Secure and Storage-Efficient Deep Learning Models for Edge AI Using Automatic Weight Generation

Atri Chatterjee; Habibur Rahaman; Swarup Bhunia

REVIEW 4 major objections 7 minor 28 references

Secure and Storage-Efficient Deep Learning Models for Edge AI Using Automatic Weight Generation

T0 review · 4 major / 7 minor · reviewed 2026-08-06 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read WINGs claims trained networks can discard most weight matrices and regenerate them layer by layer from a PCA-reduced seed, cutting fully connected memory 53x and AlexNet memory 28x with 1-2% accuracy loss.

desk verdict The FC weight-generation scheme is undefined as written—each layer gives one PCA'd weight matrix, so the SVR has no training set—and the paper's own tables contradict the abstract; the CNN side is more concrete but still misses key measurements. read the letter →

arxiv 2507.06380 v1 pith:5ZTT2SG5 submitted 2025-07-08 cs.LG cs.AIcs.CV

Habibur Rahaman , Atri Chatterjee , Swarup Bhunia This is my paper · ORCID

classification cs.LGcs.AIcs.CV

keywords automaticweightgenerationmodelcompressionsupportvectorregressionprincipalcomponentanalysisedgeAIbit-flipattacksensitivity-awaredeepneuralnetworkinference

verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

The paper sets out to establish that the weights of a trained deep network do not all need to be stored: a small compressed seed plus a set of lightweight regression models can regenerate each layer's weights during inference. The proposed scheme, WINGs, applies PCA to the first layer's weight matrix, trains a support vector regression (SVR) model to predict the PCA-reduced weights of the next layer from those of the current one, and repeats that mapping through the network. For convolutional layers, it first measures each layer's gradient sensitivity and compresses only the low-sensitivity layers, preserving the layers whose perturbation would cost accuracy. If the scheme works as reported, edge devices could run models with a few megabytes of weight memory, and tampering via bit flips would be easier to detect because errors in reconstructed weights propagate across layers. The paper reports 53x compression for fully connected layers, 28x for AlexNet on MNIST, and 18x on CIFAR-10 with roughly 1-2% accuracy loss.

What carries the argument

The machinery is a chain of PCA-reduced weight matrices linked by SVR predictors: $\widehat{W}^{PCA}_{\ell} = \mathrm{SVR}_{\ell-1}(\widehat{W}^{PCA}_{\ell-1})$. PCA shrinks each layer's weight matrix to its top eigenvectors, keeping the variance above a threshold; the SVR models are trained during an offline phase to map one layer's reduced weights to the next layer's reduced weights, and at inference the original shape is restored by inverse PCA. In the CNN version, a sensitivity analysis computes the expected Frobenius norm of the loss gradient for each layer, and only layers below a threshold enter the PCA-SVR pipeline, with the rest stored in original form. The security property is carried by the same chain: errors introduced into a predicted component propagate through the reconstruction and into later layers, amplifying their effect on accuracy.

What would settle it

Run the WINGs pipeline on a fixed architecture and dataset, reconstruct every layer's weights, and compare the reconstructed matrices with the originals layer by layer while measuring test accuracy. An observed accuracy drop beyond the paper's reported 1-2% on the same dataset-architecture pair, or an SVR prediction error that grows with depth, would falsify the central claim.

Watch

Extended reading notes

Core claim

On its own terms, the paper's central discovery is that there is enough cross-layer structure in trained weight matrices for a support vector regression model to predict the PCA-reduced weights of layer $\ell+1$ from the PCA-reduced weights of layer $\ell$, so the full matrix never has to be stored or loaded. Only the reduced first-layer weights and the trained SVR models are kept; every other layer's weights are reconstructed on the fly by applying PCA, SVR prediction, and inverse PCA. In CNNs the same machinery is applied selectively, with a gradient-based sensitivity measure selecting low-sensitivity layers for compression while high-sensitivity layers stay untouched. A secondary claim is that this reconstruction chain changes the attack surface: a bit flip in a compressed layer causes a sharper accuracy drop than in the original model, which the paper reads as a built-in tamper-detection signal.

