# Strategic Input Selection For Deep Neural Networks Reliability Evaluation

Lucas Roquet, Fernando Fernandes dos Santos, Maria Kastriotou, Angeliki Kritikakou

► To cite this version:

Lucas Roquet, Fernando Fernandes dos Santos, Maria Kastriotou, Angeliki Kritikakou. Strategic Input Selection For Deep Neural Networks Reliability Evaluation. NSREC 2025 - IEEE Nuclear & Space Radiation Effects Conference, IEEE, Jul 2025, Nashville (Tennessee), United States. pp.1-5.
hal-05006303

HAL Id: hal-05006303

https://hal.science/hal-05006303v1

Submitted on 26 Mar 2025

HAL is a multi-disciplinary open access
archive for the deposit and dissemination of sci-
entific research documents, whether they are pub-
lished or not. The documents may come from
teaching and research institutions in France or
abroad, or from public or private research centers.

L'archive ouverte pluridisciplinaire HAL, est
destinée au dépôt et à la diffusion de documents
scientifiques de niveau recherche, publiés ou non,
émanant des établissements d'enseignement et de
recherche français ou étrangers, des laboratoires
publics ou privés.

<figure><img src="image_1.png" /></figure>

Distributed under a Creative Commons Attribution 4.0 International License
# Strategic Input Selection For Deep Neural Networks Reliability Evaluation

Lucas Roquet, Fernando Fernandes dos Santos, Maria Kastriotou, Angeliki Kritikakou

**Abstract**

We present a robust methodology for selecting inputs for DNNs in radiation experiments. Using our approach, we obtained a 12.19× higher DNN misclassification rate on average compared to the commonly used random input selection.

**Corresponding and Presenting Author:** Lucas Roquet is with Institut national de recherche en informatique et en automatique (INRIA), France Campus de Beaulieu, 263 Av. Général Leclerc, 35042 Rennes, France, +33299847218.

**Contributing Authors:**

Fernando Fernandes dos Santos, Angeliki Kritikakou, are with INRIA, France.

Maria Kastriotou is with ISIS Neutron and Muon Source, United Kingdom.

**Session Preference:** E: Radiation Effects in Devices and Integrated Circuits

**Presentation Preference:** Oral
# I. INTRODUCTION

Deep neural networks (DNNs) have become state-of-the-art machine learning (ML) methods with high accuracy and capabilities in solving complex problems in various domains such as natural language processing, computer vision, radar processing, or medical applications. DNNs' remarkable accuracy makes them a suitable option to be adopted in safety- and mission-critical systems such as autonomous driving and avionics. As reliability is a mandatory requirement in such systems, DNNs' reliability has to be correctly assessed.

In safety- and mission-critical systems, large and complex hardware accelerators such as Graphical and Tensor Processing units (GPUs and TPUs) enable the deployment of DNNs with high performance and efficiency. However, those hardware accelerators are vulnerable to transient faults induced by ionizing radiations [1], [2]. Thus, to assess the reliability of DNN-based applications against ionizing radiation, researchers and engineers often perform two main approaches, radiation testing or fault simulation. Radiation testing provides realistic results as the system is exposed to real ionizing particles, however, collecting statistically meaningful data can be challenging, and the failure is only observed at the output of the application, limiting the fault propagation visibility. On the contrary, fault simulation allows a detailed fault propagation analysis since faults can be injected into specific parts of the hardware or software. Fault simulation, however, can lead to irrelevant results as the fault models are set by the user and can be unrealistic. In this paper, we use both approaches to provide an in-depth evaluation of the radiation faults on DNN models<fnref n="1" />.

When beam experiments and fault simulation are used to evaluate complex and large DNNs with many input possibilities, performing exhaustive reliability evaluation becomes highly unachievable. The combinations of input, model variants, and hardware accelerator optimizations become so large that simply performing exhaustive radiation experiments and fault simulation is impractical due to the resources and time required to gather significant results. To reduce the evaluation space of DNN systems, researchers and engineers often select a small subset of inputs [3]. However, the subset chosen might bias the experimental results because of its composition [4].

