Organizations: Department of Computer Science and Engineering, University of South Florida, Tampa, FL 33620, USA. · Department of Computer and Electrical Engineering and Computer Science, Florida Atlantic University, Boca Raton, FL 33431, USA.
The inference phase of deep neural networks (DNNs) in embedded systems is increasingly vulnerable to fault attacks and failures, which can result in incorrect predictions. These vulnerabilities can potentially lead to catastrophic consequences, making the development of effective mitigation techniques essential. In this paper, we introduce MAED (Mathematical Activation Error Detection), an algorithm-level error detection framework that exploits mathematical identities to continuously validate the correctness of non-linear activation function computations at runtime. To the best of our knowledge, this work is the first to integrate algorithm-level error detection techniques to defend against both malicious fault injection attacks and naturally occurring faults in critical DNN components in embedded systems. The evaluation is conducted on three widely adopted activation functions, namely ReLu, sigmoid, and tanh which serve as fundamental building blocks for introducing non-linearity in DNNs and can lead to mispredictions when subjected to natural faults or fault attacks. We assessed the proposed error detection scheme via fault model simulation, achieving close to 100% error detection while mitigating existing fault attacks on DNN inference. Additionally, the overhead introduced by integrating the proposed scheme with the baseline implementation (i.e., without error detection) is validated through implementations on an AMD/Xilinx Artix-7 FPGA and an ATmega328P microcontroller, as well as through integration with TensorFlow. On the microcontroller, the proposed error detection incurs less than 1% clock cycle overhead, while on the FPGA it requires nearly zero additional area, at the cost of approximately a 20% increase in latency for sigmoid and tanh.
Figures & tables
Attack Level
Attack Vector
Required Faulty Bits
Model Knowledge
Target Environment
Physical Access
Protected by MAED
Transferability
Frameflip [ 26 ]
Code Library (BLAS)
Rowhammer (Software)
1
Black-box
Cloud/MLaaS
No
Potentially (if it affects activation output)
High
BitFlip [ 24 ]
Model Weights
Rowhammer (Software)
11-20
White-box
Cloud/MLaaS
No
No
Low
DeepHammer [ 25 ]
Model Weights
Rowhammer (Software)
11-23
White-box
Cloud/MLaaS
No
No
Low
DeepLaser [ 16 ]
Activation Functions
Laser Injection (Hardware)
5-15
Gray-box
Embedded Systems/IoT
Yes
Yes
Medium
Table I: Comparison of FIAs targeting DNNs
Effect of attack
Detected through
sigmoid
Skipping the negation in the exponent
∣h1(y)−ex∣>ϵ
tanh
Skipping the negation in the exponent
∣h2(y)−e−2x+1e−2x−1∣>ϵ
ReLu
Always maps to 0
h3(x)=1
Table II: Effectiveness of MAED against DeepLaser attack [ 16 ]
Figure 1: Effect of round-off error and number of Taylor terms to the accuracy of the proposed architecture for exponentiation function.
Figure 2: Effect of round-off error and number of Taylor terms to the accuracy of the proposed architecture for sigmoid function.
Figure 3: Effect of round-off error and number of Taylor terms to the accuracy of the proposed architecture for tanh function.
Parameter
Simulation Settings
expo
sigmoid
tanh
Input signal
Range of [−3,3]
Iterations for each simulation
1000
Taylor terms number
30
30
40
Round-off error
10−14
10−14
10−15
Table III: Simulation settings
Model
#
Fault Detection Ratio (%)
n
m
Expo
Sigmoid
tanh
1
1
96.1
99.1
96.5
1
5
96.6
99.4
97.7
Bit flipping
3
1
95.6
98.2
95.3
3
5
98.3
99.5
97.3
6
1
97.5
98.7
97.7
Table IV: Our comprehensive fault detection simulation results For “Random” injection type
Model
#
Fault Detection Ratio (%)
n
m
Expo
Sigmoid
tanh
1
2
95.2
97.9
96
1
5
95.9
98
95.8
Bit flipping
3
2
94.2
98
96.1
3
5
95
98.2
95.6
6
2
97.1
98.3
97.3
Table V: Our comprehensive fault detection simulation results For “Burst” injection type
Model
#
Fault Detection Ratio (%)
n
Expo
sigmoid
tanh
1
90.8
93
92.9
2
95.5
95.4
95.9
Skipping
3
96.8
97.1
97.5
4
98.1
98.7
98.4
5
98.5
99.1
98.4
Table VI: Our comprehensive fault detection simulation results for “Skipping” and “Total Random” models
Activation Function
Average Inference Time (ms)
Model Size (MB)
tanh 1
0.284
0.37
error_tanh 2
0.432
0.37
sigmoid 1
0.294
0.37
error_sigmoid 2
0.458
0.37
ReLu 1
0.283
0.37
error_ReLu 2
0.313
0.37
Table VII: Comparative analysis of inference latency and memory footprint for baseline and protected activation functions in TensorFlow
Activation Function
Clock Cycles
Time ( μ s)
Overhead (%)
tanh 1
9,933,888
620,868
-
error_tanh 2
9,934,400
620,900
0.0052%
sigmoid 1
9,927,808
620,488
-
error_sigmoid 2
9,940,928
621,308
0.132%
1 Baseline, 2 Protected
Table VIII: Evaluation of clock cycles for baseline and protected activation functions on ATmega328P microcontroller (16 MHz)
Scheme
Protected
Baseline
Area
LUTs
2,934
2,896
DSPs
18
18
Timing
Latency (CCs)
9
7
Total time (ns)
64.26
49.98
Power (W) @ 140 MHz
0.214
0.212
Energy (nJ)
13.75
10.59
Table IX: AMD/Xilinx Artix-7, xc7a200tfbg676-2 hardware implementation results for sigmoid function
Figure 4: Hardware Architecture of Sigmoid Function with Error Detection.
