Physically unclonable memristor-based compute-in-memory chip for secure AI

Memristor-based compute-in-memory architectures offer ultralow power consumption and latency, making them well-suited for deploying artificial intelligence on resource-constrained edge devices. However, their vulnerability to model extraction attacks poses a significant challenge to secure deployment. Here, we report a physically unclonable memristor-based compute-in-memory chip that secures AI models, encrypting with both external digital keys and in-situ analog keys sourced from physical hardware variations in the transistors of memristor arrays. The chip supports simultaneous in-situ decryption and vector-matrix multiplication. We demonstrate the security and efficiency of the fabricated chip in real-time electrocardiogram signal detection, achieving over a thousand-fold reduction in power consumption compared to conventional digital platforms. Leveraging the unique physically unclonable analog keys, the proposed system becomes resistant to cloning, with the model inference accuracy below 40%, even when digital keys and model parameter ciphertexts are fully exposed. Our memristor-based physically unclonable compute-in-memory chip could be used in edge computing applications that require secure and efficient edge AI deployment.