Paper deep dive
The Weight of a Bit: EMFI Sensitivity Analysis of Embedded Deep Learning Models
Jakub Breier, Štefan Kučerák, Xiaolu Hou
Intelligence
Status: succeeded | Model: Gemma-4-26B-A4B | Prompt: intel-v1 | Confidence: 92%
Last extracted: 7/21/2026, 1:53:13 AM
Summary
This paper presents a comprehensive empirical study evaluating the resilience of embedded deep learning models against Electromagnetic Fault Injection (EMFI) attacks across four different numerical weight representations: FP32, FP16, INT8, and INT4. Using architectures like ResNet and VGG on embedded hardware, the authors demonstrate that floating-point models suffer catastrophic accuracy degradation from single-bit faults, whereas integer representations, particularly INT8, offer significantly better resistance and a favorable trade-off between model size and fault tolerance.
Entities (12)
Relation Signals (7)
EMFI → targets → Embedded Neural Networks
confidence 95% · Fault injection attacks on embedded neural network models have been shown as a potent threat.
ChipSHOUTER → usedfor → EMFI
confidence 95% · To assess fault tolerance, we subject the resulting models to experimental EMFI campaigns using a NewAE ChipSHOUTER platform
FP32 → exhibits → Catastrophic Accuracy Degradation
confidence 92% · floating-point representations exhibit almost a complete degradation in accuracy (Top-1 and Top-5) after a single fault injection
ResNet-18 → isevaluatedwith → EMFI
confidence 90% · We evaluate four representative convolutional neural network (CNN) architectures—ResNet-18... subject the resulting models to experimental EMFI campaigns
VGG-11 → isevaluatedwith → EMFI
confidence 90% · We evaluate four representative convolutional neural network (CNN) architectures—... and VGG-11... subject the resulting models to experimental EMFI campaigns
INT8 → offers → Better Resistance
confidence 90% · integer representations offer better resistance overall. In particular, the 8-bit representation on a relatively large network (VGG-11) retains Top-1 accuracy of around 70%
TinyML → enables → Edge AI
confidence 85% · TinyML specifically targets the most resource-constrained class of devices... deployment of deep learning models on edge devices, often referred to as Edge AI
Cypher Suggestions (0)
No Cypher suggestions yet.
Abstract
Abstract:Fault injection attacks on embedded neural network models have been shown as a potent threat. Numerous works studied resilience of models from various points of view. As of now, there is no comprehensive study that would evaluate the influence of number representations used for model parameters against electromagnetic fault injection (EMFI) attacks. In this paper, we investigate how four different number representations influence the success of an EMFI attack on embedded neural network models. We chose two common floating-point representations (32-bit, and 16-bit), and two integer representations (8-bit, and 4-bit). We deployed four common image classifiers, ResNet-18, ResNet-34, ResNet-50, and VGG-11, on an embedded memory chip, and utilized a low-cost EMFI platform to trigger faults. Beyond accuracy evaluation, we characterize the injected fault pattern by analyzing the bit error rate, the spatial distribution of corrupted bytes, and the prevalence of 0xFE/0xFF byte values across formats, identifying the mechanisms responsible for the observed differences in resilience. Our results show that while floating-point representations exhibit almost a complete degradation in accuracy (Top-1 and Top-5) after a single fault injection, integer representations offer better resistance overall. In particular, the 8-bit representation on a relatively large network (VGG-11) retains Top-1 accuracy of around 70% and Top-5 at around 90%.
Tags
Links
- Source: https://arxiv.org/abs/2602.16309v2
- Canonical: https://arxiv.org/abs/2602.16309v2
Trouble viewing inline? Open PDF directly →
Full Text
66,294 characters extracted from source content.
Expand or collapse full text
JOURNAL OF L A T E X CLASS FILES, VOL. 14, NO. 8, AUGUST 20211 The Weight of a Bit: EMFI Sensitivity Analysis of Embedded Deep Learning Models Jakub Breier, ˇ Stefan Ku ˇ cer ́ ak, Xiaolu Hou Abstract—Fault injection attacks on embedded neural network models have been shown as a potent threat. Numerous works studied resilience of models from various points of view. As of now, there is no comprehensive study that would evaluate the influence of number representations used for model parameters against electromagnetic fault injection (EMFI) attacks. In this paper, we investigate how four different number representations influence the success of an EMFI attack on embedded neural network models. We chose two common floating-point representations (32-bit, and 16-bit), and two integer representations (8-bit, and 4-bit). We deployed four common image classifiers, ResNet-18, ResNet-34, ResNet-50, and VGG- 11, on an embedded memory chip, and utilized a low-cost EMFI platform to trigger faults. Beyond accuracy evaluation, we characterize the injected fault pattern by analyzing the bit error rate, the spatial distribution of corrupted bytes, and the preva- lence of 0xFE/0xFF byte values across formats, identifying the mechanisms responsible for the observed differences in resilience. Our results show that while floating-point representations exhibit almost a complete degradation in accuracy (Top-1 and Top-5) after a single fault injection, integer representations offer better resistance overall. In particular, the 8-bit representation on a relatively large network (VGG-11) retains Top-1 accuracy of around 70% and Top-5 at around 90%. Index Terms—Neural networks, electromagnetic fault injec- tion, neural network security I. INTRODUCTION E MBEDDED implementations of neural networks are gaining popularity with frameworks such as TinyML [1], allowing a real-time, efficient execution in the Edge. The applications range from the Internet of Things to mobile devices to autonomous systems, offering significant benefits: reduction in latency, improved data privacy, removing the necessity of a constant network connection, to name a few. These lightweight frameworks take pre-trained models and optimize them with various techniques, such as quantization and pruning [2], to fit in the resource-constrained hardware. The result is the ability of small microcontrollers with only a few kilobytes of RAM to run models for image classification, anomaly detection, and others, effectively moving away from the classical cloud setup. J.BreieriswithTTControlGmbH,Vienna,Austria.E-mail: jbreier@jbreier.com. ˇ S. Ku ˇ cer ́ ak and X. Hou are with the Faculty of Informatics and Information Technologies, Slovak University of Technology, Slovakia. X. Hou is also affili- ated with the State Key Laboratory of Blockchain and Data Security , Zhejiang University. E-mail: xkucerak@stuba.sk, houxiaolu.email@gmail.com. This work was supported by the Open Research Fund of The State Key Laboratory of Blockchain and Data Security, Zhejiang University under grant no. A2566. This naturally introduces new security and reliability chal- lenges due to malicious and environmental influences stem- ming from the physical accessibility of these devices. Fault injection attacks (FIAs) are one notable threat where the attacker disturbs the operation of the device to introduce errors, either in the data or execution flow [3]. Electromagnetic fault injection (EMFI) [4] is a fault injection technique that is non- invasive and does not need a sophisticated, expensive device to perform. The attacker uses a high-power pulse generator to inject a sharp electromagnetic pulse, introducing transient faults in the device’s electronic circuits. These faults can either cause bit flips in the memory or skip the instructions being executed, resulting in the misbehavior of the neural network model, as shown in [5]. When deploying neural networks on a microcontroller, one needs to consider the numerical representation of model pa- rameters. To achieve memory and power savings, it is standard to use reduced-precision formats: for instance, 32-bit floating- point weights can be reduced to 16-bit floats, 8-bit integers, and in extreme cases even to 4-bit or binary weights [6]. While such precision reduction/quantization introduces an approxi- mation error, when used properly, a quantized model can retain almost the same accuracy as the original one [7]. At the same time, quantization changes the fault tolerance characteristics of a network, leading to different vulnerability profiles under fault injection [8]. Intuitively, a bit flip in an integer weight has a bounded effect, especially since the weight range is limited by the quantization scale, whereas in a