Load-bearing premise

The load-bearing premise is that a regression model trained on the PCA-reduced weights of one layer can accurately predict the PCA-reduced weights of the next layer; if that cross-layer mapping is not learnable or does not generalize, the generated weights will not preserve accuracy and the entire compression scheme loses its basis.

Editorial extensions

If this is right

If the cross-layer regression is reliable, a trained fully connected network can be stored as one reduced weight matrix plus one small SVR model per layer, so memory cost no longer grows with the product of layer sizes.
The reported numbers imply that a 136.75 MB AlexNet on MNIST can be reduced to roughly 7.63 MB, which is the difference between external DRAM access and on-chip storage for many edge devices.
Keeping high-sensitivity layers uncompressed gives the method a tunable operating point: increasing the sensitivity threshold raises compression while risking accuracy, so deployment can trade the two per layer.
Because bit flips in reconstructed components spread through the SVR chain, the same mechanism that saves memory also provides a tamper indicator, potentially reducing the need for error-correcting codes on weight memory.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

The paper leaves untested whether the cross-layer SVR mapping survives in very deep or residual networks, where weight matrices in different layers are less alike; measuring prediction error accumulation with depth would settle that.
A natural extension is to compose WINGs with quantization or pruning of the stored seed and SVR models, since the two mechanisms attack different parts of the memory budget and could multiply compression ratios.
The amplified accuracy drop under bit flips implies a robustness cost the paper does not quantify: the same sensitivity that makes tampering detectable would also make the compressed model more vulnerable to natural memory errors, so a deployment would need to distinguish malicious flips from random faults.

Share X Bluesky LinkedIn Reddit HN

Signed reviews

No signed human review yet.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Desk Editor's Note

read the letter

Quick take: this paper has a genuinely clever idea—use PCA + SVR to regenerate weights on the fly and let compression make bit-flip tampering more visible—but the fully connected part of the method, the part that produces the headline 53x number, is not actually specified. Algorithm 1 trains SVR_l to map W_l^PCA to W_{l+1}^PCA. In a trained network there is exactly one weight matrix per layer, so that is one input-output pair. There is no defined training set unless you split columns or rows, and the paper never says so. That is a load-bearing gap, not a minor omission: if the mapping cannot be trained, the FC compression claim collapses. The stress-test note is right.

What is new: the specific assembly of PCA dimensionality reduction, SVR-based weight prediction, and gradient-sensitivity-based selective compression does not appear in the cited prior work, and the CNN variant is more concrete. Algorithm 2 splits each reduced weight matrix into known and predicted columns and trains an SVR per column; that is executable in principle. The security-detectability intuition—compressed weights propagate bit-flips across layers—is worth taking seriously.

Where it falls apart: the numerical claims are internally inconsistent. The abstract says 53x FC compression; Table III reports 53.32% size reduction, which is about 2.1x. The AlexNet totals are swapped: Table IV gives 17.92x for MNIST while the abstract says 28x, and Table V gives 28.67x for CIFAR-10 while the abstract says 18x. Accuracy for the AlexNet experiments is not reported at all, so the claim that compression costs only 1–2% is unverifiable. The bit-flip security section relies on a single accuracy number with no attack budget or baseline. No code or hyperparameters are provided, so none of this is reproducible.

The reader's summary is fair, though I would put even more weight on the undefined FC training set than on the inconsistent ratios. The ratios are symptoms of the same unverifiability.

Recommendation: do not send to referees as is. The CNN column-wise idea might be salvageable, but the paper needs to actually define the FC regression, provide the missing accuracy numbers, and reconcile the tables before anyone spends referee time on it.

