# On the Reliability Assessment of Artificial Neural Networks Running on AI-Oriented MPSoCs
## 5 Experimental Results
### Ranking of the Criticality of Single Neurons
#### 5.1.1 Class-Oriented Analysis (CoA)
The situation worsens with \(p=1\%\) for all the classes, except for digits 5 and 7, where the accuracy keeps close to \(60\%\) (Figure 3(c)). In the last scenario, when dropping \(p=1.5\%\) critical neurons from the classes, the correct predictions become zero or close to it. As illustrated in Figure 3(d), it turns out that for LeNet trained on MNIST data set, the most robust class corresponds to digit 5, while the least robust is digit 4. The outcome of the software fault injection for the SVHN network (ConvNet) is shown in Figure 5. When crashing \(p=0.1\%\)_Critical_ neurons, the CNN accuracy decreases until reaching a maximum percentage variation equal to \(7.3\%\) for digit 9 (Figure 4(a)). With the increase in the dropped critical neurons \(p=0.5\%\), we observe a considerable drop in accuracy, with a maximum of \(61.9\%\) of variation percentage still for digit 9 (Figure 4(b)). The correct functionality of the neural network worsens considerably for \(p=1\%\) until it reaches zero in almost all classes for \(p=1.5\%\) (Figure 4(c),d). Overall, the most robust class turns out to be the third one, i.e., digit 2. In fact, despite the dropped neurons, it is able to keep an accuracy close to \(80\%\) with the highest neurons dropped of \(927\) (\(p=0.5\%\)). On the other hand, the least resilient class is the last one (digit 9). In fact, it is significantly sensitive to removed neurons (starting from \(p=0.1\%\)). With respect to LeNet (MNIST) and ConvNet (SVHN), All-CNN (CIFAR-10) demonstrates greater sensitivity. As shown in Figure 5(a), we can observe a greater reduction in accuracy from \(p=0.1\%\) (the maximum drop in accuracy is for Class \"_Horse_\" and corresponds to \(16.2\%\) from the _Fault-free_ value). In addition, for \(p=0.5\%\), all the classes' accuracy stays under \(60\%\), with the maximum variation percentage from the golden accuracy equal to \(69.82\%\) for the class \"_Horse_\" (Figure 5(b)). When the dropped neurons become \(p=1\%\) from each class (meaning about \(1854\) neurons over the total \(185\),\(374\)), the accuracy of the classes drops below \(20\%\), except for the class \"_Car_\" with \(21.4\%\) (Figure 5(c)). The experimental  
Figure 5: SVHN ConvNet: software fault injection campaigns on _random_ and _critical_ neurons. A fixed percentage \(p\) of neurons is dropped. results indicate that the most robust class is the class \"_Car_\", while the least resilient one is class \"_Horse_\" (Figure 5(d)). Overall, data from Figures 4-6 suggest similar conclusions, and the different per-class resilience is confirmed in the three targeted CNNs. It is clear that the \(p\)-percentage refers to different CNNs of different sizes: the CIFAR-10 network contains almost 7.54\(\times\) and 4\(\times\) the number of neurons than the MNIST and SVHN networks, respectively. It means that the former starts misbehaving with about 361 neurons crashed (\(p=0.1\%\)), while the other two (with the same percentage) with about 49 and 185, respectively. Finally, these outcomes experimentally demonstrate the initial assumption stating that there are neurons playing a key role, and therefore, are defined critical for the output classes. To avoid confusion, we used the \(p\) parameter to indicate the amount of neurons dropped from the individual classes, and the \(t\) parameter to represent the set of critical neurons in the network-oriented score map. They are both percentages working on the score maps, but the first is used in the class-oriented analysis and is used to drop neurons, while the second in used in the network-oriented analysis and serves as a parameter to indicate the reliability level of the system.