# Who’s Afraid of Thomas Bayes?

Erick Galinkin<EMAIL_ADDRESS>0000-0003-1268-9258 Drexel
University3141 Chestnut StPhiladelphiaPennsylvaniaUSA19104 Rapid7120 Causeway
StBostonMassachusettsUSA02114

(2021)

###### Abstract.

In many cases, neural networks perform well on test data, but tend to
overestimate their confidence on out-of-distribution data. This has led to
adoption of Bayesian neural networks, which better capture uncertainty and
therefore more accurately reflect the model’s confidence. For machine learning
security researchers, this raises the natural question of how making a model
Bayesian affects the security of the model. In this work, we explore the
interplay between Bayesianism and two measures of security: model privacy and
adversarial robustness. We demonstrate that Bayesian neural networks are more
vulnerable to membership inference attacks in general, but are at least as
robust as their non-Bayesian counterparts to adversarial examples.

adversarial machine learning, neural networks, uncertainty, machine learning
security, privacy, membership inference

††copyright: acmcopyright††journalyear: 2021††doi:
10.1145/1122445.1122456††conference: AISEC ’21: ACM WORKSHOP ON ARTIFICIAL
INTELLIGENCE AND SECURITY; November 15–19, 2021; Seoul, South
Korea††booktitle: AISEC ’21: ACM WORKSHOP ON ARTIFICIAL INTELLIGENCE AND
SECURITY, November 15–19, 2021, Seoul, South Korea††price: 15.00††isbn:
978-1-4503-XXXX-X/18/06††ccs: Security and privacy Domain-specific security
and privacy architectures††ccs: Computing methodologies Neural networks

##  1\. Introduction

Deep learning has revolutionized machine learning over the last decade,
providing tremendous advancements across disciplines and exploding the
public’s interest in artificial intelligence. One of the safety challenges
faced by deep neural networks (Amodei et al., 2016) has been the inability to
represent uncertainty, especially on data which lies outside of the model’s
training distribution. Attempts to rectify this challenge have fueled new
research in the field of Bayesian neural networks, since Bayesianism reduces
overconfidence (Kristiadi et al., 2020) in these models. The research of Yarin
Gal (Gal and Ghahramani, 2016); Wilson and Ismailov (Wilson and Izmailov,
2020); and Kristiadi et al. has provided tools to make familiar model
architectures more Bayesian, which enhances the trustworthiness and safety of
neural networks. The ease with which familiar architectures can now
incorporate a Bayesian component lowers the barriers to development and
deployment of Bayesian models, suggesting that we will see growing deployment
of these models.

Safety in machine learning is, however, much more than simply avoiding
overconfident predictions. In order for us to ensure that machine learning
systems are safe, we must also work to keep them secure. Security-conscious AI
researchers may wonder if there is some side effect to making models more
Bayesian on the security and privacy of our models, a question that this work
seeks to address. Although there are other possible ways to quantify
uncertainty, Bayesian neural networks have gained traction in industry as a
way to alleviate this overconfidence, and have a reputation for being
theoretically sound.

In this work, we wish to examine both how Bayesianism impacts the
confidentiality of the model’s training data and the integrity of the model’s
predictions. We accomplish this by first exploring how additional information
conferred by making the model more Bayesian can enable privacy-damaging
attacks like membership inference (Shokri et al., 2017) which seek to
determine if a sample was part of the target model’s training data. Then, we
examine how specially crafted samples that aim to cause misclassification
(Szegedy et al., 2013) – so-called adversarial examples – are affected by
Bayesianism in neural networks.

##  2\. Background

This work builds on the body of literature surrounding Bayesian neural
networks, membership inference attacks, and adversarial machine learning.
Neural networks are machine learning models which couple an affine
transformation with a nonlinear activation function and have been widely used
in the fields of computer vision, and natural language processing. These
models seek to approximate complex relationships between input data and a set
of corresponding labels. Bayesian neural networks differ from these
conventional neural networks by including some feature that captures both the
uncertainty about the data – aleatoric uncertainty – and uncertainty about the
parameters – epistemic uncertainty.

Work by Gal and Ghahramani (Gal and Ghahramani, 2016) demonstrated that a
certain use of a common deep learning regularization technique, dropout, can
approximate a spike and slab Bayesian prior. Dropout is a technique where by
setting a hyperparameter known as the dropout rate, the neuron will output
zero with that probability (Srivastava et al., 2014). The work of Gal and
Ghahramani applied a high probability dropout to each layer of the network to
approximate Bayesian inference, capturing the aforementioned aleatoric and
epistemic uncertainty. Prior work by the author (Galinkin, 2021) demonstrates
tension between this sort of Bayesian dropout and differential privacy,
suggesting that some amount of information may inadvertently be “leaked” by
the use of uncertainty quantification techniques.

Expressing uncertainty provides useful information – in many cases, a highly
confident prediction suggests that the network has seen similar samples in
training. This benefit to AI safety, in making predictions on out-of-
distribution data less confident, can also provide extremely valuable
information when conducting membership inference attacks. Membership inference
attacks against machine learning models seek to determine whether or not a
data sample was in the training data for the target. Shokri et al. (Shokri et
al., 2017) developed a method for conducting these attacks against machine
learning models, conducting closed-box queries that return only the output
probabilities for each class to predict whether or not the sample input to the
model was in the training data set. This was done by first training $k$ so-
called “shadow models” that imitate the behavior of the target, trained on a
synthetic dataset that is from approximately the same distribution as the
target, where $k$ is the number of output classes. Then an attack model is
trained for each of the $k$ models, taking the outputs of the $k$ models and
making a prediction of whether or not the sample was in or out of the training
data.

Salem et al. (Salem et al., 2019) refined Shokri et al.’s procedure, training
only a single shadow model, and making a number of other improvements that
improve efficacy and reduce both training time and the amount of synthetic
training data. The methods used in our paper are derived from these
refinements. Interestingly, Salem et al. recommend dropout as a potential
defense against membership inference, albeit not enough to provide the
approximate Bayesianism of Gal and Ghahramani’s methods.

Adversarial examples – specially crafted samples which seek to perturb images
in imperceptible ways to cause misclassification – were introduced to the
world by Szegedy et al. (Szegedy et al., 2013) as a peculiar feature of
differentiable models. Further work by Carlini and Wagner (Carlini and Wagner,
2017) expanded the understanding and evaluation of these adversarial examples,
and considered the potential threat models associated with adversarial
examples. This same work by Carlini and Wagner also introduced three new
attack algorithms that each minimally distort images under a given distance
metric. Work by Suciu et al. (Suciu et al., 2019) considers the specific
question of adversarial examples against deep learning-based malware
detectors, highlighting the potential for more sophisticated detection evasion
techniques using adversarial machine learning.

Our work is thus further motivated by the assertion of Smith and Gal (Gal and
Smith, 2018) that Bayesian neural networks cannot have adversarial examples
under some set of conditions. In this work, the authors develop a strong
theoretical justification that under idealized circumstances, Bayesian
networks will capture perfect epistemic uncertainty and thus cannot have
adversarial examples. To exercise this theory in an empirical way, they
generate a synthetic dataset with complete knowledge of the ground-truth
image-space density and find that for Hamiltonian Monte Carlo – the gold
standard for Bayesian Neural Network inference – adversarial crafting fails.
Our work instead considers the susceptibility of Bayesian models to
adversarial examples on familiar benchmark datasets compared with a baseline
model rather than synthetic datasets.

