ARMOR-IMC: Adaptive Resource Mapping for Operational Robustness via Secure In-Memory Computing Muhtasim Alam Chowdhury∗ , Ramtin Zand† , Soheil Salehi∗ † Department of Computer Science and Engineering, University of South Carolina, Columbia, SC, USA ∗ Department of Electrical and Computer Engineering, University of Arizona, Tucson, AZ, USA
arXiv:2607.10938v1 [cs.CR] 12 Jul 2026
{mmc7, ssalehi}@arizona.edu∗ , [email protected]†
Abstract—The massive data-movement overhead in traditional architectures has led to the adoption of In-Memory Computing (IMC) for energy-efficient Deep Neural Network (DNN) processing. By leveraging emerging devices like Spin-Orbit Torque Magnetic Tunnel Junctions (SOT-MTJs), IMC bypasses the “memory wall” and reduces leakage power inherent in traditional CMOS. However, this shift introduces dual hardware threats: manufacturing Process Variation (PV) degrades reliability and increases vulnerability to fault injection, while power SideChannel Attacks (SCAs) compromise security. Existing defenses address these threats in isolation. This work presents a posttraining framework that simultaneously hardens analog IMC accelerators against both threats without retraining the model. Implemented in the IMAC-Sim simulator, our approach uses the proposed Variation Impact Score (VIS) to guide the mapping of Fault Observation Windows (FOWs) and introduces the Leakage Per Inference (LPI) metric to quantify input-dependent power variability under stochastic injection and the resulting reduction in effective signal-to-noise ratio. Experiments show that PVinduced faults can degrade accuracy by over 50%, while our method restores near-baseline accuracy and mitigates the threat of correlation-based power analysis attacks. Keywords—Secure In-Memory Computing, Robust AI Accelerators, Emerging Devices, Side-Channel Mitigation
I. I NTRODUCTION Deep Neural Networks (DNNs) are now integral to missioncritical systems, placing immense strain on conventional hardware. To overcome the resulting von Neumann bottleneck, the underlying hardware is shifting towards In-Memory Computing (IMC) architectures that leverage emerging devices like Spin-Orbit Torque Magnetic Tunnel Junction (SOT-MTJ) based Magnetic Random Access Memories (MRAMs) [1]. However, this transition introduces significant hardware security and reliability challenges that threaten the integrity and confidentiality of AI workloads. The first major threat is reliability degradation caused by manufacturing Process Variation (PV). Our prior work demonstrated that subtle, adversarial, or unintentional variations in physical parameters, such as the SOT-MTJ device’s oxide thickness (tox ), can alter its resistive states, inducing systemic bit-flips in the MRAM weight arrays that significantly degrade the inference accuracy of the deployed DNN model [2], [3]. The second major threat is physical Side-Channel Attacks (SCAs). It is wellestablished that DNN accelerators are vulnerable to attacks where an adversary with physical proximity measures the device’s power consumption to infer secret data. Since the power consumed by a circuit is data-dependent, attackers can
979-8-3195-0489-0/26/$31.00 ©2026 IEEE
Fig. 1. Overview of the ARMOR-IMC framework, illustrating the overall scope and highlighting the dual-metric analysis and adaptive mapping flow for improving both reliability and side-channel resilience in IMC accelerators.
leverage statistical techniques such as Correlation Power Analysis (CPA) and Differential Power Analysis (DPA) to recover the secret parameters of the model, potentially compromising its Intellectual Property (IP) [4]. While some defenses exist, they typically address these reliability and security threats in isolation, leaving a critical gap where a system hardened against one threat remains vulnerable to the other. To address this gap, we propose ARMOR-IMC, illustrated in Figure 1, a post-training framework that mitigates both PVinduced reliability issues and side-channel leakage vulnerabilities without requiring costly model retraining. Our entire methodology is implemented and validated within IMAC-Sim, a Python-based, circuit-level simulation framework that generates SPICE netlists of IMC circuits, enabling highly accurate evaluation of performance metrics, including power, latency, and the effects of interconnect parasitics [5]. The core of our framework combines an architecture-level mapping strategy with a stochastic power injection mechanism, employing two complementary metrics defined over the FOW abstraction for reliability analysis and system-level power behavior for security analysis. The first metric, a Variation Impact Score (VIS), quantifies the reliability risk by running systematic fault injection campaigns to measure the accuracy degradation caused by random faults within each FOW. The second metric, Leakage Per Inference (LPI), quantifies the security risk by capturing input-dependent power variability. II. BACKGROUND AND M OTIVATION Building upon the operational risks identified in missioncritical systems, we examine PV-induced bit-flip errors and data-dependent power leakage in analog IMC under the following threat model. We employ a gray-box adversarial model in which a supply-chain insider with limited visibility into the IMC design can manipulate fabrication processes to induce
Metric Value (Accuracy %, Power W)
66.25
Mean Accuracy (%) Mean Power (W)
60 50 42.12
40
34.75
30
26.50
23.25
20 10 0
4.66697
5
4.66618
10
4.66478
15 Bit-Flip Error Rate (%)
4.66403
20
4.66405
25
Fig. 2. Mean inference accuracy and mean power consumption across varying uniform bit-flip error rates (5%–25%).
