A Radiation-Hardened, Fault-Aware Quantized Neural Network That Self-Heals

Peter Xiangyuan Ma; Joshua S. Bloom

astro-ph.IMOct 20, 2026

A Radiation-Hardened, Fault-Aware Quantized Neural Network That Self-Heals

Authors: Peter Xiangyuan Ma, Joshua S. Bloom

Organizations: Department of Astronomy, University of California, Berkeley, CA 94720, USA

Abstract

Deep learning (DL) models are increasingly being deployed into radiation-challenging environments in spacecraft, particle accelerators, and, soon, space-based data centers. Instantiated as a learned orchestration of numbers stored in persistent memory, models are susceptible to continual degradation as high-energy particles corrupt data. At inference time, new data passed through the network fundamentally break the off-line assumptions and guarantees of a static model determined during training. To preserve the quality and efficacy of the models, fault tolerance against bit flips is a clear objective. In this work we developed a runtime method for repairing the quantized weights of neural networks (NNs) after bit flips on commodity, commercial off-the-shelf (COTS) hardware, without storing extra replicas. Our work extends the well-established Fault-Aware Training (FAT) paradigm by adding an alignment penalty to concentrate undamaged activations and weights into a low-rank subspace, and we then reconstruct flagged corrupted coordinates from the uncorrupted survivors. We call this method {\it Projection Healing} and apply it to six regression benchmarks on quantized NNs. Holding a FAT checkpoint fixed and toggling only the runtime heal gives a further ${\sim}23\%$ reduction in the native-unit excess integral. Across those datasets the method extends the operational scrub interval by a median of $2.04\times$ at a $+5\%$ RMSE degradation and $1.96\times$ at $+50\%$ , compared with $1.62\times$ and $1.07\times$ for classical Single Error Correction, Double Error Detection (SECDED). This introduces a new path towards designing resilient data-driven models, complementing established hardware redundancy, ECC, and FAT-based techniques.

Figures & tables

Figure 1: System architecture. (a) Two-pass projection healing on a row. The first DCT-II reconstruction forms the syndrome, the gate sets the blend weights, and a second projection of the surviving coordinates supplies the repaired entries. The weight-alignment term shown is $E_{\mathrm{w\_red}}=\max(0,\bar{r}_{\mathrm{w}}-\rho)$ . (b) Training uses four forwards: a clean pass, a contiguous input-block mask, a contiguous weight-block mask, and a contiguous weight sign flip. The range penalty is analytic on the weight rows, and the loss keeps the projection-healing terms separate from the fault-aware terms. (c) A hidden layer heals its weight rows, heals the pre-activation, and then applies the nonlinearity. The drawing continues through the next weight matrix to the clean output.

Figure 2: MBU sweeps on six datasets ((a)–(f)). Log x-axis: accumulated weight-bit fraction

I

over

[10^{-4},1]

. Linear y-axis: held-out test RMSE in native target units (mean across

8

seeds; shaded bands are across-seed std). Curves: unprotected, Clipped, Ranger [ 25 ] , SECDED+interleaving, RedNet, Diehard, and Our Model (RedNet/Diehard are proxy implementations; Appendix H ). The dashed line is the untrained-random floor and the gray band is the uninformative region above it. Ranger matches Clipped by construction under INT8 (Appendix H ). SECDED dominates at low

I

then saturates; Our Model stays below the software defenses longest. The SDSS panel uses the color features of Section 4.4 .