Referee Report

4 major / 7 minor

Summary. The paper proposes WINGs, a framework that compresses DNN weights by combining PCA dimensionality reduction with support vector regression (SVR). For fully connected networks, it claims to store only the first layer's weights and train SVR models to predict the PCA-reduced weights of each subsequent layer from the previous one. For CNNs, it proposes sensitivity-based layer selection and per-column SVR reconstruction of omitted PCA components. The stated contributions are memory reduction during inference, preservation of accuracy, and enhanced detectability of bit-flip attacks due to amplified error propagation. Experiments are reported on MNIST, Fashion-MNIST, SVHN, CNAE-9, and AlexNet on MNIST/CIFAR-10, with headline claims of 53x FC compression, 28x AlexNet compression on MNIST, and 18x on CIFAR-10.

Significance. If the method worked as described, the impact would be moderate but genuine: an inference-time weight-generation scheme that removes the need to store full FC weight matrices would be attractive for edge deployment, and the sensitivity-aware security angle is interesting. The paper also provides a comparison against RLE+Huffman, pruning, truncation, and JPEG compression. However, the central FC mechanism is underspecified to the point of non-executability, the inference procedure is described in two incompatible ways, and the headline compression numbers are internally inconsistent. Because these issues affect the core claims, I cannot assess the significance of the reported results as they stand.

major comments (4)

[Section III.A, Algorithm 1] The FC weight-generation scheme is not executable as written. For a trained network there is exactly one weight matrix per layer, so the training set for each SVR_l is a single pair (W_l^PCA, W_{l+1}^PCA). A regression function cannot be learned from one high-dimensional input-output pair, and no alternative training set (e.g., column-wise samples, multiple training runs, or filter patches) is defined. If one nevertheless forces a single-pair fit, the resulting SVR either stores the training input as a support vector or, for a linear kernel, stores a weight vector of the same dimension as the input; the paper gives no accounting for the size of these SVR parameters. The claim that WINGs stores only W1 and trained SVR models is therefore unsupported, and the reported FC compression ratios have no algorithmic basis.
[Section III.A, inference description vs. Algorithm 1] The paper gives two incompatible descriptions of what is fed to the SVR during inference. The prose states that PCA is applied to the weights of the previous layer to obtain W_{l-1}^PCA = PCA_{l-1}(W_{l-1}), whereas Algorithm 1 line 12 uses the previously predicted reduced weights \hat{W}_{l-1}^PCA as the input to SVR_{l-1}. Since W_{l-1} is itself reconstructed and therefore noisy during inference, these two choices produce different input distributions and different error propagation. The paper neither disambiguates them nor argues that either input matches the training distribution, so the inference procedure for the FC case is not reproduceable.
[Section V.A, Tables IV and V, and Abstract] The headline numerical claims are internally inconsistent. The abstract states 28x compression for AlexNet on MNIST and 18x for AlexNet on CIFAR-10, but Table IV (labeled MNIST) reports a total compression of 17.92x for a 136.75 MB model, while Table V (labeled CIFAR-10) reports 28.67x for a 108.74 MB model; the mapping is reversed. The text also refers to 'Table V' for results that appear in both Table IV and Table V. In addition, the abstract's '53x FC compression' is not reconciled with Table III, which reports a 53.32% size reduction (about 2.1x) for the MNIST FC model, while Table VI reports 52.48x for a different MNIST FC setup. The paper does not state which experiment supports the abstract claim, so the central quantitative claims cannot be verified.
[Section IV.B and Section V.B] The security contribution is not established. The attack experiment is described only as 'bit-flip attacks on the internal parameters of the SVR' (Section V.B), without specifying the bit budget, the flip locations, or the baseline model under identical attack conditions. The claimed amplification factor A = DeltaAccuracy_compressed / DeltaAccuracy_original >> 1 is asserted but never measured. Furthermore, a sharper accuracy drop is presented as 'detectability' without defining any detection procedure, threshold, or false-alarm analysis. As a result, the paper does not support the claim that WINGs provides a built-in tamper-detection mechanism.

minor comments (7)

