-based CIM core as differential pairs. The sequence of these differential pairs is redistributed according to the PUF response. During the CIM computation, the positive/negative columns are computed alternately in a clock cycle. CLK: clock signal. TIA: transimpedance amplifier. S&H: sample and hold circuit. ADC: analog-to-digital converter. d The hardware implementation of PUF-guided weight redistribution. The multiplexers at the output side of the ReRAM-based CIM core use PUF response to select the CIM results to the partial sum registers. e The schematic of input encryption (PUF-guided input). In this scheme, the input data is encrypted before sending to the CIM macro. After CIM computation, the output data is decrypted. f The hardware implementation of PUF-guided input. The input sequence of columns in the input data is redistributed according to the PUF response.