floating-point weight, a bit flip in the exponent bits can have a significant influence on the network’s output, as was investigated in [9]. In integer formats, the most significant bits are the critical ones for a network’s computation, while in floating-point, the exponent and higher- order mantissa bits carry the most significance. Furthermore, larger models provide inherent redundancy that compensate for some faults. The open question, and the main focus of this paper, is how these factors play out in practice: To what extent does the choice of weight number format (from high-precision to aggressively quantized) influence a neural network’s resilience against EMFI attacks? Despite growing awareness of both quantization techniques and fault injection threats, this specific question remains only partially answered by prior research. Most existing studies of neural network fault tolerance have considered a single representation (often full 32-bit precision, or a very low-bit scheme in isolation), rather than comparing formats, thus a systematic investigation is warranted [5], [8]. arXiv:2602.16309v2 [cs.CR] 11 Apr 2026 JOURNAL OF L A T E X CLASS FILES, VOL. 14, NO. 8, AUGUST 20212 Our contribution. In this work, we present an extensive empirical study of how weight representation influences the resilience of neural networks to electromagnetic fault injection. We consider four widely used numerical formats for model weights: 32-bit floating point (FP32), 16-bit floating point (FP16), 8-bit integer (INT8), and 4-bit integer (INT4), span- ning the range from full precision to aggressive quantization. We evaluate four representative convolutional neural network (CNN) architectures—ResNet-18, ResNet-34, ResNet-50 [10], and VGG-11 [11]—trained on the ImageNet-1K dataset [12], and instantiate each architecture in all four numerical formats. To assess fault tolerance, we subject the resulting models to ex- perimental EMFI campaigns using a NewAE ChipSHOUTER platform and measure the resulting degradation in Top-1 and Top-5 accuracy under identical attack conditions. Beyond the accuracy evaluation, we also characterize the injected fault pattern itself by analyzing the bit error rate, the spatial distri- bution of corrupted bytes, and the prevalence of 0xFE/0xFF byte values across formats. This methodology enables a direct comparison of the robustness of different weight representa- tions and helps explain the underlying mechanisms of failure. Our results reveal marked differences across formats: although the measured fault density is broadly similar across represen- tations, floating-point models exhibit catastrophic degradation due to NaN-inducing exponent corruption, whereas integer models generally retain substantially higher accuracy, with INT8 offering the most favorable trade-off between baseline accuracy and EMFI resilience. To our knowledge, this is the first comparative study of neural network fault-injection robustness across multiple weight precisions under a unified experimental setup. Organization. The rest of the paper is organized as follows. Section I overviews a related work in the field and Section I gives the necessary background. Evaluation method on an experimental hardware is described in Section IV, followed by Section V that details the results of this work. Section VI provides the discussion, and finally, Section VII concludes this paper and provides directions for future work. I. RELATED WORK A number of prior works have begun to explore the in- tersection of neural network quantization/representation and fault attacks, which we briefly review here and summarize in Table I. One of the first attacks showed that by selecting and flipping a specific bit in a 32-bit floating point representation, it is possible to reduce the network accuracy by ≈90% [9]. In the domain of fault attacks on quantized neural networks, one of the earliest studies showed that by strategically flipping a few weight bits (via a Rowhammer-induced memory fault), an attacker could force a DNN classifier into misclassifying virtually all inputs, effectively reducing its accuracy to nearly random guess [13]. Along with the previous work, this demon- strated the outsized impact that even low-level data corruption can have on network accuracy, whether it is represented in a floating-point or an integer format. SNIFF method [14] took fault attacks further by using them for model extraction: it allowed to reverse-engineer the parameters of a neural network by inducing sign-bit flips in the network’s computations. By using high-precision arithmetic in their experiments, the authors were able to recover model weights with negligible error (on the order of 10 −13 ), essen- tially stealing a proprietary model with far fewer queries than a standard black-box approach. On the other hand, research in neural network reliability has looked at how model design choices (like quantization) affect tolerance to unintentional faults (for example, soft errors or radiation-induced bit flips). In [15], the authors investigated CNNs on FPGAs under radiation-induced single-event upsets, comparing a baseline full-precision model to a binarized (1- bit weights) model. They found that the quantized (binary) network was about 39% less sensitive to radiation-induced faults than the full-precision network, presumably because the simpler binary representation and reduced parameter count offered a smaller attack surface in terms of bits that can be flipped. However, they also observed a trade-off: the fraction of faults that led to output misclassification was slightly higher (by ≈12%) in the binary network, indicating that while fewer faults occured, those that did were somewhat more likely to cause an error in inference. In another recent study [8], the authors examined the fault tolerance of quantized and pruned CNN models. They developed a statistical fault injection framework (SFI4N) to efficiently evaluate large networks, and reported that as net- works are more aggressively pruned (sparser), their sensitivity to bit flips increases, presumably due to less redundancy in the parameters. To counter this, they proposed a selective redundancy mechanism (a lightweight error mitigation tech- nique) and demonstrated it could improve a quantized CNN’s EMFI Attack (Pulse Generator) EM Pulse Target Memory (RAM) Neural Network Accuracy FP32/16 Representation Result: Failure INT8/4 Representation Result: Functional Faulted Byte PatternWeight Corruption (Red = Faulted) Numerical Precision Impact Fig. 1. Overview of the EMFI analysis done in this paper. JOURNAL OF L A T E X CLASS FILES, VOL. 14, NO. 8, AUGUST 20213 TABLE I SUMMARY OF RELATED WORK ON FAULT INJECTION ON NEURAL NETWORK REPRESENTATIONS. Prior workAttack typeTarget model & platformWeight formatMain findings Hong et al. [9]Bit-flip attack (memory fault via Rowhammer) 19 Deep CNN classifiers; simu- lated attack 32-bit floating pointFlipping a specific single bit can cause an accuracy loss of over 90%. Rakin et al. [13]Bit-flip attack (memory fault via Rowhammer) Deep CNN classifiers; simulated attack 8/6/4-bit integerFlipping ∼13 weight bits can de- grade a network’s accuracy to∼0% (misclassification of virtually all inputs). Breier et al. [14]Fault injection for model extraction (sign-bit flips) Deep feature-extractor network; simulated attack 32/64-bitfloating point By flipping sign bits of activations, achieved < 10 −13 error in recov- ered weights, effectively stealing the DNN model. Libano et al. [15]Radiation-induced soft er- rors (fault injection & ac- celerated radiation tests) Small CNN on FPGA (MNIST digit recognition) 1-bit binary vs. 32-bit float Binary-weightnetworkshowed 39%fewererroneousoutputs underfaults,but12%more of its errors were catastrophic (misclassifications) compared to full-precision. Guillem ́ e et al. [8]Statistical fault injection (simulated bit flips) AlexNet-like CNN, software simu- lation; evaluated pruning and quan- tisation 8-bitinteger(with varyingpruning levels) Pruning increases fault sensitivity (less redundancy). Proposed selec- tive redundancy (hardware voting) improved fault tolerance by ∼96% vs. no protection. Gaine et al. [16]Electromagnetic & laser fault injection (instruction skip) CNN (2-layer ConvNet) on ARM Cortex-M4 microcontroller (em- bedded device) 8-bit integer (CMSIS- N quantized) First demonstrated EMFI/LFI on a real CNN inference: single-glitch instruction skips in convolution or activation routines caused targeted mispredictions and persistent erro- neous states. Goswami et al. [5]Electromagnetic fault in- jection (transient bit flips in NVM) TinyMLhardwareplatform withFRAMstorage;models: MobileNet, ResNet, EfficientNet on CIFAR-10 8-bit integerEM pulses