# Challenges in Assessing and Improving Deep Neural Networks Reliability

Fernando Fernandes dos Santos, Paolo Rech

<figure><img src="image_1.png" /></figure>

## To cite this version:

Fernando Fernandes dos Santos, Paolo Rech. Challenges in Assessing and Improving Deep Neural Networks Reliability. IEEE Design & Test, In press, pp.1-6. hal-04748638

HAL Id: hal-04748638

https://hal.science/hal-04748638v1

Submitted on 22 Oct 2024

HAL is a multi-disciplinary open access
archive for the deposit and dissemination of sci-
entific research documents, whether they are pub-
lished or not. The documents may come from
teaching and research institutions in France or
abroad, or from public or private research centers.

L'archive ouverte pluridisciplinaire HAL, est
destinée au dépôt et à la diffusion de documents
scientifiques de niveau recherche, publiés ou non,
émanant des établissements d'enseignement et de
recherche français ou étrangers, des laboratoires
publics ou privés.

<figure><img src="image_2.png" /></figure>

Distributed under a Creative Commons Attribution 4.0 International License
# Challenges in Assessing and Improving Deep Neural Networks Reliability

Fernando Fernandes dos Santos* and Paolo Rech⁺

*Univ Rennes, CNRS, Inria, IRISA - UMR 6074, F-35000 Rennes, France

⁺University of Trento, Italy

e-mails: fernando.fernandes-dos-santos@inria.fr and paolo.rech@unitn.it

**Abstract**—Machine Learning (ML) is one of the most significant technological advancements in recent years. ML nowadays has been employed in a plethora of applications, from chatbots to industry automation and space exploration. Deep Neural networks (DNNs) used in these applications to perceive the environments must be highly reliable. The complexity of the software and hardware frameworks to run DNNs makes the reliability evaluation a challenging task. This paper discusses the effects of radiation-induced faults on DNNs and how to improve the reliability of DNN-based systems. We cover how to test DNNs to find vulnerabilities and the best ways to protect them, discussing the strengths and weaknesses of the available strategies.

**Index Terms**—deep neural networks, reliability, NVIDIA GPUs, fault tolerance, radiation-induced faults

## I. INTRODUCTION

Machine Learning has advanced significantly and is today able to solve problems that would be impossible to tackle using traditional programming techniques. By stacking several layers, it is indeed possible to extract progressively abstract features from the input data. With this information, Deep Neural Networks (DNNs) allow to find patterns in the input data and learn to solve specific tasks.

Since DNNs are extremely useful in several mission- and safety-critical domains that range from robotics to autonomous vehicles and aerospace applications, questions about their reliability have been posed. Traditional fully connected neural networks that perform prediction over structured data are considered resilient given their redundant computation. Unfortunately, feature extraction is a computationally heavy task and, since modern DNNs include hundreds of these layers that need to be processed in real time, the probability of faults and the impact of a fault in the final prediction is exacerbated.

The feature extraction is usually performed thanks to convolution. A kernel slides over the input matrix to extract a specific feature. This process needs to be done for each convolutional layer in the DNN. The huge amount of convolutions in modern DNNs (hundreds of layers, each requiring hundreds of convolutions) makes it necessary to adopt high-performance computing devices to train and run the inference of DNNs. Graphics Processing Units (GPUs) have been the first and are today the most common devices for accelerating DNNs. The massively parallel architecture of GPUs significantly speeds up the performance of DNNs. More recently, dedicated accelerators for DNNs have been designed for Field-Programmable Gate-Arrays (FPGAs) or in low-power EdgeAI devices.

