JASPER: Special Session on Joint Reliability And Security Assessment of SPlit Computing for Edge Robustness

I. INTRODUCTION

• Split Computing partitions DNN inference between an edge Head model and cloud Tail model, while feature-map compression reduces communication overhead for safety-critical deployment.The approach combines edge response and energy benefits with cloud computational resources.Source: §I · p. 1
• Hardware faults and adversarial perturbations can both cause incorrect decisions, but are traditionally assessed independently with different metrics.The separation gives only a partial view because reliability and security optimizations may affect each other's robustness.Source: §I · pp. 1–2
• The paper jointly evaluates fault-injection reliability and feature-map adversarial security, then combines them in JVS with a confidence-aware extension.The extension captures prediction errors and confidence degradation under perturbations.Source: §I · p. 2
• Evaluation covers ten ResNet-50 Split Computing configurations using CRBQ and Entropic Student compression on ImageNet-2012.The evaluation subset contains 625 images spanning major super-classes among the original 1,000 categories.Source: §I · p. 2

A. Evaluation strategy

• The reliability analysis concerns mobile-device computing errors and assumes ideal communication channels and cloud Tail-model operation.The stated setting targets hardware faults on mobile devices such as drones or robots.Source: A. Evaluation strategy · p. 2
• Fault campaigns corrupt the Head model at application level to emulate hardware-accelerator fault effects propagating through inference.The fault model represents permanent faults or timing effects in defective embedded-GPU multiply-accumulate units.Source: A. Evaluation strategy · pp. 2–3
• The evaluation injects multi-bit flips into intermediate feature maps according to matrix-multiplication tiling on embedded GPUs.A faulty streaming multiprocessor can corrupt tile values across one or more threads.Source: A. Evaluation strategy · p. 3
• Tile Size (TS), Block Error Rate (BER), and Neuron Error Rate (NER) determine which feature-map locations receive random single-bit flips.BER is the portion of tiles executed in a faulty-MAC streaming multiprocessor; NER is the fraction of neurons corrupted within a tile.Source: A. Evaluation strategy · p. 3
• Faulty inference is compared with golden execution using MRAD for classification changes and Top1/Top-2 confidence margin R∆ for output-distribution shifts.The analysis also tracks confidence changes because faults can alter logits without changing the predicted class.Source: A. Evaluation strategy · p. 3

B. Experimental results

• The experiments evaluate six CRBQ configurations and four Entropic Student configurations on ImageNet.The Entropic Student compression factors are β ∈ {0.64, 1.28, 2.56, 5.12}.Source: B. Experimental results · p. 3
• Fault injection uses 32×32 tiles, with NER values from 2% to 10% and BER values from 20% to 100%.Both error rates are swept across five settings.Source: B. Experimental results · p. 3
• Experiments run on a workstation with an Intel i9-10800 CPU, 32 GB RAM, and an NVIDIA RTX 3060TI GPU.The passage identifies the experimental hardware platform.Source: B. Experimental results · p. 3

1) Misclassification rate deviation:

• At BER = 0.1, CRBQ(12) has the lowest MRAD (52.67%), while Entropic Student MRAD ranges from 44.32% (β = 0.16) to 54.79% (β = 2.56).For CRBQ, CRBQ(2) reaches 61.19% at BER = 0.1; for Entropic Student, β = 0.16 remains lowest across the BER range.Source: Figure 3 · p. 4, 1) Misclassification rate deviation · p. 4
• At BER = 0.08, MRAD increases with compression factor β, from 43.69% at β = 0.16 to 53.28% at β = 2.56, a 9.59-percentage-point rise.Source: 1) Misclassification rate deviation · p. 4

2) Probability distribution deviation:

