A confidential AI accelerator architecture in a standard DDR5 DIMM. Encrypted models and private data compute inside trusted silicon and never exist in plaintext on the host.
This is a logical architecture diagram, not decorative PCB artwork. Select a die to inspect its role. Protected inter-die traffic, final packaging and DDR5 interoperability remain product targets.
Load a workload to reconfigure the instrument. The participating dies, evidence maturity, buyer and hard boundary change with each program.
Regulated-data inference, model-IP protection on untrusted infrastructure and multi-tenant serving with tenant-bound keys. The encrypted datapath and secure loader run on physical FPGA hardware.
Boundary: final inter-die protection, capacity, energy and performance await product silicon.
Sentence embeddings and indexed retrieval run beside resident models and sealed corpora. This is the high-volume entry workload: retrieval at memory bandwidth without repeatedly moving the model.
Boundary: indexed-token capacity, throughput and module energy are first-order product estimates.
LoRA, forward-only MeZO, distilled small-model training and continued pretraining are runnable in the pre-silicon stack and sealed to the tenant key.
Boundary: implemented in RTL/software experiments; not measured on a product module.
Sealed rollout, teacher and synthetic-data fleets, RETRO-style retrieval appliances and sparse memory layers. dm3m supplies resident memory work around frontier training. It is not the dense training engine.
Boundary: token rate, H100 comparisons and multi-stick scale are modeled and need a published methodology.
Non-volatile banks double as storage-class memory over the product DDR5 surface, preserving sealed master state, models, adapters and private corpora through power cycles.
Boundary: persistence semantics, endurance, power-fail behavior and host interoperability are product targets.
The architecture climbs from adapter tuning to continued pretraining, then stops explicitly before frontier pretraining. All stages below are pre-silicon implementations, not product-module measurements.
Few-step tenant-specific adapter adaptation.
Forward passes only, zero backward graph, inference-level memory.
Private embedders and classifiers through distillation.
Domain adaptation on a sealed private corpus with replay against forgetting.
Filter the ledger by maturity. FPGA hardware, RTL/software implementation, SPICE verification, first-order modeling and product targets never share the same label.
| Addr | Artifact | Result | Environment / boundary | Maturity |
|---|---|---|---|---|
| 40.01 | Transformer encoder | Attention + FFN + norms + softmax + residual; zero mismatches. | ZCU106 over JTAG | FPGA hardware |
| 40.02 | Confidential layer | AES-encrypted weights opened only inside the implemented device path. | ZCU106 secure loader | FPGA hardware |
| 40.03 | SDK parity | 0 of 256 outputs differ from silicon. | Python / PyTorch golden model | FPGA hardware |
| 40.04 | Live transport | Model streamed into a running device without rebuilding; zero mismatches. | JTAG-AXI transport | FPGA hardware |
| 40.05 | RTL regression | 51 / 51 self-checking tests; timing closed at 150 MHz. | ZCU106 implementation flow | RTL verified |
| 40.06 | Analog CIM MAC | Exact in the current circuit experiment. | SPICE only; array silicon absent | SPICE |
| 40.07 | Retriever | Embedding / retrieval datapath proven. | Current hardware test path | Proven path |
| 40.08 | Security primitives | AES-128 + XTS against FIPS test vectors; SP 800-108 key vault; open RTL. | Not a FIPS 140 certification claim | Verified RTL |
| 40.09 | Software front end | PyTorch nn.Module; ONNX / HF → per-channel quantize + SmoothQuant → encrypt → load. | Pre-silicon software stack | Implemented |
| 40.0A | Memory layer | Bit-identical twin; local sparse zero-transpose gradients. | Device-honest INT8 experiments | Implemented |
| 40.0B | Tiled matmul | Integer tiling path for models larger than one local array. | Pre-silicon compute stack | Implemented |
| 40.0C | Precision + generation | INT4 / INT8 / INT16 bit-serial precision per layer; decoder and KV-cache path. | Product architecture | Target |
| 40.0D | Module envelope | ~12–15 W active; ~0.3 W idle for non-volatile master state. | First-order thermal / power model | Modeled |
| 40.0E | Product module | eMRAM/RRAM dies, silicon-photonic links and DDR5 interoperability. | Next milestone: process test chip | In development |
Move the control to explore a linear first-order scaling model. These are architecture estimates, not measured DIMM or server results.
Every illuminated register is one modeled dm3m DIMM. The product target uses standard DDR5 slots; no CXL or add-in-card variant.
Resident-weight private inference, retrieval, adaptation and persistent memory. Local analog-array efficiency target: 40–80 TOPS/W; the 700-TOPS / 208-W server model is ~3.4 delivered TOPS/W after system scope. Procurement thesis: reduce dependence on HBM and advanced GPU packaging by moving weights into a standard-slot memory architecture; availability remains time-sensitive and modeled.
H100 supports confidential computing. dm3m instead targets plaintext confined to trusted die domains and resident weights in memory slots. A 16-DIMM configuration is compared with a one-H100 deployment assumption; energy, token rate and availability remain modeled. NVIDIA H100 reference.
The cells show direct product fit. “Role” means a pipeline component, not the primary compute engine.
The current proof reduces digital architecture risk. It does not remove foundry, device, package, optical, DDR5 compliance or product-security work. Specific foundry, process and program economics are shared only during qualified diligence.
Confidential encoder, secure loader, live transport, bit-exact SDK, tests and timing closure.
Map the digital path; characterize eMRAM, RRAM, PPA and mixed-signal behavior.
Packaging, photonic fabric, protected links, DDR5 interoperability, reliability and compliance.
Finished modules or licensed silicon/system IP.
Provable private inference in the servers you already own, at the energy cost of memory instead of moving the model through a separate accelerator hierarchy.