    \section{Low-Voltage Induced Random Bit Errors in Quantized DNN Weights}
\label{sec:supp-main}

We provide a more detailed discussion of the considered error model: random bit errors, induced through low-voltage operation of memories commonly used on DNN accelerators \cite{KimDATE2018,KoppulaMICRO2019}. Work such as \cite{ChandramoorthyHPCA2019,KoppulaMICRO2019} model the effect of low-voltage induced bit errors using two parameters: the probability $\pfault$ of bit cells in accelerator memory being faulty at a given low voltage and the probability $\perror$ that a faulty bit cell results in a bit error on access.
Following measurements in works such as \cite{GanapathyHPCA2019,KimDATE2018}, we assume that these errors are \emph{not} transient errors by setting $\perror = 100\%$ such that the overall probability of bit errors is $p := \pfault \cdot \perror = \pfault$. In doing so, we consider the worst-case where faulty bit cells \emph{always} induce bit errors. However, the noise model from the main paper remains valid for any arbitrary but fixed $\perror \neq 100\%$. For the reminder of this document, we assume the probability of bit error $p = \pfault$, with $\perror = 100\%$, as in the main paper. In the following section, we describe the two parameters, $\pfault$ and $\perror$, in more details.

\begin{table}[t]
	\centering
	\caption{\textbf{Quantization-Aware Training Accuracies.} Clean \TE for $m = 8$ bits or lower using our robust fixed-point quantization. We obtain competitive performance for $m = 8$ and $m = 4$ bits. On \CifarH, a Wide ResNet (WRN) clearly outperforms our standard SimpleNet model. Batch normalization (BN), improving \TE slightly on \CifarT, is significantly less robust than group normalization (GN), \cf \tabref{tab:supp-bn}. * For $m \leq 4$, we report results with weight clipping, \Clipping[$0.1$].}
	\label{tab:supp-accuracy}
	\vspace*{-0.25cm}
	\hspace*{-0.25cm}
	\begin{subfigure}[t]{0.19\textwidth}
		\vspace*{0px}
		\small
		\begin{tabular}{|@{\hskip 4px}l@{\hskip 4px}|@{\hskip 4px}c@{\hskip 4px}|}
			\multicolumn{2}{c}{\bfseries \CifarT}\\
			\multicolumn{2}{c}{\bfseries SimpleNet+GN}\\
			\hline
			Quant. $m$ & \TE in \%\\
			\hline
			-- & 4.34\\
			8 & \bfseries 4.32\\
			4* & 5.29\\
			3* & 5.71\\
			\hline
		\end{tabular}
	\end{subfigure}
	\begin{subfigure}[t]{0.28\textwidth}
		\vspace*{0px}
		\small
		\begin{tabular}{|@{\hskip 4px}l@{\hskip 4px}|@{\hskip 4px}c@{\hskip 4px}|@{\hskip 4px}c@{\hskip 4px}|}
			\multicolumn{3}{c}{\bfseries \CifarT}\\
			\multicolumn{3}{c}{\bfseries Arch. Comparison}\\
			\hline
			Model & no Quant. & $m = 8$\\
			\hline
			SimpleNet+GN & 4.34 & 4.32\\
			SimpleBet+BN & 4.04 & 3.83\\
			ResNet-50+GN & 5.88 & 6.81\\
			ResNet-50+BN & \bfseries 3.91 & \bfseries 3.67\\
			\hline
		\end{tabular}
	\end{subfigure}\\[4px]

	\hspace*{-0.5cm}
	\begin{subfigure}[t]{0.19\textwidth}
		\vspace*{0px}
		\small
		\begin{tabular}{| l | c |}
			\multicolumn{2}{c}{\bfseries \MNIST}\\
			\hline
			Quant. $m$ & \TE in \%\\
			\hline
			4 & 0.4\\
			2* & 0.47\\
			\hline
		\end{tabular}
	\end{subfigure}
	\begin{subfigure}[t]{0.2\textwidth}
		\vspace*{0px}
		\small
		\begin{tabular}{| l | c |}
			\multicolumn{2}{c}{\bfseries \CifarH}\\
			\hline
			Quant. $m$, Model & \TE in \%\\
			\hline
			8, SimpleNet & 23.68\\
			8, WRN & 18.53\\
			\hline
		\end{tabular}
	\end{subfigure}
	\vspace*{-0.1cm}
\end{table}

\textbf{Faulty Bit Cells.} Due to variations in the fabrication process, SRAM bit cells become more or less vulnerable to low-voltage operation. For a specific voltage, the resulting bit cell failures can be assumed to be random and independent of each other. We assume a bit to be faulty with probability $\pfault$ increasing exponentially with decreased voltage \cite{GanapathyDAC2017,GanapathyHPCA2019,KimDATE2018,ChandramoorthyHPCA2019}. Furthermore, the faulty bits for $\pfault' \leq \pfault$ can be assumed to be a subset of those for $\pfault$. For a fixed chip, consisting of multiple memory arrays, the pattern (spatial distribution) of faulty cells is fixed for a specific supply voltage. Across chips/memory arrays, however, faulty cells are assumed to be random and independent of each other.

\textbf{Bit Errors in Faulty Bit Cells:} Faulty cells may cause bit errors with probability $\perror$ upon read/write access.
We note that bit errors read from memory affect \emph{all} computations performed on the read weight value.
We assume that a bit error flips the currently stored bit, where flips $0$-to-$1$ and $1$-to-$0$ are assumed equally likely.

\subsection{Profiled Bit Errors}
\label{subsec:supp-errors-profiled}

\begin{figure}[t]
	\centering
	\includegraphics[width=0.4\textwidth]{c10_clipping_linf.pdf}
	\vspace*{-8px}
	\caption{\textbf{Weight Clipping Improves $L_\infty$ Robustness.} On \CifarT, we plot \RTE for \emph{relative} $L_\infty$ perturbations on weights: Random noise with $L_\infty$-norm smaller than or equal to $x\%$ of the weight range is applied. \Clipping clearly improves robustness. Again, the relative magnitude of noise is not affected by weight clipping. Note that $L_\infty$ noise usually affects all weights, while random bit errors affect only a portion of the weights.}
	\label{fig:supp-clipping-inf}
	\vspace*{-0.2cm}
\end{figure}

\figref{fig:supp-errors} splits the bit error distributions of \figref{fig:errors} into a $0$-to-$1$ flip and a $1$-to-$0$ bit flip map. The obtained maps, $p_{\text{1t0}}$ and $p_{\text{0t1}}$, contain per-bit flip probabilities for $1$-to-$0$ and $0$-to-$1$ bit flips at a given low voltage. In this particular profiled chip, \figref{fig:supp-errors} (bottom), $0$-to-$1$ flips are more likely. Similarly, \figref{fig:supp-errors} (right) shows that most  $0$-to-$1$ flips are actually persistent across time at that voltage \ie, not random transient errors.
The following table summarizing the key statistics of the profiled chips: the overall bit error rate $p$, the rate of $1$-to-$0$ and $0$-to-$1$ flips $p_{\text{1t0}}$ and $p_{\text{0t1}}$, and the rate of persistent errors $p_{\text{sa}}$, all in \% at a specific supply voltage:

\begin{center}\small
\begin{tabular}{| l | c | c | c | c |}
	\hline
	Chip & $p$ & $p_{\text{0t1}}$ & $p_{\text{1t0}}$ & $p_{\text{sa}}$ \\
	\hline
	\multirow{2}{*}{1} & 2.744 & 1.27 & 1.47 & 1.223\\
	& 0.866 & 0.38 & 0.49 & 0.393\\
	\hline
	\multirow{3}{*}{2} & 4.707 &  3.443 & 1.091 & 0.627\\
	& 1.01 &  0.82 & 0.19 & 0.105\\
	& 0.136 & 0.115 & 0.021 & 0.01 \\
	\hline
	\multirow{2}{*}{3} & 2.297 & 1.81 & 0.48 & 0.204 \\
	& 0.597 & 0.496 & 0.0995 & 0.206 \\
	\hline
\end{tabular}
\end{center}

\begin{table*}[t]
	\centering
	\small
	\caption{\textbf{Impact of Quantization Scheme on Robustness.} Complementary to \tabref{tab:quantization-robustness}, we report \TE and \RTE for various bit error rates $p$ for the quantization scheme in \eqnref{eq:quantization} with global, per-layer and asymmetric quantization, $m = 8$ bits. Instead of quantizing into signed integer, using unsigned integers works better for asymmetric quantization. Furthermore, proper rounding instead of integer conversion also improves robustness. Note that influence on clean \TE is neglegible, \ie, the DNN can ``learn around'' these difference in quantization-aware training. Especially for $m = 4$ bit, the latter makes a significant difference in terms of robustness.}
	\label{tab:supp-quantization}
	\vspace*{-0.25cm}
	\begin{tabular}{| c | l | c | c | c | c | c | c | c |}
		\hline
		\multicolumn{9}{|c|}{\bfseries \CifarT: quantization robustness}\\
		\hline
		& Model & \multirow{2}{*}{\begin{tabular}{c}\TE\\in \%\end{tabular}} & \multicolumn{6}{c|}{\RTE in \%, $p$ in \% p=0.01}\\
		\cline{4-9}
		& (see text) && $0.01$ & $0.05$ & $0.1$ & $0.5$ & $1$ & $1.5$\\
		\hline
		\hline
		\multirow{5}{*}{\rotatebox{90}{$m = 8$ bit}} & \eqnref{eq:quantization}, global & 4.63 & 10.70 {\color{gray}\scriptsize ${\pm}$1.37} & 86.01 {\color{gray}\scriptsize ${\pm}$3.65} & 90.36 {\color{gray}\scriptsize ${\pm}$0.66} & 90.71 {\color{gray}\scriptsize ${\pm}$0.49} & 90.57 {\color{gray}\scriptsize ${\pm}$0.43} & --\\
		& \eqnref{eq:quantization}, per-layer (= \Normal) & 4.36 & 4.82 {\color{gray}\scriptsize ${\pm}$0.07} & 5.51 {\color{gray}\scriptsize ${\pm}$0.19} & 6.37 {\color{gray}\scriptsize ${\pm}$0.32} & 24.76 {\color{gray}\scriptsize ${\pm}$4.71} & 72.65 {\color{gray}\scriptsize ${\pm}$6.35} & 87.40 {\color{gray}\scriptsize ${\pm}$2.47}\\
		& +asymmetric & 4.36 & 5.76 {\color{gray}\scriptsize ${\pm}$0.09} & 6.47 {\color{gray}\scriptsize ${\pm}$0.22} & 7.85 {\color{gray}\scriptsize ${\pm}$0.46} & 40.78 {\color{gray}\scriptsize ${\pm}$7.56} & 76.72 {\color{gray}\scriptsize ${\pm}$7.01} & 85.83 {\color{gray}\scriptsize ${\pm}$2.58}\\
		& +unsigned & 4.42 & 6.58 {\color{gray}\scriptsize ${\pm}$0.13} & 6.97 {\color{gray}\scriptsize ${\pm}$0.28} & 7.49 {\color{gray}\scriptsize ${\pm}$0.41} & 17.00 {\color{gray}\scriptsize ${\pm}$2.77} & 54.57 {\color{gray}\scriptsize ${\pm}$8.58} & 83.18 {\color{gray}\scriptsize ${\pm}$3.94}\\
		& +rounded (= \Quant) & 4.32 & 4.60 {\color{gray}\scriptsize ${\pm}$0.08} & 5.10 {\color{gray}\scriptsize ${\pm}$0.13} & 5.54 {\color{gray}\scriptsize ${\pm}$0.2} & 11.28 {\color{gray}\scriptsize ${\pm}$1.47} & 32.05 {\color{gray}\scriptsize ${\pm}$6} & 68.65 {\color{gray}\scriptsize ${\pm}$9.23}\\
		\hline
		\hline
		\multirow{2}{*}{\rotatebox{90}{$4$ bit}} & integer conversion & 5.81 & 90.46 {\color{gray}\scriptsize ${\pm}$0.2} & 90.40 {\color{gray}\scriptsize ${\pm}$0.21} & 90.39 {\color{gray}\scriptsize ${\pm}$0.22} & 90.36 {\color{gray}\scriptsize ${\pm}$0.2} & 90.36 {\color{gray}\scriptsize ${\pm}$0.22} & 90.39 {\color{gray}\scriptsize ${\pm}$0.22}\\
		& proper rounding & 5.29 & 5.49 {\color{gray}\scriptsize ${\pm}$0.04} & 5.75 {\color{gray}\scriptsize ${\pm}$0.06} & 5.99 {\color{gray}\scriptsize ${\pm}$0.09} & 7.71 {\color{gray}\scriptsize ${\pm}$0.36} & 10.62 {\color{gray}\scriptsize ${\pm}$1.08} & 15.79 {\color{gray}\scriptsize ${\pm}$2.54}\\
		\hline
	\end{tabular}
	\vspace*{-0.1cm}
\end{table*}

For evaluation, we assume that the DNN weights are mapped linearly onto the memory of these chips. The bit error maps are of size $8192 \times 128$ bits for chips 2 and 3 and $2048 \times 128$ bits for chip 1. Furthermore, to simulate various different mappings, we repeat this procedure with various offsets and compute average \RTE across all mappings. For results, we refer to \appref{subsec:supp-randbet-baselines}.

