🤖 AI

The Weight of a Bit: EMFI Sensitivity Analysis of Embedded Deep Learning Models

This paper evaluates the impact of four number representations (32-bit/16-bit floating-point and 8-bit/4-bit integer) on the resilience of embedded deep learning models against electromagnetic fault injection (EMFI) attacks, revealing that integer formats, particularly 8-bit, offer significantly better resistance and accuracy retention compared to floating-point formats which suffer near-total degradation after a single fault.

Original authors: Jakub Breier, Štefan Kučerák, Xiaolu Hou

Published 2026-04-14

📖 5 min read🧠 Deep dive

CC BY 4.0

Original authors: Jakub Breier, Štefan Kučerák, Xiaolu Hou

Original paper licensed under CC BY 4.0 (http://creativecommons.org/licenses/by/4.0/). ✨ This is an AI-generated explanation of the paper below. It is not written or endorsed by the authors. For technical accuracy, refer to the original paper. Read full disclaimer

The Big Picture: Hacking a Brain with a Magnet

Imagine you have a tiny, super-smart robot brain (a neural network) running on a small device, like a smart camera or a drone. This brain is made up of millions of tiny "weights" (numbers) that tell it how to recognize things, like a cat or a car.

The researchers in this paper asked a scary question: What happens if we zap this device with a strong magnetic pulse?

They used a special tool (an electromagnetic pulse generator) to shoot a quick, sharp burst of energy at the device's memory. This is like giving the device a tiny, invisible "shock" that flips some of the numbers inside its brain. The goal was to see if this shock would make the robot brain go crazy and start misidentifying everything.

The Experiment: Testing Different "Languages"

The brain doesn't just store numbers; it stores them in different "languages" or formats. The researchers tested four different ways to write these numbers to see which one was the most "shockproof":

FP32 & FP16 (The High-Definition Language): These are like writing numbers with a massive amount of detail (floating-point). They are very precise but complex.
- Analogy: Imagine writing a recipe using fractions like "1/3 of a cup" or "0.0004 grams." It's very precise, but if you mess up the decimal point, the whole dish is ruined.
INT8 & INT4 (The Simple Language): These are integer formats, where numbers are rounded to whole numbers (like 1, 2, 3).
- Analogy: This is like writing a recipe using only whole cups: "1 cup," "2 cups." It's less precise, but much harder to mess up.

They tested these languages on four famous "brains" (ResNet-18, ResNet-34, ResNet-50, and VGG-11) to see how they reacted to the magnetic shock.

The Results: The "Float" vs. The "Integer"

The results were dramatic and revealed a huge difference in how these languages handle a "shock."

1. The Floating-Point Disaster (FP32/FP16)

When the researchers zapped the high-precision (floating-point) models, the results were catastrophic.

What happened: The accuracy dropped to near zero. The robot brain forgot how to recognize anything.
The Analogy: Think of the floating-point numbers as a house of cards. The "exponent" part of the number is like the foundation. If the magnetic pulse flips just one single bit in that foundation, the whole house collapses.
- In the floating-point system, a tiny glitch can turn a normal number (like 0.5) into a "Not a Number" (NaN) or a number so huge it breaks the math (like 10 to the power of 38).
- Once one number explodes, it poisons the next layer of the brain, which poisons the next, until the entire system crashes. It's like one domino falling and knocking over a skyscraper.

2. The Integer Resilience (INT8/INT4)

When they zapped the integer models, the results were surprisingly good.

What happened: The accuracy dropped, but the brain kept working! For example, the VGG-11 model with 8-bit integers still got about 70% of answers right, even after being shocked.
The Analogy: Think of integer numbers as a bucket with a lid. If you pour too much water in (a glitch), the water just hits the lid and stops. It can't overflow.
- If a bit flips in an integer, the number might change from "5" to "127" (the max), but it stays within the bucket. It doesn't explode into infinity.
- Because the numbers are "clamped" or bounded, a single glitch doesn't destroy the whole system. The brain has enough "redundancy" (extra brain power) to ignore the weird number and still guess correctly.

The "Magic" of the 8-Bit Format

The paper found that 8-bit integers (INT8) were the "Goldilocks" solution.

They are small enough to fit on tiny devices (saving space and battery).
They are simple enough to survive magnetic shocks.
They are smart enough to still recognize cats and cars accurately.

Why Does This Matter?

We are moving toward a world where AI runs on tiny devices in our homes, cars, and hospitals (Edge AI). These devices are physically accessible, meaning a bad guy could potentially use a magnet to hack them.

This paper tells us a crucial security secret: If you want your AI to be safe from physical attacks, don't use the fancy, high-precision math. Use the simple, whole-number math.

Summary

The Attack: A magnetic pulse flips bits in the memory.
The Weakness: High-precision math (Floating Point) is like a house of cards; one flip destroys everything.
The Strength: Simple math (Integers) is like a sturdy bucket; it absorbs the shock without breaking.
The Winner: 8-bit integers offer the best balance of speed, size, and safety.

In short: When it comes to hacking, simple is stronger.

1. Problem Statement

As Deep Learning (DL) models are increasingly deployed on resource-constrained edge devices (TinyML), they become vulnerable to physical fault injection attacks. Specifically, Electromagnetic Fault Injection (EMFI) allows attackers to induce transient bit-flips in memory without invasive hardware modification.