<figure><img src="image_3.png" /><figcaption>(a) Expected detection.</figcaption></figure>

<figure><img src="image_4.png" /><figcaption>(b) Output observed on beam experiments.</figcaption></figure>

<caption>Fig. 1. Expected detection by YOLOv3 on a frame of Caltech dataset when no fault is observed (1(a)) and observed neutron-induced fault effect (1(b))</caption>

When reliability is concerned, GPUs or AI accelerators in general share two peculiar drawbacks: (1) they have large silicon area and are designed with cutting-edge technology, thus increasing the probability of experiencing faults and (2) they have a parallel architecture, thus opening to the possibility of having one single fault to propagate to multiple parallel processes, exacerbating the probability for the fault to propagate in the neural network and to affect the output. Many sources
of faults can be a concern when running DNNs on GPUs, including transient [1], degrading [2], [3], permanent [4], and intermittent faults [2]. While permanent and degrading faults lead to a more critical impact on the inference process [5], [6], they can be identified through regular checks and tensor metrics [6]. On the other hand, intermittent and transient faults present more complex fault models, as they do not always result in visible failures [1], [7]. Due to their stochastic nature, transient faults are one of the most challenging to detect and protect. Transient faults may result from voltage and temperature variations, timing faults, and ionizing particles [1], [8], [9].

As shown in Figure 1(b), a transient fault caused by a single neutron impact can severely impact the detection performed by DNNs. It is then fundamental to properly characterize the fault model (i.e., the way the hardware fault manifests itself in the software layer) to guarantee realistic reliability evaluations. Injecting single bit flips in software does no longer accurately represent the fault model in modern parallel computing systems.

DNNs are approximate algorithms that generate a tensor of values, which must be post-processed to determine which subset of tensor values are most likely to represent the correct classes, objects, or text. This inexact nature of DNNs' output is only apparently playing in favor of their reliability. In fact, while the prediction is not deterministic, it is not unlikely for a fault to corrupt the output probability vector in a way that modifies the classification or detection information. It is then necessary to formalize the difference between a *tolerable* and a *critical* error. The former modifies the DNN output without affecting detection or classification while the latter induces a misclassification or a misdetection.

A vibrant research has been triggered to improve DNNs' reliability using software strategies [7], [10], [11]. The focus on software solutions is justified by the fact that, given the complexity of the underlying hardware and the performance required to run DNNs in real time, modifying the circuit or the computing architecture is simply too costly. It is also important to notice that most traditional fault mitigation solutions, such as replications, cannot be employed in DNNs for the excessive overhead they introduce in terms of hardware area, power consumption, and latency. Researchers have then worked to identify efficient and dedicated fault mitigation strategies that goes from checksum (Algorithm Based Fault Tolerance) to values filters and re-training. All these solutions are focused on critical faults, since correcting tolerable faults would introduce unnecessary overhead.

The ML scenario is rapidly evolving, with new models reaching unprecedented accuracy and flexibility. Additionally, novel hardware accelerators are continuously being designed. Unfortunately, both the reliability evaluation and mitigation solutions designed for a specific framework can hardly be extended to others. It is then of utmost importance to be at speed with novelty and to find novel reliability evaluations and hardening solutions that are not tight to the specific hardware or software model, but can be generalized. In this paper, we review the research path so far in the reliability of DNNs, focusing specifically on GPUs. We will highlight the criticality

<figure><img src="image_5.png" /><figcaption>Fig. 2. General steps for a radiation experiment to evaluate DNN failure rate. Typically, the calibration of the beam experiment is a live and iterative procedure that loops many times from steps a) to c).</figcaption></figure>

of the architecture and models and list the most effective and original hardening solutions available.

## II. NOVEL RELIABILITY CHALLENGES

Assessing the reliability of DNNs is a challenging task due to the complexity of the hardware and software frameworks. Though radiation experiments are the only known way to have a realistic estimate of the error rate, they do not allow tracking fault propagation. On the other hand, fault simulation identifies specific fault sites. However, the fault models are synthetic and provided by the user. It is then mandatory to ensure that the simulation fault models are realistic to avoid drawing inaccurate conclusions or implementing ineffective hardening solutions. In this Section, we present the evaluations and improvements we proposed in the article *Analyzing and Increasing the Reliability of Convolutional Neural Networks on GPUs* [7]. We adopt a cross-layer analysis that combines radiation and software fault simulation approaches to obtain realistic and traceable insights into the reliability of DNNs.

