Robustness of Neural Networks against
Storage Media Errors

arXiv:1709.06173v1 [cs.IT] 18 Sep 2017

Minghai Qin, Chao Sun, and Dejan Vucinic
Western Digital Research, San Jose, CA, USA,
{Minghai.Qin, Chao.Sun, Dejan.Vucinic}@wdc.com

Abstract—We study the trade-offs between storage/bandwidth
and prediction accuracy of neural networks that are stored in
noisy media. Conventionally, it is assumed that all parameters
(e.g., weight and biases) of a trained neural network are stored
as binary arrays and are error-free. This assumption is based
upon the implementation of error correction codes (ECCs) that
correct potential bit flips in storage media. However, ECCs add
storage overhead and cause bandwidth reduction when loading
the trained parameters during the inference. We study the robustness of deep neural networks when bit errors exist but ECCs
are turned off for different neural network models and datasets.
It is observed that more sophisticated models and datasets are
more vulnerable to errors in their trained parameters. We propose a simple detection approach that can universally improve
the robustness, which in some cases can be improved by orders of
magnitude. We also propose an alternative binary representation
of the parameters such that the distortion brought by bit flips
is reduced and even theoretically vanishing when the number of
bits to represent a parameter increases.

I. I NTRODUCTION
Neural networks (NNs) [1], [2] are layered networks that try
to fit the function of neurons in a human brain during object
recognition, decision making, etc. They are one of the most
widely-used machine learning techniques due to their good
performance in practice. Some variants of neural networks are
shown to be more suitable for different learning applications.
For example, deep convolutional neural networks (CNNs) [3],
[4] are found to be effective in recognizing and classifying
images. Recurrent neural networks (RNNs) [5], [6] provides
stronger performance in sequence prediction, e.g., speech or
text recognition. Compared to standard feed-forward neural
networks with full connections, CNNs have much less number
of connections in the convolutional layers and thus much fewer
parameters to train, possibly avoiding the over-fitting problems. RNNs have memory units like long-short-term-memory
(LSTM) [7] that can be trained without vanishing/exploding
gradient problems. The neural networks are determined by the
connections between neurons, each of which is associated with
a trainable parameter called a weight. There is another parameter associated with each neuron called a biase. Since a bias
can be viewed as a weight from a neuron with constant input,
we will indiscriminately call it a weight as well. The set of
all trainable weights are trained by back-propagation [8], [9]
in the training process.
In order to fit highly non-linear functions and thus achieve
a high rate of correctness in practice, neural networks usually
contain millions to billions of weights trained from a large
dataset in a careful manner to avoid over-fitting problem.

In the current technology, the weights are usually stored in
non-volatile memories (NVMs) and are loaded to CPU/GPU
caches to make predictions for input (e.g., images, voices,
or texts) during inference phase. NVMs are noisy media
where bit errors can happen during writing, reading, or retention. Error correction codes (ECCs) [10] are ubiquitously
used in NVM systems to guarantee data reliability by adding
10% to 20% storage redundancy. There are two major reasons why we study the robustness of neural networks when
weights stored in noisy NVM media are not fully recovered
by ECCs. Firstly, the GPU caches have limited size (usually in Giga-byte range) but the size of the neural network
models grow fast since the cost of gathering big data becomes smaller. If caches in a single or multiple GPUs cannot
hold all weights of a neural network model, the bandwidth
of loading them from NVMs to GPU caches would affect the
system performance, especially for high throughput applications, such as video recognition during self-driving where
the number of frames processed per second positively correlates to the safety factor. The storage overhead brought
by ECCs will add latency and reduce the throughput of the
NVM chips. Secondly, there is a growing number of research
on using NVMs themselves (or built-in unit on NVM chips)
for calculations in neural networks instead of CPU/GPU centered calculation. The benefit of this in-memory computing
comes from the highly parallelism of NVM systems, but
ECCs might have to be weakened or abandoned depending
on the design of the computing system.
Robustness of neural networks has been studied against random and adversarial noise. [11] provides adversarial attack algorithms on input and defensive distillation towards evaluating
the robustness of neural networks. [12] proposed training algorithms that address the issue of output instability when the input is slightly distorted. [13] and [14] studied neural networks
with binary or ternary weights, whose training algorithms are
adjusted.
In this paper, we study the robustness of a trained neural
networks when they are stored in noisy media. The neural
networks are trained using floating-point number calculations
on GPUs and the real-valued weights are stored in binary arrays. We will review some mappings from real numbers to
fixed-length binary arrays. Each bit in the binary array will
be flipped identically and independently with some probability, called raw bit error rate (RBER), and the accuracy of
the distorted neural networks will be examined. We then propose a simple operation to improve the accuracy by adding a
check bit for each weight. Several datasets and neural network

models are examined to confirm the universal benefits brought
by the proposal. Finally, we provide some theoretical analysis on the binary representations of real numbers such that the
bit-flip-incurred distortion can be reduced.
II. P RELIMINARIES

be unfolded (Fig. 2) in time to form a feedforward neural
network for training purposes. One of the most widely used
neurons to store the states is LSTM, consisting of forget-gate,
update-gate, and output-gate. Back-propagation algorithms can
be applied from the last output neurons backwards to train all
weights in the RNN.

