Understanding Fault Tolerance of Adversarially Robust Pruned Models

# Understanding Fault Tolerance of Adversarially Robust Pruned Models
Source: [https://arxiv.org/html/2608.04173](https://arxiv.org/html/2608.04173)
###### Abstract

Deep neural networks \(DNNs\) deployed on resource\-constrained neuromorphic hardware face three concurrent challenges: the need for model compression through pruning, vulnerability to adversarial input perturbations, and susceptibility to hardware\-induced weight faults such as stuck\-at\-zero errors\. While each of these factors has been studied in isolation, their combined effects on model reliability have received little attention\. This paper presents an empirical investigation of how pruning, adversarial training, and hardware fault injection interact to affect the robustness of convolutional neural networks\. Using a compact three\-layer CNN trained on MNIST, we conduct three experiments: \(1\) comparing the fault tolerance of naturally and adversarially trained models under simultaneous hardware faults and adversarial attacks, \(2\) evaluating how pruning affects adversarial robustness, and \(3\) characterizing the joint accuracy surface across fault rates, adversarial perturbation magnitudes, and pruning levels\. Our results show that adversarial training improves robustness against input perturbations but increases sensitivity to stuck\-at\-zero weight faults\. Contrary to intuition, pruning did not significantly increase fault sensitivity, and varying the pruning level had little effect across fault rates and attack strengths\. These results highlight the need to jointly consider adversarial robustness and hardware reliability\.

## IIntroduction

The growing demand for on\-device inference has driven the deployment of deep neural networks \(DNNs\) onto edge computing platforms, including neuromorphic hardware such as IBM NorthPole and BrainChip Akida\. However, operating in these environments places three simultaneous demands on a model: it must be compact enough to fit within tight memory and compute budgets\[[10](https://arxiv.org/html/2608.04173#bib.bib7),[6](https://arxiv.org/html/2608.04173#bib.bib9),[5](https://arxiv.org/html/2608.04173#bib.bib10)\], robust enough to resist adversarial input perturbations\[[3](https://arxiv.org/html/2608.04173#bib.bib4),[12](https://arxiv.org/html/2608.04173#bib.bib5)\], and tolerant of hardware\-induced weight faults\[[7](https://arxiv.org/html/2608.04173#bib.bib28),[19](https://arxiv.org/html/2608.04173#bib.bib29)\]\. Each of these requirements has been studied extensively in isolation, yet their combined effect on model reliability has received little attention\.

This work investigates how model compression through pruning, adversarial training, and stuck\-at weight faults jointly affect the reliability of convolutional neural networks\. Specifically, we study how adversarially trained models compare to naturally trained models under weight faults, and the effect of pruning in adversarially trained networks on both input perturbations and weight fault tolerance\.

Model pruning is one of the most effective techniques for reducing the computational cost of DNNs\. It removes parameters that contribute little to the model’s output, resulting in a smaller and faster network suitable for edge deployments\[[10](https://arxiv.org/html/2608.04173#bib.bib7),[6](https://arxiv.org/html/2608.04173#bib.bib9),[5](https://arxiv.org/html/2608.04173#bib.bib10)\]\. Pruning strategies have been widely studied and can be broadly categorized by how pruning is performed, when it is applied during training, and the criteria used to identify parameters for removal\[[2](https://arxiv.org/html/2608.04173#bib.bib12)\]\.

When implemented on neuromorphic chips, DNNs are exposed to hardware\-level faults that can alter their learned behavior\. A common example is the stuck\-at fault, where a synaptic weight becomes permanently fixed at either logic low \(0\) or logic high \(1\), regardless of input\. These faults can arise from manufacturing defects, device degradation, or environmental stress, and can also be deliberately induced by an attacker\[[7](https://arxiv.org/html/2608.04173#bib.bib28)\]\. They distort the internal computations of the network, degrading inference reliability\[[15](https://arxiv.org/html/2608.04173#bib.bib27),[8](https://arxiv.org/html/2608.04173#bib.bib32)\]\. Prior work has shown that convolutional networks exhibit layer\-dependent sensitivity to random weight perturbations, with lower layers being substantially more fragile than higher layers\[[1](https://arxiv.org/html/2608.04173#bib.bib34)\]\. As a result, fault tolerance has become a critical concern for systems deployed on neuromorphic hardware\.