	+5% RMSE (Operational)			+10% RMSE (Degraded)			+50% RMSE (Breakdown)
Dataset	Unprot.	SECDED	Ours	Unprot.	SECDED	Ours	Unprot.	SECDED	Ours
CalHousing	$2.38{\times}10^{-3}$	$4.98{\times}10^{-3}$	$\mathbf{5.31{\times}10^{-3}}$	$4.19{\times}10^{-3}$	$7.82{\times}10^{-3}$	$\mathbf{9.49{\times}10^{-3}}$	$2.22{\times}10^{-2}$	$2.57{\times}10^{-2}$	$\mathbf{5.68{\times}10^{-2}}$
Friedman	$3.34{\times}10^{-3}$	$5.94{\times}10^{-3}$	$\mathbf{6.18{\times}10^{-3}}$	$5.99{\times}10^{-3}$	$9.30{\times}10^{-3}$	$\mathbf{1.11{\times}10^{-2}}$	$2.36{\times}10^{-2}$	$2.72{\times}10^{-2}$	$\mathbf{4.24{\times}10^{-2}}$
SDSS	$9.06{\times}10^{-3}$	$\mathbf{1.33{\times}10^{-2}}$	$1.33{\times}10^{-2}$	$1.51{\times}10^{-2}$	$1.98{\times}10^{-2}$	$\mathbf{2.27{\times}10^{-2}}$	$5.54{\times}10^{-2}$	$5.50{\times}10^{-2}$	$\mathbf{9.24{\times}10^{-2}}$
JetPt	$1.81{\times}10^{-2}$	$2.20{\times}10^{-2}$	$\mathbf{3.18{\times}10^{-2}}$	$2.85{\times}10^{-2}$	$3.17{\times}10^{-2}$	$\mathbf{5.00{\times}10^{-2}}$	$9.99{\times}10^{-2}$	$9.48{\times}10^{-2}$	$\mathbf{1.66{\times}10^{-1}}$
CMAPSS	$2.34{\times}10^{-2}$	$2.68{\times}10^{-2}$	$\mathbf{5.31{\times}10^{-2}}$	$3.42{\times}10^{-2}$	$3.62{\times}10^{-2}$	$\mathbf{7.99{\times}10^{-2}}$	$1.06{\times}10^{-1}$	$1.01{\times}10^{-1}$	$\mathbf{2.25{\times}10^{-1}}$

Table 2: Exposure intensity

I

at which median test RMSE rises

+5\%

+10\%

, and

+50\%

above each model’s own clean baseline, not the shared unprotected floor. Bold indicates the largest

I

. The

+50\%

column is

I_{\mathrm{break}}

, not untrained-network collapse.

Dataset	Full	No wt. heal	No act. heal	No heal	Unaligned	Gain	Vs. unaligned	Clean $\Delta$
CalHousing	$0.40\pm 0.05$	$0.42\pm 0.04$	$0.46\pm 0.06$	$0.48\pm 0.06$	$0.43\pm 0.06$	15.9%	8.0%	+0.3%
Friedman	$1.43\pm 0.05$	$1.78\pm 0.06$	$1.52\pm 0.04$	$1.86\pm 0.05$	$1.65\pm 0.06$	23.5%	14.0%	+1.0%
SDSS	$0.012\pm 0.001$	$0.013\pm 0.001$	$0.014\pm 0.001$	$0.015\pm 0.001$	$0.012\pm 0.001$	22.3%	$-$ 0.2%	+0.4%
JetPt	$8.96\pm 0.37$	$10.9\pm 0.3$	$9.83\pm 0.46$	$11.7\pm 0.4$	$11.6\pm 0.8$	23.2%	23.1%	+0.1%
CMAPSS	$4.03\pm 0.59$	$5.96\pm 0.69$	$4.18\pm 0.62$	$6.08\pm 0.72$	$5.34\pm 0.87$	33.7%	25.4%	$-$ 0.2%
CHF	$641.9\pm 64.2$	$734.4\pm 49.6$	$748.7\pm 103.3$	$823.3\pm 89.7$	$730\pm 45$	22.0%	11.9%	+1.6%

Table 3: Native-unit excess

\int\max(y-y^{\star},0)\,d\log_{10}I

I\in[5\times 10^{-4},\,3\times 10^{-1}]

, mean

\pm

std across seeds. Not normalized by the unprotected integral. Gain is

(\mathrm{No\ heal}-\mathrm{Full})/\mathrm{No\ heal}

from unrounded values. Unaligned is a from-scratch retrain with the alignment penalties and both runtime heals removed; the surrogate curriculum and range penalty stay. Vs. unaligned is

