NeuralFuse: Learning to Recover the Accuracy of Access-Limited Neural Network Inference in Low-Voltage Regimes
Authors: Hao-Lun Sun
Lei Hsiung
Nandhini Chandramoorthy
Pin-Yu Chen
Tsung-Yi Ho
Venue: NeurIPS 2024 poster (2024)
Keywords: machine learning
energy efficient inference
bit error resilience
Primary area: machine_learning_for_other_sciences_and_fields
TL;DR: NeuralFuse provides model-independent protection for AI accelerators built on a chip, allowing them to maintain stable performance when suffering low-voltage-induced bit errors.

Abstract: Deep neural networks (DNNs) have become ubiquitous in machine learning, but their energy consumption remains problematically high. An effective strategy for reducing such consumption is supply-voltage reduction, but if done too aggressively, it can lead to accuracy degradation. This is due to random bit-flips in static random access memory (SRAM), where model parameters are stored. To address this challenge, we have developed NeuralFuse, a novel add-on module that handles the energy-accuracy tradeoff in low-voltage regimes by learning input transformations and using them to generate error-resistant data representations, thereby protecting DNN accuracy in both nominal and low-voltage scenarios. As well as being easy to implement, NeuralFuse can be readily applied to DNNs with limited access, such cloud-based APIs that are accessed remotely or non-configurable hardware. Our experimental results demonstrate that, at a 1% bit-error rate, NeuralFuse can reduce SRAM access energy by up to 24% while recovering accuracy by up to 57%. To the best of our knowledge, this is the first approach to addressing low-voltage-induced bit errors that requires no model retraining.

NeuralFuse: Learning to Recover the Accuracy of Access-Limited Neural Network Inference in Low-Voltage Regimes
Hao-Lun Sun', Lei Hsiung", Nandhini Chandramoorthy") Pin-Yu Yu Chen', Tsung-Yi Yi Ho
National Tsing Hua University 2 DDattmoth College
IBM Research
4 The Chinese University of Hong Kong s s109062594am109 .tt......... edu.tw lei hww.ng..gg... gwwddrrtoutt.h....... edu (pin-yu.ches chen, nandhini. www.chaancmaaoo taandrrmoorthy)@111 com tyho@cse. cuhk. edu. hk
Abstract
Deep neural networks (DNNs) have become ubiquitous in machine learning, but their energy consumption remains problematically high. effective strategy for reducing such consumption is supply-voltage reduction, but if done too aggressively, it can lead to accuracy degradation. This is due random bit-flips in static random access memory (SRAM), where model parameters are stored. To address this challenge, we have developed NeuralFusee, novel add-on module that handles the energy-accuracy tradeoff in low-voltage regimes by learning input transformations and using them to generate error-resistant data representations, thereby protecting DNN accuracy in both nominal and low-volter scenarios. As well as being easy implement, NeuralFuse can be readily applied to DNNs with limited access, such cloud-based APIs that accessed remotely experimental results demonstrate that, at a 1% bit-error rate, NeuralFuse can reduce SRAM access energy by up 24% while recovering accuracy by up 57%. To the best of our knowledge, this is the first approach to addressing low-volrage-induced bit errors that requires no model retraining.
configuuuee hardware. Our
Introduction
Energy-efficient computing is of primary importance to the effective deployment of deep neural networks (DNNs), particularly in edge devices and in on-chip Al systems. Increasing DNN com- putation's energy efficiency and lowering its carbon footprint require iterative efforts from both chip designers and algorithm developers. Processors with specialized hardware accelerators for Al computing, capable of providing orders of magnitude better performance and energy efficiency for AI computation, are now ubiquitous. However, alongside reduced precision/quantizatioo and architectural optimizations, endowing such systems with the capacity for low- operation is powerful lever for reducing their power consumption.
The computer engineering literature contains ample evidence of the effects of undervolting and low-voltage operation on accelerator memories that store weights and activations during computation. Aggressive scaling-down down of static random access memory's 's (SRAM's) supply voltage to below the rated value saves power, thanks to quadratic dependence of dynamic power on voltage. Crucially,
Project h http://pp/etttttttaaaaaaaaaaaaaa wtw.:uuusssttii......... .tf..i..ff.spccee space
Code: attps://githuu htw.:ittth..o...meeeeeeeeeeeeeee www.o/////////eeeeeeeeee
38th Conference on Neural Information Processing Systems (NcurIPS 2024).

---

Ouerlip
Berggiammeey The ond Pa totted BecNerss
Sce
Are. 45
Soura Disalee
Asa 48.51
38,9%
NarzFaa Areiiecttas Cand Daceeds
Lowe
X- (1.
$7.89 1
Obue Nodel)
Sung Saiing Proesioge
(a) The pipeline of the NuuralFuse framework at inference.
(b) Energy/accuracy tradeofff example.
Figure I: (a) At inference, NeuralFuse transforms input samples x into robust data representations. The nominal voltage allows models to work as expected, whereas at low voltage, one would encounter bit errors (e.g.. 1%) that cause incorrect inferences. The percentages reflect the accuracy of CIFAR- 10 pre-trained 8 with and without NeuralFuse in both those voltage cases. (b) On the same base model (8es we illustrate the energy/accuracy tradcoff of six NeuralFuse implementations. The x-axis represents the percentage reduction in dynamic-memor access energy at low-voltage settings (base model protected by NeuralFuse), as compared to the bit-error- (nominal) voltage. The y-axis represents the perturbed accuracy (evaluated at low voltage) with a 1% bit-error rate.
however, it also leads to an exponential increase in bit failures. Memory bit flips cause errors in the stored weight and activation values [Chandramoorthy et al., 2019, Ganapathy et al., 2017], leading to catastrophic accuracy loss.
A recent wave of research has proposed numerous techniques for allowing low-voltage operation of DNN accelerators while preserving their accuracy. Most of these have been either hardware- based error-mitigation techniques error-aware robust training of DNN models. On-chip error mitigation methods have significant performance and power overheads [Chandramoorthy et al., 2019, Reagen et al., 2016]. On the other hand, some have proposed to generate models that are robust to bit errors via a specific learning algorithm [Kim et al., 2018, Koppula et al., 2019, Stutz et al., 2021], thereby eliminating the need for on-chip error mitigation. However, error-aware robust training to find the optimal set of robust parameters for each model is time- and energy-intensive and may not be possible in all access- access-limited settings.
In this paper, therefore, we propose novel model-agnostic approach: NeuralFuse. This proof-of- concept machine-learmin module offers trainable input transformation parameterized by a relatively small DNN; and, by enhancing input's robustness, it mitigates bit errors caused by very low- vow-voltage operation, thus serving the wider goal of more accurate inferencing. The pipeline of NusralFuse illustrated in Figure 1. To protect the deployed models from making wrong predictions under low-power conditions, NeuralFuse accepts scenarios under access-limited neural networks (e.g., non-configurable hardware or dloud-based APIs). Specifically, we consider two access-limin scenarios that are common in the real world: 1) relaxed access, in which 'black box" model details are unknown, but backpropagation through those models is possible; and 2) restricted access, in which the model details are unknown and backpropagation is disallowed. To enable it to deal with relaxed access, we trained NeuralFuse via backpropagation, and for restricted-access cases, we trained on white-box surrogate model. To the best of our knowledge, this is the first study that leverages learning-bas method to address random bit errors as a means of recovering accuracy in low-voltage and access- -imited settings.
We summarize our main contributions as follows:
We propose NeuralFuse, novel learning based input- crauuttransformaiion module aimed at enhancing the accuracy of DNNs that are subject random bit errors caused by very low voltage operation. basis at the data-input stage and
NeuralFuse is model-agnostic, i.e., operates on a does not require any re-training of deployed DNN models.
We explore two practical limited-access scenarios for restricted access. In the former setting, we use gradient-based methods for module training. In the latter one, we use white-box surrogate model for training, which is highly transferable other types of DNN architecture.
inference: relaxed access and
We report the results of an extensive program of experiments with various combinations of DNN models (ResNet18, ResNet50, VGGI1, VGGI6, and VGG19), datasets (CIFAR-10, 100,

---

GTSRB, and ImageNet-10), 10), and NeuralFuse implementations of different architectures and sizes. These show that NeuralFuse can consistently increase the perturbed accuracy (accuracy evaluated under random bit errors in weights) by up to 57%, while simultaneously saving up to 24% of the energy normally required for SRAM access, based on our realistic characterization of bit-cell failures for a given memory array in a low-voltage regime inducing 0.5% 11% bit-error rate.
We demonstrate NeuralFuse's ' transferability (i.c., adaptability to unseen base models), versatility (i.e., ability to recover low-precision quantization loss), and competitiveness (i.e., state-of-the-an performance) in various scenarios, establishing it promising proof-of-concep for energy- efficient, resilient DNN inference.
2 Related Work and Background
Software-bssed Energy-saving Strategies. Various recent studies have proposed software-based methods of reducing computing's 's energy consumption. For instance, quantization techniques have been reported to reduce the precision required for storing model weights, and thus decrease total memory storage [Gong et al., 2014, Rastegari et al., 2016, Wu et al., 2016]. On the other hand, Yang et al. [2017]- - who proposed energy-aware pruning on each layer and fine-tuning of weights to maximize final accuracy suggested several ways to reduce DNNs' energy consumption. For example, they devised the ECC framework, which compresses DNN models to meet given energy constraint [Yang et al., 2019a]. and a method of compressing such models via joint pruning and quantization [Yang et al.. 2020]. is also feasible, during DNN training, to treat energy constraints as an optimization problem and thereby reduce energy consumption while maximizing training accuracy (Yagg et al., 2019h) 90] However, unlike ours, all these methods imply changing either model architectures or model weights.
Hardware-based Energy-saving Strategies. Prior studies have also explored ways of improving energy efficiency via specially designed hardware. Several of them have focused on the undervolting of DNN accelerators and proposed methods to maintain accuracy in the presence of bit errors. For in- stance, Reagen et al. [2016] proposed an SRAM fault-mitigation technique that rounds faulty weights to zero avoid degradation of prediction accuracy. Srinivasan al. [2016] recommended storing sensitive MSBs (most significant bits) in robust SRAM cells to preserve accuracy. Chandramoorthy et al. [2019] proposed dynamic supply-voltage boosting to improve the resilience of memory access operations; and the learning-baat based approach proposed by Stutz et al. [2021] aims to find models that robust to bit errors. The latter paper discusses several techniques for improving such robustness, notably quantization, weight-clipping. random bit-error training, and adversarial bit-error training. Its authors concluded from their experiments that combination of quantization, weight-clipping, and adversarial bit-error training will yield excellent performance. However, they also admitted that the relevant training process was sensitive to hyperparameter settings, and hence, might come with a challenging training procedure.
However, we suggest that all the methods mentioned above are difficult to implement and/or unsuitable for use in real-world access- limited settings. For example, the weights of DNN models packed on embedded systems may not be configurable or updatable, making model retraining (e.g., Stutz et al. [2021]) non-viable in that scenario. Moreover, DNN training is already a tedious and time-consuming task, adding error-aware training to it may further increase its complexity and, in particular, make hyperparameter searches more challenging. Özdenizci and Legenstein [2022] also reported that error-aware training was ineffective for large DNNs with millions of bits. NeuralFuse obviates the need for model retraining via an add-on trainable input- crpputttrnsfoommaioo function parameterized by relatively small secondary DNN.
SRAM Bit Errors in DNNs. Low voltage-induced memory bit-cell failures can cause bit-flips from 0 to and vice versa. In practice, SRAM bit errors increase exponentially when the supply voltage is scaled below Vmann i.e., the minimum voltage required to avoid them. This phenomenon has been studied extensively in the prior literature, including work by Chandramoorthy et al. [2019] and Ganapathy et al. [2017]. The specific increases bit errors as voltage scales down, in the case of an SRAM array of 512 x 64 bits with 14nm technology node, is illustrated in Figure 2. The corresponding dynamic energy per SRAM read access, measured at each voltage at a constant frequency, is shown on the right-hand side of the figure. In this example, accessing the SRAM at
3

---

0.3
Energi per a0085 (MD
0.2
BitEror
0.15
0.000
01
0.001
0.5
0.6
0.7
0.8
0.9
1.3
12
0.5
0.5
0.7
0.8
0.9
111 12
Noraaizzdd Voltage
Normalized Voltage
Figure 2: The bit-error rates (left) and dynamic energy per memory access versus voltage for static random access memory arrays (right) as reported by Chandramoorthy et al. [2019]. The x-axis shows voltages normalized with respect to the minimum bit error-free voltage (Vmin).
0.83V leads to a % bit-error rate, and at the same time, dynamic energy per access reduced by approximately 30%. This can lead to DNNs making inaccurate inferences, particularly when bit- bit-flips occur at the MSBs. However, improving robustness bit errors can allow us lower Vmmin and exploit the resulting energy savings.
It has been observed that bit-cell failures for a given memory array randomly distributed and independent of each other. That is, the spatial distribution of bit-flips can be assumed to be random, it generally differs from one array to another, within as well between chips. Below, following Chandramoorthy et al. [2019], we model bit errors in memory array of a given size by generating random distribution of such errors with equal likelihood of 0-to-1 and 1-to-0 bit-flipping. More specifi- cally, we assume that the model weights are quantized to 8-bit precision (i.e., from 32-bit bit floats to 8-bit integers), and generate perturbed models by injecting our randomly distributed bit errors into the two's complement representation of weights. For more implementation details, please refer to Section 4.1.
3 NeuralFuse: Framework and Algorithms
3.1 Error-Resistant Input Transformation
As illustrated in Figure 1, we propose novel trainable input-transformation module, NeuralFuse, parametrized by relatively small DNN, mitigate the accuracy-energy tradeoff for model inference and thus overcome the drawback of performance degradation in low-voltage regimes, A specially designed loss function and training scheme are used derive NeuralFuse and apply it the input data such that the transformed inputs will become robust to low voltage-induced bit errors.
Consider the input sampled from the data distribution X' and set of models MM with p% random bit errors on weights (i.e., perturbed models). When it is not manifesting any bit errors (i.c., at normal-voltage settings), the perturbed model operates as nominal deterministic one, denoted by Mn. NeuralFuse aims to ensure that a model M₂ E Mp can make correct inferences on the transformed inputs while also delivering consistent results in its Mo state. To adapt various data characteristics, NeuralFuse designated as F Eq. (1), below - is designed to be input-aware. This characteristic can be formally defined as
F(x) clip 9(x)).
(1)
where (xx) is "ggenraaoo" (i.c., input- couutttransfommttion function) that generate perturbation based on input x. As transformed by NeuralFuse, i.c., as F(x), that input is passed to the deployed model (Mo M,)) for final inference. Without loss of generality, lies within scaled input range F(.) E [-1, 1]d, where d is the (flattened) dimension of x.
assume the transformed input
3.2 Training Objective and Optimizer
To train generator G(-), which ought to be able to ensure the correctness of both the perturbed model M, and the clean model Mo. we parameterized with neural network and apply our training objective function
arg max log PM, (ulF Wg)) À EM, Dog PM, F(x:WW)) We

---

where Wg is the set of trainable parameters for G; y is the ground-trum truth label of PM denotes the likelihood of y as computed by model M being given a transformed input F(x; W3); MG);;M p the distribution of the perturbed models inherited from the clean model Mo. under a 5% random bit-error rate; and is a hyperparameter that balances the importance of the nominal and perturbed models.
The training objective function can be readily converted to a loss function (C) that evaluates cross- entropy between the ground-truth label y and the prediction PM (y F(x; Wg). That is, the total loss function can be calculated as
(3) In particular, optimizing the loss function requires evaluation of the impact of the loss term L M, on randomly perturbed models. Our training process is inspired by expectation over transformation (EOT) attacks [Athalye et al., 2018], which aim to produce robust adversarial examples that are simultaneously adversarial over the entire transformation distribution. Based on that idea, we propose a new optimizer for solving Eq. (3), which we call expectation over perturbed models (EOPM). EOPM-trained generators can generate error-resistant input transformations and mitigate inherent bit errors. However, it would be computationally impossible to enumerate all possible perturbed models with random bit errors, and the number of realizations for perturbed models is constrained by the memory size of the GPUs used for training, In practice, therefore, we only use N perturbed models per iteration to calculate empirical average loss, i.c.,
Coaa = L.D + X L.M.-
Laps +...+ LM
LM, =0
N
where N is the number of perturbed models {Mp..... .Mpx> } that are simulated to calculate the loss caused by random bit errors. Therefore, the gradient used to update the generator can be calculated as follows:
C aW2
3CMg +
A (DSMe)
OLMPN JW2
(5)
aW2 N
Through our implementation, we found that stable performance could be delivered when N 10.
and that there was little to be gained by using a larger value. The results of our ablation study for different values of N can be found in Appendix E.
3.3 Training Algorithm
Algorithm 1 in Appendix A summarizes NeuralFuse's 's training steps. Briefly, this involves splitting the training data X into B mini-batches for training the generator in each epoch. For each mini-batch, we first feed these data into F-)) to obtain the transformed inputs. Also, we simulate N perturbed models using p% random bit-error rate, denoted by Mp..... Mpy. from My. Then, the transformed inputs are fed into those N perturbed models as well as into the clean model .Ms and their respective losses and gradients are calculated. Finally, NeuralFuse parameters Wg are updated based on the gradient obtained by EOPM.
4 Experiments
4.1 Experiment Setups
Datasets. We evaluate NeuralFuse on four different datasets: CIFAR-10 [Krizhevsky and Hinton, 2009], CIFAR- 100 [Krizhevsky and Hinton, 2009], the German Traffic Sign Recognition Benchmark (GTSRB) [Stallkamp et al., 2012], and ImageNet- 10 [Deng et al., 2009]. CIFAR-10 consists of 10 classes, with 50,000 training images and 10,000 testing images in total. Similarly, CIFAR-100 consists of 100 classes, with 500 training images and 100 testing images in each. The GTSRB contains 43 classes with total of 39,209 training images and 12,630 testing images. Similar to CIFAR-10 and CIFAR- 100, we resize GTSRB into 92x32x3 in our experiment. For ImageNet- 10, we chose the same ten categories Huang et al. [2022], in which there are 13,000 training images and 500 test images cropped into 224x Due to space limitations, our CIFAR-100 results are presented in Appendices F and G.
Base Models. We selected several common architectures for our base models: ResNet18, ResNer50 [He et al., 2016], VGGI1, VGG16, and VGG19 [Simonyan and Zisserman, 2015]. To replicate the deployment of models on chips, all our based models were given quantization-an aware training that followed Stutz et al. [2021].
5

