Faults That Fortify: CNN Adversarial Robustness via GPU Undervolting

# Faults That Fortify: CNN Adversarial Robustness via GPU Undervolting
Source: [https://arxiv.org/html/2608.20572](https://arxiv.org/html/2608.20572)
Ihsen Alouani4,and Khaled N\. Khasawneh1Affiliation:1George Mason University, Fairfax, USA \- Email: \{bomidi, atahmasi, halsyour, kkhasawn\}@gmu\.eduAffiliation:2SecureMind Technologies Inc, Fairfax, USA \- Email: saba@securemindtech\.aiAffiliation:3Rochester Institute of Technology, Rochester, USA \- Email: cxfeec@rit\.eduAffiliation:4Queen’s University, Belfast, UK \- Email: i\.alouani@qub\.ac\.uk

###### Abstract

Convolutional Neural Networks \(CNNs\) face a dual challenge: vulnerability to adversarial attacks and prohibitive training cost\. Adversarial training is effective but expensive, a burden that grows as learning shifts to the energy\-constrained edge\. This paper addresses both through GPU undervolting during training\. Reducing supply voltage introduces stochastic perturbations in arithmetic that act as implicit regularization, improving robustness while lowering power\. We characterize undervolting\-induced faults at the bit level, then train LeNet, VGG\-6, and MobileNetV3 on MNIST and CIFAR\-10 under two training regimes, standard and adversarial, each at nominal and undervolted voltage, and evaluate all models against adversarial attacks\. In both regimes, the undervolted model consistently achieves higher adversarial accuracy than its nominal\-voltage counterpart, showing that hardware\-induced faults strengthen even adversarial training\. Because dynamic power scales quadratically with supply voltage, these robustness gains arrive with substantial energy savings\. GPU undervolting is therefore a readily deployable hardware\-level defense requiring no algorithmic change, and opens a promising direction in which robustness and energy efficiency move together\.

###### Index Terms:

Machine learning, Adversarial attacks, Fault injection, Undervolting, Power efficient training, AI Robustness\.

## IIntroduction

Convolutional Neural Networks \(CNNs\) have become a fundamental component of modern computer vision, enabling applications ranging from medical imaging to autonomous driving\. However, training these models requires substantial computational resources, including high\-performance GPUs and significant energy consumption\[[25](https://arxiv.org/html/2608.20572#bib.bib1)\]\. These challenges are particularly pronounced in edge computing, where models are increasingly fine\-tuned in addition to being deployed on resource\-constrained platforms such as drones, wearable devices, and autonomous vehicles operating under stringent power budgets\[[19](https://arxiv.org/html/2608.20572#bib.bib23)\]\. In such settings, the computational overhead of robustness\-enhancing techniques is often prohibitive\. Consequently, improving training efficiency while preserving both model accuracy and robustness has emerged as a critical research objective\.

![Refer to caption](https://arxiv.org/html/2608.20572v1/CNN-Undervolting-Workflow-Host2027_44.png)Fig\. 1:Workflow overviewRecent research focuses on the algorithmic level through quantization, pruning, and accelerator codesign\[[23](https://arxiv.org/html/2608.20572#bib.bib2),[6](https://arxiv.org/html/2608.20572#bib.bib3)\]\. A complementary lever acts beneath it, where hardware modifications such as voltage scaling influence model performance and learning dynamics\[[18](https://arxiv.org/html/2608.20572#bib.bib24)\]\. Prior works have examined the security implications of this behavior, showing how undervolting can be exploited to induce faults in controlled ways\[[14](https://arxiv.org/html/2608.20572#bib.bib15),[29](https://arxiv.org/html/2608.20572#bib.bib25)\], while also demonstrating its potential as a defensive mechanism that injects benign noise to disrupt adversarial attacks\[[22](https://arxiv.org/html/2608.20572#bib.bib16),[12](https://arxiv.org/html/2608.20572#bib.bib13),[13](https://arxiv.org/html/2608.20572#bib.bib14)\]\. These undervolting\-induced faults result from diminished voltage margins that degrade transistor switching reliability, potentially causing timing violations, unstable storage behavior, and incorrect signal sampling during computation\. Unlike memory\-centric fault mechanisms, such as Rowhammer\-induced DRAM disturbances or targeted weight corruption attacks\[[3](https://arxiv.org/html/2608.20572#bib.bib17),[31](https://arxiv.org/html/2608.20572#bib.bib18),[1](https://arxiv.org/html/2608.20572#bib.bib26)\], which involve persistent alterations to stored data and are addressed through corresponding mitigation approaches\[[28](https://arxiv.org/html/2608.20572#bib.bib19),[24](https://arxiv.org/html/2608.20572#bib.bib20)\], undervolting faults arise from transient disruptions in the underlying hardware execution process\.