In general, adversarial attacks work via the same principle – given a neural
network with fixed parameters, $F(x)=y$, we define the classifier
$C(x)=\arg\max_{i}F(x)_{i}$ to output a label for the input $x$. Let
$C^{*}(x)$ be the correct label of $x$. Then, given a valid input $x$ and a
target class $t\neq C^{*}(X)$, we search for a small perturbation $\delta$
such that for distance metric $D$,

$\begin{split}\text{minimize }D(x,x+\delta)\\\ \text{such that
}C(x+\delta)=t\end{split}$

The distance metric $D$ is most often some $\ell_{p}$ norm, with $p$ most
often set to 0, 2, or $\infty$. In untargeted cases, we search instead for
some valid input $x^{\prime}$ which meets the same minimization criteria and
constraints as $x+\delta$. This approach, however, is less common than
generating noise or a patch to be applied.

##  3\. Methods

To assess the effect of Bayesianism on the efficacy of membership inference
attacks and adversarial examples, we leverage a total of four models. Each
model architecture features a standard, dropout-less control and a Bayesian
experimental model. All of the models are trained and tested on both the MNIST
(LeCun, 1998) and the CIFAR-10 (Krizhevsky et al., 2009) datasets, two well-
researched benchmarks. This provides a good basis for comparison to other
model architectures and allows us to draw more specific conclusions about the
effect of Bayesianism absent variables around the data and architecture. All
of the models and experiments were conducted on a single server, with a single
RTX 2080 Ti, 128 GB of RAM, and an AMD Threadripper 1950x.

###  3.1. Models

Our first experimental architecture is based on the LeNet-5 (LeCun et al.,
2015) architecture, which features 5 hidden layers. The second experimental
architecture is based on the ResNet-18 (He et al., 2016) architecture that
takes advantage of residual connections to avoid the vanishing gradient
problem – a problem which plagues very deep, non-residual networks. Although
our datasets are quite simple, these two architectures are widely studied and
easy to train given computational limitations. In order to make the
aforementioned models Bayesian, our work leverages the spike and slab prior of
Gal and Ghahramani (Gal and Ghahramani, 2016) within the experimental models.
This ensures the highest degree of similarity between the Bayesian and non-
Bayesian architectures in order to isolate the effect of Bayesianism. All of
the models were trained with early stopping to prevent overfitting, but no
hyperparameters were tuned in training the architectures to assure the highest
degree of similarity between Bayesian and Non-Bayesian models.

###  3.2. Attacks

Attacks on machine learning systems come in many forms, from more conventional
denial of service or code execution-style attacks on the libraries (Stevens et
al., 2017) to the ML-specific denial of service via sponge examples (Shumailov
et al., 2020), there are many facets where machine learning systems can be
exploited. We consider two classes of attacks from this array: membership
inference attacks and adversarial examples. These two attack classes have both
been well-studied, and target wildly different parts of the process –
membership inference seeking to attack the confidentiality of training data,
and adversarial examles seeking to attack the integrity of the predictions.
Background on these is provided in Section 2 and we detail the methods used in
our experiments below.

####  3.2.1. Membership Inference

We leverage the prior work done by Salem et al. (Salem et al., 2019) on
closed-box membership inference attacks. This involves the creation of a
synthetic “shadow” dataset with a similar distribution to the training
distribution of the target model. The shadow dataset is used to train a shadow
model that approximates predictions for the target classifier. Additional
synthetic examples are generated and added to the shadow dataset, to be used
as a validation dataset on which the classifier is not trained. The shadow
model and shadow dataset is then used to generate a set of output vectors from
the classifier and assigned an “in” or “out” label depending on whether or not
the model was trained on the sample. This in-or-out dataset is used to train a
binary classifier to attack the model. This process is visualized in Figure 1.
Further technical details are available in the paper by Salem et al.

Figure 1. Diagram of Membership Inference Attack

####  3.2.2. Adversarial Examples

Using the Microsoft Counterfit
framework111https://github.com/azure/Counterfit, we evaluate our models using
two different attacks: a boundary attack (Brown et al., 2017) and the hop-
skip-jump attack (Chen et al., 2020). These attacks are both closed-box
attacks – attacks which do not require direct access to the model and instead
consider only inputs to and outputs from the model – making the attack
scenario more realistic than open-box models where all details are available
to attackers. Each model was targeted using both attacks over 100 iterations
per attack, model, and dataset combination. We evaluate attack efficacy as a
percentage equal to the number of successful attack attempts.

The boundary attack is a decision-based attack which leverages an adversarial
patching technique intended to cause misclassification in the real world. It
starts with a perturbation of the original image that is already adversarial –
classified as part of the target class – and iteratively reduces the
$\ell_{2}$ distance between the original image and the adversarial example by
randomly walking along the boundary between the adversarial and non-
adversarial region of the classifier. This is done by first ensuring the
adversarial sample $x^{\prime}$ is in the input domain, in this case, a valid
image. Then, at step $k$, the perturbation $\eta^{k}$, should have a relative
size of $\delta$:

$\|\eta^{k}\|_{2}=\delta\cdot D(x,x^{\prime})$

where $D$ is the distance metric being used. In this case, we set
$D(x,x^{\prime})=\|x-x^{\prime}\|_{2}^{2}$. The value of $\eta$ is drawn from
a Gaussian distribution, than rescaled and clipped to ensure the above
criteria hold. In any case where perturbing $x^{\prime}$ by $\eta$ moves the
adversarial sample out of the target class, the perturbation is discarded.

The hop-skip-jump attack is inspired by the boundary attack, but rather than
rejecting perturbations that move the adversarial sample out of the target
class, those perturbations are used to estimate the gradient direction and
extends the attack to the $\ell_{\infty}norm$. The attack is also both very
query efficient, making it useful for evaluating real-world security of
models, and comparable in efficacy to open-box attacks like Carlini-Wagner
(Carlini and Wagner, 2017). Warde-Farley and Goodfellow (Warde-Farley and
Goodfellow, 2016) have put forth the argument that $\ell_{\infty}$ is the
optimal distance metric for adversarial examples, and so that is the distance
metric we use in our implementation.

Dataset and Model | Test Accuracy | Hop-Skip-Jump | Boundary | Membership Inference
---|---|---|---|---
MNIST LeNet-5 | 98.48% | 58% | 52% | 63.91%
Bayesian MNIST LeNet-5 | 98.01% | 52% | 50% | 64.72%
MNIST ResNet-18 | 98.66% | 64% | 70% | 62.49%
Bayesian MNIST ResNet-18 | 98.02% | 66% | 62% | 73.38%
CIFAR-10 LeNet-5 | 58.43% | 94% | 92% | 58.86%
Bayesian CIFAR-10 LeNet-5 | 58.56% | 85% | 87% | 66.85%
CIFAR-10 ResNet-18 | 75.40% | 69% | 71% | 72.10%
Bayesian CIFAR-10 ResNet-18 | 73.20% | 60% | 57% | 77.16%
Table 1. Summary of results for test set accuracy, efficacy of adversarial
attacks, and accuracy of membership inference against the model. Results for
attacks with the highest efficacy on the dataset are in bold.

##  4\. Results

The results in Table 1 show that in all cases where a model is more Bayesian,
it features a higher susceptibility to membership inference attacks compared
with its non-Bayesian counterpart. This strongly implies that a more Bayesian
model is inherently more susceptible to membership inference, which is likely
an artifact of the additional uncertainty captured on out-of-distribution
samples. When a Bayesian model makes an inference on a sample it has been
trained on, is is substantially more confident than compared with samples that
it has not seen, which lends itself to the efficacy of the attacks on these
models.

Figure 2. Area under the curve plot for membership inference against MNIST
trained model Figure 3. Area under the curve plot for membership inference
against CIFAR-10 trained model

As we can observe from Figure 2, at all points for models trained on MNIST,
the ResNet with dropout is far more vulnerable to the membership inference
attack than the other 3 models, which are clustered more closely together. The
curve is an artifact of the attack model described in Section 3.2.1, comparing
the true positive and false positive rate. In this case, a true positive is a
correct identification that an observed sample is from the training dataset
and a false positive is declaring the sample as part of the training dataset
when it is not. The closeness of the curves other than the Bayesian ResNet
suggests that there may be too much noise in the predictions. This issue could
potentially be resolved with hyperparameter tuning.

