The Weight of a Bit: EMFI Sensitivity Analysis of Embedded Deep Learning Models

Jakub Breier; Štefan Kučerák; Xiaolu Hou

cs.CRFeb 18, 2026

The Weight of a Bit: EMFI Sensitivity Analysis of Embedded Deep Learning Models

Authors: Jakub Breier, Štefan Kučerák, Xiaolu Hou

Organizations: TTControl GmbH, Vienna, Austria. · the Faculty of Informatics and Information Technologies, Slovak University of Technology, Slovakia. · the State Key Laboratory of Blockchain and Data Security , Zhejiang University.

Abstract

Fault injection attacks on embedded neural network models have been shown as a potent threat. Numerous works studied resilience of models from various points of view. As of now, there is no comprehensive study that would evaluate the influence of number representations used for model parameters against electromagnetic fault injection (EMFI) attacks. In this paper, we investigate how four different number representations influence the success of an EMFI attack on embedded neural network models. We chose two common floating-point representations (32-bit, and 16-bit), and two integer representations (8-bit, and 4-bit). We deployed four common image classifiers, ResNet-18, ResNet-34, ResNet-50, and VGG-11, on an embedded memory chip, and utilized a low-cost EMFI platform to trigger faults. Beyond accuracy evaluation, we characterize the injected fault pattern by analyzing the bit error rate, the spatial distribution of corrupted bytes, and the prevalence of 0xFE/0xFF byte values across formats, identifying the mechanisms responsible for the observed differences in resilience. Our results show that while floating-point representations exhibit almost a complete degradation in accuracy (Top-1 and Top-5) after a single fault injection, integer representations offer better resistance overall. In particular, the 8-bit representation on a relatively large network (VGG-11) retains Top-1 accuracy of around 70% and Top-5 at around 90%.

Figures & tables

Fig. 1: Overview of the EMFI analysis done in this paper.

Prior work	Attack type	Target model & platform	Weight format	Main findings
Hong et al. [ 9 ]	Bit-flip attack (memory fault via Rowhammer)	19 Deep CNN classifiers; simulated attack	32-bit floating point	Flipping a specific single bit can cause an accuracy loss of over 90%.
Rakin et al. [ 13 ]	Bit-flip attack (memory fault via Rowhammer)	Deep CNN classifiers; simulated attack	8/6/4-bit integer	Flipping $\sim$ 13 weight bits can degrade a network’s accuracy to $\sim$ 0% (misclassification of virtually all inputs).
Breier et al. [ 14 ]	Fault injection for model extraction (sign-bit flips)	Deep feature-extractor network; simulated attack	32/64-bit floating point	By flipping sign bits of activations, achieved $<10^{-13}$ error in recovered weights, effectively stealing the DNN model.
Libano et al. [ 15 ]	Radiation-induced soft errors (fault injection & accelerated radiation tests)	Small CNN on FPGA (MNIST digit recognition)	1-bit binary vs. 32-bit float	Binary-weight network showed 39% fewer erroneous outputs under faults, but 12% more of its errors were catastrophic (misclassifications) compared to full-precision.
Guillemé et al. [ 8 ]	Statistical fault injection (simulated bit flips)	AlexNet-like CNN, software simulation; evaluated pruning and quantisation	8-bit integer (with varying pruning levels)	Pruning increases fault sensitivity (less redundancy). Proposed selective redundancy (hardware voting) improved fault tolerance by $\sim$ 96% vs. no protection.
Gaine et al. [ 16 ]	Electromagnetic & laser fault injection (instruction skip)	CNN (2-layer ConvNet) on ARM Cortex-M4 microcontroller (embedded device)	8-bit integer (CMSIS-NN quantized)	First demonstrated EMFI/LFI on a real CNN inference: single-glitch instruction skips in convolution or activation routines caused targeted mispredictions and persistent erroneous states.

TABLE I: Summary of related work on fault injection on neural network representations.

Fig. 2: Experimental electromagnetic fault injection setup overview.

Format	Total bits	Range	Decimal digits
FP32	32	$\pm 3.4\times 10^{38}$	$\sim$ 7
FP16	16	$\pm 6.55\times 10^{4}$	$\sim$ 3–4
INT8	8	$[-128,127]$	Exact
INT4	4	$[-8,7]$	Exact

TABLE II: Summary of the numerical representations considered in this work.