Our goal is to develop a strong input selection methodology that reduces the risk of biased results. To achieve that we detail, in Section III, a novel method to select inputs for DNN reliability assessment that considers the model and input characteristics in the analysis. We anticipate that the proposed method presents a critical failure rate of the DNNs evaluated that is on average 12.19× higher than a commonly random selection used in recent works. We propose a method for DNN radiation testing<fnref n="1" /> based on the model's confidence. By selecting both Low-confidence inputs (where the model hesitates between two predictions) and High-confidence inputs (where the model is very sure about its prediction) we show that we can gather very optimistic and pessimistic critical failure rates for DNNs that can differ in 1 order of magnitude. We conducted neutron beam experiments on 2 DNNs running on GPUs to validate our method and compared the critical failure

rates with the commonly used random selection approach. For each DNN, we assess 4 different configurations of input selection, totaling more than 90 hours of ChipIr beam time. Our contributions are:

* A method to profile DNN models to gather and sort the predictions confidence. Our methodology can be applied to any dataset and DNN used for vision tasks.

* A pre-radiation testing input selection approach that can split select inputs that lead to optimistic and pessimistic failure rates of DNNs.

* An end-to-end methodology for reliability evaluation of DNNs for image classification that is applicable for radiation experiments and fault simulation<fnref n="1" />.

# II. BACKGROUND

A DNN comprises multiple interconnected layers that process input data to return a prediction. DNNs can be decomposed into three parts. The first part is the input layer that processes the raw data (i.e., text, images, etc.). The second part is the hidden layers, which perform operations on the input, aiming to extract features from it. The final part is the output layer that returns the model's prediction. DNNs can be trained to perform classification tasks such as image classification [5]. During the training phase, an image classification DNN will learn how to classify *N* different classes by iterating over multiple times on an *image dataset*. After the training phase, the DNN will be deployed to perform inference, which consists of feeding input to the DNN, which will produce a set of *N* probabilities associated with each class on the input image (prediction logits). The final prediction (i.e. the classification) of the DNN will be the class with the highest probability.

In this work, we evaluate a specific type of DNN, Vision Transformers (ViTs) [5], which are the state-of-the-art methods for image classification, object detection [6], and image segmentation [7]. One characteristic of ViTs is that they are very large compared to other types of DNNs, their parameter count ranges from millions to billions. Given the large size of ViTs, GPUs and TPUs are needed to enable DNNs' effective deployment. In this work, we used GPUs as DNN hardware accelerators, which have been widely demonstrated to be heavily impacted by different types of ionizing radiation, such as atmospheric neutrons, protons, and heavy ions [1]. Radiation-induced faults have a non-negligible impact on DNNs posing a reliability threat by highly degrading their accuracy [8].

Ionizing radiation can induce transient faults in hardware leading to soft errors, which can be masked, or cause failures in the system such as **Detected Unrecoverable Errors (DUEs)** – crash or system reboot – or **Silent Data Corruptions (SDCs)** – incorrect output of the program. For DNNs, we can categorize SDCs into two types: **Tolerable SDCs** happen when the model output is modified (prediction logits) but the final classification remains correct, whereas **Critical SDCs** the TOP1 classification probability is changed (misclassification).

To assess the impact of radiation-induced faults on DNNs, researchers, and engineers can perform accelerated beam experiments. Performing accelerated beam experiments requires a certain amount of time to obtain statistically significant

<footnote n="1">¹fault simulation will be presented on the final paper, see Section III</footnote>
<figure><img src="image_2.png" /><figcaption>Fig. 1: 3-step methodology for input selection. **a** we profile the whole dataset+DNN to collect the prediction probabilities for each input image (prediction logits). **b** we analyze the data to compute the input confidence based on the logits. **c** We divided the dataset into Low- and High-confidence image sets and evaluated a subset of each under radiation experiments.</figcaption></figure>

results, i.e., enough number of events or fluence [9]. Additionally, the current complexity of the system composed of heterogeneous hardware combined with many layers of software makes radiation testing much more difficult due to the multiple-level masking and complex fault models [1].

Given the complexity of large DNNs and the size and diversity of existing datasets, researchers often have to perform beam experiments with DNNs on a subset of a chosen dataset. For image classification DNNs' testing, it is common to pick random inputs among the whole dataset [1]–[3] and run the DNN repeatedly with the same input to gather statistically meaningful data. However, testing on a smaller subset might lead to biased results as it may not reflect the diversity of the chosen dataset or even corner-case scenarios [4].