\subsection{Bounding Generalization to Random Bit Errors}
\label{subsec:supp-bound}

Let $w$ denote the final weights of a trained DNN $f$. We test $f$ using $n$ i.i.d. test examples, \ie, $(x_i,y_i)_{i=1}^n$. We denote by $w'$ the weights where each bit of $w$ is flipped with probability $p$ uniformly at random, corresponding to the error model from \secref{sec:errors}.
The expected \emph{clean} error  of $f$ is given by
\begin{align*}
	\Exp[\Id_{f(x;w)\neq y}] = \Pr(f(x;w)\neq y).
\end{align*}
The expected \emph{robust} error (regarding i.i.d. test examples drawn from the data distribution) with random bit errors in the (quantized) weights is
\begin{align*}
	\Exp[ \Id_{f(x;w')\neq y}] = \Pr( f(x;w')\neq y).
\end{align*}
Here, the weights of the neural network are themselves random variables. Therefore, with $x, y, w$, and $w'$ we denote the random variables corresponding to test example, test label, weights and weights bit random bit errors. With $x_j, y_j, w_i$ and $w'_i$ we denote actual examples. Then, the following proposition derives a simple, probabilistic bound on the deviation of expected robust error from the empirically measured one (\ie, \RTE in our experiments):

\begin{table*}[t]
	\centering
	\small
	\caption{\textbf{Weight Clipping Improves Robustness.} We report \TE and \RTE for various experiments on the robustness of weight clipping with $\wmax$, \ie, \Clipping[$\wmax$]. First, we show that the robustness benefit of \Clipping is independent of quantization-aware training, robustness also improves when applying post-training quantization. Then, we show results for both symmetric and asymmetric quantization. For the latter we demonstrate that label smoothing \cite{SzegedyCVPR2016} reduces the obtained robustness. This supports our hypothesis that weight clipping, driven by minimizing cross-entropy loss during training, improves robustness through redundancy.}
	\label{tab:supp-clipping}
	\vspace*{-0.25cm}
	\begin{tabular}{| c | l | c | c | c | c | c | c | c |}
		\hline
		\multicolumn{9}{|c|}{\bfseries \CifarT ($\mathbf{m = 8}$ bit): clipping robustness for post- and during-training quantization}\\
		\hline
		&Model & \multirow{2}{*}{\begin{tabular}{c}\TE\\in \%\end{tabular}} & \multicolumn{6}{c|}{\RTE in \%, $p$ in \% p=0.01}\\
		\cline{4-9}
		&&& $0.01$ & $0.05$ & $0.1$ & $0.5$ & $1$ & $1.5$\\
		\hline
		\hline
		\multirow{6}{*}{\rotatebox{90}{\begin{tabular}{@{}c@{}}Post-Training\\Asymmetric\end{tabular}}} & \Normal & 4.37 & 4.95 {\color{gray}\scriptsize ${\pm}$0.11} & 5.47 {\color{gray}\scriptsize ${\pm}$0.17} & 6.03 {\color{gray}\scriptsize ${\pm}$0.22} & 15.42 {\color{gray}\scriptsize ${\pm}$3.4} & 51.83 {\color{gray}\scriptsize ${\pm}$9.92} & 81.74 {\color{gray}\scriptsize ${\pm}$5.14}\\
		& \Quant & 4.27 & 4.59 {\color{gray}\scriptsize ${\pm}$0.08} & 5.10 {\color{gray}\scriptsize ${\pm}$0.13} & 5.54 {\color{gray}\scriptsize ${\pm}$0.15} & 10.59 {\color{gray}\scriptsize ${\pm}$1.11} & 30.58 {\color{gray}\scriptsize ${\pm}$6.05} & 63.72 {\color{gray}\scriptsize ${\pm}$6.89}\\
		& \Clipping[$0.25$] & 4.96 & 5.24 {\color{gray}\scriptsize ${\pm}$0.07} & 5.73 {\color{gray}\scriptsize ${\pm}$0.14} & 6.16 {\color{gray}\scriptsize ${\pm}$0.21} & 10.51 {\color{gray}\scriptsize ${\pm}$0.91} & 26.27 {\color{gray}\scriptsize ${\pm}$5.65} & 61.49 {\color{gray}\scriptsize ${\pm}$9.03}\\
		& \Clipping[$0.2$] & 5.24 & 5.48 {\color{gray}\scriptsize ${\pm}$0.05} & 5.87 {\color{gray}\scriptsize ${\pm}$0.09} & 6.23 {\color{gray}\scriptsize ${\pm}$0.13} & 9.47 {\color{gray}\scriptsize ${\pm}$0.7} & 19.78 {\color{gray}\scriptsize ${\pm}$3.58} & 43.64 {\color{gray}\scriptsize ${\pm}$8.2}\\
		& \Clipping[$0.15$] & 5.38 & 5.63 {\color{gray}\scriptsize ${\pm}$0.05} & 6.03 {\color{gray}\scriptsize ${\pm}$0.09} & 6.38 {\color{gray}\scriptsize ${\pm}$0.13} & 8.80 {\color{gray}\scriptsize ${\pm}$0.41} & 15.74 {\color{gray}\scriptsize ${\pm}$2.24} & 36.29 {\color{gray}\scriptsize ${\pm}$7.34}\\
		& \Clipping[$0.1$] & 5.32 & 5.52 {\color{gray}\scriptsize ${\pm}$0.04} & 5.82 {\color{gray}\scriptsize ${\pm}$0.06} & 6.05 {\color{gray}\scriptsize ${\pm}$0.07} & 7.45 {\color{gray}\scriptsize ${\pm}$0.26} & 9.80 {\color{gray}\scriptsize ${\pm}$0.62} & 17.56 {\color{gray}\scriptsize ${\pm}$3.08}\\
		\hline
		\hline
		\multirow{7}{*}{\rotatebox{90}{\begin{tabular}{@{}c@{}}Symmetric\\(during training)\end{tabular}}} & \Normal & 4.36 & 4.82 {\color{gray}\scriptsize ${\pm}$0.07} & 5.51 {\color{gray}\scriptsize ${\pm}$0.19} & 6.37 {\color{gray}\scriptsize ${\pm}$0.32} & 24.76 {\color{gray}\scriptsize ${\pm}$4.71} & 72.65 {\color{gray}\scriptsize ${\pm}$6.35} & 87.40 {\color{gray}\scriptsize ${\pm}$2.47}\\
		& \Quant & 4.39 & 4.77 {\color{gray}\scriptsize ${\pm}$0.08} & 5.43 {\color{gray}\scriptsize ${\pm}$0.21} & 6.10 {\color{gray}\scriptsize ${\pm}$0.32} & 17.11 {\color{gray}\scriptsize ${\pm}$3.07} & 55.35 {\color{gray}\scriptsize ${\pm}$9.4} & 82.84 {\color{gray}\scriptsize ${\pm}$4.52}\\
		& \Clipping[$0.25$] & 4.63 & 4.99 {\color{gray}\scriptsize ${\pm}$0.07} & 5.53 {\color{gray}\scriptsize ${\pm}$0.1} & 6.06 {\color{gray}\scriptsize ${\pm}$0.16} & 13.55 {\color{gray}\scriptsize ${\pm}$1.42} & 41.64 {\color{gray}\scriptsize ${\pm}$7.35} & 73.39 {\color{gray}\scriptsize ${\pm}$7.15}\\
		& \Clipping[$0.2$] & 4.50 & 4.79 {\color{gray}\scriptsize ${\pm}$0.06} & 5.25 {\color{gray}\scriptsize ${\pm}$0.09} & 5.65 {\color{gray}\scriptsize ${\pm}$0.16} & 9.64 {\color{gray}\scriptsize ${\pm}$0.99} & 21.37 {\color{gray}\scriptsize ${\pm}$4.23} & 45.68 {\color{gray}\scriptsize ${\pm}$7.9}\\
		& \Clipping[$0.15$] & 5.18 & 5.42 {\color{gray}\scriptsize ${\pm}$0.05} & 5.76 {\color{gray}\scriptsize ${\pm}$0.08} & 6.07 {\color{gray}\scriptsize ${\pm}$0.09} & 8.36 {\color{gray}\scriptsize ${\pm}$0.43} & 13.80 {\color{gray}\scriptsize ${\pm}$1.45} & 24.70 {\color{gray}\scriptsize ${\pm}$3.77}\\
		& \Clipping[$0.1$] & 4.86 & 5.07 {\color{gray}\scriptsize ${\pm}$0.04} & 5.34 {\color{gray}\scriptsize ${\pm}$0.06} & 5.59 {\color{gray}\scriptsize ${\pm}$0.1} & 7.12 {\color{gray}\scriptsize ${\pm}$0.3} & 9.44 {\color{gray}\scriptsize ${\pm}$0.7} & 13.14 {\color{gray}\scriptsize ${\pm}$1.79}\\
		& \Clipping[$0.05$] & 5.56 & 5.70 {\color{gray}\scriptsize ${\pm}$0.03} & 5.89 {\color{gray}\scriptsize ${\pm}$0.06} & 6.03 {\color{gray}\scriptsize ${\pm}$0.08} & 6.68 {\color{gray}\scriptsize ${\pm}$0.14} & 7.31 {\color{gray}\scriptsize ${\pm}$0.2} & 8.06 {\color{gray}\scriptsize ${\pm}$0.36}\\
		\hline
		\hline
		\multirow{11}{*}{\rotatebox{90}{\begin{tabular}{@{}c@{}}{\color{red}\textbf{A}}symmetric (default) quant.\\(during training)\end{tabular}}} & \Normal & 4.36 & 4.82 {\color{gray}\scriptsize ${\pm}$0.07} & 5.51 {\color{gray}\scriptsize ${\pm}$0.19} & 6.37 {\color{gray}\scriptsize ${\pm}$0.32} & 24.76 {\color{gray}\scriptsize ${\pm}$4.71} & 72.65 {\color{gray}\scriptsize ${\pm}$6.35} & 87.40 {\color{gray}\scriptsize ${\pm}$2.47}\\
		& \Quant & 4.32 & 4.60 {\color{gray}\scriptsize ${\pm}$0.08} & 5.10 {\color{gray}\scriptsize ${\pm}$0.13} & 5.54 {\color{gray}\scriptsize ${\pm}$0.2} & 11.28 {\color{gray}\scriptsize ${\pm}$1.47} & 32.05 {\color{gray}\scriptsize ${\pm}$6} & 68.65 {\color{gray}\scriptsize ${\pm}$9.23}\\
		& \Clipping[$0.25$] & 4.58 & 4.84 {\color{gray}\scriptsize ${\pm}$0.05} & 5.29 {\color{gray}\scriptsize ${\pm}$0.12} & 5.71 {\color{gray}\scriptsize ${\pm}$0.16} & 10.52 {\color{gray}\scriptsize ${\pm}$1.14} & 27.95 {\color{gray}\scriptsize ${\pm}$4.16} & 62.46 {\color{gray}\scriptsize ${\pm}$8.89}\\
		& \Clipping[$0.2$] & 4.63 & 4.91 {\color{gray}\scriptsize ${\pm}$0.05} & 5.28 {\color{gray}\scriptsize ${\pm}$0.08} & 5.62 {\color{gray}\scriptsize ${\pm}$0.11} & 8.27 {\color{gray}\scriptsize ${\pm}$0.35} & 18.00 {\color{gray}\scriptsize ${\pm}$2.84} & 53.74 {\color{gray}\scriptsize ${\pm}$8.89}\\
		& \Clipping[$0.15$] & 4.42 & 4.66 {\color{gray}\scriptsize ${\pm}$0.05} & 5.01 {\color{gray}\scriptsize ${\pm}$0.09} & 5.31 {\color{gray}\scriptsize ${\pm}$0.12} & 7.81 {\color{gray}\scriptsize ${\pm}$0.6} & 13.08 {\color{gray}\scriptsize ${\pm}$2.21} & 23.85 {\color{gray}\scriptsize ${\pm}$5.07}\\
		& \Clipping[$0.1$] & 4.82 & 5.04 {\color{gray}\scriptsize ${\pm}$0.04} & 5.33 {\color{gray}\scriptsize ${\pm}$0.07} & 5.58 {\color{gray}\scriptsize ${\pm}$0.1} & 6.95 {\color{gray}\scriptsize ${\pm}$0.24} & 8.93 {\color{gray}\scriptsize ${\pm}$0.46} & 12.22 {\color{gray}\scriptsize ${\pm}$1.29}\\
		& \Clipping[$0.05$] & 5.44 & 5.59 {\color{gray}\scriptsize ${\pm}$0.04} & 5.76 {\color{gray}\scriptsize ${\pm}$0.07} & 5.90 {\color{gray}\scriptsize ${\pm}$0.07} & 6.53 {\color{gray}\scriptsize ${\pm}$0.13} & 7.18 {\color{gray}\scriptsize ${\pm}$0.16} & 7.92 {\color{gray}\scriptsize ${\pm}$0.25}\\
		\cline{2-9}
		& \Clipping[$0.2$]+LS & 4.48 & 4.77 {\color{gray}\scriptsize ${\pm}$0.05} & 5.19 {\color{gray}\scriptsize ${\pm}$0.1} & 5.55 {\color{gray}\scriptsize ${\pm}$0.12} & 9.46 {\color{gray}\scriptsize ${\pm}$0.82} & 32.49 {\color{gray}\scriptsize ${\pm}$5.07} & 68.60 {\color{gray}\scriptsize ${\pm}$7.33}\\
		& \Clipping[$0.15$]+LS & 4.67 & 4.86 {\color{gray}\scriptsize ${\pm}$0.05} & 5.23 {\color{gray}\scriptsize ${\pm}$0.08} & 5.83 {\color{gray}\scriptsize ${\pm}$0.12} & 7.99 {\color{gray}\scriptsize ${\pm}$0.43} & 29.40 {\color{gray}\scriptsize ${\pm}$6.99} & 68.99 {\color{gray}\scriptsize ${\pm}$8.48}\\
		& \Clipping[$0.1$]+LS & 4.82 & 5.05 {\color{gray}\scriptsize ${\pm}$0.04} & 5.37 {\color{gray}\scriptsize ${\pm}$0.08} & 6.10 {\color{gray}\scriptsize ${\pm}$0.11} & 7.36 {\color{gray}\scriptsize ${\pm}$0.4} & 10.59 {\color{gray}\scriptsize ${\pm}$1.01} & 18.31 {\color{gray}\scriptsize ${\pm}$2.84}\\
		& \Clipping[$0.05$]+LS & 5.30 & 5.43 {\color{gray}\scriptsize ${\pm}$0.03} & 5.63 {\color{gray}\scriptsize ${\pm}$0.06} & 6.43 {\color{gray}\scriptsize ${\pm}$0.07} & 6.51 {\color{gray}\scriptsize ${\pm}$0.15} & 7.30 {\color{gray}\scriptsize ${\pm}$0.23} & 8.06 {\color{gray}\scriptsize ${\pm}$0.38}\\
		\hline
	\end{tabular}
	\vspace*{-0.1cm}
\end{table*}