A. Neural networks and notations
A neural network contains input neurons, hidden neurons,
and output neurons. It can be viewed as a function f : X → Y
where the input x ∈ X ⊆ Rn is an n-dimensional vector and
the output y ∈ Y ⊆ Rm is an m-dimensional vector. In this
paper, we focus on classification problems where
output
Pthe
m
y = (y1 , . . . , ym ) is usually normalized such that i=1 yi = 1
and yi can be viewed as the probability for some input x to be
categorized as the i-th class. The normalization is often done
by the softmax function that maps an arbitrary m-dimensional
vector ŷ into normalized y, denoted by y = sof tmax(ŷ), as
i)
, i = 1, . . . , m. For top-k decision problems,
yi = Pmexp(ŷ
i=1 exp(ŷi )
we return the top k categories with the largest output yi . In
particular for hard decision problems where k = 1, the classification results is then arg maxi yi , i = 1, . . . , m.
A feedforward neural network f that contains n layers (excluding the softmax output layer) can be expressed as a concatenation of n functions fi , i = 1, 2, . . . , n such that f =
fn (fn−1 (· · · f1 (x) · · · )). The ith layer fi : Xi → Yi satisfies
Yi ⊆ Xi+1 , X1 = X . The output of last layer Yn is then fed
into the softmax function. The function fi is usually defined
as
fi (x) = σ(W · x + b),
where W is the weights matrix, b is the bias vector, and σ is
an element-wise activation function that is usually nonlinear,
e.g., sigmoid and rectified linear unit (ReLU). Both W and b
are trainable parameters.
A convolutional neural network (CNN) (Fig. 1) is a special
class of feedforward neural network that has local weights
constraints, e.g., the weights connecting neurons are all zeros
except for a few pair of neurons between adjacent layers, and
the value of weights between different pair of neurons in two
layers with similar spatial relationships are forced to be the
same. Therefore, a CNN layer has much less parameters to
train compared to a fully connected layer and is good at extract local features from the previous layer, which enable it to
be the state-of-art technique for image recognition problems.

Fig. 1. Example of a CNN

A recurrent neural network (RNN) is a special class of neural networks that has directed cycles, which enable it to create
internal states and exhibit temporal behaviors. A RNN can

Fig. 2. Unfolding a RNN

In this paper, we focus on exploiting the robustness of deep
CNNs and RNNs on different datasets.

B. Real-valued weights and their binary representations
Assume we have a trained neural network whose weights
are all real numbers. In order to store the real-valued weights
into storage media, each of them needs to be converted into
binary arrays of certain length. Several ways to map real numbers to binary arrays exist, among which the most widely used
is IEEE Standard for Floating-Point Arithmetic (IEEE 754). In
this paper, we focus on 16-bit representations of real numbers
since the precision of 16 bits is high enough to avoid degradation of inference performance due to quantization errors.
1) IEEE Standard for Floating-Point Arithmetic: IEEE 754
provides guidelines to represent a real number r as (−1)s × cq
by 16, 32, 64, 128, and 256 bits, where s is 1-bit of sign, c
is a significand, and q is an exponent. For 16-bit representation, 5 bits are assigned to the exponent with bias equal 15
and the rest 11 bits are used for the 10-bit significand and the
1-bit sign. The largest number that can be represented is (2 −
2−10 ) × 215 = 65504 which is much larger than the weights
in any neural network models. Since almost all weights are
between −1 and +1 (or even much closer to 0), the representation precision is at least 2−11 (numbers between 0.5 and
1), and the precision will increase exponentially when the real
number decreases exponentially to 0.
With the presence of media errors, IEEE standard for
floating-point arithmetic is not a proper representation of
real-valued weights. The major weakness is due to the large
range the IEEE 754 standard can represent. In particular, if the
most significant bit in the exponent is erroneous, the value of
that weight can be inadvertently set to a very large value. For
example, the binary string 0 01101 0101010101 represents
(−1)0 × 213−15 × 1.3330078125 ≈ 0.33, but if the second
bit is flipped and the string becomes 0 11101 0101010101, it
will represent (−1)0 × 229−15 × 1.3330078125 = 21840. This
large value of weight will totally destroy the learned neural network. Since the number of weights is large and each

weight has a few “vulnerable” bits (e.g., some most significant bits in the exponents), there is rarely any robustness in
the trained neural networks against the media errors.
2) Binary expansion: In order to avoid the large distortion
incurred by IEEE 754 standard floating-point number representation, a direct quantization of real numbers between the
minimum-valued weight and the maximum-valued weight can
be implemented. Assume the minimum and maximum weight
is denoted by wmin and wmax , respectively. To convert a weight
into a binary array, the interval [wmin , wmax ] can be quantized
into 2q consecutive subintervals with boundaries
wmin = b0 < b1 < · · · < b2q −1 = wmax ,
where q is the number of bits to represent a weight. For all
weights w ∈ [wmin , wmax ], if w is in the ith interval, i.e., bi 6
w < bi+1 , then w is represented by the q-bit binary expansion of the decimal integer i as (b0 , b1 , . . . , bq−1 ). When the
weights are loaded from binary storage array for calculation,
it can be recovered by


q−1
wmax − wmin  1 X
bj 2j  .
×
+
wrec = wmin +
2q
2 j=0
The binary expansion representation of weights avoids exploding problem in IEEE 754 standard, but it also has weakness in that all bits have different robustness against errors. If
the most significant bit is in error, then the distortion is as large
as half of the range, i.e., |werroneous − wtrue | = 12 (wmax − wmin );
on the other hand, if the bits in the non-significant bits are
in error, the distortion is too small to affect the performance.
The unequal vulnerability of bits might increase the variance
and cause unpredictability and instability of neural networks.
In Section V, a Hamming-distance-based binary representation of real numbers will be proposed to reduce the unequal
vulnerability of the q bits.
III. ROBUSTNESS

