A single non-volatile transistor double-tap differential based multi-bit in-situ decryption memory computing method and circuit

Abstract

The application provides a single non-volatile transistor-based two-phase differential multi-bit in-situ decryption memory computing method and circuit, and belongs to the field of integrated circuit design and artificial intelligence hardware acceleration technology. The method steps include: weight encryption storage, input preprocessing, two-phase in-situ calculation, differential reconstruction and bias recovery steps; the circuit includes: a non-volatile transistor array, a differential scanning gate drive circuit, a two-phase differential buffer, a bias recovery module and a peripheral processing module. The application stores encrypted weights in a single non-volatile transistor (1T) storage unit, uses function splitting of an input vector and a key, cooperates with two-phase timing control to apply an input voltage, realizes differential calculation in an analog domain, thereby completes multi-bit multiply-accumulate operation (MAC) in-situ without exposing the plaintext weight, significantly improves the storage density and computing energy efficiency, and has the characteristics of simple circuit implementation and strong noise resistance.

Description

Technical Field

[0001] This invention relates to the fields of integrated circuit design and artificial intelligence hardware acceleration technology, specifically to an in-situ decryption in-memory calculation method and circuit based on a single multi-bit non-volatile transistor and a two-step differential strategy. Background Technology

[0002] With the rapid development of artificial intelligence (AI) and the Internet of Things (IoT) technologies, edge devices are placing extremely high demands on the real-time performance and energy efficiency of data processing. However, in the traditional von Neumann architecture, computing units and storage units are physically separated. When performing data-intensive tasks such as deep learning, frequent data transfer between memory and processor leads to severe "memory wall" and "power wall" problems, limiting the overall performance and energy efficiency of the system.

[0003] To address the aforementioned issues, in-memory computing (IMC, also known as computing-in-memory, CIM) architecture has emerged. CIM technology integrates computational logic directly into the storage array, leveraging the physical characteristics of storage cells (such as current accumulation or charge redistribution) to perform core operations like vector-matrix multiplication (VMM) directly in the analog domain. Among these, in-memory computing based on non-volatile memory (NVM) (nvCIM) exhibits promising applications in edge AI inference scenarios due to its low static power consumption and data retention even when power is off. Its arrays can achieve high-throughput multiply-accumulate (MAC) operations by enabling multiple word lines in parallel.

[0004] However, while nvCIM technology offers high energy efficiency, it also introduces new data security vulnerabilities. Due to the nature of non-volatile memory, even after a power outage, the neural network weight parameters (often highly valuable intellectual property) stored in the array are preserved. Attackers can illegally read the original weight data in the storage array through side-channel analysis (such as electromagnetic signal analysis), reverse engineering, or direct physical probing, leading to the leakage of the core model.

[0005] To protect the security of model weights, a direct approach is to first encrypt the weights (e.g., using the AES algorithm) and store them, then read them into the cache and decrypt them before computation. However, this "decrypt first, then compute" method not only requires additional decryption hardware overhead but also reverts to the data transfer process, undermining the energy efficiency and low latency advantages of the CIM architecture's "in-situ computation." Therefore, academia and industry have proposed the concept of Encrypted CIM (eCIM). eCIM aims to integrate decryption operations into the MAC computation process of CIM, typically using Boolean logic (such as XOR operations) to co-modulate encryption algorithms, allowing the memory to perform operations directly based on the ciphertext without needing to recover the complete plaintext weight matrix at any stage.

[0006] The existing eCIM technical solutions mainly include the following implementation methods:

[0007] 1) SRAM-based eCIM scheme: This scheme utilizes complementary data stored in cross-coupled inverter nodes within SRAM cells. By introducing additional word line control through the gating transistors and combining this with input vector preprocessing (such as calculating the XOR result of the input and key), the XOR decryption logic is completed within the array. However, SRAM itself is volatile, and its large cell area limits storage density.

[0008] 2) Complementary pairing schemes based on NVM (such as RRAM, FeFET, etc.): To implement in-situ XOR decryption logic in non-volatile memory, existing technologies typically require complementary cell structures. For example, using a 2T-2R (two transistors - two resistors) or complementary 2T structure, the original and inverse codes of the weights are physically stored simultaneously. Alternatively, XOR matching logic in content-addressable memory (CAM) can be used to selectively read specific devices in the complementary cells using a key.

[0009] While existing eCIM solutions address data security to some extent, they still face significant challenges and drawbacks: First, high area overhead. Most existing non-volatile eCIM solutions (such as RRAM and FeFET-based solutions) rely heavily on "complementary pairing" cell structures (i.e., using two devices to represent a logic bit) or complex cell structures to achieve hardware mapping of XOR logic. This means that to achieve encrypted computation, the effective density of the memory array is halved, or the area overhead per bit is doubled, which is unacceptable in edge chips that pursue high integration. Second, insufficient support for multi-bit computation. Current eCIM designs are mostly limited to computation of single-bit (binary) weights or low-precision inputs. Due to the introduction of encryption logic, signal accumulation in the analog domain becomes more complex. Achieving linear accumulation of multi-bit inputs / weights while ensuring decryption correctness is extremely challenging in circuit design. Third, complexity of peripheral circuits. To accommodate the reading of complementary cells or complex Boolean logic transformations, complex input preprocessing circuits or sensitive amplifier readout circuits are often required, further increasing the overall power consumption and design complexity of the system.