It is also worth noting that these defensive mechanisms primarily operate during inference, where faults are introduced into an already trained model and are typically emulated through software\-based injection\[[13](https://arxiv.org/html/2608.20572#bib.bib14),[22](https://arxiv.org/html/2608.20572#bib.bib16)\]rather than experimentally observed under undervolted hardware conditions\. Consequently, the impact of transient faults during the training phase remains largely unexplored\. In contrast, this work investigates transient faults induced exclusively through undervolting a physical GPU and examines whether such perturbations can be leveraged to beneficially influence training dynamics\.

Undervolting injects subtle stochasticity into the arithmetic of learning itself, which may push the network toward flatter representations rather than the sharp decision boundaries that gradient\-based attacks exploit\. Because dynamic power scales quadratically with supply voltage, the same knob also lowers energy consumption\. The technique therefore carries a dual benefit, greener training and more resilient models, from one hardware setting requiring no algorithmic change\.

To investigate this, we run standard and adversarial training, each at nominal and undervolted GPU voltage, training LeNet\[[16](https://arxiv.org/html/2608.20572#bib.bib21)\], VGG\-6\[[27](https://arxiv.org/html/2608.20572#bib.bib27)\], and MobileNetV3\[[11](https://arxiv.org/html/2608.20572#bib.bib28)\]on MNIST\[[16](https://arxiv.org/html/2608.20572#bib.bib21)\]and CIFAR\-10\[[15](https://arxiv.org/html/2608.20572#bib.bib22)\]and evaluating all models against PGD attacks\[[21](https://arxiv.org/html/2608.20572#bib.bib29)\]across a range of perturbation budgets \(Figure[1](https://arxiv.org/html/2608.20572#S1.F1)\)\. In both regimes, the undervolted variant is consistently more robust than its nominal\-voltage counterpart while consuming less energy\.

These findings represent an encouraging first step rather than a complete defense\. Beyond demonstrating that undervolting can improve robustness against adversarial attacks while simultaneously offering energy\-efficiency benefits, our results suggest a promising new research direction at the intersection of hardware reliability, energy optimization, and AI robustness\. Building on these encouraging results, future work in this area is encouraged to further explore bit\-level fault behavior and extend evaluations to larger foundation and quantized models, where both robustness dynamics and energy savings may become even more pronounced\. The contributions of this paper are summarized as follows\.

- •We characterize the computational faults induced by undervolting on a real GPU, showing that they are stochastic yet controllable\.
- •We propose training\-time undervolting as a novel means of improving CNN robustness on GPUs, demonstrating that hardware\-generated noise during training is a practical, easily deployable, and energy\-efficient security mechanism\.
- •We evaluate undervolting under both standard and adversarial training and show that it improves robustness in both regimes\.
- •We quantify the resulting power reduction, showing that these robustness gains arrive alongside measurable energy savings and acceptable computational reliability\.

## IIBackground and Related Work

### II\-AUndervolting\-Induced Faults

Undervolting, the reduction of a circuit’s supply voltage below its nominal level, is an effective way to improve energy efficiency in high\-performance systems such as GPUs, since dynamic power scales approximately with the square of the supply voltage\. The same reduction, however, slows transistor switching and degrades circuit timing, producing computational instability and transient faults\. The quantitative relation between voltage, delay, and error probability therefore determines how undervolting affects GPU\-based deep learning\.

Impact on Power Consumption: Total GPU power is the sum of dynamic and static components,

Ptotal=Pdyn\+Pstatic=αs​CL​Vd​d2​fclk\+Ileak​Vd​d,P\_\{\\text\{total\}\}=P\_\{\\text\{dyn\}\}\+P\_\{\\text\{static\}\}=\\alpha\_\{s\}C\_\{L\}V\_\{dd\}^\{2\}f\_\{\\text\{clk\}\}\+I\_\{\\text\{leak\}\}V\_\{dd\},\(1\)
whereαs\\alpha\_\{s\}is the switching activity factor,CLC\_\{L\}the effective load capacitance,fclkf\_\{\\text\{clk\}\}the clock frequency, andIleakI\_\{\\text\{leak\}\}the leakage current\. BecausePdynP\_\{\\text\{dyn\}\}scales quadratically withVd​dV\_\{dd\}whilePstaticP\_\{\\text\{static\}\}decreases linearly, lowering the voltage reduces both terms, at the cost of timing reliability\.

