Paper deep dive
TreeFI: Value-Aware Statistical Fault Injection for Deep Neural Networks
Noam Bires, Marcello Traiola, Angeliki Kritikakou, Elisa Fromont
Intelligence
Status: succeeded | Model: Gemma-4-26B-A4B | Prompt: intel-v1 | Confidence: 90%
Last extracted: 9/7/2026, 7:10:01 AM
Summary
The paper introduces TreeFI, a value-aware statistical fault injection (SFI) methodology for evaluating the reliability of Deep Neural Networks (DNNs) against single-bit faults in FP32 activations and weights. Unlike existing SFI approaches, TreeFI exploits the property that bit-flip effects depend strongly on the corrupted value. It partitions value distributions into intervals with similar bit-flip behaviors using regression trees and allocates injection budgets via stratified sampling based on interval frequency and risk. Validated on CNNs (ResNet8, RepVGG-A0) and Transformers (DeiT) using CIFAR-10 and ImageNet, TreeFI reduces the required injection budget by up to 72.1x compared to state-of-the-art baselines while maintaining statistical accuracy.
Entities (10)
Relation Signals (8)
TreeFI → reduces → injection budget
confidence 95% · TreeFI reduces the required injection budget by up to 72.1x
TreeFI → uses → Regression Trees
confidence 95% · TreeFI partitions each layer's value distribution into intervals with similar expected bit-flip behavior, learned using regression trees
DeiT → testedon → ImageNet
confidence 90% · We then study the scalability... using... ImageNet, with different Transformer architectures, such as DeiT...
ResNet8 → testedon → CIFAR-10
confidence 90% · We first evaluate the proposed methodology on two Convolutional Neural Network (CNN) architectures: ResNet8... on the CIFAR-10 dataset.
TreeFI → validateson → ResNet8
confidence 90% · On ResNet8, where exhaustive activation fault injection is feasible, TreeFI provides more accurate estimates
TreeFI → validateson → CIFAR-10
confidence 90% · We validate TreeFI on CNN and Transformer models using CIFAR-10 and ImageNet.
TreeFI → outperforms → SFI
confidence 85% · TreeFI provides more accurate estimates than state-of-the-art statistical FI baselines... TreeFI reduces the required injection budget by up to 72.1x compared to the data-aware one-shot SFI.
TreeFI → outperforms →
Cypher Suggestions (0)
No Cypher suggestions yet.
Abstract
Abstract:Reliability evaluation of deep neural networks under hardware faults commonly relies on fault injection, but exhaustive campaigns are intractable for modern models and datasets. Statistical fault injection reduces this cost, yet existing approaches still require large injection budgets because they do not explicitly exploit a key property of floating-point faults: the effect of a bit flip depends strongly on the value being corrupted. We propose TreeFI, a value-aware statistical fault-injection methodology for FP32 single-bit faults in DNN activations and weights. TreeFI partitions each layer's value distribution into intervals with similar expected bit-flip behavior, learned using regression trees, and allocates injections across these intervals according to their relevance for failure-rate estimation. This stratified allocation preserves the target confidence and error margin while avoiding unnecessary injections in low-impact regions of the fault space. We validate TreeFI on CNN and Transformer models using CIFAR-10 and ImageNet. On ResNet8, where exhaustive activation fault injection is feasible, TreeFI provides more accurate estimates than state-of-the-art statistical FI baselines under the same campaign setting. Across the evaluated models, TreeFI reduces the required injection budget by up to 72.1x, with average reductions of 44.9x for activation faults and 11.2x for the executed weight campaigns.
Tags
Links
- Source: https://arxiv.org/abs/2609.04912v1
- Canonical: https://arxiv.org/abs/2609.04912v1
Trouble viewing inline? Open PDF directly →
Full Text
54,008 characters extracted from source content.
Expand or collapse full text
TreeFI: Value-Aware Statistical Fault Injection for Deep Neural Networks ∗ Noam Bires noam.bires@inria.fr Univ Rennes, Inria, IRISA, CNRS, Rennes, France Marcello Traiola marcello.traiola@inria.fr Univ Rennes, Inria, IRISA, CNRS, Rennes, France Angeliki Kritikakou angeliki.kritikakou@inria.fr Univ Rennes, Inria, IRISA, CNRS, Rennes, France Elisa Fromont elisa.fromont@irisa.fr Univ Rennes, Inria, IRISA, CNRS, Rennes, France Abstract Reliability evaluation of deep neural networks under hardware faults commonly relies on fault injection, but exhaustive campaigns are intractable for modern models and datasets. Statistical fault injection reduces this cost, yet existing approaches still require large injection budgets because they do not explicitly exploit a key property of floating-point faults: the effect of a bit flip depends strongly on the value being corrupted. We propose TreeFI, a value-aware statistical fault-injection methodology for FP32 single-bit faults in DNN activations and weights. TreeFI partitions each layer’s value distribution into inter- vals with similar expected bit-flip behavior, learned using regression trees, and allocates injections across these intervals according to their relevance for failure-rate estimation. This stratified allocation preserves the target confidence and error margin while avoiding unnecessary injections in low-impact regions of the fault space. We validate TreeFI on CNN and Transformer models using CIFAR-10 and ImageNet. On ResNet8, where exhaustive activa- tion fault injection is feasible, TreeFI provides more accurate esti- mates than state-of-the-art statistical FI baselines under the same campaign setting. Across the evaluated models, TreeFI reduces the required injection budget by up to 72.1×, with average reductions of 44.9×for activation faults and 11.2×for the executed weight campaigns. Keywords: Statistical fault injection, Deep neural networks, Relia- bility assessment, Soft errors 1 Introduction Deep Neural Networks (DNNs) are increasingly deployed in safety- and mission-critical systems, where dependability is as important as predictive performance. In these domains, transient hardware faults, such as soft errors induced by radiation or electrical noise, may cause bit flips that silently corrupt intermediate computations and alter the final prediction, affecting the system’s correctness. As- sessing the impact of such faults is therefore necessary to evaluate the reliability of the system [1–5]. Because the effects of these faults depend on where and when they occur, reliability evaluation typically relies on fault injection (FI), which emulates faults during execution and observes their impact on the model output [3, 4]. However, exhaustive FI rapidly becomes impractical for modern model architectures and datasets, because it requires exploring a massive space of injection loca- tions within the model, bit positions, and inputs. To address this challenge, Statistical Fault Injection (SFI) approaches have been proposed to reduce the cost of FI, while still providing statistically meaningful reliability estimates [6–8]. These approaches signifi- cantly improve scalability compared with exhaustive campaigns ∗ « https://gitlab.inria.fr/nbires/treefi