Physically unclonable memristor-based compute-in-memory chip for secure AI

Physically unclonable memristor-based compute-in-memory chip for secure AI | Research Square window.SnipcartSettings = { analytics: { enabled: false } }; (function() { var accessVector = localStorage.getItem('access_vector') || ''; window.dataLayer = window.dataLayer || []; if (accessVector) { window.dataLayer.push({ user: { profile: { profileInfo: { snid: accessVector } } } }); } })(); (function(w,d,s,l,i){w[l]=w[l]||[];w[l].push({'gtm.start':new Date().getTime(),event:'gtm.js'});var f=d.getElementsByTagName(s)[0],j=d.createElement(s),dl=l!='dataLayer'?'&l='+l:'';j.async=true;j.src='https://www.googletagmanager.com/gtm.js?id='+i+dl;f.parentNode.insertBefore(j,f);})(window,document,'script','dataLayer','GTM-K279D39R'); Browse Preprints In Review Journals COVID-19 Preprints AJE Video Bytes Research Tools Research Promotion AJE Professional Editing AJE Rubriq About Preprint Platform In Review Editorial Policies Our Team Advisory Board Help Center Sign In Submit a Preprint Cite Share Download PDF Article Physically unclonable memristor-based compute-in-memory chip for secure AI Peng Huang, Yiyang Chen, Lixia Han, Ao Shi, Lianliang Wu, Hairuo Lu, and 6 more This is a preprint; it has not been peer reviewed by a journal. https://doi.org/ 10.21203/rs.3.rs-7298175/v1 This work is licensed under a CC BY 4.0 License Status: Under Review Version 1 posted You are reading this latest preprint version Abstract Memristor-based compute-in-memory architectures offer ultralow power consumption and latency, making them well-suited for deploying artificial intelligence on resource-constrained edge devices. However, their vulnerability to model extraction attacks poses a significant challenge to secure deployment. Here, we report a physically unclonable memristor-based compute-in-memory chip that secures AI models, encrypting with both external digital keys and in-situ analog keys sourced from physical hardware variations in the transistors of memristor arrays. The chip supports simultaneous in-situ decryption and vector-matrix multiplication. We demonstrate the security and efficiency of the fabricated chip in real-time electrocardiogram signal detection, achieving over a thousand-fold reduction in power consumption compared to conventional digital platforms. Leveraging the unique physically unclonable analog keys, the proposed system becomes resistant to cloning, with the model inference accuracy below 40%, even when digital keys and model parameter ciphertexts are fully exposed. Our memristor-based physically unclonable compute-in-memory chip could be used in edge computing applications that require secure and efficient edge AI deployment. Physical sciences/Nanoscience and technology/Nanoscale devices/Electronic devices Physical sciences/Engineering/Electrical and electronic engineering Full Text Additional Declarations There is NO Competing Interest. Supplementary Files Supplementary.pdf Supplementary Information of Physically unclonable memristor-based compute-in-memory chip for secure AI Cite Share Download PDF Status: Under Review Version 1 posted You are reading this latest preprint version Research Square lets you share your work early, gain feedback from the community, and start making changes to your manuscript prior to peer review in a journal. As a division of Research Square Company, we’re committed to making research communication faster, fairer, and more useful. We do this by developing innovative software and high quality services for the global research community. Our growing team is made up of researchers and industry professionals working together to solve the most critical problems facing scientific publishing. Also discoverable on Platform About Our Team In Review Editorial Policies Advisory Board Help Center Resources Author Services Accessibility API Access RSS feed Manage Cookie Preferences © Research Square 2026 | ISSN 2693-5015 (online) Privacy Policy Terms of Service Do Not Sell My Personal Information {"props":{"pageProps":{"initialData":{"identity":"rs-7298175","acceptedTermsAndConditions":true,"allowDirectSubmit":false,"archivedVersions":[],"articleType":"Article","associatedPublications":[],"authors":[{"id":510253430,"identity":"6df0a656-5c71-4e49-aae2-8e16b6c8059d","order_by":0,"name":"Peng