OF

but rather explore the performance loss between the undistorted and distorted model. We will later provide schemes to
reduce the performance loss for the same RBER.
A. MNIST
The MNIST database is a large database of handwritten
digits that is commonly used for image processing and machine learning. It includes 60000 training images and 10000
test images of size 28 × 28. We train a convolutional neural
network to classify the 10 digits with the architecture in Table I. According to the table, the convolutional layers have
filters of size 3 × 3 and we use “valid” as the padding scheme.
The max pooling layers have filters of size 2 × 2. The output
of the last fully connected layer is passed through a softmax
layer to make a prediction. The prediction accuracy for this
trained model is 0.9961 when there is no media error.
TABLE I
CNN ARCHITECTURE FOR MNIST
Layer
Conv. 2D(3,3)
Conv. 2D(3,3)
Maxpooling
Conv. 2D(3,3)
Conv. 2D(3,3)
Maxpooling
Fully connected
Fully connected

No. of trainable parameters
320
9248
0
18496
36928
0
262400
2570

Table II shows the average prediction accuracy for different raw bit-error-rate of the media, where all weights are represented by the binary expansion. Note that the accuracy of
RBER= 0 is 0.0002 less than the undistorted model, which
means the loss of the quantization from 32-bit floating point
representation to 16-bit binary expansion is 0.0002. Each data
is obtained by averaging the accuracy of 40 distorted models
sampled independently.

N EURAL N ETWORKS

In this section, we provide a general view of robustness of
neural networks against media errors, where a weight is represented by the binary expansion of the index of its located
intervals. First, we train a neural network for a specific task,
e.g, handwritten digit recognition, using floating-point calculation by GPU. We use 16 bits to represent each trained weight
and it can be seen from our experiments that quantization error is negligible with this precision. Suppose the total number
of weights is N , then the total number of bits to represent the
neural network (excluding the architecture) is 16N . We will
model the media errors as passing through a binary symmetric
channel (BSC) [15], where each bit is flipped with probability
p. The value of p is called the raw bit-error rate (RBER) of
the media. Therefore, the average total number of bit errors is
16N p. One distorted model is then obtained by using this distorted set of weights. For each p, multiple distorted models are
saved and then used to evaluate the inference performance and
approximate the statistics. Note that the robustness of the neural network models is the major concern, thus we did not try
to train and achieve the best accuracy for undistorted models,

Output shape
(26, 26, 32)
(24, 24, 32)
(12, 12, 32)
(10, 10, 64)
(8, 8, 64)
(4, 4, 64)
(256)
(10)

TABLE II
P REDICTION ACCURACY FOR MNIST
RBER
Ave. Acc.
RBER
Ave. Acc.
RBER
Ave. Acc.

0
0.9959
0.005
0.9906
0.01
0.96952

0.001
0.9952
0.006
0.9885
0.011
0.9576

0.002
0.9945
0.007
0.9847
0.012
0.94875

0.003
0.9937
0.008
0.9816
0.013
0.9339

0.004
0.9924
0.009
0.9754
0.014
0.9224

Fig. 3 shows the box plot of the 40 distorted models for
each RBER. The top and bottom of the box are the 25th and
75th percentile of the sample, where the height of the box
is called the interquartile range. The line in the box is the
sample median. The lines extending the top and bottom of the
box is called whiskers which is by default 1.5 interquartile
range away from the top and bottom of the box, respectively.
The observations beyond the whiskers are outliers. It can be
seen that the performance variance increases dramatically with
the increment of RBER.
In order the measure the robustness of neural networks
against media errors, we introduce a robustness measure R(x),
which is defined as follows. Suppose the undistorted model

MNIST

1

Accuracy

0.98

0.96

0.94

0.92

0.9
0

0.001 0.002 0.003 0.004 0.005 0.006 0.007 0.008 0.009

0.01

0.011 0.012 0.013 0.014 0.015 0.016

RBER

10 classes include airplane, automobile, bird, cat, deer, dog,
frog, horse, ship, and truck, where all classes are mutually
inclusive.
VGG nets [16] are convolutional neural networks that have
been shown to achieve a good performance for image recognition. The input of VGG-16 and VGG-19 are both 224 × 224,
which is larger than CIFAR-10 images, thus we skip the last
few layers including two pooling layers to obtain a shortened
VGG-like architecture summarized in Table III.

Fig. 3. Box plot of MNIST database with different probability of media errors

has prediction accuracy A ∈ [0, 1], then R(x), x ∈ [0, 1]
is defined as the maximum RBER that the average accuracy is larger than or equal to Ax. In the sequel, we set
x = 0.95 as default, that is, R = R(0.95) is the maximum RBER that the model can tolerate when the prediction
accuracy is at least 95% of the undistorted model. It can
be seen that the robustness of the CNN for the MNIST is
R ≈ 0.012 (0.012 is the largest RBER with accuracy greater
than 0.9961 ∗ 0.95 = 0.9463).
In order to explore the robustness of each convolutional
layer or fully connected layer against errors, we test the prediction accuracy when weights in each layer are distorted individually. The top figure in Fig. 4 shows the average prediction
accuracy over 40 distorted models for each RBER where bit
errors appear in only one of the six layers. It can be observed
that the robustness is decreasing from the first to the fourth
convolutional layer, possibly due to the fact that the number
of weights is largely increased from the first to the fourth. In
order to take the total number of weights into account, the
bottom figure in Fig. 4 shows the average prediction accuracy
versus the total number of bit errors in each layer. It is reasonable to see that layers with more weights can tolerate more
bit errors at the same prediction accuracy.