\begin{proposition}
	\label{prop:bound}
	Let $w'_i$, $i = 1,\ldots,l$ be $l$ examples of weights bit random bit errors (each bit flipped with probability $p$). Then it holds
	\begin{align*}
		\Pr\Big( \frac{1}{nl}&\sum_{j=1}^n \sum_{i=1}^l \Id_{f(x_j;w'_i)\neq y_j} - \Pr(f(x;w')\neq y)\geq \epsilon\Big)\\
		&\quad\leq (n+1) e^{-n\epsilon^2 \frac{l}{(\sqrt{l}+\sqrt{n})^2}}.
	\end{align*}
	As alternative formulation, with probability $1-\delta$ it holds
	\begin{align*}
		\Pr( f(x; w'_i)\neq y) < & \frac{1}{nl}\sum_{j=1}^n \sum_{i=1}^l \Id_{f(x_j; w'_i)\neq y_j}\\ &+ \quad \leq\sqrt{\frac{\log\Big(\frac{n+1}{\delta}\Big)}{n}} \frac{\sqrt{l}+\sqrt{n}}{\sqrt{l}}.
	\end{align*}
\end{proposition}
{\small
\begin{proof}
Let $0<\alpha<1$. Using the Hoeffding inequality and union bound, we have:
\begin{align*}
	&\Pr\Big(\maxop_{j=1,\ldots,n} \frac{1}{l}\sum_{i=1}^l \Id_{f(x_j; w'_i)\neq y_j} - \Exp_{w'}[\Id_{f(x_j; w')\neq y_j}] > \alpha\epsilon\Big) \\
	=& \Pr\Big(\bigcup_{j=1,\ldots,n}\big\{ \frac{1}{l}\sum_{i=1}^l \Id_{f(x_j; w'_i)\neq y_j} - \Exp_{w'}[\Id_{f(x_j; w')\neq y_j}] > \alpha\epsilon\big\}\Big)\\
	&\leq \; n\, e^{-l\alpha^2 \epsilon^2}.
\end{align*}
Then, again by Hoeffding's inequality, it holds:
\begin{align*}
	&\Pr\Big( \frac{1}{n}\sum_{j=1}^n \Exp_{w'}[\Id_{f(x_j; w')\neq y_j}]
	- \Exp_{x,y}[\Exp_{w'}[\Id_{f(x; w')\neq y}]] > (1-\alpha) \epsilon \Big)\\
	&\leq \; e^{-n\epsilon^2 (1-\alpha)^2}.
\end{align*}
Thus, using
\begin{align*}
	a + b>\epsilon \Longrightarrow \{a > \alpha \epsilon\} \cup \{b > (1-\alpha)\epsilon\}
\end{align*}
gives us:
\begin{align*}
	&\Pr\Big( \frac{1}{nl}\sum_{j=1}^n \sum_{i=1}^l \Id_{f(x_j; w'_i)\neq y_j} - \Pr( f(x; w')\neq y)\geq \epsilon\Big)\\
	=& \Pr\Big( \frac{1}{n}\sum_{j=1}^n \big(\frac{1}{l}\sum_{i=1}^l \Id_{f_{w'_i}(x_j)\neq y_j} - \Exp_{w'}[\Id_{f(x_j; w'_i)\neq y_j}]\big)\\
	 +& \frac{1}{n}\sum_{j=1}^n \Exp_{w'}[\Id_{f(x_j; w'_i)\neq y_j}] - \Pr( f(x; w')\neq y)\geq \epsilon\Big)\\
	\leq & \Pr\Big( \frac{1}{n}\sum_{j=1}^n \big(\frac{1}{l}\sum_{i=1}^l \Id_{f(x_j; w'_i)\neq y_j} - \Exp_{w'}[\Id_{f(x_j; w')\neq y_j}]\big)>\alpha \epsilon\Big)\\
	+& \Pr\Big( \frac{1}{n}\sum_{j=1}^n \Exp_{w'}[\Id_{f(x_j; w')\neq y_j}] - \Pr( f(x; w')\neq y)\geq (1-\alpha)\epsilon\Big)\\
	\leq &  n\, e^{-l\alpha^2 \epsilon^2} + e^{-n\epsilon^2 (1-\alpha)^2}
\end{align*}
Having both exponential terms have the same exponent yields $\alpha=\frac{\sqrt{n}}{\sqrt{l}+\sqrt{n}}$ and we get the upper bound of the proposition.
\end{proof}
}

\textbf{Remarks:}
The samples of bit error injected weights $\{w'_i\}_{i=1}^l$ can actually be different for any test example $(x_j, y_j)$, even though this is not the case in our evaluation. Thus, the above bound involves a stronger result: for any test example, the empirical test error with random bit errors (\ie, robust test error \RTE) and the expected one have to be similar with the same margin. Note also that this bound holds for any fixed bit error distribution as the only requirement is that the bit error patterns we draw are i.i.d. but not the bit errors on the pattern.
In \appref{subsec:experiments-stress}, we consider results with $l = 10^6$, \ie, $l \gg n$ with $n = 10^4$ on \CifarT such that $\nicefrac{l}{(\sqrt{l}+\sqrt{n})^2}$ tends towards one. With $\delta=0.99$ the excess term $\sqrt{\frac{\log\Big(\frac{n+1}{\delta}\Big)}{n}} \frac{\sqrt{l}+\sqrt{n}}{\sqrt{l}}$ in the Proposition is equal to $4.1\%$. Thus larger test sets would be required to get stronger guarantees e.g. for $n=10^5$ one would get $1.7\%$.

\section{Quantization and Bit Manipulation in PyTorch}
\label{sec:supp-implementation}

Our fixed-point quantization $Q$ in \eqnref{eq:quantization} quantizes weights $w_i \in [-\qmax, \qmax] \subset \mathbb{R}$ into signed integers $\{-2^{m-1}-1,\ldots,2^{m-1}-1\}$. Here, the quantization range $[-\qmax,\qmax]$ is symmetric around zero. Note that zero is represented exactly. To implement asymmetric quantization, as outlined in \secref{subsec:robustness-quantization}, the same scheme can be used to quantize weights $w_i \in [\qmin, \qmax]$ within any arbitrary, potentially asymmetric, interval. To this end, \eqnref{eq:quantization} with $\qmax = 1$ is used and the weights in $[\qmin,\qmax]$ are mapped linearly to $[-1, 1]$ using the transformation $N$:
\begin{align}
	N(w_i) = \left(\frac{w_i - \qmin}{\qmax - \qmin}\right)\cdot 2 - 1.\label{eq:asymmetric-quantization}
\end{align}
Generally, $\qmin$ and $\qmax$ are chosen to reflect minimum and maximum weight value -- either from all weights (global quantization) or per-layer.
Furthermore, we argue that asymmetric quantization becomes more robust when using \emph{unsigned} integers as representation. In this case, \eqnref{eq:quantization} can be adapted using a simple additive term:
\begin{align}
	\begin{split}
		Q(w_i) &= \left\lceil \frac{w_i}{\Delta}\right\rfloor + (2^{m - 1} - 1)\\
		Q^{-1}(v_i) &= \Delta (v_i - (2^{m - 1} - 1))
	\end{split}\label{eq:unsigned-quantization}
\end{align}
We use asymmetric quantization using $N$ in \eqnref{eq:asymmetric-quantization} with \eqnref{eq:unsigned-quantization} as our \emph{robust} fixed-point quantization.

\begin{table}[t]
	\centering
	\small
	\caption{\textbf{Batch Normalization not Robust.} \RTE with group normalization (GN) or batch normalization (BN). \RTE increases when using BN even though clean \TE improves slightly compared GN. However, using batch statistics at test time (\ie, ``training mode'' in PyTorch) improves \RTE significantly indicating that the statistics accumulated throughout training do not account for random bit errors. We use \textbf{group normalization as default.}}
	\label{tab:supp-bn}
	\vspace*{-0.25cm}
	\hspace*{-0.25cm}
	\begin{tabular}{| c | l | c | c | c |}
		\hline
		\multicolumn{5}{|c|}{\bfseries \CifarT ($\mathbf{m = 8}$ bit): robustness of BN}\\
		\hline
		&& \multirow{2}{*}{\begin{tabular}{@{}c@{}}\TE\\in \%\end{tabular}} & \multicolumn{2}{c|}{\RTE in \%}\\
		\hline
		&& & $p{=}0.1$ & $p{=}0.5$\\
		\hline
		\hline
		\multirow{2}{*}{GN} & \Normal & 4.32 & 5.54 & 11.28\\
		& \Clipping[$0.1$] & 4.82 & 5.58 & 6.95\\
		\hline
		\hline
		\multicolumn{5}{|c|}{\textbf{BN w/ \emph{Accumulated} Statistics}}\\
		\hline
		\multirow{2}{*}{BN} & \Normal & 3.83 & 6.36 & 52.52\\
		& \Clipping[$0.1$] & 4.46 & 5.32 & 8.25\\
		\hline
		\hline
		\multicolumn{5}{|c|}{\textbf{BN w/ Batch Statistics at Test Time}}\\
		\hline
		\multirow{2}{*}{BN} & \Normal & 3.83 & 6.65 & 9.63\\
		& \Clipping[$0.1$] & 4.46 & 6.57 & 7.29\\
		\hline
	\end{tabular}
	\vspace*{-0.1cm}
\end{table}

Following \secref{subsec:robustness-quantization}, we implement ``fake'' fixed-point quantization for quantization-aware training and bit error injection directly in PyTorch \cite{PaszkeNIPSWORK2017}. Here, fake quantization means that computation is performed in floating point, but before doing a forward pass, the DNN is quantized and dequantized, \ie, $w_q = Q^{-1}(Q(w))$ in \algref{alg:training}. Note that we quantize into \emph{unsigned} $8$ bit integers, irrespective of the target precision $m \leq 8$. To later induce random bit errors, the $8 - m$ most significant bits (MSBs) are masked for $m < 8$. Bit manipulation of unsigned $8$ bit integers is then implemented in C/CUDA and interfaced to Python using CuPy \cite{cupy} or CFFI \cite{cffi}. These functions can directly operate on PyTorch tensors, allowing bit manipulation on the CPU as well as the GPU. We will make our code publicly available to faciliate research into DNN robustness against random bit errors.

