对比四种精度下嵌入式模型抗电磁故障攻击能力,发现整数精度更耐用。
The Weight of a Bit: EMFI Sensitivity Analysis of Embedded Deep Learning Models
- 测试32位浮点、16位浮点、8位整数、4位整数四种表示方式
- 单次故障后浮点模型准确率几乎归零,8位整数仍保持70%准确率
- 发现0xFE/0xFF字节异常高频,揭示故障传播机制
嵌入式神经网络模型的故障注入攻击已被证明是重大威胁。现有研究多从不同角度评估模型韧性,但尚无系统性工作分析参数数值表示对电磁故障注入(EMFI)攻击的影响。本文研究了四种不同数值表示在嵌入式模型上对EMFI攻击的敏感性:32位浮点、16位浮点、8位整数、4位整数。将四个常见图像分类器——ResNet-18、ResNet-34、ResNet-50和VGG-11部署于嵌入式存储芯片,并使用低成本EMFI平台触发故障。除准确率评估外,还通过比特错误率、受损字节空间分布及0xFE/0xFF字节出现频率,分析故障模式,揭示韧性差异机制。结果表明,浮点表示在单次故障后准确率几乎完全崩溃(Top-1与Top-5),而整数表示整体更具抗性;其中,大网络VGG-11在8位整数表示下仍保持约70%的Top-1准确率和约90%的Top-5准确率。
原文摘要 · Abstract (English)
Fault injection attacks on embedded neural network models have been shown as a potent threat. Numerous works studied resilience of models from various points of view. As of now, there is no comprehensive study that would evaluate the influence of number representations used for model parameters against electromagnetic fault injection (EMFI) attacks. In this paper, we investigate how four different number representations influence the success of an EMFI attack on embedded neural network models. We chose two common floating-point representations (32-bit, and 16-bit), and two integer representations (8-bit, and 4-bit). We deployed four common image classifiers, ResNet-18, ResNet-34, ResNet-50, and VGG-11, on an embedded memory chip, and utilized a low-cost EMFI platform to trigger faults. Beyond accuracy evaluation, we characterize the injected fault pattern by analyzing the bit error rate, the spatial distribution of corrupted bytes, and the prevalence of 0xFE/0xFF byte values across formats, identifying the mechanisms responsible for the observed differences in resilience. Our results show that while floating-point representations exhibit almost a complete degradation in accuracy (Top-1 and Top-5) after a single fault injection, integer representations offer better resistance overall. In particular, the 8-bit representation on a relatively large network (VGG-11) retains Top-1 accuracy of around 70% and Top-5 at around 90%.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品;中文卡片由大模型生成,请以原文为准。