• For CRBQ(3), R∆ rises from 4.67 in the 0−6.67% MRAD interval to 73.91 in the 86.67−93.33% interval.At 93.33−100.0% MRAD, the margin collapses for all CRBQ configurations except CRBQ(1).Source: 2) Probability distribution deviation · pp. 4–5, Figure 4 · p. 5
• For Entropic Student β = 5.12, R∆ rises from 1.63 in the lowest MRAD interval to 87.90 in the highest interval.The passage reports that larger β values tend to have wider confidence margins at higher MRAD levels.Source: 2) Probability distribution deviation · p. 5

A. Evaluation strategy

• An attacker with access to the physically exposed Head and its intermediate feature maps can craft attacks without altering model parameters.The threat model concerns the device-side attack surface, not attacks that corrupt the wireless link between Head and Tail.Source: A. Evaluation strategy · pp. 5–6
• The gray-box attack iteratively updates the input using the bottleneck feature-map gradient, with perturbation budget ϵ setting attack strength.It stops when the predicted class changes or after 33 iterations, while keeping pixels within the valid image range.Source: A. Evaluation strategy · pp. 5–6
• ASR counts top-1 prediction changes across all 625 images, while relative S∆ reduction measures confidence-gap loss only on unchanged predictions.These security metrics are aligned with reliability-side accuracy degradation and the same Top-1/Top-2 confidence gap for joint assessment.Source: A. Evaluation strategy · p. 6

B. Experimental results

• 98.8% mean ASR is reached by the six CRBQ models at ϵ = 0.01, up from 76.6% at ϵ = 0.001.Mean attacked accuracy falls from 23.8% to 3.1% over those budgets, against mean golden accuracy of 83.6%.Source: 1) Attack success across the… · p. 6
• CRBQ 2 and CRBQ 3 remain the most resistant across budgets, while CRBQ 1 reaches 100% ASR at ϵ = 0.01.At ϵ = 0.003, their ASRs are 83.2% and 83.8%, respectively; CRBQ 1 is the most sensitive configuration in the sweep.Source: 1) Attack success across the… · p. 6
• Higher Entropic Student β gives higher ASR, with β = 2.56 and β = 5.12 already near saturation at small perturbation budgets.At ϵ = 0.001, ASR is 90.7% for β = 2.56 and 96.2% for β = 5.12; both reach 100% in the sweep.Source: 1) Attack success across the… · p. 6

2) Output confidence and uncertainty:

• For Entropic Student, confidence-gap reduction rises from 33.1% to 47.4% for β = 0.64 and from 36.9% to 48.7% for β = 1.28 between ϵ = 0.001 and ϵ = 0.005.The β = 2.56 and β = 5.12 curves are defined only at smaller budgets because almost no predictions remain unchanged at larger budgets.Source: 2) Output confidence and uncertainty · pp. 6–7, Figure 6 · p. 7
• [Figure 6](not a link) shows S∆ reduction versus ϵ; across CRBQ models the mean reduction rises from 39.0% at ϵ = 0.001 to 55.6% at ϵ = 0.005.At ϵ = 0.003, CRBQ 2 has a 37.2% reduction and CRBQ 12 has a 55.3% reduction.Source: 2) Output confidence and uncertainty · p. 6, Figure 6 · p. 7
• Compression strategy affects both prediction flips and confidence left on surviving predictions, so security assessment must account for the compression mechanism and perturbation budget.CRBQ 2 and 3 show the strongest tested CRBQ resistance, while β = 5.12 saturates earlier and has too few unchanged predictions at larger budgets for stable confidence-gap estimates.Source: 2) Output confidence and uncertainty · p. 7

• The work aims to treat reliability and security together as a single feature of robustness to better explain system vulnerability and threat impact.Source: §IV · p. 7
• Improving security does not necessarily improve system reliability.Source: §IV · p. 7
• Improving reliability may negatively affect security.Source: §IV · p. 7