\section{Weight Clipping with Group/Batch Normalization}
\label{sec:supp-clipping}

While weight clipping, \ie, globally constraining weights to $[-\wmax, \wmax]$ during training, is easy to implement, we make a simple adjustment to group and batch normalization layers: we reparameterize the scale parameter $\alpha$ of batch/group normalization, which usually defaults to $\alpha = 1$ and may cause problems when clipped, \eg, to $[-0.1, 0.1]$. In particular with aggressive weight clipping, $\alpha \leq \wmax < 1$, the normalization layers loose their ability to represent the identity function, considered important for batch normalization in \cite{IoffeICML2015}. Our reparameterization introduces a learnable, auxiliary parameter $\alpha'$ such that $\alpha$ as $\alpha = 1 + \alpha'$ to solve this problem.


\chapter{Background}\label{chap:background}

Imagine the following task between two players, Anne and Bill. Between Anne and Bill is a lever in the middle position and has five positions in total. Anne thinks the lever should be pulled two positions to her side and Bill thinks the lever should be pulled two positions to his side.
Anne does not know Bill has a goal on his side, and Bill does not know Anne has a goal on her side.
This can be seen in figure \ref{leverexample}.\\
\input{figures/pictures/Hebelbild} \\

With the asynchronous execution order this task could be easily finished if Anne or Bill just pulled the lever two times in their direction. But just as easily this task could go on a really long time if Anne and Bill pulled the lever alternating, once to the right and then to the left, then to the right again and so on. This could go on infinitely. With no set execution order, how can we prevent the task from going on infinitely? To answer this question we first need to introduce the formal framework.

\section{Dynamic Epistemic Logic}
In the following we will define and explain the core concepts of the Dynamic Epistemic Logic (DEL). DEL is a specific mathematical language used as the framework of this thesis.

The definitions are taken from the work of Bolander et al. \cite{bolander2018better} and \cite{bolander2017gentle} and the book ``Dynamic epistemic logic'' from Ditmarsch \cite{Ditmarsch2007}.

Let $\mathcal{A}$ be a finite set of agents, from the example above this would be $\mathcal{A} =\{$Anne, Bill$\}$. Let $\mathcal{P}$ be a finite set of atomic propositions. Atomic propositions, like $p$ or $q$, describe some affairs that can be true or false.
The epistemic language $\mathcal{L}_{\text{KC}}$ is: \\
$$
\varphi ::= \top \ | \ \bot \ | \ p \ | \ \neg \varphi \ | \ \varphi \wedge \varphi \ | \ K_i \varphi \ | \ C\varphi
$$

with $p \in \mathcal{P}$ and $i \in \mathcal{A}$.
$\top$ describes $\varphi$ as being true, $\bot$ as false.
$K_i \varphi$ reads as ``Agent $i$ knows $\varphi$''. $C \varphi$ reads as ``it is common knowledge that $\varphi$ ''.\\
From the example before, the two agents, $a$ (Anne) and $b$ (Bill) have two goal positions, goal $p$ (lever to the left) and $q$ (lever to the right). Anne knows that one goal position is the left, but does not know the other: $K_a p \wedge \neg K_a q$ . Bill knows that one goal position is the right, but does not know the other position: $\neg K_b  p \wedge K_b q$.

Formulas are evaluated in epistemic models %\todo{not defined}
$$
\mathcal{M}=(W, (\sim_i)_{i \in \mathcal{A}}, V)
$$
with the domain $W$ being a nonempty finite set of worlds,
$\sim_i$ being an equivalence relation called the indistinguishably relation for agent $i \in \mathcal{A}$ and $V : \mathcal{P} \rightarrow \mathcal{P}(W)$ assigning a valuation to each atomic proposition.

Using Anne and Bill as an example, Anne only knows $p$ is true. She does not know if $p \land q$ or $p \land \neg q$, so she sees two worlds. Those two worlds are indistinguishable for Anne. Bill only knows $q$ is true, he does not know if $p \land q$ or $\neg p \land q$. One world where just the lever to the left is a goal, a world where another goal is the lever to the right and a world where just the lever to the right is a goal. Let $w_1$ be the world where just the lever to the left is a goal, $w_2$ be the world where the goal is the lever to the left or to the right and $w_3$ be the world where the goal is the lever to the right. Then $w_1 \sim_\text{Anne} w_2$ and $w_2 \sim_\text{Bill} w_3$. A graphic representation of this would be the global state $s = (\mathcal{M}, w_2)$ with the nodes representing the worlds and the edges representing the indistinguishably relation. The circle around a node represent designated worlds. In all graphic representations in this thesis we usually omit reflexive edges and edges that can be implied by transivity for better readability.
\[
s=
\begin{tikzpicture}
  \draw (-2,0) node[world, label=below:{$w_1: p, \neg q$}] (w1) {};
  \draw (0,0) node [desig] {}; % designation
  \draw (0,0) node[world, label=below:{$w_2: p,q$}] (w2) {};
  \draw (2,0) node[world, label=below:{$w_3: \neg p, q$}] (w3) {};
  \draw (w1) -- node[above] {Anne} (w2);
  \draw (w2) -- node[above] {Bill} (w3);
\end{tikzpicture}
\]

For $W_d \subseteq W$, the pair $(\mathcal{M}, W_d)$ is called an epistemic state (or simply a state) and the worlds of $W_d$ are called designated worlds. A state is called global if $W_d=\{w\}$ for some world $w$ (called the actual world). We then often write $(\mathcal{M},w)$ instead of $(\mathcal{M},\{w\} )$. We use $S^{gl}(P,\mathcal{A})$ to denote the set of global states (or simply $S^{gl}$ if $P$ and $\mathcal{A}$ are clear from context). For any state $ s=(\mathcal{M}, W_d) $ we let $Globals(s)= \{ (\mathcal{M},w) | w \in W_d \} $.
A state $(\mathcal{M}, W_d)$ is called a local state for agent $i$ if $W_d$ is closed under $\sim _i$ (that is, if $w \in W_d$ and $w \sim _i v $, then $v \in W_d$).
Given a state $s=(\mathcal{M}, W_d)$ the associated local state of agent $i$, denoted $s^i$, is $(\mathcal{M},\{v|v\sim _i w \text{ and } w \in W_d\})$. Going from $s$ to $s^i$ amounts to a \textit{perspective shift} to the local perspective of agent $i$.

In the example above, Anne has the local state $s^{\text{Anne}}=(\mathcal{M},\{w_1,w_2\})$ and Bill has the local state $s^{\text{Bill}}=(\mathcal{M},\{w_2,w_3\})$.

Let $(\mathcal{M}, W_d)$ be a state on $P,\mathcal{A}$ with $\mathcal{M}=(W, (\sim_i)_{i \in \mathcal{A}}, V)$. For $i \in \mathcal{A}$, $p \in P$ and $\varphi, \psi \in \mathcal{L}_{\text{KC}}(P,\mathcal{A})$, we define truth as follows:
\begin{align*}
  &(\mathcal{M}, W_d) \models \varphi
    & &\text{ iff } \qquad
    (\mathcal{M},w)\models \varphi \text{ for all } w \in W_d \\
  &(\mathcal{M}, w) \models p
    & &\text{ iff } \qquad
    w \in V(p) \\
  &(\mathcal{M}, w) \models \neg \varphi
    & &\text{ iff } \qquad
    (\mathcal{M},w) \not\models \varphi \\
  &(\mathcal{M}, w) \models \varphi \wedge \psi
    & &\text{ iff } \qquad
    (\mathcal{M},w) \models \varphi \text{ and } (\mathcal{M},w) \models \psi \\
  &(\mathcal{M}, w) \models K_i \varphi
    & &\text{ iff } \qquad
    (\mathcal{M},v) \models \varphi \text{ for all } v \sim_i w \\
  &(\mathcal{M}, w) \models C \varphi
    & &\text{ iff } \qquad
    (\mathcal{M},v) \models \varphi \text{ for all } v \sim^* w \\
  &(\mathcal{M}, w) \models \top
    & &\text{        } \qquad
    \text{always} \\
  &(\mathcal{M}, w) \models \bot
    & &\text{        } \qquad
    \text{never}
\end{align*}
where $\sim^*$ is the transitive closure of $\bigcup_{i \in \mathcal{A}}\sim_i$.

From the example above, in $(\mathcal{M},w_2)$, $w_2$ is the designated world. In this designated world, Anne still does not know if $q$ is true or not. $(\mathcal{M},w_2) \models \neg K_aq \wedge \neg K_a \neg q$.
Performing a perspective sift on $s=(\mathcal{M},w_2)$ for Anne is $(\mathcal{M},w_2)^{\text{Anne}} =(\mathcal{M},\{w_1,w_2\})$. This perspective shift gives us $(\mathcal{M},\{w_1,w_2\})\not\models q$ and $(\mathcal{M},\{w_1,w_2\})\not\models \neg q$. This way, we can verify the knowledge from the global world for an agent by performing a perspective shift for that agent.

\subsection{Epistemic Actions and Product Updates}

An event model is a 4-tuple $\mathcal{E} = \langle E, (\sim_i)_{i\in \mathcal{A}}, pre, \textit{eff}  \rangle$ where the domain $E$ is a non-empty finite set of events; $\sim_i \subseteq E \times E$ is an equivalence relation called the indistinguishably relation for agent $i$;
$pre:E \rightarrow \mathcal{L}_{KC}$ assigns a precondition to each event;
and $\textit{eff}:E \rightarrow \mathcal{L}_{KC}$ assigns a post condition, or effect to each event.
For all $e\in E$, $\textit{eff}(e)$ is a conjunction of literals, that means atomic propositions and their negations, including $\top$ and $\bot$.\\
For $E_d \subseteq E$, the pair $(\mathcal{E}, E_d)$ is called an epistemic action, or simply action and the events in $E_d$ are called a local action for agent $i$ when $E_d$ is closed under $\sim_i$. \\
Each event of an action represents a different possible outcome.
By using multiple events $e, e' \in E$ that are indistinguishable ($e \sim e' )$, it is possible to model only partially observable actions.\\
If the event model has $E=\{e\}$, we will write $\mathcal{E}=\langle pre(e), \textit{eff}(e)\rangle$.