during weight loading corrupted stored weights, leading to up to 40% accuracy loss in lightweight models (larger models fared better due to higher redun- dancy). This workElectromagnetic fault in- jection (transient bit flips in NVM) Embedded memory chip hosting model parameters of ResNet-18, ResNet-34, ResNet-50, VGG-11 32/16-bitfloating point, 8/4-bit integer Floating point representations de- grade significantly in accuracy, while integer ones offer more resis- tance to faults, especially for larger networks. The best trade-off is of- fered by the 8-bit integer quantiza- tion. resilience by about 96% compared to an unprotected model. On the hardware side, [16] recently demonstrated practical EMFI and laser fault attacks on a microcontroller running an 8- bit quantized CNN. They showed that even a single instruction skip fault (induced by an EM pulse or laser shot) during a forward pass can alter the network’s prediction or cause a persistent “memory effect” in the computations, highlighting the real-world feasibility of such attacks on TinyML devices. Another closely related work [5] specifically looked at EMFI on a TinyML hardware platform with INT8 weight storage. They found that small, lightweight models suffered major accuracy degradation under EMFI, whereas larger mod- els with more parameters (and presumably more redundancy) were somewhat more robust. In summary, these related studies show a growing awareness of the security implications of neural network representations. None of the existing works, however, provides a direct head- to-head comparison of different numeric formats under the same fault injection conditions and with the same models – the gap that our paper aims to fill. By comparing FP32, FP16, INT8, and INT4 in a unified experimental setup, our work builds upon the above research to provide new insights into how model precision and fault resilience are connected. I. BACKGROUND In this section, we first provide an overview of embedded neural network implementations in Subsection I-A. We then describe the number formats used for weight representations in this work in Subsection I-B. Finally, we discuss the attack goals of FIAs on neural network implementations in Subsection I-C and the physical principles underlying electromagnetic fault injection in Subsection I-D. A. Embedded and Edge Neural Network Implementations The deployment of deep learning models on edge devices, often referred to as Edge AI or TinyML [17], represents a paradigm shift from centralized cloud-based computation to on-device inference. This shift is driven by the need for low latency, improved data privacy, and reduced bandwidth consumption. However, embedded targets, ranging from con- strained microcontrollers (MCUs) to embedded GPUs, operate under strict power and memory budgets. This necessitates the JOURNAL OF L A T E X CLASS FILES, VOL. 14, NO. 8, AUGUST 20214 use of specialized software frameworks designed to support the numerical representations described in Subsection I-B. 1) TinyML and Resource Constraints: TinyML specifically targets the most resource-constrained class of devices, typi- cally based on microcontrollers (e.g., ARM Cortex-M) with limited SRAM and flash memory, and often operating in the milliwatt power range. Unlike server-grade deployments, such implementations cannot rely on massive parallelism or virtually unlimited memory. Consequently, models must be aggressively compressed and optimized before deploy- ment. In this context, the physical integrity of memory is paramount; investigating fault injection in TinyML is therefore critical, because the redundancy typically present in large, over-parameterized cloud models is often removed during the optimization process. 2) TensorFlow Lite (TFLite): TensorFlow Lite [18] is a widely adopted open-source framework for on-device infer- ence. Its deployment workflow involves converting a trained model into the efficient FlatBuffer-based .tflite format using the TFLite Converter. This conversion process performs several graph optimizations that are essential for embedded execution: • Operator fusion: combining multiple operations (e.g., convolution followed by an activation function) into a single computational kernel to reduce memory-access overhead. • Quantization-aware conversion: transforming weights from FP32 to INT8 or INT4, thereby allowing the model to run on integer-only arithmetic logic units (ALUs) commonly found in low-power MCUs. The TFLite Interpreter then executes the optimized graph. Because TFLite relies on static memory planning to minimize runtime allocation, it presents a deterministic target for elec- tromagnetic fault-injection attacks. B. Number Formats In this study, we consider two floating-point representations and two integer representations (see Table I for a summary). In the following, we briefly describe each representation; additional background can be found in [19]. 1) Floating-Point Representations: Floating-point arith- metic provides a wide dynamic range and is therefore the standard representation for training deep learning models. These formats follow the IEEE 754 standard, dividing the binary representation into three components: the sign bit (s), the exponent bits, and the fraction or mantissa (m). The exponent bits are the binary representation of the biased exponent e. a) Single Precision (FP32): FP32 is the standard format for training neural networks on general-purpose GPUs and CPUs. It uses 32 bits allocated as follows: 1 sign bit, 8 exponent bits, and 23 mantissa bits. The value v of an FP32 number is given by Equation (1): v F P32 = (−1) s × 2 e−127 × (1.m)(1) This format provides a high dynamic range (approximately ±3.4 × 10 38 ) and high precision, making it robust against vanishing gradients during training, but memory-intensive for inference on embedded targets. b) Half Precision (FP16): To reduce memory bandwidth and storage requirements, FP16 compresses the representation into 16 bits: 1 sign bit, 5 exponent bits, and 10 mantissa bits. Its value is given by Equation (2): v F P16 = (−1) s × 2 e−15 × (1.m)(2) While FP16 halves the memory footprint compared with FP32, the smaller number of exponent bits significantly shrinks the dynamic range (approximately ±6.5× 10 4 ). This makes the representation more sensitive to numerical instability, although it is often sufficient for inference in many embedded applications. 2) Quantized Integer Representations: Quantization maps continuous floating-point values to a discrete set of low- precision integer values. This is critical for embedded in- ference, because integer arithmetic units are generally faster and more energy-efficient than floating-point units. In uniform affine quantization, a real-valued quantity r is mapped to a quantized integer q using a scale factor S and a zero-point Z: q = round r S + Z(3) a) 8-bit Integer (INT8): INT8 is the prevalent quanti- zation standard for edge AI inference (e.g., TensorFlow Lite and TensorRT). It uses 8 bits to represent signed integers, typically in two’s complement notation, resulting in a range of [−128, 127]. INT8 reduces the model size by a factor of 4 compared with FP32. Because its dynamic range is limited to 256 discrete levels, INT8 typically relies on uniform affine quantization, in which floating-point weights are mapped to integers using calibrated quantization parameters S and Z to minimize accuracy degradation. b) 4-bit Integer (INT4): INT4 represents an aggressive low-bit-width format used in extreme edge scenarios or for compressing large language models (LLMs). It uses only 4 bits per weight, providing an 8× compression ratio compared with FP32, with a signed two’s complement range of [−8, 7]. However, having only 16 representable values makes this format highly sensitive to perturbations. In the context of fault injection, a single bit flip in an INT4-encoded weight can induce a large relative change in its numerical value, corresponding to a substantial fraction of the total dynamic range. TABLE I SUMMARY OF THE NUMERICAL REPRESENTATIONS CONSIDERED IN THIS WORK. FormatTotal bitsRangeDecimal digits FP3232±3.4× 10 38 ∼7 FP1616±6.55× 10 4 ∼3–4 INT88[−128, 127]Exact INT44[−8, 7]Exact C. Fault Injection Attacks on Neural Networks Fault injection attacks (FIA) were originally proposed as an active hardware attack method on cryptosystems, allowing JOURNAL OF L A T E X CLASS FILES, VOL. 14, NO. 8, AUGUST 20215 Host PC (EMFI control & model operation) ChipSHOUTER (EM pulse generator) EM injection probe Ballistic Gel board with 4MB SRAM Trigger signal EM pulse Upload weight chunks 1. Read back faulted weights 2. Run inference & log accuracy Fig. 2. Experimental electromagnetic fault injection setup