[Algorithm 1 caption] The word 'interference' in the Algorithm 1 caption should be 'inference'.
[Section V.A] The text refers to 'Table 1' when comparing compression techniques, but the actual table is labeled Table VI; please correct the reference.
[Section V.A, Figure 4 discussion] The text uses 'precision' where it appears to mean 'accuracy' (e.g., 'precision above 80%' and 'precision of 15.3%'); please use consistent terminology.
[Table VI vs. Table III] The CNAE-9 baseline accuracy is listed as 97.20% in Table VI but 90.74% in Table III; the discrepancy should be explained or corrected.
[Section IV.C] The sentence 'For a model with Noriginal weights, the ECC cost is below (sensitivity-aware protection further lowers costs)' is incomplete; the intended formula or comparison is missing.
[Section III.B and Algorithm 2] The notation is inconsistent: the text uses \tilde{W}_l and \mu_l, while Algorithm 2 uses W^{(i)}_{flat} and \mu_i; please unify the symbols so that the PCA centering and reconstruction steps are unambiguous.
[Figure 7] The figure caption does not describe the axes, the number of flipped bits, or the attack procedure; without this information the sharpness comparison is difficult to interpret.

Circularity Check

2 steps flagged · score 6.0 of 10

FC and CNN 'predictions' are in-sample SVR fits: the SVRs are trained on the exact reduced weights they later output, so reported accuracy validates reconstruction, not independent weight prediction.

fitted input called prediction [Section III.A, Algorithm 1 (Training Phase line 6; Inference Phase line 12)]
"Train SVRℓ to map reduced weights: Ŵ^PCA_ℓ 7→ Ŵ^PCA_{ℓ+1}; ... Predict reduced weights for layer ℓ: Ŵ^PCA_ℓ = SVR_{ℓ−1}(Ŵ^PCA_{ℓ−1})"

SVR_ℓ is fitted with target Ŵ^PCA_{ℓ+1}; during inference the same SVR_ℓ emits Ŵ^PCA_{ℓ+1} from Ŵ^PCA_ℓ. For the first generated layer (ℓ=2), the output is exactly the training target, so no held-out weight prediction occurs. The reported 1–2% accuracy loss is a measure of how well the SVRs reconstruct the weight matrices they were trained on, not evidence that layer weights can be predicted independently. Moreover, Algorithm 1 provides only one weight matrix per layer, giving one input–output pair per SVR; without an undocumented split into rows/columns/patches, the regression training set is degenerate.
fitted input called prediction [Section III.B, Algorithm 2, Step 4 (SVR Prediction)]
"Split: W PCA i = [W known i , W predict i ]; Predict: Ŵ predict i [:, j] = f i,j (W known i )"

Each SVR f_{i,j} is trained on the known columns of the very same reduced weight matrix to output the missing columns W^{predict}_i. The 'predicted' columns are the regression targets used to fit f_{i,j}; reconstruction is in-sample imputation of the training data. The paper presents this as automatic weight generation, but the SVR parameters already encode the missing components, so the stored SVRs are a learned copy of the omitted values rather than an independent prediction.

full rationale

Both compression schemes in WINGs train SVRs on the exact weight components they later call 'predicted' during inference. In the FC scheme (Section III.A/Algorithm 1), SVR_ℓ is fit to map Ŵ^PCA_ℓ to Ŵ^PCA_{ℓ+1}, and the inference loop uses SVR_{ℓ−1} to produce Ŵ^PCA_ℓ from Ŵ^PCA_{ℓ−1}; for ℓ=2 this output is the training target itself. The CNN scheme (Section III.B/Algorithm 2) fits each f_{i,j} on known columns of W^PCA_i to impute missing columns, so the 'prediction' is an in-sample fit. Under the rubric, this is fitted input called prediction: the reported accuracy validates reconstruction fidelity of a learned compression, not an independent forecast or generative capability. The FC algorithm is also underspecified because a trained network contains one weight matrix per layer, giving a single input-output pair for each SVR. There is no load-bearing self-citation or imported uniqueness theorem; the security experiments are empirical and not circular. Because PCA, sensitivity-based layer selection, and the attack experiments provide some independent content, the partial circularity is scored 6, not 8 or 10.