[0010] Therefore, there is an urgent need for a high-efficiency in-memory computing circuit and method that can support multi-bit input and in-situ decryption based on a single non-volatile transistor cell (rather than a complementary pair) without sacrificing storage density. Summary of the Invention

[0011] To address the problem that existing non-volatile in-memory computation (nvCIM) technologies typically rely on complementary paired memory cells (such as 2T-2R or complementary 2T structures) to perform XOR logic when implementing in-situ decryption (eCIM), resulting in halved storage density, large hardware area overhead, and difficulty in achieving high-precision multi-bit computation, this invention proposes a multi-bit in-situ decryption in-memory computation method and circuit based on dual-phase differential processing of a single non-volatile transistor.

[0012] This invention stores encryption weights in a single non-volatile transistor (1T) memory cell, utilizes the functional decomposition of the input vector and key, and coordinates with two-phase timing to control the application of the input voltage to achieve differential computation in the analog domain. This allows multi-bit multiply-add (MAC) operations to be completed in situ without exposing the plaintext weights, significantly improving storage density and computational efficiency.

[0013] The technical solution of the present invention is as follows:

[0014] A multi-bit in-situ decryption memory calculation method based on dual-phase differential calculation using a single non-volatile transistor, characterized by the following steps:

[0015] 1) Weight encryption storage steps: Store the plaintext weight matrix... With key vector Perform XOR encryption to generate a ciphertext weight matrix. and the ciphertext weight matrix elements in The value is mapped to a conductance value and written into a memory array consisting of a single non-volatile transistor; the single non-volatile transistor is not configured with a corresponding complementary memory cell.

[0016] 2) Input preprocessing step: Obtain the input vector to be calculated. and the key vector used for decryption For each element in the input vector and the corresponding elements in the key vector Generate a first clock phase input signal and a second clock phase input signal; the first clock phase input signal corresponds to a logic term. That is, it is valid when the key bit is logic 0 and set to zero when it is logic 1; the second clock phase input signal corresponds to the logic item. That is, the key is valid when it is logic 1 and set to zero when it is logic 0;

[0017] Wherein, the first clock phase input signal is represented as The second clock phase input signal is represented as ,when At that time, only the first clock phase input is valid. At that time, only the second clock phase input is valid, where This represents the j-th input element in the input vector. This represents the key bit corresponding to the j-th column or the j-th input channel;

[0018] 3) Dual-time in-situ calculation steps: In the first clock phase, input the first clock phase signal. This is converted into a word line voltage and applied to the memory array, obtaining the current or charge corresponding to the first intermediate result on the source line; in the second clock phase, the second clock phase input signal is... This is converted into word line voltage and applied to the memory array, resulting in the current or charge amount corresponding to the second intermediate result on the source line;

[0019] Specifically, the first clock phase Phase 1 is used to calculate the positive contribution term, and the array output is denoted as Y1; the second clock phase Phase 2 is used to calculate the negative contribution term, and the array output is denoted as Y2; these two are the first and second intermediate results.

[0020] 4) Differential reconstruction and bias recovery steps: Perform a subtraction operation on the first intermediate result Y1 and the second intermediate result Y2. The differential MAC result after removing the key symbol mask is obtained; the input vector is calculated. With key vector The inner product related terms are used as bias terms, and these bias terms are added to the difference MAC result to obtain the final plaintext multiplication and addition operation result.

[0021] This invention also includes a multi-bit in-situ decryption memory calculation circuit based on a single non-volatile transistor dual-phase differential method. This circuit supports the implementation of the aforementioned innovative method and is characterized by comprising: a non-volatile transistor array, a differential scanning gate drive circuit, a dual-phase differential buffer, a bias recovery module, and a peripheral processing module; wherein...

[0022] 1) A non-volatile transistor array is used to store ciphertext weights and generate column currents. It is a NOR or AND type array composed of individual non-volatile transistor (1T) cells, each cell of which is used to store encrypted ciphertext weight information. The gate of the non-volatile transistor is connected to the word line (WL), and the drain or source is connected to the bit line (BL) or source line (SL).

[0023] 2) A differential scan gate drive circuit is used to receive input data and key data, and generate a first clock phase Phase 1 input signal and a second clock phase Phase 2 input signal according to the input vector and key vector, respectively; the output of the differential scan gate drive circuit is connected to the word line of the array; the differential scan gate drive circuit is configured to apply a clock phase signal based on the key vector to the array word line in two different clock cycles. The first voltage signal of the logic and based on The second voltage signal of the logic;

[0024] 3) The dual-phase differential buffer is used to acquire the array output for two clock cycles and perform buffering and subtraction operations to obtain the differential MAC result after removing the key symbol mask; this circuit is connected to the source line of the array to read the output current or charge of the array; this circuit is implemented by a differential analog-to-digital converter (ADC) based on the classic sample and hold unit;

[0025] 4) The bias recovery module is used to superimpose the bias term determined by the input vector and the key vector, that is, to calculate the linear combination bias value of the input data and the key data, and add it to the output of the double-shot differential buffer to obtain the final plaintext multiplication and addition operation result;

[0026] The peripheral processing module includes: a WL decoder for selecting the activated word line; an input register for buffering the input vector and key vector; a level generator for generating input gate signals corresponding to Phase 1 and Phase 2 and converting the two-phase input signals into array word line voltages; a BL driver circuit for driving the bit lines; an SL multiplexer for selecting the corresponding source line output channel; multiple ADCs for quantizing analog readout signals from different channels or phases; and a shift accumulator for bit weight alignment and accumulation of multi-bit inputs or multi-bit weighted partial sums.

