Training DNNs Resilient to Adversarial and Random Bit-Flips by Learning Quantization Ranges
Authors: Kamran Chitsaz
Goncalo Mordido
Jean-Pierre David
François Leduc-Primeau
Venue: Accepted by TMLR ()

Abstract: Promoting robustness in deep neural networks (DNNs) is crucial for their reliable deployment in uncertain environments, such as low-power settings or in the presence of adversarial attacks. In particular, bit-flip weight perturbations in quantized networks can significantly degrade performance, underscoring the need to improve DNN resilience. In this paper, we introduce a training mechanism to learn the quantization range of different DNN layers to enhance DNN robustness against bit-flip errors on the model parameters. The proposed approach, called weight clipping-aware training (WCAT), minimizes the quantization range while preserving performance, striking a balance between the two. 
Our experimental results on different models and datasets showcase that DNNs trained with WCAT can tolerate a high amount of noise while keeping the accuracy close to the baseline model. Moreover, we show that our method significantly enhances DNN robustness against adversarial bit-flip attacks. Finally, when considering the energy-reliability trade-off inherent in on-chip SRAM memories, we observe that WCAT consistently improves the Pareto frontier of test accuracy and energy consumption across diverse models.

Published in Transactions on Machine Learning Research (11/2023)
Training DNNs Resilient to Adversarial and Random Bit-Flips by Learning Quantization Ranges
Kamran Chitsaz Polytechnique Montreal
kamran. wwwaamm.ciitta--dddaaaafffoooopp
Gonçalo Mordido Mila, Polytechnique Montreal
goncalo-fflppe.torcattooo pwwoloo-iiipptttrrrdoooomorrioid
Jean-Pierts David Polgtechnique Montreal
jean jeen-pieree.darvid@ppolyy.t.
François Reduc-Primess Polytechnique Montreal
froncois
Reviewed on OpenReview: https: //
// openreview. net/ forum? id- Ba-jHMPUZIHHB
Abstract
Promoting robustness in deep neural networks (DNNs) is crucial for their reliable deployment in uncertain environments, such as low-power scttings or in the presence of adversarial atlacks. In particular, bit-slip weight perturbations in quantized networks can significantly degrade performance, underscoring the need to improve DNN resilience. In this paper, we introduce a training mechanism to learn the quantization range of different DNN layers to enhance DNN robustness against bit-flip errors on the model parameters. The proposed approach, called weight clipping-aware training (WCAT), minimizes the quantization range while preserving performance, striking balance between the two. Our experimental results on different models and datasets showcase that DNNs trained with WCAT can tolcrate high amount of noise while keeping the accuracy close to the baseline model. Moreover, we show that our method significantly enhances DNN robustness against adversarial bit.flip attacks. Finally, when considering the energy-relaabilit trade-off inherent on-chip SRAM memories, we observe that WCAT consistently improves the Pareto frontier of test accuracy and energy consumption across diverse models
1 Introduction
The widespread application of DNNs in critical domains, such self-driving cars (Bose al. 2021 and medical diagnosis (Gongye et al. 2020 has emphasized the need to study their reliability and performance in noisy environments. Also, to improve their performance, custom hardware accelerators have emerged as a promising solution given the high computational demands of DNNs. However, it is essential to ensure that DNNs retain their efficiency and reliability when deployed on specialized hardware with a limited energy budget and the presence of hardware faults. Although quantizing and compressing DNN weights can improve robustness and decrease the potential impact of bit-flip errors (Qian et al. 2023)) adversarial attacks can still cause severe performance deterioration with only few vulnerable bits (Rakin et al. 2019).
Bit-flips in memories can oceur randomly result of undesirable events such chip labrication variations, supply voltage variations, or targeted attacks. The row-hammer attack (RHA), where multiple accesses can disturb DRAM rows and cause bit-flips other rows, has boen extensively rescarched (Kim et al.) 2014). with DRAMs being highly susceptible this type of attack due to their dense architecture. Furthermore,
Code is available httpes//gthhbb.com//mmchtt/

---

Published in Transactions on Machine Learning Research (11/2023)
to improve energy efficiency in recent DNN accelerators, reducing the memory supply voltage has become popular approach to reduce energy consumption, particularly in SRAMs, due to the quadratic relationship between dynamiic energy consumption and supply voltage. Despite energy-effiiinnt near-threshold voltage processing can cause bit-flip errors in SRAMs, which may compromise the reliability of the DNN accelcrator (Frustaci el al. 2015).
In recent years, there has been an increased focus on developing defense methods to improve the robustness of DNNs against random weight perturbations well as adversarial attacks. The fault tolerance capability of DNNs can be improved by modifying the network's size, structure, and training process. For example, some methods improve the DNN robustness by adding memory or computational overhead (Liu et al. 2023; Guo et al.) 2021), while others involve compressing and binarizing the weights of the DNNs to limit the impact of weight perturbations (He et al. 2020). However, this can lead to a performance loss when the model weights are not perturbed, which we refer to as the noiseless weights setting.
In the conventional noiseless setting, the quantization range creates delicate trade-off between the quantiza- tion error and the dynamic weight range. While reducing the quantization range decreases the quantization error due to rounding, it also decreases the dynamic range. which is vital in neural networks for repre- senting weights with large absolute values (Choi et al. 2019). Our experimental results demonstrate that the quantization range also plays a crucial role in network robustness. Hence, the goal of this work is to minimize the quantization range, while striking a good balance between robustness to noisy weights and performance on noiseless weights. By incorporating this learning mechanism during training, we manage to uphold DNN performance under noiseless conditions while achieving a more robust network against bit-flip errors at inference time.
Our proposed approach, weight-clipping aware training (WCAT), focuses on learning and reducing the quantization range of different layers, thereby enhancing robustness against bit errors during inference. To ensure efficient training convergence without compromising the performance of the noiseless network, we employ an accurate gradient approximation technique. Additionally, we simulate bit-flip errors during the training phase to further improve DNN robustness, leading to a more resilient model against bit errors during inference. Moreover, in the context of fine-tuning pre-trained DNNs for increased robustness, we demonstrate that initializing the quantization range based on the expected mcan square error between real weights and dequantized noisy weights leads to higher robustness. Overall, our findings and results pave the way to advancing the understanding and practical implementations of robust DNN quantization methods.
2 Related work
This section begins by providing an overview of quantization techniques during training (Section 2.1 We then delve into adversarial attacks in Section 2.2 Finally, we review existing defense mechanisms against
bit-flip attacks or perturbations in Section 2.3
2.1 Quantization-Aware Training
Jow-precision neural networks can benefit from quantization operations during the training process to learn quantization-aware parameters and improve performance. Although the quantization range is usually set to the maximum absolute value of the weight to ensure that the largest integer represents the largest weight value within the bit precision, may cause high rounding error and consequently low robustness. Finding a better quantization range can be achieved based on the statistics of the weights (Choi et al., 2019 or by duplicating channels with weight outliers and halving their values to avoid outlier distortion when performing weight clipping (Zhao et al. 2019).
Mcanwhile, learning the quantization range during training has emerged as promising method for low- precision quantization. However, this approach can be difficult because the quantizer itself is not continuous, so approximating the gradient of the quantizer is required. Among these methods, (Jung et al.] 2019) proposed clipping function that balances the tradc-off between the quantization range and sparsification. Baskin et al. (2021) introduced a parameterized clipping function that is applied before quantization. Jain et al. (020)) proposed quantization scheme with learnable scaling factor and defined the gradient based
2

---

Published in Transactions on Machine Learning Research (11/2023)
the straight-through estimator (STE). Also, Esser et al. 2019) used a similar method but added gradient scaling to achieve state-of-the-art performance on the Net dataset.
2.2 Bit-Flip Attack
The bit-flip attack is a malicious technique that manipulates the parameters of a DNN model at runtime to reduce its performance. Although random bit-flips applied to a network's weights can corrupt performance, they can generally withstand relatively large number of such flips before performance significantly degraded. Therefore, an attacker is looking to identify vulncrable bits by leveraging information about the network architecture, the parameters, or the dataset. Raaiin et al. (2019) propose progressive bit scarch based on the approximated gradient with respect to the bits of the network. The goal of this method is to reduce the network's performance to a random guess. The objective function of the attack is given by
max C (11B)2 (110)1(()))) {B.}
(1)
s.t. Σ H (Br, Bi) S
where is the loss function, B; the binary representation of the weights layer 1, B, is the perturbed binary representation of the weights attacked by the bit-flip attack (BFA), X is training input, and Y its corresponding label. The constraint in equation given in terms of the Hamming distance H. between the attacked binary weights and the original binary weights, and Nş is the maximum number of bit-flips allowed.
2.3 Defense Methods
Various defense techniques have been proposed to enhance the robustness of DNNs against bit-flip attacks or perturbations. Some methods involve additional overhead, such as using error-correction code units within SRAM cells (Jahinuzaaman et al.] 2009) or implementing hash-based weight verification schemes to correct errors before inputting data into the DNN (Guo et al. 2021 Others, like binarization (He et al. 2020 and adversarial training (Buldu et al., 2022 can increase robustness at the expense of sacrificing the performance of the noiseless model. Additionally, Rakin et al. (2021b) proposed augmenting the model's capacity during training, which further enhances robustness, in conjunction with binarization.
In a recent study, Stutz et al. (2021) proposed an innovative approach to improve the robustness of neural networks by combining asymmetric fixed-point quantization with aggressive weight clipping during training. In addition, [Stutz al. (2022) also proposed to apply per-layer weight clipping, where a specific quantiza- tion range is set for each layer. This approach provides additional robustness, different layers may require different quantization ranges depending on the magnitude and distribution of the weights. By applying per- layer weight clipping, the network can better adapt to these differences and optimize the quantization ranges for each layer accordingly. In our approach, we also leverage weight clipping, but with a key distinction: instead of predefined ranges, we focus on learning and dynamically reducing the clipping range throughout training. This dynamic adaptation further enhances network robustness. Importantly, our paper empirically demonstrates the pivotal role of quantization range in mitigating bit-flip noise, an aspect not extensively explored in prior research. Furthermore, our motivation for learning the quantization range through opti- mization is grounded in empirical evidence showing significant improvements in the performance of quantized models (Nagel ct al. 2021 ).
3 Weight Clipping-Award Training (WCAT)
In our proposed approach, Weight Clipping-Aware Training (WCAT), we draw inspiration from our empirical analysis on the optimal quantization range in the presence of bit-flip errors (see Appendix A). Our focus lies on uniform symmetric signed quantization for the weights of both convolutional and fully-connected layers. To reduce the quantization error, we first clip the weights and then apply linear weight quantization
3