overview. easy key extraction even in cases where cryptanalysis attack would have been impractical [20], [21]. FIAs on Deep Neural Networks (DNNs) represent a critical security threat where an adversary manipulates the model’s output by inducing transient or permanent errors in the underlying hardware [22]. In the context of edge AI, these attacks typically target the model weights stored in memory [13] or the activations during runtime computation [23], [24]. Such corruptions allow several different attack vectors: • Misclassification: the basic attack, referred to as “eva- sion” in the context of adversarial learning. It can either be untargeted [13] or targeted [25], meaning that the attacker either achieves a random class output or a specific class output. • Reverse engineering: also referred to as “model steal- ing/extraction.” It was shown that precisely controlled bit flips can precisely recover model parameters [14]. • Backdoor/trojan planting: in this attack, the attacker either plants the backdoor during the training [26], [27] or after the model deployment [28]. Then, a specific trigger in- serted in the network input causes the model misbehavior. Additionally, fault attacks can cause a generic denial of service attack by making the system unresponsive, but this attack vector is not specific to neural networks and can generally be achieved by simpler means in practice (e.g., by making the power source unavailable). D. Electromagnetic Fault Injection Electromagnetic fault injection (EMFI) is a non-invasive physical attack technique used to disrupt the normal execution of an integrated circuit (IC) by inducing localized transient faults [29]. Unlike contact-based methods such as clock or voltage glitching, EMFI utilizes Faraday’s Law of Induction to create internal currents without physical modification of the target package. While it can be more precise if the IC package is opened, faults can still be triggered through the package, making it one of the biggest advantages over the laser fault injection [30], along with the equipment cost [3]. The core principle of EMFI involves a high-voltage pulse generator connected to an injection probe, typically consisting of a copper coil wound around a ferrite or mu-metal core [31]. When a rapid current pulse passes through the coil, it generates a time-varying magnetic field ⃗ B(t). According to Faraday’s Law (see, for example, [32]), the electromotive force (EMF) induced in the underlying silicon circuitry is given by: E =− dΦ B dt =− d dt Z ⃗ B· d ⃗ A(4) where Φ B is the magnetic flux passing through the sensitive loops of the IC’s metal layers. This induced voltage can momentarily exceed the threshold voltages of transistors or disrupt the propagation of signals along data buses, leading to bit-flips in registers, memory cells, or instruction flow errors [4]. The efficacy of an EMFI attack is primarily governed by the rise time, pulse width, and peak voltage of the injection signal. In our setup, we utilize a high-voltage pulse generator (NewAE ChipSHOUTER) capable of generating transient pulses with a magnitude of 200-500V. Injection probes. The injection probe acts as the transducer that converts the electrical pulse into a localized magnetic field. Our study utilizes a micro-probe designed for high- precision spatial targeting. The following properties influence the success and the precision of the EMFI attack [33]: • Core material: the probe utilizes a high-permeability ferrite core. The ferrite material serves to concentrate the magnetic flux lines, minimizing far-field interference and ensuring that the fault is localized to a specific region of the SoC (e.g., the SRAM block or the instruction pipeline). • Coil topology: the probe consists of several turns (typi- cally 5–20) of fine copper wire. A lower number of turns reduces the total inductance, allowing for faster rise times, whereas a higher number of turns increases the peak magnetic field strength at the cost of temporal resolution. • Probe tip geometry: the probe tip determines the shape and the size of the electromagnetic field generated by the probe. We use a relatively large tip with a diameter of 4 m, allowing us to target multiple memory banks at the same time. To characterize the vulnerability of the target, the probe is normally mounted on a high-precision XYZ motorized stage. By automating the displacement of the probe across the surface of the IC, a “fault map” can be generated for further analysis. In our case, the mapping process was synchronized with the trigger signal of the DNN inference, ensuring that the pulse was injected during the exact window when the weights of the targeted layers were stored in the memory. JOURNAL OF L A T E X CLASS FILES, VOL. 14, NO. 8, AUGUST 20216 IV. EVALUATION METHOD In this section, we first present the experimental setup in Subsection IV-A, followed by a discussion of the surface scan results, which identify the most vulnerable region of the chip, in Subsection IV-B. The quantization configuration is detailed in Subsection IV-C. Fig. 3. NewAE ChipSHOUTER EMFI device mounted on the Ender-3 3D printer used as a positioning device. The Ballistic Gel board with the 4MB SRAM chip used as the DUT is positioned below the ChipSHOUTER. Fig. 4. Detail of the EM probe above the SRAM chip. A. Experimental Setup The components of the experimental setup and their respec- tive functions are shown in Fig. 2. The setup is centered around the NewAE ChipSHOUTER electromagnetic fault injection device 1 . A key component of the EMFI setup is the injection probe. We used a 4 m probe with counter-clockwise winding around its ferrite core (see Fig. 4 for details). Using this setup, we targeted the CW521 Ballistic Gel board, which hosts a 4 MB SRAM chip (AS6C3216A-55TIN, ALLIANCE MEMORY) fabricated in CMOS technology. In the remainder of the paper, we refer to this board as the DUT (device under test). An Ender-3 V3 SE 3D printer was repurposed as an XYZ positioning platform by replacing the printhead with a 1 https://chipwhisperer.readthedocs.io/en/latest/ChipSHOUTER/ ChipSHOUTER.html ChipSHOUTER mounted on a custom 3D-printed holder. The resulting fault-injection bench is shown in Fig. 3. The Host PC controlled the ChipSHOUTER and the positioning platform, communicated with the DUT, and handled all operations related to the neural network model. After the initial evaluation, we identified a set of fault injection parameters that reliably produced memory faults. Specifically, we used a 300 V pulse with a width of 160 ns. During each attack, a single electromagnetic pulse was in- jected. This experimental architecture reflects an in-storage fault- injection threat model, in which the adversary has physical access to the weight-storage memory before or during device boot (e.g., via proximity to external SRAM on a PCB-level device), which is an established scenario in embedded systems security [16]. Performing inference on a separate, unmodified GPU allows us to isolate the mathematical propagation of representation-level faults from confounding effects in the inference stack, such as memory interleaving, instruction-level caching, and ECC mechanisms commonly present in inte- grated SoCs. Extending this analysis to fully in-situ inference on a microcontroller is an important direction for future work, but it lies outside the scope of the present study, whose objective is the comparative characterization of sensitivity across numerical representations. B. Surface Scan To identify the probe position that most effectively induced faults, we first performed a surface scan of the chip. The AS6C3216A-55TIN is packaged in a TSOP I surface-mount package with dimensions of 12× 20 m 2 . The Z-axis was fixed at a height of 1 m above the chip surface. We used 20 sampling points along the X -axis and 40 along the Y - axis, corresponding to a step size of approximately 0.5 m and yielding a total of 800 scan points. At each point, we uploaded random bytes to fill the entire SRAM and then performed electromagnetic fault injection. After the injection, we read back the memory contents and compared them with the original data to determine the proportion of corrupted bytes, which we define as the success rate. The resulting scan is shown in Fig. 5. The most sensitive region is located around coordinate (7, 35), where the success rate reaches approximately 15%. The position of the probe above this region is shown in Fig. 4. C. Quantization Configuration All integer models were quantized using Brevitas PTQ (v0.11, Xilinx/brevitas) [34]. Post-training quantiza- tion was performed using symmetric weight quantization (weight-quant-type: sym), per-channel granularity (weight-quant-granularity: per_channel), and