TABLE III
CNN ARCHITECTURE FOR CIFAR-10
Layer
Conv. 2D
Conv. 2D
Max pooling
Conv. 2D
Conv. 2D
Max pooling
Conv. 2D
Conv. 2D
Conv. 2D
Max pooling
Fully connected
Fully connected

Output shape
(32,32,64)
(32,32,64)
(16,16,64)
(16,16,128)
(16,16,128)
(8,8,128)
(8,8,256)
(8,8,256)
(8,8,256)
(4,4,256)
(256)
(10)

No. of trainable parameters
1792
36928
0
73856
147584
0
295168
590080
590080
0
1048832
2570

Table IV and Fig. 5 show the accuracy and the box plots for
each RBER for the CIFAR-10 dataset using the CNN architecture in Table III. The robustness of the CNN for CIFAR-10 is
therefore R(0.95) ≈ 2 × 10−5 , much less than the robustness
of the CNN for MNIST dataset.
TABLE IV
P REDICTION ACCURACY FOR CIFAR-10
RBER
Ave. Accu.

0
0.8991

1e-5
0.8789

2e-5
0.8555

3e-5
0.8265

4e-5
0.7984

MNIST. Distort only one layer

1

0.9

0.85

0.96
0.94
0.92

1st: Conv. 2D
2nd: Conv. 2D
3rd: Conv. 2D
4th: Conv. 2D
5th: Full
6th: Full

Accuracy

Accuracy

0.98

0.8

0.9
10 -2

10 -1

0.75

RBER
1

0.7
0

Accuracy

0.98
0.96
0.94
0.92
0.9
10 2

1e-05

2e-05

3e-05

4e-05

5e-05

6e-05

RBER
1st: Conv. 2D
2nd: Conv. 2D
3rd: Conv. 2D
4th: Conv. 2D
5th: Full
6th: Full

Fig. 5. Box plot of CIFAR-10 for different RBERs

10 3

10 4

10 5

10 6

Total No. error bits

Fig. 4. Prediction accuracy when only one of the six layers has bit errors.

B. CIFAR-10
The CIFAR-10 dataset consists of 60000 32 × 32 color images in 10 classes, with 6000 images per class. It is partitioned into 50000 training images and 10000 test images. The

Fig. 6 shows the accuracy versus RBER and versus total
number of bit errors when only one of the nine layers includes
weights with errors. Similar to the CNN for MNIST, the robustness is increasing as from the first convolutional layer with
the minimum weights to the later layers with more weights.
C. IMDB
IMDB is one of the most popular and authoritative source
for movie, TV and celebrity content. The 50000 movie reviews

1st: Conv. 2D
2nd: Conv. 2D
3rd: Conv. 2D
4th: Conv. 2D
5th: Conv. 2D
6th: Conv. 2D
7th: Conv. 2D
8th: Full
9th: Full

0.85

0.8

0.75
10 -5

10 -4

10 -3

10 -2

10 -1

0.85

0.8

Accuracy

Accuracy

0.9

RBER

0.75

0.7

Accuracy

0.9

0.65

1st: Conv. 2D
2nd: Conv. 2D
3rd: Conv. 2D
4th: Conv. 2D
5th: Conv. 2D
6th: Conv. 2D
7th: Conv. 2D
8th: Full
9th: Full

0.85

0.8

0.75
10 1

10 2

10 3

10 4

10 5

Total No. bit errors

0

0.001 0.002 0.003 0.004 0.005 0.006 0.007 0.008 0.009 0.01 0.011 0.012 0.013 0.014 0.015 0.016

RBER

Fig. 7. Box plot of accuracy for IMDB when the LSTM layer has bit errors

Fig. 6. Prediction accuracy when only one of the nine layers has bit errors.

TABLE VII
AVERAGE PREDICTION ACCURACY FOR IMDB WHEN THE EMBEDDING

TABLE V
RNN ARCHITECTURE FOR IMDB

LAYER HAS BIT ERRORS

Layer
Embedding
Conv. 1D
Max pooling
LSTM
Full Connect.

Output shape
(500,32)
(498,32)
(124,32)
(100)
(1)

No. of trainable parameters
160000
3104
0
53200
101

are equally partitioned into training set and test set. Each review is categorized as either “positive” or “negative”.
Recurrent neural networks (RNNs) enables to remember
“states”, which are proved to be useful in understanding languages. We use a simple RNN layer consisting of 100 LSTM
units after an embedding layer and a one-dimensional convolutional layer. The embedding layers transform the word
vector into its corresponding word embeddings [17]. The detailed architecture and the number of trainable parameters in
the model the listed in Table V.
Since we are interested in the RNN (i.e., LSTM) part of the
model, we inject bit errors to the embedding layer and LSTM
layer separately and keep the convolutional layer error-free.
The prediction accuracy of the LSTM layer and the embedding layer against media errors is explored in Table VI, Fig. 7,
Table VII and Fig. 8. The robustness of the LSTM layer and
embedding layer are both R(0.95) ≈ 0.012. Note that the
number of outliers for RNN-based model is more than previous CNN-based image recognition tasks, possibly due to the
fact that the weights in LSTM layers are shared by all LSTM
cells and a small change of weight will affect all LSTM cells.