(\mathrm{Unaligned}-\mathrm{Full})/\mathrm{Unaligned}

. Clean

\Delta

is the fault-free RMSE change from toggling the heal on one frozen aligned checkpoint. The SDSS row uses the colors

r

u{-}g

g{-}r

r{-}i

, and

i{-}z

	Full (DCT)	Arbitrary basis	MAD despike
CalHousing	2.24	2.22 (0.99)	2.87 (1.28)
Friedman	5.38	5.02 (0.93)	10.05 (1.87)
SDSS	0.10	0.11 (1.09)	0.12 (1.22)
JetPt	101.4	98.6 (0.97)	120.3 (1.19)
CMAPSS	65.8	64.5 (0.98)	70.6 (1.07)
CHF	1529	2721 (1.78)	2843 (1.86)

Table 4: Absolute integral

\int y\,d\log_{10}I

in native target units. Parentheses are the ratio to the DCT column. Lower is better. CHF, not the other five datasets, is sensitive to the basis.

Configuration	CalH.	Fried.	SDSS	JetPt	CMAPSS	CHF	Mean
Unprotected	1.00	1.00	1.00	1.00	1.00	1.00	1.00
Full (Ours)	$\mathbf{0.58\pm 0.10}$	$\mathbf{0.79\pm 0.02}$	$\mathbf{0.71\pm 0.10}$	$\mathbf{0.78\pm 0.02}$	$\mathbf{0.69\pm 0.04}$	$\mathbf{0.73\pm 0.07}$	$\mathbf{0.71\pm 0.06}$
No concentration flag	$0.58\pm 0.09$	$0.80\pm 0.03$	$1.08\pm 0.18$	$0.78\pm 0.01$	$0.69\pm 0.04$	$0.80\pm 0.08$	$0.79\pm 0.07$
No act. heal	$0.64\pm 0.09$	$0.83\pm 0.03$	$0.77\pm 0.11$	$0.82\pm 0.02$	$0.70\pm 0.04$	$0.78\pm 0.07$	$0.76\pm 0.06$
No weight heal	$0.60\pm 0.09$	$0.89\pm 0.02$	$0.75\pm 0.11$	$0.86\pm 0.02$	$0.81\pm 0.06$	$0.79\pm 0.07$	$0.78\pm 0.06$
No weight align	$1.06\pm 0.18$	$2.21\pm 0.13$	$1.86\pm 0.29$	$2.54\pm 0.26$	$1.79\pm 0.35$	$1.54\pm 0.12$	$1.83\pm 0.22$

Table 5: Normalized relative excess AUC, same definition as Table 1 , on knots from

5\times 10^{-4}

1

. Lower is better. Each column is a from-scratch retrain except the unprotected reference.

Figure 3: Per-bit-position curves on the six published checkpoints. (a) SBU relative RMSE damage vs. bit index. (b) SBU row-level gate detection excess vs. bit index (dotted: raw fire rate). (c)–(d) Short bursts (

m=3

) with forced start bit: relative damage and baseline-corrected false-negative rate vs. start bit. Low-order bits are nearly silent; the sign bit dominates both damage and detection.

		FLOPs
Method	Persistent ROM	$n_{\mathrm{mb}}{=}256$	$n_{\mathrm{mb}}{=}1$
Unprotected	$1.0\times$	$1.0\times$	$1.0\times$
Hardware TMR	$3.0\times$	$3.0\times$	$3.0\times$
SECDED+intlv (72,64)	$1.125\times$	${\sim}1.0\times$	${\sim}1.0\times$
SECDED(b7) UEP	$1.02\times$	${\sim}1.0\times$	${\sim}1.0\times$
Clip. / Diehard	$1.0\times$	${\sim}1.0\times$	${\sim}1.0\times$

Table 6: Square-layer reference (

N{=}128

k{=}32

), with both projection passes always executed. Healing weights on every iteration costs

1+4k/N+4k/n_{\mathrm{mb}}

. Periodic INT8 writeback every

Q=256

iterations amortizes the weight term to

1+4k/N+4k/(Qn_{\mathrm{mb}})

. “ROM” counts persistent model storage; periodic writeback uses a transient FP32 buffer during the scrub but retains no FP32 weight replica. Requantization, checksum, memory-traffic, and atomic-write costs are excluded.

Appendix figures & tables7 assets

Supplementary material from the paper’s appendix.