[0027] Furthermore, the non-volatile transistor is selected from one of the following: ferroelectric field-effect transistor (FeFET), floating-gate transistor, or charge-trapping transistor.

[0028] Furthermore, the non-volatile transistor operates in multi-level cell (MLC) mode, and its threshold voltage... Programmed to One of the discrete states, the channel conductance corresponding to each state Linear correspondence to ciphertext weight combination value; Multilevel cell (MLC) mode refers to a single non-volatile transistor storing multiple bits of information through multiple distinguishable threshold voltage or channel conductance states; correspondingly, multilevel conductance refers to the equivalent channel conductance or readout conductance corresponding to these discrete threshold states.

[0029] Furthermore, the differential scanning gate drive circuit includes a pulse width modulation (PWM) or amplitude modulation (AM) circuit for converting the multi-bit input vector... This is converted into a voltage pulse of corresponding duration or amplitude. During double-step differential operation, the first clock phase (Phase 1) drives the corresponding... The pulse, the second clock phase (Phase 2) drives the corresponding The pulse is used to multiply the input value and the weighted conductance through integration in the time domain.

[0030] Furthermore, the bias recovery module includes a scaling factor configuration unit, which is used to adjust the coefficient value of the bias term according to the currently calculated weight accuracy, to ensure that the bias compensation is strictly matched with the magnitude of the array output.

[0031] Compared with the prior art, the beneficial effects of the present invention are as follows:

[0032] 1) Increased storage density and significantly reduced area overhead: This invention breaks the limitation of existing eCIM technology, which must rely on complementary paired units (such as 2T, 2T2R) to achieve XOR decryption. Encryption storage and computation can be completed using a single non-volatile transistor (1T). Theoretically, the number of array units can be nearly halved under the same weight bit storage requirements, thereby increasing the chip's storage density.

[0033] 2) No negative voltage input required, simple circuit implementation: By splitting the calculation and decryption process into two positive input differential terms (i.e. Disassembled into minus This avoids the hardware difficulties of generating and processing negative voltage inputs in analog in-memory computing and is compatible with existing standard logic processes and driver circuits.

[0034] 3) Supports multi-bit in-situ decryption and computation: This scheme utilizes a combination of dual-step differential mechanisms to support convolution operations of multi-bit inputs (such as 2-bit / 4-bit) and multi-level units (MLC), solving the problem that traditional XOR-CIM has difficulty in handling non-binary multiplication and addition operations.

[0035] 4) Enhanced noise immunity: Employing a time-interleaved differential readout mechanism, both readout processes follow the same physical path. This differential operation effectively suppresses common-mode noise and device process variation, thereby improving the signal-to-noise ratio and accuracy of analog in-memory computing. Attached Figure Description

[0036] The above and / or additional aspects and advantages of the present invention will become apparent and readily understood from the following description of the embodiments taken in conjunction with the accompanying drawings, wherein:

[0037] Figure 1 This diagram illustrates the security risks faced by in-memory computing accelerators based on non-volatile memory (NVM) in existing technologies, showing the path attackers take to steal model weights.

[0038] Figure 2 This is a schematic diagram of the circuit principle for implementing encrypted in-memory computation (eCIM) using complementary pairing units in the prior art;

[0039] Figure 3 This is a schematic diagram of the device structure of a single non-volatile transistor (1T) and its multilevel storage (MLC) principle used in the embodiments of the present invention;

[0040] Figure 4This is a flowchart of the multi-bit in-situ decryption memory calculation method based on a single non-volatile transistor dual-phase differential method according to the present invention;

[0041] Figure 5 This is the logical truth table for the double-step differential in-situ decryption and multi-bit computation based on function decomposition proposed in this invention;

[0042] Figure 6 This is a schematic diagram of the circuit topology of an encrypted in-memory computing array built based on a single non-volatile transistor in an embodiment of the present invention, wherein (a) is an AND array structure and (b) is a NOR array structure;

[0043] Figure 7 This is a diagram illustrating the overall system architecture of the multi-bit in-situ decryption and in-memory computation circuit based on a single non-volatile transistor dual-phase differential, as provided in an embodiment of the present invention. Detailed Implementation

[0044] The technical solution of the present invention will be further clearly and completely described below with reference to the accompanying drawings and specific embodiments.

