Nowadays, quantized Neural Networks (QNNs) are increasingly deployed in safety-critical scenarios based on resource-constrained edge devices, making resilience evaluation of paramount importance. Current studies investigate transient or permanent faults in a separate way leaving a gap between hardware- and application-level fault analysis. This paper deals with this gap by presenting a novel fault-correlation methodology that analyses the QNN behavior under transient bit-flips and permanent stuck-at faults. The proposed approach experimentally demonstrates that the impact of permanent hardware faults, which are known to be computationally costly, can be effectively estimated through extremely fast application-level fault injections. The experimental results have been gathered in three image-classification QNNs (MobileNetV1, EfficientNetB0, and ResNet18) deployed in a RISC-V based SoC, and show an average cross-correlation of 87.05% in the three experiments between the two fault models under evaluation.

Deep learning has become a central tool in power side-channel analysis, supporting not only key recovery from measured traces but also the detection of key-dependent patterns, templates, and leakage structure. Despite this progress, the use of deep learning for leakage assessment at the Register-Transfer Level (RTL) remains largely unexamined. RTL-level switching activity provides the earliest point in the design flow where power side-channel leakage can be assessed, offering fast analysis while avoiding the complexity and cost associated with gate-level evaluation. This paper presents the first study that applies both unsupervised and supervised deep learning to power side-channel evaluation at RTL-level. An unsupervised Convolutional Long Short-Term Memory (ConvLSTM) autoencoder is used to learn temporal representations without key labels, and a supervised Convolutional Neural Network (CNN) is included to provide a profiling-style reference. Both models are evaluated using 40,000 RTL switching-activity proxies generated with VeriSide for AES-128 executions on a CVA6 core with an AES-64 accelerator. The unsupervised model achieves precise key distinguishability and consistent leakage localization, approaching the supervised baseline with moderately higher trace requirements. The results show that deep learning can expose exploitable leakage directly at the RTL stage, motivating the integration of mitigation strategies early in the digital design process.

Side-channel attacks exploit data-dependent variations in power consumption to recover secret information from hardware implementations. Detecting leakage at early design stages is critical, as post-synthesis or silicon-level fixes are costly and limited. At the RTL level, power is commonly approximated using switching-activity-based proxies, such as Hamming Weight (HW) or Hamming Distance (HD), which effectively model the activity factor in the dynamic power equation. Prior work has focused on scalable extraction and statistical analysis of such traces, without explicitly considering the device structural properties that may influence the effective capacitive term. This work investigates the integration of structural information at RTL to better approximate the capacitive component of dynamic power. VeriSide-II introduces a structure-aware proxy that augments switching activity with fan-out and combinational depth to form a more accurate capacitance model. Validation against post-synthesis gate-level power achieves approximately 93% correlation. As a second validation, a comparison against FPGA measurements shows up to a 10% improvement in diagonal-band correlation over activity-only formulations, while preserving leakage alignment under representative CPA experiments. These results experimentally demonstrate that incorporating structural awareness at RTL improves power-proxy fidelity and strengthens consistency between simulation-based and hardware-observed leakage, enabling more reliable early-stage side-channel assessment.

Deep Neural Networks (DNNs) are increasingly deployed in safety-critical and high-performance computing systems, often relying on specialized hardware accelerators such as systolic arrays to achieve high throughput and energy efficiency. However, the growing complexity of DNN models and the continued scaling of semiconductor technologies expose these systems to reliability challenges caused by transient and permanent hardware faults. Assessing the reliability of DNN inference on systolic arrays is essential, yet existing approaches face significant challenges: microarchitecture-level fault injection is prohibitively slow for modern DNNs, while purely software-level methods may not accurately capture hardware-specific fault propagation. This special session presents three complementary contributions addressing these challenges. First, Systolic Array Fault-Propagation Analysis (SAFPA) is a method that enables reliability assessment orders of magnitude faster than microarchitecture-level simulation, with support for multiple systolic array dataflows. Second, an error-driven iterative statistical fault injection methodology is presented that minimizes the number of required fault injections while preserving statistical validity, which is particularly advantageous for large fault populations. Third, a hardware-aware simulation-based fault injection framework (FLAUERS) that bridges the gap between algorithm-level and RTL-level analysis by leveraging the mathematical structure of systolic arrays. Together, these contributions advance the state of the art in efficient and accurate reliability assessment of DNN accelerators.