A. Evaluating Reliability and Security as a joint SC system robustness feature

• JVS combines MRAD from fault-induced accuracy degradation with ASR from adversarial simulations to capture vulnerability to both threats.A high JVS indicates high vulnerability to injected faults or adversarial attacks.Source: A. Evaluating Reliability and Security… · pp. 7–8
• MRAD and ASR are comparable 0–100 vulnerability scores measuring model misclassification, although the misclassifications have different causes.MRAD is the normalized reliability score under faults; ASR quantifies vulnerability under adversarial simulations.Source: A. Evaluating Reliability and Security… · pp. 7–8
• Figures 7–9 cover JVS by perturbation pattern and security configuration, Rtot and Stot versus BER and ϵ, and extended JVS by configuration and target layer.The extended metric accounts for accuracy and confidence-score degradation.Source: Figure 7 · p. 8, Figure 8 · p. 8, Figure 9 · p. 9
• The framework aligns independently collected fault and attack measures by JVS and configuration after averaging reliability indicators, despite their different experimental parameters.Fault campaigns use BER, while attack simulations use perturbation magnitude ϵ.Source: A. Evaluating Reliability and Security… · pp. 8–9
• The confidence-aware reliability and security terms combine outcome and confidence information through weighted averages, with α denoting fault prediction-change rate and β denoting ASR.The confidence complements quantify lost prediction confidence as uncertainty.Source: A. Evaluating Reliability and Security… · p. 9
• The extension replaces MRAD and ASR with Rtot and Stot, incorporating confidence loss; configurations preserving correctness and large confidence margins receive lower scores.It therefore captures both prediction changes and how confidently predictions are produced.Source: A. Evaluating Reliability and Security… · p. 9

B. Experimental Results

• JVS maps security perturbation magnitude ϵ to a BER-corresponding corruption intensity, aligning reliability and security measurements on a common perturbation axis.The joint metric stresses the model with ϵ and BER together, unlike Stot and Rtot, which vary one corruption axis in isolation.Source: B. Experimental Results · p. 10
• JVS consistently increases as perturbation intensity rises, capturing the cumulative impact of hardware faults and adversarial perturbations across Split Computing configurations.Figure 7 reports JVS over increasing perturbation levels.Source: B. Experimental Results · pp. 9–10
• CRBQ 9 and CRBQ 6 show the highest JV Stot vulnerability, while Entropic Student β = 5.12 achieves its lowest vulnerability.Higher compression factors generally produce larger JVS values for both strategies, whereas lower compression settings maintain smaller values across the evaluated range.Source: B. Experimental Results · p. 10
• JV Stot increases monotonically with perturbation level and distinguishes configurations with similar misclassification rates but different confidence margins.It incorporates prediction errors and confidence degradation, providing clearer separation than the original JVS metric.Source: B. Experimental Results · p. 10
• For CRBQ 1, Stot and Rtot remain essentially unchanged from scale 0.01 to 0.03, while JV Stot shows a sharp low-scale collapse under simultaneous corruption.Single-axis sweeps do not reveal this behavior.Source: B. Experimental Results · p. 10
• For Entropic Student at low BER, β = 2.56 ranks among the best by Rtot but among the worst by JV Stot; at low ϵ, β = 0.64 is best by JV Stot.At medium or high ϵ, β = 5.12 remains best by JV Stot, showing that configuration rankings depend on the joint metric and perturbation level.Source: B. Experimental Results · p. 10

V. CONCLUSION

• The framework combines neuron-level fault injection and feature-map-aware adversarial attack simulations to assess reliability and security in Split Computing.It introduces JVS and a confidence-aware extension that captures prediction errors and confidence degradation.Source: §V · p. 10
• MRAD ranges from 44.3% to 61.2% under fault injection, while adversarial attacks achieve up to 98.8% ASR.The evaluation uses ten Split Computing configurations based on ResNet-50 trained on ILSVRC-2012.Source: §V · p. 10
• The joint metrics reveal vulnerability trends hidden when reliability and security are analyzed independently.The paper presents them as a more comprehensive methodology for designing dependable Split Computing systems.Source: §V · p. 10