In this work, we focus on stuck\-at\-zero faults, which are simulated through software\-based fault injection on a floating\-point model\. This approach allows controlled study of fault effects but does not capture the full behavior of real neuromorphic hardware, such as analog noise or device\-specific fault patterns\. We use stuck\-at\-zero injection as a proxy for hardware\-level weight corruption, consistent with prior simulation\-based fault studies\[[1](https://arxiv.org/html/2608.04173#bib.bib34)\]\.

Beyond their individual effects, pruning and hardware faults can each alter the network’s decision boundaries, influencing its response to adversarial examples\. Adversarial examples are slightly perturbed inputs that cause high\-confidence misclassification\. These perturbations are often imperceptible to humans but can drastically alter a model’s output\[[3](https://arxiv.org/html/2608.04173#bib.bib4)\],\[[12](https://arxiv.org/html/2608.04173#bib.bib5)\]\. Adversarial training serves as the most common defense technique against input perturbations and is achieved by augmenting training data with adversarially perturbed examples\.

Prior studies have reported that pruning can improve adversarial robustness within certain compression limits, but beyond a critical pruning rate, the model becomes more vulnerable to adversarial attacks\[[13](https://arxiv.org/html/2608.04173#bib.bib24),[18](https://arxiv.org/html/2608.04173#bib.bib1),[9](https://arxiv.org/html/2608.04173#bib.bib17),[4](https://arxiv.org/html/2608.04173#bib.bib18)\]\. How this relationship is further affected when the network is also subjected to hardware faults remains an open question\.

To the best of our knowledge, no prior work has jointly studied the interaction of pruning, adversarial training, and hardware fault tolerance in convolutional networks\. While\[[17](https://arxiv.org/html/2608.04173#bib.bib35)\]demonstrated that adversarial training increases sensitivity to weight perturbations in fully\-connected networks, their work did not examine convolutional architectures, model compression, or neuromorphic\-specific fault models, as summarized in Table[I](https://arxiv.org/html/2608.04173#S1.T1)\.

TABLE I:Summary of prior work addressing pruning, adversarial robustness, and hardware fault tolerance\. This work is the first to jointly address all three\.This paper bridges this gap through controlled experiments that jointly vary pruning level, adversarial training, and fault injection rate\. Our contributions are:

1. 1\.We provide joint characterization of how adversarial training, model compression, and hardware faults interact to determine model reliability\.
2. 2\.We reveal non\-obvious interactions between these threats: adversarially trained models exhibit heightened sensitivity to hardware faults\.
3. 3\.Intuitively we would expect compressed networks to be more prone to weight faults since they have fewer weights to represent information\. However, we observe that model compression has minimal impact on adversarial robustness in fault\-free settings\.

## IIRelated Work

### II\-AAdversarial Robustness

Adversarial examples were first defined by\[[16](https://arxiv.org/html/2608.04173#bib.bib3)\], revealing that imperceptible input perturbations can cause confident misclassifications in deep neural networks\. This discovery led to the development of gradient\-based attacks such as the Fast Gradient Sign Method \(FGSM\)\[[3](https://arxiv.org/html/2608.04173#bib.bib4)\]and Projected Gradient Descent \(PGD\)\[[12](https://arxiv.org/html/2608.04173#bib.bib5)\], which have become standard benchmarks for evaluating model vulnerability\. Adversarial training, which augments the training set with adversarially perturbed examples, has emerged as the most effective defense mechanism\[[12](https://arxiv.org/html/2608.04173#bib.bib5)\]\. Although this approach improves robustness to adversarial perturbations, it often degrades clean accuracy and substantially increases training cost\[[20](https://arxiv.org/html/2608.04173#bib.bib25)\]\.

### II\-BModel Compression and Pruning

The motivation for pruning comes from the need to reduce the energy required to run large networks so that they can run in real time on edge devices\. Early pruning methods such as\[[10](https://arxiv.org/html/2608.04173#bib.bib7)\]used Hessian information to calculate the sensitivity, which in turn decided the parameters to be removed\. Another early work by\[[15](https://arxiv.org/html/2608.04173#bib.bib27)\]show that there is a strong correlation between node relevance and weight magnitude\. Moreover, they also showed that pruning does not have a significant impact on the tolerance of the network subject to zeroing of a single weight\. Later work demonstrated that simpler threshold\-based pruning with iterative retraining could achieve 9×\\timesto 13×\\timescompression on AlexNet and VGGNet respectively\[[6](https://arxiv.org/html/2608.04173#bib.bib9)\]\. The compression pipeline in\[[5](https://arxiv.org/html/2608.04173#bib.bib10)\]combined pruning, quantization with weight sharing, and Huffman coding to achieve 35×\\timescompression on AlexNet\. Structured pruning methods such as\[[11](https://arxiv.org/html/2608.04173#bib.bib13)\]remove entire filters or channels for hardware efficiency, whereas unstructured pruning achieves higher sparsity at the cost of irregular memory access\. Recent survey\[[2](https://arxiv.org/html/2608.04173#bib.bib12)\]categorizes pruning techniques by granularity \(unstructuredvs\.structured\), timing \(pre\-training, during\-training, or post\-training\), and selection criteria \(magnitude, gradient, or saliency\-based\)\.