Voltage\-Delay Relationship and Timing Faults: The propagation delaytdt\_\{d\}of a CMOS logic gate depends strongly on the supply voltage,

td∝Vd​d\(Vd​d−Vt​h\)α,td≤Tclk=1fclk,t\_\{d\}\\propto\\frac\{V\_\{dd\}\}\{\(V\_\{dd\}\-V\_\{th\}\)^\{\\alpha\}\},\\qquad t\_\{d\}\\leq T\_\{\\text\{clk\}\}=\\frac\{1\}\{f\_\{\\text\{clk\}\}\},\(2\)
whereVt​hV\_\{th\}is the threshold voltage,α\\alpha\(typically between 1 and 2\) the velocity saturation index, andTclkT\_\{\\text\{clk\}\}the clock period\. Correct operation requires the second condition to hold on every logic path\. When undervolting pushestdt\_\{d\}beyondTclkT\_\{\\text\{clk\}\},timing violationsoccur and produce incorrect outputs or transient faults\. The likelihood of such faults grows exponentially as the voltage margin shrinks,

Pfault≈e−β⁡\(Vd​d−Vmin\),P\_\{\\text\{fault\}\}\\approx e^\{\-\\beta\(V\_\{dd\}\-V\_\{\\text\{min\}\}\)\},\(3\)
whereVminV\_\{\\text\{min\}\}is the minimum stable voltage andβ\\betaa hardware\-dependent sensitivity constant\. AsVd​dV\_\{dd\}approachesVminV\_\{\\text\{min\}\}, the system transitions sharply from reliable computation to frequent soft errors\. In GPU workloads these faults appear mainly as small perturbations in floating\-point arithmetic,

y~=y\+δ⁡\(Vd​d\),\\tilde\{y\}=y\+\\delta\(V\_\{dd\}\),\(4\)
whereyyis the correct output,y~\\tilde\{y\}the computed result under undervolting, andδ⁡\(Vd​d\)\\delta\(V\_\{dd\}\)voltage\-dependent noise whose variance grows as the voltage is lowered\. Mild undervolting therefore introduces stochastic noise, whereas aggressive undervolting causes substantial numerical instability\.

Implications for Deep Learning: Such faults are not always harmful\. Neural networks tolerate low\-level noise because of their distributed representations, and the random errors induced by undervolting may act as a regularizer comparable to dropout or weight noise, potentially improving generalization and robustness\. Excessive undervolting, in contrast, disrupts gradient\-based optimization and degrades convergence and accuracy\.

### II\-BRandomization\-based Defenses

Convolutional Neural Networks \(CNNs\) remain vulnerable to adversarial perturbations, small crafted input changes that drastically alter predictions\. Randomization\-based defenses counter this threat by injecting stochasticity into inference or training so that the structured gradients attackers rely on become unreliable\. Randomness has been applied at three levels: to inputs, through stochastic resizing, padding, and augmentation\[[30](https://arxiv.org/html/2608.20572#bib.bib4),[5](https://arxiv.org/html/2608.20572#bib.bib5)\]; to intermediate features, through noise injection that turns a single network into an implicit ensemble of stochastic models\[[20](https://arxiv.org/html/2608.20572#bib.bib6)\]; and to parameters, through Monte Carlo dropout, Bayesian uncertainty modeling, and stochastic quantization or weight noise\[[10](https://arxiv.org/html/2608.20572#bib.bib10)\]\. Randomized smoothing formalizes the idea by averaging predictions under Gaussian noise to obtain probabilistic robustness guarantees within a norm\-ball\[[17](https://arxiv.org/html/2608.20572#bib.bib7),[4](https://arxiv.org/html/2608.20572#bib.bib8)\], with later variants improving certified robustness at comparable accuracy\[[8](https://arxiv.org/html/2608.20572#bib.bib9),[10](https://arxiv.org/html/2608.20572#bib.bib10)\]\.

The paradigm has known limits\. Expectation\-over\-transformation attacks recover usable gradients by averaging over the randomization itself\[[2](https://arxiv.org/html/2608.20572#bib.bib11)\], and excessive noise degrades clean\-input accuracy, so the degree of stochasticity requires calibration\. Randomization nevertheless remains a flexible and inexpensive route to robustness, and hardware\-level stochastic effects such as those induced by GPU undervolting extend it by supplying intrinsic randomization during training at no additional computational cost, while leaving inference deterministic\.

## IIIProposed Methodology

We propose a training methodology that exploits hardware\-level undervolting to inject beneficial stochastic noise into CNN training\. This section defines the threat model, formalizes how undervolting\-induced faults enter the learning process, and describes the training procedure and operating\-point selection\.

### III\-AThreat Model

We consider the standard white\-box evasion setting: the adversary has full knowledge of the trained model’s architecture and parameters and craftsLpL\_\{p\}\-bounded perturbations using first\-order methods, instantiated in our evaluation as PGD over a range of budgetsϵ\\epsilon\. The adversary attacks the deployed model, which executes at nominal voltage; the defender controls only the hardware configuration of the training process\. We assume the defender’s GPU supports voltage adjustment through standard driver tooling and that training completes without fatal faults, a condition enforced by the operating\-point selection in Section[III\-C](https://arxiv.org/html/2608.20572#S3.SS3)\. Fault\-injection attacks on the model itself\[[3](https://arxiv.org/html/2608.20572#bib.bib17),[31](https://arxiv.org/html/2608.20572#bib.bib18),[1](https://arxiv.org/html/2608.20572#bib.bib26)\]are outside our scope\.

