SlowGuess/NeurIPS_2023_OCR huggingface dataset:
Table 1: The tables present results across various backbones, reporting top-1 accuracy on the ImageNet [10] validation set for both the baseline and our method. Additionally, we report the change in total parameters and FLOPs (a negative sign indicates a decrease), the improvement in last-layer and overall model reliability, and a percentage increase in Top2Diff.
Backbone	Acc. Baseline	Acc. Ours	Additional Params (w.r.t baseline)	Additional FLOPs (w.r.t baseline)	Improvement in Reliability (Last Layer)	Improvement in Reliability (Overall)	Improvement in Top2Diff
Alexnet [31]	56.43%	57.28%	-1.49M	-1.50M	7.92×	4.67×	2.83%
VGG-16-BN [57]	73.45%	72.96%	-1.49M	-1.50M	14.43×	9.64×	1.62%
VGG-19-BN [57]	74.40%	74.01%	-1.49M	-1.50M	13.29×	8.67×	1.13%
ResNet-18 [20]	69.60%	69.68%	0.26M	0.26M	2.87×	1.91×	3.07%
ResNet-34 [20]	73.25%	72.62%	0.26M	0.26M	3.89×	2.53×	2.08%
ResNet-50 [20]	75.64%	74.84%	-0.49M	-0.49M	4.48×	2.96×	3.35%
ResNet-101 [20]	77.25%	75.52%	-0.49M	-0.49M	4.33×	2.77×	3.13%
ResNet-152 [20]	77.98%	76.18%	-0.49M	-0.50M	4.47×	2.85×	3.09%
MobileNet-V2 [24]	71.87%	71.83%	-0.11M	-0.09M	3.92×	2.43×	5.36%
MaxViT-T [60]	82.98%	83.08%	0.26M	0.28M	3.38×	2.63×	2.62%
Swin-V2-T [37]	80.97%	80.02%	0.13M	0.15M	1.65×	1.07×	2.85%
Swin-V2-S [37]	82.71%	82.86%	0.13M	0.15M	3.51×	2.60×	3.04%
FocalNet-T [65]	80.23%	80.77%	0.13M	0.14M	3.87×	2.61×	2.61%
FocalNet-S [65]	82.01%	82.52%	0.13M	0.14M	4.73×	3.50×	3.10%
Accuracy impact: Our proposed model has a small accuracy reduction on the backbone compared to the baseline, ranging from  $-1.77\%$  to  $+0.52\%$ , for an average decrease of  $3\%$ . Despite the reduction, we find that our proposed model is in fact more confident in its accurate predictions based on the difference between the top two classes (the Top2Diff). For ResNet50, the Top2Diff for the baseline model is  $70.32\%$ , while the Top2Diff of our model is  $73.67\%$ , a  $+3.35\%$  improvement. A similar phenomenon is observed across all models, where the average Top2Diff increases by  $2.50\%$ . Further, we perform an additional study in §7.4, where we empirically show that this accuracy impact is indeed minimal, especially compared to the upside observed in reliability improvement.
Table 2: The tables present results across various datasets (CIFAR10 [29], CIFAR100 [30], FOOD101 [3], and STL10 [9]) for two backbones (ResNet-50 [20] and FocalNet-T [65]), reporting top-1 accuracy on the respective validation set for both the baseline and our method. Additionally, we report the improvement in last-layer and overall model reliability, and a percentage increase in Top2Diff.
Dataset	Backbone	Acc. Baseline	Acc. Ours	Improvement in Reliability (Last Layer)	Improvement in Reliability (Overall)	Improvement in Top2Diff
CIFAR10 [29]	ResNet-50 [20]	95.07%	95.29%	2.04x	1.71x	6.70%
CIFAR10 [29]	FocalNet-T [65]	94.76%	94.94%	2.47x	1.30x	3.58%
CIFAR100 [30]	ResNet-50 [20]	78.23%	78.53%	2.19x	1.65x	3.69%
CIFAR100 [30]	FocalNet-T [65]	77.06%	79.21%	3.21x	1.58x	2.90%
FOOD101 [3]	ResNet-50 [20]	83.13%	83.97%	2.66x	2.15x	2.78%
FOOD101 [3]	FocalNet-T [65]	85.64%	85.91%	3.28x	2.85x	1.70%
STL10 [9]	ResNet-50 [20]	47.73%	52.68%	2.10x	1.91x	2.45%
STL10 [9]	FocalNet-T [65]	62.74%	63.78%	2.23x	1.72x	1.96%
Model Size and Runtime Impact: Our proposed method marginally increases the total number of parameters, on average, by  $0.18M$  compared to the baseline. This reduction is model-dependent, as it depends on the second-to-last layer feeding into the latent representation  $(B\times E)$  before moving onto the projection layer  $(E\times C)$  for the final prediction. A few models (such as deeper ResNet's and VGG) actually observe a slight decrease in total model parameters, which is topology dependent. This parameter difference translates to a small increase/decrease of FLOPs during inference, respectively, as show in column 5. Overall, our proposed technique produces models with similar size and runtime to the baseline on average.