For the first neutron-beam experiment to characterize the DNN sensitivity ever conducted, we selected a set of representative DNNs, including YOLOv1 and Faster R-CNN for object detection and ResNet for image classification. We performed the experiments at ChipIr in Rutherford Appleton Laboratory (RAL, UK) and LANSCE in Los Alamos National Laboratory (LANL, US). Both facilities provide a neutron beam to simulate atmospheric neutron effects in electronic devices. This allows for the measurement of realistic failure rates of the device while executing a code. The beam experiments measured the probability of a neutron causing a failure in the GPU. The failure rate calculated in these experiments can be used to estimate the terrestrial failure rate caused by neutrons on a GPU – the Failure In Time (FIT) rate.
<figure><img src="image_6.png" /><figcaption>Fig. 3. Figure 3(a) illustrates the pioneering neutron-beam experiment conducted on NVIDIA GPUs, employing complex float CNNs developed with popular ML frameworks such as Darknet, Caffe, and Torch. Figure 3(b) presents the FIT rates for YOLO, Faster R-CNN, and ResNet on Kepler GPU. The effectiveness of three protection mechanisms, ECC, ABFT for CNNs, and Smart Pooling validated using beam experiments, is depicted in Figure 3(c).</figcaption></figure>

We summarize a general approach to experimentally evaluate the GPU neutron sensitivity, as illustrated in Figure 2. The neutron beam experiment's first step (step a) consists of preparing the Devices Under Test (DUTs) inside the beam chamber. This includes setting up hardware components and communications outside the beam, such as the Ethernet network (Figure 3(a)). Once the hardware setup is complete, we can turn on the beam and allow the flux of particles to hit the DUTs (step b). The experiment is then controlled by a set of scripts that run and verify whether the DUTs inside the beam chamber are responding (steps c.1 and c.2). We continuously run the code on the irradiated GPU with a known input, checking that the application output is correct. Any expected and produced output mismatches are classified as **Silent Data Corruptions (SDC)**. Since DNNs are approximate methods, we classify the SDCs into two categories: (1) Tolerable SDCs, which do not change the inference even if the output tensors differ, and (2) Critical SDCs, which can change the classification or detection. Finally, if the application crashes or the operating system stops responding, it is considered a **Detected Unrecoverable Error (DUE)**.

In Figure 3(b), we report the normalized FIT rate for the DNNs running on the NVIDIA Tesla K40 (Kepler Architecture) on ChipIR experiments. We cannot provide absolute FIT rates for NVIDIA GPUs to avoid disclosing sensitive data. However, we can still use relative data to analyze the effectiveness of protection methods. Recent studies [11], [12] have validated through beam experiments and fault simulations that ABFT and range restriction are effective methods for hardening DNNs.

In Figures 3(b) and 3(c), we compare the SDC rate for the unprotected version and the one protected by Error Correction Codes (ECC) and the software methods. It is worth noting that in the beam experiments, we can only compare failure rates with and without the correction mechanism (comparing the reduction of each technique vs the unprotected version). Adding extra checks on the DNN inference to count the corrected errors would add unnecessary overhead and lead to an unfair comparison with the unprotected versions. More resources are used for error correction checking while the GPU is irradiated, directly influencing the FIT rate results.

We find that a single fault can spread through the GPU's microarchitecture, affecting several parallel threads and eventually undermining the neural network's inherent fault tolerance. We can observe in Figure 3(b) that the more complex structures in Faster R-CNN and ResNet make them more likely to experience SDCs than YoloV1. However, the high accuracy and complexity of Faster R-CNN and ResNet significantly reduce the probability of Critical SDCs.