### III\-BUndervolting as a Training\-Time Noise Source

As established in Section[II](https://arxiv.org/html/2608.20572#S2), operating below nominal voltage perturbs individual arithmetic operations asy~=y\+δ⁡\(Vd​d\)\\tilde\{y\}=y\+\\delta\(V\_\{dd\}\), where the variance ofδ\\deltagrows as voltage decreases\.

During training, every operation in the forward pass, backward pass, and weight update is subject to such perturbation\. The parameter update at stepttis therefore effectively

wt\+1=wt−η⁡\(∇L​\(wt\)\+δt\),w\_\{t\+1\}\\;=\\;w\_\{t\}\\;\-\\;\\eta\\left\(\\nabla L\(w\_\{t\}\)\+\\delta\_\{t\}\\right\),\(5\)whereη\\etais the learning rate,LLthe training loss, andδt\\delta\_\{t\}aggregates the voltage\-induced perturbations accumulated through the computation of the gradient\. Unlike software\-based noise injection, which adds computation and targets a chosen site \(inputs, activations, or weights\),δt\\delta\_\{t\}arises in every operation at zero computational cost and with no modification to the training pipeline\. Rather than suppressing these perturbations as errors, we treat them as intrinsic noise regularization, consistent with prior evidence that stochastic noise applied during training improves adversarial robustness\[[17](https://arxiv.org/html/2608.20572#bib.bib7)\]\. Because per\-operation perturbations concentrate in low\-significance mantissa bits \(Section[V\-A](https://arxiv.org/html/2608.20572#S5.SS1)\), they are small enough for optimization to converge to full clean accuracy, yet pervasive enough that their cumulative effect shapes the learned solution\. At deployment, the model executes at nominal voltage; no faults occur at inference and the model’s outputs are fully deterministic\.

### III\-CTraining Procedure and Operating\-Point Selection

For each architecture–dataset pair, we sweep voltage–frequency operating points downward from nominal and select the lowest voltage at which training reliably completes, the point of maximum fault incidence short of instability\. The GPU is held at this voltage for the entire training run, so perturbations act on every iteration from initialization to convergence\.

We evaluate the method under a2×22\{\\times\}2design: two training regimes, standard and adversarial, each executed at nominal and undervolted voltage with matched random seeds, weight initializations, and hyperparameters, so that within each regime the applied voltage is the only systematic difference between runs\. Adversarial noise is deliberately crafted to maximize model error within a constrained threat model, whereas undervolting noise arises from hardware fluctuations outside the nominal voltage margin; because the two differ in both origin and statistical properties, we hypothesize that they act as complementary robustness mechanisms\. In the adversarial regime, on\-the\-fly PGD example generation executes under the same voltage condition as the weight updates, since both are components of the training process\. All trained models are evaluated identically at nominal voltage\.

## IVExperimental Setup

All experiments usedPyTorchon a dedicated server with an NVIDIARTX 3090GPU, which provides 10,496 CUDA cores and 24 GB of GDDR6X memory\. Undervolting was applied throughMSI Afterburner, which exposes voltage in 6 mV steps and frequency in 15 MHz steps, fine enough to explore the energy\-accuracy trade\-off across operating points systematically\.

We evaluated three architectures spanning a range of depths and computational budgets: the classicalLeNet, a lightweightVGG\-6, andMobileNetV3\. Training used two benchmark image\-classification datasets,MNISTandCIFAR\-10\. MNIST offers a clean, low\-complexity setting for controlled observation of basic behavior, while CIFAR\-10 demands deeper feature extraction and exercises undervolting under heavier computational load\. To evaluate the robustness of the model, we employed the untargeted PGD attack implemented in thetorchattacksversion3\.5\.13\.5\.1library withα=0\.007\\alpha=0\.007and100100optimization steps, varying the perturbation budgetϵ\\epsilonuntil the model accuracy approached zero\.

## VEvaluation

### V\-ACharacterizing Undervolting\-Induced Faults

Before evaluating training outcomes, we characterize the faults undervolting induces on our GPU, since these faults are the noise source our method relies on\. Prior characterizations were performed on CPUs\[[13](https://arxiv.org/html/2608.20572#bib.bib14)\]and FPGAs\[[26](https://arxiv.org/html/2608.20572#bib.bib12),[12](https://arxiv.org/html/2608.20572#bib.bib13)\], where undervolting measurably perturbs inference computation; whether GPU faults behave comparably has not been examined\.

We recreated the core experiment of\[[13](https://arxiv.org/html/2608.20572#bib.bib14)\], originally conducted on a CPU, multiplying two tensors repeatedly, a billion times in our case, to amplify faults until bit\-level errors become measurable\. We ran the computation at nominal voltage and at the lowest stable undervolted setting the hardware supports, then compared outputs bit by bit, tracking the number of flips and their distribution across the 32\-bit floating\-point representation\. Figure[2](https://arxiv.org/html/2608.20572#S5.F2)reports the frequency of flips and the direction of each transition per bit position\.