Evaluation on Additional Datasets: We evaluate our method on additional datasets (CIFAR10 [29], CIFAR100 [30], Food101 [3], and STL10 [9]) for two networks: ResNet-50 [20] and FocalNet-T [65]. Our results, shown below in Table 2, validate that our technique is general and can work across an array of model types and datasets. Furthermore, we did not have to modify any hyperparameters in the process, suggesting the ease of our technique as well as the increased benefit from a reliability point of view. Additionally, adding these new datasets further support our claims that our technique has negligible impact on model training accuracy, whilst still providing us with a large upside in resilience.
Reliability Evaluation: Most importantly, our proposed technique significantly improves the hardware reliability of the model, as this was the intention behind the method. The most significant change occurs on the last layer, where the average reduction is model-family specific. In other words, the ResNet family observes an average  $4.01 \times$  hardware reliability improvement and the VGG family observes a  $13.68 \times$  improvement on the final layer, using the  $\Delta$ Loss metric as explained in §5. This difference is related to the baseline backbone, where in general the ResNet family baseline can be considered more reliable than the VGG family to hardware errors [41], resulting in a larger improvement with our proposed technique for the less robust model family (VGG). Overall, we observe improvements across the board for all models studied, signifying the benefits of our technique. Similarly, looking at a model's end-to-end hardware reliability, we find the average to be  $9.16 \times$  better for the VGG family, and  $2.61 \times$  for the ResNet family. While this value is strongly influenced by the last layer, we observe that most layers in the network do get a modest hardware resilience improvement, captured by the averages listed in the table and additional results in Appendix C.
7 Discussion and Analysis
We perform a series of additional studies to validate and better understand the insights of our proposed method. First, we describe an ablation study on the initialization of the projection layer in §7.1. Second, we provide a qualitative explanation of the impact of errors on the baseline versus our proposed method using the state-of-the-art Ablation-CAM visualization in §7.2. Third, we analyze the impact of the baseline training versus our method's training on the activation values produced by each model, and use this to provide an intuitive explanation for the improved hardware reliability in §7.3. Finally, in §7.4, we further discuss the tradeoff between the small accuracy drop on the validation set compared with the large improvement in hardware reliability by studying the output classification accuracy of images.
7.1 Ablation Study
Our ablation study (Table 3) measures the improvement in hardware reliability for different projection initialization techniques on ResNet50. We compare 1) a random initialization, 2) a CLIP-based initialization ("a photo of a [CLASS]" prompt), and 3) our CLIP+GPT-3 initialization.
Table 3: Ablation for type of initialization on the projection layer. CLIP refers to a simple hand-crafted prompt "a photo of a [CLASS]" while  $\mathrm{CLIP + GPT}$  refers to the proposed method in  $\S 4$
Backbone	Projection Initialization	Improvement in Reliability (Last Layer)	Improvement in Reliability (Across Backbone)
ResNet-50	random	1.74×	1.09×
ResNet-50	CLIP	5.06×	3.28×
ResNet-50	CLIP+GPT-3	6.09×	3.93×
In general, we find that any text-based projection initialization helps improve reliability, as observed via the "random" experiment which gives a  $74\%$  last layer improvement, and an overall  $9\%$  improvement across the network compared to the baseline. However, a more intelligent projection initialization via CLIP improves the hardware reliability up to  $3.28 \times$  across the network ( $5.06 \times$  for the final layer) and good prompting via GPT-3 to "describe a [CLASS]" further improves it to  $3.93 \times$  ( $6.09 \times$  for the final layer). To summarize, our ablation study validates that our good hardware reliability improvements indeed come from our proposed initialization.