Appendix

Dataset	Arch.	Params	INT8 bits
CalHousing	$8{\to}96{\to}96{\to}80{\to}1$	18 017	144 136
Friedman	$10{\to}200{\to}200{\to}128{\to}1$	68 257	546 056
SDSS	$5{\to}200{\to}200{\to}128{\to}1$	67 257	538 056
JetPt	$13{\to}200{\to}200{\to}128{\to}1$	68 857	550 856
CMAPSS	$21{\to}200{\to}200{\to}128{\to}1$	70 457	563 656
CHF	$5{\to}200{\to}200{\to}128{\to}1$	67 257	538 056

Appendix

Table 7: Per-dataset MLP shapes. INT8 bits equal parameter count times

8

, counting each bias element as one stored byte. Per-channel scales are extra protected metadata and are not in this count.

Quantity	Value	Bit share
$Z=\sum_{m=1}^{256}m^{-2.2}$	$1.4895$	–
$P(m=1)$ (SBU)	$67.1\%$	$25.4\%$
$P(m\geq 2)$	$32.9\%$	$74.6\%$
$P(m\geq 8)$	$4.90\%$	$42.9\%$
$P(m\geq 32)$	$0.82\%$	$21.8\%$
$P(m\geq 128)$	$0.09\%$	$6.3\%$

Appendix

Table 8: Properties of the truncated discrete power-law multiplicity

P(m)=m^{-\alpha}/Z

m\in\{1,\dots,m_{\max}\}

with

\alpha=2.2

m_{\max}=256

. Exact arithmetic, not measurements. The median of

m

1

. Bit share is the fraction of flipped bits, not the fraction of strikes.

Figure 4: Sensitivity to the assumed multiplicity spectrum. Both axes use

P(m\geq 2)

. (a) Measured sensitivity of

+5\%

RMSE, derived from Table 2 . (b) Sensitivity of the six-dataset mean relative excess AUC over the wide window

I\in[10^{-4},1]

$T$	Bit 6	Bit 7	FPR (%)	Cost (%)	Rel. AUC
0.04	0.27	0.58	24.7	23.9	–
0.08	0.27	0.58	24.7	13.6	–
0.12	0.27	0.58	24.7	8.6	–
0.14 ∗	0.27	0.58	24.7	6.6	1.10
0.20	0.21	0.62	22.0	3.1	1.04
0.27	0.09	0.71	15.0	1.3	1.01

Appendix

Table 9: Weight-gate center sweep at

\tau_{\mathrm{flag}}=0.18

on seed

0

. Bit columns are row-detection excess. FPR is the zero-fault row fire rate. Cost is the clean-RMSE penalty versus the heal-off end. Rel. AUC is the ratio to

T=0.35

. Dashes are ladder ends without that ratio. The dagger is the weight operating point, not the activation center

T=0.25

Dataset	BF (orig.)	BF (near)	Surr.+STE
CalHousing	1.09 †	0.88 †	0.98
Friedman	1.07 †	1.04 †	1.05 †
SDSS	0.87 †	0.92 †	0.97
JetPt	1.14 †	0.89 †	0.94 †
CMAPSS	1.15 †	1.06 †	1.07 †
CHF	1.07 †	1.02 †	1.02 †

Appendix

Table 10: Full-stack curriculum ablation. Every arm still includes subspace alignment and eval-time Projection Healing. Entries are paired ratios of wide-window excess AUC to the published surrogate curriculum; below one favors that column’s arm. BF (orig.) is the original bit-flip severity, about

6\times

milder than the surrogate. BF (near) matches the surrogate on measured severity. Surr.+STE sends the surrogate masks through the bit-flip arm’s straight-through estimator. A dagger marks a paired bootstrap interval that excludes parity. Parentheses on the geometric-mean row are bootstrap ranges. This is not a standalone unaligned FAT baseline. The SDSS entry in BF (orig.) uses the color features, and that column’s geometric mean has no bootstrap range because BF (near) and Surr.+STE were not rerun.

