SAfER: Layer-Level Sensitivity Assessment for Efficient and Robust
  Neural Network Inference
Deep neural networks (DNNs) demonstrate outstanding performance across most
computer vision tasks. Some critical applications, such as autonomous driving
or medical imaging, also require investigation into their behavior and the
reasons behind the decisions they make. In this vein, DNN attribution consists
in studying the relationship between the predictions of a DNN and its inputs.
Attribution methods have been adapted to highlight the most relevant weights or
neurons in a DNN, allowing to more efficiently select which weights or neurons
can be pruned. However, a limitation of these approaches is that weights are
typically compared within each layer separately, while some layers might appear
as more critical than others. In this work, we propose to investigate DNN layer
importance, i.e. to estimate the sensitivity of the accuracy w.r.t.
perturbations applied at the layer level. To do so, we propose a novel dataset
to evaluate our method as well as future works. We benchmark a number of
criteria and draw conclusions regarding how to assess DNN layer importance and,
consequently, how to budgetize layers for increased DNN efficiency (with
applications for DNN pruning and quantization), as well as robustness to
hardware failure (e.g. bit swaps).
Edouard Yvinec, Arnaud Dapogny, Kevin Bailly, Xavier Fischer
# SAfER: Layer-Level Sensitivity Assessment for Efficient and Robust Neural Network Inference

###### Abstract

Deep neural networks (DNNs) demonstrate outstanding performance across most computer vision tasks. Some critical applications, such as autonomous driving or medical imaging, also require investigation into their behavior and the reasons behind the decisions they make. In this vein, DNN attribution consists in studying the relationship between the predictions of a DNN and its inputs. Attribution methods have been adapted to highlight the most relevant weights or neurons in a DNN, allowing to more efficiently select which weights or neurons can be pruned. However, a limitation of these approaches is that weights are typically compared within each layer separately, while some layers might appear as more critical than others. In this work, we propose to investigate DNN layer importance, _i.e._ to estimate the sensitivity of the accuracy w.r.t. perturbations applied at the layer level. To do so, we propose a novel dataset1 to evaluate our method as well as future works. We benchmark a number of criteria and draw conclusions regarding how to assess DNN layer importance and, consequently, how to budgetize layers for increased DNN efficiency (with applications for DNN pruning and quantization), as well as robustness to hardware failure (e.g. bit swaps).

Footnote 1: The database and loading scripts are publicly available on github.

## 1 Introduction

Empirical evidence shows the remarkable predictive capabilities of deep neural networks (DNNs). For instance, in computer vision, from image classification [14] to object detection [15] through semantic segmentation [16], deep neural networks achieve state-of-the-art performance. For a number of applications such as medical imaging [20] or autonomous driving [17], however, being able to closely understand and monitor the internal behavior of DNNs is of paramount importance. Broadly speaking, this has been related in the literature as DNN explainability [1].

First, at train time, explainability encompasses the theoretical study of the learning dynamics and the generalization capacities of DNNs [18, 19, 16]. Second, during deployment, explainability also implies diagnosing _why_ a DNN took a particular decision, predicted one class rather than another, or generated one particular sequence of words, conditionally to its inputs. The study of this input-output relationship is often called visual explanation in the context of computer vision, or, more generally, attribution [20, 21, 22, 23, 24, 25, 26, 27].

Perhaps the most straightforward way to compute and understand attribution for one pixel of an image [1] is to set its value to \(0\) and measure the accuracy loss induced by this change. However, beyond highlighting the most relevant _pixels_ or dimension of an input for prediction, attribution methods can be used to diagnose which _weights_ can-or can not-be removed in a DNN for pruning [20]. One limitation of such approach, however, lies in the fact that weights or neurons can be compared within the same layer only.

In the continuity of this work, we propose to study the cross-layer relative importance with respect to the final accuracy of the model. Having effective methods for layer importance ranking for deep neural networks should open new perspectives on neural networks predictive abilities. Stemming from attribution techniques for input sensitivity understanding and pruning for neuron level sensitivity measurement, we study the effectiveness of these techniques to tackle the challenge of cross-layer sensitivity assessment.

