Characterizing the Fault Response of the Intel Neural Compute Stick 2 Under Single-Pulse Electromagnetic Fault Injection

Problem Statement

Commercial neural-network inference accelerators, such as Vision Processing Units (VPUs), are increasingly deployed in safety-relevant edge applications (e.g., industrial inspection, robotics). However, their fault responses to transient hardware disturbances remain poorly characterized in open literature. While standards like IEC 61508 and ISO 26262 require failure modes to be characterized and residual fault rates quantified, vendors often do not publish failure characteristics for proprietary silicon. Previous work on the Intel Neural Compute Stick 2 (NCS2) was limited to a single feasibility study establishing that electromagnetic disturbances cause errors but failing to characterize the fault space, spatial sensitivity, or persistence of faults.

Methodology

The authors conducted a systematic single-pulse Electromagnetic Fault Injection (EMFI) campaign on the Intel NCS2 (featuring the Movidius Myriad X VPU) running the OpenVINO runtime.

• Target Platform: The NCS2 was decased to expose the Myriad X package. It was cooled actively to prevent thermal throttling, which was observed to modulate fault rates.
• Injection Setup: A NewAE ChipSHOUTER pulse generator drove near-field magnetic probes (1 mm CW, 1 mm CCW, and 4 mm CCW coils) positioned by a 3D-printer-based XYZ stage.
• Workloads: Three ImageNet-trained Convolutional Neural Networks (CNNs) were evaluated: ResNet-18, ResNet-50, and VGG-11.
• Experimental Phases:
  1. Exploratory Scan: Used a Tree-structured Parzen Estimator (TPE) sampler to search a large parameter space (lateral coordinates, stand-off distance, voltage) to identify "hotspots" where faults occur.
  2. Spot Tests: Fixed-parameter trials (256 trials per configuration) were conducted at identified hotspots to generate stable statistical distributions of outcomes.
• Timing: Pulses were delivered either 1 second before inference start (idle state with loaded model) or 1 second after inference start (during inference).
• Fault Taxonomy: Outcomes were classified into four mutually exclusive classes:
  • C0 (Unchanged): No measurable accuracy change.
  • C1 (Minor SDC): Minor accuracy degradation (between 1% and 50% drop in top-1 accuracy), potentially transient or persistent but not catastrophic.
  • C2 (Major Persistent Degradation): Top-1 accuracy collapses (>50% drop) and remains collapsed across all subsequent inferences until the model is explicitly reloaded.
  • C3 (Device Failure): Device hangs, USB disconnection, or runtime errors requiring a USB power-cycle to recover.

Key Results

1. Four Reproducible Outcome Classes
The study confirms that single EMFI pulses produce four distinct, reproducible outcomes. Crucially, Class C2 (Major Persistent Degradation) is a significant finding. In this state, the device returns a successful inference call with a result that is severely incorrect (top-1 accuracy < 5%), and this error persists for all subsequent inferences until the model is reloaded. This regime is undetectable by standard inference-API-level mechanisms.

2. Spatial Sensitivity and Hotspots
Spatial mapping revealed two reproducible lateral hotspots separated by approximately 7 mm, where Class C1 and C2 faults are concentrated. A central region between these hotspots preferentially produces Class C3 (device hangs). This suggests a die layout where lateral regions contain compute/storage blocks and the central region contains control logic.

3. Persistence and Idle-State Vulnerability

• Persistence: Class C2 faults persist across subsequent inferences. Explicit model reload restores baseline accuracy, indicating the corruption resides in the loaded model state (weights, instructions, or configuration) rather than non-volatile storage or irreversible silicon damage.
• Idle-State Vulnerability: Pulses delivered to an idle device (with the model already loaded but before inference starts) induce Class C2 faults at rates comparable to during-inference pulses. This demonstrates that model state is fault-susceptible even when the device is idle, rendering load-time integrity checks alone insufficient.

4. Architecture-Dependent Reliability
Different CNN architectures occupy distinct regions in the "persistent-fault-rate vs. device-failure-rate" plane:

• ResNet-18 & ResNet-50: Exhibit high persistence rates (18–31%) but lower device failure rates. They show a bimodal distribution where faults tend to be either negligible or catastrophic (C2), with few intermediate (C1) outcomes.
• VGG-11: Exhibits a significantly higher rate of minor accuracy perturbations (C1) and a higher device failure rate (C3) during inference compared to ResNets. The authors hypothesize this is due to VGG-11's larger fully-connected classifier head, which may absorb some corruption without total collapse, and its larger memory footprint increasing the risk of control-state disruption.

5. Timing and Probe Effects

• Timing: While C2 rates are comparable between "before" and "during" inference, the distribution of C1 and C3 varies by architecture and timing.
• Probe Size: The 4 mm probe, which couples energy over a larger area, tends to produce Class C3 (hangs) at high voltages, whereas the 1 mm probes are required to induce localized data corruption (C1/C2).

Significance and Claims

The paper claims to fill a critical gap in the reliability characterization of edge AI hardware by moving beyond feasibility to systematic fault space mapping. Its primary contributions are:

1. Taxonomy: Establishing a four-class fault taxonomy (No-effect, Minor SDC, Major Persistent SDC, Device Failure) that maps to radiation-effects terminology (SET, SEU, SEFI).
2. Persistence Discovery: Identifying a "Major Persistent Degradation" regime where a single pulse causes long-term, silent misclassification that survives across inferences and is invisible to the host application without external checks.
3. Idle-State Risk: Demonstrating that loaded model state is vulnerable even when the device is idle, challenging the sufficiency of load-time integrity checks.
4. Architecture as a Lever: Showing that model architecture choice systematically shifts the device's reliability profile, providing system integrators with a deployment-time lever to manage fault rates.
5. Mitigation: Proposing application-level mitigation strategies (host-side watchdogs, reference-image cross-checking, redundant inference) that do not require firmware or runtime modifications.

The authors maintain modesty regarding their claims, noting that the results are specific to the NCS2 and the tested workloads. They acknowledge limitations such as the use of a single device sample, the lack of a public die floorplan (limiting precise spatial-to-block correlation), and software-triggered jitter preventing per-layer fault localization. They position this work as a characterization under EMFI rather than a quantitative prediction of soft-error rates in all field conditions, though they argue the qualitative fault classes are likely preserved across different transient disturbance sources.