\(a\)Bit flip distribution across bit position![Refer to caption](https://arxiv.org/html/2608.20572v1/Diversity.png)\(b\)Diversity
\(c\)Number of bit flips
Fig\. 2:Impact of undervolting on multiplication in GPU\(a\)LeNet\-MNIST\(b\)VGG\-6\-MNIST\(c\)MobileNet\-V3\-CIFAR\-10
Fig\. 3:Comparison of the robustness of original models trained under normal GPU operation and undervolted GPU conditions using adversarial samples generated with various noise budgetsNearly all observed flips fall in the mantissa, with far fewer in the exponent field\. Mantissa bits encode fine\-grained precision rather than large numeric shifts, so each fault perturbs a result by an amount well below the sensitivity threshold of a trained network\. Consistent with this, we verified that a trained model’s inference accuracy is nearly identical at nominal and undervolted voltage on our GPU, in contrast to the degradation reported on other platforms\[[26](https://arxiv.org/html/2608.20572#bib.bib12)\]; individual faults are simply too small to alter predictions in a single forward pass\.

This characterization explains why undervolted training remains viable and beneficial\. Because per\-operation perturbations are small, stochastic, and unbiased, gradient descent tolerates them and converges to full clean accuracy\. Because they are injected into every arithmetic operation across millions of training iterations, their cumulative effect nonetheless shapes the optimization, acting as the implicit regularization whose impact on robustness we evaluate next\.

### V\-BUndervolted Training

Figure[3](https://arxiv.org/html/2608.20572#S5.F3)contrasts standard and undervolted training under adversarial perturbation\. For each model we first trained conventionally at nominal GPU voltage, then generated adversarial samples with PGD, sweeping over a range of perturbation budgets\. The resulting accuracies form the blue curve in the figure and show the expected degradation as perturbation strength grows\.

\(a\)LeNet\-MNIST\(b\)VGG\-6\-MNIST\(c\)MobileNet\-V3\-CIFAR\-10
Fig\. 4:Comparison of the robustness of adversarial\-trained models trained under normal GPU operation and undervolted GPU conditions using adversarial samples generated with various noise budgetsWe then repeated the pipeline on the same datasets with the GPU held at the lowest voltage at which the system remained stable, producing what we call theundervolted model\.

Table[I](https://arxiv.org/html/2608.20572#S5.T1)reports the voltage and frequency for nominal and undervolted operation together with the resulting power improvement\. Frequency is unchanged between the two settings, so the reduction is attributable to voltage alone\.

TABLE I:Voltage, Frequency, and Power Improvement Across ModelsTurning to robustness, Figure[3](https://arxiv.org/html/2608.20572#S5.F3)shows that the gap between the two training regimes widens as the adversarial budget grows; baseline models lose accuracy rapidly under stronger perturbations, consistent with the documented vulnerability of CNNs, while undervolted models retain higher accuracy across all budgets at which either retains nonzero accuracy\. The trend holds across every architecture and dataset evaluated, so controlled hardware\-level noise introduced during training acts as an implicit regularizer that improves adversarial robustness, perhaps by favoring flatter minima or by exposing the network to fluctuations that resemble adversarial distortion\.

The gain was not uniform across different models, however, it was noticeably smaller for larger, deeper models such as MobileNetV3 \(Figure[3\(c\)](https://arxiv.org/html/2608.20572#S5.F3.sf3)\)\. We attribute this to greater fault masking in their deeper convolutional and intermediate computations, where the many nonlinear stages and pooling operations tend to absorb small perturbations before they propagate to the output\. This interpretation is reinforced by our fault characterization, which shows that most observed faults occurred in lower\-significance bits \(Figure[2\(a\)](https://arxiv.org/html/2608.20572#S5.F2.sf1)\), whose corruption is more easily tolerated by an already redundant representation\. As future work, we plan to evaluate larger models with a higher proportion of linear layers, which offer fewer masking opportunities, to better understand how this robustness behavior generalizes across network depth and structure\.

### V\-CUndervolted Adversarial Training

To test the complementarity hypothesized in Section[III\-C](https://arxiv.org/html/2608.20572#S3.SS3), we performed adversarial training under nominal and undervolted conditions\. Both runs followed the standard PGD procedure: adversarial examples were generated on\-the\-fly from the model’s current parameters at each iteration and used to update the weights, keeping the model exposed to perturbations throughout training\.

We then evaluated both models across a wide range of PGD attack strengths\. Figure[4](https://arxiv.org/html/2608.20572#S5.F4)compares the two\. The undervolted version is consistently more robust across every architecture and dataset, with the margin widening at medium to high perturbation budgets where the baseline begins to deteriorate\. The gain is notable given that adversarial training already ranks among the strongest available defenses, yet undervolting\-induced noise improves it further\.