The product update is used to specify the next state resulting from performing an action in a state.
Let a state $s = (\mathcal{M},W_d)$ and an action $a=(\mathcal{E},E_d)$ be given with $\mathcal{M}=\langle W,(\sim_i)_{i \in \mathcal{A}}, V\rangle $ and $\mathcal{E}=\langle E, (\sim_i)_{i \in \mathcal{A}},pre, \textit{eff} \rangle$
then the product update of $s$ with $a$ is defined as $s \otimes a = ((W',(\sim_i')_{i \in \mathcal{A}}, W_d'))$ where :

 \begin{itemize}
   \item each world is paired up with all applicable events \\
   $W'=\{(w,e)\in W \times E ~|~ \mathcal{M}, w \models pre(e)\};$
   \item new worlds are indistinguishable if the old worlds and the events are indistinguishable \\
   $\sim_i'=\{((w,e),(w',e')) \in W'\times W' ~|~ w \sim_i w' \text{ and } e \sim_i e'\};$
   \item propositions become true if the proposition occurred as a positive literal in the effect of the event or the proposition was satisfied in the world before and did not appear negative in the effect \\
   $V'(p) = \{ (w,e) \in W' ~|~ \textit{eff}(e) \models p \text{ or } (\mathcal{M},w \models p \text{ and } \textit{eff}(e)\not \models \neg p)\};$
   \item worlds are designated if both predecessor world and event are designated. \\
   $W_d' = \{ (w,e) \in W' ~|~ w \in W_d \text{ and } e \in E_d\}$.
 \end{itemize}

$a=(\mathcal{E}, E_d)$ is applicable in $s=(\mathcal{M},W_d)$ if for all $w \in W_d$ there is an event $e \in E_d$ such that $(\mathcal{M},w) \models pre(e)$.

Let us imagine a planning task between Lea and Max. Lea puts two cards face down in front of Max. The goal is that Max picks up the queen. The problem here is that Max does not know where the queen is. \\
Lea has put the queen to the right, so $qR$.

\[
s=
\begin{tikzpicture}
  \draw (-2,0) node[world, label=below:{$w_1: \neg qR$}] (w1) {};
  \draw (0,0) node [desig] {}; % designation
  \draw (0,0) node[world, label=below:{$w_2: qR$}] (w2) {};
  \draw (w1) -- node[above] {Max} (w2);
\end{tikzpicture}
\]

There are two types of actions that could be performed to solve this problem:
\begin{enumerate}
  \item Announcement actions \\
    Lea could tell Max where she put the queen. $\omega(a_{\text{announcement}})=\text{Lea}$

    \[
    \begin{tikzpicture}
      \draw (-2,0) node[world, label=below:{$w_1: \neg qR$}] (w1) {};
      \draw (0,0) node [desig] {}; % designation
      \draw (0,0) node[world, label=below:{$w_2: qR$}] (w2) {};
      \draw (w1) -- node[above] {Max} (w2);
    \end{tikzpicture}
    %
    ~\otimes~
    %
    \begin{tikzpicture}
      \draw (0,0) node [desig] {}; % designation
      \draw (0,0) node[world, label=below:{$e_1: \langle qR, \top \rangle $}] (w1) {};
    \end{tikzpicture}
    %
    ~=~
    %
    \begin{tikzpicture}
      \draw (0,0) node [desig] {};
      \draw (0,0) node[world, label=below:{$(w_2, e_1): qR$}] (w1e1) {};
    \end{tikzpicture}
    \]

  \item Sensing actions \\
    Max could look at the left card, then he knows where the queen is.
    $\omega(a_{\text{sense}})=\text{Max}$

    \[
    \begin{tikzpicture}
      \draw (-2,0) node[world, label=below:{$w_1: \neg qR$}] (w1) {};
      \draw (0,0) node [desig] {}; % designation
      \draw (0,0) node[world, label=below:{$w_2: qR$}] (w2) {};
      \draw (w1) -- node[above] {Max} (w2);
    \end{tikzpicture}
    %
    ~\otimes~
    %
    \begin{tikzpicture}
      \draw (-2,0) node[world, label=below:{$e_1: \langle qR, \top \rangle $}] (e1) {};
      \draw (0,0) node [desig] {}; % designation
      \draw (0,0) node[world, label=below:{$e_2: \langle \neg qR, \top \rangle $}] (e2) {};
    \end{tikzpicture}
    %
    ~=~
    %
    \begin{tikzpicture}
      \draw (-2,0) node[world, label=below:{$w_1: \neg qR$}] (w1) {};
      \draw (0,0) node [desig] {}; % designation
      \draw (0,0) node[world, label=below:{$w_2: qR$}] (w2) {};
    \end{tikzpicture}
    \]

\end{enumerate}

\subsection{Planning tasks}

A planning task $\Pi = \langle s_0, A, \omega, \gamma \rangle$ consists of a global state $s_0$ called the \textit{initial state}; a finite set of actions A; an owner function $\omega: A \rightarrow \mathcal{A}$; and a \textit{goal formula} $\gamma \in \mathcal{L}_{KC}$.

Consider a version of the lever problem from before. For simplicity, in this example there is only one player and the lever can only be pulled once. The planning task $\langle s_0, \{ a_1 \} , \omega, p \rangle$ consists of the initial state $s_0 = $
\begin{tikzpicture}
  \draw (0,0) node [desig] {}; % designation
  \draw (0,0) node[world, label=below:{$\neg p$}] (w1) {};
\end{tikzpicture}
with the lever being in the upright position. The action $a_1$ =
\begin{tikzpicture}
  \draw (0,0) node [desig] {}; % designation
  \draw (0,0) node[world, label=below:{$e_1: \langle \top, p \rangle $}] (w1) {};
\end{tikzpicture}
has the owner $\omega(a_1) = 1$ (player 1). Everything is fully observable for the agent. The intuitive  solution should prescribe the action $a_1$ to agent 1, pulling the lever to the right.

\[
\begin{tikzpicture}
  \draw (0,0) node [desig] {}; % designation
  \draw (0,0) node[world, label=below:{$w_1: \neg p$}] (w1) {};
\end{tikzpicture}
%
~\otimes~
%
\begin{tikzpicture}
  \draw (0,0) node [desig] {}; % designation
  \draw (0,0) node[world, label=below:{$e_1: \langle \top, p \rangle $}] (w1) {};
\end{tikzpicture}
%
~=~
%
\begin{tikzpicture}
  \draw (0,0) node [desig] {};
  \draw (0,0) node[world, label=below:{$(w_1, e_1): p$}] (w1e1) {};
\end{tikzpicture}
\]

A policy $\pi$ for $\Pi = \langle s_0, A, \omega, \gamma \rangle$ is a partial mapping $\pi: S^{gl} \hookrightarrow \mathcal{P}(A)$ such that:
\begin{enumerate}
  \item Applicability\\
    We require actions to be applicable in all states they are assigned to: \\
    for all $a \in S^{gl}, a \in \pi(s): a$ is applicable in $s$.
  \item Uniformity \\
    If the policy $\pi$ prescribes some action $a$ to agent $i$ in state $s$ and agent $i$ cannot distinguish $s$ from some other state $t$, then $\pi$ has to prescribe the same action $a$ for $i$ in $t$ as well: \\
    for all $s,t \in S^{gl} $ such that $ s^{\omega(a)} = t^{\omega(a)}, a \in \pi(s): a \in \pi(t)$

    A planning task with the agents Lea and Max,
    initial state Lea puts two cards face down on the table, one of them is a queen, the other a king. Max does not know if the queen is on the left or the right side. The goal is that Max turns over the queen. Max has two actions, he can either turn over the left card or the right card. The policy in which Max turns over the left card is a valid policy because even though he does not know if that card is the queen, the action is prescribed in both cases.

  \item Determinism \\
    We require $\pi$ to be unambiguous for all agents in the sense that in each state $s$ where an agent $i$ is supposed to act according to $\pi$, $\pi$ will always prescribe the same action for agent $i$.
\end{enumerate}

The properties uniformity and applicability together imply knowledge of preconditions, the property that in each state, an agent who is supposed to perform a particular action must also know that the action is applicable in that state.

We also must allow policies to sometimes prescribe multiple actions of different owners to the same state. This is because the set of indistinguishable states can differ between the agents. To characterize the different outcomes of agents acting according to a common policy, we define the notion of policy executions.

An execution of a policy $\pi$ from a global state $s_0$ is a maximal (finite or infinite) sequence of alternating global states and actions $(s_0, a_1, s_1, a_2, s_2,...)$, such that for all $ m \leq 0$
\begin{enumerate}
  \item $a_{m+1} \in \pi(s_m)$ and
  \item $s_{m+1} \in Globals(s_m \otimes a_{m+1})$
\end{enumerate}
An execution is called successful for a planning task $\Pi = \langle s_0, A, \omega, \gamma \rangle$, if it is a finite execution $(s_0, a_1, s_1,...,a_n, s_n)$ such that $s_n \models \gamma$.

%\extend{Example: Anna lets Bill pull the lever to the right. Globally this makes sense, since that is Bills goal. But individually, this makes no sense at all because Anne doesent know Bills goal.}

In the lever example, a policy could be that, starting in the position with the lever being in the middle, Bill pulls the lever to the right and then to the right again. This is a policy that satisfies all properties and where the last state satisfies the goal formula. The execution of the policy is finite and successful. \\
For Bill, this is a reasonable policy. It satisfies the goal formula he knows to be true, with the lever being at the far right position. But for Anne, it is not a reasonable policy because she can not see that the execution of this policy will satisfy the goal formula.

%\todo{Geht das hier etwas schöner?}
We now want to restrict our focus to policies that are guaranteed to achieve the goal after a finite number of steps. More formally, all of their executions must be successful. As in nondeterministic planning, such policies are called strong (Cimatti et al. \cite{cimattietal}).
For a planning task $\Pi = \langle s_0, A, \omega, \gamma \rangle$, a policy $\pi$ is called strong if $s_0 \in \text{Dom}(\pi) \cup \{s \in S^{gl} ~|~ s \models \gamma\}$ and for each $s \in \text{Dom}(\pi)$, any execution of $\pi$ from $s$ is successful for $\Pi$. A planning task is called solvable if a strong policy for $\Pi$ exists.
For $ i \in \mathcal{A} $ , we call a policy $i$-strong if it is strong and  $Globals(s_0^i ) \subseteq \text{Dom}(\pi) \cup\{ s \in S^{gl} ~|~ s \models \gamma \}$.

When a policy is i-strong it means that the policy is strong and defined on all the global states that agent $i$ cannot distinguish inbetween. It follows directly from the definition that any execution of an $i$-strong policy from any of those initially indistinguishable states will be successful. So if agent $i$ comes up with an $i$-strong policy, agent $i$ knows the policy to be successful.

The policy from above, with Bill pulling the lever to the right twice is Bill-strong but not Anne-strong.

Sometimes the agents cannot coordinate their plans but rather have to come up with plans individually. These plans can differ a lot, the agents often have different knowledge about the states, the actions and therefore the action outcomes. For this reason we will define a policy profile for a planning task $\Pi$ to be a family $(\pi_i)_{i \in \mathcal{A}}$ where each $\pi_i$ is a policy for $\Pi$. We assume actions to be instantaneous and executed asynchronously. This leads to the following generalization:

An execution of a policy profile $(\pi_i)_{i \in \mathcal{A}}$ is a maximal (finite or infinite) sequence of alternating global states and actions $(s_0, a_1, s_1,...)$, such that for all $m \leq 0$,
\begin{enumerate}
  \item $a_{m+1} \in \pi_i(s_m)$ where $i=\omega(a_{m+1})$ \\
    Note here the source of nondeterminism as a result from the possibility of multiple policies prescribing actions for their respective agents.
  \item $s_{m+1} \in Globals(s_m \otimes a_{m+1}) $ \\
    Here the source of nondeterminism is from the possibility of nondeterministic action outcomes.
\end{enumerate}

If all agents have one strong policy in common which all of them follow, then at execution time, the goal is guaranteed to be eventually reached. If, however, each agent acts on its individual strong policy, then the incompatibility of the individual policies may prevent the agents from reaching the goal, even though each individual policy is strong.