To minimize bias from random input selection, the ideal approach would be to evaluate the entire dataset. However, this is impractical due to the time and resources needed to obtain meaningful results. For example, the ImageNet validation set consists of 50,000 images, and assuming we could record 50 events in one hour of beam time for each image, it would take ≈ 5.71 years to gather enough statistical data for a single dataset. It is worth noting that this is a very optimistic assumption [1], [2], as testing complex devices might yield zero events even after a long period of beam testing [9]. It is, then, necessary to develop improved and customized methods for beam testing of DNNs to reduce the bias of a naive random selection. In the next section, we present a novel methodology for input selection to evaluate large DNN models for image classification on accelerated beam experiments.

### III. PROPOSED APPROACH FOR INPUT SELECTION

We propose a solid approach for selecting inputs for DNN radiation testing by classifying inputs based on the model's confidence. This method allows bounding random input critical failure results between a very pessimistic critical failure rate and a very optimistic critical failure rate. Fig. 1 depicts the general methodology of our analysis in three steps. In this section, we explain the three steps of our proposed methodology: **a) Profiling**; **b) Data analysis and input classification**; and **c) Beam experiments**.

**a) Profiling:** The first step of our method (step **a**) is to profile the dataset to gather useful data. Given a selected

model, we run inference on each image of the dataset validation set. Most image classification datasets are divided into 3 parts: i) the training set, for training; ii) the test set (unlabeled elements used to test the model); iii) the validation set, which contains labeled inputs (i.e. the ground truth result that the model should return) used to get the model's accuracy. In this work, we selected the ImageNet validation dataset composed of 50,000 images divided into 1,000 different classes. It is worth noting that our approach works with any dataset. From the validation set, we can extract if the DNN correctly predicts the class of each input, and the set probabilities associated with each class of each input, including the *TOP1* (final classification of the model) and *TOP2* (second highest classification probability) probabilities. All of these data are stored in a database for post-processing in the next phase.

**b) Data analysis and input classification:** Using profiling data, we can extract different metrics to select the inputs (step **b**). First, we can classify the input images into two classes: the correct predictions and the wrong ones (the label of the inference produced by the model is the same or not with the ground truth). In this work, we only focus on the correct predictions as they will provide the most valuable insights about the model misclassification rates (i.e. Critical SDCs). Secondly, from the correct predictions subset, we can compute its confidence for each image. The confidence [4] of input is given by the difference between the *TOP1* probability and the *TOP2* probability, i.e., *TOP1* – *TOP2*. If the difference is close to 1, this means that the model is very confident about its result. On the opposite, if the difference is close to zero, it means that the model is not confident between the two classes and might even have a random guess.

Fig. 2 shows the confidence distribution extracted for a ViT DNN and 2 examples of inputs extracted from the High- and Low-confidence subsets. In the horizontal axis Fig. 2a) shows the *TOP1* – *TOP2* difference, and in the vertical axis the observed frequency on the ImageNet validation dataset. For all DNNs evaluated in this work using ImageNet (details on Section IV) the confidence distribution is very similar. Thus we show only the ViT distribution given space constraints. In the final paper, we will present data for all the models we evaluate. In this step we propose to extract two subsets from the data in Fig. 2, the *lowest* and the *highest* confidences. We
<figure><img src="image_3.png" /><figcaption>Fig. 2: Fig.a) depicts ViT's confidence distribution for the correct predictions (from Imagenet dataset). We build two subsets called Low- and High-confidence inputs that are used in the beam experiments. Fig.b) and Fig.c) show one example of each subset, to exemplify how the model changes its confidence when the image's complexity and context change.</figcaption></figure>

<figure><img src="image_4.png" /><figcaption>Fig. 3: RTX A2000 GPUs aligned on ChipIR's beamline.</figcaption></figure>

hypothesize that images with high and low confidence will change the model's sensitivity to a fault. For a fault to cause a Critical SDC (misclassification) on an input that the model is very confident about is much harder than for it to cause a Critical SDC on an image that the model has low confidence in (it is easier to change the *TOP1* probability). We show that this is the case in Section V. To exemplify how the complexity of the input can change the model's confidence we show an example in Fig. 2.b) from the ViT High-confidence set, where the model is 96% sure that a dog is on the image, contrary to Fig. 2.c) where the model is not sure if it is an old car, an ambulance, or a fire truck, resulting in a confidence of 0.1%.