and currently represent the state-of-the-art for efficient FI evalu- ation of neural networks [7, 8]. Despite these advances, current SFI approaches still neglect an important source of variation in the fault space: the effect of a bit flip strongly depends on the value being corrupted. This is particularly important when the values in a DNN layer span a wide range. For a specific bit position, the original value determines both whether this bit is 0 or 1 and how much the value changes when this bit is flipped. As a result, two injections targeting the same bit position can have very different effects depending on the stored value. However, existing SFI meth- ods do not systematically exploit this behavior, leaving room for further reductions in the number of required injections. To address this gap, this paper proposesTreeFI, a value-aware statistical fault injection methodology for evaluating DNN reliabil- ity. The key idea is simple: bit flips do not have the same impact for all values, so TreeFI first groups layer values into ranges that behave similarly under bit flips. It then allocates more injections to the value ranges that matter most for estimating the failure rate, while still targeting a user-specified confidence and error margin. To do so, TreeFI learns value ranges for each layer and bit position using regression trees, and then derives a stratified sampling strategy that requires substantially fewer injections than state-of-the-art SFI approaches. This work adopts the single-bit fault model commonly used in statistical fault injection studies of deep neural networks (DNNs) [7, 8], where faults are represented as independent bit cor- ruptions under the single-fault assumption. The objective of this work is not to evaluate the realism of the fault model, but to reduce the number of injections required to achieve a target statisti- cal accuracy given a predefined fault population. Software-level single-bit injections are therefore used solely to define a fully char- acterizable reference population, enabling rigorous validation and comparison of the proposed statistical acceleration method. Al- though real hardware faults may produce multi-bit errors or exhibit temporal and spatial correlations, accurately modeling such effects requires detailed low-level hardware characterization and is beyond the scope of this study. We evaluate TreeFI using software FI, in line with prior SFI litera- ture, and compare it against state-of-the-art data-aware one-shot [7] and iterative Statistical FI [8] approaches. We first evaluate the pro- posed methodology on two Convolutional Neural Network (CNN) architectures: ResNet8 [9] and RepVGG-A0 [10] on the CIFAR- 10 [11] dataset. To establish a ground-truth reference, we perform an exhaustive FI campaign for ResNet8 activations on 5,000 inputs and use it to evaluate the quality of the resulting reliability esti- mates. We then study the scalability of the proposed methodology using a much larger dataset, i.e., ImageNet [12], with different Trans- former architectures, such as DeiT-Tiny/Small/Base [13]. Overall, the results show that TreeFI achieves up to a 72.1×reduction in injections compared to the data-aware one-shot SFI. Moreover, on arXiv:2609.04912v1 [cs.AR] 4 Sep 2026 Noam Bires, Marcello Traiola, Angeliki Kritikakou, and Elisa Fromont the ResNet8 benchmark, where exhaustive ground-truth FI is pos- sible, TreeFI yields lower estimation error in a single statistical FI campaign than the data-aware one-shot SFI. In summary, the main contributions of this work are: •a value-aware SFI methodology that exploits the dependence of bit-flip effects on the corrupted value; • a per-layer, per-bit partitioning of value ranges into intervals with similar bit-flip behavior, learned using a regression tree; • a stratified sampling strategy that targets a desired confidence level and error margin, and reduces the required injections; • a thorough experimental evaluation that validates TreeFI against exhaustive FI (ResNet8), compares it with two state-of-the-art sta- tistical FI baselines, and includes a hyperparameter ablation study. 2 Background and related work Deep neural network reliability has been studied across multiple abstraction levels, from software-implemented fault injection to hardware-level simulation and radiation-based experiments. Re- cent surveys organize this literature according to the goal of the work (reliability assessment versus hardening), the abstraction level of the analysis, the target platform, and the adopted fault model [1–5]. Radiation-based fault injection experiments provide high realism, but they require access to dedicated irradiation facilities and the target device, which makes them costly and less flexible to repeat. RTL- or architecture-level fault injection can capture hardware details more faithfully, but it depends on the availability of low-level hardware models and is typically much more expensive to run. By contrast, software-implemented fault injection, while less accurate, is hardware-agnostic and can be applied early in the development cycle, before the final accelerator or detailed RTL model is available. This makes it a practical setting for studying faults in weights, activations, and intermediate computations while keeping the experimental campaign manageable. A handful of soft- ware frameworks support this style of analysis, including Ares [14], TensorFI [15], PyTorchFI [16], and MRFI [17]. To reduce the computational cost of fault-injection campaigns, statistical fault injection (SFI) techniques are widely used. Instead of exhaustively injecting all possible faults, SFI injects only a carefully selected subset and uses classical sampling theory to estimate the behavior of the full fault population under a desired confidence level and error margin [6, 18]. In the DNN setting, these methods aim to make reliability analysis scalable while remaining consistent with exhaustive FI under the same fault model [7, 8]. In practice, they organize the statistical process at the layer and bit level, and determine how many injections are needed for each layer–bit pair. State-of-the-art methods in this line include the data-aware one- shot method [7] (SFI) and the later iterative method [8] (IFI).SFI reduces the number of injections through proxy-guided allocation, but it was originally proposed for weight fault injection and is less favorable on activation faults, where the value distribution is more heterogeneous and input-dependent.IFIupdates the campaign using intermediate FI results, but this comes with two practical limitations: it can spend many injections in early iterations on bits that ultimately have little or no impact, and its iterative nature makes the total runtime difficult to predict in advance. TreeFI follows this statistical-FI line, but introduces an additional source of structure that these methods do not explicitly exploit: the dependence of fault effects on the corrupted value. It parti- tions the value space into intervals with similar bit-flip behavior and allocates more injections to the intervals that matter most for the failure rate estimation. In this way, TreeFI further reduces the number