### II\-CHardware Fault Tolerance

Hardware faults pose a reliability challenge for neural networks deployed on neuromorphic and edge devices\.\[[1](https://arxiv.org/html/2608.04173#bib.bib34)\]demonstrated that convolutional networks exhibit layer\-dependent sensitivity to weight perturbations, with lower layers more fragile than higher layers\.\[[7](https://arxiv.org/html/2608.04173#bib.bib28)\]showed that DNNs are vulnerable to bit\-flip corruptions\. Their analysis shows that a Rowhammer\-based attacker can cause upto 99% drop in accuracy with constrained bit\-flip corruption and with no knowledge of the model\. Unlike deliberate fault\-injection attacks that adversarially craft bit\-flips to target specific weights\[[7](https://arxiv.org/html/2608.04173#bib.bib28),[14](https://arxiv.org/html/2608.04173#bib.bib37)\], this work focuses on random hardware\-reliability faults\.\[[19](https://arxiv.org/html/2608.04173#bib.bib29)\]provides a perturbation region such that DNNs will maintain their accuracy if weight perturbations are within that region\. Further, they provide a perturbation\-aware weight quantization technique showing significant improvement\.\[[8](https://arxiv.org/html/2608.04173#bib.bib32)\]talk about different fault patterns in neuromorphic hardware and provide ways to detect them\. The permanent stuck\-at faults \(where weights become fixed at zero or one\) represent common failure modes in memristive hardware causing the need for fault\-aware design\.

### II\-DPruning and Adversarial Robustness

The interaction between model compression and adversarial robustness has produced contradictory findings across studies\.\[[18](https://arxiv.org/html/2608.04173#bib.bib1)\]used magnitude\-based pruning and found that while it maintains clean accuracy, heavy pruning substantially reduces adversarial robustness\. In contrast,\[[9](https://arxiv.org/html/2608.04173#bib.bib17)\]used structured pruning and found that pruning alone, under standard natural training, improves adversarial robustness by acting as a regularizer, achieving results competitive with adversarial training without requiring it\.\[[4](https://arxiv.org/html/2608.04173#bib.bib18)\]similarly report that increased sparsity improves robustness\. This disagreement suggests that the pruning granularity, timing, criteria, as well as the training type \- natural vs\. adversarial, shapes whether pruning helps or hurts adversarial robustness\. These differences motivate our use of magnitude\-based \(unstructured\) pruning combined with adversarial training as a distinct setting from prior work\.

### II\-EAdversarial Robustness and Hardware Faults

Recent work has explored the interaction between adversarial robustness and weight perturbations\.\[[17](https://arxiv.org/html/2608.04173#bib.bib35)\]showed that adversarially trained models are more vulnerable to weight perturbations than naturally trained models and proposed a margin\-based regularization method to improve robustness under joint perturbations\. However, their work focused on dense networks and did not consider model compression or neuromorphic fault models such as stuck\-at\-zero faults\. Our work extends this line of research by jointly characterizing the effects of pruning, adversarial training, and hardware fault tolerance in convolutional neural networks\.

## IIIMethod

This study extends the framework of\[[18](https://arxiv.org/html/2608.04173#bib.bib1)\]on the adversarial robustness of pruned neural networks to ensure consistency\. A compact CNN is trained on MNIST, subjected to pruning and adversarial training, and evaluated under simulated hardware faults\. Both clean and adversarial accuracies are measured across varying attack strengths, pruning levels, and weight faults\. All experiments are conducted in PyTorch\.