The models trained on CIFAR-10, shown in Figure 3 show a greater variability
in vulnerability to membership inference attacks than those trained on MNIST,
though the AUC for ResNet with dropout still greatly exceeds the other three
models. We note, however, that no model trained on any dataset is especially
close to the baseline AUC of 0.5, with the LeNet-5 trained on CIFAR-10 having
the smallest AUC, 0.64.

Dataset | Bayesian | Non-Bayesian
---|---|---
MNIST | 69.05% | 63.2%
CIFAR-10 | 72.01% | 65.48%
Table 2. Membership inference efficacy between Bayesian and Non-Bayesian
models per dataset

Table 2 breaks down the results from Table 1 in detail, showing that in
general, Bayesian models are approximately 10% more vulnerable to membership
inference attacks than their non-Bayesian counterparts independent of dataset.
This suggests that there is an inherent trade-off being made between
quantifying uncertainty and protecting the confidentiality of a model’s
training data. We discuss potential mitigations that may alleviate this trade-
off in Section 5.

In contrast with the membership inference results, Bayesian and non-Bayesian
models proved approximately equally vulnerable to adversarial examples.
Efficacy of attacks demonstrated little correlation between model and dataset
combination, and no one model type clearly more vulnerable the others across
datasets. On CIFAR-10, the non-Bayesian LeNet-5 proved more vulnerable to
adversarial examples for both attacks, but the same model architecture was the
second-most robust on average for the MNIST dataset. The presence of
Bayesianism seems to have no effect on the efficacy of adversarial examples in
general. This is reasonable given the fact that the decision boundaries for
the various models and datasets should be quite similar and the attack methods
used have no knowledge of the models inner workings, and must rely entirely on
gradient estimation techniques.

Dataset | Hop-Skip-Jump | Boundary
---|---|---
MNIST | 60% | 58.5%
CIFAR-10 | 77% | 76.75%
Table 3. Average efficacy of adversarial attacks across all models per dataset

Interestingly, the training dataset seems to have a much stronger relationship
to the efficacy of adversarial samples than any model-specific artifact, as we
can observe from Table 3. This is likely due to the additional complexity of
the sample space for CIFAR-10, as compared with MNIST. This follows from the
sensitivity to well-generalizing features in the data, as described by Ilyas
et al (Ilyas et al., 2019). Since CIFAR-10 images are both larger and are
color images, as compared with MNIST’s black and white images, they have a
comparative wealth of features that may be highly predictive but not robust.

##  5\. Conclusion

The results of our experiment are very clear on the question of membership
inference attacks – Bayesian neural networks are substantially more vulnerable
to these types of attacks. In sensitive use cases of artificial intelligence,
we will want to have both uncertainty quantification and data privacy.
Unfortunately, these experiments suggest that we likely cannot have both.
Returning only the top-1 result with a probability may help alleviate this, as
it is quite difficult to build a membership inference attack off of so little
data. However, this may impact the usefulness of the model in cases where
humans need to make decisions based upon its output.

Luckily, it seems that in cases where adversarial examples are part of our
threat model, Bayesianism does not increase nor reduce the opportunity for
attacks to be successful. Across the two data sets, the hop-skip-jump attack
was most effective on alternatively the largest Bayesian model and the
smallest non-Bayesian model while the boundary attack proved effective on two
different non-Bayesian models across the two data sets. The results of our
experiment suggest that the most significant factor in the success of
adversarial examples is the complexity of the dataset – models trained on
datasets with more space to perturb the image are far more vulnerable. This
suggests that Bayesianism should not affect your risk calculus in cases where
adversarial examples are a threat. In many cases where Bayesianism is being
implemented, confidence on unexpected samples should be low, so there may even
be other advantages against adversarial examples.

In future work, we seek to see how these attacks work on non-image data, such
as text. Privacy of text is more acutely relevant for most use cases, and
prior work (Carlini et al., 2020) suggests that stronger forms of training
data recovery are possible on these sorts of models. Coupling that work with
the increased complexity in the adversarial example space and recent
breakthroughs (Boucher et al., 2021) in adversarial examples on text
classifiers make this realm a natural extension of the current work.
Additionally, future work might consider how certain defenses against
membership inference and adversarial examplesperform when paired with
Bayesianism.

###### Acknowledgements.

Funded by the Auerbach Berger Chair in Cybersecurity held by Spiros
Mancoridis, at Drexel University

## References

  * (1)
  * Amodei et al. (2016) Dario Amodei, Chris Olah, Jacob Steinhardt, Paul Christiano, John Schulman, and Dan Mané. 2016\.  Concrete Problems in AI Safety.  arXiv:1606.06565 [cs.AI]
  * Boucher et al. (2021) Nicholas Boucher, Ilia Shumailov, Ross Anderson, and Nicolas Papernot. 2021.  Bad Characters: Imperceptible NLP Attacks.  _arXiv preprint arXiv:2106.09898_ (2021).
  * Brown et al. (2017) Tom B. Brown, Dandelion Mané, Aurko Roy, Martín Abadi, and Justin Gilmer. 2017\.  Adversarial Patch.  _CoRR_ abs/1712.09665 (2017).  arXiv:1712.09665 http://arxiv.org/abs/1712.09665
  * Carlini et al. (2020) Nicholas Carlini, Florian Tramer, Eric Wallace, Matthew Jagielski, Ariel Herbert-Voss, Katherine Lee, Adam Roberts, Tom Brown, Dawn Song, Ulfar Erlingsson, et al. 2020\.  Extracting Training Data from Large Language Models.  _arXiv preprint arXiv:2012.07805_ (2020).
  * Carlini and Wagner (2017) Nicholas Carlini and David Wagner. 2017.  Towards evaluating the robustness of neural networks. In _2017 ieee symposium on security and privacy (sp)_. IEEE, 39–57.
  * Chen et al. (2020) Jianbo Chen, Michael I. Jordan, and Martin J. Wainwright. 2020\.  HopSkipJumpAttack: A Query-Efficient Decision-Based Attack.  arXiv:1904.02144 [cs.LG]
  * Gal and Ghahramani (2016) Yarin Gal and Zoubin Ghahramani. 2016.  Dropout as a bayesian approximation: Representing model uncertainty in deep learning. In _international conference on machine learning_. 1050–1059.
  * Gal and Smith (2018) Yarin Gal and Lewis Smith. 2018.  Sufficient conditions for idealised models to have no adversarial examples: a theoretical and empirical study with Bayesian neural networks.  _arXiv preprint arXiv:1806.00667_ (2018).
  * Galinkin (2021) Erick Galinkin. 2021\.  The Influence of Dropout on Membership Inference in Differentially Private Models.  _arXiv preprint arXiv:2103.09008_ (2021).
  * He et al. (2016) Kaiming He, Xiangyu Zhang, Shaoqing Ren, and Jian Sun. 2016\.  Deep residual learning for image recognition. In _Proceedings of the IEEE conference on computer vision and pattern recognition_. 770–778.
  * Ilyas et al. (2019) Andrew Ilyas, Shibani Santurkar, Logan Engstrom, Brandon Tran, and Aleksander Madry. 2019.  Adversarial Examples Are Not Bugs, They Are Features.  _Advances in neural information processing systems_ 32 (2019).
  * Kristiadi et al. (2020) Agustinus Kristiadi, Matthias Hein, and Philipp Hennig. 2020\.  Being Bayesian, Even Just a Bit, Fixes Overconfidence in ReLU Networks. In _Proceedings of the 37th International Conference on Machine Learning_ _(Proceedings of Machine Learning Research, Vol. 119)_ , Hal Daumé III and Aarti Singh (Eds.). PMLR, 5436–5446.  http://proceedings.mlr.press/v119/kristiadi20a.html
  * Krizhevsky et al. (2009) Alex Krizhevsky, Geoffrey Hinton, et al. 2009\.  Learning multiple layers of features from tiny images.  (2009).
  * LeCun (1998) Yann LeCun. 1998\.  The MNIST database of handwritten digits.  _http://yann. lecun. com/exdb/mnist/_ (1998).
  * LeCun et al. (2015) Yann LeCun et al. 2015\.  LeNet-5, convolutional neural networks.  _URL: http://yann. lecun. com/exdb/lenet_ 20, 5 (2015), 14\.
  * Salem et al. (2019) Ahmed Salem, Yang Zhang, Mathias Humbert, Mario Fritz, and Michael Backes. 2019.  ML-Leaks: Model and Data Independent Membership Inference Attacks and Defenses on Machine Learning Models. In _Network and Distributed Systems Security Symposium 2019_. Internet Society.
  * Shokri et al. (2017) Reza Shokri, Marco Stronati, Congzheng Song, and Vitaly Shmatikov. 2017.  Membership inference attacks against machine learning models. In _2017 IEEE Symposium on Security and Privacy (SP)_. IEEE, 3–18.
  * Shumailov et al. (2020) Ilia Shumailov, Yiren Zhao, Daniel Bates, Nicolas Papernot, Robert Mullins, and Ross Anderson. 2020\.  Sponge examples: Energy-latency attacks on neural networks.  _arXiv preprint arXiv:2006.03463_ (2020).
  * Srivastava et al. (2014) Nitish Srivastava, Geoffrey Hinton, Alex Krizhevsky, Ilya Sutskever, and Ruslan Salakhutdinov. 2014.  Dropout: a simple way to prevent neural networks from overfitting.  _The journal of machine learning research_ 15, 1 (2014), 1929–1958.
  * Stevens et al. (2017) Rock Stevens, Octavian Suciu, Andrew Ruef, Sanghyun Hong, Michael Hicks, and Tudor Dumitraş. 2017.  Summoning demons: The pursuit of exploitable bugs in machine learning.  _arXiv preprint arXiv:1701.04739_ (2017).
  * Suciu et al. (2019) Octavian Suciu, Scott E Coull, and Jeffrey Johns. 2019\.  Exploring adversarial examples in malware detection. In _2019 IEEE Security and Privacy Workshops (SPW)_. IEEE, 8–14.
  * Szegedy et al. (2013) Christian Szegedy, Wojciech Zaremba, Ilya Sutskever, Joan Bruna, Dumitru Erhan, Ian Goodfellow, and Rob Fergus. 2013\.  Intriguing properties of neural networks.  _arXiv preprint arXiv:1312.6199_ (2013).
  * Warde-Farley and Goodfellow (2016) David Warde-Farley and Ian Goodfellow. 2016.  adversarial perturbations of deep neural networks.  _Perturbations, Optimization, and Statistics_ 311 (2016).
  * Wilson and Izmailov (2020) Andrew Gordon Wilson and Pavel Izmailov. 2020.  Bayesian Deep Learning and a Probabilistic Perspective of Generalization.  _arXiv preprint arXiv:2002.08791_ (2020).