The cost of a a policy can be defined as its worst-case execution length, the number of actions in its longest possible execution. An optimal policy is one with minimal costs. Due to partial observability and different knowledge, the agents might assign different costs to the same policy and therefore the costs are subjective. \\
Let $\pi$ be a strong policy for a planning task $\Pi$. The perspective-sensitive cost (or simply cost) of $\pi$ from a state $s\in Dom(\pi)$, denoted $\kappa_{\pi}(s)$ is defined as:
$$\kappa_{\pi}(s) =
\begin{cases}
0 \qquad & \text{if there exists no } a \in \pi(s)\\
1+ \max_{a\in \pi(s), s'\in Globals(s^{\omega(a)} \otimes a)} \kappa_{\pi}(s') \qquad & \text{else.}
\end{cases}$$


\documentclass{easychair}

\usepackage{doc}
\usepackage{scalerel}
\usepackage{amsfonts}

\newcommand{\easychair}{\textsf{easychair}}
\newcommand{\miktex}{MiK{\TeX}}
\newcommand{\texniccenter}{{\TeX}nicCenter}
\newcommand{\makefile}{\texttt{Makefile}}
\newcommand{\latexeditor}{LEd}
\newcommand{\emptycon}{\scaleobj{.75}\bullet}
\newcommand{\ext}{\triangleright}
\newcommand{\arri}{\Rightarrow}

\newcommand{\ms}[1]{\mathsf{#1}}
\newcommand{\ToS}{\mathsf{ToS}}
\newcommand{\U}{\mathsf{U}}
\newcommand{\Code}{\mathsf{Code}}
\newcommand{\Ty}{\mathsf{Ty}}
\newcommand{\V}{\mathsf{V}}
\newcommand{\C}{\mathsf{C}}
\newcommand{\Bool}{\ms{Bool}}

\title{Staged Compilation and Generativity%
  \thanks{The author was supported by the European Union, co-financed
    by the European Social Fund (EFOP-3.6.3-VEKOP-16-2017-00002).}}

\author{
Andr\'as Kov\'acs
}

% Institutes for affiliations are also joined by \and,
\institute{
  E\"otv\"os Lor\'and University,
  Budapest, Hungary \\
  \email{kovacsandras@inf.elte.hu}
}

\authorrunning{Kov\'acs}
\titlerunning{Staged Compilation and Generativity}
\pagenumbering{gobble}
\begin{document}

\maketitle

The purpose of staged compilation is to write code-generating programs in a safe
and ergonomic way. Although it is always possible to write metaprograms by
simply manipulating strings or deeply embedded syntax trees, this is often
error-prone and tedious. Staging is a way to have more guarantees about the
safety and well-typing of metaprograms, and also a way to integrate object-level
and meta-level syntaxes more organically.

Two-level type theory (2LTT) \cite{twolevel} was originally developed for the
purpose of doing synthetic homotopy theory, by adding a metaprogramming layer on
top of homotopy type theory \cite{hottbook}. However, it turns out that 2LTT is
also a great framework for metaprogramming and staging in general; it is
applicable to a wide range of object theories.

There is a natural semantics to 2LTT which justifies the metaprogramming view:
this is the \emph{presheaf model} of 2LTT. Here, meta-level types are presheaves
over the underlying category of the object theory. Hence, every meta-level
construction must be stable under the object-level morphisms.

\paragraph{Generativity}Generativity means that we can only generate code, but not look inside
object-level syntax and make decisions based on that. Generativity simplifies
staging, and it is often enforced in practical implementations
\cite{kiselyov14metaocaml}. However, non-generative staging provides additional
power and flexibility. A simple example for a non-generative feature is
conversion checking. Assume that given an object-level type $A$, $\Code\,A$ is
the type of meta-level programs which compute $A$-expressions. Conversion
checking may be postulated as $\ms{conversion}_A : (t\,u : \Code\,A) \to (t = u)
+ (t \neq u)$. We aim to investigate generativity in the presheaf model. We
observe that it depend on the choice of morphisms in the object theory.

If base morphisms are \emph{substitutions}, then $\ms{conversion}$ does not hold
in the model, because definitional inequality is not stable under substitution. For
example, inequal variables may become equal after substitution.

If base morphisms are \emph{weakenings}, then $\ms{conversion}$
holds. However, in this case the object theory can only support features which
can be specified with weakenings. For instance, this allows simple types at at
the object level, without any $\beta$-rules, but it does not allow polymorphism
or dependent types. This is still sufficient for many staging applications.

\paragraph{Yoneda lemma} It is worth to note that we get generativity statements
in the presheaf model from the Yoneda lemma. For example, the natural
transformation $\ms{y}\,\Bool_0 \Rightarrow \Bool_1$ must be a constant map in the
model. How is it possible then to have non-generativity? The answer is that
the Yoneda lemma can only meaningfully apply to \emph{types} (as opposed to
contexts) in the presheaf model, if context extension is preserved by Yoneda
embedding. If base morphisms are weakenings, the base category does not have all
binary products, and context extension is not preserved by $\ms{y}$. Hence, the
singleton context $\emptycon,\ms{y}\,\Bool_0$ is not representable, and the
Yoneda lemma does not say anything about dependency on $\ms{y}\,\Bool_0$.

\bibliographystyle{plain}
\bibliography{references}

\end{document}


\section{Low-Voltage Induced Random Bit Errors in Quantized DNN Weights}
\label{sec:errors}

We assume the quantized DNN weights to be stored  on multiple memory banks, \eg, SRAM in the case of on-chip scratchpads or DRAM for off-chip memory. As shown in \cite{GanapathyDAC2017,KimDATE2018,ChandramoorthyHPCA2019}, the probability of memory bit cell failures increases exponentially as operating voltage is scaled below $\Vmin$, \ie, the minimal voltage required for reliable operation, see \figref{fig:introduction}. This is done intentionally to reduce energy consumption, \eg, \cite{ChandramoorthyHPCA2019,KimDATE2018,KoppulaMICRO2019}, or adversarially by an attacker, \eg, \cite{TangUSENIX2017}. Process variation during fabrication causes a variation in the vulnerability of individual bit cells. As shown in \figref{fig:errors} (left), for a specific memory array, bit cell failures are typically approximately random and independent of each other \cite{GanapathyDAC2017}. We also consider chips showing other error patterns as in \figref{fig:errors} (right). Nevertheless, there is generally an ``inherited'' distribution of bit cell failures across voltages \cite{GanapathyHPCA2019}, if a bit error occurred at a given voltage, it is likely to occur at lower voltages, as made explicit in \figref{fig:errors}. However, across different SRAM arrays in a chip or different chips, the patterns or spatial distribution of bit errors is usually different and can be assumed random \cite{ChandramoorthyHPCA2019}. Throughout the paper, we use the following bit error model:

\textbf{Random Bit Error Model:}
\textit{The probability of a bit error is $p$ (in \%) for all weight values and bits. For a fixed memory array, bit errors are persistent across supply voltages, \ie, bit errors at probability $p'{\leq}p$ also occur at probability $p$. A bit error flips the currently stored bit. We denote random bit error injection by $\biterror_p$.}

\begin{figure*}
    \vspace*{-0.15cm}
    \centering
    \includegraphics[width=0.85\textwidth]{main_training_flow4.pdf}
    \vspace*{-6px}
    \caption{\textbf{Random Bit Error Training (\Random).} We illustrate the data-flow for \Random as in \algref{alg:training}. Here, $\biterror_p$ injects random bit errors in the \red{quantized weights} $\red{v^{(t)}} = Q(\magenta{w^{(t)}})$, resulting in $\red{\tilde{v}^{(t)}}$, while the forward pass is performed on the \blue{de-quantized perturbed weights} $\blue{\tilde{w}_q^{(t)}} = Q^{-1}(\red{\tilde{v}^{(t)}})$, \ie, fixed-point arithmetic is not emulated. The weight update during training is not affected by bit errors and computed in \magenta{floating point}.}
    \label{fig:flowchart}
    \vspace*{-0.2cm}
\end{figure*}

This error model realistically captures the nature of low-voltage induced bit errors, from both SRAM and DRAM as confirmed in \cite{ChandramoorthyHPCA2019,KimDATE2018,KoppulaMICRO2019}. However, our approach in \secref{sec:robustness} is model-agnostic: the error model can be refined if extensive memory characterization results are available for individual chips. For example, faulty bit cells with $1$-to-$0$ or $0$-to-$1$ flips might not be equally likely. Similarly, as in \cite{KoppulaMICRO2019}, bit errors might be biased towards alignment along rows or columns of the memory array. The latter case is illustrated in \figref{fig:errors} (right). However, estimating these specifics requires testing infrastructure and detailed characterization of individual chips.
More importantly, it introduces the risk of overfitting to few specific memories/chips.
Furthermore, we demonstrate that the robustness obtained using our uniform error model generalizes to bit error distributions with strong spatial biases as in \figref{fig:errors} (right).

We assume the quantized weights to be mapped linearly to the memory. This is the most direct approach and, in contrast to \cite{KoppulaMICRO2019}, does not require knowledge of the exact spatial distribution of bit errors. This also means that we do not map particularly vulnerable weights to more reliable memory cells, and therefore no changes to the hardware or the application are required. Thus, in practice, for $W$ weights and $m$ bits per weight value, we sample uniformly $u \sim U(0, 1)^{W \times m}$. Then, the $j$-th bit in the quantized weight $v_i = Q(w_i)$ is flipped iff $u_{ij} \leq p$.
Our model assumes that the flipped bits at lower probability $p' \leq p$ are a subset of the flipped bits at probability $p$ and that bit flips to $1$ and $0$ are equally likely. The noise pattern of random bit errors is illustrated in \figref{fig:quantization}:
for example a single bit flip in the most-significant bit (MSB) of the signed integer $v_i$ can result in a change of roughly half of the quantized range (also \cf \secref{subsec:robustness-quantization}).

\section{Towards Robustness Against Random Bit Errors}
\label{sec:robustness}

We address robustness against random bit errors in three steps: First, we analyze the impact of fixed-point quantization schemes on bit error robustness. This has been neglected both in prior work on low-voltage DNN accelerators \cite{KimDATE2018,KoppulaMICRO2019} and in work on quantization robustness \cite{MurthyARXIV2019,MerollaARXIV2016,SungARXIV2015}. This yields our \textbf{robust quantization} (\secref{subsec:robustness-quantization}). On top, we propose aggressive \textbf{weight clipping} as regularization during training (\secref{subsec:robustness-clipping}).
Weight clipping enforces a more uniformly distributed, \ie, redundant, weight distribution, improving robustness. We show that this is due to minimizing the cross-entropy loss, enforcing large logit differences.
Finally, in addition to robust quantization and weight clipping, we perform \textbf{random bit error training (\Random)} (\secref{subsec:robustness-training}): in contrast to the fixed bit error patterns in \cite{KimDATE2018,KoppulaMICRO2019}, we train on completely \emph{random} bit errors and, thus, generalize across chips and voltages.
Generalization is measured using \emph{average robust test error (\RTE)}, the test error after injecting bit errors, \wrt to our error model from \secref{sec:errors} as well as real, profiled bit error patterns. % but also the corresponding standard deviation.
Robustness against bit error rate $p$ has to induce robustness for $p' \leq p$ (\ie, higher voltage), as well.

\subsection{Robust Fixed-Point Quantization}
\label{subsec:robustness-quantization}

We consider quantization-aware training \cite{JacobCVPR2018,KrishnamoorthiARXIV2018} using a generic, deterministic fixed-point quantization scheme commonly used in DNN accelerators \cite{ChandramoorthyHPCA2019}. However, we focus on the impact of quantization schemes on robustness against random bit errors, mostly neglected so far \cite{MurthyARXIV2019,MerollaARXIV2016,SungARXIV2015}. We find that quantization affects robustness significantly, even if accuracy is largely unaffected.

\textbf{Fixed-Point Quantization:} Let $f(x; w)$ be a DNN taking an example $x \in [0, 1]^D$, \eg, an image, and weights $w \in \mathbb{R}^W$ as input. Quantization determines how weights are represented in memory, \eg, on SRAM. In a \emph{fixed-point quantization} scheme, $m$ bits allow to represent $2^m$ distinct values.
A weight $w_i \in [-\qmax, \qmax]$
is represented by a signed $m$-bit integer $v_i = Q(w_i)$ corresponding to the underlying bits. Here, $[-\qmax, \qmax]$ is the \emph{symmetric} quantization range and signed integers use two's complement representation. Then, $Q: [-\qmax, \qmax] \mapsto \{-2^{m - 1} - 1, \ldots, 2^{m - 1} - 1\}$ is defined as
\begin{align}
    Q(w_i) = \left\lfloor \frac{w_i}{\Delta}\right\rfloor,\text{  }
    Q^{-1}(v_i) = \Delta v_i,\text{  }
    \Delta = \frac{\qmax}{2^{m - 1} - 1}
    \label{eq:quantization}
\end{align}
Flipping the most significant bit (MSB, \ie, sign bit) leads to an absolute error of half the quantization range, \ie, $\qmax$ ({\color{yellow!75!black!}yellow} in \figref{fig:quantization}).
Flipping the least significant bit (LSB) incurs an error of $\Delta$, \cf \eqnref{eq:quantization}. Thus, the impact of bit errors ``scales with'' $\qmax$.