### III\-ANetwork Architecture and Training

The network consists of three convolutional layers with 32, 64, and 64 filters, followed by a fully connected layer of 10 neurons before softmax\. The convolutional layers have a kernel size/ stride/ padding of 3/ 1/ 1 respectively\. Natural training uses cross\-entropy loss with RMSProp optimizer \(learning rate = 0\.001, weight decay = 5e\-4\) for 10 epochs\. In case of adversarial training, another 5 epochs with natural as well as adversarial images are carried out\. Each layer has a binary maskMMapplied directly to its weight tensorWW\. The mask is stored as a non\-trainable variable and multiplied element\-wise with the corresponding weights to deactivate selected connections:

### III\-BPruning Procedure

After baseline training, X% of weights with the smallest absolute values are set to zero globally\. We experimented with 20, 40, 60 and 80 percent of pruning\. The resulting pruned network is retrained using the same hyper\-parameters to recover lost accuracy and stabilize performance\. Three model variants are obtained: \(1\) Naturally Trained, \(2\) Adversarially Trained, \(3\) Adversarially Trained and Pruned\.

### III\-CAdversarial Training and Attacks

Adversarial robustness is introduced using Projected Gradient Descent based adversarial training\. The total loss is defined as the mean of the clean loss and the adversarial loss\. The clean loss is computed as the cross\-entropy between the network’s predictions on unperturbed inputs and the corresponding ground\-truth labels\. The adversarial loss is computed as the cross\-entropy between the predictions on adversarially perturbed inputs and the corresponding ground\-truth labels\. The final loss is expressed as

L=12​\[Lclean\+Ladversarial\]L=\\tfrac\{1\}\{2\}\\left\[L\_\{\\text\{clean\}\}\+L\_\{\\text\{adversarial\}\}\\right\]\(2\)where bothLcleanL\_\{\\text\{clean\}\}andLadversarialL\_\{\\text\{adversarial\}\}are standard cross\-entropy losses\. Adversarial examples are generated during training using the network’s current parameters\. The perturbation process follows theL−∞L\-\\inftyProjected Gradient Descent method\. Given a clean inputXc​l​e​a​nX\_\{clean\}and corresponding labelyy, the input is iteratively perturbed in the direction of the sign of the loss gradient with respect to the input:

Xadv=Xclean\+δkX\_\{\\text\{adv\}\}=X\_\{\\text\{clean\}\}\+\\delta^\{k\}\(3\)whereδk\\delta^\{k\}is the perturbation afterkkiterations of step sizeaa\. At each step, the perturbation is calculates as:

δi\+1=δi\+a⋅sign​\(∇xL​\(δi,ytrue\)\)\\delta^\{i\+1\}=\\delta^\{i\}\+a\\cdot\\text\{sign\}\(\\nabla\_\{x\}L\(\\delta^\{i\},y\_\{\\text\{true\}\}\)\)\(4\)After each update, the perturbation is clipped to ensure that it remains within the allowableϵ\\epsilon\-bounded region around the clean input\. Following this, a second clipping step confines the pixel intensities of the adversarial image to the valid range\[0,1\]\[0,1\]\. We use a step sizea=0\.01a=0\.01, number of iterationsk=40k=40and epsilonϵ=0\.3\\epsilon=0\.3\. Adversarial robustness at inference is evaluated by calculating both clean and adversarial accuracy under both FGSM and PGD attacks\. The attacks are applied over a range of perturbation magnitudes,ϵ∈\[0,0\.5\]\\epsilon\\in\[0,0\.5\], with an increment of0\.10\.1\. Each configuration was tested across55independent runs with random initializations, and results were averaged\.

### III\-DHardware\-Fault Simulation

In this work, we emulate stuck\-at\-zero faults by progressively setting10%10\\%of the remaining active weights to zero at each step, reaching up to80%80\\%total faults\. After each increment, clean and adversarial accuracies are evaluated to quantify the cumulative impact of hardware faults on network robustness\.

### III\-EEvaluation Metrics

Model robustness was assessed using clean accuracy, adversarial accuracy, with increasing fault levels\. All experiments were repeated55times to ensure statistical reliability\. Results are reported as mean±\\pmstandard deviation across runs\.

![Refer to caption](https://arxiv.org/html/2608.04173v1/abstract_figures/pruning_accuracy.png)Figure 1:Accuracy vs\. Attack Strength for Adversarially trained model at different pruning levels

## IVResults

### IV\-AAdversarial Training shows improved Input Robustness but reduces Fault Tolerance

Figure[1](https://arxiv.org/html/2608.04173#S3.F1)and Table[II](https://arxiv.org/html/2608.04173#S4.T2)show classification accuracy under FGSM and PGD attacks for the adversarially trained network across pruning levels\. Atϵ=0\.3\\epsilon=0\.3and no faults present, FGSM and PGD accuracy remained above 89% across all pruning levels, indicating that pruning does not significantly affect adversarial robustness under fault\-free conditions\.