Huang","email":"data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAZAAAAAyAQMAAABI0h/eAAAABlBMVEX///8AAABVwtN+AAAACXBIWXMAAA7EAAAOxAGVKw4bAAAAwklEQVRIiWNgGAWjYDACCTBpA6F5SNCSRrqWwyRoMZfuMfxc8Ot8nuSMBMYHb9sY5M0JabGcc8ZYembf7WJpiQRmw7ltDIY7GwhoMbiRu0Gat+d24jyJBDZp3jaGBIMDhLVs/s3bcw6khf03sVq2SfP8OJA4G2gLM1FaLGfkf7PmbUgulux52Cw555yE4QZCWswl0pJv8/yxy5M4nnzww5syG3nCDgMRjED3AMkGBlg0EdbC8AekZRSMglEwCkYBDgAAaSs/UX9816YAAAAASUVORK5CYII=","orcid":"https://orcid.org/0000-0003-3280-0099","institution":"Peking University","correspondingAuthor":true,"prefix":"","firstName":"Peng","middleName":"","lastName":"Huang","suffix":""},{"id":510253431,"identity":"bc34e878-52a6-4684-86c0-9246c7d811b6","order_by":1,"name":"Yiyang Chen","email":"","orcid":"","institution":"Peking university","correspondingAuthor":false,"prefix":"","firstName":"Yiyang","middleName":"","lastName":"Chen","suffix":""},{"id":510253432,"identity":"1ce508fa-7b07-473b-a54d-4410ef3eacd9","order_by":2,"name":"Lixia Han","email":"","orcid":"","institution":"Nanjing University of Aeronautics and Astronautics","correspondingAuthor":false,"prefix":"","firstName":"Lixia","middleName":"","lastName":"Han","suffix":""},{"id":510253433,"identity":"07e94614-d7c8-4981-aa77-e2c640f26f65","order_by":3,"name":"Ao Shi","email":"","orcid":"","institution":"Peking university","correspondingAuthor":false,"prefix":"","firstName":"Ao","middleName":"","lastName":"Shi","suffix":""},{"id":510253434,"identity":"71e5ac9b-0a60-4b78-9443-6a7910a4d9e5","order_by":4,"name":"Lianliang Wu","email":"","orcid":"","institution":"Peking university","correspondingAuthor":false,"prefix":"","firstName":"Lianliang","middleName":"","lastName":"Wu","suffix":""},{"id":510253435,"identity":"e0c965b7-4eb9-49de-b832-af0cefebec3e","order_by":5,"name":"Hairuo Lu","email":"","orcid":"","institution":"Peking university","correspondingAuthor":false,"prefix":"","firstName":"Hairuo","middleName":"","lastName":"Lu","suffix":""},{"id":510253436,"identity":"ea588d53-2584-441a-b024-951adce648d8","order_by":6,"name":"Kexun Li","email":"","orcid":"","institution":"Peking university","correspondingAuthor":false,"prefix":"","firstName":"Kexun","middleName":"","lastName":"Li","suffix":""},{"id":510253437,"identity":"c4714b31-ed89-4ecd-8429-3a9e45837d66","order_by":7,"name":"Haozhang Yang","email":"","orcid":"","institution":"Peking university","correspondingAuthor":false,"prefix":"","firstName":"Haozhang","middleName":"","lastName":"Yang","suffix":""},{"id":510253438,"identity":"9a5f110a-f994-4ab1-9ee9-4551e6d7d333","order_by":8,"name":"Jiaqi Li","email":"","orcid":"","institution":"Peking university","correspondingAuthor":false,"prefix":"","firstName":"Jiaqi","middleName":"","lastName":"Li","suffix":""},{"id":510253439,"identity":"8ce264de-c332-4e26-8787-6124fb67d5c7","order_by":9,"name":"Zheng Zhou","email":"","orcid":"https://orcid.org/0009-0008-3957-3144","institution":"Peking University","correspondingAuthor":false,"prefix":"","firstName":"Zheng","middleName":"","lastName":"Zhou","suffix":""},{"id":510253440,"identity":"c9b61497-9e42-4072-85e6-4ae4acc9a4d7","order_by":10,"name":"Lifeng Liu","email":"","orcid":"https://orcid.org/0000-0002-0187-9243","institution":"Peking University","correspondingAuthor":false,"prefix":"","firstName":"Lifeng","middleName":"","lastName":"Liu","suffix":""},{"id":510253441,"identity":"b28d88e3-13f9-46ff-8bcd-76309277c262","order_by":11,"name":"Jinfeng Kang","email":"","orcid":"https://orcid.org/0000-0002-6286-0423","institution":"Peking University","correspondingAuthor":false,"prefix":"","firstName":"Jinfeng","middleName":"","lastName":"Kang","suffix":""}],"badges":[],"createdAt":"2025-08-05 08:35:14","currentVersionCode":1,"declarations":"","doi":"10.21203/rs.3.rs-7298175/v1","doiUrl":"https://doi.org/10.21203/rs.3.rs-7298175/v1","draftVersion":[],"editorialEvents":[],"editorialNote":"","failedWorkflow":false,"files":[{"id":90654004,"identity":"097fbd6a-1474-4c29-9ea1-f2b3ec2e3661","added_by":"auto","created_at":"2025-09-05 09:27:13","extension":"pdf","order_by":1,"title":"","display":"","copyAsset":false,"role":"manuscript-pdf","size":1761404,"visible":true,"origin":"","legend":"Article File","description":"","filename":"Manuscript.pdf","url":"https://assets-eu.researchsquare.com/files/rs-7298175/v1_covered_ea3db430-fbc8-4f55-a453-7a5a1cb6d15e.pdf"},{"id":90653255,"identity":"8103c6a8-77f6-4851-a516-f8b8e5be6ba7","added_by":"auto","created_at":"2025-09-05 09:19:07","extension":"pdf","order_by":1,"title":"","display":"","copyAsset":false,"role":"supplement","size":1693370,"visible":true,"origin":"","legend":"Supplementary