of required injections, while keeping the advantages of one-shot, upfront-budgeted campaigns. Our approach is validated using software fault injection, in line with state-of-the-art methods. Other approaches reduce the cost of FI through techniques that are complementary to statistical fault injection. Some works tar- get critical-bit or parameter identification, for example through binary-search-like fault localization [19], bit-level sensitivity analy- sis [20], Hessian-guided ranking combined with adaptive FI [21], or machine-learning-guided ranking of vulnerable components [22, 23]. These methods aim to identify the most sensitive parts of the model and focus the campaign on them, rather than estimating the full failure rate under an explicit confidence/error target. Other approaches replace or accelerate FI through analytical or hybrid modeling, such as semi-analytical vulnerability estimation [24] or cross-layer simulation [25, 26], where only the most hardware- critical parts are simulated at low level while the rest of the system is evaluated at a higher level of abstraction. TreeFI is complemen- tary to these directions: rather than replacing FI with analytical approximations or prioritizing only the most critical components, it improves fault-sampling efficiency in statistical FI by explicitly leveraging value dependence. Other studies have shown that resilience depends strongly on numerical format and value range, but they use this observation for protection rather than vulnerability assessment. These works include format-aware resilience analysis [27], value-range con- straining techniques such as numerical-range squeezing [28], and reliability-oriented training methods based on trainable activation shaping or transient-fault-aware optimization [29, 30]. By contrast, our focus is not to harden the model, but to evaluate its vulnerability more efficiently under a statistical FI methodology. 3 TreeFI: Value-aware statistical fault injection 3.1 Motivation A key limitation of existing statistical fault injection methods is that they do not explicitly organize the fault sampling campaign by value range. In practice, however, the impact of a bit flip depends not only on the bit position but also on the original numerical value. This dependence is especially pronounced for floating-point data, where flipping the same bit can produce very different perturba- tions depending on the value being corrupted. Figure 2 illustrates this effect on a representative ResNet8 activation layer. Each plot is based on 65,536 single-bit fault injections. In both plots, the x-axis represents the original activation value, and the y-axis represents the model accuracy after flipping bit 30 (top graph) or bit 27 (bot- tom graph) of that activation. The two subplots correspond to two different bit positions, but the main message is the same in both cases: for a given bit position, the effect of the bit flip is not uniform, but depends on the original value before the flip. As shown in the figure, for some activation ranges, flipping the bit has little or no visible effect on model accuracy, whereas in other ranges the same bit causes a strong drop in accuracy. Therefore, two fault injections targeting the same layer and the same bit position can still produce very different outcomes because the corrupted values belong to TreeFI: Value-Aware Statistical Fault Injection for Deep Neural Networks (a) Value Distribution Analysis Log Value Histogram Collect Activation / Weight Distributions (b) Learning Value Intervals High Risk Med Risk High Risk Low Risk (1)(2)(3)(4) Train Regression Trees (c) Interval Frequency Analysis (1) (2) (3) (4) Layer Values Frequency Analyze Interval Frequency for each Risk Type (d) Stratified Fault Injection (1) (2) (3) (4) More samples for frequent and uncertain intervals. Budget by Frequency & Uncertainty (e) Aggregating the Outcomes DNN Model Inferences Fault- Free Run ✓ Fault- Injected Run × Compare Outputs Failure Rate Low High Top-1 Change Rate Failure Rate Estimation Figure 1. Overview of the TreeFI Value-Aware Fault Injection Method. different value ranges. The same value-dependent behavior is also observed for weight faults, although Figure 2 focuses on activations. This observation motivates our approach. If the fault effect de- pends strongly on the corrupted value, then a sampling strategy that does not explicitly distinguish between value ranges is inef- ficient. TreeFI’s central idea is to exploit the value dependence highlighted in Figure 2. While existing statistical FI approaches already allocate injections across layers or bit positions, they do not explicitly organize the sampling campaign by value range. TreeFI addresses this limitation by partitioning the value distribution into intervals and allocating more injections to those that occur more 0% 20% 40% 60% 80% 100% Golden accuracy Bit 30 (exponent MSB) 0.00.51.01.52.02.53.03.54.0 0% 20% 40% 60% 80% 100% Golden accuracy Bit 27 Golden value Post-fault accuracy Figure 2. Motivating example on a representative ResNet8 activa- tion layer: for a fixed bit position, the impact of a bit flip on model accuracy depends strongly on the original activation value. frequently and are more likely to influence the final failure-rate es- timate. Thus, TreeFI uses the value axis itself to guide the sampling campaign, making it more efficient while still targeting a desired confidence level and error margin. 3.2 Overview of TreeFI The proposed value-aware fault-injection methodology comprises two phases, as depicted in Figure 1. The first phase is an offline char- acterization, corresponding to Figure 1(a)–(c). TreeFI first collects the value distribution of each target layer (a). It then partitions the value axis into intervals with similar local bit-flip effects (b), based only on the numerical difference between the original value and the bit-flipped value, without evaluating the effect on the model output. Finally, it computes how frequently each interval occurs in practice (c). The second phase performs the actual fault injection campaign, as shown in Figure 1(d)–(e). In this phase, TreeFI deter- mines how many injections to apply in each interval and performs the corresponding fault injections (d), and finally aggregates the observed results to obtain a final failure-rate estimate (e). The same workflow applies to faults in both activations and weights, but the practical execution differs slightly between the two cases. The effect of a fault at a given activation tensor location depends on its value, which varies across input samples. As a result, selecting an activa- tion fault requires considering both the input and the activation location. For weight faults, the value to be corrupted is stored in the model parameters and is independent of the input. Once a weight and bit position are selected, the same corrupted parameter can be evaluated across all considered inputs. The next two subsections describe the different phases of the TreeFI approach. 