---

NeuralFuse Generators. The architecture of the NeuralFuse generator (9) is based on an encoder- decoder structure. We designed and compared three types of generators, namely convolution based.. deconvolution-aasee and UNet-based. We also considered large(())/mall(S) network sizes for each type. Further details can be found below and in Appendix B.
Convolution- based (Conv). Conv uses convolution with MaxPool layers for its encoder and convolution with UpSample layers for its decoder. This architecture has previously been shown to be efficient and effective at generating input-aware backdoor triggers [Nguyen and Tran, 2020].
Deconvolution-basee (DeCony). DeConv uses convolution with MaxPool layers for its encoder and deconvolution layers for its decoder. We expected this modification both to enhance its performance and to reduce its energy consumption.
UNet-based (UNet). UNet uses convolution with MaxPool layers for its encoder, and deconvo- lution layers for its decoder. UNet is known for its robust performance in image segmentation [Ronneberger et al., 2015].
Eonrgy-consumptton Calculation. The energy consumption reported in Figure is based on the product of the total number of SRAM memory accesses in a systolic array-based convolution neural network (CNN) accelerator and the dynamic energy per read access at a given voltage. Research by Chen et al. [2016] previously showed that energy consumption by SRAM buffers and arrays accounts for high proportion of total system energy consumption. We assume that there are no bit errors on NeuralFuse, given its status as an add-on data preprocessing module whose functions could also be performed by a general-purpon the accelerator equipped with dynamic voltage scaling and therefore NeuralFuse computation is performed at nominal error-free voltage. We report reduction in overall weight-memory energy consumption (i.e., NeuralFuse + Base Model under a p% bit-error rate) with respect to the unprotected base model in the eguuaa-voltage mode (i.e., 0% bit-error rate and without NeuralFuse).
core. In this work we assume it is implemented on
To quantify memory accesses, we used the SCALE-SIM simulator [Samajdar et al., 2020], and our chosen configuration simulated an output-stationary dataflow and 32x32 systolic array with 256KB of weight memory. We collected data on the dynamic energy per read access of the SRAM both at Vmni and at the voltage corresponding to a 1% bit-error rate (Vber 0.83V mss) from Cadence ADE Spectre simulations, both at the same clock frequency.
Relaxed and Restricted Access Settings. In the first of our experiments" two scenarios, relaxed access, the base-model information was not entirely transparent, but allowed us to obtain gradients from the black-box model through backpropagation. Therefore, this scenario allowed direct training of NeuralFuse with the base model using EOPM. In the restricted-access scenario, on the other hand, only the inference function was allowed for the base model, and therefore trained NeuralFuse using a white-box surrogate base model and then transfering the generator to the access-restricted model.
Computing Resources. Our experiments were performed using eight Nvidia Tesla V100 GPUs and implemented with PyTorch. NeuralFuse was found to generally take 150 epochs to converge, and its training time was similar to that of the base model it incorporated. On both the CIFAR-10 and CIFAR- 100 datasets, average training times were 17 hours (ResNet18), 50 hours (ResNet50), 9 hours (VGG11), 13 hours (VGG16), and 15 hours (VGG19). For GTSRB, the average training times were 9 hours (ResNet18), 27 hours (ResNet50), 5 hours (VGG11), 7 hours (VGG16). and 8 hours (VGG19); and for ImageNet-10 10, the average training times were 32 hours (ResNet18), 54 hours (ResNet50), 50 hours I), 90 hours (VGG16), and 102 hours (VGG19).
4.2 Performance Evaluation, Relaxed-access Scenario
Our experimental results pertaining to the relaxed-access scenario are shown in Figure 3. The bit- error rate (BER) due to low voltage was 1% in the cases of CIFAR- 10 and GTSRB, and 0.5% for ImageNet-10. The BER of ImageNet-10 10 was lower than that of the other two because, being pre- trained, it has more parameters than either of them. For each experiment, we sampled and evaluated N 10 perturbed models (independent from training), and below, we report the means and standard deviations of their respective accuracies. Below, clean accuracy (CA) refers to a model's 's accuracy measured at nominal voltage, and perturbed accuracy (PA) to its accuracy measured at low voltage.
In the cases of CIFAR-10 and the GTSRB, we observed that large generators like ConvL. and UNetL recovered PA considerably, i.c., in the range of 41% to 63% on ResNet18, VGGI1, VGG16,

---

Neacs
valtage (wio Neard
Nominal NeuraBuse)
Low voltage (wi NeuralPose)
(a) CIFAR-I0, 1% Bit-error Rate
(b) GTSRB, 1% Bit-error Rate
Widn
ImageNet-10. 0.5% Bit-error Rate
Figure 3: colaxed-access scenario test accuracies (%) of various pre-traines models with and without NeuralFuse, compared nominal voltage (0% bit-error rate) low voltage (with specified bit-error rates). The results demonstrate that NeuralFuse consistently recovered perturbation accuracy.
and VGG19, ResNet50's recovery percentage was slightly worse than those of the other base models, but it nevertheless attained up 51% recovery on the GTSRB. On the other hand, the recovery percentages achieved when we used small generators like DeConvS were worse than those of their larger counterparts. This could be explained by larger-sized networks' better ability to learn error-resistant generators (though perhaps at the cost of higher energy consumption). In the case of Image 10, using larger generators also yielded better PA performance recovery, further demonstrating NeuralFuse's ability to work well with large input sizes and varied datasets.
4.3 Performance Evaluation, Restricted-accest Scenario (Transferability)
The experimental results of our restricted-acceest scenario are shown in Table 1. We adopted ResNet18 and VGG19 as our white-box surrogate source models for training the generators under 1.5% bit- error rate. We chose ConvL and UNetL as our generators because they performed best out of the six we tested (see Figure 3).
From Table 1, we can see that transferring from larger BER such as 1.5% can endow a smaller one (e.g., 1%) with strong resilience. The table also makes clear that using VGG19 as a surrogate model with UNet-based generators like UNetL can yield better recovery performance than other model/generator combinations. On the other hand, we observed in some cases that if we transferred between source and target models of the same type (but with different BERs for training and testing), performance results could exceed those we had obtained during the original relaxed- access scenario. For instance, when we transferred VGG19 with UNetL under 1.5% BER to VGG19 or VGG11 under 0.5% BER, the resulting accuracies were 85.86% (as against 84.99% for original VGG19) and 84.81% (as against 82.42% for original VGG11). We conjecture that generators trained on relatively large BERs can cover the error patterns of smaller BERs, and even help improve the latter's generalization. These findings indicate the considerable promise of access-limited base models in low-voltage settings to recover accuracy.
4.4 Energy/Accuracy Tradeoff
report total dynamic energy consumption as the total number of SRAM-access events multiplied by the dynamic energy of single such event. Specifically, used SCALE-SIM to calculate total
7

---

Table 1: Restricted-access scenario: Transfer results CIFAR-10 with 1.5% bit-error rate
Conv (I.5%(
UNeiL (1.3%)
SM
TM
BER
CA
PA
CA (NF)
PA (NF)
RP
CA (NF)
PA (NF)
RP
1%
38.9
12.4
89.0 = 0.5
50.1
85.2 =
46.3
ResNer18
92.6
89.8
85.8
0.5%
70.1
89.6
0.2
19.5
85.7
15.6
ResNe150
1%
92.6
26.1 1
9.4
89.2
36.1
18
10.0
84.4
38.9 1 16
12.8
0.5%
61.0
10.3
74.1
10
13.1
72.7 4.6
11.7
1%
42.2
1T.6
59.2 1 10
17.0
69.8 :: 7.5
27.6
ResNet18
VGGHI
88.4
86.3
82.3
0.5%
63.6 9.3
78.9 = 4.9
15.3
77.0 4.0
13.4
1%
35.7
7.9
62.2
26.5
68.9 14
33.2
VGGI6
90.3
89.4
84.7
0.5%
66.6 8.1
83.4 5.5
16.8
80,5 =
1%
36.0 12.0
49.9 23
13.9
55.1 17
19.1
VGG19
90.5
89.8
85.0
0.5%
64.2 12.4
81.8 8.5
17.6
78.5 - 6.8
14.3
1%
38.9 12.4
62.6 13
23.7
72.3 + 11 33.4
R8
92.6
88.9
85.0
0.5%
70.1 11.6
84.2 7.2
14.1
82.1 = 2.2
12.0
1%
26.1 = 9.4
37.9 18
11.8
46.7 = 17
20.6
ResNe150
92.6
88.8
85.2
0.5%
61.0 :1: 10.3
76.6 7.8
15.6
78.3 4.7
17.3
42.2
76.0
33.8
81.9
39.7
VGG19
VGG11
88.4
88.9
85.5
0.5%
63.6
9.3
85.9 2.6
22.3
84.8
1%
35.7
7.9
76.5
40.8
79.2 1 7.5
43.5
VGG16
90.3
89.0
85.9
0.5%
66.6
8.1
87.7
0.7
21.1
84.7 + 0.9
18.1
1%
36.0 1:
12.0
80.2 1: 12
44.2
84.3 1 1.2
48.3
VGG19
90.5
86.3
0.5%
64.2 + 12.4
88.8 = 0.4
24.6
85.9 = 0.3
21.7
source model, used for training generators; TM: target model, for testing generators; BER: bit-error rate the target model; CA (%) clean accuracy: PA (%). perturbed accuracy: NF: NeuralFuse: and RP: total recovery percentage PA (NF) vs. PA
Nore. SM:
Table 2: Energy saving (%) by NeuralFuse for 30 combinations of base models and generators.
ConvL
ConvS DeConvL DeConvS
UNetL
UNetS
ResNet18
19.0
29.1
21.2
27.5
24.0
28.9
ResNet50
25.4
29.9
26.4
29.2
27.7
29.9
VGG11
6.6
27.5
11.2
24.1
17.1
27.2
VGG16
17.1
28.9
19.7
27.0
23.0
28.7
VGG19
20.3
29.7
22.3
27.8
24.8
29.1
weight-memory access (TWMA), specifics of which can be found in Appendix C's Table 6. In Table 2, below, we report percentages energy saved (ES) at voltages that yield a 1% bit-error rate for various base-model and generator combinations. The formula for computing ES is
Energy
EEeeryy Energy wv) x 100%,
ES
(6)
Energyay
where NV denotes nominal voltage regime, and LV, a low-voltage one.
Our results indicate that when ResNet18 is utilized as base model, NeuralFuse can recover model accuracy by 20 49% while reducing energy use by 19 - 29%. In Appendix C, we provide more results on the tradeoff between energy and accuracy of different NeuralFuse and base-model combinations. Overall, would appear that using NeuralFuse can effectively restore model accuracy when SRAM encounters low-voltage-ing -oottage-indueed induced random bit errors.
Runtime and Latency. On the other hand, runtime and its corresponding energy consumption may also affect overall energy savings. For instance, previous research has shown that multiply-and- accumulate (MAC) operations account for more than 99% of operations in state-of-the-ee CNNs, dominating processing runtime and energy consumption alike Yang et al. [2017]. Therefore, we also report the results of our MAC-based
estimation in Appendix C, and of our latency analysis in Appendix D. Here, it should also be noted that an additional latency overhead is an inevitable tradeoff for reducing energy consumption our scenarios. Although neither runtime nor latency is major focus of this paper, future researchers could usefully design gighter-weight version of the NeuralFuse module, or apply model-compression techniques it, to reduce these two factors.
4.5 Model Size and NeuralFuse Efficiency
To arrive at full performance characterization NeuralFuse, we analyzed the relationship between the final recovery achieved by each base model in combination with generators of varying parameter counts. For this purpose, we defined efficiency ratio as the recovery percentage PA divided by NeuralFuse's parameter count. Table 3 compares the efficiency ratios of all NeuralFuse generators

---

Table 3: The efficiency ratio for all NeuralFuse generators.
Base Model
NuuralFuse
BER
ConvL ConvS
DeConvL. DeConvS UNetL
UNetS
1%
67.5
182
76.6
190.7
94.5
245.9
ResNet18
0.5%
24.7
73.3
30.7
62.5
33.6
88.3
1%
37.4
75.1
57.4
102.7
102.3
248.4
ResNet50
0.5%
35.2
108.7
40.4
92.5
47.4
124.6
1%
62.3
212.9
69.3
165.8
92.0
251.7
VGG11
0.5%
32.3
96.3
35,8
77.2
38.9
100.7
VGG16
1%
69.6
211.2
76,9
196.5
98.8
292.9
0.5%
30.3
98.1
33.0
75.3
40.6
113
1%
57.6
147.5
65.5
141.6
95.4
250.8
VGG19
0.5%
33.0
91.0
37,5
70.2
43.1
106.4
Figure 4: ppeecccd-rreciioon accuracy
trained CIFAR-10. Those results show that UNet-based generators had better efficiency per million parameters than either convolution-based or deconnolution-basee ones.
4.6 NeuralFuse's Robustness to Reduced- Reduced-precision Quantization
Lastly, we also explored NeuralFuse's robustness to low-precision quantization on model weights. Uniform quantization is the usual method for quantizing model weights [Gholami et al., 2022]. However, possible for to cause an aceuracy drop due to lack of precision. Given our aim of offering protection from bit errors, we hoped to understand whether NeuralFuse could also recover model-accuracy drops caused by this phenomenon. We therefore uniformly quantized the model weights to a lower bit precision and measured the resulting accuracy. Specifically, we applied symmetric uniform quantization to our base models with various numbers of bits induce precision loss, and defined the quantized weight Wa (integer) W L where W denotes the original
max [W] model weight (full precision), 8 2 is the quantization scale parameter, and b is the precision (number of bits) used to quantize the models. Bit errors induced by low voltage operation as previously described, are also applied low precision weights.
We used the GTSRB pre-trained ResNet18 as our example in an evaluation of two NeuralFuse generators, i.e., ConvL and UNetL trained with 0.5% BER, and varied precision b from 8 bits to bits (integer). The results, shown Figure 4, indicated that when b > 3 bits, NeuralFuse could effectively recover accuracy in both the low-voltage and low-precision scenarios. When b = 3, while NeuralFuse could still handle the bit- free model (Fig. 4 top), it exhibited a limited ability to recover the random bit-error case (Fig. 4 bottom). We find these results encouraging, insofar as NeuralFuse was only trained on random bit errors, yet demonstrated high accuracy in dealing with unseen bit-quantization errors. Further experimental results derived from other base models and datasets can be found in Appendix H.
4.7 Extended Analysis
Here, we would like to highlight some key findings from the additional results in the Appendices. In Appendix E, we compare NeuralFuse against a simple bascline of learning a universal input perturbation. We found that such baseline performed much worse than NeuralFuse validating the necessity of adopting input-aware transformation if the goal is to learn error-resistant data representations in low-voltage scenarios. Appendix G, we report that ensemble training of white-box surrogate base models could further improve the transferability of NeuralFuse in restricted- access scenarios. Appendices K and L present visualization results NeuralFuse's 's data embeddings and transformed inputs. In Appendix J, we show that NeuralFuse can further recover the accuracy of a base model trained with adversarial weight perturbation low-voltage setting.
that task,
Conclusion
In this paper, we have proposed NeuralFuse, the first non-intrusive post hoc module that protects model inference against bit errors induced by low voltage. NeuralFuse is particularly well suited to

---

architectures and modalities, practical paachie--deplyyeen cases in which access to the base model is limited or relaxed. The design of Fusr includes a novel loss function and new optimizer, EOPM, that enable it to handle simulated randomness in perturbed models. Our comprehensive experimental results and analysis show that NeuralFuse can recover test accuracy by up to 57% while simultaneously enjoying an up to 24% reduction in memory- energy requirements. Moreover, NeuralFuse demonstrates high transferability to access-consiee access-constrained models and high versatility, c.g., robustness to low-precision quantization. In short, NuuralFuse is notable advancement in mitigating neural-network inference's s energy/accuracy tradeoff in low-voltage regimes, and points the way to greener future Al technology. Our future work will include extending this study to other such as transformer based language models.
Limitations. We acknowledge the challenge of achieving significant power savings without accuracy loss and view NuuralFuse as foundational, proof-of-concpp- step toward this goal. Future research could enhance this approach by optimizing the pre-processing module to adapt to specific error characteristics of low-voltage SRAM or by integrating lightweight hardware modifications to further improve the energy-accuracy trade-off.
Broader Impacts. We see no ethical or immediate negative societal consequence of our work, and holds the potential for positive social impacts, from environmental benefits to improved access to technology and enhanced safety in critical applications.
Acknowledgments and Disclosure of Funding
We thank the anonymous reviewers for their insightful comments and valuable suggestions. The research described in this paper was conducted in the JC STEM Lab of Intelligent Design Automation, which is funded by The Hong Kong Jockey Club Charities Trust in support of Tsung- Yi Ho.
References
Anish Athalye, Logan Engstrom, Andrew lyas, and Kevin Kwok. Synthesizing robust adversarial examples. In Jennifer Dy and Andreas Krause, editors, Proceedings of the 35th International Conference on Machine Learning, volume 80 of Proceedings of Machine Learning Research, pages 283-293, Stockholm, Sweden, 10-15 Jul 2018. PMLR.
Babak Ehteshami Bejnordi, Tijmen Blankevoort, and Max Welling. Batch-shaping for learning conditional channel gated networks. In International Conference on Learning Representations, 2020.
Nandhini Chandramoorthyy, Karthik Swaminathan, Martin Cochet, Arun Paidimarri, Schuyler Eldridge, Rajiv Joshi, Matthew M. Ziegler, Alper Buyuktosunoglu, and Pradip Bose. Resilient low voltage accelerators for high energy efficiency. In 2019 IEEE International Symposium on High Performance Computer Architecture (HPCA). pages 157-158, 2019. doi: N0.1109/HPCA.2019..0 900034
Yu-Hsin Chen, Joel Emer. and Vivienne Sze. Eyeriss: A spatial architecture for energy-efficiess dataflow for convolutional neural networks. ACM SIGARCH computer architecture news, 44(3):367-379 2016.
Jia Deng, Wei Dong, Richard Socher, Li-Jia Li, Kai Li, and Li Fei-Fei. Imagenet: A large-scale hicrarchical image database. In 2009 IEEE Conference Computer Vision and Pattern Recognition, pages 248-255, 2009. doi: 10. 10.110//CVPR.2000 W..VPP..00995068844
Shrikanth Ganapathy, John Kalamatianos, Keith Kasprak, and Steven Raasch. On characterizing threshold sram failures in finfet technology. In Proceedings of the 54th Annual Design Automation Conference 2017, pages 1-6, 2017.
Amir Gholami, Schoon Kim, Zhen Dong, Zhewei Yao, Michael W Mahoney, and Kurt Keutzer, survey of quantization methods for efficient neural network inference. Low-Power Computer Vision, pages 291- 9326. Chapman and Hal//CCC, 2022.
Yunchao Gong, Liu Liu, Ming Yang, and Lubomir Bourdev. Compressing deep convolutional networks using vector quantization. arXiv preprint orXiv:1412.6611 2014.
Kaiming He, Xiangyu Zhang, Shaoqing Ren, and Jian Sun. Deep residual learning for image recognition. In 2016 IEEE Conference on Computer Vision and Pattern Recognition (CVPR), pages 770-778, 2016. doi: 10. 10.1109/CVPR.200 2016.90.
Zhizhong Huang. Jie Chen, Junping Zhang, and Hongming Shan. Learning representation for clustering via prototype scattering and positive sampling. IEEE Transactions on Pattern Analysis and Machine Intelligence. pages 1-16, 2022. doi: 20110//TAM...022222202
10