defects, while a non-invasive side-channel adversary monitors aggregate power consumption during inference. A. In-Memory Computing (IMC) and Process Variation Within the broader field of IMC, architectures are typically classified as either digital or analog, with this work focusing on analog IMC that utilizes the physical device properties of non-volatile memories such as SOT-MRAM to execute large-scale matrix computations such as Matrix Multiplication (MatMul) by exploiting Ohm’s and Kirchhoff’s laws. Even when accounting for the overhead of required data converters, the reduction in core computational energy allows analog IMC to achieve a lower total energy per operation compared to digital IMCs [6]. To model this, we utilize IMAC-Sim, which has gained attention for its ability to efficiently model MatMul using crossbar arrays of memristive architectures [5]. Despite these advantages, SOT-MTJ devices remain highly susceptible to process variation at scaled technology nodes. These manufacturing fluctuations manifest in critical physical parameters such as the free-layer dimensions and, most significantly, the oxide tunnel barrier thickness (Tox ), which directly impacts the stability of the device’s Parallel (RP ) and Anti-Parallel (RAP ) resistive states [2], [3]. Simulations using physically grounded Verilog-AMS models demonstrate that Tox variations exert an exponential influence on device behavior. In particular, if Tox is reduced by less than 1 nm, the resulting read current through the device can exceed the critical switching threshold, triggering unintentional bit-flips during read operations [2]. B. Power Side-Channel Leakage in IMC Accelerators Power SCA exploits the fundamental dependence between a circuit’s instantaneous power consumption and the data being processed, a principle formalized by Kocher et al. through Differential Power Analysis (DPA) and Correlation Power Analysis (CPA) [4], [7]. While early SCA studies primarily targeted cryptographic implementations, recent work has demonstrated that machine learning accelerators are similarly vulnerable, as data-dependent switching activity can leak information about internal computations and model parameters. In the context of IMC, this risk is amplified by the stationary mapping of NN weights and the deterministic execution patterns of analog and mixed-signal compute macros. III. P ROPOSED M ETHODOLOGY: ARMOR-IMC This section introduces the ARMOR-IMC framework.
A. VIS-Based Reliability Analysis and Remapping Our reliability analysis is based on introducing random bitflips into the memristive crossbar arrays in order to identify vulnerable regions. These PV effects manifest as unintended, statistically distributed resistance shifts across SOT-MTJ devices, directly inducing bit-flip errors in stored NN weights [8]. The fault injection procedure is implemented using IMACSim [5], where software-trained NN weights are mapped onto resistive crossbar arrays using low-resistance (5 KΩ) and high-resistance (15 KΩ) states. PV-induced bit-flip errors are emulated by directly altering these resistance values, with 100-run Monte Carlo simulations per configuration. As shown in Figure 2, mean inference accuracy progressively degrades from 66.25% at 5% bit-flips to 23.25% at 25% fault rates, while mean power consumption remains stable. To enable fine-grained fault sensitivity analysis, IMACSim partitions each NN layer into smaller sub-arrays that realistically model interconnect parasitics and physical layout constraints. In this work, we evaluate a three-layer DNN trained on the MNIST dataset with a 400 × 120 × 84 × 10 architecture, corresponding to 48,000, 10,080, and 840 weights in layers 1, 2, and 3, respectively. Among supported sub-array sizes (32×32, 64×64, 128×128, and 256×256), the 32×32 configuration provides the most reliable performance and is therefore adopted throughout this study. This partitioning yields fixed-size tiles referred to as Fault Observation Windows (FOWs), which represent the fundamental analytical units for localized fault analysis. The number of horizontal and vertical partitions for each layer iscomputed as: Nin + 1 Nout , Vp = (1) Hp = Xrow Xcol where Nin and Nout denote the number of input and output neurons, and Xrow and Xcol correspond to the FOW dimensions (32×32). For example, the first layer is segmented into 4 × 13 = 52 FOWs, which are indexed for targeted fault injection and analysis. Using this FOW-level abstraction, we define the VIS to quantify the sensitivity to localized faults within each layer. VIS is computed by individually injecting high bit-flip rates (50%-90%) into each FOW while keeping all other regions fault-free, followed by inference evaluation over 100 test images in each