3.3 TreeFI phases (a) Value Distribution Analysis The first step, sketched in Fig- ure 1(a), is to collect the value distribution for each target DNN layer. For activations, TreeFI executes the model with the valida- tion set and records the values at the output of the layer. For each input, all tensor values of the target layer are accumulated into the Noam Bires, Marcello Traiola, Angeliki Kritikakou, and Elisa Fromont histogram; no tensor-value subsampling is used. To keep prepro- cessing tractable, TreeFI stores only weighted histogram counts and discards the raw activation values after they have been accu- mulated. For faults in weights, the distribution is obtained directly from the model parameters. TreeFI achieves lightweight preprocess- ing by storing these values in histogram form rather than in a large list of raw values. Indeed, in large-scale settings, direct raw-value sorting can require more than one day of preprocessing, whereas our histogram-based approach reduces this cost to a few seconds. To obtain the histogram, values that differ by less than 10 −4 are grouped together in bins, and the frequency of each bin is recorded. In our experiments, using this approach produces identical inter- val partitions (phase b) to those obtained from the raw values. All subsequent partitioning steps are weighted by bin counts, ensuring that rare values do not disproportionately influence the resulting intervals. The histogram-based approach and the 10 −4 threshold are used only to speed up offline characterization; they do not de- fine the precision of the injected values. The original value of the activation or weight,푎, is used for subsequent fault injection and failure-rate estimation. (b) Learning Value Intervals The second step, shown in Fig- ure 1(b), is to partition the values collected in the first step into intervals with similar local bit-flip effects. Here, “local” means that TreeFI does not yet perform full fault injections through the DNN or evaluate the effect on the model output. Instead, for each layer and bit position, it only considers how much the value itself changes when that bit is flipped. For each layer and bit position, TreeFI learns the intervals with a one-dimensional regression tree trained on the collected value histograms. Intuitively, the regression tree scans the value axis and places split points where the local effect of flipping the selected bit changes significantly. The histogram counts from step (a) are used during training so that the learned splits are supported by enough observed values, rather than being driven by rare bins with very few samples. As a result, each leaf of the tree defines one interval. In our experiments, trees are trained independently for each layer–bit pair using a minimum leaf weight of 10 samples, a maximum of 100 leaf nodes, and a weighted-MSE split threshold of 10 −4 . The maximum-leaf constraint is not reached in practice: the learned trees contain at most about 15 leaves per layer–bit pair. For each learned interval, TreeFI then computes an average severity based on the log-distance between the original value and its bit-flipped counterpart, averaged over the values in that interval. We denote this quantity byavg_log ℓ,푏,푘 . This severity is mapped through a sigmoid function휎to obtain the risk score푟 ℓ,푏,푘 of interval 푘 in layer ℓ for bit position 푏: 푟 ℓ,푏,푘 = 휎 푠·(avg_log ℓ,푏,푘 − 훽 ℓ ) ,(1) where푠controls how sharp the transition is and훽 ℓ is a layer- dependent bias. In our implementation,푠is fixed across all layers, while the bias is defined as 훽 ℓ = log 10 (훾 · 푎 ℓ,max ),(2) where푎 ℓ,max is the maximum golden (i.e., original non-faulty) value observed in layerℓand훾is a scaling factor. The resulting risk score is bounded between 0 and 1 and is used later to guide the distribution of fault injections across intervals. These intervals serve as the basic units for fault sampling and es- timation. This step converts the qualitative observation of Figure 2 into an operational fault-injection strategy. (c) Interval Frequency Analysis Once the value intervals are defined, TreeFI computes how often each interval appears during the golden execution, as illustrated in Figure 1(c). This interval fre- quency comes directly from the histogram collected in step (a) and indicates how common each interval is during fault-free execution. These frequencies are used in two ways: first, decide how many fault injections to assign to each interval (d), and second, combine the interval-level results into a final failure-rate estimate (e). (d) Stratified Fault Injection The interval risk scores computed in step (b) are used here to capture how much the expected fault effect varies within each interval. This step then decides how many fault injections to assign to each value interval, as sketched in Fig- ure 1(d). For each layer and bit position, TreeFI distributes injections across the learned intervals using two pieces of information: how often each interval appears during fault-free execution, and how much the expected bit-flip effect varies within that interval. Fol- lowing the standard idea of stratified sampling [31], intervals that are more common and intervals whose effect is harder to estimate receive more injections. In our case, the number of injections푛 ℓ,푏,푘 assigned to interval 푘 is proportional to 푛 ℓ,푏,푘 ∝푊 ℓ,푏,푘 √︃ 푟 ℓ,푏,푘 1−푟 ℓ,푏,푘 ,(3) where푊 ℓ,푏,푘 is the frequency of interval푘for a given pair of layer (ℓ) and bit (푏) and푟 ℓ,푏,푘 is the interval risk score. The values푛 ℓ,푏,푘 di- rectly give the number of injections assigned to each interval. Their sum over푘gives the total number of injections for the considered layer–bit pair, and this total is chosen so that the final failure-rate estimate satisfies the desired confidence level and error margin. As a result, TreeFI does not distribute injections uniformly across the value axis. Instead, it concentrates more injections on the value intervals that are both common and more difficult to estimate accu- rately. In this way, TreeFI addresses the limitation highlighted in Figure 2: since the effect of a bit flip varies across the value axis, the number of injected faults should also vary across value intervals. Activation and weight execution: For activation faults, TreeFI processes each input and looks for activation values whose fault- free value falls inside the selected interval. Among these candidate locations, it randomly selects one location and flips the chosen bit. In other words, an activation location is eligible for injection if its value, for the current input, belongs to the interval selected for sampling. For weight faults, TreeFI selects a model parameter whose value falls inside the selected interval and flips the chosen bit in that parameter. The model is then executed with this corrupted parameter on the considered input samples. In both cases, the in- jected event in the current implementation is a single-bit flip. We use this fault model because it is standard in software-implemented reliability studies and provides a simple and controlled setting for evaluating the proposed sampling methodology and comparing it to existing approaches, which use the same fault model [7, 8]. (e) Aggregating the outcomes The final step is shown in Fig- ure 1(e). For each fault injection run, TreeFI compares the output of the faulty execution with the output of the fault-free (golden) execution