Saion K. Roy

Research and projects

Machine-learning security and integrated-circuit design go hand in hand, from algorithms and computer architecture down to the hardware implementation. Making ML accelerators more energy efficient, for example through in-memory computing (IMC), exposes new attack surfaces. Commercial platforms show the same pattern, where shared resources such as caches and DRAM enable new side-channel and backdoor attacks. Because these vulnerabilities cut across the stack, finding and fixing them calls for algorithm-architecture-circuit co-design, toward secure and efficient ML hardware.

Energy-efficient eNVM in-memory computing accelerator design

Resistive IMC on embedded non-volatile memory (MRAM, ReRAM, and FeFET) promises large energy savings for machine learning, but analog compute comes with noise. Benchmarking these architectures, modeling their accuracy limits, and building them in silicon reveals how device non-idealities, wire parasitics, sensing mismatch, and ADC precision set the compute SNDR, and how that SNDR trades off against energy, network accuracy, and security.

Overview: benchmark IMC chips, model device and array accuracy limits, build measured MRAM silicon, and extend the energy-accuracy trade-off to security 01 · BENCHMARK IMC chip benchmarks Energy efficiency andcompute density acrosspublished IMC chips 02 · MODEL Device and array limits ADC Crossbar and parallel-bararrays across MRAM,ReRAM, and FeFET 03 · BUILD Measured MRAM silicon SEC22 nm 22 nm MRAM IMC macrowith statistical errorcompensation 04 · SECURE Security trade-off wŵIMCextracted Model extraction oneNVM IMCs, the bridgeinto accelerator security Energy-accuracy trade-off Device, array, sensing, and ADC non-idealities jointly limit compute SNDR + Security Energy-accuracy-security IMC benchmarking Crossbar IMC analysis Parallel-bar IMC analysis SEC–MRAM IMC EAS-IMCin accelerator security Overview: benchmark IMC chips, model device and array accuracy limits, build measured MRAM silicon, and extend the energy-accuracy trade-off to security01 · BENCHMARKIMC chip benchmarksEnergy efficiency andcompute density acrosspublished IMC chipsIMC benchmarking02 · MODELDevice and array limitsADCCrossbar and parallel-bararrays across MRAM,ReRAM, and FeFETCrossbar IMC analysisParallel-bar IMC analysis03 · BUILDMeasured MRAM siliconSEC22 nm22 nm MRAM IMC macrowith statistical errorcompensationSEC–MRAM IMCEnergy-accuracy trade-offDevice, array, sensing, and ADC non-idealitiesjointly limit compute SNDR04 · SECURESecurity trade-offwŵIMCextractedModel extraction oneNVM IMCs, the bridgeinto accelerator security+ SecurityEnergy-accuracy-securityEAS-IMCin accelerator security
  1. Energy efficiency versus compute density of SRAM in-memory-computing chips, clustered by technology node

    IMC benchmarking

    OJ-SSCS 2022CICC 2022

    A compositional framework that compares over 100 IMC and digital chips using bit-normalized TOPS, TOPS/W, and TOPS/mm², released as an open resource.

    • 106indexed papers
    • 13×SRAM IMC lead over digital in bank-level energy efficiency
    • 6.6×SRAM IMC lead over digital in compute density

    Paper

  2. Resistive crossbar in-memory computing architecture with a conductance at each input and output line crossing, followed by TIA current sensing and an ADC on every output line

    Crossbar IMC analysis

    ISCAS 2022

    Statistical signal-and-noise models that set the computational-accuracy limits of resistive crossbar IMCs across MRAM, ReRAM, and FeFET.

    • <1 ppResNet-20 accuracy gap to an exhaustive search
    • 6–7 bminimum ADC precision at N = 512

    Paper

  3. Parallel-bar resistive IMC architecture with 2T2R bitcells, a current-sensing loop, and per-column ADCs

    Parallel-bar IMC analysis

    JxCDC 2024

    Energy-accuracy trade-offs in MRAM, ReRAM, and FeFET parallel-bar IMCs, where wire parasitics, conductance variation, and sensing mismatch cap the compute SNDR and the network-level accuracy.

    • 18–22 dBmaximum compute SNDR
    • ≈12conductance contrast beyond which SNDR saturates
    • 22 nmMRAM measurements validate the model

    Paper

  4. Die micrograph of the 22 nm MRAM in-memory computing chip with the IMC core, SEC processor, drivers, ADC column array, and MRAM array outlined

    SEC–MRAM IMC

    JSSC 2024ESSCIRC 2023

    A measured 22 nm MRAM IMC macro with offset-compensating current sensing for mismatch and statistical error compensation (SEC) for wire parasitics.