run. These localized PV experiments isolate fault-sensitive crossbar regions by aggregating VIS values into a scoreboard that ranks FOWs from most to least vulnerable based on their impact on inference accuracy. Dynamic Weight Mapping Strategy. To improve robustness against PV-induced faults, a dynamic weight mapping strategy is employed to reallocate critical weights from vulnerable regions of the crossbar to more reliable locations. The procedure operates at the granularity of FOWs and is guided by the computed VIS profiles. For a given weight matrix W ∈ RC×R partitioned into N FOWs {S1 , . . . , SN }, the most fault-affected region is identified by computing the Mean Absolute Error (MAE) between the fault-perturbed matrix W and a clean reference matrix W ref for each FOW: X 1 MAEb = Wij − Wijref , (2) |Sb | (i,j)∈Sb
(3)
A resilient partner FOW k is then selected from geometrycompatible candidates within the same layer, prioritized by highest fault-stressed inference accuracy derived from VIS. In the case of multiple candidates with identical fault-stress accuracy, ties are resolved by selecting the FOW with the lowest average power consumption. The contents of Sb⋆ and Sk⋆ are subsequently swapped, effectively relocating highimportance weights to more reliable physical regions without modifying the overall crossbar structure or operation count. This mapping is performed as a pre-inference step prior to SPICE netlist synthesis in IMAC-Sim.
Layer 1 VIS-Based Heatmap Across Error Rates 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52
52
50% 60% 30
70% 80%
15
90%
B. Leakage Per Inference (LPI) Metric
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52
Layer 2 VIS-Based Heatmap Across Error Rates 2
3
4
5
6
7
8
9
Layer 3 VIS-Based Heatmap Across Error Rates 10
11
12
60%
8
70% 80%
4
90% 1
2
3
4
5
6
7
8
9
10
11
12
1
12
50%
1
Final VIS Rank (1 = worst 12 = best)
1
To establish exploitable power side-channel leakage without performing explicit CPA, we characterize baseline inputdependent power under a fixed, fault-free IMC mapping and test whether input data and power consumption exhibit a stable, learnable relationship. LPI is defined as the standard deviation of average power consumption measured across input inferences and is used as a first-order Leakage Power Analysis (LPA) indicator of input-dependent power variability. Table I reports the measured power statistics for each MNIST digit class, computed over 400 inference samples under identical hardware conditions. The results exhibit systematic variation in mean power across digits, with values ranging from 4.60 W (digit 0) to 4.68 W (digit 6). The inter-class separation exceeds the within-class standard deviation, indicating sufficient inputdependent leakage to motivate correlation-based SCA analysis. Although architectural remapping is applied to mitigate this leakage, LPI remains unchanged (≈ 0.059 W) across Layer 1 swap configurations, indicating that static remapping alone is insufficient to suppress input-dependent leakage. Deterministic and Stochastic Noise Injection. Before stochastic obfuscation, we evaluate deterministic power balancing as a baseline active countermeasure. For each input, a compensatory auxiliary current sink adds the required power offset Paux (i) to equalize total inference power, thereby removing first-order input-dependent variation. However, this requires oracle knowledge of each input’s exact power deficit and creates a static signature vulnerable to averaging attacks. Deterministic balancing suppresses first-order LPI but leaves a repeatable signature, motivating stochastic randomization. To overcome the limitations of deterministic equalization, stochastic noise injection is introduced in which the auxiliary current sink is randomized for each execution. Prior to deployment, the auxiliary injected-power bounds are selected to span the observed baseline power variation while exceeding the measurement noise floor. During operation, for each input image i in execution run t, an auxiliary power component Paux (i, t) is sampled from a uniform distribution, Paux (i, t) ∼ U(∆Pmin , ∆Pmax ), (4) where ∆Pmin and ∆Pmax denote the lower and upper bounds of the auxiliary injected-power range, not bounds on total
1
Final VIS Rank (1 = worst 52 = best)
b
⋆
TABLE I BASELINE INPUT- DEPENDENT POWER CHARACTERISTICS FOR MNIST DIGIT CLASSES UNDER FIXED FAULT- FREE MAPPING . Digit Mean Power (W) Std (W) Digit Mean Power (W) Std (W) 0 4.6046 0.044 5 4.6043 0.064 1 4.6236 0.065 6 4.6784 0.041 2 4.6735 0.055 7 4.6441 0.072 3 4.6477 0.061 8 4.6732 0.060 4 4.6394 0.082 9 4.6221 0.065
2
3
3
50% 60% 2
70% 80% 90% 1
2
3
Final VIS Rank (1 = worst 3 = best)
and selecting the FOW with the maximum deviation as b⋆ = arg max MAEb .