The results presented in Figure 3(b) indicate that DUEs are more likely to occur than SDCs for all tested configurations. This is because DNN kernels require many device-host (CPU-GPU) synchronizations, during which a transient fault could potentially lead to a GPU DUE. Although a significant portion of SDCs can be masked, DUEs may still affect the device's reliability. For this reason, the Faster R-CNN and Resnet models, which require a much larger number of synchronizations, exhibit up to 5× higher DUE rates than YoloV1.

Modern GPUs are equipped with Single Error Correction Double Error Detection (SECDED) ECC, which helps to enhance their reliability while maintaining high performance. The ECC on current NVIDIA GPUs protects global memories (DDRs) and core memories, such as shared memories, cache memories, and register files. When ECC is enabled, the DUE rate also increases because ECC can correct one-bit flip in the protected memories, and when a double-bit flip is detected, it throws a system exception. As DNNs use large portions of the memory to perform classification/detection, multiple errors on memories are expected to happen, resulting in a higher DUE rate when ECC is ON.

Table I presents the ratio of the observed failure rate for SDCs and DUEs (($ECC\ On\ rate$)/($ECC\ Off\ rate$)) and the percentage of the observed Critical SDCs. While the ECC can reduce the SDC failure rate by an order of magnitude (Figure 3(b)), the ECC can reduce neither the number of critical nor multiple errors from unprotected GPU units. Even with ECC protection, we show that the critical SDC rate is not negligible, on average 33.9%. ECC is a fault tolerance method for memories that neglects the high number of computation units necessary to compute the large modern DNNs. In the following section, we present how the computation operations can be hardened by using simple application-level approaches.
Our study marks a significant advancement in understanding the reliability of DNNs on GPUs, being the first to thoroughly evaluate their neutron-induced failure rates, criticality, and fault tolerance. Our research uses a combination of physical fault injection and instruction-level fault simulation with neutron beams to study fault propagation behavior in CNNs. This enabled us to propose software-level hardening techniques for CNNs. Additionally, our work has characterized specific fault models affecting DNNs in GPU environments, especially during matrix multiplication operations, and highlighted how these faults manifest in the convolution matrix output. This characterization, confirmed by subsequent studies [11], [13], supports the advancement of fault-aware training methods, allowing for the incorporation of algorithms that enhance DNNs' reliability against faults, maintaining accuracy even when faults occur.

### III. DESIGNED SOFTWARE-BASED HARDENING SOLUTIONS

Once the fault model and the fault propagation in DNNs have been characterized it is possible to design dedicated hardening solutions to prevent the faults from propagating and modifying the output. Essentially, as shown in Table I, our beam experiments have shown that ECC in GPUs reduces the number of output failures in DNNs but is ineffective in reducing the number of critical SDCs. We found that most of the critical SDCs are not caused by memory errors but rather by faults in the data path, control units, scheduler, or logic units of the GPUs. Since we cannot rely on ECC to improve DNNs' reliability, we must design alternative solutions.

In our research, we have seen that most faults affecting the DNN output are generated in convolutional layers, where matrix multiplications are performed. Thus, we adapt to DNNs a known hardening solution for matrix multiplication: Algorithm-Based Fault Tolerance (ABFT). Moreover, we have found that the faults that are more likely to induce a critical SDC are the ones that significantly modify the values to propagate through the network. We have then introduced float value filters in the Max-Pool layers of the DNN and renamed the layer SmartPool. In this section, we will describe the reasoning behind these solutions, as well as their latency overhead and error correction capabilities.