## VIDiscussion and future work

The proposed undervolting\-based approach demonstrated noticeable improvements over the baseline, highlighting its effectiveness as a promising technique for enhancing both the robustness and energy efficiency of AI models\. Although the current results are preliminary, they provide strong evidence that undervolting can be leveraged not only as a power optimization technique but also as a mechanism for improving model resilience, introducing a new research direction at the intersection of energy\-efficient computing and AI robustness\.

Neural networks and AI now serve as the backbone of a wide range of application domains\[[9](https://arxiv.org/html/2608.20572#bib.bib30),[7](https://arxiv.org/html/2608.20572#bib.bib31)\], so a hardware\-level defense is only valuable insofar as it transfers beyond the architectures evaluated here\. Building on these encouraging results, several directions will be explored in future work\. First, we plan to extend the evaluation to larger and more complex foundation models particularly those with a higher proportion of linear layers, which offer fewer masking opportunities as well as quantized and other optimized AI models, to assess the generality and scalability of the approach\. We also intend to investigate more advanced voltage and frequency scaling strategies to identify optimal operating points that maximize robustness while preserving computational efficiency\. Another important direction is the characterization and localization of undervolting\-induced bit\-flips\. By analyzing where bit\-flips occur, their frequency, and their impact on model behavior, we aim to better understand fault propagation under undervolting conditions and support the development of more targeted and effective undervolting strategies\.

## VIIConclusion

This study demonstrates that controlled GPU undervolting offers a promising avenue for enhancing the robustness of CNNs while simultaneously reducing GPU energy consumption\. By characterizing the stochastic faults induced by lowering voltage on real GPUs, we show that hardware\-level perturbations can act as an implicit regularizer, improving generalization and resilience to both natural and adversarial input variations, without significant degradation in model accuracy\. This work opens a new perspective at the intersection of GPU hardware and machine learning, motivating future research on larger foundation models\.

