ARMOR-IMC shows the dual threat facing analog MEA front-ends

What the work claims

Chowdhury, Zand, and Salehi present ARMOR-IMC, a post-training method that simultaneously improves reliability and security of analog in-memory computing (IMC) accelerators without retraining the neural network. The two threats are manufacturing process variation (PV), which can flip bits in the resistive weight arrays and degrade inference accuracy, and power side-channel attacks (SCAs), which exploit input-dependent power consumption to recover model parameters or secret data.¹

The authors introduce two metrics. The Variation Impact Score (VIS) ranks small crossbar tiles by how much localized bit-flips degrade inference accuracy. The Leakage Per Inference (LPI) metric measures the standard deviation of average power across inferences and serves as a first-order indicator of side-channel leakage. Using these metrics, ARMOR-IMC remaps critical weights away from vulnerable tiles and then injects randomized auxiliary power to break the correlation between input and measured power.

How it works

The test vehicle is a three-layer fully connected network trained on MNIST with a 400x120x84x10 architecture, implemented in the IMAC-Sim circuit-level simulator. The baseline error-free network achieves 69% inference accuracy with 4.7 W average power consumption.¹ Weights are mapped onto SOT-MTJ based magnetic RAM arrays using 5 kilohm and 15 kilohm resistance states to represent the two bit values.

PV is emulated by injecting random bit-flips at rates from 5% to 25%. Mean accuracy degrades from 66.25% at 5% bit-flips to 23.25% at 25% bit-flips, while average power stays essentially flat at 4.7 W.¹ To locate the damage, the authors partition each layer into 32x32 Fault Observation Windows (FOWs). Layer 1 maps to 52 FOWs, Layer 2 to fewer, and Layer 3 to only 3 FOWs. For each FOW they inject high bit-flip rates between 50% and 90% and measure the accuracy drop over 100 test images per run, producing a VIS scoreboard.

The remapping step swaps the contents of the most fault-sensitive FOW with a more resilient, geometry-compatible partner, prioritizing the partner with the highest stressed accuracy and lowest average power. The biggest recovery occurs in Layer 3, where only three FOWs exist: remapping lifts accuracy at 90% fault injection from 17% to 34%, effectively doubling it.¹

For security, the authors first show that baseline input-dependent power is measurable. Mean power across MNIST digit classes ranges from 4.60 W for digit 0 to 4.68 W for digit 6, with an LPI of approximately 0.059 W and inter-class separation larger than within-class standard deviation.¹ Deterministic power balancing suppresses this first-order leakage by more than 96%, but the fixed compensation rule creates a stationary signature vulnerable to averaging attacks. ARMOR-IMC therefore adds stochastic auxiliary power sampled uniformly from 0.2 W to 0.4 W during each inference window. The injected noise bandwidth of about 180 mW exceeds the baseline inter-class signal of about 140 mW, causing digit-class power distributions to overlap by roughly 34 mW in Layer 1 and 53 mW in Layer 2. The cost is a 6.5% power overhead, about 0.30 W.¹

Where a skeptic should push

The experiments are simulation-based in IMAC-Sim, not measurements of fabricated silicon. That is appropriate for a methodology paper, but it means the absolute accuracy and power numbers are tied to the simulator's device models and the chosen MNIST network. A different network, a different device technology, or a more capable adversary could change the quantitative conclusions.

The security analysis uses LPI as a proxy for true side-channel vulnerability rather than a full correlation power analysis attack. The authors acknowledge that stochastic injection raises the attacker's trace complexity, but they do not prove information-theoretic security. The 69% baseline accuracy is also modest; a higher-accuracy model may distribute importance differently across FOWs, altering the VIS landscape.

Most importantly for MEA use, the stochastic power injection occurs on the same power rail as the analog compute. In a mixed-signal front-end, injecting hundreds of milliwatts of randomized current could couple into the very neural signals the array is trying to record, turning a security defense into an electromagnetic-interference or supply-noise problem.

What this changes for mixed-signal MEA acquisition chains

The paper matters for MEA hardware because the same analog IMC primitives being developed for AI accelerators are also candidates for on-array neural signal processing: spike sorting, feature extraction, closed-loop stimulus triggering, and adaptive filtering. ARMOR-IMC shows that once weights live in resistive crossbars, PV and side-channel leakage are not separate concerns; they are coupled through the physical layout and the power supply.

The first lesson is that process variation in on-array weights is not a gradual quality loss but a sharp failure. A 25% bit-flip rate collapsed MNIST accuracy to 23.25%, and even the small Layer 3, with only three FOWs, dropped to 17% under 90% localized faults.¹ For an MEA front-end, the equivalent failure is not a slightly noisier recording; it is a wrong spike label, a missed burst, or an ill-timed stimulation pulse. If the array performs closed-loop control, that error propagates into the living tissue.

The second lesson is that power side-channels exist even in analog compute macros and can be exploited without invasive probing. An adversary with access to the supply current of an MEA headstage could potentially infer neural state or model parameters from input-dependent power. The countermeasure, randomized auxiliary current, is effective in simulation but must be evaluated against the MEA's analog-front-end noise budget. A 0.3 W randomized load may be negligible in a data-center accelerator but could be a dominant noise source in a microvolt-sensitive acquisition chain.

The genuine opportunity is architectural. VIS-guided remapping is a post-training fix, which means it can be applied to an already-trained closed-loop controller without collecting new biological data. That is valuable because retraining on living tissue is slow and expensive. The genuine threat is complacency: treating on-array compute as a pure digital-design problem and ignoring the mixed-signal reality that weight errors, power noise, and biological signals share the same silicon and the same power rail.

The bottom line

ARMOR-IMC demonstrates that analog IMC accelerators can be hardened against PV-induced faults and power side-channel leakage after training, using circuit-level remapping and stochastic power injection. The numerical gains are meaningful: near-doubling of accuracy in the most vulnerable layer and effective masking of input-dependent power signatures.

For MEA designers, the work is a reminder that moving compute onto the acquisition die imports the reliability and security problems of AI hardware into the biological interface. The decisive next step is a mixed-signal demonstration that measures how much VIS-guided remapping and stochastic power injection perturb the neural signal itself. If the defense corrupts the recording, it is not a defense.