# Comparing Application-Level Hardening Techniques for Neural Networks on GPUs
## 5 Experimental Results
### Fault Mitigation with Respect to WSBFs
However, we can notice that in 4 out of the 5 target NN architectures, range-restriction-based HTs (i.e., Ranger and Adaptive Clipper) outperform the others. For example, in Lenet5, Adaptive Clipper helps to reduce the impact of errors affecting the 30 th bit by increasing the accuracy of the baseline model from 59.74% to 88.56%, while Ranger, median filter, and Swap ReLU6 introduce a reduced but significant improvement with respect to the Baseline in NN accuracy to 87.05%, 79.01%, 75.23%, respectively. This means that range-restriction-based HTs result in better improvements than other approaches, and  
Figure 5: Fault class distribution. In this figure, the HT names are abbreviated as follows: Baseline (BL), Adaptive Clipper (AC), Swap ReLU6 (SR) and median filter (MF). the additional training step included in the implementation of Adaptive Clipper helps to improve Lenet5 resiliency more than Ranger. Mnasnet, regardless of the implemented HT (i.e., Baseline, Ranger, or Adaptive Clipper), is the only architecture that is not resilient to the faults inducing errors in the exponent bits different than bit 30. However, Adaptive Clipper shows a negligible improvement with faults of 0.2%, while Ranger increases the accuracy with respect to the Baseline by up to 2.03%. However, when the fault location is in bit 30, Ranger and Adaptive Clipper increase the Baseline accuracy by 50.79% and 48.70%, respectively. When considering Mobilenet V2 architecture, Adaptive Clipper improves the baseline accuracy from 66.48% to 70.03% when the bit-flip occurs on bit 30, while, under the same faulty scenario, Ranger shows performance comparable with the Baseline. As previously mentioned, this highlights the importance of the additional training step of Adaptive Clipper in Mobilenet V2, since the original architecture includes bounded activation functions so that the new activation functions are clipped around the original values. Interestingly, when Swap ReLU6 is implemented on Mobilenet V2, the training algorithm converges to higher accuracy (84.36%) than Baseline (78.99%). This results in an increased resiliency to bit-flips in bit 30, achieving an accuracy that is comparable to the Baseline accuracy when lower significant bits are affected, i.e., 76.84%. Figure 6: Accuracy degradation for HTs in front of errors injected in weights per bit location. For Resnet18, when the MSB is targeted, the baseline accuracy is 52.95%, and median filter reaches 64.47%, which is comparable to the improvements in Ranger and Adaptive Clipper where the NN reaches 65.52% and 63.05% accuracy, respectively. Ultimately, the error-severity-based analysis shows the NN is sensitive to faults in exponent bit locations different from bit 30. In general, we can say that Ranger, from bit 26 to bit 30, shows a constant improvement of \(\approx\)2.5%. On the other hand, Adaptive Clipper increases the baseline accuracy from 43.31% to 48.51% only when bit 30 is targeted, while when other exponent bits are targeted, the recorded improvement is only 0.46%. Concerning Squeezenet, Adaptive Clipper and Ranger, in particular Adaptive Clipper, outperform other approaches, reaching an accuracy score of 65.88% and 58.64%, where Swap ReLU6 seems to have no actual beneficial effect on the NN architecture, improving the baseline accuracy by only 0.1%. The ineffectiveness of the implementation of Swap ReLU6 on Squeezenet comes from the fact that its convolutional blocks do not contain any normalization layer, which means that implementing Swap ReLU6 on Squeezenet only concerns the bounding of the ReLU activation function to 6. Based on this initial evaluation, we can conclude that when single bit-flips are introduced into the weights, it is not possible to establish a clear ranking in terms of the percentages of masked faults or critical SDCs.