---

Published in Transactions on Machine Learning Research (11/2023)
(Section 3.1 Then, we employ the STE (Beniio et al. 2013) mechanism to update the weights that are both inside and outside the clipping range during training (Section 3.3
Additionally, the optimal clamping value for each layer is also learned (Section 3.2 and is further reduced during training using weight decay. Moreover, we discuss optionally applying bit-flip noise injection during training (Section 3.4 to further improve the network robustness in highly noisy regimes. We summarize our proposed approach in Section 3.6
3.1 Weight clipping and quantization
Although asymmetric quantization has shown better robustness against bit-flip noise (Stutz et al., 2021 symmetric quantization has the advantage of reducing the computational overhead handling the zero-point offset during accumulation operations (Nagel et al. 2021) and is more hardware-friendly. Honce, we adopt uniform symmetric quantization and use the following clipping function that constrains the weight values of layer Wi, to be in symmetric range controlled by aj E :
Wi -0,
Wi Clip(W,,,))
Wi,
-ai S Wi S on
(2)
Wi a1
where Wi represents the clipped weights in the range [- oz]. We perform such clipping in layer-wisc manner, particularly in every convolutional or fully-connected layer of the network. After clipping, then map the real-valued weights to a discrete grid of integers using linear quantization scheme:
2
Wine
Wi
a1
where is the bit precision and [-] represents the round- to- neareee integer operator. To approximately recover the real-valued weights Wi from their quantized representations Win",, we apply the following doquantization step:
Wi
04
Wint.
26-1
The intuition behind simply applying linear quantization rather than more complex quantization schemnes, e.g. Mordido et al. (2019); Goncharenko et al. (2019): Esser al. (2019), that we hypothesize that the quantization range is what most. matters in terms of robustness, as recently indicated by previous work and also observed in our experimental results. Nevertheless, note that using complex schemes may result in better overall performance of the quantized, noiseless network.
3.2 Learned quantization range
To strike a better balance between reducing quantization error and preserving the dynamic range, thereby achieving enhanced robustness, we optimize the parameter ay during training. The gradient of og w.r.t. each value of weights in layer is defined follows:
-1 -0 On doz
:
0,
-a S wi S aq
(5)
1,
Wi 02,
with a different ay being learned for each layer. Importantly, since the gradients from the weights outside the quantization range get accumulated, we introduce a scaling factor applied the gradient of the quantization range ay during the learning process, similar to Esser al. (2019). More specifically, we multiply the accumulated gradient of alpha, Var. with 1/ W/], where [W]] represents the cardinality of the weight

---

Published in Transactions on Machine Learning Research (11/2023)
matrix, i.c. the number of weights in layer L. This scaling promotes more controlled and slower update of the quantization range, while still allowing the network to learn the optimal values.
To further promote a small a, we add an L2 regularization term to the update at each iteration. The strength of the regularization is controlled by X, the regularization coefficient, and the added loss term is expressed by of. The trade-off between robustness and performance can be controlled by adjusting the value of A. A large value of results in an increasingly smaller during training and thus a more robust network since the quantization range will be reduced. On the other hand, smaller value of X will result in larger and less robust network but with better noiseless performance.
3.3 Straight-through gradient estimation
After applying the clipping function (equation 2 possible approach to update the weights during back- propagation is to set the gradient to for the weight values that lie inside the clipping range and to 0 for the values outside the range which is known as piece-wise linear (PWL) gradient estimator (Baskin et al. 2021
Oriy
1, if wy E [-a 0, otherwise.
(6)
owr
Using this approach, the weights outside the range are not updated, and instead, the scaling factor is adjusted to bring the dequantized value closer to its optimal value. However, in our case, want to decrcase the scaling factor to apply aggressive weight clipping and promote DNN robustness. Therefore, we propose to set the gradient to 1 for all weight values W, regardless of whether they lie inside or outside the quantization range. This is achieved using the straight-through gradient estimation (STE) technique, which allows the gradient to flow through the clipping operation without being affected.
3.4 Bit- noise (BFN) injections
To further improve DNN robustness at inference time, a popular approach is to simulate bit-flip errors during training (Henwood et al. 2020 Stutz et al. 2021). More specifically, let f(wi), (X) be a network
with weights {WiJt and (X,Y) a training input and corresponding label from the training set. The desired objective to minimize may be defined as:
1= Ee c (((m))(()))))))
where L is the loss function and Wi is perturbed representation of the weights W₁ obtained as follows:
Wi ay
2b-1-1 x (W/ @c)
(8)
where Wint is the quantized representation of W,, denotes the bitwise XOR operation, c= Di 2'c with 6 Bernoulli(p)), and Po is the bit error rate. In other words, the desired objective is the average loss of the network over all possible noise realizations.
However, this objective is intractable due to the exponentially large number of possibilities. Moreover, the XOR operation is not differentiable and, therefore, needs to be approximated. common approach for approximating the objective in equation 7 is to use STE for the noise-injecting model, which passos the output gradients through the input gradients. Hence, by sampling from the noise distribution and using one noise realization per minibatch, assuming stochastic minibatch optimization, pass by injecting the bit-flip noise to the weights to compute the perturbed weights Wi and then compute aw; 1. Using STE ultimately enables us to backpropagate gradients through the the backward by setting aw; non-differentiable process of adding noise to the weights, making it possible to minimize the objective.
complete the forward
5

---

Published in Transactions on Machine Learning Research (11/2023)
Algorithm Weight clipping-wwars training (WCAT)
Input: bit error rale Po: alpha weight decay A, learning rale 7
1: for 1= 1 to I. do
initialize og using equation 10
3: end for
4: for t = to do
5: sample batch (X from training data
for to do
Wi- = CCip(WW,-ar at)
W?nt Quantizo(W,,az)
9:
= -i=0 2,, <~ Bernouli(pp))
Wiin wint De
10:
11:
Wi De-quantize(W//u oa)
12:
end for
13:
A = VL (fw (X), X) +
14: W W 7
15: end for
3.5
Quantization range initialization
We can search for a quantization range a' that minimizes the quantization error, for a given weight distri- bution. This optimal range a* can be determined by minimizing the following equation:
arg min an (W - DDQ (Wint))?
(9)
Here, DQ() represents the dequantization step specified Equation Additionally, we can find the optimal range considering the expected quantization error under a given bit error rate Po- This can be achieved by minimizing the following equation:
a" arg min a. [ww DDQ (Wie &e))²
DQ
(10)
In the context of using pretrained models, we observed that initializing weights is crucial. By initializing the quantization range of each layer using equation T0 with a brute force search, we introduced a negligible overhead at the beginning of the training process. However, this initialization greatly improved both the robustness and performance of the model.
3.6 Summary of WCAT
We outline our proposed approach Algorithm which encapsulates the steps of WCAT. First, we initialize the quantization parameters oy heuristically (line 2). During each training iteration's forward pass, we quantize the clipped weights (lines and 8), inject bit-flip noise (line 10), and then dequantize the perturbed weights (line 11). Subsequently, and the regularization term (line 13). Finally, update the model parameters utilizing straight-through gradient estimation (line 14). In essence, WCAT dynamically adjusts quantization ranges during training to strike a balance between achieving better performance and improving robustness.
compute the gradient of the loss with respect to the perturbed weights
4 Experimental results
In this section, we present. the experimental results of the proposed WCAT method. We begin by outlining our experimental setup in Section 4.1 Then, we investigate the impact of regularization (Section 4.4 and gradient scaling (Section 4.5) on model robustness. We also explore the effeets of initializing the quantization range for fine-tuning pre-trained models Section 4.7 Next, we compare the different methods terms of bit-error robustness against random (Section
4.2 and adversarial attacks (Section 4.3). Furthermore, we

