# Rethinking Non-idealities in Memristive Crossbars for Adversarial Robustness in Neural Networks

arXiv: https://arxiv.org/abs/2008.11298 · HTML: https://mlsanity.com/paper/2008.11298/

## Key facts

- Cited by 4 papers in the map (data through 14 Oct 2026).
- First posted on arXiv 25 Aug 2020.

## Built on by (most cited first, 4 of 4)

- [Efficiency-driven Hardware Optimization for Adversarially Robust Neural Networks](https://mlsanity.com/paper/2105.04003/) (2021)
- [Noise Sensitivity-Based Energy Efficient and Robust Adversary Detection in Neural Networks](https://mlsanity.com/paper/2101.01543/) (2021)
- [Design of secure and robust cognitive system for malware detection](https://mlsanity.com/paper/2208.02310/) (2022)
- [Nonideality-aware training makes memristive networks more robust to adversarial attacks](https://mlsanity.com/paper/2409.19671/) (2024)

## Abstract (arXiv)

Deep Neural Networks (DNNs) have been shown to be prone to adversarial attacks. Memristive crossbars, being able to perform Matrix-Vector-Multiplications (MVMs) efficiently, are used to realize DNNs on hardware. However, crossbar non-idealities have always been devalued since they cause errors in performing MVMs, leading to computational accuracy losses in DNNs. Several software-based defenses have been proposed to make DNNs adversarially robust. However, no previous work has demonstrated the advantage conferred by the crossbar non-idealities in unleashing adversarial robustness. We show that the intrinsic hardware non-idealities yield adversarial robustness to the mapped DNNs without any additional optimization. We evaluate the adversarial resilience of state-of-the-art DNNs (VGG8 & VGG16 networks) using benchmark datasets (CIFAR-10, CIFAR-100 & Tiny Imagenet) across various crossbar sizes. We find that crossbar non-idealities unleash significantly greater adversarial robustness (>10-20%) in crossbar-mapped DNNs than baseline software DNNs. We further assess the performance of our approach with other state-of-the-art efficiency-driven adversarial defenses and find that our approach performs significantly well in terms of reducing adversarial loss.