In safety-critical applications such as autonomous driving and robotics, the reliability of Deep Neural Networks (DNNs) performing video semantic segmentation is paramount. However, detecting hardware-induced faults in these complex tasks remains a challenge. State-of-the-art methods often evaluate fault criticality using overly conservative metrics like mean Intersection over Union (IoU) or Pixel Accuracy (PA). Furthermore, for online detection, they typically require invasive white-box access to internal states and miss transient faults by analyzing only single frames. To address these limitations, this work proposes a novel, unsupervised Spatio-Temporal Fault Detection framework. The proposed Single Frame and Temporal Consistency (SFTC) methodology leverages a dual-phase strategy: Single Frame Consistency (SFC), which evaluates geometric features (Area, Position, Symmetry, Shape) to identify structural degradations within single frames, and a Temporal Consistency (TC), which monitors frame-to-frame dynamics to detect transient faults that violate structural and visual continuity. To validate this approach, we present an extension of the Faulty Output Dataset (FOD), now covering both outdoor automotive scenarios (Fast-SCNN on Cityscapes) and indoor robotic environments (ESANet on NYU Depth V2). Experimental results for both permanent and transient faults demonstrate that the synergy between spatial and temporal monitoring significantly enhances reliability, achieving a detection rate increase of up to 9.14% compared to the state-of-the-art performance, by operating in a fully black-box way.

The deployment of Deep Learning models on resource-constrained edge devices exposes them to security threats, particularly Model Extraction Attacks (MEAs) that aim to steal proprietary knowledge or compromise system reliability. While many mitigations exist for cloud environments, they are typically too resource-intensive for microcontrollers, leaving edge devices vulnerable. This paper introduces a lightweight mitigation against query-based MEAs against models deployed on edge devices. The proposed technique leverages Latent Space Projection and Random Fourier Features to obfuscate model outputs with negligible effects on accuracy and performance. The approach was implemented and validated on a STM32 micro-controller running a CNN for presence detection. Experimental results demonstrate that the mitigation reduces the fidelity of an extracted surrogate model from 95% to approximately 29%. This is achieved with low memory overhead and no perceptible latency impact, making it suitable for real-time, low-power IoT applications.

Today’s electronic devices are increasingly powered by deep learning algorithms to perform various tasks, from pedestrian recognition in self-driving cars to detecting health problems in low-cost, low-power wearable devices. However, despite the claimed built-in redundancy of deep learning models, the literature shows that they are susceptible to random-hardware faults: even a single corrupted bit can lead to catastrophic failures. Therefore, it is crucial to discover novel, smart, and low-cost fault detection solutions that can be used in the field to stop the propagation of critical faults. This study explores the fault-detection capabilities of mathematical metrics typically used in domains such as image processing, audio analysis, and regression. These metrics, applied to intermediate output tensors of convolutional layers, effectively detect early failures and stop their propagation, saving computational time, costs, and power. Fault injection campaigns are performed on three Convolutional Neural Networks (CNNs) to test the fault detection capability of 15 metrics. The outcomes show their effectiveness in detecting permanent faults with a very high true positive rate. Among the different metrics, the experimental analysis highlighted three metrics that demonstrated notable performance based on their Receiver Operating Characteristic (ROC) curves and corresponding confusion matrices: Minkowski distance, Mean Squared Error (MSE), and the TSum metric. By introducing trade-offs between sensitivity (true positive rate) and specificity (false positive rate), it is possible to identify between 88.63% and 97.13% of critical faults while sacrificing only between 0.27% and 0.31% of total inferences which are unnecessarily re-executed.

This paper investigates the use of Approximate Computing (AxC), specifically functional approximation, to enhance the resilience of Deep Neural Networks (DNNs) against hardware faults in various applications, including safety-critical systems such as autonomous vehicles. As deploying DNNs requires balancing performance, energy efficiency, and reliability, traditional methods often achieve reliability through redundancy, which can increase area, power consumption, and latency. Our work shows preliminary results that leveraging approximate multipliers can, under some conditions, lead to energy reductions without compromising DNN resilience, under the right conditions. We evaluate the impact of approximation on DNN performance and robustness, exploring the interplay between energy efficiency and fault tolerance. Through comprehensive benchmarking, we highlight the potential of AxC to enable more efficient and reliable DNN implementations, paving the way for advanced applications in real-time and edge computing environments. Results obtained on four different DNNs show that it is possible to achieve up to a 3 & times; reduction in power consumption without any negative impact on resilience.

This paper encompasses three contributions by university professors and researchers. The presentations vary from the state-of-the-art of VLSI benchmarks for testing and reliability and their importance for the research community, to the advent of new benchmarks to address the current complexity gap with industrial designs and enable researchers to effectively validate their methodologies.