This study paves the way for exciting future perspectives for DNN optimization including, but not limited to:

* **DNN compression (quantization and pruning):** On the one hand, prior work on neural network compression highlighted the necessity to adapt the compression rates to specific layers. For instance, in quantization where floating point operations are converted into low-bit fixed point operations, prior works [12, 13, 14] have shown that quantizing the first and last layers to larger bit-width lead to low latency cost while baring significant benefits in terms of accuracy preservation. Generally speaking, the search for a well suited bit-width assignment per per neuron is called mixed-precision [23, 14, 15, 24]. However, in practice, it is often either a very costly process based upon a set of simple heuristics [10, 20]
or reinforcement learning [22, 23]. Similarly, in the context of DNN pruning, where one seeks to remove blocks of computations in order to reduce both the inference runtime and the memory footprint of the model, previous work have employed simple strategies to assign a pruning rate per-layer [19, 18, 20]. These empirical results suggest that the correct assignment of the compression rates is an unsolved important aspect of neural network inference acceleration.
* **Robust Inference:** On the other hand, multiple critical applications [20, 21] of deep neural networks require strong guarantees on the robustness of the predictive function w.r.t. random bit-flips caused by hardware failures. These attacks can give rise to incorrect predictions and lead to system failures that can be catastrophic in the case of critical systems. For example, as pinpointed in [10], it is possible to attack an hardware and induce one bit swap every 350ms on a stream of 500Mbit/s during data transfers in memory. Similarly, on DDR2 memory, hardware manufacturers have measured that on average 22696 errors occur every year. The baseline strategy [17] to detect these failures and discard the corresponding computations consists in performing said computations twice and ensuring that the results are identical. However, with the growing size of neural networks [20], such solution could lead to unsustainable energy consumption. Therefore, from a robustness standpoint, there is a growing need to not only be able to compare DNNs neurons or weights _inside_ a specific layer, but also to compare the layers _themselves_ to only induce redundant calculations to the most important parts of the networks.

In what follows, we investigate the challenge of layer-wise sensitivity assessment through the lens of attribution methods. Specifically, we adapt and benchmark a number of attribution methods for fine-grained weight relevance estimation, as well as a number of reduction methods to derive layer-wise importance criteria. In order to evaluate these criteria, we then implement two tests. First, we constructed a dataset of DNN models and their corresponding layers ranking obtained _via_ an exhaustive search. Second, we apply these methods in a straightforward manner to DNN compression and robustness to hardware failures in realistic scenarios. Our empirical results enabled us to draw conclusions on best practices regarding cross-layer sensitivity measurement.

## 2 Layer-wise sensitivity assessment

Let's consider a trained neural network \(f\) and each layers \(f_{l}\) with weights \(w_{l}\). In this study, we seek to rank the importance of the layers \((f_{1},...,f_{L})\) of \(f\) using only computations of \(f\) on a small, unlabelled, calibration set \(\mathcal{X}=(x_{1},...,x_{n})\) (with \(n=256\) in practice), akin to [20]. Let \(\epsilon_{l}\) denote a perturbation applied to each weight (or alternatively, to its activations) of layer \(f_{l}\), such that \(f^{\epsilon_{l}}\) is the function disturbed at layer \(l\) and \(f^{\epsilon_{l}}_{l}\) its \(l\)-th layer. With this convention, we define the importance of layer \(l\) as:

\[\mathcal{I}(f,\epsilon_{l})\triangleq-\mathbb{E}_{X_{\text{test}}}\left[||f^{ \epsilon_{l}}-f||\right] \tag{1}\]

where \(X_{\text{test}}\) is a test set. Intuitively, if a specific perturbation \(\epsilon_{l}\) applied to layer \(l\) causes large changes in the predictive function (as compared to applying the same kind of perturbation to other layers), then this layer is likely to be particularly important. Consequently, our goal is to find a criterion \(C\) which predicts the importance ranking of any layer \(l\) with respect to a perturbation \(\epsilon_{l}\) of said layer, _i.e._:

\[\forall i,j\quad C(f,\mathcal{X})_{i}\leq C(f,\mathcal{X})_{j} \Leftrightarrow\mathcal{I}(f,\epsilon_{i})\leq\mathcal{I}(f,\epsilon_{j}) \tag{2}\]

Simply put, computing \(C\) upon \(\mathcal{X}\) for each layer of \(f\) is sufficient to assess the importance of the layers w.r.t. a considered perturbation. Moreso, we are particularly interested in finding importance criteria \(C\) that assess layer-wise sensitivity in a general sense, and hence that do not depend on the nature of the perturbations \(\epsilon_{l}\). Such criteria can thus be calculated solely by evaluating statistics of \(f\) on the calibration set \(\mathcal{X}\). Furthermore, we propose to search for criteria that can be written as:

\[C(f,\mathcal{X})_{l}=\psi\circ(\phi(f,\mathcal{X})_{l}) \tag{3}\]

Where \(\phi\) denotes a function that extracts fine-grained sensitivity information (_i.e._, at the level of a layer's weight), and \(\psi\) reduces this information to an ordered set such as \(\mathbb{R}\) to derive a ranking for the layers. Below we first describe existing candidates for function \(\phi\).