![Refer to caption](https://arxiv.org/html/2608.04173v1/abstract_figures/nat_vs_adv_fault.png)Figure 2:Clean Accuracy vs\. Fault percentage for Natural training and Adversarial trainingTABLE II:Clean and adversarial accuracy \(mean±\\pmstd over 5 runs\) atϵ=0\.3\\epsilon=0\.3, across pruning levels and stuck\-at\-zero fault rates\.Figure[2](https://arxiv.org/html/2608.04173#S4.F2)compares clean accuracy under increasing stuck\-at\-zero fault rates for naturally trained versus adversarially trained networks\. Adversarially trained networks began degrading at lower fault rates than naturally trained networks, with the two curves diverging noticeably after 20% faults\. This observation is consistent with, but does not prove, our hypothesis that adversarial training shifts the decision boundary in a way that becomes increasingly fragile as weight faults accumulate\.

![Refer to caption](https://arxiv.org/html/2608.04173v1/abstract_figures/fault_accuracy.png)Figure 3:Accuracy vs\. Fault percentage for Adversarially trained network at different pruning levels
### IV\-BNo Significant Increase in Fault Sensitivity was seen with Pruning

Table[II](https://arxiv.org/html/2608.04173#S4.T2)shows accuracy atϵ=0\.3\\epsilon=0\.3across pruning levels at three fault rates: 0%, 40%, and 80%\. At 0% faults, clean accuracy remained stable across all pruning levels, showing that retraining after pruning fully recovers clean accuracy\. Adversarial accuracy is lower than clean accuracy, as expected, but remains fairly stable across all pruning levels\. At 40% faults, accuracy varied substantially by pruning level, following a non\-monotonic pattern\. 40% and 60% pruning showed the highest retained clean and adversarial accuracy, while 0% and 80% pruning degraded more\. At 80% faults, all pruning levels collapsed to near chance level, with no meaningful separation between pruning levels\. Figure[3](https://arxiv.org/html/2608.04173#S4.F3)shows this non\-monotonic pattern across the full 0\-80% fault range: clean, FGSM, and PGD accuracy degrade at a similar pace across all five pruning levels, with no pruning level showing a clear or consistent advantage\. We note that variance at intermediate fault rates \(20\-40%\) was substantial, in some cases exceeding 30 percentage points of standard deviation across the 5 runs\. This indicates that model behavior under moderate fault injection is highly sensitive to the specific random pattern of faulted weights\. As a result, mean\-accuracy comparisons alone may not support strong claims of statistical significance at these fault rates without further testing\.

### IV\-CJoint Characterization Across Fault Rate, Attack Strength, and Pruning

Figure[4](https://arxiv.org/html/2608.04173#S4.F4)presents accuracy as a function of both fault injection rate and attack strength, for FGSM and PGD, across all five pruning levels\. The overall shape of the accuracy surface is broadly consistent across pruning levels, showing that pruning level has limited impact on the joint robustness\-fault trade\-off\. However, given the high variance noted above, this consistency reflects a general trend rather than a precise, reproducible boundary\.

![Refer to caption](https://arxiv.org/html/2608.04173v1/abstract_figures/exp3_contour_grid.png)Figure 4:Joint characterization across fault rates, attack strengths, and pruning levels for Adversarially trained network

## VDiscussion

The results show that adversarial training improves robustness against FGSM and PGD attacks but also increases sensitivity to hardware\-induced weight faults \(Figures[1](https://arxiv.org/html/2608.04173#S3.F1),[2](https://arxiv.org/html/2608.04173#S4.F2)\)\. As the stuck\-at\-zero fault rate increases, adversarially trained models experience degradation in classification accuracy compared to naturally trained models \(Figure[2](https://arxiv.org/html/2608.04173#S4.F2)\)\. Thus, the results reveal a non\-trivial tradeoff between robustness to adversarial inputs and robustness to hardware perturbations\. We propose an explanation grounded in decision boundary geometry\. Adversarial training pushes the decision boundary further from the training data points, requiring larger perturbations to cause misclassifications\. This creates what we consider an ”optimal” boundary for defending against input attacks\. However, when this learned network is exposed to stuck\-at\-zero weight faults, the corrupted weights alter the decision boundary geometry, resulting in a ”sub\-optimal” boundary\. As faults accumulate, the boundary gets pushed back toward the data points\. This means smaller adversarial perturbations are now sufficient to cause misclassifications, explaining the increased vulnerability of adversarially trained models under hardware faults\. This is consistent with, though does not confirm, our hypothesis that adversarial training shifts the decision boundary in a way that becomes increasingly fragile as weight faults accumulate\.