\textbf{Global and Per-Layer Quantization:} $\qmax$ can be chosen to accommodate all weights, \ie, $\qmax = \max_i |w_i|$. This is called \emph{global} quantization. However, it has become standard to apply quantization \textit{per-layer} allowing to adapt $\qmax$ to each layer. As in PyTorch \cite{PaszkeNIPSWORK2017}, we consider weights and biases of each layer separately. By reducing the quantization range for each layer individually, the errors incurred by bit flips are automatically minimized, \cf \figref{fig:quantization}. The
\textbf{per-layer, symmetric quantization is our default reference}, referred to as \Normal. However, it turns out that it is further beneficial to consider arbitrary quantization ranges $[\qmin, \qmax]$ (allowing $\qmin > 0$). In practice, we
first map $[\qmin, \qmax]$ to $[-1,1]$ and then quantize $[-1,1]$ using \eqnref{eq:quantization}.
Overall, per-layer asymmetric quantization has the finest granularity, \ie, lowest $\Delta$ and approximation error. Nevertheless it is not the most robust
quantization.

\begin{figure}[t]
	\centering
	\vspace*{-0.1cm}
	\hspace*{-0.3cm}
	\begin{subfigure}{0.24\textwidth}
		\vspace*{3px}

		\includegraphics[height=1.35cm]{c10_q81auunfp_nt_original_logits.pdf}
	\end{subfigure}
	\begin{subfigure}{0.12\textwidth}
		\vspace*{0px}

		\includegraphics[height=1.425cm]{c10_q81auunfp_nt_original_confidences.pdf}
	\end{subfigure}
	\begin{subfigure}{0.12\textwidth}
		\vspace*{0px}

		\includegraphics[height=1.425cm]{c10_q81auunfp_nt_original_weights.pdf}
	\end{subfigure}

	\hspace*{-0.4cm}
	\begin{subfigure}{0.24\textwidth}
		\vspace*{3px}

		\includegraphics[height=1.35cm]{c10_q801auunfp_nt_original_logits.pdf}
	\end{subfigure}
	\begin{subfigure}{0.12\textwidth}
		\vspace*{0px}

		\includegraphics[height=1.425cm]{c10_q801auunfp_nt_original_confidences.pdf}
	\end{subfigure}
	\begin{subfigure}{0.12\textwidth}
		\vspace*{3px}

		\includegraphics[height=1.425cm]{c10_q801auunfp_nt_original_weights.pdf}
	\end{subfigure}

	\hspace*{-0.3cm}
	{\color{black!25!white}\rule{0.5\textwidth}{0.5px}}

	\hspace*{-0.4cm}
	\begin{subfigure}{0.24\textwidth}
		\vspace*{0px}

		\includegraphics[height=1.825cm]{c10_q81auunrfp_sawt_bit_random_g001_pop1_logits.pdf}
	\end{subfigure}
	\begin{subfigure}{0.12\textwidth}
		\vspace*{0px}

		\includegraphics[height=1.7cm]{c10_q81auunrfp_sawt_bit_random_g001_pop1_confidences.pdf}
	\end{subfigure}
	\begin{subfigure}{0.12\textwidth}
		\vspace*{3px}

		\includegraphics[height=1.7cm]{c10_q81auunrfp_sawt_bit_random_g001_pop1_weights.pdf}
	\end{subfigure}

	\vspace*{-8px}
	\caption{\textbf{Effect of Weight Clipping.} On \CifarT, weight clipping constraints the weights (right), thereby implicitly limiting the possible range for logits (left, {\color{colorbrewer2}blue}).
	However, even for $\wmax = 0.1$ the DNN is able to produce high confidences (middle, {\color{colorbrewer2}blue}), suggesting that more weights are used to obtain these logits. Furthermore, the impact of random bit errors, $p = 1\%$, on the logits/confidences ({\color{colorbrewer1}red}) is reduced significantly. \Random (trained with $p = 1\%$, w/o weight clipping), increases the range of weights and is less effective at preserving logit/confidence distribution. %Logit/confidence histograms normalized over $10\cdot 128$ examples.
	}
	\label{fig:clipping}
	\vspace*{-0.2cm}
\end{figure}

\textbf{Robust Quantization:} Quantization as in \eqnref{eq:quantization} does \emph{not} provide optimal robustness against bit errors. First, the floor operation $\lfloor \nicefrac{w_i}{\Delta}\rfloor$ is commonly implemented as float-to-integer conversion. Using proper rounding $\lceil\nicefrac{w_i}{\Delta}\rfloor$ instead has negligible impact on accuracy, even though approximation error improves slightly. In stark contrast, bit error robustness is improved considerably. During training, DNNs can compensate the differences in approximation errors, even for small precision $m < 8$. However, at test time,
rounding decreases the impact of bit errors considerably. Second, \eqnref{eq:quantization} uses signed integers for symmetric quantization. For asymmetric quantization, with arbitrary $[\qmin, \qmax]$, we found quantization into \emph{unsigned} integers to improve robustness, \ie, $Q : [\qmin, \qmax] \mapsto \{{\color{red}0}, \ldots, {\color{red}2^m - 1}\}$. This is implemented using an additive term of $2^{m-1}-1$ in \eqnref{eq:quantization}. While accuracy is not affected, the effect of bit errors in the sign bit changes: in symmetric quantization, the sign bit mirrors the sign of the weight value. For asymmetric quantization, an unsigned integer representation is more meaningful. Overall, our \textbf{robust fixed-point quantization (\Quant)}  uses per-layer, asymmetric quantization into unsigned integers with rounding.
These seemingly \emph{small differences} have little to no impact on accuracy, while having tremendous impact on robustness against bit errors, see \secref{subsec:experiments-quantization} and \appref{sec:supp-implementation}.
\revision{They are simple to implement, do not add training complexity or hyper-parameters and demonstrate the importance of robustness in developing DNN quantization schemes.}

\begin{algorithm}[t]
\caption{\textbf{Random Bit Error Training (\Random).} The forward passes are performed using \blue{de-quantized weights (blue)}. Perturbed weights are obtained by injecting bit errors in the \red{quantized weights (in red)}. The update, averaging gradients from both forward passes, is performed in \magenta{floating-point (magenta)}. Also see \figref{fig:flowchart}.}
\label{alg:training}
\begin{algorithmic}[1]
\small
\Procedure{RandBET}{$p$}
    \State initialize \magenta{$w^{(0)}$}
	\For{$t = 0, \ldots, T - 1$}
    	\State sample batch $\{(x_b, y_b)\}_{b = 1}^B$
    	\State \{element-wise clipping:\}
    	\State $\magenta{w^{(t)}} = \min(\wmax, \max(-\wmax, \magenta{w^{(t)}}))$
    	\State \{quantization:\}
    	\State $\red{v^{(t)}} = Q(\magenta{w^{(t)}})$
        \State $\blue{w_q^{(t)}} = Q^{-1}(\red{v^{(t)}})$
        \State \{clean forward and backward pass:\}
        \State $\Delta^{(t)} = \nabla_w \sum_{b = 1}^B \mathcal{L}(f(x_b; \blue{w_q^{(t)}}), y_b)$
        \State \{\emph{perturbed} forward and backward pass:\}
        \State $\blue{\tilde{w}_q^{(t)}}{\hskip 1px=\hskip 1px}Q^{-1}(\biterror_p(\red{v^{(t)}}))$\label{line:attack} \{inject random bit errors\}
        \State $\tilde{\Delta}^{(t)} = \nabla_w \sum_{b = 1}^B \mathcal{L}(f(x_b; \blue{\tilde{w}_q^{(t)}}), y_b)$
        \State \{average gradients and weight update:\}
        \State $\magenta{w^{(t + 1)}} = \magenta{w^{(t)}} - \gamma(\Delta^{(t)} + \tilde{\Delta}^{(t)})$
    \EndFor
    \State \textbf{return} $\blue{w_q^{(T)}} = Q^{-1}(Q(\magenta{w^{(T)}}))$
\EndProcedure
\end{algorithmic}
\end{algorithm}

\subsection{Training with Weight Clipping as Regularization}
\label{subsec:robustness-clipping}

\textbf{Weight clipping} refers to constraining the weights to $[-\wmax, \wmax]$ \emph{during training}, where $\wmax$ is a hyper-parameter. Generally, $\wmax$ is independent of the quantization range(s) which always adapt(s) to the weight range(s) at hand. However, weight clipping limits the maximum possible quantization range (\cf \secref{subsec:robustness-quantization}), \ie, $\qmax \leq \wmax$.
It might seem that weight clipping with small $\wmax$ automatically improves robustness against bit errors as the absolute errors are reduced. However, the \emph{relative} errors are not influenced by rescaling. As the DNN's decision is usually invariant to rescaling, reducing the scale of the weights does not impact robustness. In fact, the mean relative error of the weights in \figref{fig:quantization} (right) increased with clipping at $\wmax = 0.1$. Thus, weight clipping does \emph{not} ``trivially'' improve robustness by reducing the scale of weights. Nevertheless, we found that weight clipping actually improves robustness considerably on top of our robust quantization.

The interplay of weight clipping and minimizing the the cross-entropy loss during training is the key. High confidences can only be achieved by large differences in the logits. Because the weights are limited to $[-\wmax, \wmax]$, large logits can only be achieved using more weights in each layer to produce larger outputs. This is illustrated in \figref{fig:clipping} (right): using $\wmax = 0.1$, the weights are (depending on the layer) up to $5$ times smaller. Considering deep NNs, the ``effective'' scale factor for the logits is significantly larger, scaling exponentially with the number of layers. Thus, using $\wmax = 0.1$ is a significant constraint on the DNNs ability to produce large logits. As result, weight clipping produces a much more uniform weight distribution.
\figref{fig:clipping} (left and middle) shows that a DNN constrained at $\wmax = 0.1$ can produce similar logit and confidence distributions (in {\color{colorbrewer2}blue}) as the unclipped DNN. At the same time, random bit errors, have a significantly smaller impact on the logits and confidences (in {\color{colorbrewer1}red}). \figref{fig:clipping} (right column) also shows the induced redundancy in the weight distribution. Weight clipping leads to more weights being utilized, \ie, less weights are zero (note log-scale, marked in {\color{colorbrewer1}red}, on the y-axis). Also, more weights reach large values, relative to the maximum absolute weight. Overall, we found weight clipping to be an easy-to-use but effective measure to improve weight robustness. We use \Clipping[$\wmax{=}0.1$] to refer to, \eg, weight clipping with $\wmax = 0.1$. For more evidence supporting our argumentation, see \tabref{tab:clipping-robustness}. For example, we show that DNNs loose robustness when using label smoothing, \ie, not enforcing high confidences/logits during training.
\revision{Finally, weight clipping is straight-forward to implement (\cf \algref{alg:training}, line 6) and adds negligible training cost. The additional hyper-parameter, \ie, $\wmax$, can easily be tuned based on constraints on clean (or robust) performance, \cf \secref{subsec:experiments-clipping}.}

\subsection{Random Bit Error Training (\Random)}
\label{subsec:robustness-training}

