MAED: Mathematical Activation Error Detection for Mitigating Physical Fault Attacks in DNN Inference

Kasra Ahmadi; Saeed Aghapour; Mehran Mozaffari Kermani; Reza Azarderakhsh

cs.CRMar 18, 2026

MAED: Mathematical Activation Error Detection for Mitigating Physical Fault Attacks in DNN Inference

Authors: Kasra Ahmadi, Saeed Aghapour, Mehran Mozaffari Kermani, Reza Azarderakhsh

Organizations: Department of Computer Science and Engineering, University of South Florida, Tampa, FL 33620, USA. · Department of Computer and Electrical Engineering and Computer Science, Florida Atlantic University, Boca Raton, FL 33431, USA.

Abstract

The inference phase of deep neural networks (DNNs) in embedded systems is increasingly vulnerable to fault attacks and failures, which can result in incorrect predictions. These vulnerabilities can potentially lead to catastrophic consequences, making the development of effective mitigation techniques essential. In this paper, we introduce MAED (Mathematical Activation Error Detection), an algorithm-level error detection framework that exploits mathematical identities to continuously validate the correctness of non-linear activation function computations at runtime. To the best of our knowledge, this work is the first to integrate algorithm-level error detection techniques to defend against both malicious fault injection attacks and naturally occurring faults in critical DNN components in embedded systems. The evaluation is conducted on three widely adopted activation functions, namely ReLu, sigmoid, and tanh which serve as fundamental building blocks for introducing non-linearity in DNNs and can lead to mispredictions when subjected to natural faults or fault attacks. We assessed the proposed error detection scheme via fault model simulation, achieving close to 100% error detection while mitigating existing fault attacks on DNN inference. Additionally, the overhead introduced by integrating the proposed scheme with the baseline implementation (i.e., without error detection) is validated through implementations on an AMD/Xilinx Artix-7 FPGA and an ATmega328P microcontroller, as well as through integration with TensorFlow. On the microcontroller, the proposed error detection incurs less than 1% clock cycle overhead, while on the FPGA it requires nearly zero additional area, at the cost of approximately a 20% increase in latency for sigmoid and tanh.

Figures & tables

Frameflip [ 26 ]	Code Library (BLAS)	Rowhammer (Software)	1	Black-box	Cloud/MLaaS	No	Potentially (if it affects activation output)	High
	Attack Level	Attack Vector	Required Faulty Bits	Model Knowledge	Target Environment	Physical Access	Protected by MAED	Transferability
BitFlip [ 24 ]	Model Weights	Rowhammer (Software)	11-20	White-box	Cloud/MLaaS	No	No	Low
DeepHammer [ 25 ]	Model Weights	Rowhammer (Software)	11-23	White-box	Cloud/MLaaS	No	No	Low
DeepLaser [ 16 ]	Activation Functions	Laser Injection (Hardware)	5-15	Gray-box	Embedded Systems/IoT	Yes	Yes	Medium

Table I: Comparison of FIAs targeting DNNs

	Effect of attack	Detected through
sigmoid	Skipping the negation in the exponent	$\|h_{1}(y)-e^{x}\|>\epsilon$
tanh	Skipping the negation in the exponent	$\|h_{2}(y)-\frac{e^{-2x}-1}{e^{-2x}+1}\|>\epsilon$
ReLu	Always maps to 0	$h_{3}(x)=1$

Table II: Effectiveness of MAED against DeepLaser attack [ 16 ]

Figure 1: Effect of round-off error and number of Taylor terms to the accuracy of the proposed architecture for exponentiation function.

Figure 2: Effect of round-off error and number of Taylor terms to the accuracy of the proposed architecture for sigmoid function.

Figure 3: Effect of round-off error and number of Taylor terms to the accuracy of the proposed architecture for tanh function.

Parameter	Simulation Settings
Parameter	expo	sigmoid	tanh
Input signal	Range of $[-3,3]$
Iterations for each simulation	1000
Taylor terms number	30	30	40
Round-off error	$10^{-14}$	$10^{-14}$	$10^{-15}$

Table III: Simulation settings

Model	#		Fault Detection Ratio (%)
Model	$n$	$m$	Expo	Sigmoid	tanh
	1	1	96.1	99.1	96.5
	1	5	96.6	99.4	97.7
Bit flipping	3	1	95.6	98.2	95.3
Bit flipping	3	5	98.3	99.5	97.3
	6	1	97.5	98.7	97.7

Table IV: Our comprehensive fault detection simulation results For “Random” injection type

Model	#		Fault Detection Ratio (%)
Model	$n$	$m$	Expo	Sigmoid	tanh
	1	2	95.2	97.9	96
	1	5	95.9	98	95.8
Bit flipping	3	2	94.2	98	96.1
Bit flipping	3	5	95	98.2	95.6
	6	2	97.1	98.3	97.3

Table V: Our comprehensive fault detection simulation results For “Burst” injection type

