[论文解读] Scalable Digital Compute-in-Memory Ising Machines for Robustness Verification of Binary Neural Networks

Madhav Vadlamani, Rahul K Singh+3 more|arXiv (Cornell University)|Mar 5, 2026

Physical Unclonable Functions (PUFs) and Hardware Security被引用 0

一句话总结

论文将 BNN 鲁棒性验证重新表述为 QUBO，并通过基于 SRAM 的数字化内存计算在记忆中的 Ising 机器求解，利用不完美解提取对抗性扰动并以高效方式验证非鲁棒性。

ABSTRACT

Verification of binary neural network (BNN) robustness is NP-hard, as it can be formulated as a combinatorial search for an adversarial perturbation that induces misclassification. Exact verification methods therefore scale poorly with problem dimension, motivating the use of hardware-accelerated heuristics and unconventional computing platforms, such as Ising solvers, that can efficiently explore complex energy landscapes and discover high-quality solutions. In this work, we reformulate BNN robustness verification as a quadratic unconstrained binary optimization (QUBO) problem and solve it using a digital compute-in-memory (DCIM) SRAM-based Ising machine. Instead of requiring globally optimal solutions, we exploit imperfect solutions produced by the DCIM Ising machine to extract adversarial perturbations and thereby demonstrate the non-robustness of the BNN. The proposed architecture stores quantized QUBO coefficients in approximately 9.1~Mb of SRAM and performs annealing in memory via voltage-controlled pseudo-read dynamics, enabling iterative updates with minimal data movement. Experimental projections indicate that the proposed approach achieves a $178 imes$ acceleration in convergence rate and a $1538 imes$ improvement in power efficiency relative to conventional CPU-based implementations.

研究动机与目标

• Motivate robustness verification for binary neural networks (BNNs) and its NP-hardness due to adversarial perturbation search.
• Propose a QUBO formulation of BNN robustness verification suitable for Ising hardware.
• Design an SRAM-based digital compute-in-memory (DCIM) Ising architecture with in-memory annealing.
• Demonstrate that imperfect Ising solutions can yield valid adversarial perturbations via forward BNN inference.
• Show hardware-aware performance gains over CPU-based verification in terms of convergence, energy, and scalability.

提出的方法

• Cast robustness verification as an optimization problem to find adversarial perturbations within a perturbation budget.
• Convert the QCBO/constraints into a QUBO via penalty and quadratization to obtain H(q)=q^T Q q.
• Map the QUBO to an Ising Hamiltonian and embed it for DCIM SRAM implementation with a pinned-one approach to handle diagonals.
• Use voltage-controlled pseudo-read noise during in-memory annealing to inject stochasticity without external RNG hardware.
• Perform sequential spin updates using in-memory MACs to compute local flip costs Delta E_i and accept updates in an annealing flow.
• Evaluate perturbations by reconstruction and forward BNN inference to identify adversarial examples.

实验结果

研究问题

• RQ1 Can BNN robustness verification be effectively expressed as a QUBO suitable for Ising hardware?
• RQ2 How does an SRAM-based DCIM Ising machine perform in discovering adversarial perturbations compared to CPU-based or simulated annealing approaches?
• RQ3 Do imperfect (non-global-minimum) solutions from Ising hardware suffice to identify valid adversarial examples via forward inference?
• RQ4 What are the hardware implications (area, energy, timing) of scaling QUBO-based BNN robustness verification to higher dimensions?

主要发现

• The DCIM Ising machine identifies near-optimal solutions and yields adversarial perturbations that flip BNN outputs, even when constraints are not perfectly satisfied.
• DCIM-based optimization achieves up to 178× faster convergence and up to 1538× better energy efficiency relative to CPU-based implementations in their projections.
• The approach produces a substantial number of good solutions and unique perturbations across multiple BNN configurations (e.g., 63x7x1, 127x7x1, 1023x3x1).
• Imperfect solutions frequently produce valid adversarial attacks after forward inference, demonstrating practical robustness-verification utility.
• 8-bit quantization preserves much of the energy convergence behavior, with some variance due to coefficient quantization but near-global-minimum regions are still reached.
• The proposed method scales to higher-dimensional inputs (including full-size 28×28 MNIST-like BNNs) and maintains verification capability.