Securing RRAM-Based Neural Networks via Neuron-Level Activation-Triggered Perturbation

Resistive random-access memory (RRAM)–based computing systems have emerged as a promising platform for deploying deep neural networks (DNNs) due to their high energy efficiency and massive parallelism enabled by in-memory vector–matrix multiplication. However, unauthorized access to RRAM-based platforms exposes the deployed models to black-box query–based model theft and reverse-engineering attacks. To address this threat, this paper proposes a neuron-level activation–triggered perturbation protection mechanism tailored for RRAM-based neural network deployment. The proposed protection method is composed of an activation module and a perturbation module. First, a lightweight conditional activation module is embedded into the model’s semantic bottleneck layer, encoding the authorization state of an access request as neuron activation signals. Then, the resulting activation signal controls a perturbation module that injects direction- and magnitude-adjustable distortions into the output logits if an unauthorized behavior is detected. Under authorized operation, on the other hand, the activation value remains close to zero, ensuring that the original inference functionality is preserved. This protection mechanism does not modify backbone network weights nor introduce additional inference branches. The authorization decision and output intervention can be completed within a single forward pass. Evaluation results on a behavior-level RRAM simulator demonstrate that the proposed method can effectively protect the deployed models against model theft attacks under unauthorized queries while preserving prediction accuracy under authorized access, with an insignificant hardware overhead.