1
Fig. 3. VIS heatmaps for all 3 layers after localized fault injection (50-90%). Top: Layer 1. Bottom: Layers 2 (Left) and 3 (Right). Colors encode Final VIS error rank (red: high, yellow: moderate, green: low).
inference power. The sampled auxiliary power is realized through a time-gated resistive load connected to the supply rail and activated exclusively during the corresponding inference window. The required resistance is computed as 2 VDD Raux (i, t) = , (5) Paux (i, t) and the total observed power is given by Pobs (i, t) = Pbase (i, t) + Paux (i, t) (6) Since the auxiliary power component is independently resampled for each execution, the resulting power side-channel is transformed into a non-stationary stochastic process, intentionally preventing the formation of stable and repeatable power signatures exploitable by correlation-based SCAs. IV. E XPERIMENTAL R ESULTS AND D ISCUSSION This section evaluates the ARMOR-IMC framework under fault-injection and power-leakage scenarios. A. Reliability Preservation via VIS-Guided Remapping The localized fault sensitivity of the SOT-MRAM crossbars was evaluated by applying bit-flip injection rates between 50% and 90% at the FOW granularity across all layers. As a reference, the error-free baseline achieves 69% inference accuracy with 4.7 W average power consumption. As illustrated in the VIS heatmaps in Figure 3, the impact of these faults is highly non-uniform across layers. Layer 1 with 52 FOWs exhibits inherent resilience due to its large fan-in redundancy, maintaining approximately 61% accuracy even at high fault rates, corresponding to a modest 7 to 8% loss relative to the baseline. In contrast, Layer 3, consisting of only 3 FOWs, experiences severe degradation, with accuracy decreasing from 30% at 50% injection to 17% at 90% injection, representing a loss exceeding 50% relative to the error-free case. Figure 4
Layer 1
80 70 Accuracy (%)
60
61
65
62
68
61
68
Layer 2 61
65
62
66
61
65 58
50
58
57
Layer 3
63
61 51
Baseline Accuracy 69%
61
Without mapping With mapping
52
40
30 30
30
26
29
20
36 23 22
21
70%
80%
34 17
10 0
50%
60%
70%
80%
90%
50%
60% 70% 80% Bit-flip error rate
90%
50%
60%
90%
Fig. 4. Accuracy under localized bit-flip faults with and without VIS-guided mapping across Layers 1-3 (50-90% error rates), with Layer 3 showing the most pronounced recovery at higher fault-rates.
for different digit classes are no longer distinct “bands” but instead exhibit substantial overlap, as illustrated in Figure 5. For instance, the power ranges for Digit 0 (4.79 − 4.97 W) and Digit 1 (4.93−5.12 W) overlap by approximately 34 mW. Crucially, the total injected noise bandwidth (∼ 180 mW) explicitly exceeds the baseline inter-class leakage signal (∼ 140 mW). This overlapping behavior reduces the effective SNR, as the power signature of any input is masked by injected noise. Similar efficacy is observed in Layer 2 (overlap ≈ 53 mW), indicating that stochastic injection reduces input-power correlation and increases the trace complexity of correlation-based SCAs. Consequently, LPI reflects the injected algorithmic noise magnitude, supporting effective SNR reduction below unity. Although this moving-target defense incurs a 6.5% power overhead (∼0.30 W), intermittent operation with randomized activation intervals keeps the leakage profile non-static and difficult to learn, providing increased resilience against simple and differential power analysis attacks. V. C ONCLUSION
Fig. 5. Ridge plot of input-dependent power distributions after stochastic power injection for selected digits.