---

Sung Kim, Patrick Howe, Thierry Moreau, Armin Alaghi, Luis Ceze, and Visvesh Sathe. Matic: Learning around errors for efficient low-voltage neural network accelerators. In 2018 Design, Automation & Test Europe Conference & Exhibition (DATE), pages 1-6, IEEE, 2018.
Skanda Koppula, Lois Orosa, A Giray Yaglikıi, Roknoddin Azizi, Taha Shahroodi, Konstantinos Kancllopou- high-performane deep neural network inference
los, and Onur Mutlu. Eden: Enabling energy-efficicee using approximate dram. In Proceedings of the 52nd Annual IEEE/ACM International Symposium on Microarchitecture, pages 166-181, 2019.
Alex Krizhevsky and Geoffrey Hinton. learning multiple layers of features from tiny images. Technical report, University of Toronto, Toronto, Ontario, 2009.
Seyed-Mohsee Moosavi-Dezfooli; Alhussein Fawzi, Omar Fawzi, and Pascal Frossard. Universal adversarial perturbations. In Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition (CVPR), pages 1765-1773, 2017.
Tuan Anh Nguyen and Anh Tran. Input-aware dynamic backdoor attack. Advances in Neural Information Processing Systems (NeurIPS), 33:3454-3464, 2020.
Ozan Özdenizci and Robert Legenstein. Improving robustness against stealthy weight bit-flip attacks by output code matching. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pottern Recognition, pages 13388 13397, 2022.
Mohammad Rastegari. Vieente Ordonez. Joseph Redmon, and Ali Farhadi. Xnor-net: Imagenet classification using binary convolutional neural networks. In European Conference on Computer Vision (ECCV), pages 525-542 Springer, 2016.
Brandon Reagen, Paul Whatmough, Robert Adolf, Saketh Rama, Hyunkwang Lee, Sac Kyu Lee, José Miguel Hernández-Lobato, Yeon Wei, and David Brooks. Minerva: Enabling low-power, highly-accurate deep neural network accelerators. 2016 ACM/EEE 43rd Annual International Symposium on Computer
Architecture (ISCA), pages 267-278, 2016. doi: 10.1 109/1SCA, 2011..2.
Olaf Ronneberger, Philipp Fischer, and Thomas Brox. U-net: Convolutional networks for biomedical image segmentation. In International Conference on Medical Image Computing and Computer Assister-Assisted Intervention, pages 234-241. Springer, 2015.
Ananda Samajdar, Jan Moritz Joseph, Yuhao Zhu, Paul Whatmough, Matthew Mattina, and Tushar Krishna. A systematic methodology for characterizing scalability of dnn accelerators using scale-sim. In 2020 IEEE International Symposium on Performance Analysis of Systems and Software (ISPASS), pages 58-68, 2020.
K. Simonyan and A. Zisserman. Very deep convolutional networks for large-scale image recognition. In International Conference on Learning Representations (ICLR), 2015.
Vladislav Sovrasov. pttlops: a flops counting tool for neural networks in pytorch framework, 2018-2023, URL https:// /itb/b.tthhuh.. wtt.hhu...mm///////eee/ee wotm///oorasor/flossooooooo counter pytorch. Github Repository.
Gopalakrishnan Srinivasan, Parami Wijesinghe, Syed Shakib Sarwar, Akhilesh Jaiswal, and Kaushik Roy. Significance driven hybrid 8t-6t sram for energy-efficient synaptic storage in artificial neural networks. In 2016 Design, Automation & Test in Europe Conference Exhibition (DATE), pages 151-156. IEEE, 2016.
Johannes Stallkamp. Mare Schlipsing, Jan Salmen, and Christian Igel. Man vs. computer: Benchmarking machine learning algorithms for traffic sign recognition. Neural Networks, 32:323-332, 2012.
David Stutz, Nandhini Chandramoorthy, Matthias Hein, and Bernt Schiele. Bit error robustness for energy- efficient dan accelerators. In A. Smola, A. Dimakis, and I. Stoica, editors, Proceedings of Muchine Learning and Systems, volume 3. pages 569-598, 2021.
Laurens van der Maaten and Geoffrey Hinton. Visualizing data using t-sne. Journal of Machine Learning Research, 9(86):2579 26005, 2008.
Dongxian Wu, Shu- Tao Xia, and Yisen Wang. Adversarial weight perturbation helps robust generalization. In H. Larochelle, M. Ranzato, R. Hadsell, M.F Balcan, and H. Lin, editors, Advances Neural Information Processing Systems, volume 33, pages 2958-2969. Curran Associates, Inc., 2020.
Jiaxiang Wu, Cong Leng, Yuhang Wang, Qinghao Hu, and Jian Cheng. Quantized convolutional neural networks for mobile devices. In Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition (CVPR), pages 4820-4828, 2016.
Haichuan Yang, Yuhao Zhu, and Liu. Ecc: Platform-indepeeddent energy energy-constrained deep neural network compression via bilinear regression model. In Proceedings of the IEEESCVF Conference on Computer Vision and Pattern Recognition (CVPR), pages 11206 11215, 2019a.
Haichuan Yang. Yuhao Zhu, and Ji Liu. Energy-come constraind compression for deep neural networks via weighted sparse projection and layer input masking. In International Conference on Learning Representations (ICLR), 2019b.

---

Haichuan Yang, Shupeng Gui, Yuhao Zhu, and Ji Liu. Automatic neural network compression by sparsity- quantization joint learning: A constrained optimization-based approach. In Proceedings the IELE/CVF Conference on Computer Vision and Puttern Recognition (CVPR). 2020.
Tien-Ju Yang. Yu-Hsin Chen, and Vivienne Sze. Designing mmery--ffficiem convolutional neural networks using energy-aware pruning. In Proceedings of the IEEE Conference Computer Vision and Pattern Recognition (CVPR), pages 5687-5695, 2017.
Hongyang Zhang, Yaodong Yu, Jiantao Jiao, Erie Xing, Laurent El Ghaoui, and Michael Jordan. Theoretically principled trade-off between robustness and accuracy. In International Conference on Machine Learning (ICML), pages 7472-7482. PMLR, 2019.
12

---

Appendix
The appendix provides more implementation details for our method, experimental results on more datasets and settings, ablation studies, and qualitative analysis. The appendices cover the following:
Implementation Details: NeuralFuse Training Algorithm (Sec. A), NeuralFuse Generator (Sec.
B), Energy/Accuracy Tradeoff (Sec. C), Latency Reports (Sec. D)
Experimental Results: Ablation Studies (Sec. E), Relaxed Access (Sec. F), Restricted Access
(Sec. G), Reduced-preciiite Quantization (Sec. H), Adversarial Training (Sec. 1), Adversarial Weight Perturbation (Sec. J)
Qualitative Studies: Data Embeddings Visualization (Sec. K); Transformed Inputs Visualization (Sec. L.)
A Training Algorithm of NeuralFuse
Algorithm Training steps for NeuralFuse
Input: Base model Mn: Generator G: Training data samples X; Distribution the perturbed models Mz: Number of perturbed models N; Total training iterations T
Output: Optimized parameters Wg for the Generator
1: for t = 0.... - do
2: for all mini batnhes (x, 1 X do
3: Create transformed inputs X, = F(x) clipp-..i G(x)).
4: Sample perturbed models (Mp,,... Mpx from Mp under p% random bit errors.
5: for all Mp: {Mp.. Mp.. do
6:
Calculate the loss Lp. based on the output of the perturbed model Mp. Then calculate the gradients Ip. for Wg based on Cp.-
7:
end for
Calculate the loss Lo based the output of the clean model Mo- Then calculate the gradients Go for Wg based on Lo- 9: Caleulate the final gradient Ifinal using (5) based go and Ip, ... 9px-
8:
10: Update Wg using Ifinot-
end for
12: end for
B Implementation Details of NeuralFuse Generator
We consider two main goals in designing the NeuralFuse Generator: efficiency (so the overall energy overhead decreased) and 2) robustness (so that can generate robust patterns on the input image and overcome the random bit flipping in subsequent models). Accordingly, we choose utilize an encode-decoder architecture in implementing the generator. The design of ConvL is inspired by Nguyen and Tran [2020], in which the authors utilize similar architecture design input- aware trigger generator, and have demonstrated its efficiency and effectiveness. Furthermore, we attempted to enhance it by replacing the Upsampling layer with Deconvolution layer, leading the creation of DeConvL. The UNetL- NeuralFuse draws inspiration from Ronneberger et al. [2015], known for its robust performance image segmentation, and thus, incorporated it as one of our architectures. Lastly, ConvS, DeConvS, and UNetS are scaled-down versions of the model designed to reduce computational costs and total parameters. The architectures of Convolutional based and Deconvolational-aassee are shown in Table 4, and the architecture of UNet-based generators is in Table 5. For abbreviation used in the table, ConvBlock means the Convolution block, Conv means single Convolution layer, DeConyBlos Deconvolution layer, and BN means a Batch Normalization layer. We use learning rate = 0.001, A = 5, and Adam optimizer. For CIFAR-10. 10, GTSRB, and CIFAR- 100, set batch size b 25 for each base model. For ImageNet-10, we set = 64 for ResNet18, ResNet50 and VGGI1, and = 32 for both VGG16 and VGG19.
means the Deconvolution block, DeConv means a single
13

---

Table 4: Model architecture for both Convolution-based and Deconvolution-based generators. Each ConvBlock consists of a Convolution (kernel = 3 x 3, padding = 1, stride 1), a Batch Nor- malization, and ReI.U layer. Each DeConyBlod consists of Deconvolution (kernel = x
padding = L, stride = 2), a Batch Normalization, and a ReLU layer.
Conv1.
ConvS
DeConvT
DeConvS
Layers
Layers
#CHs
Layers
#CHs
Layers
#CHb
(ConyBlock)x2, MaxPool
ConvBlock, Maxpool
32
(ConyBlock)24 MaxPool
32
ConvBlockk Maxpool
32
(ConyBlock)x2, MaxPool
ConvBlock, Maxpool
(ComyBlock)x2, MaxPool
64
ConvBlock, Maxpool
(Con-Bluck)x2, MaxPool
ConvBlack, Maxpuol
64
(ConvBlackx22 MaxPool,
ConvBluck, Maspoul
ConvBlock, UpSpmple, ConvBlock
CouvBlock, UpSample
64
ConvBlock
128
DeConvBlock
64
ConyBlack, UpSample, ConvBlock
64
Conv Bleck, UpSample
32
DeConvBlock, Con Block
64
DeConvBlack
32
ConvBlock, UpSmmple, ConvBlock
32
Conv Block, UpSample
3
DeConvBlock, Cony Block
32
DeConv, BN, Tanh
Cony, BN, Tanh
32
Conv, BN, Tanh
3
Cony, BN, Tanh
3
[Note] #CHs:
number of channels.
Table 5: Model architecture for UNet-based generators. Each ConvBlock consists of a Convolution (kerel== 3 x 3, padding = stride 1), Batch Normalization, and ReLU layer. Other layers. such as the Deconvolutional layer (kernel = 2 x 2, padding = 1, stride = 2), are used in UNet-based models. For the final Convolution layer, the kernel size is set 1.
UNetL.
UNetS
Layers
#Channels
Layers
#Channels
LI: (ConvBlock)x2
16
LI: (ConvBlock)x2
L2: Maxpool, X
32
1.2: Maxpool, (lonvBloc))22 x
16
L3: Maxpool, (ConvBlock)x2
64
L3: Maxpool, 2
32
L4: Maxpool, (ConvBlock)x22
128
L4: Maxpool, (ConvBlock)x2
64
15: DeConv
15: DeConv
166 Concat[L.3, 155
128
166: Concat[L.3, 1.5]
L7: (ConvBlock)x2
L7: (ConvBlock)x2
L8: DeConv
L8: DeConv
19: Concat(1.2, L8]
19:: Concat(1.2, L8]
L10: (ConyBlock)x2
L10: xConvBlock)x2
LII: DeConv
16
LII: DeConv
L12: Concat[L.I LII]
32
L12: Concat[L.I LI1]
16
L13: (ConvBlock)x2
16
L13: (ConvBlock)
L14: Conv
L.14 Conv
C NeuralFuse's Energy/Accuracy Tradeoff
SCALE-SIM. SCALE-SIME [Samajdar et al., 2020] is systolic array-based CNN simulator that can calculate the number of memory accesses and the total time in execution cycles by giving the specific model architecture and accelerator architectural configuration as inputs. In this paper, use SCALE- SIM to calculate the weights memory access of 5 based models (ResNet18, 8, ResNet50, VGG11, VGG16, VGG19), and generators (ConvI., ConvS, DeConvl., DeConvS, UNetL., UNetS). While SCALE-SIM supports both Convolutional and Linear layers, it does not yet support Deconvolution layers. Instead, we try to approximate the memory costs of Deconvolution layers by Convolution layers. We change the input and output from Deconvolution into the output and input of the Convolution layers. Besides, we also change the stride into when we approximate padding for the convolution layers while generating input files for SCALE-SIM, In this paper, we only consider the energy saving on weights accesses, so we only take the value "SRAM Filter Reads" from the output of SCALE-SIM as the total weights memory accesses (T.W.M.A.) for further energy calculation.
We also add
In Table 6, we report the total weight memory access (T.W.M.A.) using SCALE-SIM. We then showed the energylaccuracy tradeoff between all of the combinations of NeuralFuse and base models under a 1% of bit error rate in Figure 5.
Parameters and MACs Calculation. In addition to T. W.M.A.A. the number of parameters and MACs (multiply-accumml operations) are also common metrics in measuring the energy consumption of machine learning models. Yang al. [2017] have shown that the energy consumption of computation
14

---

VGG19 Table 6: The total weights memory access calculated by SCALE-SIM.
Base Model
ResNet18
ResNet50
VGG11
VGGI6
VGGI9
T.W.M.A.
2,755,968
6,182,144
1,334,656
2,366,848
3,104,128
NuuralFuse
ConvL
ConvS
DeConvL
DeConvS
UNetL
UNetS
T.W.M.A.
320,256
41,508
259,264
86,208
180,894
45,711
[Note] T.W.M.A.: total weight memory access.
Comparison under 1% CIFAR-10
VGG CICmn.
VCC Droan.
Sand
DeComl
Perturbed Aetumayy)
VSG DDDDCCm
Rechente DeCordd
Reehwdd SeConda
VIGIT-UU
VGCISHUNE
Dechestt
Postactte JUAS
Energy Saving Percertage (%%)
Figure 5: The energy/accuracy tradeoff of different NeuralFuse implementations with all CIFAR-10 pre-trained based models. The X-axis represents the percentage reduction in dynamic memory access energy at low-voltage settings (base model protected by NeuralFuse) compared to the bit-error- free (nominal) voltage; the Y-axis represents the perturbed accuracy (evaluated at low voltage) with a 1% bit error rate.
and memory accesses both proportional MACs, allowing us to take computation energy consumption into account.
Here, use the open-source package ptflops [Sovrasov, 2018-2023] to calculate the parameters and MAC values of all the base models and the NeuralFuse generators, in the same units as Bejnordi et al. [2020] used. The results are shown in Table 7. Note that modified the base model architectures for ImageNet-10, 10, as it has larger input sizes. For example, we use a larger kernel size = 7 instead of 3 in the first Convolution layer in ResNet-based models to enhance the learning abilities. Therefore, the parameters of base models are different between different datasets. For NeuralFuse generators, we utilize the same architectures for implementation (including ImageNet-10). As result, our proposed NeuralFuse generators are generally smaller than base models, either on total model parameters or MAC values.
Table 7: Parameter counts and MACs for all base models and generators in this paper.
Base Model
ResNet18
ResNe150
VGGI1
VGGI6
CIFAR-10
11.173,962
23,520,842
9,231,114
14.728,266
20,040,522
Parameter
ImageNet-10
11.181.642
23,528,522
128,812.810
134,309.922
139.622,218
CIFAR-10
557.14M 1.82G
1.31G
153.5M
314.43M
399.47M
MACs
ImageNet-10 10
4,12G
7.64G
15.53G
19.69G
NeuralFuse
ConvI.
ConvS
DeConvL.
DeConvS
UNetl.
UNetS
CIFAR-10
Parameter
ImageNet-10
723,273
113,187
647,785
156,777
482,771
121,195
CIFAR-10
80.5M 3.94G
10.34M
64.69M 3.17G
22.44M 1.IG
41.41M 2.03G
10.58M
MAC'
ImageNet-10
506.78M
518.47M
15

---

MACs-based Energy Consumption. We can then use the MAC values to further approximate the end-to-end energy consumption of the whole model. Assume that all values are stored on SRAM and that MAC represents single memory access. The corresponding MACs-based energy saving percentage (MAC-ES, %) can derived from Eq. 7 (c.f. Sec. 4.4), and results can be found Table 8. We can observe that most combinations can save large amount of energy, except that VGG11 with two larger NuuralFuse (ConvL and DeConvL) may increase the total energy. These results consistent with the results reported in Table 2. In addition, we also showed the MACs-based energylaccuracy tradeoff between all of the combinations of NeuralFuse and base models under a 1% of bit error rate in Figure 6.
MAC-ES
MACRuc mall Energy wings
wing
MAC sadid Enery her weliog regiss MACricusaoo Energy Norri yo rveeiaal valagg
X 100%
MAC Eineryy sceind wdag:
(7)
Table 8: The MACs-Based energy saving percentage (%) for different combinations of base models and NeuralFuse.
ConvL
ConvS
DeConyL
DeConvS
UNetL
UNeiS
ResNer18
16.2
28.7
19.0
26.6
23.2
28.7
ResNe150
24.5
29.8
25.7
28.9
27.4
29.8
VGG11
-21.8
23.9
-11.5
16.0
3.6
23.7
VGG16
5.0
27.3
10.0
23.5
17.4
27.2
VGG19
10.4
28.0
14.4
25.0
20.2
28.0
Comparison under 1% of bit enoo rate on CIFAR-10 Based on MACs
Vaent vol teoood
Base Model
VGDit
Rost
VOG cooevs
Reskett
VGS S0-Gon
Rochesd
VOO Dao
Pertubed Accumey)))
VOG 1H-oCCordL
VGG 19- OeCond.
Roster CCCCCA
VOD Carkkaaee
Resher deCeCondd
VGG 1a-
Reshar Nec.
Redber del kirst
ReplassHHUii
Energy Sawing Percentage (%)
Figure 6: The Mac-based energy/accuracy tradeoff of different NeuralFuse implementations with all CIFAR- pre-trained based models. The X-axis represents the percentage reduction in dynamic memory access energy at low-voltage settings (base model protected by NeuralFuse), compared to the bit-error-free (nominal) voltage; the Y-axis represents the perturbed accuracy (evaluated low voltage) with a 1% bit error rate.
Although using ConvL or DeConvL along with base model VGG11 for CIFAR-I0 implies an increase in energy consumption, using other smaller-scale generators, can still save the overall energy and recover the base model's 's accuracy. That said, developers can always choose smaller generators (with orders of magnitude fewer MAC operations than the original network) restore model accuracy, further demonstrating the flexibility of choosing NeuralFuse generators of different sizes.
D Inference Latency of NeuralFuse
In Table 9, we report the latency (batch_size=1, size=1, CIFAAR10//mageNet-100 testing dataset) of utilizing the different NeuralFuse generators with two different base models, ResNet18 and VGG19. While
16