The joint characterization across fault rates, attack strengths, and pruning levels reveals that pruning level has minimal impact on the robustness\-fault trade\-off \(Figure[4](https://arxiv.org/html/2608.04173#S4.F4)\)\. Magnitude\-based pruning removes the smallest magnitude weights, keeping only the most significant weights that contribute most to the decision boundary\. We would intuitively expect adversarially trained pruned networks to be more prone to weight faults since they have fewer weights to represent information and faults would now corrupt these concentrated high importance weights\. However, this is not what we observed\. Adversarially trained pruned networks under the same percentage of weight faults show no additional sensitivity compared to their unpruned counterparts\. The mechanism underlying this robustness warrants further investigation\. A per\-layer analysis comparing the magnitude distribution of faulted weights in pruned versus unpruned models would shed more light on this mechanism, which we leave for future work\. We also note that model behavior was highly variable at intermediate fault rates \(20\-40%\), with standard deviations across our five seeds sometimes exceeding 30 percentage points \(Table[II](https://arxiv.org/html/2608.04173#S4.T2)\)\. This indicates that the specific random pattern of faulted weights, not just the fault rate, can substantially affect a given model’s degradation\. This variability, combined with our limited sample size of five runs, means the trends we report here should be interpreted as consistent directional patterns rather than precisely characterized effects\. Moreover, this work focuses only on stuck\-at\-zero faults\. Stuck\-at\-one faults, which may be more damaging in certain classification settings, represent an important complementary fault model for future study\. Future work will also include testing on additional datasets and model architectures, as well as validation on real neuromorphic hardware, to assess whether these trends generalize beyond the three\-layer CNN and MNIST setting used in this study\.

## VIConclusion

This paper presented a controlled experiment on how pruning, adversarial training, and hardware\-induced weight faults jointly affect the reliability of convolutional neural networks\. Using a three\-layer CNN trained on MNIST, we found that adversarial training improves robustness against input perturbations but increases sensitivity to stuck\-at\-zero weight faults, which we explain through the geometry of the decision boundary\. Contrary to intuition, pruning did not significantly increase sensitivity to these weight faults\. Our joint characterization across fault rates, attack strengths, and pruning levels showed that pruning level has limited systematic impact on this trade\-off, although the high variance observed across runs at intermediate fault rates suggests these trends should be interpreted directionally rather than as precise effects\. These findings represent an initial step toward understanding the joint reliability of compressed, adversarially robust neural networks under hardware faults, with additional datasets, architectures, and fault types remaining important directions for future work\.

## AI Usage Statement

Generative AI tools were used to assist with editing and polishing the manuscript, as well as supporting code development and debugging\. All AI\-assisted content was reviewed and verified by the authors, who take full responsibility for the final work\.

## Acknowledgments

This material is based upon work supported by the Air Force Office of Scientific Research \(AFOSR\) under award FA9550\-24\-1\-0322\. Any opinions, findings, conclusions, or recommendations are those of the authors and do not necessarily reflect the views of the United States Air Force\.

