RESQ: A Unified Framework for REliability- and Security Enhancement of Quantized Deep Neural Networks

Ali Soltan Mohammadi; Samira Nazari; Ali Azarpeyvand; Mahdi Taheri; Milos Krstic; Michael Huebner; Christian Herglotz; Tara Ghasempouri

cs.LGMar 16, 2026

RESQ: A Unified Framework for REliability- and Security Enhancement of Quantized Deep Neural Networks

Authors: Ali Soltan Mohammadi, Samira Nazari, Ali Azarpeyvand, Mahdi Taheri, Milos Krstic, Michael Huebner, Christian Herglotz, Tara Ghasempouri

Organizations: University of Zanjan, Zanjan, Iran · Brandenburg Technical University, Cottbus, Germany · Tallinn University of Technology, Tallinn, Estonia · Leibniz Institute for High Performance Microelectronics, Frankfurt Oder, Germany

Abstract

This work proposes a unified three-stage framework that produces a quantized DNN with balanced fault and attack robustness. The first stage improves attack resilience via fine-tuning that desensitizes feature representations to small input perturbations. The second stage reinforces fault resilience through fault-aware fine-tuning under simulated bit-flip faults. Finally, a lightweight post-training adjustment integrates quantization to enhance efficiency and further mitigate fault sensitivity without degrading attack resilience. Experiments on ResNet18, VGG16, EfficientNet, and Swin-Tiny in CIFAR-10, CIFAR-100, and GTSRB show consistent gains of up to 10.35% in attack resilience and 12.47% in fault resilience, while maintaining competitive accuracy in quantized networks. The results also highlight an asymmetric interaction in which improvements in fault resilience generally increase resilience to adversarial attacks, whereas enhanced adversarial resilience does not necessarily lead to higher fault resilience.

Figures & tables

Fig. 1 : Overview of the RESQ framework. The pipeline sequentially enhances DNN resilience and produces a final model robust to both input perturbations and hardware faults.

Model	Dataset	Baseline	BPFC Stage	FA Stage	Q-FA Stage
ResNet-18	CIFAR-10	92.82	92.13	91.34	91.69
VGG-11	CIFAR-10	90.44	90.05	89.26	89.83
EfficientNet-B0	GTSRB	99.89	99.73	99.05	96.40
Swin-Tiny	CIFAR-100	85.30	81.39	78.20	73.12

TABLE I : Baseline and Stage-Wise Accuracy (%) of RESQ across Architectures and Datasets

Fig. 2 : Top ten critical layers for ResNet-18 via EMA-based gradient norms.

Panel of Figure 4 — Fig. 3 : Impact of training stages on resilience of ResNet-18

Model	Clean	FGSM	IFGSM	PGD	BIM	MIM	$\epsilon$
VGG11	89.83	36.92	10.22	12.28	10.90	16.33	0.1
Q-FA-VGG11	90.02	50.94	24.52	27.57	25.57	30.77	0.1
ResNet18	91.69	41.95	10.52	12.68	11.06	17.43	0.1
Q-FA-ResNet18	92.82	52.30	30.45	31.01	30.86	34.80	0.1
EfficientNet	96.40	58.39	51.47	46.57	51.65	54.44	0.001
Q-FA-EfficientNet	97.80	86.35	84.97	83.55	85.01	85.57	0.001

TABLE II : Adversarial Resilience of Models with Different Perturbation Magnitudes

Model	BER 1	BER 2	BER 3
Q-FA-VGG11	91.21	49.97	13.95
VGG11	89.83	49.22	10.01
Q-FA-ResNet18	91.52	90.58	74.71
ResNet18	79.05	18.92	9.99
Q-FA-EfficientNet	96.15	95.57	93.68
EfficientNet	89.14	87.31	86.17

TABLE III : Fault Resilience of Models under Varying BERs

Adversarial Robustness

Adversarial robustness studies how well AI systems withstand deliberately crafted inputs, training-data corruption, and other attacks.

See all 463 papers

Understanding Fault Tolerance of Adversarially Robust Pruned Models
Aug 4, 2026Manali Dangarikar, Cory MerkelAdversarial Training Neural Network Robustness
Brain Lab Rochester Institute of Technology Rochester, NY, USA
Activation Denoising: A Robustness View on Parallel vs Sequential LLM Quantization
Oct 5, 2026Yan Scholten, Rachel Lawrence, James Hensman +3LLM Quantization Quantization Robustness
Dept. of Computer Science & Munich Data Science Institute, Technical University of Munich · Microsoft Research Cambridge, UK
On the Relationship between Model Quantization and Model Inversion Attacks
Sep 30, 2026Rongke Liu, Youwen ZhuModel Inversion Attacks Privacy-Preserving ML
School of Computer Science and Technology, Nanjing University of Aeronautics and Astronautics, Nanjing 211106, China

Aug 4, 2026J/K move · Enter open · S save

Understanding Fault Tolerance of Adversarially Robust Pruned Models

Manali Dangarikar, Cory Merkel

Brain Lab Rochester Institute of Technology Rochester, NY, USA

Adversarial Training Neural Network Robustness Adversarial Robustness Neural Network Pruning

Open paper AskPDF arXiv

Deep neural networks (DNNs) deployed on resource-constrained neuromorphic hardware face three concurrent challenges: the need for model compression through pruning, vulnerability to adversarial input perturbations, and susceptibility to hardware-induced weight faults such as stuck-at-zero errors. While each of these factors has been studied in isolation, their combined effects on model reliability have received little attention. This paper presents an empirical investigation of how pruning, adversarial training, and hardware fault injection interact to affect the robustness of convolutional neural networks. Using a compact three-layer CNN trained on MNIST, we conduct three experiments: (1) comparing the fault tolerance of naturally and adversarially trained models under simultaneous hardware faults and adversarial attacks, (2) evaluating how pruning affects adversarial robustness, and (3) characterizing the joint accuracy surface across fault rates, adversarial perturbation magnitudes, and pruning levels. Our results show that adversarial training improves robustness against input perturbations but increases sensitivity to stuck-at-zero weight faults. Contrary to intuition, pruning did not significantly increase fault sensitivity, and varying the pruning level had little effect across fault rates and attack strengths. These results highlight the need to jointly consider adversarial robustness and hardware reliability.

Abstract

Adversarial Robustness

Explore similar work

Understanding Fault Tolerance of Adversarially Robust Pruned Models

Activation Denoising: A Robustness View on Parallel vs Sequential LLM Quantization

On the Relationship between Model Quantization and Model Inversion Attacks