Fig. 3: NewAE ChipSHOUTER EMFI device mounted on the Ender-3 3D printer used as a positioning device. The Ballistic Gel board with the 4MB SRAM chip used as the DUT is positioned below the ChipSHOUTER.

Fig. 4: Detail of the EM probe above the SRAM chip.

Fig. 5: Surface scan showing the success rate at each point, expressed as the proportion of corrupted bytes in the SRAM.

Model	Type	Top-1 (%)	Top-5 (%)
ResNet18	FP32	68.750	88.379
	FP16	68.774	88.379
	INT8	68.774	88.452
	INT4	67.236	87.549
ResNet34	FP32	72.778	90.991
	FP16	72.803	90.967

TABLE III: Vanilla Top-1 and Top-5 accuracy (%) of the evaluated architectures across four weight representations.

Fig. 6: Logical memory map of EMFI effects on a $4$ MB weight buffer. Red indicates corrupted memory locations. A significant decrease in fault density is observed after the $2$ MB offset, suggesting either a boundary transition in the memory controller’s handling of burst data or a physical proximity limit of the EM probe.

Format	Mean BER (%)	Std BER (%)
FP32	5.97	0.36
FP16	6.07	0.72
INT8	7.51	0.51
INT4	6.15	1.30

TABLE IV: Bit error rate per weight format (mean

\pm

std across all fault-injected chunks and architectures).

Fig. 7: Bit error rate (BER) per architecture and weight representation. Error bars indicate

\pm 1

standard deviation across all fault-injected chunks. BER is largely format-independent (

{\approx}6\text{--}8\%

across all configurations), confirming that the observed accuracy differences stem from the representation’s response to faults rather than from differences in injected fault density.

Fig. 8: Proportion of bytes taking the value 0xFE or 0xFF per injected chunk. Although integer formats receive a higher fraction of 0xFE / 0xFF bytes than floating-point formats, they exhibit far lower accuracy degradation.

Fig. 9: Binary comparison of a weight chunk before (left) and after (right) a single EMFI pulse. Entire rows are overwritten with 0xFE , and alternating rows take the value 0x00 3C , consistent with the periodic fault pattern observed in Fig. 6 . In FP32, a byte of 0xFF or 0xFE in the biased exponent field drives the weight to NaN or an extremal value regardless of the mantissa.

Panel of Figure 14 — Fig. 10: Floating-point weight corruption statistics per chunk. (a) In FP32, approximately $1.3\%$ of weights per chunk become NaN, whereas in FP16 the corresponding fraction is approximately $0.1\%$ . (b) The post-attack weight range expands by a factor of ${\sim}10^{39}$ for FP32 and ${\sim}10^{6}$ for FP16, causing catastrophic activation saturation. No $\pm\infty$ values were observed in either format.

Fig. 11: Weight distribution analysis. The FP32 post-attack histogram is shown on a logarithmic

x

-axis,

\log_{10}(|\mathrm{Value}|)

, to visualize the “range explosion” to

\pm 10^{38}

caused by EMFI. In contrast, the INT8 pre-attack and post-attack distributions remain within the representable range

[-128,127]

Format	NaN (%)	Inf (%)	Range expansion
FP32	$1.27\pm 0.32$	$0$	$\sim\!10^{39}$
FP16	$0.10\pm 0.01$	$0$	$\sim\!10^{6}$

TABLE V: Floating-point weight corruption statistics (mean

\pm

std across all FP chunks). No Inf values were observed. Range expansion = post-attack range / pre-attack range.

Fig. 12: Classification accuracy under fault injection for ResNet-18, ResNet-34, ResNet-50, and VGG-11. Each marker corresponds to the Top-1 (blue) or Top-5 (red) accuracy obtained after injecting faults into a specific chunk of the model’s weight parameters. Results are reported for four weight representations: (a) FP32, (b) FP16, (c) INT8, and (d) INT4.