and records whether the top-1 prediction changes. Re- peating this process for all injections assigned to a given interval TreeFI: Value-Aware Statistical Fault Injection for Deep Neural Networks produces a measured failure rate for that interval, i.e., the fraction of injections in that interval that change the prediction. To estimate the failure rate for one layer–bit pair, TreeFI com- bines the measured failure rates of all intervals using how often these intervals appear during the golden pass: ˆ 푝 ℓ,푏 = ∑︁ 푘 푊 ℓ,푏,푘 ˆ 푝 ℓ,푏,푘 ,(4) where ˆ 푝 ℓ,푏 is the estimated failure rate for layerℓand bit position 푏,푊 ℓ,푏,푘 is the frequency of interval푘for that layer–bit pair, and ˆ 푝 ℓ,푏,푘 is the measured failure rate obtained from the injections per- formed in interval푘. This weighted combination is a key part of TreeFI. It ensures that the final failure-rate estimate reflects the value distribution observed during fault-free execution. Without this step, all intervals would contribute equally, even though some occur much more often than others. By weighting each interval with its empirical frequency, TreeFI makes the final estimate more representative of the actual layer behavior. This is one of the main differences between TreeFI and statistical FI methods that do not combine results at the value-interval level. 4 Experimental set-up and evaluation We evaluate TreeFI on image classification DNN models under bit flips in activations and weights. We compare the proposed approach against exhaustive fault injection when this is computationally fea- sible, and against two state-of-the-art statistical FI baselines: the data-aware one-shot method SFI [7] and the iterative method IFI [8]. For CIFAR-10 experiments, ResNet8 and RepVGG-A0 are trained on the standard 50,000-image training split and fault-injection cam- paigns are evaluated on images from the separate 10,000-image test split, which is not used during training. For the DeiT experiments, we use ImageNet-pretrained checkpoints and evaluate fault injec- tion on images from the ImageNet validation set, which is distinct from the training set. Thus, the inputs used for validation and fault injection are unseen during model training. In our experimental set-up, statistical campaigns target an absolute error margin of 퐸=1% with 99% confidence. IFI follows the recommended protocol of initializing with a looser target (퐸=5%) and refining to퐸=1%. For TreeFI, we report results with훾 ∈ 1,2,5,10for the layer- dependent bias defined in Section 3.3, while keeping the sigmoid sharpness fixed at푠=2 across all layers. All fault injection cam- paigns reported in this paper were executed on an NVIDIA H100 GPU with 96 GB of VRAM. This work instantiates the methodology using FP32 single-bit flips during inference. However, the proposed approach is not tied to FP32 specifically. More generally, it applies whenever the fault model defines how a bit flip modifies a value and the corresponding value distribution can be collected and partitioned into intervals. To evaluate the statistical robustness of TreeFI, we run 15 independent TreeFI campaigns on ResNet8 activations with different random seeds. Using the exhaustive ResNet8 reference, we report both the estimation error and the variability across runs. This allows us to evaluate how close the estimated failure rates are to the exhaustive reference and how stable the method is across repeated campaigns. We begin with activation faults on CIFAR-10 using ResNet8, where we also run an exhaustive fault injection campaign. This exhaustive campaign provides a reference against which the reli- ability estimates of TreeFI, SFI, and IFI can be directly compared. We then extend the activation-fault evaluation to RepVGG-A0 on CIFAR-10 and to larger transformer models from the DeiT family on ImageNet, in order to study the scalability of the proposed approach. Since exhaustive FI is infeasible at the ImageNet scale, the trans- former analysis focuses on statistical fault injection results only. We also present an ablation study on ResNet8 activations to assess the robustness of the proposed scoring parameters. We then re- port results from fault-injection campaigns targeting DNN weights. For weights, we executed all-layer campaigns on ResNet8, 10-layer campaigns on RepVGG-A0, and 6-layer campaigns on DeiT-Tiny with IFI, SFI, and TreeFI-20×. 4.1 Faults in activations 4.1.1 Validation against exhaustive fault injection (ResNet8 - CIFAR-10). We compare TreeFI and SFI against exhaustive FI for faults in ResNet8 activations, since this benchmark is still small enough to allow a full exhaustive campaign. TreeFI-10×(i.e.,훾=10) obtains failure rates that are very similar to those of the exhaustive reference, reproducing the same most vulnerable bits and the layers with the highest failure rates. This indicates that the reduction in the number of injections, shown in the remainder of the text, does not come from overlooking sensitive cases, but from distributing injections more effectively across the value space. Figure 3 reports the mean absolute error (MAE) of TreeFI-10×, SFI, and IFI, with respect to the exhaustive failure rates. Especially around the most failure-prone layer and bit regions (i.e., L0-L2, and bit 30), TreeFI achieves lower MAE than both SFI and IFI while requiring sub- stantially fewer injections. In general, the reported MAE values are small, and all are within the 1% statistical error target. In par- ticular, TreeFI achieves lower per-layer MAE because it computes the interval-level failure rates using the true interval frequencies observed during the golden pass, so that each interval contributes to the final estimate according to how often it actually occurs. By contrast, SFI and IFI do not explicitly reweight the estimate in this way. As a result, TreeFI better captures the contribution of value ranges that occur less often but can still strongly affect the final fail- ure rate. In other words, the reduction in the number of injections does not come at the expense of estimate quality. When varying훾, the MAE variations among TreeFI configura- tions are also small in absolute terms: the gap between TreeFI-1× and TreeFI-10×stays below 0.05 percentage points across all layers and bits, which is one order of magnitude smaller than the target error margin of 1%. The measured runtimes follow the same trend as the reduction in the number of injections reported in Table 1. On ResNet8 activations, exhaustive FI requires about 270×more injections than TreeFI-10×, highlighting the scale of the reduction achieved by the proposed approach. Among the statistical methods, SFI requires 740,354 injections and 7 h 13 min, IFI requires 979,021 injections and 9 h 35 min, and TreeFI-10×requires only 34,934 in- jections and 28 min. This corresponds to a theoretical reduction of about 21.2×versus SFI and 28.0×versus IFI, while the measured wall-clock reduction is about 15.5×versus SFI and 20.5×versus IFI. Therefore, the practical runtime savings follow the same overall trend as the reduction in the number of injections. 