## References

- \[1\]S\. K\. Abharian and S\. M\. P\. Dinakarrao\(2026\)GBFA: gradual bit\-flip fault attack on graph neural network accelerators\.In2026 27th International Symposium on Quality Electronic Design \(ISQED\),pp\. 1–8\.Cited by:[§I](https://arxiv.org/html/2608.20572#S1.p2.1),[§III\-A](https://arxiv.org/html/2608.20572#S3.SS1.p1.1)\.
- \[2\]A\. Athalye, N\. Carlini, and D\. Wagner\(2018\)Obfuscated gradients give a false sense of security: circumventing defenses to adversarial examples\.InInternational conference on machine learning,pp\. 274–283\.Cited by:[§II\-B](https://arxiv.org/html/2608.20572#S2.SS2.p2.1)\.
- \[3\]Z\. Coalson, J\. Woo, S\. Chen, Y\. Sun, L\. Yang, P\. Nair, B\. Fang, and S\. Hong\(2024\)PrisonBreak: jailbreaking large language models with fewer than twenty\-five targeted bit\-flips\.arXiv preprint arXiv:2412\.07192\.Cited by:[§I](https://arxiv.org/html/2608.20572#S1.p2.1),[§III\-A](https://arxiv.org/html/2608.20572#S3.SS1.p1.1)\.
- \[4\]J\. Cohen, E\. Rosenfeld, and Z\. Kolter\(2019\)Certified adversarial robustness via randomized smoothing\.Ininternational conference on machine learning,pp\. 1310–1320\.Cited by:[§II\-B](https://arxiv.org/html/2608.20572#S2.SS2.p1.1)\.
- \[5\]G\. S\. Dhillon, K\. Azizzadenesheli, Z\. C\. Lipton, J\. Bernstein, J\. Kossaifi, A\. Khanna, and A\. Anandkumar\(2018\)Stochastic activation pruning for robust adversarial defense\.arXiv preprint arXiv:1803\.01442\.Cited by:[§II\-B](https://arxiv.org/html/2608.20572#S2.SS2.p1.1)\.
- \[6\]A\. Gholami, S\. Kim, Z\. Dong, Z\. Yao, M\. W\. Mahoney, and K\. Keutzer\(2022\)A survey of quantization methods for efficient neural network inference\.InLow\-power computer vision,pp\. 291–326\.Cited by:[§I](https://arxiv.org/html/2608.20572#S1.p2.1)\.
- \[7\]M\. Hadi Nezhad, F\. E\. V\. Castro, E\. Mak, P\. J\. Haas, D\. Allessio, L\. Osterweil, I\. Rasul, H\. Conboy, and I\. Arroyo\(2025\)Embedding ethical awareness in computer science and ai education: the pearce approach to responsible computing\.InInternational Conference on Artificial Intelligence in Education,pp\. 135–149\.Cited by:[§VI](https://arxiv.org/html/2608.20572#S6.p2.1)\.
- \[8\]Z\. Hao, C\. Ying, Y\. Dong, H\. Su, J\. Song, and J\. Zhu\(2022\)Gsmooth: certified robustness against semantic transformations via generalized randomized smoothing\.InInternational Conference on Machine Learning,pp\. 8465–8483\.Cited by:[§II\-B](https://arxiv.org/html/2608.20572#S2.SS2.p1.1)\.
- \[9\]M\. Hariri, W\. Chen, N\. Shahini, V\. Singh, K\. Ye, A\. Samandar, D\. Ganguly, S\. Sankar, Y\. Zhang, S\. Wang,et al\.\(2026\)Test\-time scaling in reasoning llms: inference regimes, evaluation, and reproducibility\.arXiv preprint arXiv:2608\.04001\.Cited by:[§VI](https://arxiv.org/html/2608.20572#S6.p2.1)\.
- \[10\]H\. Hong and Y\. Hong\(2022\)Certified adversarial robustness via anisotropic randomized smoothing\.arXiv preprint arXiv:2207\.05327\.Cited by:[§II\-B](https://arxiv.org/html/2608.20572#S2.SS2.p1.1)\.
- \[11\]A\. Howard, M\. Sandler, B\. Chen, W\. Wang, L\. Chen, M\. Tan, G\. Chu, V\. Vasudevan, Y\. Zhu, R\. Pang,et al\.\(2019\)Searching for mobilenetv3\.In2019 IEEE/CVF international conference on computer vision \(ICCV\),pp\. 1314–1324\.Cited by:[§I](https://arxiv.org/html/2608.20572#S1.p5.1)\.
- \[12\]M\. S\. Islam, B\. Omidi, I\. Alouani, and K\. N\. Khasawneh\(2023\)Vpp: privacy preserving machine learning via undervolting\.In2023 IEEE International Symposium on Hardware Oriented Security and Trust \(HOST\),pp\. 315–325\.Cited by:[§I](https://arxiv.org/html/2608.20572#S1.p2.1),[§V\-A](https://arxiv.org/html/2608.20572#S5.SS1.p1.1)\.
- \[13\]S\. Islam, I\. Alouani, and K\. N\. Khasawneh\(2021\)Lower voltage for higher security: using voltage overscaling to secure deep neural networks\.In2021 IEEE/ACM International Conference On Computer Aided Design \(ICCAD\),pp\. 1–9\.Cited by:[§I](https://arxiv.org/html/2608.20572#S1.p2.1),[§I](https://arxiv.org/html/2608.20572#S1.p3.1),[§V\-A](https://arxiv.org/html/2608.20572#S5.SS1.p1.1),[§V\-A](https://arxiv.org/html/2608.20572#S5.SS1.p2.1)\.
- \[14\]J\. Juffinger, S\. Kalinin, D\. Gruss, and F\. Mueller\(2024\)Suit: secure undervolting with instruction traps\.InProceedings of the 29th ACM International Conference on Architectural Support for Programming Languages and Operating Systems, Volume 2,pp\. 1128–1145\.Cited by:[§I](https://arxiv.org/html/2608.20572#S1.p2.1)\.
- \[15\]A\. Krizhevsky G\. Hintonet al\.\(2009\)Learning multiple layers of features from tiny images\.Cited by:[§I](https://arxiv.org/html/2608.20572#S1.p5.1)\.