Reliability against memory-induced transient faults is a critical requirement for quantized neural networks (QNNs) deployed in safety-critical edge environments. This paper proposes an in-place fault detection strategy that embeds Cyclic Redundancy Check (CRC) codes directly into the Least Significant Bits (LSBs) of 8-bit quantized weights, achieving zero storage overhead by repurposing weight precision for granular reliability. The scheme leverages a vectorized routine optimized for the RISC-V Ibex architecture, exploiting SIMD-within-a-register (SWAR) techniques to validate weights. Cycle-accurate simulations on the lowRISC Ibex core (RV32IMC) experimentally demonstrate that the proposed CRC-Vectorized approach achieves a throughput of 9 clock cycles per weight, outperforming its results software-based ECC counterpart by 10%. Experimental across four image classification workloads on the CIFAR-10 dataset show that while this accuracy-for-reliability trade-off entails an average accuracy drop of 6.72% (using CRC-3), it provides robust fault coverage: 100% detection for single-bit flips and 3-bit burst errors, and 92.22% for double-bit errors. This solution shows an excellent reliability-performance balance, suitable for resource-constrained edge devices.

Control-flow integrity (CFI) is a fundamental defense against control-flow hijacking attacks that corrupt return addresses, and hardware-supported shadow stacks have been adopted in several mainstream processor architectures to provide backward-edge protection. The RISC-V Zicfiss extension introduces analogous CFI support into the RISC-V ecosystem, yet its practical integration into RISC-V processors remains largely unexplored. This paper presents a case study on integrating Zicfiss shadow stack support into the CVA6 processor, an opensource application-class RISC-V core representative of systems executing rich operating systems and user applications. The extension's architectural behavior is implemented and validated across privilege levels, establishing a correct and specificationaligned baseline for enforcing backward-edge CFI. This work enables a systematic study of control-flow protection mechanisms in advanced RISC-V designs. It provides a foundation for future investigations into robustness and hardening against physical and microarchitectural attack vectors.

Convolutional Neural Networks (CNNs) have become common in diverse applications, including safety-critical domains such as autonomous driving, where ensuring reliability is crucial. CNNs reliability can be jeopardized by the occurrence of hardware faults during the inference, leading to severe consequences. In recent years, gradient regularization (GR) gained attention as a technique able to improve generalization and robustness to Gaussian noise injected into the parameters of neural networks, but no study has been done considering its fault-tolerance effect. This paper analyzes the influence of GR on CNNs reliability for classification tasks in the presence of random hardware faults, exploring impacts on the network’s performance and robustness. Our experiments involved simulating permanent stuck-at faults through statistical fault injection and assessing the reliability of CNNs trained with and without GR. Experimental results point out that regularization reduces the masking ability of neural networks, paving the way for efficient in-field fault detection techniques that aim at unveiling permanent faults. Specifically, it systematically reduces the percentage of masked faults up to 15

Modern RISC-V designs are increasingly integrating cryptographic accelerators to provide better security features while enhancing performance; however, their vulnerability to power side-channel attacks remains insufficiently investigated. This paper presents a comprehensive evaluation of such vulnerabilities in a RISCV-based AES accelerator connected via the Core-V eXtension Interface (CV-X-IF). The analysis begins at the RTL using simulated power traces, employing KL (Kullback–Leibler) divergence alongside established statistical attacks such as Correlation Power Analysis (CPA) and Differential Power Analysis (DPA). Although the former serves as an early indicator of potential leakage, simulation results highlight its limitations compared to CPA and DPA. To validate these findings, leakage trends are further examined through FPGA-based power measurement. The proposed methodology is designed to be broadly applicable to a range of cryptographic workloads and accelerator architectures. It is demonstrated on an AES accelerator implementing the scalar cryptographic extension (Zk) with pre-expanded keys. Our findings reveal that side-channel vulnerabilities can persist even in tightly integrated instruction pipelines, underscoring the importance of early-stage leakage assessment. Notably, the close alignment between RTL-level simulations and FPGA-based measurements highlights the effectiveness of the approach and its practical value for guiding secure hardware design in RISC-V ecosystems. In particular, AES serves only as a case of study; the proposed RTL and FPGA validation flow is generic and can be applied to any cryptographic accelerator.