---

NeuralFuse contributes some additional latency, we consider this an unavoidable tradeoff necessary to achieve reduced energy consumption within our framework. Although the primary focus of this paper is not on latency, we acknowledge its importance. Future research could explore designing more lightweight version of the NeuralFuse module or applying model compression techniques to minimize latency. Additionally, we recognize that running NeuralFuse on general general-purpose CPU could lead to different latency and energy consumption figures due to various influencing factors like CPU architecture and manufacturing processes.
Table 9: The Inference Latency of base model and base model with NeuralFuse.
ResNet18 (CIFAR-10)
VGG19 (CIFAR-10)
ResNet18 (ImageNet-10)
VGG19 (ImageNet-10)
Base Model
5.84 ms
5.32 ms
6.21 ms
14.34 ms
ConvL
9.37 ms (+3.53)
8.96 ms (+3.64)
10.51 ms (+4.3)
17.66 ms (+3.32)
+ ConvS
7.86 ms (+2.02)
7.40 ms (+2.08)
8.28 ms (+2.07)
16.72 ms (+2.38)
DDeConVL
9.18 (+3.34)
8.59 ms (+3.27)
10:07 (+3.86)
17.24 ms (+2.90)
+ DeConvS
7.49 ms (+16)
7.04 ms (+1.72)
7.79 ms (+1,58)
15.67 ms (+1.33)
L.Netl.
10.69 ms (+4.85)
10.06 ms (+4.74)
11.14 ms (+4,93)
18.54 ms (+4.20)
UNetS
10.63 (+4.79)
10.13 ms (+4.81)
11.36 (+5.15)
18.60 ms (+4.266
E Ablation Studies
Study for N in EOPM. Here, we study the effect of N used in EOPM (Eq. 5). In Figure 7, we report the results for ConvL and ConvS on CIFAR-10 10 pre-trained ResNet18, under a 1% bit error rate (BER). The results demonstrate that if we apply larger N, the performance increases until convergence. Specifically, for ConvI. (Figure 7a), larger N empirically has smaller standard deviation; this means larger N gives better stability but at the cost of time-consuming training. In contrast, for the small generator ConvS (Figure 7b), we can find that the standard deviation is still large even trained by larger N; the reason might be that small generators are not as capable of learning representations as larger ones. Therefore, there exists tradeoff between the stability of the generator performance and the total training time, In our implementation, choosing N = 5 or 10 is a good balance.
ResNet18, CIFAR-10. 10, BER-1%
ResNet18, CIFAR-10, BER-1%
ConvL
ConvS
60
05
75
N
N
(a) Using ConvL
(b) Using ConvS
Figure 7: The experimental results on using different sizes of N for EOPM.
Tradeoff Between Clean Accuracy (CA) and Perturbed Accuracy (PA). We conducted an experiment to study the effect of different À values, which balance the ratio of clean accuracy and perturbed accuracy. In Table 10, the experimental results showed that a smaller X can preserve clean accuracy, but result in poor perturbed accuracy. On the contrary, larger À can deliver higher perturbed accuracy, but with more clean accuracy drop. This phenomenon has also been observed in adversarial training [Zhang al., 2019].
Comparison to Universal Input Perturbation (UIP). Moosavi-Dezfooli et al. [2017] has shown that there exists universal adversarial perturbation to the input data such that the model will make wrong predictions on a majority of the perturbed images. In our NeuralFuse framework, the universal perturbation is special case when we set g(x) tanh (UIP) for any data sample The transformed data sample then becomes x, clip (x + tanh (UIP)), where x; E [-1, 1j
17

---

Table 10: Experimental results based À value choosing. The results show that = can balance the tradeoff between clean accuracy and perturbed accuracy.
Base Model
ConvL
X
CA
PA
CA (NF)
PA (NF)
RP
10
90.1
88.0 = 1.7
49.1
5
89.8
87.8 + 1.7
48.8
ResNet18
1
92.6
38.9 = 12.4
90.0
84.2 1 3.8
45.3
0.1
91.6
6
26.8
0.01
92.2
43.6 13
4.7
10
89.6
77.9
19
41.9
5
89.8
77.7 +
19
41.7
VGG19
1
90.5
36.0 = 12.0
89.9
73.1
+
37.1
0.1
89.1
51.2
+ 16
15.2
0.01
90.2
36.8
0.8
Note. CA (%) clean accuracy; PA (%). perturbed accuracy; NF: NeuralFuse; and RP: total recover percentage of PA (NF) PA
and UIP is trainable universal input perturbation that has the same size as the input data. The experimental results with the universal input perturbation are shown in Table 11. We observe that its performance much worse than our proposed NeuralFuse. This result validates the necessity of adopting input-aware transformation for learning error-resistant data representations in low-voltage scenarios.
Table 11: Performance of the universal input perturbation (UIP) trained by EOPM on CIFAR-10
pre-traine pre-trained ResNet18.
Base Model
BER
CA
PA
CA (UIP)
PA (UIP)
RP
1%
38.9 + 12.4
91.8
37.9 +
-1.0
ResNet18
92.6
0.5%
70.1
11.6
92.5
70.6 + 11
0.5
1%
26.1
9.4
80.7
21.0 + 5.9
-5.1
ResNet50
92.6
0.5%
61.0 + 10.3
91.9
62.4 + 12
1.4
1% 0.5%
42.2 + 11.6
86.9
43,0 + 11
0.8
VGG11
88.4
63.6 + 9.3
88.2
64.2 + 8.8
0.6
1% 0.5%
35.7 + 7.9
90.1
37.1 + 8.5
1.4
VGG16
90.3
66.6 8.1
90.4
67.3 + 8.1
0.7
1 %
36.0
12.0
89.9
35.3 + 12
-0.7
VGG19
90.5
0.5% %
64.2 + 12.4
90.1
64.4 + 12
0.2
Note, BER: the bit-error rate of the base model; CA (%): clean accuracy; PA (%); perturbed accuracy; UIP: universal input transformation parameter, and RP: total recovery percentage of PA (UIP) vs. PA
18

---

Additional Experimental Results on Relaxed Access Settings
We conducted more experiments Relaxed Access settings to show that our NusralFuse can protect the models under different BER The results can be found in Sec. F.1 (CIFAR-10), Sec. F.2 (GTSRB), Sec. F.3 (ImageNet-10), and Sec. F.4 (CIFAR-100). For comparison, we also visualize the experimental results in the figures below each table.
F1
CIFAR-10
Table 12: Testing accuracy (%) under 1% and 0.5% of random bit error rate on CIFAR- -1..
Base
1% BER
0.5 % BER
NF
CA
Model
PA
CA (NF)
PA (NF)
RP
PA
CA (NF)
PA (NF)
RP
ConvL
89.8
87.8 + 1.7
48.8
90.4
87.9 + 2.2
17.8
ConvS
88.2
59.5 + 11
20.6
91.7
78.4 8.3
8.3
ResNet18
DeConvL
92.6
38.9
89.6
88.5
1 0.8
49.6
70.1
90.2
90.0 1 0.2
19.9
DeConvS
+ 12,4
82.9
68.8 6.4
29.9
+ 11.6
84.1
+ 79.9
9.8
UNetL
86.6
84.6 0.8
45.6
89.7
86.3 + 2.4
16.2
UNetS
84.4
68.8 + 6.0
29.8
90.9
80.7 + 5.8
10.7
ConvL
85.5
53.2 1 22
27.1
90.3
86.5 1: 3.2
25.5
ConvS
85.2
34.6 14
8.5
90.8
73.3 + 8.7
12.3
DeConvL
26.1
87.4
63.3 = 21
37.2
61.0
89.5
26.2
ResNet50
92.6
DeConvS
1 9.4
82.4
42.2 1
17
16.1
1 10.3
90.3
75.5 1 8.1
14.5
UNetL
86.2
75.5 + 12
49.4
89.9
83.9 + 3.6
22.9
UNetS
77.3
56.2 = 19
30.1
89.7
76.1 + 7.2
15.1
ConvL
89.6
872
45.1
89.8
87.0 = 1.3
23.3
ConvS
84.9
7.5
24.1
88.2
5.7
10.9
DeConvL
42.2
89.3
87.
45.0
63.6
89.6
86.9 +
23.2
VGGII
88.4
DeConvS
11.6
85.6
08.2+7.1
26.0
+ 9.3
88.3
75.7 + 4.6
12.1
UNetL
87.1
83.6 1.3
41.4
88.0
82.4 1.8
18.8
UNe1S
85.5
72.7 1: 4.6
30.5
88.1
75.8 1 4.3
12.2
ConvL
90.1
86.0
50.3
90.2
88.5 + 0.9
21.9
ConvS
87.4
59.6 12
23.9
89.9
77.8 1: 4.8
11.1
DeConvL.
35.7
89.7
85.5 + 6.8
49.8
66.6
89.7
8 1.0
21.4
VGG16
90.3
DeConvS
7.9
86.8
66.5 + 11
30.8
1 8.1
90.0
7844
11.8
UNedl
87.4
83.4 4.4
47.7
89.0
86.2 1.5
19.6
UNetS
87.4
71,2 + 8.2
35.5
89.0
80.2 1: 3.5
13.7
ConyL
89.8
77.7 +
19
41.7
90.4
88.1 1: 1.8
23.9
ConvS
87.3
52.7 +
17
16.7
89.6
74.5 + 9.0
10.3
DeConvL
36.0
86.3
78.4
18
42.4
64.2
90.4
88.5 + 1.4
24.3
VGG19
90.5
DeConvS
1 12.0
86.5
58 1
18
22.2
1: 12.4
89.7
75.2 1 8.6
11.0
UNetl.
82.1 +
4.8
46.0
89.1
85.0 +
2.7
UNetS
66.4
+
77.1 + 7.3
Note: CA (%6. clean accuracy; PA (%): perturbed accuracy; NF: NeuralFuse; and RP: total recovery percentage of PA (NF) PA
Nominal NeursiFese)
valtage
Nominal Neura
vellage NeuralFow))
CIEAR eiiii
WOOD
(a) CIFAR-10, 1% Bit Error Rate
CIAILI IE
CENAR moated Bedkets
COAR
(b) CIFAR-10, 10, 0.5% Bit Error Rate
Figure 8: Experimental results CIFAR-10
19

---

F.2 GTSRB
Table 13: Testing accuracy (%) under 1% and 0.5% of random bit error rate on GTSRB.
Base
1% BER
0.5% BER
CA
Model
PA
CA (NF)
PA (NF)
RP
PA
CA (NF)
PA (NF)
RP
ConvL
4.7
54.2
89.5
ConvS
94.4
68.6
31.7
94.8
87.7 4.2
12.4
DeConvL
36.9
95.6
91.3 4.3
54.4
75.2
95.4
93.4 1.1
18.1
ResNet18
95.5
DeConvS
+ 16.0
95.7
78.1 + 9.1
41.2
+ 12.7
95.8
90.1 3.3
14.9
UNetL
96.2
93.8 1 1.0
56.9
96.2
93.5 1 1.6
18.3
UNetS
95.9
85.1 + 6.9
48.2
95.5
91.4
16.2
Convl.
95.6
71.6
42.1
94.6
90.6
16.6
ConvS
94.8
50.5
22
21.0
95.4
8..5
10.5
ResNet50
DeConvL
95.0
29.5
94.9
71. 21
42.0
74.0
94.7
2.9
17.6
DeConvS
16.9
93.0
56.4
26.9
+ 13.0
94.6
5.9
13.5
UNetl.
94.5
80.6
51.1
96.5
9.3
19.7
UNetS
94.7
64.7 = 22
35.2
95.9
90.6 = 4.8
16.7
ConvL
94.8
85.7 7.2
92.6 92.6
ConvS
91.1
62.2
27.3
90.9
8.5
15.7
DeConvL
34.9
95.0
84.6 7.6
49.7
64.9
93.6
0.6
27.1
VGG11
91.9
DeConvS
12.4
92.4
67.5
32.6
+ 10.8
92.3
83.1
18.2
UNetL
92.2
83.2 6.0
48.3
94.8
9.76
25.7
UNerS
94.7
73.4
10
38.5
94.6
8
24.1
ConvL
96.3
72.4
57.3
9
ConvS
94.1
39.8
24.6
94.3
82.2
23.4
DeConvL
15.1
96.4
72.0
56.9
58.8
95.6
9..1
34.3
VGG16
95.2
DeConvS
6.8
93.8
50.9
35.8
8.9
95.1
5.3
25.2
UNetL
95.8
78.6
63.5
96.0
9..
34.0
UNetS
94.3
14 63.3
48.1
95.4
=
29.0
ConvI.
96.0
88.3
51.7
95.6
93.4 2.1
24.2
ConvS
69.0
32.4
87.0 +
17.8
DeConvL
36.6
95.4
87.2 7.5
50.6
69.1
95.5
92.4 2.2
23.3
VGG19
95.5
DeConvS
6.8
94.5
73.1
36.5
+ 11.1
95.5
88.8 3.7
19.7
UNetl.
95.4
88.2
6.7
51.7
94.9
91.7 + 2.5
22.6
UNerS
94.6
80.6
9.0
44.1
96.5
90.8
3.4
21.6
Note: CA (%): clean accuracy; PA (%): perturbed accuracy; NF: NeuralFuse; and RP: total recovery percentage PA (NF) vs. PA
Nominal (wio NeuralPauee)
Low voltage (wio NeuralFuze)
Nominal Neuralitsee
Low voltage (wi NeuralPose)
CT33 pm molieed Jobiiz
CTE3 wwe.udd
tnkted
CT: Co
20 090 you portia
(a) GTSRB, 1% Bit Error Rate
pr
(b) GTSRB, 0.5% Bit Error Rate
Figure 9: Experimental results on GTSRB.
20

---

F.3
ImageNet-10
Table 14: Testing accuracy under 0.5% of random bit error rate on ImageNet-10.
Base
0.5% BER
NF
CA
Model
PA
CA (NF)
PA (NF)
RP
ConvL.
94.0
88.0 + 2.0
15.7
ConvS
91.8
83.6 4.1
11.3
DeConvL
94.0
8.3
16.9
ResNet18
92.2
72.3 + 7.0
DeConvS
92.8
2.3
15.2
UNetL
94.0
8.41
15.8
UNetS
93.2
86.4
14.1
ConvL
92.2
8
40.6
ConvS
91.8
65.0 11
25.6
DeConvL
93.0
7.94
40.0
ResNet50
89.8
39.4 11
DeConvS
93.2
7.1
31.5
UNetL
92.2
8
41.1
UNetS
92.4
739
34.2
ConvL
92.0
8.71
38.3
ConvS
89.4
6.14
18.6
DeConvL
91.0
8..0
38.2
VGG11
91.6
47.8 13
DeConvS
89.0
72.5
24.7
UNetL
92.4
8.5
35.2
UNetS
86.2
73.5 6.0
25.7
ConvL.
90.8
77.1
38.7
ConvS
90.2
60.2 + 14
21.8
DeConvL
91.2
77.2 + 11
38.8
VGG16
94.6
38.4 + 17
DeConvS
90.0
62.3 + 14
23.9
UNetL
90.6
5.9
42.7
UNetS
86.4
72.3 8.8
33.9
ConvL
91.4
75.5 8.8
38.3
ConvS
88.8
56.5 13
19.3
DeConvL
91.0
75.9
38.7
VGG19
92.4
37.2 + 11
DeConvS
88.8
64.0
11
26.8
UNetL
89.4
77.9 -
6.1
40.7
UNetS
87.6
65.9 + 10
28.7
Note. CA (%): clean accuracy; PA (%): perturbed accuracy; NeuralFuse; and RP: total recovery percentage of (NF) vs.
Nominal (wio Nesr
Low voltage (wio NeuralFuse)
Nominal (w) NeuralPase)
Low voltage (wi NeuralPase)
Ieaecvenióge tabed Rubonss
Imaghht ot Sedtee
Imaecles di prstmbbet VOOL
Zeapclesd0pe entud Vodts
bragehi Jigr Inbed WooD
Fog Sare 2007
Figure 10: Experimental results on ImageNet-10, 0.5% Bit Error Rate.
21