#### A. ABFT

We use ABFT to detect and correct faults affecting convolution in CNNs, protecting matrix multiplication operations as described by Huang et al. [14]. ABFT consists of adding checksums in the input matrices before the multiplication operation, and then, after the matrix multiplication is done, we check for errors in the resulting matrix using the output checksums. The idea of using ABFT to harden CNNs arises from the observation that 67% of GPU processing in YoloV1, 82% in Faster R-CNN, and 80% in ResNet is spent in matrix multiplication-related operations. Figure 3(c) shows the efficiency of the ABFT technique applied to YoloV1 and evaluated on beam experiments on a Kepler GPU. Remarkably, ABFT can correct ≈60% of the Critical SDCs, showcasing its potential as a reliable fault tolerance approach. Furthermore,

<table><caption>TABLE I
ECC EFFICIENCY FOR YOLOV1, FASTER R-CNN, AND RESNET 200 ON NVIDIA KEPLER GPU.</caption><thead><tr><th rowspan="2"></th><th colspan="2">ECC On/Off Ratio</th><th colspan="2">Critical SDC (%)</th></tr><tr><th>SDC</th><th>DUE</th><th>ECC Off</th><th>ECC On</th></tr></thead><tbody><tr><td>YoloV1</td><td>0.2</td><td>1.1</td><td>8.0%</td><td>61.1%</td></tr><tr><td>Faster R-CNN</td><td>0.1</td><td>1.4</td><td>5.5%</td><td>25.0%</td></tr><tr><td>ResNet 200</td><td>0.2</td><td>1.5</td><td>8.0%</td><td>15.5%</td></tr></tbody></table>

the time overhead associated with ABFT is much smaller than duplication with comparison, operating at an $O(n)$ time complexity.

#### B. SmartPooling

MaxPooling is an operation that reduces the resolution of a feature map by propagating to the next layer only the element in the (2x2) window with the highest value. A preliminary evaluation with two datasets (Caltech and VOC2012) shows that all the fault-free maximum absolute values for elements entering the Yolov1 maxpool layers are up to ≈ 21. The profiled values are extremely small, considering the full range of FP16 or FP32 representations. Thus, we propose a more reliable version of the max pool layer that evaluates if the element's value to propagate is greater than a threshold (to be conservative, the threshold is set to be $10x$, the max value of a fault-free execution). If the value is above the threshold, then a fault probably occurred, we then mark that execution as faulty. This solution will detect faults in GPUs that affect multiple elements that impact the final inference most. When the fault is detected, we also propose propagating the element with the second highest element, showing promising results for error correction. SmartPool corrects 86% of SDCs under the beam (Figure 3(c)). The most promising result is that the radiation experiments demonstrate that only 2% of the SDCs remain undetected.

In order to provide a complete evaluation, we compare ABFT and SmartPooling with ECC, as shown in Figure 3(c). Both ABFT and SmartPooling outperform ECC significantly. In the ECC version, 60% of the SDCs are Critical SDCs. In contrast, ABFT and SmartPooling can correct all errors affecting matrix multiplication and Maxpooling computations. The proposed techniques can be easily applied to complex CNN architectures, and their implementation requires minimal or no hardware modifications since they can utilize the same hardware used for other CNN operations. On the contrary, ECC incurs a logarithmic memory cost, making it less desirable than ABFT and SmartPooling.

### IV. IMPROVED HARDENING SOLUTIONS FOR DNNs

Very efficient and smart hardening solutions have been designed since the first results on DNNs reliability, which highlighted the urgency in reducing the impact of faults, and the first software-based hardening solutions showcased the potentiality of DNNs in coping with faults. These improved solutions for DNNs reliability include dedicated lightweight ABFT for convolution, new filters, and fault-aware training. In this Section, we will briefly present the most effective and original solutions that have been designed.
A. Lightweight ABFT

While the original ABFT introduces a linear time overhead, this extra time must be added to each convolution operation in each layer. Moreover, the extra memory required to store and load the checksum can saturate the GPU caches, undermining parallel performances.

Thus, researchers have worked to improve the performance of ABFT. This has been achieved by introducing the concept of Filter and Input Fmap Checksums [11] (i.e., combine more checksums to reduce the comparison overhead) and by reducing the computation and the information provided from the checksum comparisons (i.e., only detection can be performed) [15]. As a result, the time overhead imposed by these lightweight ABFT solutions are lower than 20%.