Assumptions & free parameters 4 free parameters · 3 assumptions · 0 invented entities

The central method rests on three unproven assumptions: that SVR can predict next-layer weights from PCA-reduced current-layer weights, that gradient-norm sensitivity selects safe-to-compress layers, and that bit-flip errors in compressed layers amplify detectably. The sensitivity threshold tau and PCA thresholds are free parameters fitted per dataset. No new physical entities are introduced.

free parameters (4)

PCA variance retention threshold = not reported; figures show 0.1-0.99
Controls compression vs accuracy; chosen per dataset to hit target accuracy/compression (Figs. 4-6), not fixed by a rule.
Sensitivity threshold tau = not reported
Determines which layers are selected for compression in Section III.B; value never specified or justified, and the accuracy result depends on it.
SVR hyperparameters (C, epsilon, kernel) = not reported
SVR is central to weight prediction; C and epsilon appear in the loss in Section III.A but concrete values are never given.
PCA ratio rho in Algorithm 2 = not reported
Algorithm 2 takes PCA ratio rho as input but no value is provided.

assumptions (3)

domain assumption Weights of successive layers in a trained FC network are related by a learnable SVR mapping from PCA-reduced weights of one layer to the next.
Invoked in Section III.A where SVR_l is trained to map W^PCA_l to W^PCA_{l+1}; if this mapping is not learnable or not stable, the generated weights will not preserve accuracy.
domain assumption Gradient-norm sensitivity S_l = E[||grad_{W_l} L||_F] identifies layers that can be compressed without significant accuracy loss.
Used in Section III.B to select L_selected via threshold tau; no proof that Frobenius gradient norm is a reliable compressibility criterion.
domain assumption Bit-flip errors in compressed weights propagate across layers and amplify accuracy loss, making tampering detectable.
Asserted in Section IV.B with the formula A = DeltaAcc_compressed / DeltaAcc_original >> 1, but no measured values or detection analysis are provided.

how reviews work

0 comments

Cite this review

Pith. "Pith review of Secure and Storage-Efficient Deep Learning Models for Edge AI Using Automatic Weight Generation." pith.science (2026). https://pith.science/paper/5ZTT2SG5

@misc{pith2026250706380,
  author       = {Pith},
  title        = {Pith review of: Secure and Storage-Efficient Deep Learning Models for Edge AI Using Automatic Weight Generation},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/5ZTT2SG5}},
  note         = {Machine review of arXiv:2507.06380}
}

read the original abstract

Complex neural networks require substantial memory to store a large number of synaptic weights. This work introduces WINGs (Automatic Weight Generator for Secure and Storage-Efficient Deep Learning Models), a novel framework that dynamically generates layer weights in a fully connected neural network (FC) and compresses the weights in convolutional neural networks (CNNs) during inference, significantly reducing memory requirements without sacrificing accuracy. WINGs framework uses principal component analysis (PCA) for dimensionality reduction and lightweight support vector regression (SVR) models to predict layer weights in the FC networks, removing the need for storing full-weight matrices and achieving substantial memory savings. It also preferentially compresses the weights in low-sensitivity layers of CNNs using PCA and SVR with sensitivity analysis. The sensitivity-aware design also offers an added level of security, as any bit-flip attack with weights in compressed layers has an amplified and readily detectable effect on accuracy. WINGs achieves 53x compression for the FC layers and 28x for AlexNet with MNIST dataset, and 18x for Alexnet with CIFAR-10 dataset with 1-2% accuracy loss. This significant reduction in memory results in higher throughput and lower energy for DNN inference, making it attractive for resource-constrained edge applications.