---

Published in Transactions on Machine Learning Research (11/2023)
demonstrate how our proposed method can significantly reduce energy consumption at inference time while maintaining a desired level of reliability in Section 4.8 Finally, we investigate the reasons behind the notable improvement of the proposed method when using pre-trained weights in Section 4.9
4.1 Experimental settings
We conducted our experiments using three popular vision datasets: CIFAR1O, CIFAR100 Krizhevsky al. 2009), and ImageNet. (Krizhevsky et al., 2017). For our experiments, employed ResNet-20, ResNet-56, and ResNet-18 architectures for CIFARIO, CIFAR100, and ImageNet, respectively. We also used data- efficient image Transformers (DeiT) Touvron et al. 2021) to showcase the effectiveness of our method on vision transformer models. The evaluation metrics included measuring the robustness against random bit- flip and adversarial attacks. We compared our proposed method, WCAT, against baselines including linear quantization (Normal), per-layer weight clipping (PLClip), and LSQ. Detailed information on the datasets, training setups, noise injection, evaluation metrics, and baselines can be found in Appendix
CIFAR10
CIFAR100
ImageNet
95.0
75
70
92.5
accuracy (%)
test accuracy (%)
test accuracy
90.0
60
87.5
60
50
85.0
82.5
55
40
80.0
0.0
0.04
0.1
0.2
0.6
1.0
50
0.0
0.04
0.1
0.2
0.6
1.0
0.0
0.04
0.1
0.2
0.6
1.0
bit rate (%)
rate (%)
(%)
Normal
PLClip
LSQ
WCAT
Po
0.3%
Po
0%
Figure 1: Robustness of different quantization methods on ResNets with 4-bit weight quantization.
4.2 Random Attack
We compare the bit-error robustness of different methods for 4-bit weight quantization on ResNet-20 trained on CIFAR10, ResNet-56 trained on CIFAR10,, and ResNet-18 on ImageNet in Figure [ Overall, WCAT is the superior method, as it maintains high performance across all tested noisy regimes on all modols and datasets. Across all datasets, LSQ achieved the best accuracy on noiseless models. In CIFARIO, LSQ and WCAT perform similarly under low noise conditions, but WCAT shows significantly better performance high-noise regimes. However, we observe a significant improvement in ImageNet results. Even with a small amount of noise (e.g., 10_4), the accuracy of normal quantization drops dramatically. Although LSQ and PLCCLip show better robustness than normal quantization, WCAT outperforms all methods in highly noisy regimes.
In all methods, bit-flip noise (BFN) injection training tends to improve robustness, especially under highly noisy regimes. Although BFN significantly sacrifices test accuracy for normal quantization under noiseless conditions, this performance loss is nogligible in PLCLip and WCAT. We also present results for 8-bit quantization in Figure 2 We see that LSQ exhibits the best accuracy on noiseless weights for all models. However, when faced with even minor bit-flip noise, LSQ's accuracy drops significantly. In contrast, WCAT demonstrates remarkable robustness across all datasots. Additionally, we observe that ImageNet on 8-t is more sensitive to bit-flip noise than in 4-bit.
We also investigated the impact of random bit-flips in DeiT with 8-bit weight quantization on ImageNet. The results are shown in Figure 3 In this experiment, we set the PI.Clip parameter to 0.4 for DeiT-tiny and 0.6 for small and base models. Once again, WCAT outperforms all the other methods in all variations of DeiT, with the performance difference becoming more significant the model size increases.
7

---

Published in Transactions on Machine Learning Research (11/2023)
CIFARIO
CIFAR100
ImageNet
85.0
75
70
92.5
70
test accuracy (%)
accuracy (%)
test accuracy (%)
60.0
65
60
57.5
60
50
85.0
55
62.5
50
40
80.0
45
0.0
0.04
0.1
0.2
0.6
1.0
0.0
0.04
0.1
0.2
0.6
1.0
0.0
0.004
0.01
0.02
0.06 0.1
bit error rate (%)
bit error rate (%)
bit error rate (%)
PLCIp
LSQ
Figure 2: Robustness of different quantization methods on ResNets with 8-bit weight quantization.
DeiT-Ti
DeiT-S
DeiT-B
80
60
18st accuracy (%)
test (%)
60
test accuracy (%)
40
40
20
0-
0
0.01
0.05
0.5
0.0
0.01
0.1
0.0
0.01
0.05
0.1
0.5
bit error rate (%)
bit error rate (%)
bit error rate (%)
PLClip
LSQ
WCAT
Figure 3: DeiT robustness under various 8-bit weight quantization methods on ImageNet.
4.3
Adversarial Attack
We now focus additional scenario: robustness to adversarial attacks. The robustness of different methods against adversarial bit-flip attacks for all models and for both 4-bit and 8-bit quantization is presented in Figure For each dataset, we show the average number of bit-flips required to destroy network performance and reduce accuracy to random guesses over 10 different seeds for the attack method as we described in Appendix B
CIFAR10
CIFAR100
ImageNet
100
bit
7.x
78x
8.3%
1266%
0666 8 bit
80
80
6.7%
7.x
60
60
pdy
4.x
3.9%
40
40
40
3.8x
20
12x
1.5x
20
2.1%
1.0x
2.4%
20
1.9x
Normal
PLClip
LSQ
WCAT
Normal
PLClip
LSQ
WCAT
Normal
PLClip
LSQ
Figure 4: Impact of adversarial bit-flip attacks on network performance using ResNets with 4 and 8-bit weight quantization CIFARIO, CIFAR100, and TmageNet. Nytip denotes the average number of bits required to degrade top-1 accuracy to 0.1%, 1%, and 10% for ImageNet, CIFAR100, and CIFAR10, respectively.
8

---

Published in Transactions on Machine Learning Research (11/2023)
Notably, observe that WCAT not only enhances robustness against random noise but also outperforms all methods in all models against adversarial attacks under 4-bit quantization. This suggests that our proposed method benefits extend beyond improving network robustness in the presence of random noise. Moreover, WCAT's superiority is apparent in ImageNet results, where it requires 10.6x more bit-flips to cause network performance degradation when compared other methods.
DeiT-Ti
DeiT-S
DeiT-B
80
60
1est accuracy (%)
accuracy (%)
60
text accuracy (%)
40-
40
40
20
10
10
10
10P
10
10P
10
10
Number of bit. Aipps
Number of bit. tliss
Number of bit flips
LSQ
PLClip
WCAT
Figure 5: Robustness comparison of 8-bit weight quantization methods DeiT against adversarial attacks Nel.
Additionally, we explore the effect of adversarial attacks on DeiT in Figure 5 Surprisingly, the vision trans- former exhibits greater resilience to adversarial bit-flip attacks on the weights for both WCAT and PLClip. Notably, WCAT consistently outperforms other methods across all DeiT variations and demonstrates signif- icant robustness, particularly in the DesT-base model. Even after 500 bit-flip attacks, the average accuracy remains above 70%. This demonstrates the effectiveness of WCAT in protecting networks from adversarial attacks in addition to random noise.
4.4 Regularization
We start by investigating the impact of L2 regularization of the quantization ranges on the robustness and performance of different models in the presence of noise. Particularly, we vary the L2 regularization coofficient and evaluate the resulting models under different noise realizations. The results, encompassing average Lest accuracy alongside standard deviation, are presented Table D showing that increasing the L,2 regularization tends to improve robustness in noisy environments, at the expense of decreased performance in the noiseless setting.
Specifically, we find that increasing the regularization strength to force the model to have lower quantization range can improve robustness, as evidenced by the results for X = 0.5 for the ImageNet datasct. However, this comes at a significant cost in terms of performance in the absence of noise. In these scenarios, it may be more beneficial to train the model with bit-flip noise to improve its robustness against noise.
4.5 Gradient Scaling
We now investigate the impact of scaling gradient on the performance and robustness of the models in Table [ Our findings indicate that with low regularization, the scaling gradient not only improves the performance of the noiseless model but also enhances the robustness of the noisy regime for both models. Interestingly, the addition of am L2 regularizer further improves the performance of the models with gradient scale of 1. As discussed in Section 3.2. updating the quantization range involves accumulating all the gradients of weights at cach layer with respect to a, which can lead to high gradients and instability without gradient scaling. The addition of a regularizer helps to restrict the rapid change when we don't use gradient scaling. Ultimately, we observe that the models trained with scaled gradients achieve the best performance for different levels of noise. These results suggest that scaling gradient besides increasing regularization can significantly improve the robustness of the model against bit errors, especially in noisy environments, while enhancing the overall performance of the model.
9