---

F.4 CIFAR-100
As mentioned in the previous section, larger generators like ConvL, DeConvL, and UNetL have better performance than small generators. For CIFAR- 100, we find that the gains of utilizing NeuralFuse are less compared to the other datasets. We believe this is because CIFAR-100 is more challenging dataset (more classes) for the generators to learn protect the base models. Nevertheless, NeuralFuse can still function to restore some degraded accuracy: these results also demonstrate that different datasets. In addition, although the recover percentage is
NusralFuse is applicable less obvious on CIFAR- 100 (the more difficult dataset), we can still conclude that our NeuralFuse is applicable to different datasets.
Table 15: Testing accuracy (%) under 1,, 0.5% and 0.35% of random bit enror rate on CIFAR-100
NF
1% BER
(NF)
0.5% BER
(A
0.35% BER
(NF)
Conel.
$4.8
11.0 + 1.7
6.4
63.2
39.0 7.1
18.1
69.4
42.9 6.
11.4
ConvS
49.7
4.2 2.2
-0.4
70.0
24.5 7.6
3.6
72.1
35.1 7.3
3.7
R8
DeComs
DeComLL
73.7
4.6
55.2
11,9 8.2
7.3
20,9
66.3
38.2 6.9
17.3
3144
69.2
5.5
19.2
UNerS
26.8
4,6 2.5
-0.0
67.1
28.8 1: 6.8
7.9
70.9
38.3 4:
6.9
CamL
63.5
3.2 1.7
0.1
68.4
28.8 6.7
7.5
72.0
2:
5.1
ConeS
65.5
3.2 1
71.9
23.1 6.9
1.9
73.0
1.01
1.7
DeComL
DeComS
61.1
70.3
25.0
72.8
7.9
3.3
INNel.
39.0
5.0 + 1.7
1.9
66.6
36.5
6.2
15.3
70.8
45.3
9.6
LNNesS
$7.7
3,4 + 1.8
0.3
69.1
26.
6.6
4.8
72.6
39.6 +: 7.8
3.9
Comd.
58.3
11.5
63.1
38
15.0
63.9
42.4 9.0
ConvS
VGGH
DeComS
DeComLL
64.8
82
5.7
60.3
58.3
21.2 11
11.8 1: 7.9
13.0
3.5
1. 9.9.
23.9
61.9
63.9
29
40.0
1 9.9
9.0
16.2
5.9
1 10
31.3
63.5
64.0
36.1
12.8 9.1
10
4.8
UNel.
51.1
22.1 1: 8.2
13.9
6188
87.8 9.01
13.9
63.5
40. + 9.3
9.6
UNeeS
Camdl
Conv$
44.3
+
0.1
63.8
21
688
5.1
66.0
36.3 61
5.1
VGG16
DcComS
DeCoevL
67.8
3.5
7.0
23.5
53.1
20.8 +: 6.2
14.2
-1.8
22.4
7.0
62.1
62.8
29.9
42.1
1 6.7
5.5
19.8
7.5
7.2
31.1
64.9
65.0
38.1 6.63
46.6
+ 5.2
15.5
7.0
UNNel.
$0.2
25.3
61.7
41.3
UNesS
Comel
50.4
29.2 +:
18.6
63.6
46.5
= 6.8
12.5
66.9
49.1
7.0
ConyS
63.7
14.4 d: 5.1
3.8
66.6
38.3
2 6.8
4.2
67.7
45.3 2.5
3.2
VGG19
DeComs
DeComL
10.6
60.1
29.6
19.0
34.0
65.7
46.9
1
12.9
42.1
7.6
7.6
UNetl
5K.7
30.2
19.6
12.9
67.4
7.9
LiNetS
59.1
18.0
6.2
7.4
66.3
40.1
K.0
6.1
67.5
46.6
8.4
4.5
Note. CA (%)
accurcyy (%) perturhed accuracy: NE: NeuralFuse: and recovery percentage
PA
Nominal (wio NeuralPaase)
Low voltage (wio NeuralPure)
Nominal Neuralluse)
Low voltage (wi NeuralPose)
(a) CIFAR-100, 1% Bit Error Rate
COAROUE Bedorta
(b) CIFAR-100, 0.5% Bit Error Rate
(c) CIFAR-100, 0.35% Bit Error Rate
Figure 11: Experimental results on CIFAR-100.
22

---

G Additional Experimental Results on Restricted Access Settings (Transferability)
We conduct more experiments with Restricted Access settings to show that our NeuralFuse can be transferred to protect various black-box models. The experimental results are shown Sec. G.1 (CIFAR-10), Sec. G.2 (GTSRB), and Sec. G.3 (CIFAR-100).
We find that using VGG19 white-box surrogate model has better transferability than ResNet1 8 for all datasets. In addition, we can observe that some NuuralFuse generators have downward applicubility if base models have similar architecture. In other words, if we try to transfer generator trained on a large BER (e.g.. 1%) to a model with a small BER (e.g.. g.. 0.5%). the performance will be better than that of generator trained with the original BER (e.g., 0.5%). For example, in Table 16, could find that if we use VGG19 as source model to train the generator ConvL (1%), the generator could deliver better performance (in terms of PA (NF)) when applied similar base models (e.g.. VGGI VGGI6, or VGG19) under a 0.5% BER, compared to using itself as source model (shown in Table 12). We conjecture that this is because the generators trained on larger BER can also cover the error patterns of smaller BER, and thus they have better generalizability across smaller B.E.Rs.
To further improve the transferability to cross-architecture target models, also conduct experi- ment in Sec. G.4 to show that using ensemble- based training can help the generator to achieve this feature.
G.1 CIFAR-10
The results of CIFAR-10 which NeuralFuse is trained at 1% BER are shown in Table 16.
Table 16: Transfer results on CIFAR-10: NeuralFuse trained on SM with 1% BER
ConvL (1%)
UNetL (1%)
SM
TM
BER
CA
CA (NF)
(NF)
(NF)
PA (NF)
18
0.5%
92.6
70.1 1 11.6
89.8
89,5 1: 0.2
19.4
86.6
86.2 1: 0.3
16.1
26.1
9.4
36.0
9.9
38.8 = 19
12.7
ResNet50
92.6
89.5
85.2
0.5%
61.0 + 10.3
75.1 = 10
14.1
77.1 = 5.0
16.1
1%
42.2 11.6
62.5 8.4
20.3
61.1 +: 8.5
18.9
VGG11
88.4
88.4
76.8
ResNet18
0.5%
63.6 9.3
81.0 4.6
17.4
73.7 +
1%
35.7 + 7.9
63.3 18
27.6
59.9 = 16
24.2
VGGI6
90.3
89.6
85.2
0.5%
66.6 8.1
85.0 3.4
18.4
80.2
13.6
1%
36.0 + 12.0
50.7 + 22
14.7
51.1 + 16
15.1
VGG19
90.5
85.3
0.5%
64.2 12.4
80.2 8.7
16.0
76.5
12.3
1%
38.9 12.4
61.0 + 17
22.1
69.7 + 11
30.8
ResNet18
92.6
89.8
87.0
0.5%
70.1 11.6
86.1 6.9
16.0
84.2 3.0
14.1
1%
26.1 11 9.4
34.0 1: 19
7.9
44.2 1: 17
18.1
ResNet50
92.6
89.9
87.0
0.5%
61.0 10.3
76.5 10
15.5
80.7 = 4.2
19.7
VGG19
42.2
76.5 7.0
34.3
79.9
VGGI1
88.4
89.7
87.1
0.5%
63.6 1. 9,3
88.0 1. 2.1
24.4
85,4 1 0.8
21.8
1%
35.7
7.9
75.5
39.8
78.9
43.2
VGG16
90.3
89.6
87.2
0.5%
66.6 +
8.1
88.9 = 0.6
22.3
86.2 = 0.3
19.6
VGG19
0.5%
90.5
64.2
12.4
89.8
89.6
8.7
25.4
87.4
86.8
0.4
22.6
Note. SM: source model, used for training generators; TM: target model, used for testing generators; BER: the bit-eror rate of the target model; CA (%): clean accuracy; PA (%): perturbed accuracy; NF: NeuralFuse; and RP: total recovery percentage PA (NF) vs. PA
23

---

G.2 GTSRB
In Tables 17 and 18, we show the results on GTSRB which NeuralFuse is trained 1.5% and 1% BER, respectively.
Table 17: Transfer results on GTSRB: NuuralFuse trained on SM with 1.5% BER
ConvL. (1.5%)
UNetL (1.5%)
SM
CA (NF)
(NF)
RP
PA (NF)
RP
1%
36,9 16.0
93.9 = 1.9
57.0
94.4 0.4
57.5
ResNet18
95.5
95.7
94.9
0.5%
75.2 12.7
95.7 1 0.2
20.5
94,8 0.2
19.6
29.5 16.9
37.0
7.5
47.1 23
17.6
ResNet50
95.0
94.4
94.4
0.5%
74.0 + 13.0
77.5 = 13
3.5
84.8 9.5
10.8
34,9 12.4
45.2
10.3
13
15.6
ResNet18
VGGI1
91.9
92.8
91.4
0.5%
64.9 = 10.8
79.4 = 5.8
14.5
83.9 = 4.2
19.0
1%
15.1 6.8
31.1 1:
15.9
36.8 12
21.7
VGG16
95.2
95.4
94.6
0.5%
58.8 +: 8.9
84.5 +: 8.3
25.8
86.0
27.2
1%
36.6 6.8
56.4 = 15
19.8
60.8 15
24.2
VGG19
95.5
95.0
94.3
0.5%
86.9
18.6
1%
36.9 16.0
50.3 + 12
13.4
63.7 16
26.8
ResNet18
88.4
92.8
0.5%
75.2 12.7
77.9
2.7
87.5
1%
29.5 16.9
29.7 + 17
0.2
40.4 = 21
10.9
ResNer50
95.0
87.5
92.5
0.5%
74.0 + 13.0
67.9 + 17
-6.1
77.5 15
3.5
34.9 12.4
47.1 +:
12.2
12
VGG19
VGGH
91.9
89.7
93.5
0.5%
64.9 +:: 10.8
76.3 1: 5.1
11.4
86.0 = 3.8
21.1
15.1
6.8
14.1
38.5 16
23.4
VGG16
95.2
93.0
93.0
0.5%
58.8 1: 8.9
75.7 1: 12
16.9
79.9 = 8.3
21.1
1%
36.6
6.8
87.4
6.0
50.8
88.7
5.0
$2.1
VGG19
95.5
95.1
94.6
0.5%
69.1
92.4 2.4
23.3
92.4
23.3
SM: source model, used for training generatios; TM: target model, used for lesting generators; BER: model; CA (%): clean accuracy; PA (%): perturbed accuracy; NE: NeuralFuse; and RP: total recovery percentage of PA (NF) vs. PA
the larget
Table 18: Transfer results on GTSRB: NeuralFuse trained on SM with 1% BER
Convl. (1%%
UNetL (1%)
SM
TM
BER
CA
CA (NF)
PA (NF)
RP
CA (NF)
PA (NF)
RP
ResNet18
0.5%
95.5
75.2
12.7
95.7
95.3 1: 0.5
20.1
96.2
95.7 1:
20.5
1%
29.5
16.9
35.6
21
6.1
42.6 1. 23
13.1
ResNe150
95.0
94.5
95.6
0.5%
74.0
13.0
78.8
87.3 =
13.3
1%
34.9
12.4
45.8
11
10.9
47.1 = 14
12.2
VGG11
91.9
93.1
94.0
ResNer18
5.0
16.9
1%
15.1 1 6.8
26.5
12
11.4
32.4 1: 11
17.3
VGG16
95.2
95.5
0.5%
58.8
8.9
82.2 9.0
23.4
85.4
26.6
1%
36.6 1. 6.8
53.2
16.6
60.9 1 15
24.3
VGG19
95.5
94.9
95.6
0.5%
69.1 11.1
85.4 4.5
16.3
87.5 + 3.7
18.4
1%
36.9 16.0
53.1 +:
16.2
63.4 + 18 26.5
ResNet18
95.5
93.7
95.0
0.5%
75.2 12.7
83.9
8.7
89.7 + 4.8
14.5
29.5
30.6
38.9 22
9.4
ResNet50
95.0
92.8
95.4
0.5%
74.0 13.0
74.7 + 18
0.7
81.5 + 16
7.5
VGG19
34.9
12.4
50.6
15.7
58.9 15
VGG11
91.9
93.7
95.1
0.5%
64.9 + 10.8
82.3 1: 5.1
17.4
87.5 - 3.7
22.6
1%
15.1
6.8
27.8
15
12.7
33.5 1: 14
18.4
VGG16
95.2
95.2
95.2
0.5%
58.8
8.9
79.0
20.2
81.8
23.0
VGG19
0.5%
95.5
69.1
11.1
96.0
94.0
2.2
24.9
95.4
93.9 + 2.1
24.8
Note. SM: source model, used for training generators; TM: larget model, used for lesting generators; BER: the bit error rate of the Larget model: (%): accuracy; (%): perturbed accuracy; NeuralFuse; RP: recovery percentage (NF)
24

---

G.3 CIFAR-100
In Tables 19 and 20, we show results on CIFAR-100 with NeuralFuse trained 1% and 0.5% BER, respectively.
Table 19: Transfer results on CIFAR 100: NeuralFuse trained on SM with 1% BER
CouvL
UNetL (1%)
SM
TM
BER
CA
PA
(NF)
(NF)
(NF)
PA (NF)
ResNet18
73.7
=
7.4
54.8
35.8 2
50.6
39.3
1.4
3.0 1.8
2.2
2.4 = 1.9
ResNet50
0.5%
73.5
21.3 + 7.0
44.9
15.9 +
-5.4
41.5
17.1 +
-4.2
0.35%
35.7 - 8.6
23.7 4.1
-12.0
26.2 1:
-9.5
1%
8.2
5.7
9.8 1.5.6
1.6
10.2 5.1
2.0
VGG11
0.5%
64.8
23.9 = 9.4
41.2
24.2
0.3
37.5
24.5 1.55:45
0.6
ResNet18
0.35%
31.3 + 10.0
29.0 +:4
-2.3
28.2 4.5
7.0 1. 3.5
7.9
0.9
10.1 4.5
3.1
VGG16
22.4 = 7.0
44.0
22.4
0.0
26.3
3.9
5.0
VGG19
0.5%
67.8
34.0
44.2
4.8
40.7
1.3+444
0.35%
42,1 4: 9.4
33.2 .48
-8.9
32.8 1: 3.9
9.3
1%
4.6 + 2.9
5.8
1.2
6.8 +
2.2
ResNet18
0.5%
73.7
20.9 = 7.4
55.5
2.36
3.7
57.3
28.1 +:
7.2
0.35%
31.4 + 7.6
31.1 +.5.0
-0.3
36.4 + 4.5
5.0
1%
3.0 1: 1.8
2.8 1:2.1
00.2
3.7 1: 2.4
0.7
ResNer50
0.5%
73.5
21.3 = 7.0
56.1
18.9
-2.4
56.1
22.8 = 8.5
1.5
0.35%
35.7 = 8.6
28.7 1.7-1.8.
33.7 1: 7.0
8.2 5.7
12.3
4.1
15.4
7.2
VGG19
VGGH
30.0
9.4
0.35%
36.5
7.0 3.5
4.44
4,2
13.6
6.6
VGG16
0.5%
67.8
22.4
7.0
53.6
32.4 1.441.7.
10.0
55.2
35,9 1 6.2
13.5
0.35%
31.1 =
7.2
39.4
6.3
8.3
42.4 + 4,9
11.3
0.5%
34.0 +
9.6
+.1
16.2
49.1 3.5
15.1
VGG19
0.35%
42.1 1
9.4
53.1 2.2.3
11.0
52.0 1: 3.1
9.9
Note, SM: source model, used for traiingg generasors; TM: target model, used for testing generators; BER: the bit-error the target model; CA (%6)
accuracy, PA (H)) perurree accuracy; NeuralPuse; and recovery percentage (NF) vs.
Table 20: Transfer results CIFAR-100: NeuralFuse trained on SM with 0.5% BER
ConvL. (0.5%)
UNeiL (0.5%)
SM
TM
BER
CA
PA
CA (NF)
(NF)
RP
CA (NF)
PA (NF)
RP
ReaNet18
0.35%
73.7
31.4
65.2
47.7 2
16.3
66.2
49.2 =
ResNe150
0.5%
73.5
21.3
62.5
24.0 :
63.5
26.4 = 9.1
5.1
0.35%
35.7
36.3
39.4
3.7
23.9
VGG11
64.8
59.2
61.1
ResNat18
0.35%
31.3
10.0
8.7
0.5%
22.4 7.0
14.7
12.3
37.5 =
15.2
VGG16
67.8
59.5
61.4
0.35%
31.1 1 7.2
42.9 6.0
11.8
45,3 1. 4.9
14.2
VGG19
0.5%
34.0 9.6
43.7
9.6
45.0 6.3
11.0
0.35%
42.1 + 9.4
49.0 4-5.5
6.8
50.5 + 5.3
8.3
ResNet18
0.5%
20.9 + 7.4
24.9 6.7
4.0
27.7 = 6.8
6.8
0.35%
31.4 1 7.6
34.4 1. 5.4
3.0
38.1 1: 5.6
6.7
0.5%
21.3 7.0
22.7 7.8
1.4
25.4 = 8.0
4.2
ResNet50
73.5
66.2
66.7
0.35%
35.7
35.5 7.7
-0.2
38.8 + 7.5
3.2
VGG19
VGG11
0.5%
64.8
23.9 +
9.4
59.9
29.3 10
5.4
61.0
31.2 + 9.8
7.4
0.35%
31.3
10.0
36.6 9.5
38.1 1: 9.0
6.8
0.5%
22.4
30.8
33.0 7.3
VGG16
67.8
62.5
62.6
31.1
VOG19
0.35%
42.1
65.6
$2.0
52.6
Note, SM: sounce model, used for training generators; TM: target model, used for testing generators; BER: the bit-error rate the target model; CA (%6 clean accuracy; PA (%) penurbed accuracy; NE, NeuralFuse: and RP: total recovery percentage of PA (NP) PA.
25