While prior research has studied fault tolerance in neural networks, there is a lack of comprehensive, comparative studies evaluating how different numerical weight representations (floating-point vs. quantized integers) influence a model's resilience to EMFI. The core research question is: To what extent does the choice of weight format (FP32, FP16, INT8, INT4) determine a neural network's ability to withstand EMFI attacks?

2. Methodology

Experimental Setup

Hardware: The authors utilized a NewAE ChipSHOUTER platform to generate high-voltage (300V, 160ns) electromagnetic pulses. The target was a 4MB SRAM chip (AS6C3216A-55TIN) mounted on a Ballistic Gel board, acting as the Device Under Test (DUT).
Models: Four standard Convolutional Neural Network (CNN) architectures were evaluated: ResNet-18, ResNet-34, ResNet-50, and VGG-11.
Representations: Each architecture was instantiated in four weight formats:
- FP32: 32-bit Single Precision Floating Point.
- FP16: 16-bit Half Precision Floating Point.
- INT8: 8-bit Signed Integer.
- INT4: 4-bit Signed Integer.
Attack Vector: The attack followed an "in-storage" threat model. Weights were uploaded to the SRAM, a single EM pulse was injected during inference (or weight loading), and the corrupted weights were read back. Inference was then performed on a separate GPU (NVIDIA RTX 4080) to isolate the mathematical impact of the faults from hardware execution errors.
Metrics:
- Accuracy: Top-1 and Top-5 accuracy on the ImageNet-1K validation set.
- Fault Characterization: Bit Error Rate (BER), spatial distribution of corrupted bytes, prevalence of specific byte values (0xFE/0xFF), and weight distribution analysis (NaN generation, range expansion).

Quantization Configuration

Integer models were quantized using Brevitas (Post-Training Quantization) with symmetric per-channel quantization. INT4 models utilized GPTQ-style optimization to mitigate accuracy loss during the quantization process.

3. Key Contributions

First Comparative Study: This is the first work to systematically compare the EMFI resilience of FP32, FP16, INT8, and INT4 representations across multiple CNN architectures under identical experimental conditions.
Fault Pattern Characterization: The authors demonstrated that the Bit Error Rate (BER) is largely independent of the data format (approx. 6–8% across all formats). This proves that the dramatic differences in model accuracy are due to the mathematical interpretation of the faults, not the frequency of the faults themselves.
Mechanism Identification: The paper identifies the IEEE 754 exponent encoding as the primary failure mechanism for floating-point models. A single bit flip in the exponent can cause a weight to become NaN (Not a Number) or an extreme value (e.g., $10^{38}$ ), leading to catastrophic network saturation.
Resilience of Integer Formats: The study highlights that integer representations (especially INT8) offer inherent "numerical masking." Due to bounded ranges (e.g., [-128, 127]), a bit flip results in a clamped value rather than an exponential explosion, preserving model functionality.

4. Key Results

Accuracy Degradation

Floating-Point (FP32/FP16): Suffered catastrophic failure. A single fault injection reduced Top-1 accuracy to near-random guessing levels (<0.2%).
- FP32: ~1.27% of weights became NaN per chunk; weight range expanded by a factor of $\sim 10^{39}$ .
- FP16: ~0.10% NaN rate; range expansion $\sim 10^6$ .
Integer (INT8/INT4): Demonstrated significantly higher resilience.
- INT8: Retained substantial accuracy. For example, VGG-11 (INT8) maintained ~70% Top-1 and ~90% Top-5 accuracy even after faults.
- INT4: Showed better resilience than FP formats but was generally more sensitive than INT8 due to the smaller dynamic range (fewer representable values).

Spatial Sensitivity

Front-Heavy Sensitivity: Faults injected into the initial layers (early convolutions) caused the most severe accuracy drops across all formats.
Layer Redundancy: Larger models (ResNet-50, VGG-11) showed better resilience than smaller ones (ResNet-18) due to parameter redundancy.
VGG-11 Specifics: VGG-11 with INT8 showed a "bimodal" sensitivity profile. Attacks on the middle layers (specifically the large FC6 layer) had minimal impact because the 4MB fault window only corrupted a tiny fraction (~0.6%) of that massive layer's weights. Conversely, attacks on the first or last layers caused significant degradation.

Fault Pattern Analysis

0xFE/0xFF Prevalence: Integer formats received a higher proportion of bytes with values 0xFE or 0xFF (maximal values) compared to floating-point.
The Paradox: Despite receiving more "maximal" bytes, integer models performed better. In FP32, a 0xFF byte in the exponent field forces the value to NaN/Infinity. In INT8, 0xFF simply clamps the weight to 127, which is a bounded, non-catastrophic error.

5. Significance and Implications

Security Implications: The study reveals that quantization is not just a compression technique but a security feature. Moving from floating-point to integer representations (specifically INT8) provides a passive, inherent defense against EMFI attacks without requiring additional hardware countermeasures.
Design Guidelines: For edge AI deployments where physical security is a concern, INT8 quantization offers the optimal trade-off between model accuracy, memory footprint, and fault resilience.
Future Work: The authors suggest that future research should focus on training-phase optimizations (e.g., quantization-aware training) to further harden specific weight bits against errors, and extending these findings to in-situ inference on microcontrollers with complex memory hierarchies.

Conclusion

The paper concludes that the choice of numerical representation is a critical factor in the security of embedded AI. Floating-point models are highly fragile to EMFI due to the non-linear nature of IEEE 754 encoding, whereas integer models provide a robust "shock absorber" effect, maintaining functionality even under significant memory corruption.