Characterizing the Fault Response of the Intel Neural Compute Stick 2 Under Single-Pulse Electromagnetic Fault Injection

2026-05-21

AI Summary

This study addresses the lack of systematic understanding of fault behavior in commercial neural network inference accelerators under transient disturbances, a critical concern for safety-critical edge applications. Through single-pulse electromagnetic fault injection (EMFI), the authors evaluate the robustness of the Intel Neural Compute Stick 2 (NCS2) executing ImageNet models and report, for the first time, that localized EMFI at specific hotspots can induce persistent accuracy collapse—with Top-1 accuracy dropping below 5%—at probabilities as high as 31%. Notably, such faults can be triggered even during idle states and evade both API-level detection and load-time integrity checks. Based on experiments with ResNet-18/50 and VGG-11 deployed via OpenVINO, four reproducible fault patterns are identified. The work further proposes an application-layer mitigation strategy requiring no firmware or runtime modifications, enabling full recovery through a simple USB power cycle.

Abstract

Vision processing units and other commercial neural-network inference accelerators are increasingly deployed in safety-relevant edge applications, but their fault response under transient hardware disturbances remains poorly characterized in the open literature. For the Intel Movidius Myriad X, packaged as the Intel Neural Compute Stick 2 (NCS2), only a single feasibility study has been published. We report a systematic single-pulse electromagnetic fault injection (EMFI) campaign on the NCS2 running three ImageNet-trained convolutional neural networks (ResNet-18, ResNet-50, VGG-11) on the OpenVINO runtime. Across 1,536 spot-test trials at characterized hotspots and approximately 16,000 parameter-search trials, single pulses produce four reproducible outcome classes: no measured accuracy change, minor silent data corruption, major persistent degradation that survives across subsequent inferences until model reload, and device hangs requiring USB power-cycling; these outcomes are respectively interpreted as no-effect, SDC with possible SET-like or small persistent-state mechanisms, SEU-like persistent corruption, and SEFI-like loss of functionality. Two findings are central. First, the major-degradation class can be induced at 18-31% of trials at characterized hotspots, with post-collapse top-1 accuracy below five percent and persistence across all subsequent inferences until explicit model reload - a regime that no inference-API-level mechanism detects. Second, this regime is also inducible by pulses delivered to an idle device with the model already loaded, demonstrating that load-time integrity checks alone are insufficient. We discuss mitigation strategies graded by class, focusing on mechanisms implementable at the application level without modification to the device firmware or the OpenVINO runtime.

Problem

• fault injection
• neural network accelerator
• electromagnetic interference
• transient fault
• safety-critical systems

Innovation

• electromagnetic fault injection
• neural network accelerator
• silent data corruption
• persistent fault effect
• edge AI reliability