demonstrates the efficacy of VIS-guided remapping in restoring this lost accuracy. The most significant recovery occurs in Layer 3, where remapping nearly doubles the accuracy at high fault-rates, improving from 17% to 34% at 90% injection by relocating the few critical defective regions to the limited set of available reliable FOWs. Layer 2 also shows strong recovery at high fault-rates; however, a minor degradation is observed at 50% injection, where accuracy decreases from 61% to 58%. This anomaly arises because the faulty region corresponds to a 32 × 20 edge tile, and the strict constraint of swapping only between dimension-compatible FOWs restricts the candidate pool, forcing a suboptimal FOW partner selection. B. Input-Dependent Power Leakage Mitigation While the VIS-guided remapping effectively restores accuracy, baseline analysis confirmed that it leaves the fundamental power leakage signal intact. To mitigate this residual vulnerability, the deterministic power balancing successfully compresses the input-dependent power variation across digit classes, driving the LPI metric to very low values in both Layers 1 and 2 (LPI reduction > 96%). In both layers, average power values converge tightly around the baseline reference maximum, suppressing first-order amplitude differences and increasing the difficulty of naive threshold-based classification. However, the static compensation rule renders power signatures stationary and predictable across runs, leaving the defense vulnerable to profiling and averaging attacks. By injecting randomized noise sampled from a bounded distribution in the range [0.2, 0.4] W during each inference window, we observe a significant increase in the variance of the observed power consumption, effectively masking the underlying input-dependent leakage. Analysis of the experimental data for Layer 1 reveals that the power distributions
This work presents ARMOR-IMC, a post-training framework for enhancing both reliability and security in analog IMC accelerators. The VIS metric enables fine-grained identification and mitigation of PV-induced fault sensitivity, while LPI captures input-dependent power variability and indicates sidechannel leakage risk. The results demonstrate that VIS-guided mapping effectively restores inference accuracy under severe fault conditions and that stochastic auxiliary power injection renders power signatures nonstationary and harder to learn. R EFERENCES [1] K. Mishty and M. Sadi, “System and Design Technology Co-Optimization of SOT-MRAM for High-Performance AI Accelerator Memory System,” IEEE Transactions on Computer-Aided Design of Integrated Circuits and Systems, vol. 43, no. 4, pp. 1065–1078, 2024. [2] M. A. Chowdhury, M. Hossain, C. Mastrangelo, R. F. DeMara, and S. Salehi, “S-Tune: SOT-MTJ Manufacturing Parameters Tuning for Securing The Next Generation of Computing,” Frontiers in Electronics, vol. 5, 2024. [3] M. Hossain, M. A. Chowdhury, R. F. DeMara, and S. Salehi, “Sensitivity Analysis of SOT-MTJs to Manufacturing Process Variation: A Hardware Security Perspective,” in 2024 25th International Symposium on Quality Electronic Design (ISQED), 2024, pp. 1–5. [4] P. Horváth, D. Lauret, Z. Liu, and L. Batina, “SoK: Neural Network Extraction Through Physical Side Channels,” in Proceedings of the 33rd USENIX Conference on Security Symposium, ser. SEC ’24. USA: USENIX Association, 2024. [5] M. H. Amin, M. E. Elbtity, and R. Zand, “IMAC-Sim: A Circuitlevel Simulator For In-Memory Analog Computing Architectures,” in Proceedings of the Great Lakes Symposium on VLSI 2023, ser. GLSVLSI ’23. New York, NY, USA: Association for Computing Machinery, 2023, p. 659–664. [6] I. Chakraborty, M. Ali, A. Ankit, S. Jain, S. Roy, S. Sridharan, A. Agrawal, A. Raghunathan, and K. Roy, “Resistive Crossbars as Approximate Hardware Building Blocks for Machine Learning: Opportunities and Challenges,” Proceedings of the IEEE, vol. 108, no. 12, pp. 2276–2310, 2020. [7] P. C. Kocher, J. Jaffe, B. Jun, and P. Rohatgi, “Introduction to Differential Power Analysis,” Journal of Cryptographic Engineering, vol. 1, pp. 5–27, 2011. [8] M. Huff, “Review—Important Considerations Regarding Device Parameter Process Variations in Semiconductor-Based Manufacturing,” ECS Journal of Solid State Science and Technology, vol. 10, no. 6, p. 064002, jun 2021.