---

G.4 Generator Ensembling
To improve the transferability performance on cross- arost-acchteccture cases (e.g., using ResNet-bassd models as surrogate models to train NeuralFuse and then transfer NeuralFuse to VGG-based target models), we try to adopt ensemble surrogate models train our NeuralFuse. The experimental results are shown in Table 21. We use the same experimental settings mentioned in Table 1 but change one source model (e.g., ResNet18 or VGG19) into two (ResNet18 with VGG19) for training. The results show that the overall performance is better than the results shown in Table 1, which means ensemble- based training can easily solve the performance degradation on rross-architecture target models.
Table 21: Transfer results CIFAR-10: Nuse trained
SM with 1.5% BER
ConvL. (1.5%)
UNetL (1.5%)
SM
TM
BER
CA
CA (NF)
PA (NF)
RP
CA (NF)
PA (NF)
RP
1%
38.9
12.4
88.1
1.0
49.2
85.4 1 0.5
46.5
ResNet18
92.6
89.4
86.3
0.5%
70.1 1 11.6
89.2 1 0.2
19.1
86.1 1 0.2
16.0
1%
26.1 9.4
44.0 22
17.9
50.9 1: 20
24.8
ResNe150
92.6
89.3
86.1
ResNer18
0.5%
61.0
80.3 6.7
19.3
78.6 =
17.6
+ VGG19
VGGI
1%
88.4
42.2 + 11.6
89.1
77.0 = 5.6
34.8
85.9
82.3 =.1 4.1
40.1
0.5%
63.6 + 9.3
87.5
23.9
85.0 + 0.6
21.4
1%
35.7
7.9
80.5 8.6
44.8
81.4 + 45.7
VGG16
90.3
89.1
85.7
0.5%
66.6
8.1
88.2 0.7
21.6
85.0
18.4
1%
36.0 1: 12,0
75.1
17
39.1
83.0 =: 3.4
47.0
VGG19
90.5
89.2
86.1
0.5%
64.2
12.4
89.0
0.2
24.8
85.9 =
21.7
Note. SM: source model, used for training generators; TM: target model, used for testing generators; BER: the bit-crror rate of the target model; CA (%). clean accuracy; PA (%). perturbed accuracy: NF: NeuralFuse: and RP: total recovery percentage PA (NF) vs. PA
H
NeuralFuse on Reduced-precision Quantization and Random Bit Errors
As mentioned in Sec. 4.6, we explore the robustness of NeuralFuse low- www-precision quantization of model weights and consider the case of random bit emror.. Here, we demonstrate that NeuralFuse can recover not only the accuracy drop due reduced precision, but also the drop caused by low-voltage- induced bit errors (0.5% BER) under low precision. We selected two NeuralFuse generators (Convl. and UNetL) for our experiments, and these generators were trained with the corresponding base models (ResNet18 and VGG19) at 1% BER (CIFAR-10, GTSRB) and 0.5% BER (ImageNet-10). The experimental results are shown as follows: CIFAR-10 (Sec. H.I), GTSRB (See. H.2), and ImageNet-10 (Sec. H.3). Similarly, for of comparison, visualize the experimental results in the figures below each table. Our results show that NeuralFuse can consistently perform well in low- wwwpprccision regimes well as recover the low-voltage- induced accuracy drop.
H.1 CIFAR-10
Table 22: Reduced-preciite Quantization and with 0.5% BER CIFAR-10 pre-trained models.
Base Model
Convi. (1%)
UNetl. (1%) PA (NF)
#Biis
CA
CA (NF)
PA (NF)
RP
CA (NF)
RP
8
92.6
70.1 + 11.6
89.8
89.5
0.2
19.4
86.6
86.2
0.3
16.1
7
92.5
68.8 + 10.4
89.8
89.5 +
1.7
20.7
86.5
86.0 = 0.5
17.2
6
92.6
68.4 + 11.2
89.7
89.5
0.2
21.1
86.6
85.9 + 0.3
17.5
R8
5
92.4
52.7 - 14.1
89.7
90.0 0.7
37.3
86.5
85.5 0.8
32.8
4
91.8
26.3 1.3310 12.7
89.8
58.7 24.5
32.4
86.6
64.9 14.92225 22.5
38.6
84.8
11.3 1.8
89.8
5.8 10.0
12.8
1.5
86.0
14.8 10.0
3.5
10.0
10.0
0.0
10.0
0.0
10.0
0.0
8
90.5
64.2 + 12.4
12.4
89.8
89.6 8.7
25.4
87.4
86.8
0.4
22.6
7
90.3
66.5 - 8.5
89.8
89.6 -
0.2
23.1
87.4
86.7
0.3
20.2
6
90.1
59.8 13.2
89.9
89.4
3.8
29.6
87.4
86.4
0.7
26.6
VGG19
90.2
37.7
14.1
89.8
78.0
15.8
40.3
87.2
79.8
42.1
87.5
14.7
89.8
27.8
18.9
13.1
87.2
34.4 - 20.5
19.7
3 78.3
10.5 +
1.5
89.7
10.9
2.6
0.4
86.8
11.0
2.9
0.5
2
10.0
10.0 + 0.0
10.0
10.0
0.0
0.0
10.0
10.0
0.0
0.0
Note. CA (%): clean accuracy; PA (%): perturbed accuracy; NF: NeuralFuse; RP: total recovery percentage PA (NF) vs.
PA
26

---

Original Accuracy
wio NeuralPuse
NeuralPase (Convl)
NeuralPase (UNett)
CDMP-U Bubiota (hankud valtao Dowe
CreAB-aa divics flow valaag BEJ)
964
IN Qwentedeen Nambeer
Quindiestas Namber
(a) Base Model: ResNet18, no bit error.
(b) Base Model: 8 0.5% B.E.R.
CIPAR-11 to ruiiee Willow Nicerial wilaege Niv Deww)
CIPAR perttris Wildin whlleg e 1929
23 Quantzation Namber
Quunibutiz Namber
(c) Base Model: VGG19, no error.
(d)
Model: VGGI9, B.E.R.
Figure 12: Results of Reduced-precision and bit errors (0.5%) on CIFAR-10 pre-trained base models.
H.2 GTSRB
Table 23: Reduced Reducced-precisoon Quantization and with 0.5% BER on GTSRB pre-trained models.
Base Model
ConvL (1 1%)
UNetL (1%)
#Bits
CA
PA
CA (NF)
PA (NF)
RP
CA (NF)
PA (NF)
RP
8
95.5
75.2
1 12.7
95.7
95.3 1 0.5
20.1
96.2
95.7 : 0.3
20.5
7
95.5
69.5
= 10.6
95.7
95.3 =
0.3
25.8
96.2
95.9 =
0.3
26.4
95.4
67.2
14.4
95.7
95.2 =
28.0
96.2
95.7
28.5
ResNer18
95.4
48.6
18.2
95.8
92.6
44.0
96.2
94.8 2.5
46.2
4
92.6
24.6
9.8
95.9
75.6
16.2
51.0
96.2
86.6 + 9.5
62.0
3
67.7
5.3 1
3.5
95,4
18.4
15.3
13.1
96.2
25.3 22.5
20.0
2
3.8
3.8 +
0.0
4.1
3.8 - 0.0
0.0
3.8
3.8 1 0.0
0.0
8
95.5
69.1 + 11.1
96.0
94.0
2.2
24.9
95.4
93.9 + 2.1
24.8
95.6
66.1 1: 14.8
96.0
92.2 1
5.7
26.1
95.4
92.6 1 3.7
26.5
95.3
64.2 -
96.0
92.2
28.0
95.4
92.3
28.1
VGG19
95.2
14.0
96.0
44.0
95.4
86.2
8.4
38.0
4
92.0
18.2 = 14.3
93.0
92.2
5.7
74.0
95.0
49.6 = 22.8
31.4
3 60.0
2.0 + 0.9
87.3
92.2
5.7
90.2
87.2
1.7
0.9
-0,3
2 5.9
3.8 +
5.9
3.8
0.0
0.0
5.9
3.8
0.0
0.0
Note. CA (%): clean accuracy; PA (%): perturbed accuracy; NE: NeuralFuse; and RP: total recovery percentage of PA (NF) PA
Original Accuracy
(Convi)
NeuraFPuse (UNetL)
W.S #5
Arcunce
(a) Base Model: ResNet18, no bit error.
(b) Base Model: ResNet18, 0.5% B.E.R.
cr:20 sesttedd Plaskal valaps Euar!
GT22 eettaae rakag
0350300 ega
Mi Qwankadias Number
28 Quintieiaa Narber
(c) Base Model: VGG19, bit error.
(d) Base Model: VGG19, 0.5% B.E.R.
Figure 13: Results of Reduced-precisionn and bit errors (0.5% on GTSRB pre-trained base models.
27

---

H.3 ImageNet-10
Table 24; Reduced- preeccsdd Quantization and with 0.5% BER on ImageNet-10 pre-trained models.
Base Model
ConvL (0.5%) PA (NF)
UNetL (0.5%)
#Bits
CA
PA
CA (NF)
CA (NF)
(NF)
RP
8
92.2
72.3 +
7.0
94.0
88.0 +
2.0
15.7
94.0
88.1 +
1.4
15.8
7
92.4
70.6 + 13.0
94.2
86.7
4.1
16.1
93.6
87.8
3.5
17.2
6
92.4
68.9
9.9
94.2
85.1
4.8
16.2
93.6
86.4 -
3.7
17.5
ResNet18
91.0
60.9
13.0
94.2
82.5
6.8
21.6
94.0
83.2
22.3
91.4
47.4
93.8
68.6
9.8
21.2
92.6
68.7
9.2
21.3
3
85.2
28.8 + 11.8
89.2
44.1
14.0
15.3
89.4
42.7
14.2
13.9
2
10.0
10.0 + 0.0
10.0
10.0 +
0.0
0.0
10.0
10.0 +
0.0
0.0
8
92.4
37.2
11.0
91.4
75.5
8.8
38.3
89.4
77.9
6.1
40.7
92.0
91.2
59.3
13.0
32.0
89.4
65.4
10.0
38.1
6
92.4
27.9 - 6.4
91.0
59.7 + 11.8
31.8
89.4
64,9
9.9
37.0
VGG19
5
92.0
15.1 = 4.4
91.6
23.1
0.7
8.0
89.0
27,9
8.8
12.8
4
89.4
12.2 + 2.7
90.8
14.0 + 4.3
1.8
89.6
14.6
4.9
2.4
3
46.8
9.9 + 0.5
83.2
10.4 + 0.6
0.5
84.2
9.9 9
0.7
0.0
2
10.0
10.0
+ 0.0
10.0
10.0
+
0.0
0.0
10.0
10.0
0.0
0.0
Note. CA (%): clean accuracy; PA (%): perturbed accuracy: NE: NeuralFusc; and RP: total recovery percentage of PA (NF) vs.
PA
Original Accuracy
w/o NeuralFuse
NeuralPase (Convl)
NeuralPase (UNetL)
531032
Acuuar 150
(a) Base Model: 88 no bit error.
(b) Base Model: ResNet18, 0.5% B.E.R.
Imapehien per tnaieal vittre Nivenno walagg, (anee)
Imepehin 23 pre fecime Vildie dowe whege, s0000
40
33 Qarizalan Kanker
24: Gaerlataze Nurber
(c) Base Model: VGG19, bit
(d) Base Model: VGGI9, 0.5% B.E.R.
Figure 14: Results of Reduced-precision and bit errors (0.5% on ImageNet-10 pre-trained base models.
I Additional Experiments Adversarial Training
Adversarial training a common strategy to derive a robust neural network against certain pertur- bations. By training the generator using adversarial training proposed in Stutz al. [2021], report its performance against low voltage-induced bit emrrs. We use ConvL. as the generator and ResNet18 the base model, trained CIFAR-10. Furthermore, the perturbation on weights of the base model during adversarial training, and then for evaluation, will be applied against 1% of bit errors rate on the base model. The results shown in Table 25. After careful tuning of hyperparameters, we find that we are not able to obtain satisfactory recovery when adopting adversarial training. Empirically, we argue that adversarial training may not be suitable for training generator-based methods.
explore different K flip bits as
the
Additional Experiments on Robust Model Trained with Adversarial Weight Perturbation with NeuralFuse
Previously, Wu et [0200] proposed that one could obtain more robust model via adversarial weight perturbation. To seek whether such models could also be robust random bit errors,
28

---

Table 25: Performance of the generator trained by adversarial training under flip bits ResNet18 with CIFAR-10. The results show that the generator trained by adversarial training cannot achieve high accuracy against bit errors under 1% bit error rate.
K-bits
CA
PA
CA (NF)
PA (NF)
RP
100
92.4
38.3
12.1
-0.6
500
92.1
38.7
12.5
-0.2
5,000
92.6
38.9 12.4
92.6
38.9 + 12.5
0
20,000
60.1
23.0 - 8.1
-16
100,000
71.1
23.6 + 6.6
-16
Note, CA (%): clean accuracy; PA (%). perturbed accuracy; NF: Neural- Fuse; and RP: total recovery percentage of PA (NF) vs. PA
conducted experiment CIFAR-10 with the proposed adversarially trained PreAct ResNet18. The experimental results are shown in Table 26. We find that the average perturbed accuracy is 23% and 63.2% for PreAct ResNet18 under 1% and 0.5% BER, respectively. This result is lower than 38.9% and 70.1% from ResNet18 in Table 12, indicating their poor generalization ability against random bit errors. Nevertheless, when equipped NeuralFuse on the perturbed model, could still witness significant recover percentage under both 1% and 0.5% BER This result further demonstrates that NeuralFuse could be adapted to various models (i.e., trained in different learning algorithms).
Table 26: Performance of NeuralFuse trained with rubust CIFAR-10 10 pre-trained PreAct ResNet18. The results show that NeuralFuse can be used together with a robust model and further improve perturbed accuracy under both 1 % and 0.5% BER
Base Model
BER
NF
CA
PA
CA (NF)
PA (NF)
RP
ConvL
87.6
53.7 +:
30.7
ConvS
83.1
34.6 + 15
11.6
DeConvI.
87.7
55.4 +
32.4
1%
89.7
23.0 + 9.3
DeConvS
82.9
32.4 + 14
9.4
UNetL
86.1
60.4 + 28
37.4
PreAct ResNet18
UNetS
80.4
51.9 - 24
28.9
ConvL ConvS
89.2
87.8 + 1.1
24.6
89.2
14.0 6.5
10.8
DeConvL
89.0
8.14
24.2
0.5%
89.7
63.2 + 8.7
DeConvS
89.9
74.4
11.2
UNetL
87.5
85.9 + 0.8
22.7
UNetS
88.2
80.4
3.9
17.2
Note. BER: the bit- error rate of the base model: CA (%): clean accuracy: PA (%): perturbed accuracy; NF: NeuralFuse; and RP: total recovery percentage of PA (NF) vs. PA
K Data Embeddings Visualization
To further understand how our proposed NeuralFuse works, visualize the output distribution from the final linear layer of the base models and project the results onto the 2D space using t-SNE [van der Maaten and Hinton, 2008]. Figure 15 shows the output distribution from ResNet18 (trained on CIFAR-101 1-0 under 1 1% bit eтror rate. We chose two generators that have similar architecture: ConvL and ConvS, for this experiment. We can observe that: (a) The output distribution of the clean model without NeuralFuse can be grouped into 10 classes denoted by different colors. (b) The output distribution of the perturbed model under a 1% bit error rate without NeuralFuse shows mixed representations and therefore degraded accuracy. (c) The output distribution of the clean model with ConvL. shows that applying NeuralFuse will not the prediction the clean model too much (i.e., it retains high accuracy in the regular voltage setting).
(d) The output distribution of the perturbed model with Convl. shows high separability (and therefore high perturbed accuracy) as opposed (b). (c)/(f shows the output distribution of the clcan/perturbed model with ConvS. For both (c) and (f),
29

---

we can see nosier clustering when compared to (c) and (d), which means the degraded performance of ConvS compared ConvL. The visualization validates that NeuralFuse can help retain good data representations under random bit errors and that larger generators in NeuralFuse have better performance than smaller ones.
Clas made Alt Sraeaaaa Accunnca-22.4
Pertu tadd modet in thout heurs Accuaagm35443 425
Cleas EROMH MerrPPe ACLeEEyeaR...
(b)
Furtarbed Accumnoy-16.220
Deat www. MazefTun, Accuno
Phe rease Nocer0o-R2..1
(d)
(e)
(
Figure 15: t-SNE results for ResNet18 trained by CIFAR-10 under 1% of bit error rate. (a) Clean
model. (b) Perturbed model. (c) Clean model with ConvL. (d) Perturbed model with ConvL. (e)
Clean model with ConvS. (f) Perturbed model with ConvS.
L Qualitative Analysis of Transformed Inputs
In this section, we conduct qualitative study to visualize the images transformed by NeuralFuse and present some properties and observations of these images. We utilize six different architectures of NeuralFuse generators trained with ResNet18 8 under a 1% bit error rate.
Figure 16 (a) showcases several images from the truck class in CIFAR-IO. Notably, images of the same class, when transformed by the same NeuralFuse, exhibit similar patterns, such as circles symbolizing the wheels of the trucks.
In Figures 16 (b) and 16 (c), we observe analogous phenomena in the GTSRB and CIFAR- datasets. Transformed images of the same class using the same generator consistently display patterns. On GTSRB, NeuralFuse-gennraan
patterns highlight the sign's 's shape with green background, even if the original images have dark background and are under different lighting conditions. These results further underscore the efficacy and efficiency of NeuralFuse.
Figure 17 presents more images from different classes in (a) CIFAR-10, (b) GTSRB, and (c) CIFAR- 100. The transformed images exhibit distinct patterns for each class, suggesting that NeuralFuse effectively transforms images into class-specific patterns, making associated features robust to random bit errors and easily recognizable by the base model in low-voltage settings.
30

---

Clean
ConvL
ConvS
DeConvL.
DeConvS
UNetL
UNetS
(a) Truck class in CIFAR-IO.
(b) No Passing sign GTSRB.
(c) Apple class in CIFAR- -000
Figure 16: Visualization transformed images from different NeuralFuse generators trained with 8 at 1% bit error rate.
Clean
ConvL.
ConvS
DeConvL
DeConvS
UNetL
UNetS
(a) 10 classes sampled from CIFAR-10
(b) 10 traffic signs sampled from GTSRB
Clean
ConvI.
ConvS
DeConvL
DeConvS
UNetL
UNetS
(c) 20 classes sampled from CIFAR-100
Figure 17: Visualization of transformed images from different NeuralFuse generators trained by ResNet18 with 1% bit error rate.
31

---

NeurIPS Paper Checklist
1. Claims
Question: Do the main claims made in the abstract and introduction accurately reflect the paper's contributions and scope?
Answer: [Yes]
Justification:
We list our main contributions in the Abstract and Introduction.
Guidelines:
The answer NA means that the abstract and introduction do not include the claims made in the paper.
The abstract and/or introduction should clearly state the claims made, including the contributions made in the paper and important assumptions and limitations. A No or
NA answer to this question will not perceived well by the reviewers.
The claims made should match theoretical and experimental results, and reflect how be expected to generalize other settings.
much the results
is fine to include aspirational goals as motivation as long is clear that these goals are not attained by the paper.
2. Limitations
Question: Does the paper discuss the limitations of the work performed by the authors?
Answer: [Yes]
Justification:
We discussed the limitation of our work on runtime/latency in Section 4.4.
Guidelines:
The answer NA means that the paper has no limitation while the answer No means that the paper has limitations, but those are not discussed in the paper.
The authors are encouraged to create separate "Limitations" section in their paper.
The paper should point out any strong assumptions and how robust the results are to violations of these assumptions (e.g., independence assumptions, noiseless settings, model well-specification. asymptotic approximations only holding locally). The authors should reflect how these assumptions might be violated in practice and what the implications would be.
The authors should reflect on the scope of the claims made, e.g., if the approach was only tested on few datasets or with few runs. In general, empirical results often depend on implicit assumptions, which should be articulated.
The authors should reflect the factors that influence the performance of the approach. For example, facial recognition algorithm may perform poorly when image resolution low images are taken in low lighting. Or speech-to-text system might be used reliably to provide closed captions for online lectures because it fails to handle technical jargon.
The authors should discuss the computational efficiency of the proposed algorithms and how they scale with dataset size.
If applicable, the authors should discuss possible limitations of their approach address problems of privacy and faimess.
While the authors might fear that complete honesty about limitations might be used by reviewers as grounds for rejection, a worse outcome might be that reviewers discover limitations that aren't 't acknowledged in the paper. The authors should use their best judgment and recognize that individual actions in favor of transparency play an impor- tant role in developing norms that preserve the integrity of the community. Reviewers will be specifically instructed to not penalize honesty concerning limitations.
3. Theory Assumptions and Proofs
Question:
For each theoretical result, does the paper provide the full set of assumptions and complete (and correct) proof?
Answer: [NA]
32