---

Published in Transactions on Machine Learning Research (11/2023)
Table 1: Robustness of ResNet-20 on CIFAR10 and ResNet-18 on ImageNet with 4-bit quantization for different gradient scales and L2 regularization co- efficients. The average test accuracy and standard deviation of models under different noise realizations reported. The 32-bit floating-point baseline's test accuracy is 92.6% and 69.75% for NesNet-20 and ResNet-18, respectively.
Reg. coeff.
Test accuracy (%)
Model
Grad scale
X
Po 0%
Po 0.1%
Po 1%
0.0005
90.77
83.0613.6
17.814.9
0.001
91.18
86.4942.3
23.0246.4
ResNet-20 on CIFAR10
0.01
92.36
91.37
75.7645.1
0.0005
92.48
91.554.35
77. 77.72+5.1
I/VN
0.001
92.41
91.93+.2
83.4213..
0.01
91.88
91.69
88.62
0.001
68.59
31.4615.9
0.1
0.01
69.87
51.73+4.4
0.2
ResNet-18
0.5
69.91
66.3641.1
22.84+5.2
ImageNet
0.001
70.31
65.91=1.14
16.04
1/vN
0.01
69.79
67.764.75
42. 42.85+4..8
0.5
66.56
65.11
47.2643.4
4.6 Gradient Estimation
In Section the clipping range during training. [Skkr et al. (2022) argued that STE may encounter gradient explosion, while the use of PWL can lead to partial convergence halt. To address these concerns, they present novel magnitude-aware derivative (MAD) gradient estimator.
3.3
explained how used STE to update the weights that both inside and outside
CIFAR10
ImageNet
70.0
accuracy (%)
80
accuracy (%)
69.3
70
69.0
68.5
63.0
120
180
240
300
44
88
110
epach
epoch
Figure 6: Comparative evaluation of gradient estimation techniques using Res.Net-20 CIFAR10 and ResNet-18 on ImageNet datascts with 4-bit quantization. The plot showeases validation accuracy, with the average accuracy represented by a solid line, and the shaded region signifying standard deviation across 5 seeds.
We extensively examined these techniques, depicted in Figure t employing ResNet-20 CIFAR10 and ResNet-18 on ImageNet. The asscssment involved 4-bit weight quantization with constant regularization value of = 0.001. This process was repeated across 5 distinct seeds, with the average accuracy represented by a solid line and the standard deviation displayed as a shaded area adjacent to the line. Our findings reveal that these approaches exhibit comparable performance in terms of validation accuracy during train- ing/finet /iinttuniing. Given its straightforward implementation, we opt for STE estimate the gradient of the weights.
10

---

Published in Transactions on Machine Learning Research (11/2023)
Table 2: Comparison of robustness for ResNet-18 on ImageNet using different quantization range initialization for 8-bit weight quantization.
Initialization
Test accuracy (%)
Model
method
Po 0%
Pe 0.1%
Max Abs
70.09
8.643.1
ResNet-18
Optimal MSE
70.10
22.646.26
Optimal Expected MSE
69.51
59.9642.58
4.7 Quantization Range
WC outlined our approach to initializing the quantization range. Our method involves perform- ing a brule force search to find the optimal quantization range that minimizes the expected MSE ween the real weights and the dequantized weights, considering the presence of bit-flip noise. In contrast, simpler approach, referred to as the Max Abs method, initializes the range based solely on the maximum absolute value of the weights. To assess the impact of these initialization methods, we conducted experiments on ResNet-18 fine-tuned on ImageNet and present the results in Table 2
In Section 3.5
We observe that both the Max Abs and optimal MSE methods yield better noiseless performance for bit quantization. However, this comes a cost to the robustness of the network after finetuning, as the larger initial range of the weights lead to increased sensitivity to perturbations. Notably, initializing the quantization range using proposed method for specific bit error rate can significantly enhance the robustness of the fine-tuned model.
4.8 Energy-reliability trade-off
Lowering the memory supply voltage reduces energy consumption, especially in SRAMs, but it can introduce bit-flip errors and therefore reduces the reliability of DNN accelerators. Hence, enhancing DNN robustness becomes crucial for ensuring resilience in low-power applications. To this end, we model the trade-off bet energy consumption and reliability in SRAMs by applying quadratic regression on the data from (Di Mauro itt al. 2020 Fig. 11), which is based on measurements on fabricated chips. Detailed information concerning the energy model is expounded in Appendix
For each DNN model, we Accelergy Wu et al. 2209 estimate the energy consumption on the Eyeriss accelerator Chen et al. (2016), thus including both memory-access and operation energy. We modified the Eyeriss architecture to have only on-chip memory, implemented with SRAM, for all data types. We assume only the DNN weights to be stored unreliably, with the activations and partial sums being stored in a reliable SRAM. We also assume that batch normalization layers are fused with the convolutional layers. The energy consumption at nominal voltage (0.8 V) for one image (batch size of 1) is 118.37 pJ, 285.96 μJ, 390.54 JJ, and 495.12 μJ for ResNet-20, ResNet-32, ResNet-44, and ResNet-56, respectively. Importantly, we note that these nominal-voltage runs not Pareto optimal and consequently excluded from the figure for clarity.
We present the accuracy versus energy consumption of the aforementioned ResNet models on CIFAR-10 using the different methods and levels of noise in Figure 7 All methods are repeated with and without BFN. We show the points in the Pareto frontier in specified color, which represents the best trade-off between enorgy consumption and accuracy. We observe that WCAT almost always achieves the lowest energy consumption for given accuracy level. This highlights the ability of WCAT to significantly reduce energy consumption during inference without compromising much reliability compared existing methods.
4.9 Effect of pre- pre-trained weights
As previously discussed, WCAT exhibits a significant improvement in robustness on ImageNet for both random bit-flip and adversarial attacks across all models. In order to investigate this observation further, we conducted experiment to examine the impact of finetuning pre-trained models. We initiated the training
11

---

Published in Transactions on Machine Learning Research (11/2023)
96
ResNet
ResNet-1
94
Res 32
ResNet-20
test accuracy (%)
92
90
88
86
75
100
125
150
175
200
225
250
energy (NJ)
*
WCAT
Normal
PLClip
Figure 7: Classification accuracy in terms of energy per inference run on CIFAR10.
92
52
90
accuracy
90
50
test aczuracy
13%
08
test
06
20%
80%
20%
40%
80%
40%
60%
WCAT epochs
to PLCCIip % epochs
TSQ epochs
Figure Impact of finetuning on accuracy for noiseless and 1% bit error rate models of NesNet-20 on CIFAR10.
process with normal training and, after certain number of epochs, switched to the WCAT quantization method. We repeated this process for 3 different seeds. Figure g illustrates the average accuracy as solid line and the minimum and maximum performance as a shaded area for both noiseless models and models subjected BFN training with a P, 1% bit-flip probability, specifically for ResNet-22 on CIFAR10.
We that for WCAT when changing the quantization method later epochs and attempting to finetune the model, the accuracy of both noiseless and noisy models increases. On the other hand, for LSQ, starting from the beginning of the training process is crucial. While PLClip shows similar behavior to WCAT, changing to PLClip later can slightly increase both performance and robustncss. However, when varying the regularization coefficient. (A) in WCAT (Figure D), this change becomes more significant for higher values of X. This aligns with our observation on ImageNet results, where using higher À with pre-trained weights is viable, while training from scratch on CIFAR10 and CIFAR100 with high lambda may not converge. This observation provides insight into why WCAT performs significantly better on pre-trained models compared to other methods.
12

---

Published in Transactions on Machine Learning Research (11/2023)
=0.01
=0.05
best sccuray (50
57
81
scurocy
accuracy
84
84
80
20%
10%
60%
30%
83
20%
10%
00%
80%
205
10%
00%
80%
Switch from WCAT of spochs
Switch
to WCAT at spochs
Switch from Normal this % spachs
Figure 9: Impact of finetuning accuracy for noiseless and 1% bit error rate models of ResNet-220 CIFAR1O.
5
Conclusion
In this paper, we presented a robust quantization scheme based on a key observation that emphasizes the cru- cial role of the quantization range in enhancing the robustness of DNNs. Our method incorporates a learning mechanism to optimize the quantization range of different layers during training, achieving a delicate bal- ance between robustness and noiseless performance. Our experimental results across different architectures and datasets showcase that WCAT outperforms existing robust quantization lechniques, exhibiting higher accuracy levels and better defense against both random and adversarial attacks. In the end, we show that WCAT consistently provides a practical solution to improving the resilience of DNNs against bit-flip errors.
References
Chaim Baskin, Evgenii Zheltonozhkii, Tal Rozen, Natan Liss, Yoav Chai, Eli Schwartz, Raja Giryes, Alexan- der M Bronstein, and Avi Mendelson. Nice: Noise injection and clamping estimation for neural network quantization. Mathematics, 2021.
Yoshua Bengio, Nicholas Léonard, and Aaron Courville. Estimating or propagating gradients through stochastic neurons for conditional computation. arXiv preprint arXio:1308.3332 2013.
Pradip Bose, Augusto J. Vega, Sarita V. Adve, Vikram S. Adve, and Vijay Janapa Reddi. Secure and
resilient SoCs for autonomous vehicles. Proceedings of the 3rd International Workshop on Domain Specific System Archilecture (DOSSA), pp. 1 1-6, 2021.
Abdullah Murat Buldu, Alper Sen, Karthik Swaminathan, and Brian Kahne. MBET: Resilience improvement method for DNNs. In IEEE International Conference On Artificial Intelligence Testing, 2022.
Yu-Hsin Chen, Tushar Krishna, Joel S Emer, and Vivienne Sze. Eyeriss: An energy-effcient reconfigurable accelerator for deep convolutional neural networks. IEEE Journal of Solid-State Circuits, 2016.
Jungwook Choi, Swagath Venkataramani, Vijayalakshmi Viji Srinivasan, Kailash Gopalakrishnan, Zhuo Wang, and Pierce Chuang. Accurate and efficient 2-bit quantized neural networks. Machine Learning and Systems, 2019.
Alfio Di Mauro, Francesco Conti, Pasquale Davide Schiavone, Davide Rossi, and Luca Benini. Always-on 674p Wa 4GOP/s error resilient binary neural networks with aggressive SRAM voltage scaling on a 22-nm loT end-node. IEEE Transactions on Circuits and Systems 1: Regular Papers, 2020.
Steven K Esser, Jeffrey L McKinstry, Deepika Bablani, Rathinakumar Appuswamy, and Dharmendra S Modha. Learned step size quantization. ar preprint orXio:1902.08115: 2019.
Fabio Frustaci, Mahmood Khayatzadch, David Blaauw, Dennis Sylvester, and Massimo Alioto. SRAM for error-tolerant applications with dynamic energy-quality management in 28 nm CMOS. IEEE Journal of Solid-State Circuils, 2015.
13