Information of Physically unclonable memristor-based compute-in-memory chip for secure AI","description":"","filename":"Supplementary.pdf","url":"https://assets-eu.researchsquare.com/files/rs-7298175/v1/578559ff2f19544f5d07f539.pdf"}],"financialInterests":"There is \u003cb\u003eNO\u003c/b\u003e Competing Interest.","formattedTitle":"Physically unclonable memristor-based compute-in-memory chip for secure AI","fulltext":[],"fulltextSource":"","fullText":"","funders":[],"hasAdminPriorityOnWorkflow":false,"hasManuscriptDocX":false,"hasOptedInToPreprint":true,"hasPassedJournalQc":"","hasAnyPriority":true,"hideJournal":false,"highlight":"","institution":"","isAcceptedByJournal":false,"isAuthorSuppliedPdf":true,"isDeskRejected":"","isHiddenFromSearch":false,"isInQc":false,"isInWorkflow":false,"isPdf":true,"isPdfUpToDate":true,"isWithdrawnOrRetracted":false,"journal":{"display":true,"email":"[email protected]","identity":"nature-portfolio","isNatureJournal":true,"hasQc":false,"allowDirectSubmit":false,"externalIdentity":"","sideBox":"","snPcode":"","submissionUrl":"","title":"Nature Portfolio","twitterHandle":"","acdcEnabled":false,"dfaEnabled":false,"editorialSystem":"ejp","reportingPortfolio":"","inReviewEnabled":true,"inReviewRevisionsEnabled":false},"keywords":"","lastPublishedDoi":"10.21203/rs.3.rs-7298175/v1","lastPublishedDoiUrl":"https://doi.org/10.21203/rs.3.rs-7298175/v1","license":{"name":"CC BY 4.0","url":"https://creativecommons.org/licenses/by/4.0/"},"manuscriptAbstract":"Memristor-based compute-in-memory architectures offer ultralow power consumption and latency, making them well-suited for deploying artificial intelligence on resource-constrained edge devices. However, their vulnerability to model extraction attacks poses a significant challenge to secure deployment. Here, we report a physically unclonable memristor-based compute-in-memory chip that secures AI models, encrypting with both external digital keys and in-situ analog keys sourced from physical hardware variations in the transistors of memristor arrays. The chip supports simultaneous in-situ decryption and vector-matrix multiplication. We demonstrate the security and efficiency of the fabricated chip in real-time electrocardiogram signal detection, achieving over a thousand-fold reduction in power consumption compared to conventional digital platforms. Leveraging the unique physically unclonable analog keys, the proposed system becomes resistant to cloning, with the model inference accuracy below 40%, even when digital keys and model parameter ciphertexts are fully exposed. Our memristor-based physically unclonable compute-in-memory chip could be used in edge computing applications that require secure and efficient edge AI deployment.","manuscriptTitle":"Physically unclonable memristor-based compute-in-memory chip for secure AI","msid":"","msnumber":"","nonDraftVersions":[{"code":1,"date":"2025-09-05 09:19:03","doi":"10.21203/rs.3.rs-7298175/v1","editorialEvents":[],"status":"published","journal":{"display":true,"email":"[email protected]","identity":"nature-electronics","isNatureJournal":true,"hasQc":false,"allowDirectSubmit":false,"externalIdentity":"natelectron","sideBox":"Learn more about [Nature Electronics](http://www.nature.com/natelectron/)","snPcode":"","submissionUrl":"","title":"Nature Electronics","twitterHandle":"","acdcEnabled":true,"dfaEnabled":true,"editorialSystem":"ejp","reportingPortfolio":"Nature Research","inReviewEnabled":true,"inReviewRevisionsEnabled":false}}],"origin":"","ownerIdentity":"2a65c8cf-0437-4475-8b29-f908f954a56c","owner":[],"postedDate":"September 5th, 2025","published":true,"recentEditorialEvents":[],"rejectedJournal":[],"revision":"","amendment":"","status":"under-review","subjectAreas":[{"id":54198550,"name":"Physical sciences/Nanoscience and technology/Nanoscale devices/Electronic devices"},{"id":54198551,"name":"Physical sciences/Engineering/Electrical and electronic engineering"}],"tags":[],"updatedAt":"2025-09-05T09:19:03+00:00","versionOfRecord":[],"versionCreatedAt":"2025-09-05 09:19:03","video":"","vorDoi":"","vorDoiUrl":"","workflowStages":[]},"version":"v1","identity":"rs-7298175","journalConfig":"researchsquare"},"__N_SSP":true},"page":"/article/[identity]/[[...version]]","query":{"redirect":"/article/rs-7298175","identity":"rs-7298175","version":["v1"]},"buildId":"8U1c8b4HqxoKbykW_rLl7","isFallback":false,"isExperimentalCompile":false,"dynamicIds":[84888],"gssp":true,"scriptLoader":[]}