ML Security PapersIntegrated Security Mechanisms for Weight Protection in Memristive Crossbar Arrays
Muhammad Faheemur Rahman , Wayne Burleson
Published on arXiv
2510.01350
Model Theft
OWASP ML Top 10 — ML05
Key Finding
Both security mechanisms provide robust weight protection and verifiable ownership with under 10% overhead in area, delay, and power across 45nm, 22nm, and 7nm CMOS nodes.
Keyed Permutor + Watermark Protection Columns
Novel technique introduced
Memristive crossbar arrays enable in-memory computing by performing parallel analog computations directly within memory, making them well-suited for machine learning, neural networks, and neuromorphic systems. However, despite their advantages, non-volatile memristors are vulnerable to security threats (such as adversarial extraction of stored weights when the hardware is compromised. Protecting these weights is essential since they represent valuable intellectual property resulting from lengthy and costly training processes using large, often proprietary, datasets. As a solution we propose two security mechanisms: Keyed Permutor and Watermark Protection Columns; where both safeguard critical weights and establish verifiable ownership (even in cases of data leakage). Our approach integrates efficiently with existing memristive crossbar architectures without significant design modifications. Simulations across 45nm, 22nm, and 7nm CMOS nodes, using a realistic interconnect model and a large RF dataset, show that both mechanisms offer robust protection with under 10% overhead in area, delay and power. We also present initial experiments employing the widely known MNIST dataset; further highlighting the feasibility of securing memristive in-memory computing systems with minimal performance trade-offs.
Key Contributions
- Keyed Permutor: a hardware mechanism that scrambles weights stored in memristive crossbar arrays using a secret key, rendering extracted weights unusable without the key
- Watermark Protection Columns: dedicated hardware columns embedding verifiable ownership marks for IP attribution even after data leakage
- Evaluation across 45nm, 22nm, and 7nm CMOS technology nodes showing under 10% overhead in area, delay, and power
🛡️ Threat Analysis
Both proposed mechanisms — Keyed Permutor (key-based weight scrambling to prevent unauthorized extraction) and Watermark Protection Columns (ownership verification embedded in the array) — directly defend against model weight theft. The watermark is embedded in the MODEL (its hardware representation) to prove ownership, not in generated outputs, placing this squarely in ML05.