    • 2.7–6 dBmeasured compute-SNDR gain at 0.8% energy overhead
    • 74.8% → 82.0%ResNet-20 accuracy on CIFAR-10 without noise-aware training
    • 5×energy reduction at iso-SNDR

    Paper

Security vulnerabilities of ML accelerators

The hardware that runs machine learning can leak what a model computes, or let an attacker change what it does. These confidentiality and integrity attacks, and the defenses against them, range from side channels on consumer hardware and Rowhammer-based backdoors in ML accelerators to model extraction from IMCs and hardware-Trojan detection through on-chip temperature sensing.

Overview: for each project, an icon for the physical mechanism, the hardware it acts on, and what is at risk MECHANISM HARDWARE AT RISK Rowhammer DDR4 DRAM Backdoored model FAULT ATTACKROBBIN Cache probing Apple silicon SoC GNN and LLM data SIDE CHANNELSLAC Output queries eNVM IMC chip ŵ Model weights MODEL EXTRACTIONEAS-IMC Power and cache traces FPGA, MCU, and x86 Secret keys SIDE CHANNELAttack from Shadows On-chip heat 65 nm CMOS chip Chip integrity TROJAN DETECTIONHOTSPOT AttackBridges both areasDefense Overview: for each project, an icon for the physical mechanism, the hardware it acts on, and what is at riskMECHANISMHARDWAREAT RISKFAULT ATTACKROBBINRowhammerDDR4 DRAMBackdooredmodelSIDE CHANNELSLACCache probingApple siliconSoCGNN andLLM dataMODEL EXTRACTIONEAS-IMCOutput querieseNVM IMC chipŵModel weightsSIDE CHANNELAttack from ShadowsPower andcache tracesFPGA, MCU,and x86Secret keysTROJAN DETECTIONHOTSPOTOn-chip heat65 nm CMOS chipChip integrityAttackBridges both areasDefense
  1. ROBBIN attack success rate rising to 90% while test accuracy settles at 85% as more DRAM pages are hammered

    ROBBIN

    ICCAD 2026

    Rowhammer-based backdoor injection during DNN inference through DDR4 DRAM bit flips, with a vulnerability-aware DRAM page allocation that keeps model weights off Rowhammer-prone pages.

    • ≈90%attack success on three DDR4 chips
    • 64–73%fewer pages than Don’t Knock
    • 86% → 91%clean accuracy restored by the page-allocation defense

    arXiv

  2. First CPrime step, in which loading SLC eviction sets evicts L2 cache lines into the system-level cache until the target SLC sets fill

    SLAC

    CCS 2026

    An access-driven CPU-to-GPU Prime+Probe side channel through the shared system-level cache of the Apple M1, built by reverse-engineering its indexing function.

    • >90%GNN edges recovered
    • 94.8%peak LLM input-keyword recovery from an unprivileged CPU process
    • 4,096shared-cache sets mapped

    arXiv

  3. Model extraction attack in which an adversary queries an IMC chip holding weights w and retrieves an approximate model

    Bridges both areas

    EAS-IMC

    TCAD 2026IEDM 2024ICCAD 2024

    Energy-accuracy-security trade-offs in MRAM, ReRAM, and FeFET IMCs, showing that analog noise lowers compute SNDR but does not protect stored weights from gradient-based model extraction attacks.

    • 0.1%accuracy gap to the fixed-point baseline
    • 4.18 dBlowest SNDR with near-baseline model recovery
    • <2 dBcompute SNDR of the secure operating zone

    Paper

  4. Unsupervised transfer-learning attack pipeline aligning a target encoder to a fixed source model with MMD and discriminator losses

    Attack from Shadows

    AsiaCCS 2026

    An unsupervised transfer-learning-based side-channel attack (UTLA) that recovers cryptographic keys across FPGA, microcontroller, and x86 targets and across leakage modalities.

    • 61traces to key recovery, FPGA power → MCU power
    • 435traces to key recovery, MCU power → x86 cache

    Paper

  5. HOTSPOT measurement setup with the testing PCB and oscilloscope, beside a zoomed view of the on-chip BJT sensor array around the hardware Trojan

    HOTSPOT

    TCAS-I 2026

    Hardware-Trojan detection in a 65 nm ASIC that repurposes existing on-chip differential temperature sensors to catch localized power anomalies.

    • 95%peak Trojan detection accuracy
    • 6.65×higher SNR than supply-current side-channel monitoring at 1.95 µW
    • 65 nmmeasured ASIC

    Paper

View all publications