Dataset	$S_{\mathrm{block}}=3$ (1w)	$S_{\mathrm{block}}=24$ (3w)	$S_{\mathrm{block}}=64$ (8w)
CalHousing	1.02	1.04	1.08
Friedman	0.99	1.04	1.01
SDSS	1.00	1.02	0.99
JetPt	1.04	1.06	1.16
CMAPSS	0.93	0.84	0.76
CHF	1.03	1.07	1.00

Appendix

Table 11: Ratio of column-major to row-major wide-window excess AUC. A ratio above

1

means the column-major layout degrades Projection Healing relative to row-major. This is tensor layout, not SECDED word interleaving.

Model	$k/N$	Clean RMSE	Rel. AUC
Unprotected	–	$0.53\pm 0.01$	$1.00\pm 0.00$
$K=4$	0.06, 0.06, 0.08	$0.71\pm 0.05$	$0.71\pm 0.12$
$K=8$	0.13, 0.13, 0.17	$0.59\pm 0.02$	$0.56\pm 0.09$
$K=16$	0.25, 0.25, 0.33	$0.55\pm 0.01$	$0.54\pm 0.08$
$K=32$	0.50, 0.50, 0.67	$0.53\pm 0.01$	$0.59\pm 0.10$

Appendix

Table 12: Sensitivity of Projection Healing to the Green rank

K

on a narrow architecture. Column heads are abbreviated so the table fits the column;

k/N

is the retained-rank ratio on each hidden layer.

RESQ: A Unified Framework for REliability- and Security Enhancement of Quantized Deep Neural Networks
Mar 16, 2026Ali Soltan Mohammadi, Samira Nazari, Ali Azarpeyvand +5Adversarial Robustness Quantization Robustness
University of Zanjan, Zanjan, Iran · Brandenburg Technical University, Cottbus, Germany · Tallinn University of Technology, Tallinn, Estonia +1
CoG-Guided Weight Correction for Fault-Tolerant Deep Neural Networks
Jul 17, 2026Bahram Parchekani, Samira Nazari, Ali Azarpeyvand +3Neural Network Robustness
University of Zanjan, Zanjan, Iran · Tallinn University of Technology, Tallinn, Estonia
From Arithmetic to Logic: The Resilience of Logic and Lookup-Based Neural Networks Under Parameter Bit-Flips
Mar 24, 2026Alan T. L. Bacellar, Sathvik Chemudupati, Shashank Nag +4Neural Network Robustness Neural Network Quantization
The University of Texas at Austin · Federal University of Rio de Janeiro · Instituto de Telecomunicações, Porto, Portugal

Mar 16, 2026J/K move · Enter open · S save

RESQ: A Unified Framework for REliability- and Security Enhancement of Quantized Deep Neural Networks

Ali Soltan Mohammadi, Samira Nazari, Ali Azarpeyvand, Mahdi Taheri+4

University of Zanjan, Zanjan, Iran · Brandenburg Technical University, Cottbus, Germany · Tallinn University of Technology, Tallinn, Estonia+1

Adversarial Robustness Quantization Robustness Neural Network Quantization Post-Training Quantization

Open paper AskPDF arXiv

This work proposes a unified three-stage framework that produces a quantized DNN with balanced fault and attack robustness. The first stage improves attack resilience via fine-tuning that desensitizes feature representations to small input perturbations. The second stage reinforces fault resilience through fault-aware fine-tuning under simulated bit-flip faults. Finally, a lightweight post-training adjustment integrates quantization to enhance efficiency and further mitigate fault sensitivity without degrading attack resilience. Experiments on ResNet18, VGG16, EfficientNet, and Swin-Tiny in CIFAR-10, CIFAR-100, and GTSRB show consistent gains of up to 10.35% in attack resilience and 12.47% in fault resilience, while maintaining competitive accuracy in quantized networks. The results also highlight an asymmetric interaction in which improvements in fault resilience generally increase resilience to adversarial attacks, whereas enhanced adversarial resilience does not necessarily lead to higher fault resilience.

Abstract

Explore similar work

RESQ: A Unified Framework for REliability- and Security Enhancement of Quantized Deep Neural Networks

CoG-Guided Weight Correction for Fault-Tolerant Deep Neural Networks

From Arithmetic to Logic: The Resilience of Logic and Lookup-Based Neural Networks Under Parameter Bit-Flips