integer format (quant-format: int). To preserve accu- racy under aggressive 4-bit quantization, GPTQ-style opti- mization was enabled (gptq: true, gpxq_act_order: true), which explains the relatively small clean-accuracy degradation of INT4 on ImageNet (cf. Table I). JOURNAL OF L A T E X CLASS FILES, VOL. 14, NO. 8, AUGUST 20217 048121619 0 4 8 12 16 20 22 26 30 34 38 x y 0 0.02 0.04 0.06 0.08 0.1 0.12 0.14 Success rate Fig. 5. Surface scan showing the success rate at each point, expressed as the proportion of corrupted bytes in the SRAM. INT4 packing. Nibble pairs are stored in ascending ad- dress order. Integer values v 1 , v 2 , v 3 , v 4 , . . . are packed into bytes as 0xv 1 v 2 , 0xv 3 v 4 , . . . using little-endian nibble order and signed two’s complement representation over the range [−8, 7]. Consequently, a single byte-corruption event simulta- neously invalidates two adjacent 4-bit weights. V. EXPERIMENTAL RESULTS To evaluate the impact of EMFI on model integrity, we used the ImageNet-1K validation set, sub-sampled to 4, 096 images with a fixed random seed (21) to ensure reproducibil- ity. Because ImageNet-1K comprises 1, 000 classes, random guessing corresponds to an accuracy of 0.1%. Inference was performed using ONNX Runtime with CUDA acceleration on an NVIDIA RTX 4080 SUPER. Model degradation was evaluated using Top-1 and Top-5 accuracy across four weight representations: FP32, FP16, INT8, and INT4. The vanilla accuracies of all evaluated models are reported in Table I. We first characterize the injected fault pattern in Subsec- tion V-A, then quantify the floating-point-specific corruption effects in Subsection V-B. Finally, Subsection V-C reports the post-EMFI accuracy across all architectures and weight representations. A. Characterization of the EMFI Error Pattern To quantify the impact of EMFI on the target memory subsystem, we first characterized the fault effects on a linear data buffer. By applying a bitwise XOR operation between the original and post-attack data, we mapped the distribution of corrupted bits across the logical address space. As shown in Fig. 6, the faults exhibit a distinct periodic pattern. Although the map is visualized as a two-dimensional matrix to highlight recurring structures, it represents a linear TABLE I VANILLA TOP-1 AND TOP-5 ACCURACY (%) OF THE EVALUATED ARCHITECTURES ACROSS FOUR WEIGHT REPRESENTATIONS. ModelTypeTop-1 (%)Top-5 (%) ResNet18 FP3268.75088.379 FP1668.77488.379 INT868.77488.452 INT467.23687.549 ResNet34 FP3272.77890.991 FP1672.80390.967 INT872.58390.942 INT471.97390.308 ResNet50 FP3275.56292.456 FP1675.51392.481 INT875.24492.334 INT474.68391.821 VGG11 FP3268.31188.623 FP1668.33588.599 INT868.18988.648 INT468.16488.062 2 MB Mark 05121,0241,5362,048 0 512 1,024 1,536 2,048 Column offset Row offset Fig. 6. Logical memory map of EMFI effects on a 4 MB weight buffer. Red indicates corrupted memory locations. A significant decrease in fault density is observed after the 2 MB offset, suggesting either a boundary transition in the memory controller’s handling of burst data or a physical proximity limit of the EM probe. sequence of addresses rather than the physical topology of the RAM cells. A significant transition is observed at the 2 MB offset: • 0–2 MB region: a high density of periodic corruption, suggesting a specific interaction between the EM pulse and the memory controller’s burst-access logic or internal buffering. • Post-2 MB region: a sharp decline in fault density, which may indicate either a boundary in the memory allocation or a physical distance limit of the EM probe’s effective field relative to the underlying chip. This pattern proved highly deterministic and persisted across power cycles and multiple days of testing. Such repeatability suggests that the vulnerability is not a stochastic “white-noise” effect, but is instead tied to the architectural handling of data at specific logical offsets. Bit error rate. To quantify the fault density across all 352 JOURNAL OF L A T E X CLASS FILES, VOL. 14, NO. 8, AUGUST 20218 TABLE IV BIT ERROR RATE PER WEIGHT FORMAT (MEAN± STD ACROSS ALL FAULT-INJECTED CHUNKS AND ARCHITECTURES). FormatMean BER (%)Std BER (%) FP325.970.36 FP166.070.72 INT87.510.51 INT46.151.30 fault-injected chunks, we computed the bit error rate (BER) as the ratio of changed bits to the total number of bits in the 4 MB window. Table IV and Fig. 7 summarize the results. Across all models and formats, the mean BER lies within the narrow range of 5.97–7.51%, with particularly low standard deviations for FP32 (±0.36%) and INT8 (±0.51%), confirming a stable and reproducible fault pattern. Crucially, the BER is largely format-independent, with all four representations exhibiting statistically similar fault densities. This indicates that the pronounced accuracy differences reported in this section arise from the representations’ responses to the injected faults, rather than from differences in the number of faults induced. ResNet-18ResNet-34ResNet-50VGG-11 0 5 10 Bit Error Rate (%) FP32FP16INT8INT4 Fig. 7. Bit error rate (BER) per architecture and weight representation. Error bars indicate ±1 standard deviation across all fault-injected chunks. BER is largely format-independent (≈6–8% across all configurations), confirming that the observed accuracy differences stem from the representation’s response to faults rather than from differences in injected fault density. 0xFE/0xFF byte pattern. Fig. 8 shows the proportion of corrupted bytes that take the value 0xFE or 0xFF. For FP32 and FP16, this fraction is modest (≈2.9% and 1.0% of the chunk, respectively), whereas for INT8 and INT4 it is consid- erably higher (7.1% and 9.2%, respectively). Despite receiving a higher proportion of maximal-value bytes, the integer models exhibit substantially smaller accuracy losses. This asymmetry is explained by the IEEE 754 encoding: in FP32, a faulty byte value of 0xFF in the biased exponent can drive the number to NaN (Not a Number) or ±∞ regardless of the mantissa, so even a relatively small absolute number of such faulty bytes is sufficient to poison floating-point inference. In bounded integer formats, by contrast, 0xFF simply clamps the weight to its maximum representable value, which is bounded by the quantization scale and therefore cannot trigger the catastrophic cascades described in the later parts. Determinism. The fault pattern proved highly deterministic: repeated injections at the same XY position produced the same distribution of corrupted addresses across power cycles and multiple days of testing, consistent with the 2 MB bound- ary periodicity observed in Fig. 6. This repeatability confirms that the vulnerability is tied to a systematic interaction between ResNet-18ResNet-34ResNet-50VGG-11 0 5 10 15 0xFE/0xFF bytes (% of chunk) FP32FP16INT8INT4 Fig. 8. Proportion of bytes taking the value 0xFE or 0xFF per injected chunk. Although integer formats receive a higher fraction of 0xFE/0xFF bytes than floating-point formats, they exhibit far lower accuracy degradation. the EM pulse and the memory controller’s burst-access logic, rather than to a stochastic noise-floor effect. B. Floating-Point Corruption Statistics To quantify the extent of the NaN and range-explosion effects, we extracted three statistics for each floating-point chunk: the fraction of weights that became NaN, and the pre- and post-attack weight ranges. Table V and Fig. 10 summarize the results. For FP32, between 1.17% and 1.30% of weights per chunk became NaN after a single injection (mean 1.27 ± 0.32%). No ±∞ values were observed: the 0xFF exponent pattern produced by this EMFI setup generates quiet NaNs rather than infinities. For FP16, the NaN fraction is approximately 10× lower (≈0.10%), owing to the smaller number of exponent bits (5 vs. 8 bits), which reduces the probability that a random byte-set event produces the all-ones exponent pattern required to encode NaN. The weight range expands catastrophically in both formats. The mean range-expansion factor for FP32 is≈10 39 , meaning that the post-attack weight range spans essentially the full representable extent of the format, while FP16 expands by ≈10 6 . A single such extreme weight can propagate through the network’s activation functions and saturate downstream neurons, a failure mode that is structurally impossible in INT8 or INT4, where the maximum post-fault weight magnitude is bounded by the quantization scale. To further investigate the catastrophic failure of floating- point representations relative to the greater resilience of integer formats, we analyzed the weight distributions before and after EMFI. Fig. 11 illustrates the corresponding pre-attack and post-attack histograms for FP32 and INT8. Floating-point explosion. As shown in the upper part of Fig. 11, the FP32 weights originally follow a narrow Gaussian- like distribution centered around zero, typically within the range [−1, 1]. However, after a single EM pulse, the weight range expands dramatically. In FP32, corrupted weights reach extreme magnitudes exceeding ±10 30 . For example, we ob- served the weight range of a ResNet18 chunk shift from [−1.04, 0.76] to approximately [−3.4× 10 38 , 3.3× 10 38 ] post- attack. This phenomenon is primarily caused by bit flips in the exponent bits. A flip in the biased exponent changes the scale of the value significantly, producing magnitudes that JOURNAL OF L A T E X CLASS FILES, VOL. 14, NO. 8, AUGUST 20219 Address000102030405060708090A0B0C0D0E0FASCII 00000000:A470473B7D505B3B719865B63B7ABBB.pG;P[;q.e.c... 00000010:41EA18BC38E820BC8A4784BC8183763A...8. .G....v: 00000020:E3EBAE3ABE905F3B29FE993B3DFA033A...:..;)..