[0045] As artificial intelligence (AI) applications migrate to the edge, in-memory computing (CIM) architectures are widely adopted due to their high energy efficiency. However, in decentralized computing, zero-trust deployments, or multi-tenant cloud service scenarios, the plaintext weights of users' private models become a concern. The weight is directly loaded into the non-volatile memory (NVM) array. At this point, a physical attacker or a malicious third-party service provider can directly read the floating gate or polarization state in the NVM through side-channel analysis, microscopic probing, and other means, thereby stealing valuable model intellectual property. Figure 1 This diagram illustrates the security risks faced by existing in-memory computing accelerators based on non-volatile memory (NVM), showcasing the path attackers can take to steal model weights. Input represents input data or activation vectors, Output represents the computational results or intermediate results returned by the server, AI model represents the model structure composed of plaintext weight matrices, and encrypted weights represent the model weights written to the non-volatile in-memory computing array after encryption with a key. Key represents the key information required to perform weight encryption or input preprocessing; the key is preferably stored by a trusted end or the client side. Attacker icons represent third parties that may attempt to read the weight state in the array through physical probing, reverse engineering, or side-channel methods.

[0046] To solve this problem, existing technologies typically employ... Figure 2 The circuit scheme shown employs complementary paired units to implement encrypted in-memory computation (eCIM). Physically, this scheme uses two non-volatile elements to store the original code of the encryption weights. and inverse code (or and ), directly implemented using hardware circuits The logic is as follows. Although in-situ decryption is achieved, this "two-tube storage per bit" method results in a halving of storage density and makes it difficult to expand to support multi-bit weights, with huge area and power consumption overhead.

[0047] Figure 2 Read, Dec, and MAC on the left represent the processing chain in the traditional scheme that executes reading, decryption, and multiplication-addition operations sequentially. Dec&MAC represents the in-situ decryption calculation method that combines decryption and multiplication-addition operations. Figure 2 In the complementary unit diagram on the right, E and E' represent the original code storage unit and the complementary storage unit for the same encryption weight bit, respectively. and Indicates input and key or The word line control signal is obtained through co-modulation; the two word lines respectively select complementary storage paths, so that the output current equivalently includes... and Two items, namely: , For plaintext weights.

[0048] To address the above problems, the present invention is based on Figure 3 The single non-volatile transistor (1T) shown is used to construct a memory computing unit. For example... Figure 3 As shown, the non-volatile transistor includes a source (S), a drain (D), a gate, and a storage layer located in the gate stack. The storage layer can be a polysilicon layer for a floating gate transistor, a silicon nitride layer (such as a SONOS structure) for a charge trapping transistor, or a ferroelectric material layer (such as hafnium zirconium oxide (HZO), perovskite PZT, etc.) for a ferroelectric transistor (FeFET). By applying a programming voltage or an erase voltage to the gate, charge can be injected into the storage layer or the ferroelectric polarization direction can be reversed, thereby non-volatilely modulating the threshold voltage of the transistor. .

[0049] Figure 3 The programming and erase voltages of a single non-volatile transistor are further illustrated in relation to the threshold voltage. The regulation relationship is as follows: Under the action of the programming voltage, a polarization or charge trapping state is formed in the storage layer, so that the device behaves in a low threshold state and can represent storing "1"; under the action of the erase voltage, the state of the storage layer changes in the opposite direction, so that the device behaves in a high threshold state and can represent storing "0". Figure 3 In the transfer characteristic curve below, I on Indicates the reading of the on-state current under bias, I off This indicates the shutdown current; the interval between high and low threshold states is used to distinguish different storage states.

[0050] In this embodiment, the non-volatile transistor operates in multi-level cell (MLC) mode. For example, by precisely controlling the programming pulse, the transistor can be... Adjusted to four different voltage levels (corresponding to "00", "01", "10", and "11"), thereby adjusting the physical conductance of a single device. It stores information with a precision of 2 bits or even higher. This is the physical basis for the high-density multi-bit encrypted computation of this invention.

[0051] In this paper, the Multilevel Cell (MLC) mode refers to a single non-volatile transistor storing multi-bit information through multiple distinguishable threshold voltage or channel conductance states; correspondingly, multilevel conductance refers to the equivalent channel conductance or readout conductance corresponding to these discrete threshold states. Taking 2-bit weight as an example, the four conductance states can correspond to the ciphertext weight combination values ​​00, 01, 10, and 11, respectively.

[0052] This invention discloses a multi-bit in-situ decryption memory calculation method based on dual-phase differential calculation using a single non-volatile transistor, the flowchart of which is shown below. Figure 4 As shown, the specific steps include:

[0053] 1) Weight encryption storage steps: Store the plaintext weight matrix... With key vector Perform XOR encryption to generate a ciphertext weight matrix. and the ciphertext weight matrix elements in The value is mapped to a conductance value and written into a memory array consisting of a single non-volatile transistor; the single non-volatile transistor is not configured with a corresponding complementary memory cell.

[0054] 2) Input preprocessing step: Obtain the input vector to be calculated. and the key vector used for decryption For each element in the input vector and the corresponding elements in the key vector Generate a first clock phase input signal and a second clock phase input signal; the first clock phase input signal corresponds to a logic term. That is, it is valid when the key bit is logic 0 and set to zero when it is logic 1; the second clock phase input signal corresponds to the logic item. That is, the key is valid when it is logic 1 and set to zero when it is logic 0;

[0055] Wherein, the first clock phase input signal is represented as The second clock phase input signal is represented as ,when At that time, only the first clock phase input is valid. At that time, only the second clock phase input is valid, where This represents the j-th input element in the input vector. This represents the key bit corresponding to the j-th column or the j-th input channel;

[0056] 3) Dual-time in-situ calculation steps: In the first clock phase, input the first clock phase signal. This is converted into a word line voltage and applied to the memory array, obtaining the current or charge corresponding to the first intermediate result on the source line; in the second clock phase, the second clock phase input signal is... This is converted into word line voltage and applied to the memory array, resulting in the current or charge amount corresponding to the second intermediate result on the source line;

[0057] Specifically, the first clock phase Phase 1 is used to calculate the positive contribution term, and the array output is denoted as Y1; the second clock phase Phase 2 is used to calculate the negative contribution term, and the array output is denoted as Y2; these two are the first and second intermediate results.