B. Improved value clipping

Recent research has shown that corrupted value clipping is one of the most effective methods for fault tolerance in DNNs [10], [12], [16]. Ranger is a corrupted value clipping method that inserts intermediary layers within the DNN to filter out values outside acceptable bounds. This process helps to prevent Critical SDCs. Ranger is able to reduce the time overhead of value clipping to 0.53% while maintaining a Critical SDC coverage of 97.05%.

An interesting value clipping method is FT-ClipAct, proposed by Hoang et al. [12]. This approach consists of modifying the DNN during the early design stages by replacing the unbounded Relu activation functions with a Relu layer with a maximum bound value. The FT-ClipAct method can achieve similar results to the Smartpooling and Ranger approaches but with near-zero time overhead at the application level.

C. Fault-Aware Training

Probably the most promising and original solution to improve efficiently the reliability of DNNs is to exploit their potential. DNNs perform well for tasks for which they have been trained. Faults are critical for a DNN for the reason that the DNN is not expecting their occurrence. It is possible to reduce fault criticality by training the DNNs to behave correctly, even in the presence of faults. This is the basic concept of Fault-aware training. The network familiarizes itself with the occurrence of faults by injecting a subset of faults during training. Typically, a corruption is injected into a convolution output, and the network is asked to still detect or classify the objects correctly. As a result, the model learns how to deal with faults. This solution has been proved promising for quantized DNNs [17] and extended to complex DNNs executed on GPUs [18].

V. FUTURE CHALLENGES AND OPPORTUNITIES

The field of ML is advancing at an unprecedented pace. The complexity and size of DNNs are growing rapidly, bringing new challenges and opportunities to apply them in various fields. One of the next frontiers for employing DNNs is space exploration. For space applications, DNNs must be fault-tolerant due to the extreme radiation environment and have the

<figure><img src="image_7.png" /><figcaption>Fig. 4. Normalized Critical SDC FIT rate for the unprotected baseline ViT models and the models protected with value clipping.</figcaption></figure>

best performance per watt ratio as they operate with limited resources.

In the context of constrained devices, DNN design is a critical step. The machine learning community has recently introduced the concept of *Frugal DNNs*, where the design is aimed at systems with limited power consumption and resources. Then, it is mandatory to evaluate the fault sensitivity of Frugal DNN designs before deploying them in safety- and mission-critical applications, as it will undoubtedly impact their reliability.

As the complexity and number of transistors of DNN accelerators increase, other sources of failures, such as degrading, intermittent, and permanent faults, are becoming a concern in both research and industry [2], [4], [5], [9]. While techniques like memory SECDED are efficient for memory protection, for complex applications that use large amounts of computing resources like DNNs, software fault tolerance is a more cost-effective and quickly deployable option. Recent studies have shown that value clipping and fault-aware training have the potential to address permanent [19], [20] and timing faults [21]. Additionally, quantized and optimized frugal DNNs can help mitigate performance degrading effects (e.g., performance reduction due to aging) and extend the lifetime of the system without compromising the model's accuracy.

Lastly, recent advances in ML include the development of Transformers models [22]. These models have surpassed all other types of DNNs in terms of accuracy in both natural language processing and vision applications [22]. Our recent research has shown that value clipping techniques can still be effective in Vision Transformers (ViTs) [23]. Figure 4 shows the Critical SDC FIT rate for the ViTs, measured under ChipIr neutron beam. The figure also confirms the effectiveness of the corrupted value clipping in preventing Critical SDCs. The Critical SDC FIT rate of unprotected versions is always higher than the ones protected by value clipping. On average, the Critical SDC FIT rate of unprotected models is 4.37, whereas the ones protected by value clipping have an average of 1.07.