pnasresearcharticle James T. Meech

# Electron-Tunnelling-Noise Programmable Random Variate Accelerator for Monte
Carlo Sampling

James T. Meech  Department of Engineering, University of Cambridge  Vasileios
Tsoutsouras  Signaloid  Phillip Stanley-Marbell  Department of Engineering,
University of Cambridge  Signaloid

###### Abstract

This article presents an electron tunneling noise programmable random variate
accelerator for accelerating the sampling stage of Monte Carlo simulations. We
used the LiteX framework to generate a FemtoRV imfc RISC-V instruction set
soft processor and deploy it on a Digilent Arty-100T FPGA development board.
The RISC-V soft processor augmented with our programmable random variate
accelerator achieves an average speedup of $8.70\times$ and a median speedup
of $8.68\times$ for a suite of twelve different benchmark applications when
compared to GNU Scientific Library software random number generation. These
speedups are achievable because the benchmarks spend an average of 90.0 % of
their execution time generating random samples. The results of the Monte Carlo
benchmark programs run over the programmable random variate accelerator have
an average Wasserstein distance of $1.48\times$ and a median Wasserstein
distance of $1.41\times$ that of the results produced by the GNU Scientific
Library random number generators. The soft processor samples the electron
tunneling noise source using the hardened XADC block in the FPGA. The
flexibility of the LiteX framework allows for the deployment of any LiteX-
supported soft processor with an electron tunneling noise programmable random
variate accelerator on any LiteX-supported development board that contains an
FPGA with an XADC.

###### keywords:

Programmable Random Variate Accelerator $|$ Monte Carlo Simulation $|$ FPGA
$|$ RISC-V

This manuscript was compiled on  -5pt

##  1 Introduction

Monte Carlo simulations for quantifying uncertainty in computations are
becoming increasingly more important (1, 2). Computer systems are expected to
make increasingly complicated real-time decisions in life-critical
applications using uncertain data (3). At the same time, Moore’s law has
ceased to provide increased computer hardware performance through transistor
scaling laws (4). These two events call for domain-specific architectures to
accelerate applications such as Monte Carlo simulations (5, 6). This article
introduces a domain-specific hardware accelerator for the sampling stage of
Monte Carlo simulations. Our accelerator will complement other domain-specific
architectures designed for propagating uncertainty through calculations (1,
2). The programmable random variate accelerator is a faster and more efficient
replacement for digital electronic hardware for Monte Carlo sampling. The
programmable random variate accelerator replaces function calls to random
number generator libraries with code to sample from the programmable random
variate accelerator. The accelerator uses an analog-to-digital converter with
direct memory access to allow a RISC-V instruction set processor to sample
from any univariate probability distribution using a physics-based
programmable non-uniform random variate generator.

###  1.1 Contributions

This article presents the following contributions:

  1. 1.

A programmable random variate accelerator design that can sample from
arbitrary univariate Gaussian distributions and arbitrary univariate
distributions as Gaussian mixtures.

  2. 2.

A prototype interfacing the programmable random variate accelerator with a
FemtoRV Petitbateau imfc RISC-V instruction set soft processor on a field
programmable gate array.

  3. 3.

Evaluation of the speed and efficiency improvements gained by using the
programmable random variate accelerator to accelerate a suite of twelve
benchmark applications.

  4. 4.

Comparison of the programmable random variate accelerator Monte Carlo
simulation accuracy for a suite of twelve benchmark applications using
Wasserstein distance from a reference result.

###  1.2 Motivation for Monte Carlo Sampling

Figure 1 panel ➀ shows an application where the user wants to generate random
samples to perform a Black Scholes Monte Carlo simulation. The application
code will call a random number generation function that will perform the Box-
Muller transform on the output of a uniform pseudorandom number generator to
obtain the samples from a Gaussian distribution required for the Black-Scholes
method. Traditional digital electronic hardware will then execute assembly
instructions to run the program for the user. For named probability
distributions with a closed-form inverse cumulative distribution function
other than the Gaussian the random number generation function will use the
inversion method. If there is no closed form for the inverse cumulative
distribution function the random number generation function will resort to
using an even more inefficient rejection sampling method (7). All of the math
operations required for the application will be converted to assembly
instructions to be run on an in-order digital electronic processor. In this
architecture, each instruction and the corresponding data will have to be read
from the main memory over the data bus incurring long latency. Finally, the
digital electronic transistors that implement the hardware will switch the
flow of electrons to perform the computation.