---

Published in Transactions on Machine Learning Research (11/2023)
Alexander Goncharenko, Andrey Denisov, Sergey Alyamkin, and Evgeny Terentev. Trainable thresholds for neural network quantization. In International Confe-Cofereecce on Artificial Neural Nelworks, 2019.
Cheng Gongye, Hongjia Li, Xiang Zhang, Majid Sabbagh, Geng Yuan, Xue Lin, Thomas Wahl, and Yunsi Fei. New passive and active attacks on deep neural networks in medical applications. In Proceedings of the 39th international conference computer-aided design, pp. 9, 2020.
Yanan Guo, Liang Liu, Yueqiang Cheng, Youtao Zhang, and Jun Yang. ModelShield: A generic and portable framework extension for defending bit-flip based adversarial weight attacks. In IEEE International Conference Computer Design, 2021.
Kaiming He, Xiangyu Zhang, Shaoqing Ren, and Jian Sun. Deep residual learning for image recognition. IEEE Conference on Computer Vision and Pattern Recognition, 2016.
Zhezhi He, Adnan Siraj Rakin, Jingtao Li, Chaitali Chakrabarti, and Deliang Fan. Defending and harnessing the bit-flip based adversarial weight attack. In IEEE/CVE Conference on Computer Vision and Pattern Recognition, 2020.
Sébastien Henwood, François Ledue-Primeau and Yvon Savaria. Layerwise noise maximisation to train low- energy deep neural networks. In International Conference on Artificial Intelligence Circuits and Systems, 2020.
Shah M Jahinuzzaman, Jaspal Singh Shah, David J Rennie, and Manoj Sachdev. Design and analysis of a 5.3-pJ 64-kb gated ground SRAM with multiword ECC. IEFE Journal of Solid-State Cirewils, 2009.
Sambhav Jain, Albert Gural, Michael Wu, and Chris Dick. Trained quantization thresholds for accurate and efficient fixed-point inference of deep neural networks. Machine Learning and Systems, 2020.
Sangil Jung, Changyong Son, Seohyung Lee, Jinwoo Son, Jae-Joon Han, Youngjun Kwak, Sung Ju Hwang, and Changkyu Choi. Learning to quantize deep networks by optimizing quantization intervals with task Conference Computer Vision and Pattern Recognition, 2019.
loss. In
Yoongu Kim, Ross Daly, Jeremie Kim, Chris Fallin, Ji Hye Loe, Donghyuk Leo, Chris Wilkerson, Konrad Lai, and Onur Mutlu. Flipping bits in memory without accessing them: An experimental study of DRAM disturbance errors. In ACM//EEE International Symposium Computer Architecture, 2014.
Alex Krizhevsky, Vinod Nair, and GeofTrey Hinton. Cifar-10 (canadian institute for advanced research). 2009. URL http:/// cs. toronto. eduizkriz/ ccifarifaar/////// .tml
Alex Krizhevsky, Πya Sutskever, and Geoffrey E Hinton. Imagenet classification with deep convolutional neural networks. Communications of the ACM, 2017.
Sheng Li, Ke Chen, Jung Ho Ahn, Jay B Brockman, and Norman P Jouppi. Cacti-p: Architecture-level modeling for sram-based structures with advanced leakage reduction techniques. In 2011 IEEE/ACM International Conference on Compuler-Aide Aided Design (ICCAD), pp. 694 701. IEEE, 2011.
Liang Liu, Yanan Guo, Yueqiang Cheng, Youtao Zhang, and Jun Yang. Generating robust dun with resistance to bit-flip based adversarial weight attack. IEEE Transactions on Computers, (2(2):401-413, 2023. doi:
10.11099/TC.2222.322111
Gonçalo Mordido, Matthijs Van Keirsbilek, and Alexander Keller. Instant quantization of neural networks using monte carlo methods. In Workshop on Energy Efficient Machine Learning and Cognitive Computing -NeurIPS Edition, 2019.
Markus Nagel, Marios Fournarakis, Rana Ali Amjad, Yelysei Bondarenko, Mart Van Baalen, and Tijmen Blankevoort. A white paper neural network quantization. arXiv preprint arXiv:2106.08295, 2021.
Ozan Özdenizei and Robert Legenstein. Improving robustness against stealthy weight bit-flip attacks by output code matching. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pp. 13388 13397, 2022.
14

---

Published in Transactions on Machine Learning Research (11/2023)
Cheng Qian, Ming Zhang, Yuanping Nie, Shuaibing Lu, and Huayang Cao. A survey of bit-flip attacks deep neural network and corresponding defense methods. Electronics, 2023.
Adnan Siraj Rakin, Zhezhi He, and Deliang Fan. Bit-flip attack: Crushing neural network with progressive bit search. In IEEE/CVF International Conference on Computer Vision, 2019.
Adnan Siraj Rakin, Zhezhi He, Jingtao Li, Fan Yao, Chaitali Chakrabarti, and Deliang Fan. T-bfa: Targeted bit-flip adversarial weight attack. IEEE Transactions on Pattern Analysis and Machine Intelligence, 44 (11):7928-774 7939, 2021a.
Adnan Siraj Rakin, Li Yang. Jingtao Li, Fan Yao, Chaitali Chakrabarti, Yu Cao, Jac-sun Seo, and Deliang Fan. RA-BNN: Constructing robust & accurate binary neural network to siultaneously defend adversarial bit-flip attack and improve accuracy, arXiv preprint arXiv:2103. 13813, 2021b.
Herbert Robbins and Sutton Monro. stochastic approximation method. Statistics, 1951.
The Annals of Mathematical
Charbel Sakr, Steve Dai, Rangha Venkatesan, Brian Zimmer, William Dally, and Brucek Khailany. Optimal clipping and magnitude-aware differentiation for improved quantization-aware training. In International Conference on Machine Learning, pp. 19123-19138. PMLRR 2022.
David Stutz, Nandhini Chandramoorthy, Matthias Hein, and Bernt Schiele. Bit error robustness for energy- efficient DNN accelerators. Machine Learning and Systems, 2021.
David Stutz, Nandhini Chaudramoorthy, Matthias Hein, and Bernt Schiele. Random and adversarial bit error robustness: Energy-effiiint and secure DNN accelerators. IEEE Transactions on Pattern Analysis and Machine Intelligence, 2022.
Hugo Touvron, Matthieu Cord, Matthijs Douze, Francisco Massa, Alexandre Sablayrolles, and Hervé Jégou, Training data-cfficient image transformers & distillation through attention. In International conference on machine learning, pp. 10347-10357. PMLR, 2021.
Yannan Nellic Wu, Jool S Emer, and Vivienne Sze. Accelergy: An architecture-level energy estimation methodology for accelerator designs. In LEEE/ACM International Conference on Computer- Aided Design, 2019.
Ritchie Zhao, Yuwei Hu, Jordan Dotzel, Chris De Sa, and Zhiru Zhang, Improving neural network quantiza- tion without retraining using outlier channel splitting. In International Conference on Machine Learning, 2019.
A Optimal Quantization Range
To motivate the connection between quantization range and robustness, we provide empirical analysis of the effect of random bit error noise on the optimal quantization range of a simple multi-layer perceptron (MLP) with a single hidden layer and 100 neurons trained on the MNIST dataset. We use cross-entropy as the objective function and use the same quantization range for the first and second fully connected layers. We evaluate our toy model on the test set for different levels of noise, which we introduce in Section 3.4 To estimate the exact loss of each trial, we use Monte-Carlo estimation, which involves sampling random instances of the noise and computing the average loss. Results are presented in Figure [Oa]
Our results indicate that increasing the bit error rate leads to smaller optimal quantization range. This finding highlights the importance of our proposed approach, as it ensures that the network maintains its performance under noiseless conditions while achieving a more robust network against bit-flip errors during inference.
Also, following similar method in Choi et al. (2019). in Figure 10b we demonstrate the a* on the (y-axis) versus bit error rate (x-axis) for some commonly known weight distributions such A/ 1), U(-1,1),
15