In \emph{addition to} weight clipping and robust quantization, we inject random bit errors with probability $p$ during training to further improve robustness. This results in the following learning problem, which we optimize as illustrated in \figref{fig:flowchart}:
\begin{align}
	\begin{split}
    	&\min_w \mathbb{E}[\mathcal{L}(f(x; \tilde{w}), y) + \mathcal{L}(f(x; w), y)]\\
    	\text{s.t.}&\quad v = Q(w),\, \tilde{v} = \biterror_p(v),\, \tilde{w} = Q^{-1}(\tilde{v}).
   	\end{split}\label{eq:random-training-average}
\end{align}
where $(x, y)$ are labeled examples, $\mathcal{L}$ is the cross-entropy loss and $v = Q(w)$ denotes the (element-wise) quantized weights $w$ which are to be learned. $\biterror_p(v)$ injects random bit errors with rate $p$ in $v$. Note that we consider both the loss on clean weights and weights with bit errors. This is desirable to avoid an increase in (clean) test error and stabilizes training compared to training only on bit errors in the weights. Note that bit error rate $p$ implies, in expectation, $pmW$ bit errors. Following \algref{alg:training}, we use stochastic gradient descent to optimize \eqnref{eq:random-training-average}, by performing the gradient computation using the perturbed weights $\tilde{w} = Q^{-1}(\tilde{v})$ with $\tilde{v} = \biterror_p(v)$, while applying the gradient update on the (floating-point) clean weights $w$. In spirit, this is similar to data augmentation, however, the perturbation is applied on the weights instead of the inputs. As we found that introducing bit errors right from the start may prevent the DNN from converging, we apply bit errors as soon as the (clean) cross-entropy loss is below $1.75$. Interestingly, weight clipping and \Random have somewhat orthogonal effects, which allows to combine them easily in practice: While weight clipping encourages redundancy in weights by constraining them to $[-\wmax,\wmax]$, % and activations,
\Random (w/o weight clipping) causes the DNN to have larger tails in the weight distribution, as shown in \figref{fig:clipping} (bottom). However, considering logits and confidences, especially with random bit errors (in {\color{colorbrewer1}red}), \Random alone performs slightly worse than \Clipping[$0.1$]. Thus, \Random becomes particularly effective when combined with weight clipping, as we make explicit using the notation \Random[$\wmax$] in \algref{alg:training}.
\revision{While \Random increases training complexity (\cf \algref{alg:training}), inference is \emph{not} affected. This is in stark contrast to hardware- or redundancy-based bit error mitigation strategies which usually impact inference time and energy consumption. We also note that the additional hyper-parameter, \ie, $p$, is easily chosen according to the target bit error rate.}


%!TEX TS-program = xelatex
%!TEX encoding = UTF-8 Unicode

\documentclass[12pt,letterpaper]{article}
\usepackage{fontspec}
\usepackage{geometry}
\geometry{letterpaper, textwidth=6.5in, textheight=9.5in, marginparsep=20pt, marginparwidth=2in}
\setlength\parindent{0in}
\usepackage[usenames,dvipsnames]{color}

% math packages
\usepackage{amsmath}
\usepackage{arevmath}
\usepackage{enumerate}

% for sans serif math
%\usepackage{cmbright}

\usepackage{cancel}
% alp's math bold command: Use it like \mb{\lambda} or \mb{X}.
\DeclareRobustCommand{\mb}[1]{\ensuremath{\boldsymbol{\mathbf{#1}}}}

% cond. independence
\newcommand\independent{\protect\mathpalette{\protect\independenT}{\perp}}
\def\independenT#1#2{\mathrel{\rlap{$#1#2$}\mkern2mu{#1#2}}}

\usepackage{xunicode}
\usepackage{xltxtra}
\defaultfontfeatures{Mapping=tex-text,Ligatures=Common, Scale=1}
%\setromanfont [Ligatures={Common}, Numbers={OldStyle}, Variant=01]{Hoefler Text Roman}
%\setromanfont{Whitney HTF Light}
%\setmainfont{Whitney HTF}
\setmainfont[
 BoldFont={Whitney HTF Medium},
 ItalicFont={Whitney HTF Light Italic},
 BoldItalicFont={Whitney HTF Medium Italic}
 ]{Whitney HTF}
\usepackage[]{hyperref}
\usepackage[
    style=numeric-comp,
    sorting=none,
    doi=false,
    isbn=false,
    url=true,
    eprint=false,
    natbib=true,
    maxnames=99
]{biblatex}
\addbibresource{Untitled.bib}

\usepackage{dsfont}

%% Commands
\newcommand{\be}{\begin{equation*}}
\newcommand{\ee}{\end{equation*}}
\newcommand{\ba}{\begin{align*}}
\newcommand{\ea}{\end{align*}}
\newcommand{\indicator}{\mathds{1}}

\title{User-artist-song Model (draft)}
\author{Jaan Altosaar, Laurent Charlin, David Blei}

\begin{document}

\makeatletter

\def\maketitle{%
\begin{centering}
\textbf{\large\@title}\\%
\@author\\%
{\today}\\
\end{centering}
\par}

\makeatother
\maketitle
\vspace{10mm}

\section{Motivation}

Listening to music is different than reading articles. The artist of a song is of higher importance than the author of a scientific paper for a given user perusing their library.

We aim to capture this intuition using latent variables representing artist-level topics $\beta_a$, song-level topics $\beta_s$, and user preferences $x_u$ as shown in Figure \ref{fig:uasmodel}.  This model can be extended, for example by connecting the artist-level $\beta_a$ node to the song-level $\beta_s$ node, or the artist-level rating $r_{ua}$ to the song-level rating $r_{uai}$.

\input{./src/uasmodelfig}
\clearpage
\section{Generative Process}

The generative process for the observed ratings is partially inspired by content-based Poisson factorization \parencite{Gopalana}:

\begin{enumerate}
\item Draw user preferences $x_u \sim \textrm{\bf Gamma}(b,c)$
\item Draw artist-level topics $\beta_a \sim \textrm{\bf Gamma}(d,e)$
\item Draw song-level topics $\beta_i \sim \textrm{\bf Gamma}(f,g)$
\item Draw user-artist rating $r_{ua} \sim \textrm{\bf Poisson}(x_u^T \beta_a)$
\item Draw user-song rating $r_{uai} \sim \textrm{\bf Poisson}(x_u^T(\beta_a + \beta_i))$
\end{enumerate}

\section{Inference}

Structured Stochastic Variational Inference (SSVI) was recently introduced \parencite{Hoffman2014} as a method to add some dependencies between global and local parameters (as opposed to mean-field inference where there are no such dependencies). Here we derive SSVI first for Poisson factorization \citep{Gopalan2013}, and then for the user-artist-song model (Figure \ref{fig:uasmodel}).

\section{Experiments}

SSVI was used to fit Poisson factorization to the million song data set \citep{Liang2014}. The precision was 8.5\% (compared to 5.2\% for content-based Poisson factorization from last semester).

\printbibliography

\end{document}

%%% Local Variables:
%%% mode: tex-pdf
%%% TeX-master: t
%%% End:


%! Author = tstreule

\section{Amperometric Sensors}
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
\subsection{Electrochemistry}
%
\formbox{Overpotential}{\eta \equiv \Delta\phi\ped{appl} {-} \Delta\phi^0 \equiv \phi_s {-} \phi_m \equiv E {-} E^0}
{\hfill\scriptsize $E^0$: Nernst}%
\formula{~}{\eta = 0}
\quad (\textbf{equilibrium} i.e. no net current)

\formula{\textbf{Faraday's law}}{
    \textcolor{gray}{
        \textit{1st: } n\propto Q \textit{,\quad 2nd: } \textrm{(equiv. weigth) } W\ped{eq} = M/z
    }
}
\formbox{\textbf{of electrolysis}}{m = \frac{Q}{z\;F}\;M = \frac{I\;t}{z\;F}\;M = n\cdot M}
\enskip \textcolor{gray}{\scriptsize $[m] {=} \unit{g}$, $[n] {=} \unit{mol}$}
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
\subsubsection{Butler-Volmer equation \textnormal{Effect of $\eta$ on barrier heigth $G$}}
\label{sec:butler-volmer}
%
\begin{tabular}{r@{:\quad}l}
    Let
    $\phi_s$	& potential of ions in solution\\
    $\phi_m$	& potential of $e^-$ in (metallic) electrode\\
    $z$			& valency of oxidized species\\
    $n$			& \#of transferred $e^-$\\
    $z-n$		& valency of reduced species
\end{tabular}
\formula{\textbf{transfer coeff. $\alpha$}}{nF\eta = n(1-\alpha)F\eta+n\alpha F\eta}
%		\formula{@equilibrium ($\eta=0$)}{k_0 \equiv k\ped{red}=k\ped{ox}}
\scalebox{.9}{%
    \formbox{\fbox{$f{\equiv}\frac{F}{RT} {\overset{@\unit[298]{K}}{=}} \frac{1}{\SI{25.69}{\milli\volt}}$}}{%
        k\ped{red} {=} k_0\;\eu^{-n\alpha f\eta}, \enskip
        k\ped{ox}  {=} k_0\;\eu^{n(1-\alpha)f\eta}
    }	\shortstack[l]{
        @equi. ($\eta=0$)\\
        $k_0 {\equiv} k\ped{red} {=} k\ped{ox}$
    }
}

The Butler-Vomer eq. relates what we measure (the \textbf{current}) with what we would like to determine (the \textbf{concentration} of an analyte):
\scalebox{.9}{%
    \formbox{\textbf{Butler-Volmer}}{j = \underbrace{nFAk_0\vspace{-1mm}}_{\vspace{-2mm}j_0} \big( C\ped{ox}(0,t)\;\eu^{-\alpha nf\eta} - C\ped{red}(0,t)\;\eu^{(1-\alpha)nf\eta} \big)}}
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
\subsection{Cyclic Voltammetry}
%
\begin{minipage}{.4\columnwidth}
    \includegraphics[width=.9\columnwidth]{Electrochemistry_Cyclic_Voltammetry}
\end{minipage}%
\begin{minipage}{.6\columnwidth}
    Offers information on the mechanism of the ec reactions occuring at an electrode.
    \begin{itemize}
        \item May be irreversible\\
        $\to$ \#upper peaks $\neq$ \#lower peaks\\
        $\to$ irreversible reaction fast
        \item Sweep rate\\
        $\to$ irreversible reaction slow
    \end{itemize}
\end{minipage}
\formtex{\textbf{Water electrolysis}}{High potentials/volt's}
%$\to$ affects $I$ %(disturbance, bad)
\formtex{~}{$\to$ affects $I$ (disturbance, bad)}
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
\subsection{Amperometric Sensors}
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
\subsubsection{Clark \textnormal{(Oxygen)} Electrode \hfill\textnormal{$\to$ Measure \ce{O2}}}
%
\begin{itemize}
    \item test solution \ce{->[O2 passes][membrane]} \ce{Pt} cathode \ce{->[reduction]} current
    \item \ce{Ag} anode is in \ce{KCl} solution ($\to$ ``enough'' \ce{Cl-} for oxidation)
\end{itemize}
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
\subsubsection{1st and 2nd Generation}
%
$	\textrm{analyte of interest}
\;\ldots\;
\underbrace{\textrm{redox enzyme}\vspace{-1.5mm}}_{\vspace{-2.5mm}\textrm{catalize}}
\;\underbrace{\ldots\vspace{-.5mm}}_{\vspace{-2.5mm}\textrm{P1}}\;
\underbrace{\textrm{mediator}\vspace{-1mm}}_{\vspace{-2.5mm}\textrm{P2}}
\;\ldots\;
\textrm{Clark Electrode}
$
\formtex{problem P1 (1st)}{\ce{O2} may be consumed, when not measured}
\formtex{problem P2 (2nd)}{need to have ``enough'' of them}
\formtex{Mediator has to be}{$\bullet$ reversible \quad $\bullet$ not toxic \quad $\bullet$ no side reactions}
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
\subsubsection{3rd Generation}
%
\textit{Immobilization}/fixation of a redox enzyme on electrode surface

$\to$ free-diffusing redox mediators are not necessary\\
$\to$ in vivo measurments allowed since immobilized

\formtex{problem P3}{Efficient electron transfer (Marcus theory)}\vspace{-1mm}
\formtex{~}{$\to$ may be overcome by mediators}\vspace{-1mm}
\formtex{~}{$\to$ minimize ET distance}
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
\subsection{Three Electrode Cell}
%
\begin{minipage}{.5\columnwidth}
    \includegraphics[width=\columnwidth]{Electrochemistry_Three_Electrode_Cell}
\end{minipage}%
\hspace{1cm}
\begin{minipage}{.5\columnwidth-1cm}
    $\frac{U\ped{REF}}{R_2} = - \frac{U\ped{in}}{R_1}$
    \par
    $I = \frac{U\ped{out}}{R_3}$
\end{minipage}