---

Justification:
This paper does not include theoretical results.
Guidelines:
The answer NA means that the paper does not include theoretical results.
All the theorems, formulas, and proofs in the paper should be numbered and cross- referenced.
All assumptions should be clearly stated referenced in the statement of any theorems.
The proofs can either appear in the main paper or the supplemental material, but they appear in the supplemental material, the authors are encouraged to provide short proof sketch provide intuition.
Inversely, any informal proof provided in the core of the paper should be complemented by formal proofs provided in appendix or supplemental material.
Theorems and Lemmas that the proof relies upon should be properly referenced.
4. Experimental Result Reproducibility
Question: Does the paper fully disclose all the information needed to reproduce the main ex- perimental results of the paper to the extent that affects the main claims and/or conclusions of the paper (regardless whether the code and data are provided or not)?
Answer: [Yes]
Justification:
The implementation details presented in Appendices A and B.
Guidelines:
The answer NA means that the paper does not include experiments.
If the paper includes experiments, a No answer to this question will not be perceived well by the reviewers: Making the paper reproducible is important, regardless of whether the code and data are provided or not.
If the contribution is dataset and/or model, the authors should describe the steps taken to make their results reproducible or verifiable.
Depending on the contribution, reproducibility can be accomplished in various ways. For example, if the contribution is a novel architecture, describing the architecture fully might suffice, or if the contribution is a specific model and empirical evaluation, it may be necessary to either make possible for others to replicate the model with the same dataset, or provide access to the model. In general. releasing code and data is often one good way accomplish this, but reproducibility can also be provided via detailed instructions for how to replicate the results, access to a hosted model (e.g.. in the case of large language model), releasing of a model checkpoint, or other means that are appropriate to the research performed.
While NeurIPS does not require releasing code, the conference does require all submis- sions to provide some reasonable avenue for reproducibility, which may depend on the nature of the contribution. For example
(a) If the contribution is primarily a new algorithm, the paper should make clear how to reproduce that algorithm. (b) the contribution is primarily a new model architecture, the paper should describe the architccture clearly and fully.
(c) If the contribution is new model (e.g., a large language model), then there should either way to access this model for reproducing the results or way to reproduce the model (e.g., with an open-source dataset instructions for how to construct the dataset).
(d) We recognize that reproducibility may be tricky in some cases, in which case authors are welcome to describe the particular way they provide for reprodueibility. the case of closed-source models, may be that access to the model is limited in some way (e.g., to registered users), but it should be possible for other researchers have some path to reproducing or verifying the results.
5. Open access to data and code
Question: Does the paper provide open access to the data and code, with sufficient instruc- tions to faithfully reproduce the main experimental results, as described in supplemental material?
33

---

Answer: [Yes]
Justification:
Our code can be found at https://github. wtt.haab.ccom/////eeaaaaaaaaaaaa
Guidelines:
The answer NA means that paper does not include experiments requiring code.
Please see the NeurIPS code and data submission guidelines (https://nips cc/
for more details.
While we encourage the release of code and data, we understand that this might not be possible, "No" is an acceptable answer. Papers cannot be rejected simply for not including code, unless this is central to the contribution (c.g., for new open-source benchmark).
The instructions should contain the exact command and environment needed to run to reproduce the results. See the NeurIPS code and data submission guidelines (https: /at////ooommsssseeeeeee
/nips. wwtppcccpp/caeeeeecccccccccceeee /ttaeiiuueee/eeeeuuniiieeeeeee ssssonoliccyy for more details.
The authors should provide instructions on data access and preparation, including how to access the raw data, preprocessed data, intermediate data, and generated data, etc.
The authors should provide scripts to reproduce all experimental results for the new proposed method and baselines. If only subset of experiments are reproducible, they should state which ones are omitted from the script and why.
At submission time, to preserve anonymity, the authors should release anonymized versions (if applicable).
Providing as much information as possible supplemental material (appended the paper) is recommended, but including URLs to data and code is permitted.
6. Experimental Setting/Details
Does the paper specify all the training and test details (c.g., data splits, hyper- parameters, how they were chosen, type of optimizer, etc.) necessary understand the results?
Question:
Answer: [Yes]
Justification:
The experimental details are presented Section 4.1, Appendix and our code.
Guidelines:
The answer NA means that the paper does not include experiments.
The experimental setting should be presented in the core the paper to a level of detail that is necessary appreciate the results and make sense of them.
The full details can be provided either with the code, appendix, as supplemental material.
7. Experiment Statistical Significance
Does the paper report error bars suitably and correctly defined or other appropriate information about the statistical significance of the experiments?
Question:
Answer: [Yes]
Justification: For each experimental result, report the mean and standard deviation and plot the error bars.
Guidelines:
The answer NA means that the paper does not include experiments.
The authors should answer "Yes" if the results are accompanied by error bars, confi- dence intervals, statistical significance tests, least for the experiments that support the main claims of the paper.
The factors of variability that the enror bars are capturing should be clearly stated (for example, train/test split, initialization, random drawing of some parameter, or overall with given experimental conditions).
The method for calculating the error bars should be explained (closed form formula, call to a library function, bootstrap, etc.)
The assumptions made should be given (e.g., Normally distributed errors).
34

---

It should be clear whether the error bar is the standard deviation or the standard error of the mean.
is OK to report 1-sigma error bars, but one should state it. The authors should preferably report a 2-sigma error bar than state that they have 96% CI, if the hypothesis of Normality of errors is not verified.
For asymmetric distributions, the authors should be careful not to show in tables figures symmetric error bars that would yield results that are out range (e.g. negative error rates).
If error bars are reported in tables or plots, The authors should explain the text how they were calculated and reference the corresponding figures tables in the text.
8. Experiments Compute Resources
For each experiment, does the paper provide sufficient information on the com- puter resources (type of compute workers, memory, time of execution) needed to reproduce the experiments?
Question:
Answer: [Yes]
Justification:
The computing resources are presented in Section 4.1.
Guidelines:
The answer NA means that the paper does not include experiments.
The paper should indicate the type of compute workers CPU GPU, internal cluster, or cloud provider, including relevant memory and storage.
The paper should provide the amount of compute required for each of the individual experimental runs as well as estimate the total compute.
The paper should disclose whether the full research project required more compute than the experiments reported in the paper (e.g., preliminary or failed experiments that didn't make it into the paper).
9. Code Of Ethics
Question: Does the research conducted in the paper conform, in every respect, with the NeurIPS Code of Ethics https: httpppss////u//s....//// httpssccccppcccccceeeeeeeeeeecee CethiicsCCeeelneeeen
Answer: [Yes]
Justification:
The work stated in this paper conform with the NeurlPS Code of Ethics.
Guidelines:
The answer NA means that the authors have reviewed the NeurlPS Code of Ethics.
If the authors answer No, they should explain the special circumstances that require a deviation from the Code of Ethics.
The authors should make sure to preserve anonymity (e.g., there a special consid- eration due to laws or regulations in their jurisdiction).
10. Broader Impacts
Question: Does the paper discuss both potential positive societal impacts and negative societal impacts of the work performed?
Answer: [Yes]
Justification:
We discussed broader impacts in Section 5,
Guidelines:
The answer NA means that there is no societal impact of the work performed.
If the authors answer NA or No. they should explain why their work has no socictal impact why the paper does not address societal impact.
Examples of negative societal impacts include potential malicious or unintended uses (e.g., disinformation, generating fake profiles, surveillance), fairness considerations (e.g., deployment of technologies that could make decisions that unfairly impact specific groups), privacy considerations, and security considerations.
35

---

The conference expects that many papers will be foundational research and not tied particular applications, let alone deployments. However, if there is direct path to any negative applications, the authors should point it out. For example, it is legitimate to point out that an improvement in the quality of generative models could be used to generate deepfakes for disinformation. On the other hand, it is not needed to point out that a generic algorithm for optimizing neural networks could enable people to train models that generate Deepfakes faster.
The authors should consider possible harms that could arise when the technology is being used as intended and functioning correctly, harms that could arise when the technology being used as intended but gives incorrect results, and harms following from (intentional or unintentional) misuse of the technology.
If there negative societal impacts, the authors could also discuss possible mitigation strategies (e.g., gated release of models, providing defenses in addition to attacks, mechanisms for monitoring misuse, mechanisms monitor how system learns from feedback over time, improving the efficiency and accessibility of MI..
11. Safeguards
Does the paper describe safeguards that have been put in place for responsible release of data models that have high risk for misuse (e.g., pretrained language models, image generators, or scraped datasets)?
Question:
Answer: [NA]
Justification:
This paper poses such risks.
Guidelines:
The answer NA means that the paper poses such risks.
Released models that have high risk for misuse or dual-use should be released with necessary safeguards to allow for controlled use of the model, for example by requiring that users adhere usage guidelines or restrictions to access the model or implementing safety filters.
Datasets that have been scraped from the Internet could pose safety risks. The authors should describe how they avoided releasing unsafe images.
We recognize that providing effective safeguards is challenging, and many papers do not require this, but we encourage authors to take this into account and make best faith effort.
12. Lieenses for existing assets
Question: Are the creators or original owners of assets (e.g., code, data, models), used in the paper. properly credited and are the license and terms of use explicitly mentioned and properly respected?
Answer: [Yes]
Justification: We have cited the original paper that produced the code package dataset.
Guidelines:
The answer NA means that the paper does
existing assets.
The authors should cite the original paper that produced the code package or dataset.
The authors should state which version of the asset is used and, if possible, include URL.
The name of the license (c.g., CC-BY 4.0) should be included for each asset.
For scraped data from a particular source (c.g., website), the copyright and terms of service of that source should be provided.
If assets are released, the license, copyright information, and terms of use in the package should be provided. For popular datasets, paperswi thcode. com com/datasets has curated licenses for some datasets. Their licensing guide can help determine the license of dataset.
For existing datasets that are re-packaged, both the original license and the license of the derived asset (if it has changed) should be provided.
36

---

If this information is not available online, the authors are encouraged to reach out to the asset's 's creators.
13. New Assets
Question: Are new assets introduced in the paper well documented and is the documentation provided alongside the assets?
Answer: [Yes]
Justification:
We described how to code in the README md.
Guidelines:
The answer NA means that the paper does not release new assets.
Researchers should communicate the details of the dataset/code/moodl as part of their submissions via structured templates. This includes details about training, license, limitations, etc.
The paper should discuss whether and how consent was obtained from people whose asset is used.
At submission time, remember to anonymize your assets (if applicable). You can either create an anonymized URL or include an anonymized zip file.
14. Crowdsourcing and Research with Human Subjects
Question: For crowdsourcing experiments and research with human subjects, does the paper include the full text of instructions given to participants and screenshots, if applicable, as well details about compensation (if any)?
Answer: [NA]
Justification:
This paper does not involve crowdsourcing nor research with human subjects.
Guidelines:
The answer NA means that the paper does not involve crowdsoureing nor research with human subjects.
Including this information in the supplemental material is fine, but if the main contribu- tion of the paper involves human subjects, then as much detail as possible should be included in the main paper.
According the NeurIPS Code of Ethies, workers involved in data collection, curation, or other labor should be paid at least the minimum wage in the country of the data collector.
15. Institutional Review Board (IRB) Approvals or Equivalent for Research with Human Subjects
Question: Does the paper describe potential risks incurred by study participants, whether such risks were disclosed to the subjects, and whether Institutional Review Board (IRB) approvals (or an equivalent approval/review based on the requirements of your country or institution) were obtained?
Answer: [NA]
Justification: This paper does not involve crowdsourcing nor research with human subjects.
Guidelines:
The answer NA means that the paper does not involve crowdsourcing research with human subjects.
Depending on the country in which research is conducted, IRB approval (or equivalent) may be required for any human subjects research. If you obtained IRB approval, you should clearly state this in the paper.
We recognize that the procedures for this may vary significantly between institutions and locations, and we expect authors to adhere to the NeurlPS Code of Ethics and the guidelines for their institution.
For initial submissions, do not include any information that would break anonymity (if applicable), such as the institution conducting the review.
37