Model	Type	# Chunks	Front	Middle	Back
ResNet18	INT8	3	0.07%	0.68%	6.37%
ResNet34	INT8	6	0.10%	0.12%	53.05%
ResNet50	INT8	7	0.15%	5.20%	49.10%
ResNet50	INT4	4	0.12%	0.17%	22.19%
VGG11	FP32	127	0.05%	0.05%	0.12%
VGG11	FP16	64	0.05%	0.05%	62.84%

TABLE VI: Consolidated spatial sensitivity: targeted chunk accuracy (Top-1 %). Front/Middle/Back denote the part of the network in which the attack occurred. Targeting chunks at the beginning of the network (Front) consistently leads to complete accuracy degradation.

Fig. 13: VGG-11 architecture, illustrating the contrast between the shapes of the convolutional and fully connected layers.

Neural Network Robustness

Neural network robustness studies how models withstand adversarial inputs, data shifts, noise, and hardware faults while maintaining reliable predictions.

See all 237 papers

Characterizing the Fault Response of the Intel Neural Compute Stick 2 Under Single-Pulse Electromagnetic Fault Injection
May 21, 2026Štefan Kučerák, Jakub Breier, Xiaolu HouEdge Inference
Faculty of Informatics and Information Technologies, Slovak University of Technology, Slovakia · TTControl GmbH, Vienna, Austria · State Key Laboratory of Blockchain and Data Security, Zhejiang University
TreeFI: Value-Aware Statistical Fault Injection for Deep Neural Networks
Sep 4, 2026Noam Bires, Marcello Traiola, Angeliki Kritikakou +1
Univ Rennes, Inria, IRISA, CNRS, Rennes, France
From Arithmetic to Logic: The Resilience of Logic and Lookup-Based Neural Networks Under Parameter Bit-Flips
Mar 24, 2026Alan T. L. Bacellar, Sathvik Chemudupati, Shashank Nag +4Neural Network Robustness Neural Network Quantization
The University of Texas at Austin · Federal University of Rio de Janeiro · Instituto de Telecomunicações, Porto, Portugal

May 21, 2026J/K move · Enter open · S save

Characterizing the Fault Response of the Intel Neural Compute Stick 2 Under Single-Pulse Electromagnetic Fault Injection

Štefan Kučerák, Jakub Breier, Xiaolu Hou

Faculty of Informatics and Information Technologies, Slovak University of Technology, Slovakia · TTControl GmbH, Vienna, Austria · State Key Laboratory of Blockchain and Data Security, Zhejiang University

Edge Inference

Open paper AskPDF arXiv

Vision processing units and other commercial neural-network inference accelerators are increasingly deployed in safety-relevant edge applications, but their fault response under transient hardware disturbances remains poorly characterized in the open literature. For the Intel Movidius Myriad X, packaged as the Intel Neural Compute Stick 2 (NCS2), only a single feasibility study has been published. We report a systematic single-pulse electromagnetic fault injection (EMFI) campaign on the NCS2 running three ImageNet-trained convolutional neural networks (ResNet-18, ResNet-50, VGG-11) on the OpenVINO runtime. Across 1,536 spot-test trials at characterized hotspots and approximately 16,000 parameter-search trials, single pulses produce four reproducible outcome classes: no measured accuracy change, minor silent data corruption, major persistent degradation that survives across subsequent inferences until model reload, and device hangs requiring USB power-cycling; these outcomes are respectively interpreted as no-effect, SDC with possible SET-like or small persistent-state mechanisms, SEU-like persistent corruption, and SEFI-like loss of functionality. Two findings are central. First, the major-degradation class can be induced at 18-31% of trials at characterized hotspots, with post-collapse top-1 accuracy below five percent and persistence across all subsequent inferences until explicit model reload - a regime that no inference-API-level mechanism detects. Second, this regime is also inducible by pulses delivered to an idle device with the model already loaded, demonstrating that load-time integrity checks alone are insufficient. We discuss mitigation strategies graded by class, focusing on mechanisms implementable at the application level without modification to the device firmware or the OpenVINO runtime.

Abstract

Neural Network Robustness

Explore similar work

Characterizing the Fault Response of the Intel Neural Compute Stick 2 Under Single-Pulse Electromagnetic Fault Injection

TreeFI: Value-Aware Statistical Fault Injection for Deep Neural Networks

From Arithmetic to Logic: The Resilience of Logic and Lookup-Based Neural Networks Under Parameter Bit-Flips