The Weight of a Bit: EMFI Sensitivity Analysis of Embedded Deep Learning Models

TL;DR

The results show that while floating-point representations exhibit almost a complete degradation in accuracy after a single fault injection, integer representations offer better resistance overall.

Abstract

Fault injection attacks on embedded neural network models have been shown as a potent threat. Numerous works studied resilience of models from various points of view. As of now, there is no comprehensive study that would evaluate the influence of number representations used for model parameters against electromagnetic fault injection (EMFI) attacks. In this paper, we investigate how four different number representations influence the success of an EMFI attack on embedded neural network models. We chose two common floating-point representations (32-bit, and 16-bit), and two integer representations (8-bit, and 4-bit). We deployed four common image classifiers, ResNet-18, ResNet-34, ResNet-50, and VGG-11, on an embedded memory chip, and utilized a low-cost EMFI platform to trigger faults. Our results show that while floating-point representations exhibit almost a complete degradation in accuracy (Top-1 and Top-5) after a single fault injection, integer representations offer better resistance overall. Especially, when considering the the 8-bit representation on a relatively large network (VGG-11), the Top-1 accuracies stay at around 70% and the Top-5 at around 90%.

Figures (8)

• Figure 1: Overview of the EMFI analysis done in this paper.
• Figure 2: Experimental electromagnetic fault injection setup overview.
• Figure 3: NewAE ChipSHOUTER EMFI device mounted on the Ender-3 3D printer used as a positioning device. The Ballistic Gel board with the 4MB SRAM chip used as the DUT is positioned below the ChipSHOUTER.
• Figure 4: Detail of the EM probe above the SRAM chip.
• Figure 5: Surface scan showing the success rate per point -- proportion of corrupted bytes in the SRAM.