Reviews:
[{"review_id": "13v95CnfzT", "reviewer": "Reviewer_aRGH", "summary": "The authors train an input pre-processing module which aims to counteract the effects of random bit errors induced by low-voltage SRAM operation. They demonstrate the ability to avoid most accuracy drops on a handful of CNNs while operating in a 0.5-1% error regime.\n\nDisclosure: I have reviewed this paper in the past. I stand by much of my previous review, as the paper has not changed substantially.", "questions": "Feel free to address the zero accuracy degradation scenario above. (I'll note that there are plenty of other papers from the HW community that do solve this problem without accuracy loss, so while I accept that the authors' approach is different---and valuably so, I'm not willing to accept an argument that it's an unreasonably high bar. Just harder.)", "limitations": "Addressed above. No societal concerns.", "rating": 7, "confidence": 4, "soundness": 4, "presentation": 4, "contribution": 3, "strengths": "The paper takes a rather unique approach to trying to counteract bit errors. Instead of fixing the model or the hardware (both of which have been studied extensively, as the authors admit), they pre-transform the input to avoid stepping in areas of the input space which are vulnerable to random bit errors in the model weights.\n\nThe paper is clearly scoped. The authors avoid some common pitfalls with energy cost savings (e.g., they account for the costs of their own technique), and the explanation of end-to-end considerations was probably necessary for readers not used the HW energy measurement. Overall, I felt that the authors did a solid job of balancing practicality (don't want to get too far into SRAM design tweaks) and depth (the energy simulation setup seems like a very reasonable configuration).\n\nThe authors' actual learned model is fairly simplistic. Perhaps others might see this as a weakness, but as I see it, the benefit of this paper is in following the authors' perspective flip to its logical conclusion. If further work wants to attempt something more sophisticated for $\\mathcal{G}(x)$, great. Better surrogates for transfer? Sure. Plenty of room to follow-on later, if someone wants.\n\nUltimately, I see this work as a \"perspective paper\". The energy savings are not anything to write home about, but the approach is qualitatively different, and that makes it valuable. It's healthy to have a method that attacks the problem from a different angle, even if it doesn't quite stack up to state of the art. By analogy, it's worth exploring a very early automobile even if a horse can outrun it---maybe there's more down this road, maybe not. But the authors have at least shown that you can do *something* here, and the explanation and foundation they've provided is stable enough to build on.", "weaknesses": "The authors' approach is not competitive with most existing HW techniques addressing low-voltage operation. This is less bad than it sounds. NeuralFuse bolts a model on to the front of an existing not-optimized-for-robustness model and tries to make the best of things. If one can add low-voltage-aware hardware modifications or low-voltage-aware models, one should. This doesn't make NeuralFuse a bad idea, but it probably does mean that HW, SW, and model builders should be trying to avoid the scenarios where NeuralFuse would be useful. This ultimately limits the practical utility of the approach.\n\nI was a bit underwhelmed by the actual reported energy/accuracy values achieved. One of the elephants in the room that the authors skirt around is the zero accuracy degradation scenario. In order for a real-world operator to accept any kind of accuracy degradation, the power savings must be *enormous*, usually measured in factors (i.e. a 5x or 10x reduction for a 1% error loss would be reasonable). In order to get good power savings, you really want to be aggressive lowering the voltage, but BER skyrockets with even small adjustments. So this is kind of the name of the game in low-voltage fault tolerance: it's a lot easier to get energy savings by allowing accuracy drop. But the test that usually separates wheat from the chaff is when you dial that down to zero measurable accuracy drop. You can always say \"well there's a trade-off a user can adjust\", but in this case, the \"trade-off\" is dominated by one end of the spectrum, and if there's not a lot of savings in that area, then it kind of condemns the approach.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "Thank you so much for recognizing our work as unique and valuable and especially for pointing out its potential to inspire a number of follow-up works. We are thrilled that you enjoyed reading our paper and provided such encouraging reviews and constructive comments. \n\nWe address the answers to your concerns/questions in the following:\n\n**1. (Limited Practical Utility)** We thank reviewer for raising this viewpoint. This is really a well-thought-out comment! While accuracy degradation is indeed a concern that developers aim to avoid, our work primarily seeks to explore a novel perspective in handling bit errors induced by low-voltage SRAM operation. In particular, NeuralFuse is used to serve as a robust error protection mechanism that can be employed in scenarios where voltage instability is a concern. Of course, NeuralFuse can be extended to save energy consumption, and our experiments have demonstrated its efficiency in this aspect. That being said, our intention is, as the reviewer said, to demonstrate that pre-processing inputs can indeed mitigate accuracy drops, even if the energy savings are modest compared to state-of-the-art hardware techniques.\n\nIt is also important to recognize that our approach is *complementary* rather than *competitive* with existing hardware solutions. In scenarios where hardware modifications are not feasible or desired, our method offers a software-centric solution that can be readily applied to existing models. We believe this flexibility is a significant strength, as it provides an additional tool for developers facing stringent power constraints.\n\n**2. (Zero Accuracy Degradation)** We agree that achieving substantial power savings without any accuracy loss is a challenging goal and a critical step for practical utility. Our current results indicate reasonable power savings with minimal accuracy loss.\nAt this stage, NeuralFuse serves as a proof-of-concept, and we are optimistic that with further research, more advanced models could significantly enhance the trade-off between energy savings and accuracy maintenance. One possible direction is to refine our pre-processing module to be more adaptive to the specific error characteristics of the low-voltage SRAM.\n\nOn the other hand, we are considering hybrid approaches that combine our input transformation with *lightweight* hardware modifications to further mitigate errors without compromising accuracy. This integrated approach could offer the best of both worlds—maintaining accuracy while still achieving meaningful power savings. \n\nIn summary, the value of our approach lies in its different attack angles. It serves as a foundation for future work that could potentially integrate more sophisticated pre-processing techniques with existing hardware solutions, thereby providing a more robust overall system.", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "JyDJH7KGPY", "reviewer": "Reviewer_nPtF", "summary": "The paper presents NeuralFuse, a novel approach to address the accuracy degradation of deep neural networks (DNNs) in low-voltage regimes. The core idea is to learn an input transformation module that can generate error-resistant data representations, thereby protecting DNN accuracy even when bit errors occur due to voltage scaling. The proposed method is model-agnostic and doesn't require retraining of the deployed DNNs, making it suitable for access-limited scenarios like cloud-based APIs or non-configurable hardware. Experimental results demonstrate that NeuralFuse can significantly recover accuracy while achieving energy savings.", "questions": "1. Potential for Hardware Acceleration of NeuralFuse: The NeuralFuse module itself might introduce computational overhead. Could NeuralFuse be implemented or accelerated in hardware to minimize its impact on inference latency and energy consumption?\n\n2. Limited Exploration of the Impact on Latency: While the paper acknowledges the latency overhead introduced by NeuralFuse, a more detailed analysis of its impact on real-time applications would be beneficial. It would be valuable to quantify the latency overhead for different NeuralFuse architectures and base models.\n\n3. Assumption of Random Bit Errors: The paper assumes a random distribution of bit errors. However, in practice, bit errors might exhibit spatial or temporal correlations. It's worth investigating the robustness of NeuralFuse to different bit error patterns.", "limitations": "1. Potential for Adversarial Attacks on NeuralFuse: The paper doesn't discuss the potential for adversarial attacks specifically targeting the NeuralFuse module. It's worth investigating whether the input transformations introduced by NeuralFuse could be exploited to craft adversarial examples that bypass the error resistance mechanism.", "rating": 5, "confidence": 4, "soundness": 2, "presentation": 2, "contribution": 3, "strengths": "1. Novelty and Practicality: The paper introduces a new perspective on mitigating the impact of bit errors in low-voltage DNN inference by focusing on input transformation. This approach is model-agnostic and doesn't necessitate retraining, making it practical for real-world scenarios where model access is limited.\n\n2. Effectiveness: The experimental results across various datasets, DNN models, and NeuralFuse implementations showcase the effectiveness of the proposed method in recovering accuracy and achieving energy savings. The paper also demonstrates the versatility of NeuralFuse in handling low-precision quantization and adversarial weight perturbation.\n\n3. Thorough Evaluation: The paper provides a comprehensive evaluation of NeuralFuse, including ablation studies, comparisons with baselines, and qualitative analysis, which strengthens the validity of the claims.", "weaknesses": "1. Limited Evaluation on Complex Models and Tasks: The evaluation of NeuralFuse is primarily focused on image classification tasks using CNN-based models. It would be beneficial to assess its performance on more complex tasks, such as object detection or natural language processing, and with different types of neural networks, such as Transformers or RNNs, to ensure its broader applicability.\n\n2. Lack of Comparison with Post-Training Quantization: The paper demonstrates the effectiveness of NeuralFuse in recovering accuracy loss due to quantization. However, it would be valuable to compare its performance with post-training quantization techniques that also aim to reduce model size and energy consumption without retraining.\n\n3. Applicability to Dynamic Voltage Scaling: The paper assumes a fixed low-voltage setting during inference. It would be valuable to explore the applicability of NeuralFuse in scenarios with dynamic voltage scaling, where the voltage might change during inference based on the workload or energy constraints.\n\n4. Impact of NeuralFuse on Interpretability: Does the input transformation introduced by NeuralFuse affect the interpretability of the base model? It would be interesting to analyze how NeuralFuse impacts the ability to explain the model's decisions.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "We thank reviewer for recognizing the novelty, practicality, and effectiveness of our work. We address your comments in the following:\n\n**1. (Complex Models and Tasks)** As an algorithm designer, we choose CNN-based models with classification, which may be a representative problem to prove our idea. As noted by [reviewer aRGH](https://openreview.net/forum?id=npoHt6WV1F&noteId=13v95CnfzT), our approach aims to tackle the model’s bit-error from different angles, and one can easily extend our approach to various task-specific models. Due to the limited time of rebuttal, we might not be able to provide results on other tasks but would include our findings on these applications in the revision.\n\n**2. (Post-Training Quantization)** We conducted an experiment that used a similar experimental setting in Section 4.6 and Appendix H. In this experiment, we apply post-training quantization to induce precision loss to the base model, which means that we do not apply *quantization-aware training* during base model training. The experimental results (see Table 27 in the [attached file](https://openreview.net/attachment?id=tYSoqYMyti&name=pdf)) show that our NeuralFuse generators can still recover the accuracy on the reduced-precision post-training quantization with 0.5% BER on the CIFAR-10 pre-trained model, despite the base model being more vulnerable to bit error attacks without quantization-aware training. This experiment demonstrates the robustness of our NeuralFuse, which is resistant not only to low voltage (bit errors) but also to precision loss (quantization).\n\n**3. (Dynamic Voltage Scaling)** The reviewer’s suggestion is really interesting. However, unstable voltage can easily damage the chip or DNN accelerators. For instance, [1] mentioned that unstable voltage can cause chips or AI accelerators to break down easily. Additionally, recent Intel processors have also suffered from voltage issues that cause CPU damage [2]. To avoid any other side effects, we used fixed voltages in our experiments, which allows a more accurate evaluation of our method and reflects reality. On the other hand, if there are only slight voltage changes, since our NeuralFuse is trained using our proposed EOPM optimizer, it will not overfit to specific error patterns. Instead, it will learn the error distribution under the specific bit error percentage. In this scenario, even if error patterns change, it will not significantly affect final performance, as demonstrated by our experiments across ten different error models.\n\n**4. (Interpretability)** These indeed are worth exploring, and in fact, we have conducted some analyses regarding the interpretability of the base model. In Appendix K, we demonstrate the output distribution at the final linear layer of the base model under three scenarios: 1) the clean base model without errors, 2) the perturbed base model with random bit errors, and 3) the perturbed base model with NeuralFuse. Based on the t-SNE visualization, we observed that the output distribution of the perturbed model is very chaotic. However, after applying NeuralFuse, the output distribution clearly groups into 10 classes. This indicates that NeuralFuse can indeed correct the outputs of the base model.\n\n**5. (Hardware Acceleration)** The adoption of any special hardware for NeuralFuse will depend on how hardware manufacturers design the architecture. Previous literature [3] has mentioned that to accommodate the specific architectures of DNNs, IC design manufacturers can develop corresponding hardware to support these specialized computations. Therefore, we believe that NeuralFuse can reduce additional latency or energy consumption by designing/using these specialized hardware.\n\n**6. (Latency)** In Appendix D, we have evaluated the latency overhead introduced by NeuralFuse. Although NeuralFuse brings a certain degree of extra latency, we deemed it an inevitable tradeoff for reducing energy consumption in our setting.\n\n**7. (Random Bit Errors)** This is a great suggestion! In fact, as mentioned in our paper (line 121), bit-cell failures for a given memory array are randomly distributed and independent of each other; that is, the spatial distribution of bit-flips can be assumed to be random, as it generally differs from one array to another, within as well as between chips. Nevertheless, we run an additional experiment with *non-uniform bit error* to explore non-uniform bit-flipping scenarios. The table below shows the perturbed accuracy with a non-uniform / non-random attack (i.e., first/last layers were implemented at $V_{min}$ and others are sub-$V_{min}$ voltages). In this setting, the perturbed accuracy becomes higher than attacking the whole models due to less perturbed parameters in the models. The experimental results also show that our NeuralFuse can still recover the perturbed accuracy.\n\n|Base Model| Perturbed Acc|ConvL|DeConvL|UNetL|\n|-|-|-|-|-|\nResNet18 | 43.8%±12.4%|88.6%±0.8%|90.0%±0.4%|85.0%±0.5%|\nVGG19|41.5%±13.4%|86.0%±3.7%|85.8%±5.6%|84.3%±2.1%|\n\n**8. (Adversarial Attacks on NeuralFuse)** This is really an interesting idea. However, we respectfully disagree that this omission represents a limitation of our work, as we believe it fall outside the immediate scope of our current work. Our primary goal is to mitigate the effects of random bit errors induced by low-voltage SRAM operation through input pre-processing, which is a distinct challenge from adversarial robustness. Nonetheless, we agree that integrating adversarial robustness with NeuralFuse will further enhance the overall reliability and security of the system.\n\n[1] When Does Poor Power Quality Cause Electronics Failures? [[link]](https://tinyurl.com/bdfvj34f)\n\n[2] Instability Reports on Intel Core 13th and 14th Gen Desktop Processors [[link]](https://tinyurl.com/3a5m7dsh)\n\n[3] Zhang et al. SpArch: Efficient Architecture for Sparse Matrix Multiplication. IEEE International Symposium on High Performance Computer Architecture (HPCA 2020)", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "nprMQ35nXE", "reviewer": "Reviewer_e1Hd", "summary": "This paper presents NeuralFuse, a module that produces error-resistant data representations by learning input transformations in order to solve the accuracy loss of deep neural networks (DNNs) brought on by low-voltage-induced bit errors in SRAM, allowing DNNs to continue operating accurately even at low voltage without the need for model retraining. NeuralFuse was tested on multiple models and datasets, and it showed that it could recover accuracy by reasonable margin and save SRAM access energy. It supports two scenarios: restricted access, which trains using a white-box surrogate model, and relaxed access, which permits backpropagation. NeuralFuse exhibits robustness against low-precision quantization and is transferrable and adaptable. The authors argue that this development may be helpful for edge devices and on-chip AI.", "questions": "Refer to the weakness section.", "limitations": "I have raised some concerns in the weaknesses section. Those are some possible limitations of this work. The authors may work on these points to overcome the limitation of their work.", "rating": 5, "confidence": 3, "soundness": 2, "presentation": 3, "contribution": 2, "strengths": "1.\tThe proposed NeuralFuse operates as an add-on module, meaning it can be integrated with existing DNNs without requiring modifications of the base models. This non-intrusive approach makes it applicable to various models and scenarios, including those with limited access to model internals like cloud APIs\n2.\tThe results demonstrate high robustness to low-voltage-induced bit errors and low-precision quantization. It shows reasonable performance recovery across different datasets and architectures and its high transferability and adaptability to unseen models \n3.\tExperimentation shows that during low-voltage operation, it can recover performance drop due to bit error with energy efficiency as fringe benefit", "weaknesses": "1.\tAuthors assume that NeuralFuse module itself is bit error free due to low voltage of SRAM, claiming that its function can be performed by general purpose core operating in nominal voltage. However, in that case, the latency of running this module will be order of magnitude higher during inference time, and the total power consumption might even be higher than base model. If instead it is run on SRAM, then it itself should be vulnerable to bit error, whose analysis is not done. From the writing, it may be assumed that the energy and latency calculation in Appendix C and D is done assuming the proposed module is in SRAM, which will change drastically if we assume that Neuralfuse operation is performed by CPU.\n2.\tIt is seen from Figure 3 and Table-1 that in bigger models (e.g: ResNet-50), the standard deviation of performance is very high for different random test bit error patterns and furthermore, the smaller the generator architecture, the worse the performance in general. So, to scale up the performance, bigger generators might be needed, which in turn will be harder to optimize and more resource consuming.\n3.\tThe authors claim that their approach has advantage over previous methods because it does not retrain base model, however, the training of generator itself has been shown to be equally hard and time-consuming, which may scale up for bigger base models or generators, so the advantage here is not very apparent.\n4.\tIf the base model is running in nominal voltage, then there should not be any bit error and in that case, the added NeuralFuse module will only increase latency and power loss with performance decrease added to it due to transformation of input to base model. So, it is only logical to adopt an adaptive approach where this module is only applicable when the SRAM voltage goes below minimum required voltage", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "We thank the reviewer for your effort and time in reviewing our paper. Our responses to your concerns are as follows:\n\n**1. (Latency)** We understand the reviewers' concerns. However, we respectfully disagree that our evaluation would change drastically if we assume that Neuralfuse operation is performed by CPU. This is because the additional consumption of a CPU is influenced by various factors such as different CPU architectures, instruction sets, processes (14nm or 3nm) or even manufacturers. Therefore, in this paper, we simplify the confounding factors and merely evaluate the latency increased by NeuralFuse. Our experimental results based on SRAM have already achieved notable results. Nevertheless, we acknowledge that these are important factors, and we will discuss them further in the revision.\n\n**2. (Big/small NeuralFuse)** In practice, the choice of the base model and the NeuralFuse generator depends on the problem to be solved. In current applications, achieving better performance often requires more training duration and larger models, so we believe this is an inevitable but acceptable issue.\n\n**3. (Training of NeuralFuse)** Regarding the issue of model retraining, we believe it is important not only to consider the time-consuming nature of the training process but also to assess the sensitivity of the retrained model to hyperparameters, which can make training easily fail. Previous papers [1] have mentioned that using adversarial weight training with all vulnerable weight-bit combinations is not a feasible approach. Therefore, we believe our NeuralFuse techniques still have significant advantages than retraining one [2].\n\n\n**4. (Applicable Scenario)** This is really a well-thought-out concern. As noted by [Reviewer aRGH](https://openreview.net/forum?id=npoHt6WV1F&noteId=13v95CnfzT), practitioners might want to *avoid the scenarios where NeuralFuse would be useful*  because NeuralFuse alone can alleviate low-voltage inference challenges to some notable extent. However, in our paper, we consider NeuralFuse to be an add-on module, meaning that NeuralFuse can be activated not only in a low-voltage regime but in both nominal- & low-voltage regimes. Although activating NeuralFuse in a nominal-voltage regime may incur the additional costs of accuracy degradation and latency, it helps protect the module from an unstable power supply and mitigate the bit-error-induced accuracy drop. \n\nNevertheless, from a hardware perspective, it is also feasible to enable NeuralFuse only when the main module is running in low-voltage regimes and disable it in nominal-voltage settings. This ensures that, in nominal-voltage regimes, NeuralFuse does not introduce any energy consumption due to the additional latency and SRAM space requirements.\n\n[1] He et al. Defending and harnessing the bit-flip based adversarial weight attack. (CVPR 2020)\n\n[2] Stutz et al. Bit error robustness for energy-efficient dnn accelerators. (MLSys 2021)", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "p2QgZvE4xX", "reviewer": "Reviewer_LgKi", "summary": "The paper proposes a method to handle the errors when reducing the voltage of SRAM to reduce the power consumption. The method is based on preprocessing the input data into error-resilient forms. Experiments show a tradeoff with a reduction of 24% of power and 2-3% accuracy loss in CIFAR10-ResNet settings.", "questions": "The questions are listed in the \"weakness\"", "limitations": "n/a", "rating": 4, "confidence": 4, "soundness": 3, "presentation": 3, "contribution": 2, "strengths": "1. The reduction of SRAM power is appreciated to lower the cost.\n2. The training method to recovered accuracy at 1% weight bit errors is also important.", "weaknesses": "1. Reduction of voltage of SRAM requires hardware access and will cause more errors than the ideal uniform bit flipping errors. I think tolerating 1% error is useful and interesting, but the motivation might be from more than lowering the SRAM voltages.\n\n2. I did not catch what if the weights in the generator (preprocessing) of the image has bit errors or not. Is it? If the generator network is assumed error free, then it seems not consistent with the overall system configuration.\n\n3. By reducing the power by 30%, the accuracy loss of CIFAR10 dataset is 2-3%. The worth of the tradeoff is debatable. What if I use a 30% smaller network and use full power of SRAM? In the experiment, clearly ResNet50 and ResNet18 has the same clean accuracy, but ResNet18 is 3 times smaller. So one could easily achieve 3x power reduction by using ResNet18 instead of ResNet50. More rigorous experiment setup needs to be considered to validate the motivation of the paper: Why one would make tradeoffs by reducing SRAM's voltage to suffer bit-errors rather than using a smaller network? This is my major concern.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "We thank the reviewer for your effort and time in reviewing our paper. Our responses to your concerns are as follows:\n\n**1. (More Motivation)** First of all, thank you for recognizing the value of our work in recovering accuracy under 1% bit errors. In fact, while energy savings are a beneficial aspect of our approach, the primary motivation behind NeuralFuse extends beyond merely lowering SRAM voltages. Our main goal is to provide a robust error protection mechanism that can be employed in scenarios where voltage instability is a concern. \n\nFor instance, the model runs at the minimum bit error-free voltage ($V_{min}$) most of the time. NeuralFuse can be activated as a temporary error protection mechanism only when the system encounters voltage instability or other unforeseen scenarios inducing bit errors. This ensures the reliability of the model's output during such critical periods, maintaining the system's overall performance and robustness. This consideration also addresses broader scenarios where bit errors might occur due to other factors such as environmental variations, component aging, or transient faults. By focusing on error resilience, NeuralFuse can be applied in various contexts where maintaining model accuracy under non-ideal conditions is essential.\n\n**2. (Generator Errors)** To ensure that NeuralFuse functions correctly, in our experimental setting, we assume that NeuralFuse operates at nominal voltage, meaning it should be error-free. Previous research has demonstrated that the integration of multiple chip units can be implemented with different voltages [1]. Therefore, regarding concerns about '*inconsistency in the overall system configuration*,' it can be argued that although the voltage settings of different parts may be different, such system design and configuration is feasible and ensures that NeuralFuse is error-free during operation.\n\n**3. (Small Network)** The reviewer's intuition is correct. Indeed, using a smaller network such as ResNet18 instead of ResNet50 can achieve significant power savings due to the reduced model complexity. However, as noted above, NeuralFuse could be much more useful in circumstances where bit errors are unexpected. In real-world applications, voltage instability or other transient conditions can introduce bit errors unpredictably. NeuralFuse provides a robust solution that can be activated dynamically in response to such errors, ensuring the reliability of model output during critical periods.\n\nBeyond handling bit errors, our approach can also mitigate accuracy drops due to precision loss. In Section 4.6, our results demonstrate a promising use case in dealing with unseen bit-quantization errors. This capability broadens NeuralFuse's applicability, making it valuable in scenarios where precision constraints are relaxed to save power, but accuracy still needs to be preserved.\n\nTherefore, in terms of efficiency, the system designers can use either smaller models or apply a low-voltage regime with NeuralFuse to achieve desired energy efficiency. In terms of robustness, NeuralFuse can act as an insurance mechanism, assuring model performance during critical periods when voltage instability or other factors induce bit errors. This reliability is particularly important for safety-critical applications, where maintaining model accuracy is essential despite adverse conditions.\n\n\n[1] Rotaru et al. Design and development of high density fan-out wafer level package (HD-FOWLP) for deep neural network (DNN) chiplet accelerators using advanced interface bus (AIB). (ECTC 2021)", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}]

Author rebuttal:
We sincerely appreciate all reviewers' valuable feedback and the efforts of the program chair and area chair. We are particularly pleased that reviewers found our paper well-written (aRGH), featuring a novel idea (aRGH, nPtF), highlighting energy efficiency benefits (nPtF,  LgKi), providing thorough analysis (aRGH, nPtF), and being practical for real-world scenarios (aRGH, nPtF, e1Hd). We have addressed your specific questions and concerns. Additionally, we have included further experimental results on post-quantization training for Reviewer nPtF in the attachment. We are committed to addressing any further issues raised and improving our manuscript accordingly, so we look forward to your feedback on our response.

Meta-review: The authors submitted rebuttals. Some reviewers had discussions with the authors, and some left follow-up comments after the author-reviewer discussion period. During the AC-reviewer discussion period, all reviewers shared post-rebuttal thoughts on this work. We find this paper on borderline, but all the reviewers are either in favor of or ok with accepting the work. My recommendation is Accept (poster) for NeurIPS 2024.

In this work, the authors introduce an add-on module method to address accuracy degradation when reducing energy consumption (i.e. reducing supply-voltage), due to random bit-flips in SRAM. We find 1) value, 2) novelty, and 3) practicality in this type of approach, which overall slightly outweigh weaknesses of this work. 

I also want to suggest that authors reflect reviewers' comments to the camera-ready. For example, reviewers shared concerns about limited evaluations in this work, which I agree to (e.g., dataset choices seem not well justified). The authors mentioned that "NeuralFuse serves as a proof-of-concept". This seems not aligned with claims made in the current manuscript, and I would like the authors to revise the claims and emphasize "NeuralFuse serves as a proof-of-concept" in the camera-ready.
Decision: Accept (poster)