4.1.2 Efficiency. Overall, we observe that TreeFI reduces the number of required fault injections, while keeping the same con- fidence and error margin, across all models. Table 1 reports the absolute number of activation fault injections required by each method under the same statistical objective. For DeiTs and IFI, we Noam Bires, Marcello Traiola, Angeliki Kritikakou, and Elisa Fromont L0L1L2L3L4L5L6 Layer 0.00 0.02 0.04 0.06 0.08 0.10 0.12 0.14 0.16 MAE (percentage points) (a) Per-layer MAE IFI SFI TreeFI 10x 232425262728293031 Bit index 10 −2 10 −1 MAE (percentage points) (b) Per-bit MAE Figure 3. ResNet8 MAE to exhaustive activation failure rates: (a) per-layer MAE over bits 23–31 and (b) per-bit MAE over layers, for IFI, SFI, and TreeFI-10× (b uses log scale). Table 1. Total number of required injections on activations per method and per model. Method ResNet8 RepVGG-A0 DeiT-Tiny DeiT-Small DeiT-Base Exhaustive 9,437,18414,024,704 58,097,664 116,195,328 232,390,656 SFI [7]740,3541,812,9191,664,6951,749,4891,781,928 IFI [8]979,0212,173,770N/AN/AN/A TreeFI 1×100,046308,303137,091113,820121,702 TreeFI 2×76,810227,601100,89177,45884,379 TreeFI 5×49,840145,52557,51941,29145,672 TreeFI 10×34,934103,55234,81624,25426,970 do not report the number of injections since, as already pointed out in Section 2, IFI’s iterative nature makes the total number of faults impossible to predict in advance, and running a full-model analysis with IFI for DeiTs is not tractable in our setup. Figure 4 presents the reduction factor achieved by TreeFI relative to SFI (values>1 indicate fewer injections). Across all models, TreeFI consistently reduces the number of required injections, ranging from 5.9×fewer injections (RepVGG-A0,훾=1×) up to 72.1×fewer injections (DeiT-Small,훾=10×). On average, TreeFI-10×achieves the same statistical results as SFI (see next paragraph), with 44.9× fewer injections. Since the total FI runtime scales approximately linearly with the number of injections, the achieved reductions translate directly into faster fault injection campaigns. Note that the gains of TreeFI become more pronounced as model size increases, as illustrated by the DeiT family. This trend suggests that the benefits of the proposed value-aware approach grow with the size of the fault space and with the heterogeneity of the underly- ing value distributions and fault effects. As the number of possible fault injections increases, existing methods, that do not explicitly organize sampling by value range, spend more injections on less impactful values, whereas TreeFI concentrates the campaign on in- tervals that are more likely to influence the final reliability estimate. As a result, TreeFI is particularly attractive for large models and datasets, where exhaustive FI is infeasible and existing statistical approaches quickly become too time-consuming to be practical. 4.1.3 Scalability (RepVGG and DeiT on CIFAR-10/ImageNet). We now evaluate TreeFI beyond the ResNet8 benchmark, where an exhaustive FI reference is no longer practical. In this setting, we compare TreeFI with SFI and IFI using two complementary criteria: the number of required injections and the resulting per-layer and per-bit failure-rate trends. For RepVGG-A0, Figure 5 compares the mean failure rates per layer and per bit obtained with IFI, SFI, and TreeFI-10×. TreeFI-10× follows the same main per-layer and per-bit failure-rate trends as the other methods, despite using far fewer injections, as shown in Table 1. The runtime results are also consistent with the theoreti- cal reduction in the number of required injections. On H100, the full activation-fault campaign on RepVGG-A0 requires 33 h 47 min with IFI, 26 h 46 min with SFI, and only 1 h 41 min with TreeFI-10×. These measured runtime reductions correspond to about 20.1×ver- sus IFI and 15.9×versus SFI. This closely matches the theoretical reductions reported in Table 1, where TreeFI-10×requires about 21.0×fewer injections than IFI and 17.5×fewer injections than SFI. This agreement indicates that the wall-clock gains of TreeFI are directly explained by the reduction in the number of injections. For DeiTs, exhaustive FI is infeasible, and IFI is also not tractable for a full-model analysis in our setup. Since the results for all DeiT versions are similar, we report only the results obtained for DeiT- Tiny. We analyzed the first layer of DeiT-Tiny with SFI, IFI, and TreeFI, executed on the same H100 GPU. On the first DeiT-Tiny layer, IFI requires 36 h 43 min, SFI requires 40 h 55 min, and TreeFI- 10×requires only 20 min. These measured runtime reductions cor- respond to about 110×versus IFI and 123×versus SFI. They are again close to the theoretical reduction in the number of injections on that same layer: TreeFI-10×requires only 1,042 injections, com- pared with 124,089 for IFI and 139,778 for SFI, that is, about 119× and 134× fewer injections, respectively. Moreover, we performed a full DeiT-Tiny activation reliability analysis using TreeFI-10×, which took 6 h 42 min. By contrast, SFI required 111 h 30 min to complete only the first three layers of DeiT- Tiny. The failure-rate results reported in Figure 6 show that, on TreeFI 1xTreeFI 2xTreeFI 5x TreeFI 10x 0 10 20 30 40 50 60 70 80 Reduction factor (SFI / TreeFI) ResNet8 RepVGG-A0 DeiT-Tiny DeiT-Small DeiT-Base Figure 4. Activation-injection reduction factors relative to the SFI baseline. Values> 1 indicate fewer injections than SFI. TreeFI: Value-Aware Statistical Fault Injection for Deep Neural Networks L0L1L2L3L4L5L6L7L8L9 L10L11L12L13L14L15L16L17L18L19L20L21 Layer 0 1 2 3 4 5 6 7 Failure rate (%) (a) Per-layer failure rate IFI SFI TreeFI 10x 232425262728293031 Bit index 10 −2 10 −1 10 0 10 1 Failure rate (%) (b) Per-bit failure rate Figure 5. RepVGG failure rates: (a) per-layer over bits 23–31 and (b) per-bit over layers, for IFI, SFI, and TreeFI-10×(b uses log scale). the layers where SFI could be completed, TreeFI-10×follows the same main per-layer and per-bit trends while requiring a much smaller number of injections. As discussed above for the lower MAE obtained with TreeFI (Figure 3(a)), the differences in the reported per-layer failure rates in Figure 6 mainly come from the reweighting step used by TreeFI, which combines interval-level results according to the empirical value distribution. To confirm this explanation, we applied the same reweighting to the SFI results, which led to failure- rate estimates that matched those of TreeFI-10×. This highlights the practical advantage of TreeFI for larger transformer models, where baseline statistical FI becomes extremely costly, enabling statistically accurate and faster estimation. 