Model	#	Fault Detection Ratio (%)
Model	$n$	Expo	sigmoid	tanh
	1	90.8	93	92.9
	2	95.5	95.4	95.9
Skipping	3	96.8	97.1	97.5
Skipping	4	98.1	98.7	98.4
	5	98.5	99.1	98.4

Table VI: Our comprehensive fault detection simulation results for “Skipping” and “Total Random” models

Activation Function	Average Inference Time (ms)	Model Size (MB)
tanh 1	0.284	0.37
error_tanh 2	0.432	0.37
sigmoid 1	0.294	0.37
error_sigmoid 2	0.458	0.37
ReLu 1	0.283	0.37
error_ReLu 2	0.313	0.37

Table VII: Comparative analysis of inference latency and memory footprint for baseline and protected activation functions in TensorFlow

Activation Function	Clock Cycles	Time ( $\mu$ s)	Overhead (%)
tanh 1	9,933,888	620,868	-
error_tanh 2	9,934,400	620,900	0.0052%
sigmoid 1	9,927,808	620,488	-
error_sigmoid 2	9,940,928	621,308	0.132%
1 Baseline, 2 Protected

Table VIII: Evaluation of clock cycles for baseline and protected activation functions on ATmega328P microcontroller (16 MHz)

Scheme		Protected	Baseline
Area	LUTs	2,934	2,896
Area	DSPs	18	18
Timing	Latency (CCs)	9	7
Timing	Total time (ns)	64.26	49.98
Power (W) @ 140 MHz		0.214	0.212
Energy (nJ)		13.75	10.59

Table IX: AMD/Xilinx Artix-7, xc7a200tfbg676-2 hardware implementation results for sigmoid function

Figure 4: Hardware Architecture of Sigmoid Function with Error Detection.

Fault Detection

Fault detection identifies abnormal behavior in machines, sensors, infrastructure, software, and autonomous systems before it causes harm or disruption.

See all 104 papers

CAFD: Concept-Aware DNN Fault Detection using VLMs
May 19, 2026Amin Abbasishahkoo, Mahboubeh Dadkhah, Lionel BriandDNN Testing Anomaly Detection
School of EECS, University of Ottawa, Ottawa, ON K1N 6N5, Canada · Research Ireland Lero centre for software, University of Limerick, Ireland
Carry-Through Checksum: A Lightweight Fault-Detection for CNN Inference at the Edge
Sep 15, 2026Kyrylo Nazarevych, Mohammad Hasan Ahmadilivani, Krister Kaldre +2Edge Inference Convolutional Neural Networks
Tallinn University of Technology, Tallinn, Estonia · University of Manchester, Manchester, United Kingdom
TreeFI: Value-Aware Statistical Fault Injection for Deep Neural Networks
Sep 4, 2026Noam Bires, Marcello Traiola, Angeliki Kritikakou +1
Univ Rennes, Inria, IRISA, CNRS, Rennes, France

May 19, 2026J/K move · Enter open · S save

CAFD: Concept-Aware DNN Fault Detection using VLMs

Amin Abbasishahkoo, Mahboubeh Dadkhah, Lionel Briand

School of EECS, University of Ottawa, Ottawa, ON K1N 6N5, Canada · Research Ireland Lero centre for software, University of Limerick, Ireland

DNN Testing Anomaly Detection

Open paper AskPDF arXiv

Fault detection for Deep Neural Networks (DNNs) has received increasing attention in recent years. While more advanced hybrid approaches have been proposed to combine multiple sources of information and outperform earlier techniques, they often incur substantial computational overhead, limiting scalability and practicality in real-world settings. In this paper, we introduce Concept-Aware Fault Detection (CAFD), a learning-based approach that achieves superior fault detection performance by effectively integrating multiple information sources while maintaining practical efficiency. Specifically, CAFD is trained using a carefully selected set of informative features, including model-based signals derived from the DNN's outputs, distance-based features, and a novel concept-based feature, called Concept Failure Ratio (CFR). CFR leverages Vision-Language Models (VLMs) to extract textual concepts from images and quantify the likelihood that their presence is associated with DNN failures. By incorporating this feature, CAFD benefits from complementary semantic information, enabling more effective fault detection. Our results demonstrate that CFR serves as an effective indicator for DNN fault detection. We conduct an extensive empirical evaluation of CAFD, comparing it against five state-of-the-art baselines across three subject DNN models and datasets, including ImageNet. Across a wide range of constrained selection budgets, CAFD consistently outperforms all baselines in Fault Detection Rate (FDR), achieving average FDR improvements of 18.3% across all investigated subjects and budget sizes.

Abstract

Fault Detection

Explore similar work

CAFD: Concept-Aware DNN Fault Detection using VLMs

Carry-Through Checksum: A Lightweight Fault-Detection for CNN Inference at the Edge

TreeFI: Value-Aware Statistical Fault Injection for Deep Neural Networks