---

Published in Transactions on Machine Learning Research (11/2023)
0.7
normal
uniform
1LO%%
laplacian
0.5
von von_misse mises
0.4
0.3
0.2
0.1
0.0
0.1
2.0
bit error rate (%)
(a)
(b)
Figure 10: Optimal quantization range under bit error rate noise (a) Optimal quantization range for dif- ferent levels of noise on a simple MLP with one hidden layer trained on the MNIST dataset. (b) Optimal quantization range from different well-known distributions for varying levels noise.
Laplacian(O, 1), and Von mises(0, 4), where the a* is derived heuristically based on Equation 10 Each point represents the optimal expected range for a different level of noise. As we can see, as the level of noise increases, the optimal quantization range becomes smaller, emphasizing the importance of our proposed approach to reduce the quantization range.
B Experimental Setups
We provide additional details about our experimental results in this appendix.
B.1 Datasets
Both CIFARIO and CIFAR100 comprise 60,000 RGB images with dimensions of 32 x 32 x 3. As per the standard approach, 50,000 examples were utilized for training and the remaining 10,000 for testing, with images evenly drawn from 10 and 100 classes, respectively. On the other hand, ImageNet is more extensive dataset, consisting of 1.2 million training images across 1,000 classes, with input dimensions of 224 224 Our work employs the same data augmentation techniques as those in He et al. (2016).
B.2 Training Setups
Each model on CIFAR10 and CIFAR100 was trained using stochastic gradient descent (SGD) Robbins & Monro 1951) with a Nesterov momentum of 0.9, weight decay of 5 x 10-4, and a batch size of 128 for 300 epochs for and bit weight quantization. We used a cosine annealing learning rate scheduler, with an initial rate of 0.1.
To fine-tune our 8-bit network on ImageNet, we began with pre-trained weights and conducted single epoch of additional training, using SGD with momentum and learning rate of 10-4 As for 4-bit networks, initialized the pre-trained weights and fine-tuned them for 110 epochs using SGD with momentum, with batch size of 256. We implemented exponential lcarning rate decay, starting from an initial rate of 0.0015 and decaying it to a final value of 10-6
B.3 Noise Injection Training
We conducted experiments applying various levels of bit-flip noise during training, as detailed Scction 3.4 in addition to the previous methods. Our results showed that a low bit error rate during training did not improve the model's robustness during inference. Conversely, high amount of noise completely destroyed
16

---

Published in Transactions on Machine Learning Research (11/2023)
the network's performance during training and prevented it from converging. After testing different bit-flip probabilities Po ranging from 10-4 to 10-2, we found that a value of Po = 5 x 10-3 increased the model's robustness, with only a slight degradation in performance in the absence of noise. Furthermore, in the case of ImageNet, the network proved highly sensitive to minor perturbations, making it challenging to converge, even with a small amount of noise during training.
B.4 Evaluation Metrics
In order to assess the robustness of DNNs, we performed 50 iterations of bit-flip noise for each test example, and the classification result was obtained by averaging the outcomes. For evaluating the resilience of the DNNs against adversarial attacks, we modified the code from Rakin et al. (2019) and used the mumber of bit- flips (Nstip) as the metric to measure BFA resistance, which corresponds to a reduction of top-1 accuracy to below 11%, 1.1%, and 0.11% for CIFAR1O, CIFAR100, and ImageNet respectively. Since BFA requires a set of data to perform the attack, we randomly sample 64 images from the test set as the default configuration. Subsequently, we calculate the test accuracy using the remaining data and report the average value of Nyui across 10 different seed values.
Note that, the proposed BFA is performed through randomly draw sample of input images from the test rest/validation set, where the default sample size is 128 and 256 for CIFAR-10 and ImageNet respectively. Then, only the sample imput is used to perform BFA, where the rest data and ground-truth labels are isolated from the attacker. Moreover, each experimental configuration is run with trials to alleviate error caused by the randomness of sampling input.
B.5 Baselines
We conducted comparison between proposed method, WCAT, and three baselines, including linear quantization (Normal), per-layer aggressive weight clipping (PLClip) which is one of the state-of-the-art methods for dealing with bit-flip errors and TSQ, a state-of-the-art quantization method with learnable step size, using both 4-bit and 8-bit weight quantization. Notably, we made modifications to the PLClip method by applying parameter clipping exclusively linear and convolutional layers. The reasoning behind this modification and our observations are detailed in Appendix [
To determine the optimal standard clipping value for PLClip, conducted hyperparameter search within the range of 0.01 to 0.8 and we found the best standard clipping value for PLCCip to be 0.1 for ResNet-20 on CIFAR1O, 0.3 for ResNet-56 on CIFAR100, and 0.7 for ResNet-18 on ImageNet. It's worth noting that to generate a different clipping range per layor, we multiplied the clipping value by the ratio between the maximum absolute weight of the given layer and the maximurn absolute weight across the entire model. However, it's crucial to mention that PI.Clip is highly sensitive to the clipping hyperparameter selection, and finding the best value is a time-consuming process. Additionally, computing the clipping range for each layer using PLClip after each iteration significantly increases the training time.
C Energy model
As discussed earlier, Di Mauro et al. (220)) offers detailed exploration of fabricated SRAMs and their bit error rates under ultra-low energy conditions using Global Foundries 22nm FDX technology. They found that as the supply voltage decreases, the bit error rate (BER) rises exponentially. By performing a quadratic regression the experimental data, we obtain the following BER model:
c min (cxp la + bV + ,0.5)
(11)
where V represents the supply voltage and specific constants are defined as follows: a = 22.12, b - 68.14.
and c = 0. Since dynamic power is proportional to the square of supply voltage, we obtain the following energy model:
V2
E
Enom
(12)
1/2
nom
17

---

Published in Transactions on Machine Learning Research (11/2023)
where Vnom 0.8V refers to the nominal supply voltage, and Enom represents the energy consumption of the memory at the nominal voltage, as reported by CACTI (Li al. 2011).
Bit Error Rate
Normalized Energy
0.5
Bit Error Rate in %
Normalized Energy
10-1
0.4
10 3
10
0.3
10-7
0.2
0.40
0.45
0.50
0.55
Supply voltage
Figure 11:
Bit error rate measurements from Di Mauro et al. 2020 show the impact of supply voltage
scaling on SRAM memories.
Figure 11 visually explains what our energy model means. It shows that lowering the memory supply voltage saves energy, but at the same time, increases the likelihood of bit flips. This insight serves to emphasize the critical balance between energy efficiency and reliability.
18

---

Published in Transactions on Machine Learning Research (11/2023)
D PLClip and batch normalization layers
In Stutz et al. 20022) the authors originally suggest applying weight clipping to all layers, including batch normalization layers. Here, we show that restricting the clipping operation to only convolutional and linear layers can enhance model robustness. Figure 12 illustrates the comparison between the main PLClip hod and the modified version against random noise. We specifically evaluate the performance ResNet-22 on CIFAR1O and ResNet-18 on ImageNet, focusing on 4-bit quantization during training with and without bit-flip noise (BFN). The results demonstrate that by not clipping the weights in the batch normalization layers, obtain better accuracy and bit-error rate trade-off.
ResNet-22 20 on CIFAR10
ResNet- 18 on ImageNet
90
60
test accuracy (%)
Test accuracy (%)
85
40
20
0.0 0.01
0.08
0.2
0.6 1.0
0.0
0.01
0.08
0.2
0.6 1.0
bit error rate (%)
bit error rate (%)
clipping batch norm
w/o clipping batch norm
clipping batch norm BFN
w/o clipping batch norm BFN
Figure 12: Comparison of robustness between applying and not applying PLClip on batch normalization layers for 4-bit quantization.
19

---

Published in Transactions on Machine Learning Research (11/2023)
E Adversarial training
In this section, we introduce adversarial training as a baseline for comparison with our proposed method. Adversarial training has been explored prior works (Stutz et al. 2022 He et al. 2020), and we adopt the same objective proposed in Adversarial Bit Error Training (AdvBET) as described by (Stutz et al. 2022). The objective function is defined as
min (f + L (FWera W
(13)
where W represents the dequantized weights, and WBFA denotes the dequantized version of the weights perturbed under the BFA, following the objective described in equation
We follow setup similar to that outlined by Stutz al (2022), starting adversarial training when the loss falls below 1.75 on CIFAR-10. Additionally, we apply gradient clipping to the faulty forward pass, constraining the gradients to the range [-0.05, 0.05]. For rest of the training sctup, we use the same training recipe as discussed in Appendix B.2
It is important to note that adversarial training significantly extends the training time due to the repeated execution of the BFA at each training iteration. For example, when performing 5-bit flips using BFA cach iteration, training ResNet-20 on CIFAR-10 requires approximately 16.5x more time compared to standard training without adversarial components. For this reason, we only introduce BFAs after completing 50% of the total epochs when performing 10-bit flip attacks to amortize the training time.
In Table 3 we present the clean accuracy and Naip, which represents the average number of bit flips required to induce the network to make random guesses. These results are obtained using various quantization meth- ods and training ResNet-20 on the CIFAR-10 dataset with 4-bit quantization. In the context adversarial training, we employ bit flip attacks with & 2, 5, and 10 at each training iteration, where is the number of adversarial bit flips selected by BFA.
Table 3: Robustness Evaluation of ResNet-20 on CIFAR-10 with 4-Bit Quantization Using Various Quanti- zation Methods and Training Strategies
Normal
PLClip
WCAT
Test accuracy (%)
N fip
Test accuracy (%)
pup
Test accuracy (%)
Nyppp
Vanilla training
92.62
11.343.9
91.45
46.9
91.88
78.8
BFN
0.5%
90.57
14.543.
90.98
30. 30.1
91.85
90.2
k =
92.34
17.316.7
90.98
78.4116.3
91.00
83. 137.4
Adversarial
= 5
92.43
17.9
90.54
80.4424.4
91.02
65. 65.4g28.0
training
k == 10
91.90
33.817.8
91.10
67.4127.2
91.84
61.9128.2
We first observe that adversarial training enhances the model's robustness against BFA using normal quan- tization. However, when compared to other robust quantization methods, it remains significantly more susceptible to adversarial attacks while also compromising clean performance. These findings suggest that adversarial training alone may not be considered highly effective defense strategy, which aligns with the conclusions outlined by (He et al. 2020).
With PLClip, we observe notable improvement in model robustness when employing adversarial training with 5 BFAs at each training iteration, achieving a two-fold increase in robustness. It's worth noting that while Stutz et al. 2022 also demonstrates the potential for adversarial training on top of per-layer clipping to enhance adversarial robustness, their specific method for injecting adversarial noise during training to perturb weights (AdvBET) differs from our baseline.
In AdyBET, rather than employing BFAs, the authors use their customized implementation of adversarial bit errors. Their approach initializes perturbed weights with the introduction of up to bits flipped, then
20

