Fig. 9: Application of RePACK scheme under different storage strategies and implementation of the threefold Encryption Scheme.

a Diagram of the encryption when both weights and inputs are encrypted. Two physical unclonable function (PUF) responses encrypt weights and inputs respectively. Together with the layer encryption, the scheme performs a threefold encryption behavior. b Effectiveness of the threefold encryption scheme based on the RePACK scheme. With the same PUF response BMR, threefold encryption can further lower the inference accuracy by 7.62%. c The timing diagram of the CIM module with threefold encryption. The reconstruction process after CIM computation includes input-level partial sum reconstruction and weight-level partial sum reconstruction. w1 and w2 are the partial sum reconstruction results at the weight level in the computation process. The weight-level reconstruction is performed after each CIM cycle. This process is implemented on combinatorial logic. i1 and i2 are the partial sum results according to the high 4-bit part and the high 4-bit part of the input data, respectively. The input-level reconstruction is performed after the whole computation. i3 refers to the final partial sum reconstruction results after the whole computation. The whole reconstruction process only induces one extra clock cycle. d Multi-level conductance distribution based on ReRAM devices. e Multi-level conductance mapping of the encrypted convolutional layer in U-Net with RePACK. f The parameters are stored using ReRAM multi-values: The effect of wrong PUF response on inference accuracy and loss value in the PUF-guided weight redistribution.