Figures

Figures reproduced from arXiv: 2507.06380 by the authors.

**Figure 2.** Flow diagram illustrating automatic weight generation and compression in the WINGs framework: This figure demonstrates Principal [PITH_FULL_IMAGE:figures/full_fig_p003_2.png] view at source ↗

**Figure 3.** This figure shows a step-by-step overview of the WINGs weight [PITH_FULL_IMAGE:figures/full_fig_p003_3.png] view at source ↗

Figures from the paper (4 more)

**Figure 4.** Figure 4: This figure shows the impact of PCA thresholds on model [PITH_FULL_IMAGE:figures/full_fig_p005_4.png]

**Figure 5.** Figure 5: This figure shows the effect of PCA thresholds on compressed [PITH_FULL_IMAGE:figures/full_fig_p005_5.png]

**Figure 6.** Figure 6: This figure shows the trade-off between size reduction and [PITH_FULL_IMAGE:figures/full_fig_p006_6.png]

**Figure 7.** Figure 7: This figure shows the impact of bit-flip attacks on model accuracy. [PITH_FULL_IMAGE:figures/full_fig_p006_7.png]

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

28 extracted references · 19 canonical work pages

[1]

Eie: Efficient inference engine on compressed deep neural network,

S. Han, X. Liu, H. Mao, J. Pu, A. Pedram, M. A. Horowitz, and W. J. Dally, “Eie: Efficient inference engine on compressed deep neural network,” ACM SIGARCH Computer Architecture News, vol. 44, no. 3, pp. 243–254, 2016

work page 2016
[2]

Bert: Pre-training of deep bidirectional transformers for language understanding,

J. Devlin, “Bert: Pre-training of deep bidirectional transformers for language understanding,” arXiv preprint arXiv:1810.04805 , 2018

arXiv 2018
[3]

Language models are few-shot learners,

T. B. Brown, “Language models are few-shot learners,” arXiv preprint arXiv:2005.14165, 2020

arXiv 2005
[4]

Deep residual learning for image recognition,

K. He, X. Zhang, S. Ren, and J. Sun, “Deep residual learning for image recognition,” in IEEE conference on computer vision and pattern recognition , 2016, pp. 770–778

work page 2016
[5]

Xnor- net: Imagenet classification using binary convolutional neu- ral networks,

M. Rastegari, V . Ordonez, J. Redmon, and A. Farhadi, “Xnor- net: Imagenet classification using binary convolutional neu- ral networks,” in European conference on computer vision . Springer, 2016, pp. 525–542

work page 2016
[6]

To prune, or not to prune: exploring the efficacy of pruning for model compression,

M. Zhu and S. Gupta, “To prune, or not to prune: exploring the efficacy of pruning for model compression,” arXiv preprint arXiv:1710.01878, 2017

arXiv 2017
[7]

Low-rank matrix factorization for deep neu- ral network training with high-dimensional output targets,

T. N. Sainath, B. Kingsbury, V . Sindhwani, E. Arisoy, and B. Ramabhadran, “Low-rank matrix factorization for deep neu- ral network training with high-dimensional output targets,” in 2013 IEEE international conference on acoustics, speech and signal processing. IEEE, 2013, pp. 6655–6659

work page 2013
[9]

Mobilenets: Efficient convolutional neu- ral networks for mobile vision applications,

A. G. Howard, “Mobilenets: Efficient convolutional neu- ral networks for mobile vision applications,” arXiv preprint arXiv:1704.04861, 2017

arXiv 2017

Show all 28 references

[10]

Squeezenet: Alexnet-level accuracy with 50x fewer parameters and¡ 0.5 mb model size,

F. N. Iandola, “Squeezenet: Alexnet-level accuracy with 50x fewer parameters and¡ 0.5 mb model size,” arXiv preprint arXiv:1602.07360, 2016

2016 arXiv
[11]

Hypernetworks,

D. Ha, A. Dai, and Q. V . Le, “Hypernetworks,” arXiv preprint arXiv:1609.09106, 2016

2016 arXiv
[12]