**c) Beam experiments:** The final step (❶) of our analysis is the model reliability evaluation with beam or fault simulation. In this step we can then extract the failure rate of the different subsets we extracted using step (❸) step. In this paper, due to space constraints, we focus on neutron beam experiments. However, this approach can also be employed for fault simulation. The final paper will include an exhaustive evaluation of input dependency based on software fault injections. We will show that, by using a software fault model, specific to ViT DNNs, extracted from previous neutron beam experiments we can perform fault injections in multiple High-/Low-confidence subsets for a comprehensive evaluation.

## IV. EXPERIMENTAL SET-UP

In this section, we present the experimental methodologies used to validate the strategy we proposed in Section III.

**a) Devices Under Test:** We performed neutron experiments on 3 RTX A2000 GPUs of NVIDIA's Ampere architecture. The Ampere architecture is built with TSMC 7nm FinFET. The RTX A2000 has 256 KB registers per Streaming Multiprocessor and a power consumption of 75W. The RTX A2000 features an L1 cache of 128 KB per SM, an L2 cache of 3MB, 3328 CUDA cores, and a core frequency of 1200 MHz. RTX A2000 also has SECDED ECC to protect registers, caches, and GDDRs. We conducted all tests with ECC enabled.

**b) Evaluated DNNs:** We evaluated 2 ViT models from the HuggingFace library (v0.8.19) [10]: original ViT [5], and Swin [6]. Vit and Swin have an accuracy of 84.50% and 85.20% respectively. When running on the GPU, ViT occupies 333MB of memory and Swin occupies 343MB. For the experiments, we used a Python program with PyTorch v2.0.0 to load the ViT and perform inferences on a batch of images from the ImageNet dataset [11].

**c) Input Selection:** For the input selection, we used the methodology presented in Section III. Additionally, to compare the proposed methodology with the ones used in previous works [1], [2], i.e. two random input selection configurations. The random sets were selected by setting two different random seeds. The first one is with `seed = 0`, denoted as Rand Z and the second one, with a large seed (`seed = 29052001`), denoted as Rand L. For the neutron beam experiments, we tested four configurations for each model. We build batches of 32 images for each subset: 1) *Low-confidence* input sets are built with the 32 lowest confidence predictions; 2) *High-confidence* with the 32 highest confidence predictions; 3) *Inputs of random batches are picked among the whole ImageNet validation set*. It is worth noting that *High-confidence* and *Low-confidence* sets comprise *only correct predictions*, whereas random inputs will contain inputs on which the model has correct and wrong predictions.

**d) Physical fault injection at ChipIr:** The experiments were performed at the ChipIr facility of the Rutherford Appleton Laboratory, UK [12]. This facility has been designed to perform neutron beam testing on electronic devices, providing the adequate test bench needed for the experiments. It notably allows the exposure of multiple devices at the same time. ChipIr provides similar energy ranges to the atmospheric ones
<figure><img src="image_5.png" /><figcaption>Fig. 4: SDC, DUE, and Critical SDC Cross-sections</figcaption></figure>

with a neutron flux $10^9 \times$ higher. Fig. 3 shows the installed setup, consisting of GPUs aligned with the neutron beam and connected to the motherboard. On average each configuration received a fluence of $3.33 \times 10^{10}$ n/cm².

## V. EXPERIMENTAL RESULTS

In this section, we discuss the results obtained on the beam experiments for SDC and DUEs. Then we show the effectiveness of our input selection approach described in Section III by analyzing the Critical SDC cross-section.

Fig. 4 depicts the Overall SDC, DUE, and Critical SDC cross-sections. The x-axis shows the different configurations and the y-axis shows the cross-section values. The statistical error is calculated according to Quinn's method [13].

a) **SDC Cross-sections:** High-confidence subset demonstrates the highest SDC cross-section. $6.45 \times 10^{-9}$ for Swin and $8.79 \times 10^{-9}$ for ViT. This is because these sets contain only correct predictions that the model is very confident about. A fault that propagates has less chance to impact the *TOP1* probability, but will slightly impact other probabilities, which do not impact the classification, resulting in Tolerable SDCs.

For the Low-confidence, Rand Z, and Rand L configurations we observe slightly lower overall SDC cross-sections than the High-confidence sets. The SDC cross-section for the Low-confidence subset is on average $4.94 \times 10^{-9}$, and for the random inputs, the SDC cross-section is on average $4.25 \times 10^{-9}$. Note that, each set is composed of different images, with no overlap between the sets. Therefore, differences in the overall SDC cross-sections are expected.