7.2 Ablation-CAM Visualization
Figure 2: Comparative Visualization of Baseline and Our version of ResNet-50 Before and After Single Bit Flip Error Injection. Each subfigure presents the original image, alongside the Class Activation Mapping (CAM) visualizations for both the baseline and our model before and after error injection. Prior to error injection, both models concentrate on key features of the images for classification. Post error injection, the baseline model's focus diverges, for instance, from the African hunting dog to the surrounding foliage (Figure 2c), whereas our model maintains its original focus, demonstrating its robustness against the induced error.
Ablation-CAM is a visualization technique developed for DNNs that employs a gradient-free approach [11]. A departure from conventional gradient-based methods, Ablation-CAM systematically removes parts of the network, allowing a deeper understanding of the individual feature map units
contributing to the model's decisions. This ablation process generates a coarse localization map, highlighting regions in the network's input image that are critical for predictions.
In our study, we chose Ablation-CAM to visualize the decision-making process of our models (original versus our proposed technique). Ablation-CAM's gradient-free nature offers a more robust way of comprehending the focus areas within deep learning models, addressing the limitations of gradient-based methods, such as susceptibility to noise in the gradient and the inability to capture the entire network's collective decision-making process [1]. Furthermore, Ablation-CAM's ability to evaluate model trustworthiness [11] was critical in understanding the robustness of our models to error injection. By observing how the models' focus shifts in response to error injection, we could make judgments about their resilience and reliability. This unique combination of features made Ablation-CAM an ideal tool for our study.
Figure 2 depicts our results for three images on the ResNet50 backbone (Additional visualizations are presented in Appendix B). We inject 2000 random errors in weights across the network (for visualization purposes) and project the impact on the input image, to see how the model responds to the same exact perturbations. Our results highlight the fact that despite the many errors, our proposed technique maintains focus on the important features which correspond to better hardware-level reliability as discussed in §6.
7.3 Value Ranges
Another angle we study in this work is the impact of our proposed technique on the value of ranges for activation values (i.e., neurons) of a model. Prior work has shown that smaller values during computations typically are more robust to single-bit perturbations, as their impact does not propagate as far (except for errors in the exponent fields of a floating point value, which range detectors or quantization can help mitigate). In fact, Google previously proposed a ReLU6 [24] activation function to clip values above the arbitrary value of 6, later used as a range detector for reliability purposes [16]. Similarly, an organic reduction in values is beneficial from a hardware reliability perspective, which we target with our approach.
(a) ResNet-50 Max Absolute Value
(b) ResNet-50 Mean Absolute Value
Figure 3: Observed Neuron values for ResNet50. The Y-axis shows the max absolute value (Figure 3a) and mean absolute value (Figure 3b) observed by profiling the ImageNet dataset on the baseline and our model on a per-layer basis. It can be seen that both max and mean are viable choices for profiling network neuron value ranges, and result in similar trends.
Figure 3 shows the absolute maximum and absolute mean observed neuron values per layer for ResNet50 across the ImageNet dataset. We find that our proposed technique strongly attenuates the values in the last layer for both measures. This result helps explain why our technique is more reliable, and why it is particularly beneficial for the final layer. The fault-free values are smaller to begin with, which in turn enable smaller range detectors [7] and also are less likely to change into a negative impactful error on the classification result. We observe a similar trend across all network studies in our experiments. We provide additional results for different networks in Appendix C.
The number representation in hardware also plays a large role in the reliability of a model, which our proposed technique directly influences. To better understand this effect, we direct the reader to the hardware implementation of numbers, which typically use the IEEE-754 floating point format, consisting of a sign bit, exponent bits, and mantissa bits. Intuitively, bit flips in the exponent bit are the most egregious, and having range detectors in place helps detect these types of errors. More subtle, however, is that depending on the original exponent value, certain bit flips can transform a number to become much larger or much smaller. In this case, a bit flip in a small number (which we identify as smaller than 2) has a very high probability of changing to another small value, regardless of which bit is flipped. In particular, so long as the sign bit or the most significant bit of the exponent (bit 31 and 30) are not the ones flipped, then the IEEE-754 format guarantees that the new, erroneous number stays under the value 2. As such, the small magnitude change has little impact on the end-to-end inference of a classification, and masks such errors. This is why it is crucial and advantageous to have smaller neuron values in a neural network, which various techniques such as batch normalization and our newly proposed technique help organically enforce (unlike an artificial enforcer such as ReLU6). Thus, our new training routine helps accomplish this through the use of the projection layer at the tail end of the neural network.
