Fault injection attacks are a potent threat against embedded implementations
of neural network models. Several attack vectors have been proposed, such as
misclassification, model extraction, and trojan/backdoor planting. Most of
these attacks work by flipping bits in the memory where quantized model
parameters are stored.
In this paper, we introduce an encoding-based protection method against
bit-flip attacks on neural networks, titled DeepNcode. We experimentally
evaluate our proposal with several publicly available models and datasets, by
using state-of-the-art bit-flip attacks: BFA, T-BFA, and TA-LBF. Our results
show an increase in protection margin of up to $7.6\times$ for $4-$bit and
$12.4\times$ for $8-$bit quantized networks. Memory overheads start at $50\%$
of the original network size, while the time overheads are negligible.
Moreover, DeepNcode does not require retraining and does not change the
original accuracy of the model.

我们引入一种基于编码的保护方法 ——DeepNcode，用于防范神经网络的位翻转攻击，实验结果表明，在 4 位和 8 位量化网络中，保护幅度分别提高了 7.6 倍和 12.4 倍，内存开销从原始网络大小的 50% 开始，而时间开销可忽略不计。此外，DeepNcode 不需要重新训练，也不改变模型的准确性。

DeepNcode: 基于编码的神经网络比特翻转攻击防护

DeepNcode: Encoding-Based Protection against Bit-Flip Attacks on Neural  Networks

Quantized networks use less computational and memory resources and are
suitable for deployment on edge devices. While quantization-aware training QAT
is the well-studied approach to quantize the networks at low precision, most
research focuses on over-parameterized networks for classification with limited
studies on popular and edge device friendly single-shot object detection and
semantic segmentation methods like YOLO. Moreover, majority of QAT methods rely
on Straight-through Estimator (STE) approximation which suffers from an
oscillation phenomenon resulting in sub-optimal network quantization. In this
paper, we show that it is difficult to achieve extremely low precision (4-bit
and lower) for efficient YOLO models even with SOTA QAT methods due to
oscillation issue and existing methods to overcome this problem are not
effective on these models. To mitigate the effect of oscillation, we first
propose Exponentially Moving Average (EMA) based update to the QAT model.
Further, we propose a simple QAT correction method, namely QC, that takes only
a single epoch of training after standard QAT procedure to correct the error
induced by oscillating weights and activations resulting in a more accurate
quantized model. With extensive evaluation on COCO dataset using various YOLO5
and YOLO7 variants, we show that our correction method improves quantized YOLO
networks consistently on both object detection and segmentation tasks at
low-precision (4-bit and 3-bit).

本文研究了量子化网络在边缘设备上的部署问题，提出了一种基于指数移动平均的更新方法和一种纠正振荡误差的简单校正方法，经过大量评估实验证明这些方法能够改善低精度下的 YOLO 网络在目标检测和分割任务上的性能。

减少量化 YOLO 网络训练中的振荡副作用

Reducing the Side-Effects of Oscillations in Training of Quantized YOLO  Networks

Bayesian learning of model parameters in neural networks is important in
scenarios where estimates with well-calibrated uncertainty are important. In
this paper, we propose Bayesian quantized networks (BQNs), quantized neural
networks (QNNs) for which we learn a posterior distribution over their discrete
parameters. We provide a set of efficient algorithms for learning and
prediction in BQNs without the need to sample from their parameters or
activations, which not only allows for differentiable learning in QNNs, but
also reduces the variance in gradients. We evaluate BQNs on MNIST,
Fashion-MNIST, KMNIST and CIFAR10 image classification datasets, compared
against bootstrap ensemble of QNNs (E-QNN). We demonstrate BQNs achieve both
lower predictive errors and better-calibrated uncertainties than E-QNN (with
less than 20% of the negative log-likelihood).

该论文提出了 Bayesian quantized 网络（BQN），并引入了一系列有效算法，用于在离散参数上学习和预测，实现了对图像分类的有效完成。