4.1.4 Hyperparameter ablation study (ResNet8 activations). To better justify the choice of the sigmoid allocation parameters, we performed an ablation study on the ResNet8 activation benchmark, where exhaustive FI provides a ground-truth reference. We evalu- ated 88 combinations formed by sharpness values푠 ∈ 1,2,3,4,6, 8,16,32and bias multipliers훾 ∈ 1,2,5,10,20,50,200,2000,10000, 20000,50000. For each configuration, we measured the difference in the failure rates of TreeFI and exhaustive FI and retained the configurations in which the difference remained within the target 1% error margin at the layer–bit level. Out of the 88 tested combina- tions, 60 remained within the target error margin, indicating that TreeFI is not overly sensitive to moderate changes in the examined hyperparameters. Overall, we observe a clear trend with respect to sharpness. For all configurations with푠 ≥16, only three biases satisfied the 1% criterion, indicating that excessively sharp sigmoid mappings over-concentrate the fault injection allocation and de- grade failure rate quality. By contrast, for all configurations with 푠 ≤3, every tested bias remained within the target 1% error margin, showing that the proposed methodology is robust to the choice of the bias, as long as the sharpness remains moderate. Figure 7 depicts the trade-off between TreeFI’s MAE relative to exhaustive fault in- jection (y-axis) and the total number of injections (x-axis). The L0L1L2L3L4L5L6L7L8L9 L10L11 Layer 0 1 2 3 4 Failure rate (%) (a) Per-layer failure rate IFI SFI TreeFI 10x 232425262728293031 Bit index 10 −1 10 0 10 1 Failure rate (%) (b) Per-bit failure rate Figure 6. DeiT-Tiny failure rates: (a) per-layer over bits 23–31 and (b) per-bit over layers, for SFI and TreeFI-10× (b uses log scale). 10 4 10 5 Number of fault injections (log scale) 0.005 0.010 0.015 0.020 0.025 0.030 Global MAE (percentage points) s8_b20000x s2_b200x s4_b1x s2_b10x All configurations Pareto front Configuration used in experiments Figure 7. ResNet8 activation hyperparameter ablation for TreeFI. Each point represents a(푠,훾)configuration (x-axis: total injections; y-axis: MAE vs. exhaustive FI). Configurations meeting the 1% layer×bit error criterion define the feasible region. The main acti- vation setting (푠= 2,훾= 10) is highlighted. figure shows that the TreeFI configuration used in our experiments (TreeFI-10×with푠=2) lies in a conservative region of the trade-off: it remains within the error margin, while it achieves a substantial reduction in injections. Overall, this ablation study indicates that TreeFI is not highly sensitive to the precise bias choice when푠 is moderate, and very large sharpness values should be avoided. The outcome of this study supports the use of푠=2 as a robust default value for sharpness, leading to a rather conservative TreeFI configuration in the experiments. This suggests that the sharpness parameter is more critical than the bias multiplier: moderate sharp- ness values remain robust across a wide range of훾, whereas overly large sharpness values make the allocation too selective. Thus, we recommend starting from moderate sharpness and only increasing selectivity when preliminary experiments justify it. Noam Bires, Marcello Traiola, Angeliki Kritikakou, and Elisa Fromont Table 2. MAE between TreeFI-20× and the weight FI baselines. ModelEvaluation vs. SFI [7] vs. IFI [8] ResNet8Per-layer0.0000%0.0367% All bits0.0062%0.0363% RepVGG-A0 Per-layer0.0190%0.0340% All bits0.0259%0.0437% DeiT-TinyPer-layer0.0183%0.0250% All bits0.0243%0.0306% 4.2 Faults in weights We additionally study bit-flip faults occurring in model weights. In contrast to activations, weight values are input-independent. Therefore, the offline characterization is computed directly from the model parameters without any dataset pass. We completed all-layer ResNet8 campaigns, 10-layer RepVGG-A0 campaigns, and 6-layer DeiT-Tiny campaigns for IFI, SFI, and TreeFI-20×. On ResNet8 weights, TreeFI-20×required 79,426 injections and 1 h 30 min, compared with 753,050 injections and 14 h 34 min for SFI, and 1,043,629 injections and 20 h 06 min for IFI. This corre- sponds to about 9.5×fewer injections than SFI and 13.1×fewer injections than IFI. On RepVGG-A0, TreeFI-20×required 62,063 injections and 1 h 55 min, compared with 1,108,540 injections and 34 h 27 min for SFI, and 1,560,584 injections and 49 h 03 min for IFI. This corresponds to about 17.9×and 25.1×fewer injections, respectively. On DeiT-Tiny, TreeFI-20×required 48,465 injections and 15 h 46 min, compared with 310,446 injections and 100 h 55 min for SFI, and 694,557 injections and 227 h 27 min for IFI. This cor- responds to about 6.4×fewer injections than SFI and 14.3×fewer injections than IFI. The corresponding wall-clock speedups are 9.7×, 18.0×, and 6.4×over SFI, and 13.4×, 25.6×, and 14.4×over IFI, for ResNet8, RepVGG-A0, and DeiT-Tiny, respectively. Averaged over these three executed scopes, TreeFI-20×is 11.4×faster than SFI and 17.8×faster than IFI. These values closely follow the average injection-count reductions of 11.2×and 17.5×, confirming that the reduction in executed faults translates directly into campaign-time savings. The resulting failure-rate estimates also remain close across methods. Table 2 reports both per-layer MAE, computed after ag- gregating over bits, and all-bits MAE, computed after aggregating over the evaluated layers. All MAEs between TreeFI-20×and the two baselines remain far below the target 1% error margin. The largest difference is 0.0437% for the RepVGG-A0 all-bits comparison with IFI, more than 20×smaller than the target margin. The DeiT- Tiny comparisons remain similarly small despite its substantially longer per-injection execution time. Table 3 summarizes the executed weight campaigns: all layers for ResNet8, 10 layers for RepVGG-A0, and 6 layers for DeiT-Tiny. TreeFI-20×requires fewer injections than both SFI and IFI in every evaluated model. The reductions are smaller than for activation faults because weight values vary less, leaving less structure for TreeFI to exploit. Even so, TreeFI-20×reduces the number of weight injections by 6.4×–17.9×compared with SFI and by 13.1×–25.1× compared with IFI, demonstrating substantial gains across all three models. Taken together, TreeFI-20×reduces the weight campaign by at least 6.4×, while its largest MAE relative to either baseline is only 0.0437%, showing that the efficiency gains do not produce materially different failure-rate estimates. Table 3. Number of injections in the executed weight FI campaigns. Method ResNet8 RepVGG-A0 DeiT-Tiny ScopeAll layers10 layers6 layers SFI [7]753,0501,108,540310,446 IFI [8]1,043,6291,560,584694,557 TreeFI 20×79,42662,06348,465 5 Conclusions and discussion We presented TreeFI, a value-aware fault-injection methodology for efficient reliability evaluation in neural networks. TreeFI parti- tions the value distribution into intervals, derives an interval risk score from the severity of bit flips within each interval, and uses this information to assign fault injections across intervals. The final reliability estimate is then computed from the measured fault- injection outcomes. In this way, TreeFI targets a desired confidence level and error margin while avoiding a bit-level, value-uniform sampling strategy. On the evaluated benchmarks, TreeFI substan- tially reduces the number of required injections compared with state-of-the-art statistical FI approaches, while keeping the esti- mation error within the target margin when validated against an exhaustive FI reference. The results further show that TreeFI pre- serves the main per-layer and per-bit failure-rate trends in larger activation-fault experiments, making it useful even when exhaus- tive validation is impractical. For weight faults, we validate the approach experimentally on CNN models and a 6-layer DeiT-Tiny subset. Our experimental study focuses on FP32 bit flips, which remain common in reliability studies and provide a clear setting for evaluating the proposed methodology. However, the method itself is more general: it only requires a fault model that defines how a bit flip modifies a value, together with a value distribution that can be collected and partitioned into intervals. We therefore expect that the same interval-learning and stratified-allocation principle can be extended to other numerical formats, such as FP16, bfloat16, or quantized integer representations. Validating this experimentally is an important direction for future work. Overall, TreeFI provides an effective compromise between estimation cost and estimate quality, and is particularly attractive for large-scale fault-injection studies where exhaustive evaluation is infeasible. 