=..: 00000030:15639CBBCF0410BC80FEA63B2672B03B.c.......;&r.; 00000040:3019713B58095C3CBC35C03CEE386A3C0.q;X.<5.C<..8j< 00000050:BA58423CB788AD3B5FDC793A7CAC2BBC.X.B<...;y:|.+ 00000060:833636BC405A75BBDB72163C641A763C.66.@Zu..r.<d.v< 00000070:1D3558B96A6CF3B4A2317B18224FBC.5X.j..;J#..."0. 00000080:BFD6EDBC32378FBCE0ACEA3A97BC563A....27.....:..V: 00000090:4F7F333CB903683C33D49D3CF578B53BO.3<..h3<..x.; 000000A0:D7BBFBBBE2F26ABB5C9E95BCEA15F1B.......j....... 000000B0:332B85B1588F3BF635043C25CDA73B3+.....;.5.<%..; 000000C0:8D53C39C6FC89B91B92A3B705B23B.S.9.......*;p[.; 000000D0:3C1F4E3C66EC483CE999243C7B990DBB<.N<f.H<..$<... 000000E0:E924E7BA3A438D3B20307E3C3C0EF43C.$..C.; 0~<<..< 000000F0:C726153DB988083DAC51E03C220C2CBC.&.=.=.Q.<",. Address000102030405060708090A0B0C0D0E0FASCII 00000000:FEFEFEFEFEFEFEFEFEFEFEFEFEFEFEFE................ 00000010:003C003C003C003C003C003C003C003C.<.<.<.<.<.<.<.< 00000020:E3EBAE3ABE905F3B29FE993B3DFA033A...:..;)..=..: 00000030:15639CBBCF0410BC80FEA63B2672B03B.c.......;&r.; 00000040:3019FEFEFEFEFEFEFEFEFEFEFEFEFEFE0............... 00000050:BA58003C003C003C003C003C003C003C.X.<.<.<.<.<.<.< 00000060:833636BC405A75BBDB72163C641A763C.66.@Zu..r.<d.v< 00000070:1D3558B96A6CF3B4A2317B18224FBC.5X.j..;J#..."0. 00000080:FEFEFEFEFEFEFEFEFEFEFEFEFEFEFEFE................ 00000090:003C003C003C003C003C003C003C003C.<.<.<.<.<.<.<.< 000000A0:D7BBFBBBE2F26ABB5C9E95BCEA15F1B.......j....... 000000B0:332B85B1588F3BF635043C25CDA73B3+.....;.5.<%..; 000000C0:FEFEFEFEFEFEFEFEFEFEFEFEFEFEFEFE................ 000000D0:003C003C003C003C003C003C003C003C.<.<.<.<.<.<.<.< 000000E0:E924E7BA3A438D3B20307E3C3C0EF43C.$..C.; 0~<<..< 000000F0:C726153DB988083DAC51E03C220C2CBC.&.=.=.Q.<",. Fig. 9. Binary comparison of a weight chunk before (left) and after (right) a single EMFI pulse. Entire rows are overwritten with 0xFE, and alternating rows take the value 0x003C, consistent with the periodic fault pattern observed in Fig. 6. In FP32, a byte of 0xFF or 0xFE in the biased exponent field drives the weight to NaN or an extremal value regardless of the mantissa. ResNet-18ResNet-34ResNet-50 VGG-11 0 0.5 1 1.5 2 NaN weights (%) FP32FP16 (a) NaN weight fraction post-attack ResNet-18ResNet-34ResNet-50 VGG-11 0 10 20 30 40 10 6 10 39 log 10 (post/pre range) FP32FP16 (b) Weight range expansion (log 10 scale) Fig. 10. Floating-point weight corruption statistics per chunk. (a) In FP32, approximately 1.3% of weights per chunk become NaN, whereas in FP16 the corresponding fraction is approximately 0.1%. (b) The post-attack weight range expands by a factor of ∼10 39 for FP32 and ∼10 6 for FP16, causing catastrophic activation saturation. No ±∞ values were observed in either format. far exceed those encountered in a normally trained network. When such extreme values are propagated into subsequent dot- product operations, they quickly induce numerical saturation and the propagation of NaNs throughout the network. This effectively “poisons” the entire inference path, resulting in the near-random accuracy observed in our experiments. Integer bounding. In contrast, the lower part of Fig. 11 demonstrates the inherent protection provided by quantization. Although the EM pulse introduces significant noise, visible as the “flattening” of the INT8 distribution, the weights remain strictly bounded by the bit-width of the representation (e.g., [−128, 127] for signed INT8). Even a “worst-case” bit flip in an integer format results only in a value clamped to the maximum representable inte- ger of that format. This prevents the exponential magnitude shifts observed in floating-point formats and ensures that a single corrupted weight cannot dominate the activation of an entire neuron or saturate subsequent layers. This mathematical bounding is the primary reason why larger models such as VGG-11, which possess a higher degree of parameter redundancy, can maintain high Top-1 accuracy despite high byte-level corruption in memory. −0.2−0.100.10.2 0.00 5.00 10.00 15.00 Weight Value Density FP32: Pre-Attack −40−2002040 0.00 0.10 0.20 0.30 0.40 log 10 (|Value|) Density FP32: Post-Attack −1000100 0.00 0.01 0.02 0.03 ×10 −2 Weight Value Density INT8: Pre-Attack −1000100 0.00 0.02 0.04 ×10 −2 Weight Value Density INT8: Post-Attack Fig. 11.Weight distribution analysis. The FP32 post-attack histogram is shown on a logarithmic x-axis, log 10 (|Value|), to visualize the “range explosion” to ±10 38 caused by EMFI. In contrast, the INT8 pre-attack and post-attack distributions remain within the representable range [−128, 127]. TABLE V FLOATING-POINT WEIGHT CORRUPTION STATISTICS (MEAN± STD ACROSS ALL FP CHUNKS). NO INF VALUES WERE OBSERVED. RANGE EXPANSION = POST-ATTACK RANGE / PRE-ATTACK RANGE. FormatNaN (%)Inf (%)Range expansion FP321.27± 0.320∼10 39 FP160.10± 0.010∼10 6 C. Sensitivity Analysis across Architectures We conducted a granular sensitivity analysis by replacing 4 MB segments of the model parameters. In total, 352 unique fault-injected models were evaluated. An overview of the results across the evaluated architectures and weight repre- sentations is provided in Fig. 12. Table VI provides a consolidated overview of the spatial sensitivity analysis for selected ResNet and VGG architec- tures. The remaining architectures were omitted because the post-attack accuracies for all attacked chunks were too low to support meaningful conclusions. Here, chunks are defined as contiguous 4 MB segments of the model’s weight tensors that JOURNAL OF L A T E X CLASS FILES, VOL. 14, NO. 8, AUGUST 202110 0% 10% 20% 30% 40% 50% 60% 70% 80% 90% ResNet18ResNet34ResNet50VGG11 Accuracy Top-1 Accuracies Top-5 Accuracies (a) 0% 10% 20% 30% 40% 50% 60% 70% 80% 90% ResNet18ResNet34ResNet50VGG11 (b) 0% 10% 20% 30% 40% 50% 60% 70% 80% 90% ResNet18ResNet34ResNet50VGG11 Accuracy (c) 0% 10% 20% 30% 40% 50% 60% 70% 80% 90% ResNet18ResNet34ResNet50VGG11 (d) Fig. 12. Classification accuracy under fault injection for ResNet-18, ResNet-34, ResNet-50, and VGG-11. Each marker corresponds to the Top-1 (blue) or Top-5 (red) accuracy obtained after injecting faults into a specific chunk of the model’s weight parameters. Results are reported for four weight representations: (a) FP32, (b) FP16, (c) INT8, and (d) INT4. were individually replaced during the fault-injection experi- ments to isolate local vulnerabilities. The table summarizes the total number of chunks for each model and data-type configuration, together with the resulting Top-1 accuracy when targeting specific spatial regions: the Front (initial layers), the Middle (intermediate layers), and the Back (final layers or fully connected layers). 