RBER
Ave. Accu.
RBER
Ave. Accu.
RBER
Ave. Accu.

0
0.8777
6e-3
0.8548
1.2e-2
0.8412

1e-3
0.8765
7e-3
0.8518
1.3e-2
0.8321

2e-3
0.8755
8e-3
0.8502
1.4e-2
0.8231

3e-3
0.8709
9e-3
0.8446
1.5e-2
0.8144

4e-3
0.8652
1e-2
0.8436
1.6e-2
0.8123

5e-3
0.8652
1.1e-2
0.8386
1.7e-2
0.8130

and models in the previous section. The basic approach is to
detect (instead of correct) media errors and set the erroneous
weights to a default value.
Considering a 16-bit representation of one weight, 15 bits
are used to represent the binary expansion of the weights while
the last one bit is used as a check-bit such that the modulo-two
sum of all 16 bits are zero. In this scenario, if any odd number
of bits are flipped from their true values, we can detect that
this weight includes erroneous bits. Since each bit error in media occurs with small probability, one-bit error dominates all
larger number of errors,. Therefore, it is with high probability
that we can detect most of the erroneous weights.
Note that most of the weights are small in their absolute
values after training. We set the values of detected erroneous weights as zeros to minimize the distortion on the
overall model. This is equivalent to remove the corresponding connection between two neurons and we call it weight
nulling. The rest of the section is devoted to the comparison of robustness of neural network with and without weight
nulling.

TABLE VI
AVERAGE PREDICTION ACCURACY FOR IMDB WHEN THE LSTM LAYER
HAS BIT ERRORS

0
0.8777
6e-3
0.8635
1.2e-2
0.8366

1e-3
0.8715
7e-3
0.8596
1.3e-2
0.8369

2e-3
0.8712
8e-3
0.8437
1.4e-2
0.8278

3e-3
0.8702
9e-3
0.8368
1.5e-2
0.8281

4e-3
0.8650
1e-2
0.8373
1.6e-2
0.8247

5e-3
0.8648
1.1e-2
0.8365
1.7e-2
0.8186

0.8

Accuracy

RBER
Ave. Accu.
RBER
Ave. Accu.
RBER
Ave. Accu.

0.85

0.75

0.7

0.65

0.6

0

IV. W EIGHT N ULLING BY A C HECK - BIT
In this section, we provide observations and schemes to improve the robustness of neural networks for the same datasets

0.001 0.002 0.003 0.004 0.005 0.006 0.007 0.008 0.009 0.01 0.011 0.012 0.013 0.014 0.015 0.016

RBER

Fig. 8. Box plot of accuracy for IMDB when the embedding layer has bit
errors

A. MNIST

0.9

No weight nulling
Weight nulling

0.85

Accuracy

Fig. 9 shows the average prediction accuracy of the CNN
architecture defined in Table I with and without weight
nulling technique. The curve labeled as “No weight nulling”
is a graphical restatement of Table II. The horizontal dashed
line indicates 95% accuracy of the undistorted model. It can
be observed that the robustness R(0.95) has been increased
from 0.012 to 0.021 by weight nulling, i.e., to tolerate the
same accuracy loss, the RBER of the media can be increased
by 75%.

0.8

0.75

0.7
10-4

10-3

10-2

RBER

Fig. 11. Average accuracy of the CNN for CIFAR-10 dataset with and without
weight nulling.

1
No weight nulling
Weight nulling

0.9

0.85

0.96

Accuracy

Accuracy

0.98

0.94

0.8

0.75

0.92
0.7
0

0.9
0

0.005

0.01

0.015

0.02

0.0001 0.0002 0.0003 0.0004 0.0005 0.0006 0.0007 0.0008 0.0009 0.001 0.0011 0.0012
RBER

0.025

RBER

Fig. 9. Average accuracy of the CNN for MNIST dataset with and without
weight nulling.

Fig. 10 shows the box plot of the prediction accuracy for
40 independently distorted models with weight nulling. Compared to the box plot without weight nulling in Fig. 3, weight
nulling not only increases the predication accuracy for the
same RBER, it also reduces the variance of accuracy as well.
1

Fig. 12. Box plot of accuracy for CIFAR-10 with weight nulling.

C. IMDB
Fig. 13 shows the average prediction accuracy of the RNN
architecture defined in Table V with and without weight
nulling technique. Bit errors are only applied to either the
LSTM layer or embedding layer. The horizontal dashed line
indicates 95% accuracy of the undistorted model. It can be
seen that the robustness measure R(0.95) for the LSTM and
the embedding layer have been increased from 0.012 to 0.015
and from 0.012 to 0.023, respectively.

0.99

Accuracy

0.98
0.97

0.88

0.96

0.87

No weight nulling
Weight nulling

0.95

0.86
0.94

Accuracy

0.93
0.92
0.91
0

0.85
0.84
0.83

0.001 0.002 0.003 0.004 0.005 0.006 0.007 0.008 0.009 0.01 0.011 0.012 0.013 0.014 0.015 0.016 0.017 0.018 0.019 0.02 0.021

RBER

Fig. 10. Box plot of accuracy for MNIST with weight nulling.

