SEAL: Multitenant Security-Aware Layer Mapping for Heterogeneous 3-D CiM Accelerators

Abstract

Heterogeneous 3-D compute-in-memory (CiM) architectures have emerged as an efficient acceleration paradigm for deep neural network (DNN) inference by leveraging the complementary characteristics of diverse memory technologies enabled through 3-D integration. Prior work has focused on architectural efficiency and workload-mapping optimization, leaving the security implications of heterogeneous CiM systems largely unexplored. This gap becomes critical in multitenant deployments, where the shared power delivery network (PDN) exposes the system to a ground-bounce-driven fault-injection attack: a malicious co-tenant drives switching-intensive activity that shifts the victim chiplet’s ground reference, corrupting memory reads during inference and degrading output quality. We propose SEAL, a security-aware layer-mapping framework that co-optimizes power, performance, area (PPA), and fault vulnerability across the layer-to-tier search space. SEAL combines per-layer criticality with device-level fault sensitivity to route vulnerability-critical layers to fault-resilient (device, tier) combinations, and we report the power and area of every mapping we present. We evaluate SEAL on ResNet-18 (CIFAR-10) and Qwen2.5-3B (WikiText-2) under attacker-induced ground bounce. SEAL reduces fault vulnerability by up to $3.9\times $ on ResNet-18 and $7.8\times $ on Qwen2.5-3B over a security-blind mapping baseline on compositions where both methods find usable mappings. On ReRAM-heavy compositions, SEAL places every high-criticality layer on a low-vulnerability tier and drives fault vulnerability to the characterization floor, an operating point the security-blind baseline does not reach. Accuracy stays within 0.06 pp of the fault-free baseline on ResNet-18 and perplexity within 0.06 of the fault-free baseline on Qwen2.5-3B. SEAL further finds usable mappings on three compositions (two on ResNet-18 and one on Qwen2.5-3B) where the security-blind baseline finds none.