Fig. 4 shows that the Low-confidence subsets are the most vulnerable configurations, and generated the highest Critical SDC cross-sections. The average Critical SDC cross-section of $8.23 \times 10^{-10}$. Contrarily, random and High-confidence configurations demonstrate on average a Critical SDC cross-section of $1.7 \times 10^{-10}$. These results follow our hypothesis discussed in Section III, where even a small error that propagates through the DNN can change the probability of the *TOP1* class for inputs that the model is not confident, leading to a Critical SDC.

Table I shows the Critical SDCs ratio between the inputs selected using our approach vs the randomly selected inputs. That is, the number of Critical SDCs of confidence-based sets (High-confidence or Low-confidence) is divided by randomly

<table><caption>TABLE I: Ratio between Critical SDCs observed for High-/Low-Confidence subsets divided by Random Input subsets.</caption><thead><tr><th></th><th>High Conf. Subset</th><th>Low Conf. Subset</th></tr></thead><tbody><tr><td rowspan="2">Swin</td><td>Rand Z subset</td><td>1.77x</td><td>5.97x</td></tr><tr><td>Rand L subset</td><td>1.02x</td><td>3.44x</td></tr><tr><td rowspan="2">ViT</td><td>Rand Z subset</td><td>2.61x</td><td>17.22x</td></tr><tr><td>Rand L subset</td><td>3.36x</td><td>22.13x</td></tr></tbody></table>

selected inputs (Rand Z or Rand L sets). The number of Critical SDCs observed for the High confidence subsets is only $2.19 \times$ higher on average than the Critical SDCs observed for randomly selected input subsets. On the contrary, Low-confidence subsets show on average $12.19 \times$ higher Critical SDCs than the random subsets. In the worst-case scenario observed during all the experiments, for ViT DNN, the number of Critical SDCs for the Low-confidence subset can be $22.13 \times$ higher than Rand L. This notably shows that picking random inputs results in optimistic error rates.

b) **DUE Cross-sections:** All configurations exhibit high DUE rates, $1.14 \times 10^{-8}$ on average for Swin and $1.46 \times 10^{-8}$ for ViT. DUEs are caused by multiple factors such as illegal memory access or ECC uncorrectable errors (the GPU driver throws an exception when a double error is detected). As ViTs are resource-demanding DNNs, they perform a lot of memory and parallel operations, increasing the probability of illegal memory access or load on the hardware schedulers, resulting in high DUE rates. For all the DUEs observed during the experiments, 87.10% were caused by application crashes by ECC uncorrectable, 6.20% illegal memory accesses, and 6.70% from other reasons.

## VI. CONCLUSIONS

We proposed a robust method for input selection for DNN radiation testing and validated it with neutron beam experiments. Our method considers the diversity of inputs regarding a DNN and a dataset and helps to provide a broader analysis for radiation testing and valuable insights into DNN's reliability. For the final paper, we will present an exhaustive evaluation with a software fault simulator with fault models extracted from beam experiments. By using fault simulations we will further demonstrate the effectiveness of our approach. Additionally, all the databases (app log files, codes, fault simulation logs, etc) will be made open source to allow the full reproducibility of our results.

## REFERENCES

[1] P. Rech, *IEEE TNS*, 2024.

[2] I. Rodriguez-Ferrandez et al., in *IEEE IOLTS*, 2024.

[3] L. M. Luza et al., *IEEE TETC*, 2021.

[4] S. Wang et al., in *ISSSR*, 2024.

[5] A. Dosovitskiy et al., in *ICLR*, 2021.

[6] Z. Liu et al., in *IEEE/CVF ICCV*, 2021.

[7] Y. Fang et al., 2023. arXiv: 2303.11331 [cs.CV].

[8] F. F. d. Santos et al., *IEEE TR*, 2019.

[9] H. Quinn et al., *IEEE TNS*, 2024.

[10] R. Wightman, *huggingface.co/timm*.

[11] J. Deng et al., in *IEEE CVPR*, 2009.

[12] C. Cazzaniga et al., *IEEE TNS*, 2024.

[13] H. Quinn, *IEEE TNS*, 2014.