0.82
0.81
0.8
0

0.002

0.004

0.006

0.008

0.01

0.012

0.014

0.016

0.018

0.02

RBER

B. CIFAR-10

Fig. 13. Average accuracy of IMDB with and without weight nulling when
the LSTM layer has bit errors.

Fig. 11 shows the average prediction accuracy of the CNN
architecture defined in Table III with and without weight
nulling technique. The horizontal dashed line indicates 95%
accuracy of the undistorted model. It can be seen that the robustness measure R(0.95) has been increased from 2 × 10−5
to 10−3 by weight nulling. That is, the tolerance of RBER
for the same accuracy loss has been improved by 50 times.
Smaller variance of the prediction accuracy from distorted
models can also be observed in Fig. 12.

The improvement of average prediction accuracy by weight
nulling for RNN-based IMDB classification is not as large as
the other architectures and datasets. This is probably due to
the recursive structure of RNN layers where noise on weights
has more effect on the overall performance. However, the box
plots in Fig. 15 and Fig. 16 show that the number of outliers is
largely reduced compared to Fig. 7 and Fig. 8 without weight
nulling, which means desirable smaller variance against the
noise can also be realized.

0.88

No weight nulling
Weight nulling

0.87

0.86

Accuracy

Accuracy

0.86
0.85

0.84

0.82

0.8

0.84

0.78

0.83
0.76

0.82

0 0.0010.0020.0030.0040.0050.0060.0070.0080.009 0.01 0.0110.0120.0130.0140.0150.0160.0170.0180.019 0.02 0.0210.0220.023

RBER

0.81
0.005

0.01

0.015
RBER

0.02

0.025

0.03

Fig. 14. Average accuracy of IMDB with and without weight nulling when
the embedding layer has bit errors.

0.88
0.87

Accuracy

0.86
0.85
0.84
0.83
0.82
0.81
0

0.001 0.002 0.003 0.004 0.005 0.006 0.007 0.008 0.009 0.01 0.011 0.012 0.013 0.014 0.015 0.016

RBER

Fig. 15. Box plot of accuracy for IMDB with weight nulling when the LSTM
layer has bit errors.

D. A summary of weight nulling
Table VIII summarizes the comparison of robustness measure R(0.95) of different datasets and neural network architectures. We conjecture that for more complicated image recognition tasks with large neural nets, e.g., vgg-16 nets, weight
nulling could improve the robustness by orders of magnitude.
In fact, we use transfer learning on ImageNet for a similar
vgg-16 nets to classify cats and dogs with input image size
being 224 by 224. The robust has been improve from 10−6 to
2.5 × 10−4 , a 250 times more tolerable RBER achieved. For
simple tasks where the robustness is already in the orders of
10−2 , the improvement exists but is less significant.
TABLE VIII
ROBUSTNESS IMPROVEMENT OF WEIGHT NULLING
NN architecture
No weight nulling
Weight nulling
IMDB
NN architecture
No weight nulling
Weight nulling

MNIST CIFAR-10
Cats-Dogs
CNN
CNN
CNN
0.012
2E−5
1E−6
0.021
1E−3
2.5E−4
(LSTM layer)
IMDB (embedding layer)
RNN
RNN
0.012
0.012
0.015
0.023

Fig. 16. Box plot of accuracy for IMDB with weight nulling when the embedding layer has bit errors.

between the original number and the decoded number of the
1-bit erroneous binary representation will be as large as half
of the range those q bits can represent. We can say that the
relative distortion can be 0.5, i.e.,
1
|werroneous − wtrue |
= ,
wmax − wmin
2
which is independent of q. Similar problems occur in IEEE
754 standards if an exponent bits or the sign bit is flipped.
In this section, we provide some theoretical definitions
and analysis used for binary representation of real numbers under bit errors. We propose a binary representation,
called Hamming-distance-based representation, of real numbers beyond IEEE 754 standards and the binary expansion.
A remarkable feature of the Hamming-distance-based representation is that the relative distortion of the real number
is vanishing as the number of bits n for representation increases, conditioned on that a constant number of bits in the
binary representation is erroneous.
Definition 1. Let q be the number of bits to represent a real
number (e.g., weight). Let R = [wmin , wmax ] be the interval
that covers all real numbers needed to represent. Let F =
{0, 1, . . . , 2q − 1} be the set of indices after a uniform quantization of R. Then each real number corresponds to an index
in F . For binary storage media, F is represented by q bits by
a bijection f : {0, 1}q ↔ F . We define the distortion under
the bijection f between two binary arrays d(f, b1 , b2 ) as the
normalized L1 distance of their corresponding indices, i.e.,
|f (b1 ) − f (b2 )|
, b1 , b2 ∈ {0, 1}q .
2q
Let dH (x1 , x2 ) be the Hamming distance between two binary arrays x1 and x2 . We define the maximum and average
distance-1 distortion under f of one binary array b as the maximum and average distortion between b and its neighbors whose
Hamming distance is 1 from b, i.e.,
d(f, b1 , b2 ) =

dmax,1 (f, b) =
and

V. H AMMING - DISTANCE - BASED B INARY
R EPRESENTATION OF N UMBERS
Consider the q-bit binary expansion representation of real
numbers in [wmin , wmax ]. As stated in Section II-B2, if the leftmost bit (most significant bit) is flipped, then the difference

dave,1 (f, b) =

max

{x:dH (b,x)=1}

P

d(f, b, x)

{x:dH (b,x)=1}

d(f, b, x)

|{x : dH (b, x) = 1}|

.