## References

- \[1\]N\. Cheney, M\. Schrimpf, and G\. Kreiman\(2017\)On the robustness of convolutional neural networks to internal architecture and weight perturbations\.arXiv e\-prints,pp\. arXiv–1703\.Cited by:[TABLE I](https://arxiv.org/html/2608.04173#S1.T1.1.1.4.4.1),[§I](https://arxiv.org/html/2608.04173#S1.p4.1),[§I](https://arxiv.org/html/2608.04173#S1.p5.1),[§II\-C](https://arxiv.org/html/2608.04173#S2.SS3.p1.1)\.
- \[2\]H\. Cheng, M\. Zhang, and J\. Q\. Shi\(2024\)A survey on deep neural network pruning: taxonomy, comparison, analysis, and recommendations\.IEEE Transactions on Pattern Analysis and Machine Intelligence\.Cited by:[§I](https://arxiv.org/html/2608.04173#S1.p3.1),[§II\-B](https://arxiv.org/html/2608.04173#S2.SS2.p1.3)\.
- \[3\]I\. J\. Goodfellow, J\. Shlens, and C\. Szegedy\(2014\)Explaining and harnessing adversarial examples\.arXiv preprint arXiv:1412\.6572\.Cited by:[TABLE I](https://arxiv.org/html/2608.04173#S1.T1.1.1.3.3.1),[§I](https://arxiv.org/html/2608.04173#S1.p1.1),[§I](https://arxiv.org/html/2608.04173#S1.p6.1),[§II\-A](https://arxiv.org/html/2608.04173#S2.SS1.p1.1)\.
- \[4\]Y\. Guo, C\. Zhang, C\. Zhang, and Y\. Chen\(2018\)Sparse dnns with improved adversarial robustness\.Advances in neural information processing systems31\.Cited by:[TABLE I](https://arxiv.org/html/2608.04173#S1.T1.1.1.5.5.1),[§I](https://arxiv.org/html/2608.04173#S1.p7.1),[§II\-D](https://arxiv.org/html/2608.04173#S2.SS4.p1.1)\.
- \[5\]S\. Han, H\. Mao, and W\. J\. Dally\(2015\)Deep compression: compressing deep neural networks with pruning, trained quantization and huffman coding\.arXiv preprint arXiv:1510\.00149\.Cited by:[TABLE I](https://arxiv.org/html/2608.04173#S1.T1.1.1.2.2.1),[§I](https://arxiv.org/html/2608.04173#S1.p1.1),[§I](https://arxiv.org/html/2608.04173#S1.p3.1),[§II\-B](https://arxiv.org/html/2608.04173#S2.SS2.p1.3)\.
- \[6\]S\. Han, J\. Pool, J\. Tran, and W\. Dally\(2015\)Learning both weights and connections for efficient neural network\.Advances in neural information processing systems28\.Cited by:[TABLE I](https://arxiv.org/html/2608.04173#S1.T1.1.1.2.2.1),[§I](https://arxiv.org/html/2608.04173#S1.p1.1),[§I](https://arxiv.org/html/2608.04173#S1.p3.1),[§II\-B](https://arxiv.org/html/2608.04173#S2.SS2.p1.3)\.
- \[7\]S\. Hong, P\. Frigo, Y\. Kaya, C\. Giuffrida, and T\. Dumitraș\(2019\)Terminal brain damage: exposing the graceless degradation in deep neural networks under hardware fault attacks\.In28th USENIX Security Symposium,pp\. 497–514\.Cited by:[TABLE I](https://arxiv.org/html/2608.04173#S1.T1.1.1.4.4.1),[§I](https://arxiv.org/html/2608.04173#S1.p1.1),[§I](https://arxiv.org/html/2608.04173#S1.p4.1),[§II\-C](https://arxiv.org/html/2608.04173#S2.SS3.p1.1)\.
- \[8\]Y\. Hsieh, H\. Tseng, I\. Chiu, and J\. C\. M\. Li\(2021\)Fault modeling and testing of spiking neural network chips\.In2021 IEEE International Test Conference in Asia \(ITC\-Asia\),pp\. 1–6\.Cited by:[TABLE I](https://arxiv.org/html/2608.04173#S1.T1.1.1.4.4.1),[§I](https://arxiv.org/html/2608.04173#S1.p4.1),[§II\-C](https://arxiv.org/html/2608.04173#S2.SS3.p1.1)\.
- \[9\]A\. Jordao and H\. Pedrini\(2021\)On the effect of pruning on adversarial robustness\.InProceedings of the International Conference on Computer Vision,Cited by:[TABLE I](https://arxiv.org/html/2608.04173#S1.T1.1.1.5.5.1),[§I](https://arxiv.org/html/2608.04173#S1.p7.1),[§II\-D](https://arxiv.org/html/2608.04173#S2.SS4.p1.1)\.