1) ResNet Analysis: The ResNet architectures (ResNet18, ResNet34, and ResNet50) exhibited extreme sensitivity to EMFI when using floating-point representations. The following observations can be made: • Floating-point (FP32/FP16): In all tested cases, the Top- 1 and Top-5 accuracies dropped close to the random- guess level, indicating a complete collapse of the models’ predictive capability (Fig. 12(a), (b)). • Integer (INT8/INT4): Although these models suffered substantial accuracy degradation, they did not collapse to the random-guess level in all cases (Fig. 12(c), (d)). • Spatial sensitivity: We observed a “front-heavy” sensi- tivity profile for the networks listed in Table VI. Faults injected into the initial convolutional layers resulted in severe accuracy degradation, whereas layers toward the end of the network (e.g., fully connected layers) exhibited greater resilience. TABLE VI CONSOLIDATED SPATIAL SENSITIVITY: TARGETED CHUNK ACCURACY (TOP-1 %). FRONT/MIDDLE/BACK DENOTE THE PART OF THE NETWORK IN WHICH THE ATTACK OCCURRED. TARGETING CHUNKS AT THE BEGINNING OF THE NETWORK (FRONT) CONSISTENTLY LEADS TO COMPLETE ACCURACY DEGRADATION. ModelType# ChunksFrontMiddleBack ResNet18INT830.07%0.68%6.37% ResNet34INT860.10%0.12%53.05% ResNet50INT870.15%5.20%49.10% ResNet50INT440.12%0.17%22.19% VGG11FP321270.05%0.05%0.12% VGG11FP16640.05%0.05%62.84% VGG11INT8320.15%68.14%54.13% VGG11INT4160.07%65.03%20.21% 2) VGG Analysis: The VGG architecture exhibited failure modes distinct from those of ResNet. While the FP32 models collapsed to near-random-guess accuracy, the FP16 VGG variants showed localized resilience; for example, replacing the final 1.4 MB chunk resulted in a Top-1 accuracy of approximately 63% (Table VI). Furthermore, the INT8- and INT4-quantized VGG models displayed a bimodal sensitivity profile: attacking the first and last layers caused substantial accuracy degradation, whereas attacking the middle layers preserved accuracy at the vanilla JOURNAL OF L A T E X CLASS FILES, VOL. 14, NO. 8, AUGUST 202111 level. The accuracy loss was therefore primarily localized to the replacement of the first and last parameter chunks, while the intermediate layers remained largely unaffected and maintained performance near the pre-attack baseline. To summarize, the results suggest that INT8 quantization offers the best balance between inference accuracy and EMFI resilience for edge deployments. Beyond reducing memory footprint, the bounded nature of integer arithmetic provides an inherent form of “numerical masking” against the high- magnitude bit flips typical of EMFI attacks. The underlying mechanisms are examined further in Section VI. VI. DISCUSSION Number representations and fault tolerance. As dis- cussed in the previous section, the difference in fault re- silience between floating-point and integer representations is not merely a matter of bit-width, but is fundamentally rooted in the dynamic range and non-linear mapping of the IEEE 754 floating-point standard, in contrast to the constant-resolution scaling used in integer representations. In addition, a phe- nomenon of activation-function saturation arises in floating- point models: • In FP32, a post-attack weight of 10 38 produces an activa- tion value so large that it either causes numerical overflow in the next layer or permanently “saturates” the neuron. • In quantized networks, weights and activations are typi- cally clipped or normalized. Even if a weight is flipped to its maximum integer value, the scaling factors used in INT8/4 quantization act as a natural shock absorber, preventing a single bit flip from dominating the entire feature map. Embedded memory limit. One potential limitation of our experimental platform is its 4 MB memory capacity, which is modest compared with that of contemporary high-performance AI accelerators. However, this choice was deliberate and aligned with the objectives of the present study. Our goal is not to evaluate absolute fault rates in highly optimized systems, but rather to characterize and compare the intrinsic sensitivity of different numerical representations used for neural network weights. Highly integrated SoCs typically employ memory interleav- ing, redundancy, and hardware-level error-correction mecha- nisms, which introduce confounding factors that can obscure the direct relationship between injected faults and their al- gorithmic impact. By using a linear, non-interleaved memory architecture without error-correction codes, we are able to isolate the mathematical propagation of memory faults within the network and to study representation-dependent effects in a controlled and reproducible manner. Moreover, this memory scale is representative of the emerg- ing Micro-AI and edge-inference domain, in which resource- constrained microcontrollers deploy neural networks in safety- and security-critical applications. In this context, understand- ing the fundamental resilience of numerical representations is particularly relevant. Extending this analysis to large-scale accelerators with complex memory hierarchies is an important direction for future work; however, such platforms would primarily affect the fault-injection surface rather than the representation-level vulnerability analyzed in this paper. VGG-11 middle-layer resilience. The bimodal sensitivity of VGG-11 INT8, in which attacking the middle chunks leaves the accuracy near the baseline whereas attacking the first or last chunks causes substantial degradation, can be explained by the geometry of the large fully connected layer FC6 (shape 4096× 25088), which occupies approximately 98 MB in INT8 and approximately 49 MB in INT4, as illustrated in Fig. 13. A single 4 MB fault window covers approximately 4/98 ≈ 4% of the bytes of FC6; at the observed byte-corruption rate of approximately 15%, the effective fraction of FC6 weights modified per injection is only approximately 0.6%. Given the high parametric redundancy of a∼100 M-parameter layer, this localized perturbation is insufficient to meaningfully shift the network’s output distribution. In contrast, the early convo- lutional layers (conv1–conv3) are both parameter-sparse and computationally critical: a 4 MB fault window covers their full weight tensors, and corruption of even a small fraction of first- layer filters destroys the intermediate feature representations on which all subsequent layers depend. Countermeasures. Countermeasures against fault injection attacks are a well-studied topic in cryptography [35]. Some of these methods can be directly applied to protect embedded neural networks, such as detection circuits [36], [37] and error-correcting or error-detecting codes [38]–[40]. In addition, several methods have been developed specifically to protect deep learning systems; we summarize the most prominent approaches below. DeepDyve [41] uses small pre-trained neural networks to verify the outputs of the main model. RADAR [42] stores a 2-bit checksum for each group of weights in memory during deployment and checks the integrity of the weights at runtime. For ResNet-18, it achieves a detection rate of 96.1% with approximately 1% computational overhead and 5.6 KB of memory overhead. HASHTAG [43] also focuses on detection, but uses cryptographic hashing instead of simple checksums. ALERT [44] monitors and detects abnormal neuron activation patterns caused by faults. When such anomalies are detected, ALERT activates a recovery mechanism to mitigate the impact of the attack. VII. CONCLUSION In this work, we presented a comprehensive empirical anal- ysis of EMFI on embedded neural networks, investigating how different numerical weight representations influence model resilience against such attacks. Beyond measuring post-attack accuracy, we characterized the injected fault pattern itself, showing that the bit error rate is largely format-independent across all tested configurations. This finding establishes that the pronounced differences in resilience stem from how each representation responds to faults rather than from differences in fault density. In partic- ular, the asymmetry between the 0xFE/0xFF byte fractions received by floating-point and integer formats, where integer models absorb a higher proportion of maximal-value bytes yet JOURNAL OF L A T E X CLASS FILES, VOL. 14, NO. 8, AUGUST 202112 64 224 conv1 128 112 conv2 256 56 conv3 512 28 conv4 512 14 conv5 4096 1 fc6 4096 1 fc7 1000 1 fc8 Fig. 13. VGG-11 architecture, illustrating the contrast between the shapes of the convolutional and fully connected layers. suffer far less accuracy degradation, directly exposes the role of the IEEE 754 exponent encoding as the primary failure mechanism. We showed that the numerical representation of weights is consequently a significant factor in model resilience: floating- point models suffer from catastrophic accuracy degradation due to NaN propagation and exponent bit flips, whereas quantized models provide an inherent form of protection through numerical clipping. Among the formats studied, INT8 offers the most favorable trade-off between inference accuracy, memory footprint, and EMFI resilience for edge deployments. As a future direction, it would be worthwhile to investigate training-phase approaches for improving fault resistance. Al- though INT8 provides passive protection, new quantization- aware training schemes could be developed to specifically minimize the bit-error sensitivity of the most influential weight bits. Extending the analysis to in-situ inference on a micro- controller would also allow the representation-level findings reported here to be validated under realistic deployment con- ditions. Acknowledgement: OpenAI ChatGPT, Google Gemini, and Anthropic Claude LLMs were used to improve clarity and readability of some portions of this manuscript. REFERENCES [1] J. Lin, L. Zhu, W.-M. Chen, W.