7.4 Understanding the Accuracy Degradation in the Context of Hardware Reliability
To better understand the  $\sim 0.3\%$  accuracy loss of our technique, we wanted to see how the baseline and proposed models matched up if we excluded low-confidence images (i.e., images "at the border" during classification). In practice, low-confidence images would not be relied upon for safety-critical decision-making - hence we wanted to measure the "true" accuracy of the models.
Figure 4: Model accuracy as a function of Top2Diff deltas for ResNet50. This figure shows that as we exclude images with low Top2Diff for classification accuracy measurements, our proposed model recoups accuracy faster than the original baseline model, indicating that many correctly classified images by the baseline model are borderline correct, to begin with.
We perform a sweep of different Top2Diff values (where "Delta" goes from  $1\%$  to  $40\%$ ) and exclude the "correct" images that have a Top2Diff value below each sweep point. We measure the new network accuracy in light of these delta values and found that many images that were classified correctly by the original model "fell off" as we increased the delta. On the other hand, our proposed model did not lose its classification accuracy as fast; at a delta of Top2Diff=15, the inflection point occurs where our method has the same accuracy (i.e.,  $0\%$  accuracy degradation between models) as the original model, and improves beyond this point. That said, a  $0.3\%$  accuracy loss itself is reasonable in and of itself for the large hardware reliability gains we observe, yet this discussion point presents a trade-off opportunity (as a function of Top2Diff) that can enable a model designer to tune their model for their desired accuracy and hardware reliability targets. To further validate this claim, we find that for different datasets (Table 2), our technique marginally improves accuracy across the board.
In conclusion, our paper presents a software-driven solution to enhance hardware reliability in neural networks. By combining textual and visual information, we mitigate the impact of transient bit-flips during computation. Our approach improves neural network reliability of the most critical layer by up to  $14\times$  compared to the baseline, with minimal changes to training. We contribute a simple training methodology, rigorous evaluation using accuracy and reliability metrics, and a comprehensive discussion supported by visualization techniques. Our work highlights the significance of addressing hardware errors during training, offering a promising direction for developing robust models against transient bit-flips.
This work is supported in part by the National Science Foundation (NSF) grant CCF-1704834. We also thank the Fatima Fellowship for their GPU grant and Hugging Face for organizing and sponsoring the Fatima Research Fellowship program.
[1] Marco Ancona, Enea Ceolini, Cengiz Öztireli, and Markus Gross. Towards better understanding of gradient-based attribution methods for deep neural networks, 2018.
[2] R. A. Ashraf, R. Gioiosa, G. Kestor, R. F. DeMara, C. Cher, and P. Bose. Understanding the propagation of transient errors in hpc applications. In SC, pages 1-12, 2015.
[3] Lukas Bossard, Matthieu Guillaumin, and Luc Van Gool. Food-101 – mining discriminative components with random forests. In ECCV, 2014.
[4] Tom Brown et al. Language models are few-shot learners. In NeurIPS, 2020.
[5] Franck Cappello, Geist Al, William Gropp, Sanjay Kale, Bill Kramer, and Marc Snir. Toward Exascale Resilience: 2014 Update. Supercomput. Front. Innov.: Int. J., 2014.
[6] Franck Cappello, Al Geist, Bill Gropp, Laxmikant Kale, Bill Kramer, and Marc Snir. Toward exascale resilience. *IJHPCA*, 23(4):374–388, November 2009.
[7] Zitao Chen, Guanpeng Li, and Karthik Pattabiraman. Ranger: Boosting Error Resilience of Deep Neural Networks through Range Restriction. CoRR, abs/2003.13874, 2020.
[8] Zitao Chen, Niranjhana Narayanan, Bo Fang, Guanpeng Li, Karthik Pattabiraman, and Nathan DeBardeleben. TensorFI: A Flexible Fault Injection Framework for TensorFlow Applications. CoRR, abs/2004.01743, 2020.
[9] Adam Coates, Honglak Lee, and Andrew Y. Ng. An analysis of single layer networks in unsupervised feature learning. In AISTATS, 2021.
[10] Jia Deng, Wei Dong, Richard Socher, Li-Jia Li, Kai Li, and Li Fei-Fei. Imagenet: A large-scale hierarchical image database. In CVPR, 2009.
[11] Saurabh Desai and Harish G. Ramaswamy. Ablation-cam: Visual explanations for deep convolutional network via gradient-free localization. In WACV, 2020.
[12] S. Di, H. Guo, R. Gupta, E. R. Pershey, M. Snir, and F. Cappello. Exploring properties and correlations of fatal events in a large-scale hpc system. TPDS, 30(2), 2019.