A more efficient alternative to the traditional hardware shown in the top
panel of Figure 1 would be to offload all of the random number generation to a
dedicated programmable random variate accelerator. The user can simply replace
all random number generator calls with calls to the programmable random
variate accelerator application programming interface. Then the compiler
generates assembly instructions to program and sample from the programmable
random variate accelerator. These assembly instructions will allow the
programmable random variate accelerator to use an analog-to-digital converter
to sample from a Gaussian fast and efficiently using an analog noise source.
The programmable random variate accelerator will then quickly and efficiently
transform the raw Gaussian samples to samples from the required probability
distribution and store them in a register in the processor. This replaces the
multiple assembly instructions required to perform the Box-Muller transform,
inversion, or rejection sampling by a single instruction to sample from the
programmable random variate accelerator.

Figure 1: The steps required to perform a Black Scholes Monte Carlo simulation
using a programmable random variate accelerator instead of a digital
electronic processor diverge at the first abstraction level below the abstract
Black Scholes application required by the user. The programmable random
variate accelerator requires small changes at every level of the software and
hardware stack to use electron tunneling noise to generate samples from
parameterized probability distributions to run the Monte Carlo simulation.

##  2 Programmable Random Variate Acceleration

Sampling from empirical application-specific non-uniform probability
distributions is slow and inefficient. Digital electronics processors use the
fast and efficient inversion method (7) shown in Algorithm 1 to transform
uniformly-distributed random samples to non-uniformly-distributed random
samples. Digital electronic processors can only use the inversion method to
obtain random samples for an application when there exists an analytical
closed-form solution for the inverse cumulative distribution function of the
probability density function that the application requires samples from. For
probability density functions for which there is no analytic form for the
inverse cumulative distribution function, the digital electronic processor
must instead use the accept-reject method (7) to transform random samples with
a uniform distribution to samples from the target non-uniform distribution.
Algorithm 2 shows the accept-reject method. The accept-reject method
repeatedly generates samples until a sample satisfies the condition on line
four of Algorithm 2. The algorithm discards any samples that do not meet the
condition. As a result, the accept-reject method is slow and inefficient.

Result: Sample from non-uniform random variable $X$

1 Generate uniform [0, 1] random variate $u$

2 RETURN $x\leftarrow F^{-1}(u)$

Algorithm 1 Inversion method (7). Let $X$ be a non-uniform random variable
that the digital electronic processor needs to sample, $U$ be the uniform
random variable that the digital electronic processor can sample from, and
$F^{-1}$ the inverse cumulative distribution function that the digital
electronic processor requires samples from.

Result: Sample from non-uniform random variable $X$

1 repeat

2 Generate uniform [0, 1] random variate $u$

3 Generate uniform [0, 1] random variate $x$

4 Set $T\leftarrow c\frac{f(x)}{g(x)}$

5

6until  _$uT\leq 1$_

7RETURN $x$

Algorithm 2 Accept-reject method (7). Let $g$ be the density of $U$ and $f$ be
the density of $X$. Let $c\geq 1$ be a constant such that the condition
$f(x)\leq cg(x)$ holds for all $x$. The accept-reject method probabilistically
rejects random variates from a probability distribution that is easy to sample
to produce samples from a probability distribution that is hard to sample.

##  3 Arbitrary Distribution From Gaussian Mixture

Many Monte Carlo simulations require samples from bespoke empirical non-
uniform probability distributions. Our analog noise source can only generate
samples from a univariate Gaussian. We therefore present the theory required
to generate samples from any univariate probability distribution using samples
from a univariate Gaussian random variable. Starting from a univariate
distribution described in terms of discrete samples, it is possible to
reconstruct the probability density function using a kernel density. In the
case where we select the Gaussian as our kernel function the kernel density is
a mixture of Gaussian distributions.

A programmable random variate accelerator can generate samples from a Gaussian
distribution using Gaussian electronic noise and then transform those samples
to change the mean and standard deviation of the distribution. The
programmable random variate accelerator can generate samples from any non-
uniform distribution by decomposing it into a mixture of Gaussians and then
using the Gaussian-to-Gaussian transform (Section 3.2) to sample from each
Gaussian component of the kernel density. The accelerator can then use a
uniform-random-number generator to sample from each Gaussian distribution with
likelihood proportional to the relative weight of each Gaussian (or use equal
weights).

###  3.1 Kernel Densities

If we take a set of $N$ data points that represent a distribution, we can
construct a kernel density estimate of the probability density function. We do
this by fitting a Gaussian mixture to the points. Let $N$ be the number of
samples, $M$ be the number of component functions, $K$ be the kernel density
function that we use (a Gaussian distribution) and $h$ be the bandwidth which
is a smoothing parameter. Wand et al. (8) show that we can write the
normalized version of our kernel density estimate as

$\hat{f}_{X}(x)=\frac{1}{Mh}\sum^{M}_{i=1}K\bigg{(}\frac{x-x_{i}}{h}\bigg{)}.$
(1)

Assuming that the data has a Gaussian distribution we can use Silverman’s rule
to calculate $h$. Let $\sigma_{N}$ be the standard deviation of all $N$ data
points, Silverman (9) shows that we can estimate $h$ as

$h=\bigg{(}\frac{4\sigma_{N}^{5}}{3N}\bigg{)}^{\frac{1}{5}}.$ (2)

More sophisticated kernel density estimation methods exist if the application
demands a better approximation (10, 11, 12).

###  3.2 Gaussian-to-Gaussian Transform

The programmable random variate accelerator can obtain a Gaussian-distributed
random variable $X^{\prime}$ with any desired mean $\mu^{\prime}$ and standard
deviation $\sigma^{\prime}$ from a Gaussian-distributed random variable $X$
with a mean $\mu$ and standard deviation $\sigma$ (13) by applying the
transformation

$X^{\prime}=(Xa)+b$ (3)

where

$a=\frac{\sigma^{\prime}}{\sigma}$ (4)

and

$b=\mu^{\prime}-\mu a.$ (5)

Sampling from a random variable by transforming samples from an existing
Gaussian or mixture of Gaussian random variables always produces a sample,
unlike the accept-reject method which does not.

##  4 Electron Tunelling Noise Source Implementation

The implementation of the Gaussian random number generator consists of a
constant current reverse bias generating circuit, a reverse-biased Zener diode
noise source, a direct current blocking capacitor, a bias setting potential
divider, and an operational amplifier. Both the reverse bias generating
circuit and the oper can be turned off to reduce power consumption by
connecting the “On” pin to 0 V.

###  4.1 Circuit Design

Figure 2 shows the circuit diagram of the programmable noise source design
slightly modified from prior work by Huang (14). The design leverages a high
voltage constant current light emitting diode driver to provide a Zener diode
with a 15 V reverse bias. The light-emitting diode driver enforces a constant
current to minimize the overall power consumption. The reverse-biased Zener
diode generates a noise voltage which is amplified by an operational amplifier
with a gain of $5\times$. Prior to this, a direct current blocking capacitor
removes the large 15 V bias voltage from the noise signal and a potential
divider sets the mean of the noise signal. Figure 3 shows a prototype printed
circuit board that implements the circuit shown in the shaded gray box on the
left side of Figure 2 (i.e., excluding the mux, ADC, and CPU).

The circuit uses a constant current light emitting diode driver powered by the
supply rail to apply a 15 V reverse bias to the Zener diode to cause electrons
to randomly tunnel through the PN junction. This random tunneling activity
manifests itself as a random voltage signal that the circuit amplifies using a
non-inverting operational amplifier circuit. The direct current blocking
capacitor removes the 15 V direct current bias, and the circuit adds a new
bias to the signal using a programmable resistor divider. The resistor divider
controls the mean of the Gaussian noise distribution. The gain of the non-
inverting operational amplifier controls the standard deviation of the
distribution. Finally, the analog-to-digital converter quantizes the output of
the amplifier to 12-bit unsigned integers. We set the bias and gain to ensure
that the analog-to-digital converter sees a large range of unique signal
values and captures the Gaussian shape of the distribution.