VI. CONCLUSIONS

ML is rapidly transforming modern computing, providing a broad range of capabilities from pattern recognition to
decision-making, which is essential for applications like autonomous vehicles and space missions. However, the integration of ML into safety-critical systems introduces challenges due to its probabilistic nature and the complexity of the required hardware, raising concerns about the reliability of decisions and the potential for unpredictable errors. Novel fault assessment methodologies need to address these issues to ensure accuracy and reliability in real-world conditions.

To enhance the reliability of ML in mission- and safety-critical applications, it is essential to develop hardening solutions tailored to the unique characteristics of ML accelerators and the computational demands of inference tasks. This consists of a deep understanding of the error tolerance of neural networks and the hardware's behavior under adverse conditions, like radiation exposure. A collaborative effort among researchers, particularly in radiation effects, is necessary to develop a validated fault model and rigorous experimental validation of hardening solutions. This approach aims to establish a new standard of reliable computing that can effectively support the advanced capabilities of ML-based applications.

## REFERENCES

[1] F. Su, C. Liu, and H.-G. Stratigopoulos, "Testability and dependability of ai hardware: Survey, trends, challenges, and perspectives," *IEEE Design & Test*, vol. 40, no. 2, pp. 8-58, 2023.

[2] C. Torres-Huitzil and B. Girau, "Fault and error tolerance in neural networks: A review," *IEEE Access*, vol. 5, pp. 17322-17341, 2017.

[3] S. Kundu, S. Banerjee, A. Raha, S. Natarajan, and K. Basu, "Toward functional safety of systolic array-based deep learning hardware accelerators," *IEEE Transactions on Very Large Scale Integration (VLSI) Systems*, vol. 29, no. 3, pp. 485-498, 2021.

[4] B. Salami, O. S. Unsal, and A. C. Kestelman, "On the resilience of rt1 nn accelerators: Fault characterization and mitigation," in *2018 30th International Symposium on Computer Architecture and High Performance Computing (SBAC-PAD)*, pp. 322-329, 2018.

[5] J. D. Guerrero Balaguera, J. E. Rodriguez Condia, F. Fernandes Dos Santos, M. Sonza Reorda, and P. Rech, "Understanding the effects of permanent faults in gpu's parallelism management and control units," in *Proceedings of the International Conference for High Performance Computing, Networking, Storage and Analysis, SC '23*, (New York, NY, USA), Association for Computing Machinery, 2023.

[6] V. Turco, A. Ruospo, E. Sanchez, and M. S. Reorda, "Early detection of permanent faults in dnn's through the application of tensor-related metrics," in *2024 27th International Symposium on Design & Diagnostics of Electronic Circuits & Systems (DDECS)*, pp. 13-18, 2024.

[7] F. F. d. Santos, P. F. Pimenta, C. Lunardi, L. Draghetti, L. Carro, D. Kaeli, and P. Rech, "Analyzing and Increasing the Reliability of Convolutional Neural Networks on GPUs," *IEEE TR*, 2019.

[8] R. Baumann, "Soft errors in advanced computer systems," *IEEE Design & Test of Computers*, vol. 22, no. 3, pp. 258-266, 2005.

[9] D. Mitra, S. Bhattacharjee, S. Sur-Kolay, B. Bhattacharya, S. Zachariah, and S. Kunduc, "Test pattern generation for power supply droop faults," in *19th International Conference on VLSI Design held jointly with 5th International Conference on Embedded Systems Design (VLSID'06)*, pp. 6 pp.-, 2006.

[10] G. Li, S. K. S. Hari, M. Sullivan, T. Tsai, K. Pattabiraman, J. Emer, and S. W. Keckler, "Understanding error propagation in deep learning neural network (dnn) accelerators and applications," in *SC17: International Conference for High Performance Computing, Networking, Storage and Analysis*, pp. 1-12, 2017.

[11] S. K. S. Hari, M. B. Sullivan, T. Tsai, and S. W. Keckler, "Making convolutions resilient via algorithm-based error detection techniques," *IEEE TDSC*, 2022.