[0058] 4) Differential reconstruction and bias recovery steps: Perform a subtraction operation on the first intermediate result Y1 and the second intermediate result Y2. The differential MAC result after removing the key symbol mask is obtained; the input vector is calculated. With key vector The inner product related terms are used as bias terms, and these bias terms are added to the difference MAC result to obtain the final plaintext multiplication and addition operation result.

[0059] Figure 5 This invention demonstrates the core mathematical principles and logical transformation process of achieving "single-tube storage, in-situ decryption, and multi-bit computation" using the method of this invention. To avoid area loss caused by complementary pairing, this invention innovatively introduces the mechanisms of "function splitting" and "double-step difference".

[0060] Figure 5 key vector in This indicates a key shared by column or by input channel. Represents the plaintext weight matrix. Indicates by and The ciphertext weight matrix, obtained by bitwise XOR and actually written into the non-volatile transistor array, is Figure 5 In the truth table on the right, Indicates the plaintext weight bits. Indicates the key bits. Indicates the weight bit of the ciphertext; when hour and Same, when hour for The bitwise inverse of the result.

[0061] Assume the row and column indices in the array are The most significant bit (MSB) and least significant bit (LSB) of the MLC weight (Multi-Level Cell) are denoted as follows: The key variables defined are as follows:

[0062] Plaintext weights In binary representation: ,in The value is a position weight constant or an additively decomposable conductance, which can be considered as a general value in binary. .

[0063] Encryption Key Encryption is used by column (or row, depending on the array orientation; in this example, a column-shared key is used). For example, that is The specific level of implementation is... and .

[0064] Ciphertext weight That is, actually stored in Figure 3 The conductivity value of the non-volatile transistor shown ,in For a selectable unit conductance.

[0065] To calculate the expected plaintext multiplication and addition result This invention utilizes the arithmetic properties of XOR logic. The target formula is transformed as follows:

[0066]

[0067] After expansion, the core calculation formula of this invention is derived:

[0068]

[0069] Substitution ,get:

[0070]

[0071] For the core calculation items of eCIM (decryption process), due to the input items exist It will become a negative value ( ) However, conventional in-memory computing arrays struggle to directly handle negative voltage inputs. Therefore, this invention employs a two-phase differential strategy, splitting the above formula into two parts that are executed step-by-step in the time domain:

[0072] Phase 1: Calculate positive contributions At this point, only if the key When, input Valid; if If so, the input must be 0.

[0073] Phase 2: Calculate negative contributions. At this point, only if the key When, input Valid; if If so, the input must be 0.

[0074] The final result is: .

[0075] In this way, the input signal always remains positive. or It is easier to adapt to the IV characteristics of standard non-volatile transistors, while utilizing The multi-level conductance enables in-situ decryption calculation of multi-bit weights.

[0076] Furthermore, the method is particularly suitable for high-density storage and computation of multi-bit weights. Unlike existing technologies that require the use of two complementary units to store the weight bits and their complementary bits separately, this invention utilizes the multi-level (MLC) characteristic of a single transistor to directly store the combined ciphertext weights.

[0077] Taking 2-bit weights as an example, define The most significant bit (MSB) is the most significant bit. The least significant bit (LSB) has the following bit weights: and .

[0078] plaintext weight It can be represented as:

[0079]

[0080] According to the encryption rules of the present invention, the ciphertext By key (Shared by column) is obtained by XORing with plaintext weights, i.e. and Using Boolean logic's arithmetic transformation relations Expand the plaintext weights as follows:

[0081]

[0082]

[0083]

[0084] in, The total conductance of the multi-bit ciphertext stored by a single transistor in an MLC device is denoted as . G0 represents the single conductance quantization step size or unit conductance, used to map the discrete values ​​of the ciphertext weights to the target channel conductance of the non-volatile transistor; when the weight accuracy, device process, or readout voltage range changes, G0 can be calibrated according to the array readout dynamic range.

[0085] Therefore, the target output of multi-bit in-memory computation This can be deduced as:

[0086]

[0087]

[0088] This formula mathematically proves that the present invention only requires storing one multi-level state in a single non-volatile transistor. ,Cooperate The dual-phase differential input modulation is equivalent to the multiply-add operation of multi-bit plaintext weights, eliminating the need for physical storage of the weights' complement or inverse code, thus further saving array area.

[0089] The above calculation method can be implemented using the encrypted in-memory computing array designed in this invention. Figure 6 The array consists of several Figure 3 The individual non-volatile transistors shown are arranged in a matrix.