Adaptive weight compression for memory-efficient neural net- works,

J. H. Ko, D. Kim, T. Na, J. Kung, and S. Mukhopadhyay, “Adaptive weight compression for memory-efficient neural net- works,” in Design, Automation & Test in Europe Conference & Exhibition (DATE), 2017 . IEEE, 2017, pp. 199–204

2017
[13]

Binarized neural networks: Training deep neural networks with weights and activations constrained to+ 1 or-1,

M. Courbariaux, I. Hubara, D. Soudry, R. El-Yaniv, and Y . Ben- gio, “Binarized neural networks: Training deep neural networks with weights and activations constrained to+ 1 or-1,” arXiv preprint arXiv:1602.02830, 2016

2016 arXiv
[14]

Deep compression: Com- pressing deep neural networks with pruning, trained quantiza- tion and huffman coding,

S. Han, H. Mao, and W. J. Dally, “Deep compression: Com- pressing deep neural networks with pruning, trained quantiza- tion and huffman coding,” arXiv preprint arXiv:1510.00149 , 2015

2015 arXiv
[15]

Flipping bits in memory without accessing them: An experimental study of dram disturbance errors,

Y . Kim, R. Daly, J. Kim, C. Fallin, J. H. Lee, D. Lee, C. Wilk- erson, K. Lai, and O. Mutlu, “Flipping bits in memory without accessing them: An experimental study of dram disturbance errors,” ACM SIGARCH Computer Architecture News , vol. 42, no. 3, pp. 361–372, 2014

2014
[16]

Exploiting correcting codes: On the effectiveness of ecc memory against rowhammer attacks,

L. Cojocar, K. Razavi, C. Giuffrida, and H. Bos, “Exploiting correcting codes: On the effectiveness of ecc memory against rowhammer attacks,” in 2019 IEEE Symposium on Security and Privacy (SP). IEEE, 2019, pp. 55–71

2019
[17]

Defending bit-flip attack through dnn weight reconstruction,

J. Li, A. S. Rakin, Y . Xiong, L. Chang, Z. He, D. Fan, and C. Chakrabarti, “Defending bit-flip attack through dnn weight reconstruction,” in 2020 57th ACM/IEEE Design Automation Conference (DAC). IEEE, 2020, pp. 1–6

2020
[18]

Liii. on lines and planes of closest fit to systems of points in space,

K. Pearson, “Liii. on lines and planes of closest fit to systems of points in space,” The London, Edinburgh, and Dublin Philo- sophical Magazine and Journal of Science , vol. 2, no. 11, pp. 559–572, 1901

1901
[19]

A tutorial on support vector regression,

A. J. Smola and B. Sch ¨olkopf, “A tutorial on support vector regression,” Statistics and computing , vol. 14, pp. 199–222, 2004

2004
[20]

Secure ai systems: Emerging threats and defense mechanisms,

H. Rahaman, A. Chatterjee, and S. Bhunia, “Secure ai systems: Emerging threats and defense mechanisms,” in 2024 IEEE 33rd Asian Test Symposium (ATS) . IEEE, 2024, pp. 1–6

2024
[21]

Bit-flip attack: Crushing neural network with progressive bit search,

A. S. Rakin, Z. He, and D. Fan, “Bit-flip attack: Crushing neural network with progressive bit search,” in Proceedings of the IEEE/CVF International Conference on Computer Vision , 2019, pp. 1211–1220

2019
[22]

Low precision arithmetic for deep learning,

J. D. M Courbariaux, Y Bengio, “Low precision arithmetic for deep learning,” in ICLR (Workshop), 2015, 2015, pp. 199–204

2015
[23]

J. A. Hertz, Introduction to the theory of neural computation . Crc Press, 2018

2018
[24]

Eyeriss: An energy-efficient reconfigurable accelerator for deep convo- lutional neural networks,