6 Reproducibility The TreeFI implementation and experimental artifacts are available at https://gitlab.inria.fr/nbires/treefi. The repository’sREADME.md provides installation instructions and ready-to-run activation and weight examples, whiledocs/reproducibility.mdexplains how to reproduce the paper’s results. Acknowledgment This work was supported by the French government under the France 2030 investment plan, as part of the PEPR Intelligence Arti- ficielle (AdaptING project, grant number ANR-23-PEIA-0009). The experiments were performed using SLICES-FR HPC, supported by Inria and partner institutions. TreeFI: Value-Aware Statistical Fault Injection for Deep Neural Networks References [1]C. Bolchini et al., “Resilience of deep learning applications: A systematic literature review of analysis and hardening techniques,” Computer Science Review, vol. 54, p. 100 682, 2024. [2]M. H. Ahmadilivani et al., “A Systematic Literature Review on Hardware Reliability Assessment Methods for Deep Neu- ral Networks,” ACM Comput. Surv., vol. 56, no. 6, 141:1– 141:39, 2024. [3]A. Ruospo et al., “A Survey on Deep Learning Resilience Assessment Methodologies,” Computer, vol. 56, no. 2, p. 57– 66, 2023. [4]P. Rech, “Artificial Neural Networks for Space and Safety- Critical Applications: Reliability Issues and Potential Solu- tions,” IEEE Transactions on Nuclear Science, vol. 71, no. 4, p. 377–404, 2024. [5]F. Su et al., “Testability and Dependability of AI Hardware: Survey, Trends, Challenges, and Perspectives,” IEEE Design & Test, vol. 40, no. 2, p. 8–58, 2023. [6]R. Leveugle et al., “Statistical fault injection: Quantified error and confidence,” in Automation & Test in Europe Conference & Exhibition 2009 Design, 2009, p. 502–506. [7]A. Ruospo et al., “Assessing Convolutional Neural Networks Reliability through Statistical Fault Injections,” in 2023 De- sign, Automation & Test in Europe Conference & Exhibition (DATE), 2023, p. 1–6. [8]A. Ruospo et al., “An Effective Iterative Statistical Fault Injec- tion Methodology for Deep Neural Networks,” IEEE Transac- tions on Computers, vol. 74, no. 7, p. 2431–2444, 2025. [9]K. He et al., “Deep Residual Learning for Image Recogni- tion,” in 2016 IEEE Conference on Computer Vision and Pattern Recognition (CVPR), 2016, p. 770–778. [10]X. Ding et al., “RepVGG: Making VGG-style ConvNets Great Again,” in 2021 IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR), 2021, p. 13 728–13 737. [11]A. Krizhevsky, “Learning Multiple Layers of Features from Tiny Images,” M.S. thesis, University of Toronto, 2009. [12]J. Deng et al., “ImageNet: A large-scale hierarchical image database,” in 2009 IEEE Conference on Computer Vision and Pattern Recognition, 2009, p. 248–255. [13]H. Touvron et al., “Training data-efficient image transform- ers & distillation through attention,” in Proceedings of the 38th International Conference on Machine Learning, 2021, p. 10 347–10 357. [14]B. Reagen et al., “Ares: A framework for quantifying the resilience of deep neural networks,” in Proceedings of the 55th Annual Design Automation Conference, 2018, p. 1–6. [15] Z. Chen et al., “TensorFI: A Flexible Fault Injection Frame- work for TensorFlow Applications,” in 2020 IEEE 31st Interna- tional Symposium on Software Reliability Engineering (ISSRE), 2020, p. 426–435. [16]A. Mahmoud et al., “PyTorchFI: A Runtime Perturbation Tool for DNNs,” in 2020 50th Annual IEEE/IFIP International Conference on Dependable Systems and Networks Workshops (DSN-W), 2020, p. 25–31. [17] H. Huang et al., “MRFI: An Open-Source Multiresolution Fault Injection Framework for Neural Network Processing,” IEEE Transactions on Very Large Scale Integration (VLSI) Sys- tems, vol. 32, no. 7, p. 1325–1335, 2024. [18]W. G. Cochran, Sampling techniques. 1977. [19] Z. Chen et al., “BinFI: An efficient fault injector for safety- critical machine learning systems,” in Proceedings of the In- ternational Conference for High Performance Computing, Net- working, Storage and Analysis, 2019, p. 1–23. [20]O. Weng et al., “FKeras: A Sensitivity Analysis Tool for Edge Neural Networks,” ACM J. Auton. Transport. Syst., vol. 1, no. 3, 15:1–15:27, 2024. [21] O. Weng et al., “PrioriFI: More Informed Fault Injection for Edge Neural Networks,” in Proceedings of the 31st ACM Inter- national Conference on Architectural Support for Programming Languages and Operating Systems, Volume 2, 2026, p. 1461– 1475. [22] M. Traiola et al., “A machine-learning-guided framework for fault-tolerant DNNs,” in 2023 Design, Automation & Test in Europe Conference & Exhibition (DATE), 2023, p. 1–2. [23]M. Traiola et al., “harDNNing: A machine-learning-based framework for fault tolerance assessment and protection of DNNs,” in 2023 IEEE European Test Symposium (ETS), 2023, p. 1–6. [24]M. H. Ahmadilivani et al., “DeepVigor+: Scalable and Ac- curate Semi-Analytical Fault Resilience Analysis for Deep Neural Network,” arXiv preprint arXiv:2410.15742, 2024. [25]C. Bolchini et al., “Fast and accurate error simulation for cnns against soft errors,” IEEE Transactions on Computers, vol. 72, no. 4, p. 984–997, 2023. [26]R. B. Tonetto et al., “ENFOR-SA: End-to-end Cross-layer Transient Fault Injector for Efficient and Accurate DNN Re- liability Assessment on Systolic Arrays,” in 2026 IEEE 44th VLSI Test Symposium (VTS), 2026, p. 1–7. [27]J. Gutiérrez-Zaballa et al., “Evaluating single event upsets in deep neural networks for semantic segmentation: An em- bedded system perspective,” Journal of Systems Architecture, vol. 154, p. 103 242, 2024. [28]E. Ozen et al., “SNR: Squeezing Numerical Range Defuses Bit Error Vulnerability Surface in Deep Neural Networks,” ACM Trans. Embed. Comput. Syst., vol. 20, no. 5s, p. 1–25, 2021. [29]B. Ghavami et al., “FitAct: Error Resilient Deep Neural Net- works via Fine-Grained Post-Trainable Activation Functions,” in 2022 Design, Automation & Test in Europe Conference & Exhibition (DATE), 2022, p. 1239–1244. [30]F. F. dos Santos et al., “Improving Deep Neural Network Reliability via Transient-Fault-Aware Design and Training,” IEEE Transactions on Emerging Topics in Computing, vol. 13, no. 3, p. 829–840, 2025. [31]J. Neyman, “On the Two Different Aspects of the Represen- tative Method: The Method of Stratified Sampling and the Method of Purposive Selection,” in Breakthroughs in Statis- tics: Methodology and Distribution, S. Kotz et al., Eds., 1992, p. 123–150.