[0090] Example 1: AND array ( Figure 6 (a) The bit line BL and source line SL are both vertically arranged, and the word line WL is horizontally arranged. The drain of the transistor is connected to the bit line BL, and the source is connected to the source line SL. In this structure, by applying a voltage across WL... , Let be the input size of the i-th row. The current is at the unit bit line level, determined based on the actual multi-value state and device conditions, and is concentrated on SL. , Let be the device conductance value in the i-th row and j-th column.

[0091] Figure 6 In (a), BL1 and BL2 represent two vertical bit lines, SL1 and SL2 represent two vertical source lines, and WL1 and WL2 represent two horizontal word lines; each cell in the solid box is a single non-volatile transistor memory cell, and the "1" or "0" marked therein indicates the ciphertext weight bits stored in the corresponding cell. The AND-type array selects rows through word lines and forms a read path through bit lines and source lines, making it suitable for implementing serial-parallel combined in-memory computation at high densities.

[0092] Example 2: NOR array ( Figure 6 (b) The bit lines BL are vertically arranged, while the word lines WL and source lines SL are horizontally arranged. The drain of the transistor is connected to the bit line BL, and the source is connected to the source line SL (or grounded). In this structure, by applying a voltage across WL... , The size of the input in the i-th row, The unit voltage, which is the operating voltage level determined by the circuit and device requirements, can be any value such as 0.1V or 1V, and current is collected on BL. , Let be the device conductance value in the i-th row and j-th column.

[0093] Figure 6 In (b), BL1 and BL2 represent vertical bit lines, WL1 and WL2 represent horizontal word lines, and SL1 and SL2 represent horizontal source lines; cells in the same row can share word lines and source lines, and cells in the same column can share bit lines. NOR arrays facilitate parallel reading of current from multiple columns and are suitable for implementing vector-matrix multiplication with high parallelism.

[0094] Figure 7 The overall circuit architecture for implementing the method of this invention is shown. Each large square with a complete I / O buffer (four are shown in the figure) represents a basic processing unit (PE). Each PE contains multiple sub-arrays, represented by the dashed squares. A detailed enlarged view of one of the sub-arrays is shown below, which mainly includes: a differential scanning gate drive circuit, an encrypted in-memory computing array (using... Figure 6 The system consists of any array configuration, a dual-phase differential buffer, an offset recovery module, and readout and peripheral processing modules (selectors, shift accumulators, etc.). These modules work together to complete the entire process of input buffering, word line selection, level generation, dual-phase driving, matrix multiplication, analog readout, quantization, and digital accumulation.

[0095] Figure 7 The large block at the top, equipped with a complete I / O buffer, can store the ciphertext weights corresponding to different layers or different linear transformations in the neural network, such as E. qkv E o Efc1 and E fc2 These represent the ciphertext weight matrices for query / key / value projection, output projection, and the first and second linear layers of the feedforward network in the attention module, respectively. Each array block can perform input / output buffering through I / O & Buffer, and completes read / write, phase switching, and computation timing control through the clock CLK signal and the computation control signal generated by the CTRL module.

[0096] Figure 7 The lower part is the multi-bit in-situ decryption in-memory computation circuit based on a single non-volatile transistor dual-phase differential. The WL decoder selects the active word line; the input register buffers the input vector and key vector; the level generator generates the input gate signals for Phase 1 and Phase 2 and converts the two-phase input signals into array word line voltages; the single-transistor in-memory computation array based on XOR encryption generates column currents based on the ciphertext conductance; and the differential scan gate drive circuit is used for Phase 1 and Phase 2 decryption in-memory computation. In step 2, word lines or input drives corresponding to positive and negative contribution terms are applied respectively; the BL drive circuit is used to drive the bit lines; the dual-phase differential buffer is used to temporarily store the readout results of the two phases; the shift accumulator and bias recovery module are used to complete the differential results, bit weight scaling, and bias term superposition; the SL multiplexer is used to select the corresponding source line output channel; multiple ADCs are used to quantize the analog readout signals of different channels or different phases; and the shift accumulator is used to perform bit weight alignment and accumulation on the partial sum generated by multi-bit inputs or multi-bit weights. These modules can be repeatedly arranged in the array column direction or row direction to support parallel computation of multiple output channels.

[0097] This invention provides a multi-bit in-situ decryption memory calculation method based on a single non-volatile transistor dual-phase differential. The embodiment of this invention includes a multi-bit in-situ decryption memory calculation circuit based on a single non-volatile transistor dual-phase differential. Figure 7 The specific process shown in the enlarged diagram (with dotted lines below) is as follows:

[0098] S1: Data writing and encryption. During the system initialization phase, the external controller assigns plaintext weights. With preset key Perform XOR operation ( ), and generate the ciphertext weight matrix The program is written into a cryptographic in-memory computing array based on non-volatile transistors. Since the ciphertext weights are multi-bit data, the writing process involves a program / verify operation on the transistor threshold voltage.

[0099] S2: Input preprocessing and double-shot difference calculation process, the specific steps are as follows:

[0100] Step A (Calculation of the first clock phase, Phase 1): The WL decoder receives the input vector. and key vector And calculate The array's WL level generator will This is converted into an analog voltage and applied to the array word lines. The array then utilizes the stored ciphertext. The multiply-accumulate operation is performed, and the current / charge signal generated on the source line is read out and temporarily stored in the first set of capacitors or registers of the dual-beat differential buffer.