-C. Wang, and S. Han, “Tiny machine learning: Progress and futures [feature],” IEEE Circuits and Systems Magazine, vol. 23, no. 3, p. 8–34, 2023. [2] T. Liang, J. Glossner, L. Wang, S. Shi, and X. Zhang, “Pruning and quantization for deep neural network acceleration: A survey,” Neuro- computing, vol. 461, p. 370–403, 2021. [3] J. Breier and X. Hou, “How practical are fault injection attacks, really?” IEEE Access, vol. 10, p. 113 122–113 130, 2022. [4] M. Dumont, M. Lisart, and P. Maurine, “Electromagnetic fault injection: How faults occur,” in 2019 Workshop on Fault Diagnosis and Tolerance in Cryptography (FDTC). IEEE, 2019, p. 9–16. [5] B. Goswami, R. Chetry, C. Moorthii, and M. Suri, “Investigation of em fault injection on emerging lightweight neural network hardware,” in Applied Cryptography and Network Security Workshops (ACNS). Springer, 2025, p. 113–123. [6] S. Hashemi, N. Anthony, H. Tann, R. I. Bahar, and S. Reda, “Under- standing the impact of precision quantization on the accuracy and energy of neural networks,” in Design, Automation & Test in Europe Conference & Exhibition (DATE), 2017. IEEE, 2017, p. 1474–1479. [7] M. Nagel, M. Fournarakis, R. A. Amjad, Y. Bondarenko, M. Van Baalen, and T. Blankevoort, “A white paper on neural network quantization,” arXiv preprint arXiv:2106.08295, 2021. [8] W. Guillem ́ e, A. Kritikakou, Y. Helen, C. Killian, and D. Chillet, “Fault tolerance in quantized and pruned convolutional neural networks,” in IEEE International Symposium on On-Line Testing and Robust System Design (IOLTS), 2025, p. 1–7. [9] S. Hong, P. Frigo, Y. Kaya, C. Giuffrida, and T. Dumitras , , “Termi- nal brain damage: Exposing the graceless degradation in deep neural networks under hardware fault attacks,” in 28th USENIX Security Symposium (USENIX Security 19), 2019, p. 497–514. [10] K. He, X. Zhang, S. Ren, and J. Sun, “Deep residual learning for image recognition,” in Proceedings of the IEEE conference on computer vision and pattern recognition (CVPR), 2016, p. 770–778. [11] K. Simonyan and A. Zisserman, “Very deep convolutional networks for large-scale image recognition,” arXiv preprint arXiv:1409.1556, 2014. [12] J. Deng, W. Dong, R. Socher, L.-J. Li, K. Li, and L. Fei-Fei, “Imagenet: A large-scale hierarchical image database,” in 2009 IEEE conference on computer vision and pattern recognition. Ieee, 2009, p. 248–255. [13] A. S. Rakin, Z. He, and D. Fan, “Bit-flip attack: Crushing neural network with progressive bit search,” in Proceedings of the IEEE/CVF International Conference on Computer Vision, 2019, p. 1211–1220. [14] J. Breier, D. Jap, X. Hou, S. Bhasin, and Y. Liu, “Sniff: Reverse engineering of neural networks with fault attacks,” IEEE Transactions on Reliability, vol. P, no. 99, p. 1–13, 2021. [15] F. Libano, B. Wilson, M. Wirthlin, P. Rech, and J. Brunhaver, “Un- derstanding the impact of quantization, accuracy, and radiation on the reliability of convolutional neural networks on fpgas,” IEEE Transac- tions on Nuclear Science, vol. 67, no. 7, p. 1402–1410, 2020. [16] C. Gaine, P.-A. Moellic, O. Potin, and J.-M. Dutertre, “Fault injection on embedded neural networks: Impact of a single instruction skip,” in 2023 26th Euromicro Conference on Digital System Design (DSD).IEEE, 2023, p. 317–324. [17] N. N. Alajlan and D. M. Ibrahim, “Tinyml: Enabling of inference deep learning models on ultra-low-power iot edge devices for ai applications,” Micromachines, vol. 13, no. 6, p. 851, 2022. [18] R. David, J. Duke, A. Jain, V. Janapa Reddi, N. Jeffries, J. Li, N. Kreeger, I. Nappier, M. Natraj, T. Wang et al., “Tensorflow lite micro: Embedded machine learning for tinyml systems,” Proceedings of machine learning and systems, vol. 3, p. 800–811, 2021. [19] B. Parhami, Computer arithmetic.Oxford university press Oxford, 1999, vol. 20, no. 00. [20] D. Boneh, R. A. DeMillo, and R. J. Lipton, “On the importance of checking cryptographic protocols for faults,” in Advances in Cryptol- ogy—EUROCRYPT’97: International Conference on the Theory and Application of Cryptographic Techniques Konstanz, Germany, May 11– 15, 1997 Proceedings. Springer, 1997, p. 37–51. [21] J. Breier, X. Hou, and S. Bhasin, Automated Methods in Cryptographic Fault Analysis. Springer, 2019. [22] Y. Liu et al., “Fault injection attacks on deep neural networks: Lessons learned,” in Design Automation Conference (DAC), 2017. [23] X. Hou, J. Breier, D. Jap, L. Ma, S. Bhasin, and Y. Liu, “Physical security of deep learning on edge devices: Comprehensive evaluation of fault injection attack vectors,” Microelectronics Reliability, vol. 120, p. 114116, 2021. JOURNAL OF L A T E X CLASS FILES, VOL. 14, NO. 8, AUGUST 202113 [24] J. Breier, X. Hou, D. Jap, L. Ma, S. Bhasin, and Y. Liu, “Practical fault attack on deep neural networks,” in Proceedings of the 2018 ACM SIGSAC Conference on Computer and Communications Security, 2018, p. 2204–2206. [25] A. S. Rakin, Z. He, J. Li, F. Yao, C. Chakrabarti, and D. Fan, “T- bfa: Targeted bit-flip adversarial weight attack,” IEEE Transactions on Pattern Analysis and Machine Intelligence, vol. 44, no. 11, p. 7928– 7939, 2021. [26] J. Breier, X. Hou, M. Ochoa, and J. Solano, “Foobar: Fault fooling backdoor attack on neural network training,” IEEE Transactions on Dependable and Secure Computing, vol. 20, no. 3, p. 1895–1908, 2022. [27] C. Mart ́ ınez-Mej ́ ıa, J. Solano, J. Breier, D. Bucko, and X. Hou, “Deep- bar: Fault backdoor attack on deep neural network layers,” arXiv preprint arXiv:2407.21220, 2024. [28] A. S. Rakin, Z. He, and D. Fan, “Tbt: Targeted neural network attack with bit trojan,” in Proceedings of the IEEE/CVF conference on computer vision and pattern recognition, 2020, p. 13 198–13 207. [29] S. Habibi and et al., “Emfi: Electromagnetic fault injection on micro- controllers,” in International Conference on Security and Cryptography (SECRYPT), 2021. [30] J. Breier and D. Jap, “Testing feasibility of back-side laser fault injection on a microcontroller,” in Proceedings of the WESS’15: Workshop on Embedded Systems Security, 2015, p. 1–6. [31] X. Hou and J. Breier, Cryptography and Embedded Systems Security. Springer, 2024. [32] K. Kuehn, “Faraday’s law,” in A Student’s Guide Through the Great Physics Texts: Volume I: Electricity, Magnetism and Light. Springer, 2015, p. 331–344. [33] C. Gaine, J.-P. Nikolovski, D. Aboulkassimi, and J.-M. Dutertre, “New probe design for hardware characterization by electromagnetic fault injection,” in 2022 International Symposium on Electromagnetic Compatibility–EMC Europe. IEEE, 2022, p. 299–304. [34] G. Franco, A. Pappalardo, and N. J. Fraser, “Xilinx/brevitas,” 2025. [Online]. Available: https://doi.org/10.5281/zenodo.3333552 [35] A. Baksi, S. Bhasin, J. Breier, D. Jap, and D. Saha, “A survey on fault attacks on symmetric key cryptosystems,” ACM Computing Surveys, vol. 55, no. 4, p. 1–34, 2022. [36] L. Zussa, A. Dehbaoui, K. Tobich, J.-M. Dutertre, P. Maurine, L. Guillaume-Sage, J. Clediere, and A. Tria, “Efficiency of a glitch detector against electromagnetic fault injection,” in 2014 Design, Au- tomation & Test in Europe Conference & Exhibition (DATE).IEEE, 2014, p. 1–6. [37] J. Breier, S. Bhasin, and W. He, “An electromagnetic fault injection sen- sor using hogge phase-detector,” in 2017 18th International Symposium on Quality Electronic Design (ISQED). IEEE, 2017, p. 307–312. [38] X. Guo and R. Karri, “Recomputing with permuted operands: A concur- rent error detection approach,” IEEE Transactions on Computer-Aided Design of Integrated Circuits and Systems, vol. 32, no. 10, p. 1595– 1608, 2013. [39] J. Breier, X. Hou, and Y. Liu, “On evaluating fault resilient encoding schemes in software,” IEEE Transactions on Dependable and Secure Computing, vol. 18, no. 3, p. 1065–1079, 2019. [40] J. Breier, M. Khairallah, X. Hou, and Y. Liu, “A countermeasure against statistical ineffective fault analysis,” IEEE Transactions on Circuits and Systems I: Express Briefs, vol. 67, no. 12, p. 3322–3326, 2020. [41] Y. Li, M. Li, B. Luo, Y. Tian, and Q. Xu, “DeepDyve: Dynamic verification for deep neural networks,” in Proceedings of the 2020 ACM SIGSAC Conference on Computer and Communications Security, 2020, p. 101–112. [42] J. Li, A. S. Rakin, Z. He, D. Fan, and C. Chakrabarti, “Radar: Run- time adversarial weight attack detection and accuracy recovery,” in 2021 Design, Automation & Test in Europe Conference & Exhibition (DATE). IEEE, 2021, p. 790–795. [43] M. Javaheripi and F. Koushanfar, “Hashtag: Hash signatures for online detection of fault-injection attacks on deep neural networks,” in 2021 IEEE/ACM International Conference On Computer Aided Design (IC- CAD). IEEE, 2021, p. 1–9. [44] X. Wei, X. Wang, Y. Yan, N. Jiang, and H. Yue, “Alert: A lightweight defense mechanism for enhancing dnn robustness against t-bfa,” Journal of Systems Architecture, vol. 152, p. 103160, 2024.