Nowadays, AI applications are becoming extremely popular in our everyday life as well as for the industry. Recent incidents involving hyperscalers have revealed that even cloud-based datacenter hardware can experience failures leading to Silent Data Corruptions (SDCs), also called Silent Data Errors (SDEs). This Special Session delves into the implications of such failures on AI workloads, both during training and inference, and explores methodologies for efficiently detecting SDCs or SDEs through dedicated monitoring phases.

The complexity of the state-of-the-art devices makes reliability assessments approaches extremely complex and, sometimes, out of the timing constraints and computational capabilities. Fault Injections (FIs) are one of the most used approaches for evaluating the dependability of safety-critical systems. With billion-transistor hardware devices running trillion-parameter deep neural networks, injecting the entire fault universe is unfeasible. A widespread solution consists in performing statistical fault injections (SFIs), injecting a subset of faults to estimate a characteristic with an error margin and a confidence level. This research work presents an iterative SFI approach to estimate failure rates in convolutional neural networks (CNNs), i.e., the percentage of wrong predictions caused by random hardware faults affecting synaptic weights. SFIs at different granularities have been performed with margin of errors equal to 1%, 0.1%, and 0.01%. Results for two CNNs (ResNet20 and MobileNetV2) are presented and experimentally and statistically demonstrate the effectiveness of the proposed approach. For instance, to estimate the network-wise failure rate with an error margin of 0.01%, the proposed approach reduces the total injected faults by about 66% and 90% compared to conservative methods, and by 1.94% and 1.65% compared to iterative SFI methods in the literature, for ResNet20 and MobileNetV2, respectively.

Leakage assessment at the Register Transfer Level (RTL) is essential for identifying vulnerabilities in various designs, including cryptographic systems, AI models, and other applications handling sensitive data during the design phase. This paper introduces VeriSide, an innovative framework built as a modified version of Verilator to generate compact format files that directly capture side-oriented information, such as Hamming Distance (HD) or Hamming Weight (HW) of the signals. VeriSide streamlines the power side-channel (PSC) analysis process by providing efficient and scalable solutions for large-scale designs. Traditional methods relying on verbose Value Change Dump (VCD) or Switching Activity Interchange Format (SAIF) files face significant scalability and resource challenges, especially for complex systems-on-chip (SoCs). These methods incur substantial storage and processing overheads. VeriSide overcomes these limitations by drastically reducing file size and eliminating post-simulation memory usage, while maintaining analysis accuracy.

Assessing AI systems reliability is essential before deploying them in safety-critical applications. While recent efforts have focused on improving model resilience to random hardware faults, meaningful comparison remains difficult due to the lack of standardized reference models. Different authors use different implementations, which makes comparisons unfair and biased: resilience is influenced by the training processes, the software framework, and data representations. To address these issues, this work introduces a benchmark suite of CNN models to test the resilience of DNNs. The benchmark is structured on different axes: software framework, hardware platform, data representation, task and dataset. It is aimed at providing a shared foundation for fair and reproducible resilience evaluation.

Security in modern RISC-V processors demands more than functional correctness: It requires resilience to side-channel attacks. This paper evaluates the vulnerability of the side channel of the CVA6 RISC-V core by analyzing software-based AES encryption uses an RTL-level power profiling framework called VeriSide. This work represents that this design's Correlation Power Analysis (CPA) reveals significant leakage, enabling key recovery. These findings underscore the importance of early-stage RTL assessments in shaping future secure RISC-V designs.

In recent years, research and technology advancements have driven exponential growth in the adoption of Artificial Intelligence (AI)-based systems, even in safety-critical contexts such as autonomous driving and healthcare applications. The joint effort of academia and industry has yielded techniques and standards with the objective of ensuring the safe operation of AI-based technology. In the specific context of Convolutional Neural Networks (CNNs) running on GPUs, Image Test Libraries (ITLs) have been proposed as an effective method for performing on-line functional testing of GPU multipliers. This is achieved by launching the inference of a set of test images containing a set of ATPG-generated functional test patterns. However, while the demand for computational power for DNN models is constantly increasing, another branch of Machine Learning (ML) research, namely TinyML, focuses on minimizing the computational requirements of DNN models in order to bring AI capabilities to edge devices, whose constraints on power usage, memory space and processing power do not allow for the deployment of conventional DNN models. This research work aims to adapt the ITL technique to CNNs running on ultra-low-power edge hardware, while also overcoming some limitations of GPU ITLs. Experimental results demonstrate that a single test image generated using the proposed method is capable of detecting 96.01% of stuck-at faults occurring in the 32-bit integer multiplier of a RISC-V-based ultra-low-power System-on-Chip executing a quantized CNN.