[12] L.-H. Hoang, M. A. Hanif, and M. Shafique, "Ft-clipact: resilience analysis of deep neural networks and improving their fault tolerance using clipped activation," in *Proceedings of the 23rd Conference on Design, Automation and Test in Europe*, DATE '20, (San Jose, CA, USA), p. 1241-1246, EDA Consortium, 2020.

[13] C. Bolchini, L. Cassano, A. Miele, and A. Toschi, "Fast and Accurate Error Simulation for CNNs Against Soft Errors," *IEEE TC*, 2022.

[14] K.-H. Huang and J. A. Abraham, "Algorithm-based fault tolerance for matrix operations," *IEEE TC*, vol. C-33, pp. 518-528, June 1984.

[15] F. Libano, P. Rech, and J. Brunhaver, "Efficient error detection for matrix multiplication with systolic arrays on fpgas," *IEEE Transactions on Computers*, pp. 1-14, 2023.

[16] Z. Chen, G. Li, and K. Pattabiraman, "A low-cost fault corrector for deep neural networks through range restriction," in *2021 51st Annual IEEE/IFIP International Conference on Dependable Systems and Networks (DSN)*, (Los Alamitos, CA, USA), pp. 1-13, IEEE Computer Society, jun 2021.

[17] U. Zahid, G. Gambardella, N. J. Fraser, M. Blott, and K. A. Vissers, "FAT: training neural networks for reliable inference under hardware faults," in *ITC*, 2020.

[18] N. Cavagnero, F. D. Santos, M. Ciccone, G. Averta, T. Tommasi, and P. Rech, "Transient-fault-aware design and training to enhance dnn's reliability with zero-overhead," in *IEEE IOLTS*, 2022.

[19] J. Zhang, T. Gu, K. Basu, and S. Garg, "Analyzing and mitigating the impact of permanent faults on a systolic array based neural network accelerator," in *2018 IEEE 36th VLSI Test Symposium (VTS)*, (Los Alamitos, CA, USA), pp. 1-6, IEEE Computer Society, apr 2018.

[20] M. A. Hanif and M. Shafique, "efat: Improving the effectiveness of fault-aware training for mitigating permanent faults in dnn hardware accelerators," 2023.

[21] J. Deng, Y. Fang, Z. Du, Y. Wang, H. Li, O. Temam, P. Ienne, D. Novo, X. Li, Y. Chen, and C. Wu, "Retraining-based timing error mitigation for hardware neural networks," in *2015 Design, Automation & Test in Europe Conference & Exhibition (DATE)*, pp. 593-596, 2015.

[22] A. Dosovitskiy, L. Beyer, A. Kolesnikov, D. Weissenborn, X. Zhai, T. Unterthiner, M. Dehghani, M. Minderer, G. Heigold, S. Gelly, J. Uszkoreit, and N. Houlsby, "An image is worth 16x16 words: Transformers for image recognition at scale," *ICLR*, 2021.

[23] L. Roquet, F. Fernandes dos Santos, P. Rech, M. Traiola, O. Sentieys, and A. Kritikakou, "Cross-Layer Reliability Evaluation and Efficient Hardening of Large Vision Transformers Models," in *Design Automation Conference (DAC)*, (San Francisco, United States), June 2024.

<figure><img src="image_8.png" /></figure>

Fernando Fernandes dos Santos received his Ph.D. from the Federal University of Rio Grande do Sul, Porto Alegre, Brazil, in 2021. He specializes in parallel architecture reliability, efficient hardening techniques, and mitigating radiation effects. He is working at INRIA Rennes on improving the fault tolerance and reliability of RISCV processors and DNN accelerators.

<figure><img src="image_9.png" /></figure>

Paolo Rech received his Ph.D. from Padova University, Italy, in 2009. Since 2022, Paolo has been an associate professor at Università di Trento. Before 2022, he was an associate professor at UFRGS in Brazil. His research interests include evaluating and mitigating radiation-induced effects in automotive applications, space exploration, large-scale HPC centers, and quantum computers.