Figure 2: The physics-based Gaussian random number generator circuit. Details
of circuits such as the constant current light emitting diode driver circuit
that produces the 15 V bias voltage are omitted here but available in (14).
Figure 3: The low power Gaussian noise source printed circuit board. The
printed circuit board consumes 1.62 mW of power in the on state and 32.4 nW in
the off state (14). Figure 4: The low power Gaussian noise source printed
circuit board connected to the XADC of an Artix-7 XC7A100T FPGA on a Digilent
Arty development board. The microSD card PMOD stores .elf program files to be
executed on the soft processor on the FPGA. LiteOS provides the functionality
to compile C language programs to .elf files for the RISC-V Petitbateau soft
processor (15). The FPGA development board and noise source board combined
consume approximately 1.983 W of power when sampling from a univariate
Gaussian.

###  4.2 Kernel Density Programmable Random Variate Accelerator for
Programmable Univariate Distributions

Figure 5 shows how the programmable random variate accelerator transforms the
random samples in software to produce the target distribution. The user
programs the processor with three arrays containing the mean, standard
deviation, and weight of each Gaussian in the kernel density. The processor
uses a software-uniform-pseudorandom number generator (16) to select a
Gaussian to generate samples from. The transform code transforms a sample from
the analog-to-digital converter to a sample from the required Gaussian. The
processor uniformly interpolates the analog-to-digital converter samples using
the same uniform-pseudorandom number generator to increase their resolution
from 12 to 64 bits. Algorithm 3 shows the process of transforming the
generated Gaussian to the required Gaussian and then linearly interpolating
with the uniform-pseudorandom-number generator. This process repeats each time
the processor samples from the distribution.

Figure 5: The programmable random variate accelerator can use a kernel density
encoded as a list of means, standard deviations, and weights to randomly
sample from the mixture of Gaussian distributions that makes up the kernel
density.

input : $\mu,\mu^{\prime},\sigma,\sigma^{\prime},U,X$

Result: Sample $N$ values from Gaussian random variable $X$

1 $a=\frac{\sigma^{\prime}}{\sigma}$

2 $b=\mu^{\prime}-\mu a$

3 for  _$i=0$ to $N$_ do

4 Read in random integer $x$ from the ADC

5 $\mathrm{Sample}=\frac{x+u}{2^{64}}$

6 $\mathrm{Samples}[i]=a*\mathrm{Sample}+b$

7

8 end for

RETURN Samples

Algorithm 3 Method to transform to transform $N$ samples from a distribution
with a mean $\mu$ and standard deviation $\sigma$ to $N$ samples with mean
$\mu^{\prime}$ and standard deviation $\sigma^{\prime}$.

##  5 Noise Source Temperature Dependence

We placed the field programmable gate array development board and the Gaussian
noise source inside a Binder MK56 thermal chamber. We set the thermal chamber
to 0 ∘C and allowed the temperature to reach equilibrium for 30 minutes. While
waiting for the temperature to reach equilibrium we had the soft processor on
the field programmable gate array consistently running a program to print raw
analog-to-digital converter values. When equilibrium was reached we ran a
program to have the processor sample and print $10^{6}$ raw analog-to-digital
converter values. We repeated this for ten different temperatures between 0 ∘C
and 45 ∘C with a 5 ∘C temperature step.

Figure 6(a) shows the dependence of the mean of the raw analog-to-digital
converter values on temperature. We can eliminate this dependence by having
the program that samples the analog-to-digital converter randomly subtract
half of the samples from the maximum analog-to-digital converter value. Figure
6(b) shows the dependence of the standard deviation of the raw analog-to-
digital converter values upon temperature. The curve with the legend “Flipped”
shows that the subtraction method that removes the temperature dependence of
the mean of the raw analog-to-digital converter values shifts the standard
deviation upwards by a constant factor but does not remove the dependence of
the standard deviation upon temperature.

(a) Mean of raw ADC samples from the Gaussian noise source.

(b) Standard deviation of raw ADC samples from the Gaussian noise source.

Figure 6: Mean and standard deviation of ten batches $10^{6}$ raw analog-to-
digital converter samples over a temperature range of 0 ∘C to 45 ∘C with a 5
∘C temperature step. The blue data points and curves show the mean and
standard deviation of the raw ADC values. The orange curve shows the standard
deviation of the raw ADC values after 50 % of them have been randomly
subtracted from the maximum ADC output value.

Figure 7(a) shows a violin plot of the kernel density of the distribution of
raw analog-to-digital converter values at each temperature. Figure 7(b) shows
how randomly subtracting the raw analog-to-digital converter value from the
maximum possible value creates symmetric distributions from the skewed raw
samples. This processing does not remove the temperature dependence of the
standard deviation and higher-order statistics. We should therefore measure
the temperature of the Gaussian noise source and compensate for it or keep the
noise source at a constant temperature when sampling it.

(a) Raw unprocessed ADC samples from the Gaussian noise source.

(b) Raw ADC samples randomly subtracted from 4095 with 0.5 probability.

Figure 7: Violin plot of kernel density estimates of $10^{6}$ ADC samples over
a temperature range of 0 ∘C to 45 ∘C with a 5 ∘C temperature step.

##  6 Speed and Power Consumption Measurements

We measured that the FemtoRV RISC-V soft processor augmented with a
programmable random variate accelerator took approximately 130 s to generate
$10^{9}$ 64-bit random samples. This is a sampling speed of 492 Mb/s. We used
a Microchip ADM00921 Power Meter to measure the combined average power
consumption of the FPGA development board and the low-power Gaussian noise
source printed circuit board to be 1.983 W while running the program that we
used to measure the univariate Gaussian sampling speed. We used a Keithly 2450
SourceMeter to measure the power consumption of the low-power Gaussian noise
source printed circuit board to be 1.62 mW in the on state and 32.4 nW in the
off state.

##  7 Monte Carlo Program Benchmarking Study

We benchmarked twelve C programming language applications on the LiteX-
generated FemtoRV Petitbateau RISC-V processor. The processor used a built-in
64-bit timer to measure the number of clock cycles required to run each
application. Table 1 shows the speedup gained by using Gaussian random numbers
generated by the electron tunneling noise programmable random variate instead
of the GNU scientific library Gaussian and Student T random number generators.
We ran each benchmark one hundred times and found that the average speedup was
$8.70\times$ and the median speedup was $8.69\times$. Gaussian sampling and
Gaussian mixture sampling respectively have an end-to-end speed up of 2815
$\times$ and $2899\times$ respectively if the program does not store the
samples in an array. All benchmark programs shown in Table 1 store the results
of the Monte Carlo simulation in an array.

Table 1: The end-to-end speedup achieved by a programmable random variate accelerator for a range of C language benchmark applications. The average speedup was $8.70\times$ and the median speedup was $8.69\times$. The average Wasserstein distance from the reference result was $1.48\times$ and the median was $1.41\times$ that of the results produced by the GNU Scientific Library random number generators. The lines column is the number of lines in the GNU scientific library implementation of the benchmark. We calculate the Wasserstein distance from a $10^{8}$ sample reference Monte Carlo run on a workstation computer. We measured the Wasserstein distance and speedup results by running 100 repeats with $10^{4}$ samples for each benchmark. We did this using the programmable random variate accelerator for sampling and also separately, the GNU scientific library random number generator. We calculate the random sampling fraction by running each benchmark $10^{4}$ times and calculating the average fraction of clock cycles spent generating random samples. We used the clock() function from the time C library. Application |  Wasserstein Distance Ratio PRVA / GSL |  Random Sampling Fraction (%) |  End-to-End Speed Up ($\times$) |  Number of Lines |  Sampling Distribution | Source
---|---|---|---|---|---|---
Gaussian Sampling | 1.98 | 98.8 | 9.36 | 80 | Gaussian | This Work
Gaussian Mixture | 1.17 | 97.5 | 6.89 | 80 | Mixture | This Work
Addition | 1.12 | 92.1 | 9.31 | 87 | Gaussian | (17, 1)
Divide | 1.51 | 92.1 | 8.59 | 87 | Gaussian | (18, 1)
Multiply | 1.61 | 92.4 | 8.78 | 87 | Gaussian | (19, 1)
Subtract | 1.21 | 92.2 | 10.24 | 87 | Gaussian | (20, 1)
Schlieren | 1.26 | 91.5 | 8.83 | 87 | Gaussian | (21, 1)
NIST-UM Dynamic Viscosity | 1.84 | 96.0 | 6.88 | 90 | Gaussian | (22, 1)
NIST-UM Thermal Expansion Coefficient | 1.30 | 98.3 | 25.24 | 84 | Student-T | (23, 1)
Medical Covid-19 R0 | 1.09 | 82.5 | 5.40 | 143 | Mixture | (24)
Geometric Brownian Motion | 1.72 | 69.3 | 2.35 | 102 | Gaussian | (25)
Black Scholes Monte Carlo Pricing | 1.93 | 71.9 | 2.57 | 98 | Gaussian | (26)