We then define the distance-1 distortion under the bijection f
as
dmax,1 (f ) = max q dmax,1 (f, b)
b∈{0,1}

and
dave,1 (f ) =

1
2q

X

dave,1 (f, b).

b∈{0,1}q

For a constant number k, the definitions of distortion measures
dmax,k (f, b), dave,k (f, b), dmax,k (f ), and dave,k (f ) can be generalized by exploring the distortion of neighbors with Hamming
distance less than or equal to k.
Example 1 Let q = 2 and F = 0, 1, 2, 3. Since the distortion
is normalized, the set of real numbers to represent can be any
scaled values of the set {0, 31 , 32 , 1}. If the bijection f is the
binary expansion that maps {(00), (01), (10), (11)} ↔ F in
the corresponding order. Then we have the following example
distortion.

Example 2 Let q = 3 and F = {0, 1, . . . , 7}. The Hammingdistance-based bijection can be defined as
{(000), (001), (010), (100), (011), (101), (110), (111)} ↔ F
in the corresponding order. That is, binary arrays with lower
Hamming weights are mapped to smaller numbers in F .
dmax,1 (f ) = 12 can be achieved by multiple distortion
mechanism. One could be the bit error on the first bit of
(001) (representing 1 ∈ F ), which ends up to (101) (repre1
senting 5 ∈ F ). The distortion is then 5−1
23 = 2 . For q = 3,
the Hamming-distance-based bijection has the same dmax,1 (f )
as the binary expansion. But for larger q, the distortion of
Hamming-distance-based bijection would decrease to 0, while
the binary expansion would remain 12 .

dmax,1 (f, (00)) = max {d(f, (00), (01)), d(f, (00), (10))}


1
|0 − 1| |0 − 2|
= .
,
= max
2q
2q
2

Theorem 1. Let f be the Hamming-distance-based bijection
and k be a constant number, then

So dmax,1 (f ) > dmax,1 (f, (00)) = 21 and it can be shown that
dmax,1 (f ) = 21 .
If the bijection f is a length-two Gray code that maps
{(00), (01), (11), (10)} ↔ F in the corresponding order.
Then

Proof: According to the definition of dmax,k (f ) and
dave,k (f ), we have the following equations

dmax,1 (f, (00)) = max {d(f, (00), (01)), d(f, (00), (10))}


3
|0 − 1| |0 − 3|
= ,
,
= max
2q
2q
4
thus dmax,1 (f ) > 43 . This means that the Gray code mapping is
worse than the binary expansion under the defined distortion
measure. Also note that as q increases, dmax,1 (f ) remains 12
for binary expansion and dmax,1 (f ) converges to 1 for Gray
codes.
Remark 1. The range of F is actually 2q − 1 but the denominator is chosen to be 2q to simplify notations since 1) it is
q
proportional with a scale factor 2 2−1
q ; 2) when q is large, the
scale factor is approximately 1.
Remark 2. Gray codes G : {0, 1}q ↔ {0, 1, . . . , 2q − 1} that
maps all binary arrays to an integer set satisfy that if i and j
are adjacent integers, then their Gray code representations have
Hamming distance 1, which is the optimally smallest number.
The goal of this section is to propose a “reverse Gray”-like
mapping, where the adjacent binary arrays with Hamming distance 1 should have small distance in their integer representations.
Construction 1 We construct the Hamming-distance-based
bijection f as follows.
Let b1 , b2 ∈ {0, 1}q , define b1  b2 if either one of the
following two conditions are satisfied. 1) wH (b1 ) > wH (b2 ),
2) wH (b1 ) = wH (b2 ) and b1 is lexicographically greater than
or equal to b2 , where wH (x) is the Hamming weight of a
binary array x.
The Hamming-distance-based bijection is defined such that
∀b1 , b2 ∈ {0, 1}q , i1 > i2 ⇔ b1  b2 , where i1 = f (b1 ) and
i2 = f (b2 ).

lim dmax,k (f ) = dave,k (f ) = 0.

q→∞

dave,k (f ) 6 dmax,k (f ) 6 kdmax,1 (f ),
where the second inequality is due to that a binary array can
be converted to another binary array with Hamming distance
k by k steps where one bit is changed in each step. Therefore,
we only need to prove
lim dmax,1 (f ) = 0.

q→∞

By the construction of Hamming-distance-based bijection,
the first binary array is the all-zero array (i.e., the Hamming
weight is 0). The next q binary arrays all have Hamming
weight 1 and so on. Thus we can sequentially partition all
2q binary arrays into q + 1 groups, where each group are all
binary arrays
 with Hamming weight k and the size of each
group is kq for k = 0, 1, . . . , q. If any bit in a binary array
is flipped, then it is converted to another binary array in one
of the adjacent groups. The distortion (their corresponding
decimal representation in F ) is less than or equal to the size
of the two groups, i.e.,


q
q
k + k+1
dmax,1 (f, b) 6
,
2q
if wH (b) < 2q ; otherwise,


q
q
k + k−1
dmax,1 (f, b) 6
.
2q
Thus,
lim dmax,1 (f ) = lim

q→∞

max dmax,1 (f, b)

q

q→∞ b∈{0,1}q

6 lim

2

q→∞

2
= lim

q/2

2q
q

2 q
πq 2

2q
r
2
= lim 2
q→∞
πq
= 0,
q→∞

where the first equalityfollows the definition, the second inequality follows that kq is maximized at k = 2q , and the third
equality follows from the Stirling approximation.