[13] Harish Dattatraya Dixit, Sneha Pendharkar, Matt Beadon, Chris Mason, Tejasvi Chakravarthy, Bharath Muthiah, and Sriram Sankar. Silent data corruptions at scale. arXiv preprint arXiv:2102.11245, 2021.
[14] Alexey Dosovitskiy, Lucas Beyer, Alexander Kolesnikov, Dirk Weissenborn, Xiaohua Zhai, Thomas Unterthiner, Mostafa Dehghani, Matthias Minderer, Georg Heigold, Sylvain Gelly, Jakob Uszkoreit, and Neil Houlsby. An image is worth 16x16 words: Transformers for image recognition at scale. In ICLR, 2021.
[15] Yu Du, Fangyun Wei, Zihe Zhang, Miaojing Shi, Yue Gao, and Guoqi Li. Learning to prompt for open-vocabulary object detection with vision-language model. In CVPR, 2022.
[16] Florian Geissler, Syed Qutub, Sayanta Roychowdhury, Ali Asgari, Yang Peng, Akash Dhamasia, Ralf Graefe, Karthik Pattabiraman, and Michael Paulitsch. Towards a safety case for hardware fault tolerance in convolutional neural networks using activation range supervision, 2021.
[17] Golnaz Ghiasi, Xiuye Gu, Yin Cui, and Tsung-Yi Lin. Open-vocabulary image segmentation. arXiv preprint arXiv:2112.12143, 2021.
[56] Kostya Serebryany, Maxim Lifantsev, Konstantin Shtoyk, Doug Kwan, and Peter Hochschild. Silifuzz: Fuzzing cpus by proxy, 2021.
[57] Karen Simonyan and Andrew Zisserman. Very deep convolutional networks for large-scale image recognition. *ICLR*, 2015.
[58] Li Tan and Nathan DeBardeleben. Failure analysis and quantification for contemporary and future supercomputers. ArXiv, abs/1911.02118, 2019.
[59] Mingxing Tan and Quoc V. Le. Efficientnet: Rethinking model scaling for convolutional neural networks. In ICML, 2019.
[60] Zhengzhong Tu, Hossein Talebi, Han Zhang, Feng Yang, Peyman Milanfar, Alan Bovik, and Yinxiao Li. Maxvit: Multi-axis vision transformer. In ECCV, 2022.
[61] Ashish Vaswani, Noam Shazeer, Niki Parmar, Jakob Uszkoreit, Llion Jones, Aidan N Gomez, Lukasz Kaiser, and Illia Polosukhin. Attention is all you need. In NeurIPS, 2017.
[62] Haohan Wang, Songwei Ge, Zachary Lipton, and Eric P Xing. Learning robust global representations by penalizing local predictive power. In NeurIPS, 2019.
[63] Syed Talal Wasim, Muzammal Naseer, Salman Khan, Fahad Shahbaz Khan, and Mubarak Shah. Vita-clip: Video and text adaptive clip via multimodal prompting. In CVPR, 2023.
[64] WikiChip. Fsd chip - Tesla - wikichip. https://en.wikichip.org/wiki/tesla_(car_company)/fsd_chip, 2019.
[65] Jianwei Yang, Chunyuan Li, Xiyang Dai, Lu Yuan, and Jianfeng Gao. Focal modulation networks. In NeurIPS, 2022.
[66] Jianwei Yang, Chunyuan Li, Pengchuan Zhang, Bin Xiao, Ce Liu, Lu Yuan, and Jianfeng Gao. Unified contrastive learning in image-text-label space. In CVPR, 2022.
[67] Renrui Zhang, Ziyu Guo, Wei Zhang, Kunchang Li, Xupeng Miao, Bin Cui, Yu Qiao, Peng Gao, and Hongsheng Li. Pointclip: Point cloud understanding by clip. In CVPR, 2022.
[68] Chong Zhou, Chen Change Loy, and Bo Dai. Denseclip: Extract free dense labels from clip. arXiv preprint arXiv:2112.01071, 2021.
[69] Kaiyang Zhou, Jingkang Yang, Chen Change Loy, and Ziwei Liu. Conditional prompt learning for vision-language models. In CVPR, 2022.
[70] Kaiyang Zhou, Jingkang Yang, Chen Change Loy, and Ziwei Liu. Learning to prompt for vision-language models. IJCV, 2022.