##  8 Related Research

###  8.1 Programmable Random Variate Accelerators

Table 2 shows a summary of state-of-the-art programmable random variate
accelerators. As far as we are aware this article presents the fastest and
most efficient electronic noise programmable random variate accelerator that
can generate samples from any univariate non-uniform probability distribution.
Three approaches from Table 2 record a lower power consumption than our
approach but are inferior in other aspects. The power measurement for the
memristor-based approach (27) does not include the power consumption of any of
the circuitry required to sample the device or bias it to the correct voltage.
The power quoted for the resonance energy transfer approach (28) is a back-of-
the-envelope estimate and not experimentally measured. The implementation we
present in this paper is approximately $35,652\times$ and $72\times$ faster
than programmable random variate accelerators we presented in previous
publications (29, 30). As the sampling speed is mainly limited by the analog-
to-digital converter sampling rate, using LiteX to deploy the design on FPGAs
with a higher analog-to-digital converter sampling rate will lead to further
speed increases.

Table 2: Comparison of state-of-the-art programmable random variate accelerator (PRVA) methods (29). Source | Speed | Efficiency | Power | Distribution(s) | Programmable | Publication
---|---|---|---|---|---|---
Central Processing Unit | 890 Mb/s | 3.17 Mb/J | 281 W | Gaussian | Yes |  (31), 2009
Graphics Processing Unit | 12.9 Gb/s | 108 Mb/J | 119 W | Gaussian | Yes |  (31), 2009
Massively Parallel Processor Array | 860 Mb/s | 403 Mb/J | 2.13 W | Gaussian | Yes |  (31), 2009
Field Programmable Gate Array | 12.1 Gb/s | 645 Mb/J | 18.8 W | Gaussian | Yes |  (31), 2009
Memristor | 6000 b/s | 120 Gb/J | 50.0 nW | Unnamed | No |  (27), 2017
Photo Detector | 1.77 Gb/s | - | - | Gaussian | No |  (32), 2017
Resonance Energy Transfer | 2.89 Gb/s | 578 Gb/J | 5.00 mW | Exponential | Yes |  (28), 2018
Photo Diode | 17.4 Gb/s | - | - | Husumi | No |  (33), 2018
Photo Diode | 66.0 Mb/s | - | - | Programmable | Yes |  (34), 2018
Photo Diode | 320 Mb/s | - | - | Exponential | No |  (35), 2018
Field Programmable Gate Array | 6.40 Gb/s | - | - | Gaussian | Yes |  (36), 2019
Photo Diode | 8.25 Gb/s | - | - | Gaussian | No |  (37), 2019
Electronic Noise | 13.8 kb/s | 209 kb/J | 66.0 mW | Gaussian | Yes |  (29), 2020
Pseudorandom | - | - | 78.9 mW | Programmable | Yes |  (38), 2021
Electronic Noise | 6.82 Mb/s | 13.4 Mb/J | 484 mW | Programmable | Yes |  (30), 2022
Electronic Noise | 492 Mb/s | 248 Mb/J | 1.98 W | Programmable | Yes | This work

###  8.2 Thermodynamic Computing

Thermodynamic computing (39, 40) uses hardware capable of sampling from an
arbitrary two-dimensional Gaussian for solving a linear system of equations,
estimating the inverse of a matrix, solving the Lyapunov equation, and
estimating the determinant of a matrix (41, 42, 43, 44). A blog post
describing thermodynamic computing hardware for Gaussian sampling reports a
speedup of approximately $13\times$ and an energy saving of approximately
$25\times$. Detailed systems evaluations explaining their hardware
architecture and how it achieves this are not available (45).

###  8.3 Tuned Stochastic Probability Trees

Prior work to design and build stochastic magnetic tunnel junction devices to
implement a computing device that can perform single random bit sampling with
a programmable bias exists (46, 47, 48, 49, 50, 51, 52, 53, 54, 55). This
approach is very different from our approach as it builds up probability
distributions using many single programmable random bits.

## Conclusion

This article presented an electron tunneling noise programmable random variate
accelerator for accelerating the sampling stage of Monte Carlo simulations. We
used the LiteX framework to generate a Petitbateau FemtoRV RISC-V instruction
set soft processor and deploy it on a Digilent Arty-100T FPGA development
board. The RISC-V soft processor augmented with our programmable random
variate accelerator achieves an average speedup of $8.70\times$ and a median
speedup of $8.69\times$ for a suite of twelve different benchmark applications
when compared to GNU Scientific Library software random number generation.
These speedups are achievable because the benchmarks spend an average of 90.0
% of their execution time generating random samples. The results of the Monte
Carlo benchmark programs run over the programmable random variate accelerator
have an average Wasserstein distance of $1.48\times$ and a median Wasserstein
distance of $1.41\times$ that of the results produced by the GNU Scientific
Library random number generators. The soft processor samples the electron
tunneling noise source using the hardened XADC block in the FPGA. The
flexibility of the LiteX framework allows for the deployment of any LiteX-
supported soft processor with an electron tunneling noise programmable random
variate accelerator on any LiteX-supported development board that contains an
FPGA with an XADC.

We thank Florent Kermarrec and all the contributors to LiteX for creating the
open-source tool we leveraged to create a portable implementation of our
architecture (56). We thank Bruno Levy for creating LiteOS and for extensive
help getting LiteOS working to load elf program files into the LiteX-generated
soft processor on an FPGA (15). In addition, we thank Andrew "Bunnie" Huang
for extensive help and advice in getting the XADC working with the LiteX
framework.