Fault detection identifies abnormal behavior in machines, sensors, infrastructure, software, and autonomous systems before it causes harm or disruption.
Fault detection for Deep Neural Networks (DNNs) has received increasing attention in recent years. While more advanced hybrid approaches have been proposed to combine multiple sources of information and outperform earlier techniques, they often incur substantial computational overhead, limiting scalability and practicality in real-world settings. In this paper, we introduce Concept-Aware Fault Detection (CAFD), a learning-based approach that achieves superior fault detection performance by effectively integrating multiple information sources while maintaining practical efficiency. Specifically, CAFD is trained using a carefully selected set of informative features, including model-based signals derived from the DNN's outputs, distance-based features, and a novel concept-based feature, called Concept Failure Ratio (CFR). CFR leverages Vision-Language Models (VLMs) to extract textual concepts from images and quantify the likelihood that their presence is associated with DNN failures. By incorporating this feature, CAFD benefits from complementary semantic information, enabling more effective fault detection. Our results demonstrate that CFR serves as an effective indicator for DNN fault detection. We conduct an extensive empirical evaluation of CAFD, comparing it against five state-of-the-art baselines across three subject DNN models and datasets, including ImageNet. Across a wide range of constrained selection budgets, CAFD consistently outperforms all baselines in Fault Detection Rate (FDR), achieving average FDR improvements of 18.3% across all investigated subjects and budget sizes.
Convolutional Neural Networks (CNNs) are increasingly deployed in safety-critical edge applications, where soft errors can silently corrupt inference outputs and lead to unsafe decisions. Such applications typically rely on resource-constrained embedded GPUs, requiring fault detection and mitigation techniques that add minimal compute, memory, and latency overhead while integrating seamlessly with the standard GPU inference pipeline. Existing algorithm-based fault tolerance techniques rely on matrix augmentation and per-operation checksum verification, imposing substantial overhead that is prohibitive for CNN inference on embedded GPUs. In this work, we propose carry-through checksum, a fundamentally new scheme for soft-error detection in CNN inference on embedded GPUs. The method embeds dedicated carry-through filters into the convolutional layers, which compute a checksum from the CNN's own operations and propagate it through inference, enabling end-to-end error detection with a single output verification. Experimental results on multiple CNN architectures show that the proposed method detects 95.86% and 86.56% of critical faults for FP32 and FP16, respectively, at almost no additional per-image overhead. Detected faults are mitigated through re-execution, incurring only 2.27% run-time overhead across the entire test set on an NVIDIA Jetson Orin NX GPU.
Kyrylo Nazarevych, Mohammad Hasan Ahmadilivani, Krister Kaldre +2
Tallinn University of Technology, Tallinn, Estonia · University of Manchester, Manchester, United Kingdom
Reliability evaluation of deep neural networks under hardware faults commonly relies on fault injection, but exhaustive campaigns are intractable for modern models and datasets. Statistical fault injection reduces this cost, yet existing approaches still require large injection budgets because they do not explicitly exploit a key property of floating-point faults: the effect of a bit flip depends strongly on the value being corrupted. We propose TreeFI, a value-aware statistical fault-injection methodology for FP32 single-bit faults in DNN activations and weights. TreeFI partitions each layer's value distribution into intervals with similar expected bit-flip behavior, learned using regression trees, and allocates injections across these intervals according to their relevance for failure-rate estimation. This stratified allocation preserves the target confidence and error margin while avoiding unnecessary injections in low-impact regions of the fault space. We validate TreeFI on CNN and Transformer models using CIFAR-10 and ImageNet. On ResNet8, where exhaustive activation fault injection is feasible, TreeFI provides more accurate estimates than state-of-the-art statistical FI baselines under the same campaign setting. Across the evaluated models, TreeFI reduces the required injection budget by up to 72.1x, with average reductions of 44.9x for activation faults and 11.2x for the executed weight campaigns.