- \[10\]Y\. LeCun, J\. Denker, and S\. Solla\(1989\)Optimal brain damage\.Advances in neural information processing systems2\.Cited by:[TABLE I](https://arxiv.org/html/2608.04173#S1.T1.1.1.2.2.1),[§I](https://arxiv.org/html/2608.04173#S1.p1.1),[§I](https://arxiv.org/html/2608.04173#S1.p3.1),[§II\-B](https://arxiv.org/html/2608.04173#S2.SS2.p1.3)\.
- \[11\]H\. Li, A\. Kadav, I\. Durdanovic, H\. Samet, and H\. P\. Graf\(2017\)Pruning filters for efficient convnets\.InInternational Conference on Learning Representations,Cited by:[§II\-B](https://arxiv.org/html/2608.04173#S2.SS2.p1.3)\.
- \[12\]A\. Madry, A\. Makelov, L\. Schmidt, D\. Tsipras, and A\. Vladu\(2017\)Towards deep learning models resistant to adversarial attacks\.arXiv preprint arXiv:1706\.06083\.Cited by:[TABLE I](https://arxiv.org/html/2608.04173#S1.T1.1.1.3.3.1),[§I](https://arxiv.org/html/2608.04173#S1.p1.1),[§I](https://arxiv.org/html/2608.04173#S1.p6.1),[§II\-A](https://arxiv.org/html/2608.04173#S2.SS1.p1.1)\.
- \[13\]S\. Pavlitska, H\. Grolig, and J\. M\. Zollner\(2023\)Relationship between model compression and adversarial robustness: a review of current evidence\.In2023 IEEE Symposium Series on Computational Intelligence \(SSCI\),pp\. 671–676\.Cited by:[TABLE I](https://arxiv.org/html/2608.04173#S1.T1.1.1.5.5.1),[§I](https://arxiv.org/html/2608.04173#S1.p7.1)\.
- \[14\]A\. S\. Rakin, Z\. He, and D\. Fan\(2020\)TBT: Targeted Neural Network Attack With Bit Trojan\.pp\. 13198–13207\.Cited by:[§II\-C](https://arxiv.org/html/2608.04173#S2.SS3.p1.1)\.
- \[15\]B\. E\. Segee and M\. J\. Carter\(1991\)Fault tolerance of pruned multilayer networks\.InIJCNN\-91\-Seattle International Joint Conference on Neural Networks,Vol\.2,pp\. 447–452\.Cited by:[§I](https://arxiv.org/html/2608.04173#S1.p4.1),[§II\-B](https://arxiv.org/html/2608.04173#S2.SS2.p1.3)\.
- \[16\]C\. Szegedy, W\. Zaremba, I\. Sutskever, J\. Bruna, D\. Erhan, I\. Goodfellow, and R\. Fergus\(2013\)Intriguing properties of neural networks\.Cited by:[§II\-A](https://arxiv.org/html/2608.04173#S2.SS1.p1.1)\.
- \[17\]Y\. Tsai, C\. Hsu, C\. Yu, and P\. Chen\(2021\)Non\-singular adversarial robustness of neural networks\.InICASSP 2021\-2021,pp\. 3840–3844\.Cited by:[TABLE I](https://arxiv.org/html/2608.04173#S1.T1.1.1.6.6.1),[§I](https://arxiv.org/html/2608.04173#S1.p8.1),[§II\-E](https://arxiv.org/html/2608.04173#S2.SS5.p1.1)\.
- \[18\]L\. Wang, G\. W\. Ding, R\. Huang, Y\. Cao, and Y\. C\. LuiAdversarial robustness of pruned neural networks\.Cited by:[TABLE I](https://arxiv.org/html/2608.04173#S1.T1.1.1.5.5.1),[§I](https://arxiv.org/html/2608.04173#S1.p7.1),[§II\-D](https://arxiv.org/html/2608.04173#S2.SS4.p1.1),[§III](https://arxiv.org/html/2608.04173#S3.p1.1)\.
- \[19\]T\. Weng, P\. Zhao, S\. Liu, P\. Chen, X\. Lin, and L\. Daniel\(2020\)Towards certificated model robustness against weight perturbations\.InProceedings of the AAAI Conference on Artificial Intelligence,Cited by:[TABLE I](https://arxiv.org/html/2608.04173#S1.T1.1.1.6.6.1),[§I](https://arxiv.org/html/2608.04173#S1.p1.1),[§II\-C](https://arxiv.org/html/2608.04173#S2.SS3.p1.1)\.
- \[20\]S\. Ye, K\. Xu, S\. Liu, H\. Cheng, J\. Lambrechts, H\. Zhang, A\. Zhou, K\. Ma, Y\. Wang, and X\. Lin\(2019\)Adversarial robustness vs\. model compression, or both?\.InProceedings of the IEEE/CVF,pp\. 111–120\.Cited by:[TABLE I](https://arxiv.org/html/2608.04173#S1.T1.1.1.5.5.1),[§II\-A](https://arxiv.org/html/2608.04173#S2.SS1.p1.1)\.