[0101] Step B (Second Clock Phase 2 Calculation): WL decoder receives input vector and key vector And calculate And the array's WL level generator will Applied to the same array word line. The array utilizes the stored ciphertext. When performing multiplication and addition operations, the current / charge signal generated on the source line is temporarily stored in the second set of capacitors or registers of the dual-step differential buffer, or directly fed into the negative input terminal of the differential ADC.

[0102] S3: Differential reconstruction and bias recovery. The dual-step differential buffer performs a subtraction operation: , The current / charge signals generated in the same column of the same array during Phase 1 and Phase 2, respectively, in the same output channel; this step is mathematically equivalent to calculating This also effectively suppresses common-mode noise of the array. The shift & add module receives the difference result and adds a pre-calculated bias term. This bias term is only related to the input and key and can be quickly calculated by external low-power digital logic. The data after bias recovery is the multi-bit plaintext MAC result obtained by in-situ decryption, which can be used for subsequent neural network layer activation or pooling operations.

[0103] The above In the analog implementation, both can be stored in the two sets of capacitors of the dual-phase differential buffer; in the digital implementation, they can be quantized separately by the ADC and stored in registers. The bias term can be pre-calculated from the input vector and key vector during the input preprocessing stage or the result recovery stage, and then superimposed after differential readout.

[0104] Furthermore, for the aforementioned multi-bit application scenarios, the circuit has been adapted in both the analog and digital domains to support high-precision calculations. On the memory array side: the individual non-volatile transistor is configured as a multi-level cell (MLC), with a threshold voltage... Programmed to One of the discrete states, the channel conductance corresponding to each state Linearly corresponds to the ciphertext weight combination value in the above formula. On the input drive side: the differential scan gate drive circuit includes pulse width modulation (PWM) or amplitude modulation (AM) circuitry for converting the multi-bit input vector... This is converted into a voltage pulse of corresponding duration or amplitude. During double-phase differential operation, the first clock phase (Phase 1) drives the corresponding... The pulse, the second clock phase (Phase 2) drives the corresponding The pulse is used to multiply the input value and the weight conductance through integration in the time domain. On the output readout side: the bias recovery module includes a scaling factor configuration unit to adjust the bias term according to the currently calculated weight precision (e.g., 2-bit, 3-bit, 4-bit). The coefficient values ​​are used to ensure that the bias compensation is strictly matched with the magnitude of the array output.

[0105] The circuit and method proposed in this embodiment successfully achieve in-situ decryption and in-memory computation of multi-bit weights on a single non-volatile transistor by splitting the decryption function into two-step differential operations in the time domain. Compared with traditional complementary pairing schemes, this invention theoretically reduces the number of storage units to nearly half that of traditional complementary pairing schemes while ensuring model security (weights are always stored in encrypted form) and significantly reduces chip area.

[0106] Without departing from the concept of this invention, the following changes and modifications should fall within the protection scope of this invention:

[0107] 1) Replacement of memory devices: Although FeFET and Flash devices are mainly described, other non-volatile devices with programmable threshold voltages that can be used as single-transistor memory cells (such as 1T structures based on MRAM or RRAM, as long as their variable conductance characteristics are utilized) are also applicable.

[0108] 2) Variations of array structure: The array connection method can be NOR type (high parallelism), AND type (high density) or NAND type (suitable for serial search), as long as the input can be controlled through word lines and the current can be converged on the bit line / source line.

[0109] 3) Variations of differential implementation: "Double-step differential" can be implemented in the analog domain by subtracting the results after sampling and holding with a capacitor; it can also be implemented in the digital domain by subtracting the results after quantizing them twice with an ADC; or it can be implemented by simultaneously reading two physical bit lines (if the circuit allows copying the input path) to convert the "double-step" in the time domain into a "double-line" in the spatial domain. However, this invention prefers time-domain double-step to save area.

[0110] 4) Variations of bias term calculation: Bias terms can be calculated in digital logic (such as CPU, DSP or dedicated logic) outside the in-memory computing array, or in analog domain calculation using reference columns at the array edge.

[0111] 5) Extension of multi-bit precision: The "multi-bit" mentioned in this invention is not limited to 2-bit input / weight. By increasing the voltage amplitude level or time pulse width modulation, it can be extended to higher precision such as 4-bit and 8-bit.

[0112] Finally, it should be noted that the above examples are merely specific embodiments of the present invention. Obviously, the present invention is not limited to the above embodiments and can have many variations. For example, the non-volatile transistor can be a FeFET, RRAM (with a gate transistor), MRAM, or other devices with programmable conductivity characteristics that can be used as a single-transistor memory cell; differential calculations can be performed in the analog domain (charge pump) or the digital domain (subtraction after ADC); the calculation of the bias term can be performed by on-chip dedicated circuitry or an off-chip processor. All these variations and modifications should fall within the protection scope of the claims of this invention.