## References

## References

  * (1) Tsoutsouras V, et al. (2021) The laplace microarchitecture for tracking data uncertainty and its implementation in a risc-v processor in MICRO-54: 54th Annual IEEE/ACM International Symposium on Microarchitecture, MICRO ’21.  (Association for Computing Machinery, New York, NY, USA), p. 1254–1269.
  * (2) Tsoutsouras V, et al. (2022) The laplace microarchitecture for tracking data uncertainty.  IEEE Micro 42(4):78–86.
  * (3) Choi J, Chun D, Kim H, Lee HJ (2019) Gaussian yolov3: An accurate and fast object detector using localization uncertainty for autonomous driving in Proceedings of the IEEE/CVF International conference on computer vision.  pp. 502–511.
  * (4) Tye NJ, Hofmann S, Stanley-Marbell P (2023) Materials and devices as solutions to computational problems in machine learning.  Nature Electronics 6(7):479–490.
  * (5) Dally WJ, Turakhia Y, Han S (2020) Domain-specific hardware accelerators.  Commun. ACM 63(7):48–57.
  * (6) Hennessy JL, Patterson DA (2019) A new golden age for computer architecture.  Communications of the ACM 62(2):48–60.
  * (7) Devroye L (1986) Non-Uniform Random Variate Generation.  (Springer-Verlag), p. 42.  ISBN: 1461386454.
  * (8) Wand MP, Jones MC (1994) Kernel smoothing.  (Crc Press).
  * (9) Silverman BW (1986) Density estimation for statistics and data analysis.  (CRC press) Vol. 26.
  * (10) Heidenreich NB, Schindler A, Sperlich S (2013) Bandwidth selection for kernel density estimation: a review of fully automatic selectors.  AStA Advances in Statistical Analysis 97:403–433.
  * (11) Chiu ST (1996) A comparative review of bandwidth selection for kernel density estimation.  Statistica Sinica pp. 129–145.
  * (12) Sheather SJ, Jones MC (1991) A reliable data-based bandwidth selection method for kernel density estimation.  Journal of the Royal Statistical Society: Series B (Methodological) 53(3):683–690.
  * (13) Leemis LM, McQueston JT (2008) Univariate distribution relationships.  The American Statistician 62(1):45–53.
  * (14) Andrew "bunnie" Huang (2024) Avalanche noise source design.  [online] https://betrusted.io/avalanche-noise.
  * (15) Bruno Levy (2023) Liteos.  [online] https://github.com/BrunoLevy/learn-fpga/tree/master/LiteX/software/LiteOS.
  * (16) O’Neill ME (2014) Pcg: A family of simple fast space-efficient statistically good algorithms for random number generation, (Harvey Mudd College, Claremont, CA), Technical Report HMC-CS-2014-0905.
  * (17) Meech JT, Kaparounakis O (2022) Micro benchmark: double-add.  [online] https://github.com/signaloid/Signaloid-Demo-Basic-Addition.
  * (18) James Timothy Meech PSM, Kaparounakis O (2022) Micro benchmark: double-divide.  [online] https://github.com/signaloid/Signaloid-Demo-Basic-Division.
  * (19) Meech JT, Stanley-Marbell P (2022) Micro benchmark: double-multiply.  [online] https://github.com/signaloid/Signaloid-Demo-Basic-Multiplication.
  * (20) Meech JT, Kaparounakis O (2022) Micro benchmark: double-subtract.  [online] https://github.com/signaloid/Signaloid-Demo-Basic-Subtraction.
  * (21) James Timothy Meech, Vasileios Tsoutsouras PSM, Kaparounakis O (2022) Micro benchmark: schlieren.  [online] https://github.com/signaloid/Signaloid-Demo-Basic-Schlieren.
  * (22) Kaparounakis O (2022) Micro benchmark: Dynamic viscosity.  [online] https://github.com/signaloid/Signaloid-Demo-Engineering-NISTUMDynamicViscosity.
  * (23) Kaparounakis O (2022) Micro benchmark: Thermal expansion coefficient.  [online] https://github.com/signaloid/Signaloid-Demo-Basic-NISTUMThermalExpansionCoefficient.
  * (24) Plevris A (2024) Calculating r0 for covid-19.  [online] https://github.com/signaloid/Signaloid-Demo-Medical-CovidR0.
  * (25) Oosterlee CW, Grzelak LA (2019) Mathematical modeling and computation in finance: with exercises and Python and MATLAB computer codes.  (World Scientific).
  * (26) Armstrong J (2017) C++ for financial mathematics.  (Chapman and Hall/CRC).
  * (27) Jiang H, , et al. (2017) A novel true random number generator based on a stochastic diffusive memristor.  Nat. Commun. 8(1):1–9.
  * (28) Zhang X, , et al. (2018) Architecting a stochastic computing unit with molecular optical devices XXmissing booktitle & seriesXXISCA’18.  (ACM/IEEE), pp. 301–314.
  * (29) Meech JT, Stanley-Marbell P (2021) Efficient programmable random variate generation accelerator from sensor noise.  IEEE Embedded Systems Letters 13(3):73–76.
  * (30) Meech JT, Stanley-Marbell P (GB Patent GB2620734, Filed July 2022) A physical random variate generator.
  * (31) Thomas DB, Howes L, Luk W (2009) A comparison of cpus, gpus, fpgas, and massively parallel processor arrays for random number generation XXmissing booktitle & seriesXXFPGA’09.  (ACM), pp. 63–72.
  * (32) Marangon DG, Vallone G, Villoresi P (2017) Source-device-independent ultrafast quantum random number generation.  Phys. Rev. Lett. 118(6):060503–1–060503–5.
  * (33) Avesani M, , et al. (2018) Source-device-independent heterodyne-based quantum random number generator at 17 gbps.  Nat. Commun. 9(1):1–7.
  * (34) Nguyen L, , et al. (2018) Programmable quantum random number generator without postprocessing.  Opt. Lett. 43(4):631–634.
  * (35) Tomasi A, , et al. (2018) Model, validation, and characterization of a robust quantum random number generator based on photon arrival time comparison.  JLT 36(18):3843–3854.
  * (36) Hu Y, , et al. (2019) Gaussian random number generator: Implemented in fpga for quantum key distribution.  Int. J. Numer. Model. El. 32(3):2554.
  * (37) Guo X, , et al. (2019) Parallel real-time quantum random number generator.  Opt. Lett. 44(22):5566–5569.
  * (38) Bashizade R, Zhang X, Mukherjee S, Lebeck AR (2021) Accelerating markov random field inference with uncertainty quantification.  arXiv preprint arXiv:2108.00570.
  * (39) Conte T, et al. (2019) Thermodynamic computing.
  * (40) Hylton T, Conte TM, Hill MD (2021) A vision to compute like nature: thermodynamically.  Commun. ACM 64(6):35–38.
  * (41) Coles PJ, et al. (2023) Thermodynamic ai and the fluctuation frontier.
  * (42) Aifer M, et al. (2023) Thermodynamic linear algebra.
  * (43) Duffield S, Aifer M, Crooks G, Ahle T, Coles PJ (2023) Thermodynamic matrix exponentials and thermodynamic parallelism.
  * (44) Aifer M, et al. (2024) Error mitigation for thermodynamic computing.
  * (45) Gordon MH, et al. (2023) Exploring thermodynamic ai.  [online] https://normalcomputing.substack.com/p/exploring-thermodynamic-ai.
  * (46) Cardwell SG, et al. (2022) Probabilistic neural circuits leveraging ai-enhanced codesign for random number generation.
  * (47) Liu S, et al. (2022) Random bitstream generation using voltage-controlled magnetic anisotropy and spin orbit torque magnetic tunnel junctions.  IEEE Journal on Exploratory Solid-State Computational Devices and Circuits 8(2):194–202.
  * (48) Misra S, et al. (2023) Probabilistic neural computing with stochastic devices.  Advanced Materials 35(37):2204569.
  * (49) Theilman BH, et al. (2022) Stochastic neuromorphic circuits for solving maxcut.
  * (50) Rehm L, et al. (2023) Stochastic magnetic actuated random transducer devices based on perpendicular magnetic tunnel junctions.  Phys. Rev. Appl. 19(2):024035.
  * (51) Aimone JB, Misra S (2023) Will stochastic devices play nice with others in neuromorphic hardware?: There’s more to a probabilistic system than noisy devices.  IEEE Electron Devices Magazine 1(2):50–56.
  * (52) Rehm L, et al. (2023) Temperature-resilient true random number generation with stochastic actuated magnetic tunnel junction devices.
  * (53) Aimone JB, Severa W, Smith JD (2023) Synaptic sampling of neural networks.
  * (54) Wolpert D, et al. (2023) Is stochastic thermodynamics the key to understanding the energy costs of computation?
  * (55) Maicke A, et al. (2023) Magnetic tunnel junction random number generators applied to dynamically tuned probability trees driven by spin orbit torque.
  * (56) Kermarrec F, Bourdeauducq S, Lann JCL, Badier H (2020) Litex: an open-source soc builder and library based on migen python dsl.  arXiv preprint arXiv:2005.02506.