Remark 3. According Theorem 1, the distortion decreases to
0 as q increases, which is a much more promising result than
binary expansion and IEEE 754 floating-point number representation where the distortion is at least a constant. But it can
also be observed that dmax,1 (f ) decreases very slowly in the
order of √1q .
Fig. 17 shows the comparison of CIFAR-10 dataset
average prediction accuracy for binary expansion and
Hamming-distance-based representation when media errors
exist. The curve corresponding to “binary expansion” is a
restatement of Table IV and the curve labeled “No weight
nulling” in Fig. 11. It can be observed that the accuracy is
slightly improved using the Hamming-distance-based bijection. We conjecture that the limited improvement is due to the
fact that q = 16 is not sufficiently large in the experiment.
0.9
Binary expansion
Hamming-distance-based

Accuracy

0.85

0.8

0.75

0.7
0

0.1

0.2

0.3

0.4

0.5

0.6

0.7

0.8

0.9

1
×10 -4

Fig. 17. Accuracy of CIFAR-10 for binary expansion and Hamming-distancebased representation.

VI. C ONCLUSIONS
In this paper, we study the robustness of neural networks
against media errors for different neural network architectures
and datasets. We propose a weight nulling algorithm based
on a check bit to improve the robustness. We also provide a
Hamming-distance-based binary representation of real numbers such that the distortion brought by bit errors in stored
media can be reduced compared to a simple binary expansion
representation or IEEE Standard for Floating-Point Arithmetic
(IEEE 754).
R EFERENCES
[1] J. Schmidhuber, “Deep learning in neural networks: An overview,” Neural Networks, vol. 61, pp. 85–117, 2015, published online 2014; based
on TR arXiv:1404.7828 [cs.NE].
[2] T. Hastie, R. Tibshirani, and J. Friedman, The Elements of Statistical
Learning. Springer, New York, 2001.
[3] K. Jarrett, K. Kavukcuoglu, and M. Ranzato, “What is the best multistage architecture for object recognition?” in IEEE Int. Conf. Computer
Vision, Kyoto, Japan, September 2009, p. 21462153.

[4] A. Krizhevsky, I. Sutskever, and G. Hinton, “Imagenet classification with deep convolutional neural networks,” in Advances
in Neural Information Processing Systems 25, F. Pereira,
C. J. C. Burges, L. Bottou, and K. Q. Weinberger, Eds. Curran Associates, Inc., 2012, pp. 1097–1105. [Online]. Available:
http://papers.nips.cc/paper/4824-imagenet-classification-with-deep-convolutional-neural
[5] A. Graves, M. Liwicki, S. Fernandez, R. Bertolami, H. Bunke, and
J. Schmidhuber, “A novel connectionist system for improved unconstrained handwriting recognition,” IEEE Trans. Pattern Analysis and
Machine Intelligence, vol. 31, no. 5, pp. 855 – 868, May 2009.
[6] H. Sak, A. Senior, and F. Beaufays, “Long short-term memory recurrent
neural network architectures for large scale acoustic modeling,” 2014.
[7] K. Greff, R. Srivastava, J. Koutnk, B. Steunebrink, and J. Schmidhuber,
“LSTM: A search space odyssey,” IEEE Trans. Neural Networks and
Learning Systems, pp. 1–11, July 2016.
[8] M. Riedmiller and H. Braun, “A direct adaptive method for faster backpropagation learning: the RPROP algorithm,” in IEEE Int. Conf. Neural
Networks, San Francisco, CA, USA, March 2009, pp. 586–591.
[9] R. Hecht-Nielsen, “Theory of the backpropagation neural network,” in
Int. Joint Conf. on Neural Networks (IJCNN), Washington, DC, USA,
1989, pp. 593–605.
[10] W. Ryan and S. Lin, Channel Codes: Classical and Modern. Cambridge University Press, 2009.
[11] N. Carlini and D. Wagner, “Towards evaluating the robustness of neural
networks,” in IEEE Symp. on Security and Privacy (SP), San Jose, CA,
USA, 2017, pp. 39–57.
[12] S. Zheng, Y. Song, T. Leung, and I. Goodfellow, “Improving the robustness of deep neural networks via stability training,” in IEEE Conf.
on Computer Vision and Pattern Recognition (CVPR), Las Vegas, NV,
USA, 2016, pp. 4480 – 4488.
[13] M. Courbariaux, Y. Bengio, and J. David, “Binaryconnect: Training
deep neural networks with binary weights during propagations,” 2015.
[Online]. Available: http://arxiv.org/abs/1511.00363
[14] P. Merolla, R. Appuswamy, J. Arthur, S. Esser, and D. Modha, “Deep
neural networks are robust to weight binarization and other non-linear
distortions,” 2016. [Online]. Available: http://arxiv.org/abs/1606.01981
[15] T. Cover and J. Thomas, Elements of Information Theory. WileyInterscience New York, NY, USA, 1991.
[16] K. Simonyan and A. Zisserman, “Very deep convolutional networks for large-scale image recognition,” in Proc. International
Conference on Learning Representations, 2014. [Online]. Available:
http://arxiv.org/abs/1409.1556(2014)
[17] T. Mikolov, I. Sutskever, K. Chen, G. Corrado, and J. Dean, “Distributed
representations of words and phrases and their compositionality,” 2013.
[Online]. Available: https://arxiv.org/abs/1310.4546