Claims

1. A multi-bit in-situ decryption memory calculation method based on dual-phase differential calculation of a single non-volatile transistor, characterized in that, Includes the following steps: 1) Weight encryption storage steps: Store the plaintext weight matrix... With key vector Perform XOR encryption to generate a ciphertext weight matrix. and the ciphertext weight matrix elements in The value is mapped to a conductance and written into a memory array consisting of a single non-volatile transistor; The individual non-volatile transistor is not configured with a corresponding complementary memory cell; 2) Input preprocessing step: Obtain the input vector to be calculated. and the key vector used for decryption For each element in the input vector and the corresponding elements in the key vector Generate a first clock phase input signal and a second clock phase input signal; the first clock phase input signal corresponds to a logic term. That is, it is valid when the key bit is logic 0 and set to zero when it is logic 1; the second clock phase input signal corresponds to the logic item. That is, the key is valid when it is logic 1 and set to zero when it is logic 0; Wherein, the first clock phase input signal is represented as The second clock phase input signal is represented as ,when At that time, only the first clock phase input is valid. At that time, only the second clock phase input is valid, where This represents the j-th input element in the input vector. This represents the key bit corresponding to the j-th column or the j-th input channel; 3) Dual-time in-situ calculation steps: In the first clock phase, input the first clock phase signal. This is converted into a word line voltage and applied to the memory array, obtaining the current or charge corresponding to the first intermediate result on the source line; in the second clock phase, the second clock phase input signal is... This is converted into word line voltage and applied to the memory array, resulting in the current or charge amount corresponding to the second intermediate result on the source line; Specifically, the first clock phase Phase 1 is used to calculate the positive contribution term, and the array outputs the first intermediate result, denoted as Y1; the second clock phase Phase 2 is used to calculate the negative contribution term, and the array outputs the second intermediate result, denoted as Y2. 4) Differential reconstruction and bias recovery steps: Perform a subtraction operation on the first intermediate result Y1 and the second intermediate result Y2. The differential MAC result after removing the key symbol mask is obtained; the input vector is calculated. With key vector The inner product related terms are used as bias terms, and these bias terms are added to the difference MAC result to obtain the final plaintext multiplication and addition operation result.

2. A circuit for implementing the multi-bit in-situ decryption memory calculation method based on a single non-volatile transistor dual-phase differential as described in claim 1, characterized in that, include: The system includes a non-volatile transistor array, a differential scanning gate drive circuit, a dual-step differential buffer, a bias recovery module, and a peripheral processing module; among which, The non-volatile transistor array is used to store ciphertext weights and generate column currents. It is a NOR or AND type array composed of individual non-volatile transistor cells, each cell of which stores encrypted ciphertext weight information. The gate of the non-volatile transistor is connected to the word line, and the drain or source is connected to the bit line BL or the source line. The differential scan gate drive circuit receives input data and key data, and generates a first clock phase Phase 1 input signal and a second clock phase Phase 2 input signal based on the input vector and key vector, respectively. The output of the differential scan gate drive circuit is connected to the word lines of the array. The differential scan gate drive circuit is configured to apply a clock phase based on the key vector to the array word lines in two different clock cycles. The first voltage signal of the logic and based on The second voltage signal of the logic; The dual-time differential buffer is used to acquire the array output for two clock cycles and perform buffering and subtraction operations to obtain the differential MAC result after removing the key symbol mask; this circuit is connected to the source line of the array to read the output current or charge of the array; this circuit is implemented by a differential analog-to-digital converter based on a classic sample-and-hold unit; The bias recovery module is used to superimpose the bias term determined by the input vector and the key vector, that is, to calculate the linear combination bias value of the input data and the key data, and add it to the output of the double-shot differential buffer to obtain the final plaintext multiplication and addition operation result; The peripheral processing module includes: a WL decoder for selecting the activated word line; an input register for buffering the input vector and key vector; a level generator for generating input gate signals corresponding to Phase 1 and Phase 2 and converting the two-phase input signals into array word line voltages; a BL driver circuit for driving the bit lines; an SL multiplexer for selecting the corresponding source line output channel; multiple ADCs for quantizing analog readout signals from different channels or phases; and a shift accumulator for bit weight alignment and accumulation of multi-bit inputs or multi-bit weighted partial sums.

3. The circuit as described in claim 2, characterized in that, The non-volatile transistor is selected from one of the following: ferroelectric field-effect transistor, floating gate transistor, or charge trapping transistor.

4. The circuit as described in claim 2, characterized in that, The non-volatile transistor operates in multilevel cell (MLC) mode, and its threshold voltage... Programmed to One of the discrete states, the channel conductance corresponding to each state Linear correspondence to ciphertext weight combination value; Multilevel cell (MLC) mode refers to a single non-volatile transistor storing multiple bits of information through multiple distinguishable threshold voltages or channel conductance states.

5. The circuit as described in claim 2, characterized in that, The differential scanning gate drive circuit includes a pulse width modulation (PWM) or amplitude modulation (AM) circuit for converting multi-bit input vectors. This is converted into a voltage pulse of corresponding duration or amplitude. During double-step differential operation, the first clock phase, Phase 1, drives the corresponding... The pulse, the second clock phase Phase 2 drives the corresponding The pulse is used to multiply the input value and the weighted conductance through integration in the time domain.

6. The circuit as described in claim 2, characterized in that, The bias recovery module includes a scaling factor configuration unit, which is used to adjust the coefficient value of the bias term according to the currently calculated weight precision.

Images