- \[16\]Y\. LeCun\(1998\)The mnist database of handwritten digits\.http://yann\. lecun\. com/exdb/mnist/\.Cited by:[§I](https://arxiv.org/html/2608.20572#S1.p5.1)\.
- \[17\]M\. Lecuyer, V\. Atlidakis, R\. Geambasu, D\. Hsu, and S\. Jana\(2019\)Certified robustness to adversarial examples with differential privacy\.In2019 IEEE symposium on security and privacy \(SP\),pp\. 656–672\.Cited by:[§II\-B](https://arxiv.org/html/2608.20572#S2.SS2.p1.1),[§III\-B](https://arxiv.org/html/2608.20572#S3.SS2.p2.2)\.
- \[18\]J\. Leng, A\. Buyuktosunoglu, R\. Bertran, P\. Bose, and V\. J\. Reddi\(2015\)Safe limits on voltage reduction efficiency in gpus: a direct measurement approach\.InProceedings of the 48th International Symposium on Microarchitecture,pp\. 294–307\.Cited by:[§I](https://arxiv.org/html/2608.20572#S1.p2.1)\.
- \[19\]J\. Lin, L\. Zhu, W\. Chen, W\. Wang, C\. Gan, and S\. Han\(2022\)On\-device training under 256kb memory\.Advances in Neural Information Processing Systems35,pp\. 22941–22954\.Cited by:[§I](https://arxiv.org/html/2608.20572#S1.p1.1)\.
- \[20\]X\. Liu, M\. Cheng, H\. Zhang, and C\. Hsieh\(2018\)Towards robust neural networks via random self\-ensemble\.InProceedings of the european conference on computer vision \(ECCV\),pp\. 369–385\.Cited by:[§II\-B](https://arxiv.org/html/2608.20572#S2.SS2.p1.1)\.
- \[21\]A\. Madry, A\. Makelov, L\. Schmidt, D\. Tsipras, and A\. Vladu\(2018\)Towards deep learning models resistant to adversarial attacks\.InInternational conference on learning representations,Cited by:[§I](https://arxiv.org/html/2608.20572#S1.p5.1)\.
- \[22\]S\. Majumdar, M\. H\. Samavatian, K\. Barber, and R\. Teodorescu\(2021\)Using undervolting as an on\-device defense against adversarial machine learning attacks\.In2021 IEEE International Symposium on Hardware Oriented Security and Trust \(HOST\),pp\. 158–169\.Cited by:[§I](https://arxiv.org/html/2608.20572#S1.p2.1),[§I](https://arxiv.org/html/2608.20572#S1.p3.1)\.
- \[23\]G\. Menghani\(2023\)Efficient deep learning: a survey on making deep learning models smaller, faster, and better\.ACM Computing Surveys55\(12\),pp\. 1–37\.Cited by:[§I](https://arxiv.org/html/2608.20572#S1.p2.1)\.
- \[24\]N\. Nazari, H\. M\. Makrani, C\. Fang, H\. Sayadi, S\. Rafatirad, K\. N\. Khasawneh, and H\. Homayoun\(2024\)Forget and rewire: enhancing the resilience of transformer\-based models against\{\\\{bit\-flip\}\\\}attacks\.In33rd USENIX Security Symposium \(USENIX Security 24\),pp\. 1349–1366\.Cited by:[§I](https://arxiv.org/html/2608.20572#S1.p2.1)\.
- \[25\]D\. Patterson, J\. Gonzalez, Q\. Le, C\. Liang, L\. Munguia, D\. Rothchild, D\. So, M\. Texier, and J\. Dean\(2021\)Carbon emissions and large neural network training\.arXiv preprint arXiv:2104\.10350\.Cited by:[§I](https://arxiv.org/html/2608.20572#S1.p1.1)\.
- \[26\]B\. Salami, E\. B\. Onural, I\. E\. Yuksel, F\. Koc, O\. Ergin, A\. C\. Kestelman, O\. Unsal, H\. Sarbazi\-Azad, and O\. Mutlu\(2020\)An experimental study of reduced\-voltage operation in modern fpgas for neural network acceleration\.In2020 50th Annual IEEE/IFIP International Conference on Dependable Systems and Networks \(DSN\),pp\. 138–149\.Cited by:[§V\-A](https://arxiv.org/html/2608.20572#S5.SS1.p1.1),[§V\-A](https://arxiv.org/html/2608.20572#S5.SS1.p3.1)\.
- \[27\]K\. Simonyan and A\. Zisserman\(2015\)Very deep convolutional networks for large\-scale image recognition\.In3rd international conference on learning representations \(ICLR 2015\),Cited by:[§I](https://arxiv.org/html/2608.20572#S1.p5.1)\.
- \[28\]A\. Tahmasivand, N\. Zahran, S\. Al\-Sayouri, M\. Fouda, and K\. N\. Khasawneh\(2025\)LM\-fix: lightweight bit\-flip detection and rapid recovery framework for language models\.In2025 IEEE 43rd International Conference on Computer Design \(ICCD\),pp\. 432–440\.Cited by:[§I](https://arxiv.org/html/2608.20572#S1.p2.1)\.
- \[29\]A\. Tang, S\. Sethumadhavan, and S\. Stolfo\(2017\)\{\\\{clkscrew\}\\\}: Exposing the perils of\{\\\{security\-oblivious\}\\\}energy management\.In26th USENIX Security Symposium \(USENIX Security 17\),pp\. 1057–1074\.Cited by:[§I](https://arxiv.org/html/2608.20572#S1.p2.1)\.
- \[30\]C\. Xie, J\. Wang, Z\. Zhang, Z\. Ren, and A\. Yuille\(2017\)Mitigating adversarial effects through randomization\.arXiv preprint arXiv:1711\.01991\.Cited by:[§II\-B](https://arxiv.org/html/2608.20572#S2.SS2.p1.1)\.
- \[31\]N\. Zahran, A\. Tahmasivand, I\. Alouani, K\. Khasawneh, and M\. Fouda\(2025\)On jailbreaking quantized language models through fault injection attacks\.InProceedings of the Great Lakes Symposium on VLSI 2025,pp\. 554–561\.Cited by:[§I](https://arxiv.org/html/2608.20572#S1.p2.1),[§III\-A](https://arxiv.org/html/2608.20572#S3.SS1.p1.1)\.