---

Published in Transactions on Machine Learning Research (11/2023)
carries out gradient ascent steps in floating point to maximize the cross-entropy loss, followed by quantizing the weights to integer values and projecting the perturbed weights onto Hamming constraints. This iterative process is repeated for a specified number of iterations. The primary distinction between their method and BFA lies in the approach to progressively flipping bits, incorporating in-layer search and cross-layer search in an iverative manner. Due to the reported sensitivity of their training method to various hyperparameters, such as step size, gradient normalization, and momentum, coupled with the unavailability of their method's implementation to the public, we opted to utilize BFA as the basis for our baseline experiments.
Lastly, we observe that adversarial training yields only marginal improvements for WCAT, with the highest level of robustness still achieved by WCAT in combination with random flip noise injection during training.
F Targeted attack
In addition to assessing our proposed method against standard adversarial attacks, we expand evaluation to include targeted adversarial attacks (Rakin et al. 2021a). These attacks are designed to manipulate a model's behavior in specific, malicious ways while preserving its expected performance for other inputs.
N flips
PA ACC
ASR
khoke
2010
2::2
19.20
V8:22
90.0
VIA
122
2500
55
41.
350
14:25
12:35
27.55
17.52
11.44
T1.65
91:33
53.55
$1,07
99.4 9937
2 202220 2712
231A7
1115
300
TAUG
$1.35
CEAT
TADE
24
PARY
Taqus dass
200
85
Tonget C005
50
150
62.5
40
80.0
1o K00 1964 (4433 24.30 beci 20
64
50
71:32
1033
29:20
77.5
54.5
$7.50
pare braz arka 1m p0 isso 213.2 2010
1132
11:21
17//
76.00
8 09:22
19.22
2927
No un suz SMA m INk 2T 17A0
02
14:34
79:71
15.
15,07
Sourr cless
class
Figure 13: Performance evaluation of stealthy targeted adversarial attacks ResNet-20 with 4-bit quanti- zation: post-attack test accuracy, attack success rate, and average bit-flip counts across three attack rounds.
A notable benchmark for targeted adversarial attacks on weight-quantized DNNs is the targeted bit-flip attack (T-BFA) (Rakin et al.) 2021a). Particularly, we evaluate the different methods using stealthy T-BFA, which is a variant of T-BFA designed with the goal of misclassifying all samples from a source class as if they belong to a target class. Importantly, this manipulation is executed while ensuring that test examples outside the allakeed source class remain unaffected. As our evaluation metrics, we employ the attack success rate (ASR), post-attack test accuracy (PA-ACC), and the average number of bit flips used for each attack (Nyr)); following (Rakin et al. 2021a).
Results using 2esNet-20 models trained on CIFAR-10 with 4-bit quantization for WCAT are presented in Figure 13 Within this figure, we present three key metrics: N Nyups PA-ACC, and ASR, organized from left to right. These metrics represent. the average values derived from three independent runs for each combination of source and target class within CIFAR-10. In summary, we observe that for certain combinations of source and target classos, the adversary requires more than 350 bits to achieve its objectives.
In Table 4 we present the evaluation of T-BFA on ResNet-20 with 4-bit quantization alongside the BFA. To assess the robustness of our proposed method, compare it with another defense approach known output code matching (OCM) (Özdenizci & Legenstein 2022). OCM replaces traditional one-hot encoding with partially overlapping bit strings for multi-class classification, reducing attack stealthiness. In our evaluation, we utilize OCM with a code length of 64, a configuration that has demonstrated superior robustness for 2es
Our analysis reveals interesting insights into the performance of the OCM and our proposed method, WCAT, under targeted adversarial attack. We see that, while OCM demonstrates impressive resilience against
21

---

Published in Transactions on Machine Learning Research (11/2023)
Table 4: Robustness Evaluation of ResNet-20 on CIFARIO: TBFA and BFA with 4-Bit Quantization.
Stealthy T-BFA
RRakin et al.
2021a)
BFA
Test Accuracy (%)
ASR (%) 1
Ntupp
PA-ACC (%)
N N5lip' 1
Normal
92.62
98.92
26.71
78.80
11.3
WCAT
91.88
98.46
237.38
78.09
90.2
OCM-64
Özdenizei & Legenstein 2022
89.29
99.65
278.48
45.27
10.6
stealthy targeted attacks (as expected), proves to be highly sensitive to BFA sometimes even underper- forming standard quantization. This latter outcome is unsurprising since OCM primarily focuses on the final dense layer.
In more in-depth analysis, illustrate the distribution of layers affected by BFA and stealthy T-BFA in Figure 14 and 15 respectively. Notably, in largeted attacks, the bit-slip noise primarily impacts the last two layers, while in BFA, the first convolutional layer and intermediate layers are predominantly targeted.
In contrast, WCAT demonstrates exceptional robustness against stealthy targeted attacks, requiring only a marginal decrease in the N stips compared OCM for inducing malfunction the model. Impressively, WCAT showcases remarkable resilience against both BFA and stealthy T-BFA while managing to preserve the model's clean accuracy.
Normal
PLCiP
0.25
0.20
0.15
0.10
3.00
cand
lpper.. cond
Upper oummer
Low comel
Sapert coars
lapert 2.ame
laper comrt
lymr2 comua
layec dedommameee
lo L.nnu
leper22 cani
layer J.mend
lppedd comd
sped camd
lawe wwr....dewnnmme ensemaate
lazer Lomuz
leyer canot
Uperr Lood
byye convz
laperd
Figure 14: Distributions of attacked layers under BFA.
Normal
PLCI
LSQ
WCXT
0.4
0.2
1005
uywe www.l. con2
layer2 Loond
lawe aon2
lasee compt
layer eang
uoyer canry
0ver2.4.omd
laver. awwaaasiee
lajer2 cong
Laver cong
layerz comr
Wayer sang
layer 12 coog
layer 8.s0n
Levor2. dhwrsseesee
Layer ccout
Layer comz
lajer' compl
layer sung
Figure 15: Distributions of attacked layers under Stealthy T-BFA.
22