Y .-H. Chen, T. Krishna, J. S. Emer, and V . Sze, “Eyeriss: An energy-efficient reconfigurable accelerator for deep convo- lutional neural networks,” IEEE journal of solid-state circuits , vol. 52, no. 1, pp. 127–138, 2016

2016
[25]

Evolving neural networks in compressed weight space,

J. Koutnik, F. Gomez, and J. Schmidhuber, “Evolving neural networks in compressed weight space,” in Proceedings of the 12th annual conference on Genetic and evolutionary computa- tion, 2010, pp. 619–626

2010
[26]

Compressing convolutional neural networks in the frequency domain,

W. Chen, J. Wilson, S. Tyree, K. Q. Weinberger, and Y . Chen, “Compressing convolutional neural networks in the frequency domain,” in Proceedings of the 22nd ACM SIGKDD interna- tional conference on knowledge discovery and data mining , 2016, pp. 1475–1484

2016
[27]

Simplifying deep neural networks for neuromorphic architectures,

J. Chung and T. Shin, “Simplifying deep neural networks for neuromorphic architectures,” in Proceedings of the 53rd Annual Design Automation Conference , 2016, pp. 1–6

2016
[28]

G. H. Golub and C. F. Van Loan, Matrix computations. JHU press, 2013

2013
[29]

Low precision arithmetic for deep learning

M. Courbariaux, Y . Bengio, and J.-P. David, “Low precision arithmetic for deep learning.” in ICLR (Workshop), 2015

2015

Pith tools

Reviewed August 6, 2026 · model on record in the stance chip above.

[1] [1]

Eie: Efficient inference engine on compressed deep neural network,

S. Han, X. Liu, H. Mao, J. Pu, A. Pedram, M. A. Horowitz, and W. J. Dally, “Eie: Efficient inference engine on compressed deep neural network,” ACM SIGARCH Computer Architecture News, vol. 44, no. 3, pp. 243–254, 2016

work page 2016

[2] [2]

Bert: Pre-training of deep bidirectional transformers for language understanding,

J. Devlin, “Bert: Pre-training of deep bidirectional transformers for language understanding,” arXiv preprint arXiv:1810.04805 , 2018

arXiv 2018

[3] [3]

Language models are few-shot learners,

T. B. Brown, “Language models are few-shot learners,” arXiv preprint arXiv:2005.14165, 2020

arXiv 2005

[4] [4]

Deep residual learning for image recognition,

K. He, X. Zhang, S. Ren, and J. Sun, “Deep residual learning for image recognition,” in IEEE conference on computer vision and pattern recognition , 2016, pp. 770–778

work page 2016

[5] [5]

Xnor- net: Imagenet classification using binary convolutional neu- ral networks,

M. Rastegari, V . Ordonez, J. Redmon, and A. Farhadi, “Xnor- net: Imagenet classification using binary convolutional neu- ral networks,” in European conference on computer vision . Springer, 2016, pp. 525–542

work page 2016

[6] [6]

To prune, or not to prune: exploring the efficacy of pruning for model compression,

M. Zhu and S. Gupta, “To prune, or not to prune: exploring the efficacy of pruning for model compression,” arXiv preprint arXiv:1710.01878, 2017

arXiv 2017

[7] [7]

Low-rank matrix factorization for deep neu- ral network training with high-dimensional output targets,

T. N. Sainath, B. Kingsbury, V . Sindhwani, E. Arisoy, and B. Ramabhadran, “Low-rank matrix factorization for deep neu- ral network training with high-dimensional output targets,” in 2013 IEEE international conference on acoustics, speech and signal processing. IEEE, 2013, pp. 6655–6659

work page 2013

[8] [9]

Mobilenets: Efficient convolutional neu- ral networks for mobile vision applications,

A. G. Howard, “Mobilenets: Efficient convolutional neu- ral networks for mobile vision applications,” arXiv preprint arXiv:1704.04861, 2017

arXiv 2017