Reviews:
[{"review_id": "HeGb4OeABU", "reviewer": "Reviewer_NCJM", "summary": "", "questions": "", "limitations": "", "rating": null, "confidence": null, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "**Strengths**\n\n1. The proposed method is clear and easy to follow.\n2. Each component of WCAT, including range initialization and regularization, is discussed and analyzed in detail through experiments.\n3. The experiment covers different model architectures, attacks, and datasets, which sufficiently support some of the claims made in this paper.\n\n**Weaknesses**\n\n1. Using per-layer weight clipping is already proposed in [1], which limits the novelty of this paper.\n2. The motivation provided in Appendix A is confusing. To the best of my understanding, this observation supports the claim that \"increasing the bit error rate leads to a smaller optimal quantization range.\" However, WCAT proposes to **optimize** the quantization range for different layers. In my opinion, the major difference between this work and existing methods like [1, 2] is using optimization to learn the quantization range. Therefore, the motivation should explain why optimization is better than the specific quantization range proposed in [1].\n3. The baselines seem to be incomplete in the experiment settings. The main comparison includes WCAT, PLClip, and LSQ, but there are other methods like AdvBET and RandBET proposed in [1]. Given that [1] may be the most related work to this paper, I consider comparison to [1] is crucial.\n4. The organization of Sections 3 and 4 may be somewhat confusing, which affects the readability of this paper. Please refer to \"Requested Changes\" for more details.\n\n[1] Random and adversarial bit error robustness: Energy-efficient and secure DNN accelerators. *IEEE Transactions on Pattern Analysis and Machine Intelligence*, 2022.\n\n[2] Bit error robustness for energy-efficient DNN accelerators. *Machine Learning and Systems*, 2021.", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "Yes", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "paper_topic_and_main_contributions": "", "excitement": null, "reproducibility": null, "ethical_concerns": "", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "", "summary_of_contributions": "This paper proposes a weight clipping-aware training (WCAT) framework to improve the robustness of quantized neural networks against bit-flip weight perturbations. The motivation behind WCAT is an empirical observation on the relationship between quantization range and robustness in a toy model. The critical part of implementing WCAT is optimizing the quantization range during training. Furthermore, WCAT can be combined with the Bit-flip noise (BFN) injection method to further improve robustness. Experiments show that WCAT can outperform some baseline methods in terms of robustness against bit errors.", "claims_and_evidence_yn": "Yes", "claims_explanation": "", "audience_yn": "Yes", "audience_explanation": "", "requested_changes": "1. Provide a clearer motivation for this paper. This can be achieved by:\n    - Explaining why learning the quantization range with optimization is better than existing methods, or\n    - Justifying how the motivation discussed in Appendix A is related to the proposed method.\n2. Add experiments with more state-of-the-art baselines, as stated above.\n3. Reorganize Section 3:\n    - I suggest delaying the presentation of Algorithm 1 to the end of Section 3. For instance, you can add a subsection to summarize the WCAT framework by going through Algorithm 1. By contrast, putting Algorithm 1 at the start makes it somewhat hard to digest.\n    - The experiment provided in Figure 1 should appear in Section 4 along with other ablation studies, since this section aims to introduce the method.\n4. Reorganize Section 4:\n    - I suggest putting the major comparison (robustness) in the front, and other ablation studies in the latter.\n    - Some comparisons like Figure 2 may be better illustrated in tables, as the results seem to be very close.", "broader_impact_concerns": "N/A", "additional_comments": "", "extra_scores": {}, "extra_text": {}}, {"review_id": "mFbmlD0PBy", "reviewer": "Reviewer_B8pi", "summary": "", "questions": "", "limitations": "", "rating": null, "confidence": null, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "Strengths:\n- A novel solution to the niche problem of post-deployment bit-flip robustness of DNNs.\n- Storyline of the paper is well constructed, the manuscript is very clear to follow, and no misleading/unsupported claims present.\n- Paper does a good job at demonstrating the effectiveness of WCAT, including transformer-based models and ImageNet scale simulations. Design choice justifications (e.g., quantization range initialization, facilitating backpropagation) are described well.\n\nWeaknesses:\n- Mainly significant results are based on random bit-flip attacks. Adversarial attack experiments (Sec 4.6) can be extended to include targeted settings.\n- Authors could improve their SOTA discussions on the relevant literature beyond some selected pieces of work.", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "Yes", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "paper_topic_and_main_contributions": "", "excitement": null, "reproducibility": null, "ethical_concerns": "", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "", "summary_of_contributions": "This paper focuses on the problem of improving robustness in quantized DNNs against random or adversarial bit-flips. Authors propose a weight clipping-aware training (WCAT) approach, where the quantization range of weights in each layer are independently optimized during training. By using a regularized training scheme, this learnable quantization range can be penalized/reduced in magnitude, which in turn increases robustness. In this pipeline, additional bit-flip noise is also incorporated during training to boost robustness further. Experiments are performed on CIFAR and ImageNet datasets, including ResNet and DeiT architectures at 4-bit and 8-bit quantization.", "claims_and_evidence_yn": "Yes", "claims_explanation": "", "audience_yn": "Yes", "audience_explanation": "", "requested_changes": "(1) Setting a non-zero bit error rate $p_o$ during training seems beneficial against random bit-flips, which is intuitive and accurate. Is there any reliable evidence that it is also beneficial against adversarial bit-flip attacks? Can the authors elaborate Figures 5 & 6 in terms of the results without BFN in WCAT?\n\n(2) Regarding SOTA comparison: Literature coverage of defenses is only centered around weight clipping and bit-flip based training methods. Some of the other existing adversarial bit-flip defenses are missing, and these were also found powerful in non-adversarial settings [1,2]. It would be good to include these methods for comparisons in the paper.\n\n(3) Did/can the authors simulate any targeted bit-flip attack [3] scenarios in at least CIFAR level experiments? There is a significant line of attack/defense works exclusively focusing on targeted bit-flips [2-5], which constitute a highly realistic and important scenario. Authors should also discuss these relevant works for a broader inclusion of literature.\n\n(4) Adversarial BFA setting often converges to solutions (bits to be flipped) in the final dense layer of the network. Did the authors simulate the \"random attacks\" considering the whole network or only the final dense layer(s)? Both would be interesting to see comparatively on e.g., one dataset.\n\nMinor comments:\n- Since bit-flip noise is a part of Algorithm 1, one assumes that it is already a part of WCAT by default. However in Figure 2 legend, there is a WCAT vs. WCAT+BFN separation. Perhaps one should restructure it in terms of setting $p_o=0$ or not.\n- In Appendix B.4, for the statement: \".. we selected 64 sample images from the test set [...] average over 10 different seeds.\" -> I believe this means: \".. we sampled 64 images from the test set [...] average over 10 different seeds\" ?\n- In Figure 6, am I correct to assume that the title texts \"(5M)\", \"(22M)\" and \"(86M)\" indicate the number of parameters but not the # bits that can be flipped? I guess the latter would also be fitting here.\n\nReferences:\n\n[1] \"Defending and harnessing the bit-flip based adversarial weight attack\", CVPR 2020.\n\n[2] \"Improving robustness against stealthy weight bit-flip attacks by output code matching\", CVPR 2022.\n\n[3] \"T-BFA: Targeted bit-flip adversarial weight attack\", IEEE TPAMI 2021.\n\n[4] \"Targeted attack against deep neural networks via flipping limited weight bits\", ICLR 2021.\n\n[5] \"Aegis: Mitigating Targeted Bit-flip Attacks against Deep Neural Networks\",  USENIX Security Symposium 2023.", "broader_impact_concerns": "I do not see any broader impact concerns.", "additional_comments": "", "extra_scores": {}, "extra_text": {}}, {"review_id": "hiaqq4LJ9I", "reviewer": "Reviewer_eJU5", "summary": "", "questions": "", "limitations": "", "rating": null, "confidence": null, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "Strengths:\n1. The proposed algorithm is easy to follow.\n2. The authors conduct extensive evaluation on various datasets as well as different models. The comparison with other baselines demonstrates the effectiveness of the proposed algorithm.\n\n\nWeaknesses:\n1. The contribution of the proposed algorithm mainly lies in the optimal quantization range. However, the optimization of quantization range is not a new story in this field. Although the authors demonstrate some trial empirical analysis of the connection between reduced quantization range and bit error rate, these trial experiments might not be sufficient and convincing to make the conclusion that a reduced quantization range leads to better performance. Specifically, the empirical evidence excludes popular backbones and benchmarks. Second, there is no evidence that. Furthermore, it is difficult to see the influence of how $\\alpha^*$ changes in layers with different depths.\n2. The authors discuss the training with noise injection, which is a common practice in adversarial robustness, such as adversarial training. In Eq. 8, $\\epsilon$ seems to be randomly sampled instead of adversarial attacks. More evaluation of the proposed algorithm with adversarial training is not included.", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "Yes", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "paper_topic_and_main_contributions": "", "excitement": null, "reproducibility": null, "ethical_concerns": "", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "", "summary_of_contributions": "This paper introduces a symmetric signed quantization scheme, which achieves better robustness against bit-flip noise. Specifically, the weights are clipped and applied linear weight quantization. The clamping range is optimized and be regularized to a small range based on the empirical analysis. The authors conduct evaluation on various models and datasets to demonstrate the effectiveness of their algorithm.", "claims_and_evidence_yn": "Yes", "claims_explanation": "", "audience_yn": "Yes", "audience_explanation": "", "requested_changes": "1. Please justify the novelty.\n2. Please clarify the motivation and provide more empirical evidence and analysis.\n3. Please provide more evaluation with adversarial training against adversarial attacks.\n4. Although this paper focuses on bit-flip noise, it could be interesting to see whether the proposed algorithm performs better robustness under traditional adversarial attacks on the image input, such as FGSM, PGD, etc.", "broader_impact_concerns": "None.", "additional_comments": "", "extra_scores": {}, "extra_text": {}}]

Author rebuttal:

Meta-review: This paper proposes a weight clipping-aware training (WCAT) approach to enhance DNN robustness against bit-flip errors on model weights. WCAT helps to achieve an optimized dynamic range of quantized weights in each layer to strike a balance between model accuracy and robustness. The effectiveness of the methods is evaluated on ResNet and DeiT models and on CIFAR and ImageNet datasets under a range of robustness benchmarking settings.

The paper is well written. Although the introduced quantization technique, i.e. the trainable clip values has been well-established in prior research on model quantization, the authors re-directed their attention toward improving the robust. The results clearly illustrate the efficacy of the methods in achieving a balance between model accuracy and robustness.

Reviewers have raised two main concerns:

1). The motivation is not clearly presented.

2). Lack evaluation on adversarial training and targeted bit-flip attack.

During the rebuttal phase, the authors thoroughly address the concerns and provide additional data.

In summary, this paper is technically solid. Two reviewers recommend accept, while one reviewer leaning rejection concerning the limited backbone structures evaluated in the paper. However, considering the proposed methods demonstrate competitive results and offer potential benefits in this domain, I recommend acceptance. I also hope that the authors will conduct a wider range of evaluations in their future work.
Decision: Accept (poster)