### Fine-grained weight relevance estimation

Authors in [20] showed that assessing the relevance of a predictive function w.r.t. its weights is a problem that bears similarity with attribution techniques. Inspired by this, we adapt and benchmark several such techniques to design candidates for the weight relevance estimation function \(\phi\). Existing candidates include zero and first order criteria that use the weight and gradient values, the higher order methods, as well as the methods derived from the integrated gradients method [20], and lastly, recent black box techniques.

#### Zero and First Order Criteria

Weights:measuring the weights of a neural network in order to estimate their contribution to the predictive function has been widely studied in pruning [19]. The resulting function, denoted \(W\), offers the advantage of being fairly simple and can be computed without data. However, it does not account for inter-layer relationships.

\[W:(f,\mathcal{X})\rightarrow(w_{1},...,w_{L}) \tag{4}\]

Gradients:in GradCam [20], attribution is computed as the gradients of function \(f\) w.r.t. each pixel of the image or feature map. This can be adapted by computing the gradients of \(f\) w.r.t. each _weight_ instead:

\[\nabla:(f,\mathcal{X})\rightarrow\left(\mathbb{E}_{\mathcal{X}}\left[\frac{ \partial f}{\partial w_{1}}\right],...,\mathbb{E}_{\mathcal{X}}\left[\frac{ \partial f}{\partial w_{L}}\right]\right) \tag{5}\]

#### Weight \(\times\) gradients:

combining these two approaches [20, 21] usually leads to a slight improvement in practice.

\[\text{W}\times\nabla:(f,\mathcal{X})\rightarrow\left(\mathbb{E}_{\mathcal{X}} \left[w_{l}\times\frac{\partial f}{\partial w_{l}}\right]\right)_{l\in\{1,...,L\}} \tag{6}\]
### Higher Order Criterion

GradCam++:we also consider the most widely used high order attribution technique(Chattopadhay et al., 2018) and adapt it to weight values as follows

\[\text{GCam++:}\left(f,\mathcal{X}\right)\rightarrow\!\!\left(\mathbb{E}_{ \mathcal{X}}\!\!\left[\frac{\left(\frac{\partial f}{\partial w_{l}}\right)^{2} }{2\!\left(\frac{\partial f}{\partial w_{l}}\right)^{2}+w_{l}\!\left(\frac{ \partial f}{\partial w_{l}}\right)^{3}\right]}\right)_{l\in\{1,\dots,L\}} \tag{7}\]

Integrated Gradients CriteriaA known pitfall (Yvinec et al., 2022) of the previously mentioned gradient methods is that the measured importance is by definition local and do not hold when considering important modification of the weight values (such as, for instance, bringing this weight to \(0\)).

Integrated gradients (IG):To address this, authors in (Sundararajan, Taly, and Yan, 2017; Yvinec et al., 2022) propose to measure the gradients for several values of a considered input (or weight, in our case) on a path towards 0 (_i.e._ for a weight matrix \(w_{l}\) at layer \(l\), we consider \(\lambda.w_{l}\) with \(\lambda\in[0,1]\)). This so-called integrated gradients criterion can be written as:

\[\text{IG}:(f,\mathcal{X})\rightarrow\left(\mathbb{E}_{\mathcal{X}}\left[\sum _{\lambda\in[0;1]}\frac{\partial f}{\partial\lambda w_{l}}\right]\right)_{l\in \{1,\dots,L\}} \tag{8}\]

Guided integrated gradients (GIG)(Kapishnikov et al., 2021) is a refinement of the IG criterion that consists in shrinking, for each integrated gradient iteration, only the least important values, as defined by their gradient magnitudes \(||\frac{\partial f}{\partial\lambda w_{l}}||\).

Important direction guided integrated gradients (IDGI)(Yang, Wang, and Bilgic, 2023) is another recent improvement over the IG method, that consists in using the direction of the gradients, weighted by the difference between the outputs at each integrated gradients iteration.

Statistical CriteriaStatistical approaches improve first order criteria by estimating the sensitivity of \(f\) within the neighborhood of the weights, as defined by a small additive random noise \(\mathcal{N}\).

SmoothGrad(Smilkov et al., 2017) criterion, on the one hand, consists in computing the expected value of the gradient magnitude within this neighborhood:

\[\text{Smooth}\nabla:(f,\mathcal{X})\rightarrow\left(\mathbb{E}_{X_{\text{ inst}},\mathcal{N}}\left[\frac{\partial f}{\partial w_{l}+\mathcal{N}} \right]\right)_{l\in\{1,\dots,L\}} \tag{9}\]

VarGrad(Adebayo et al., 2018) criterion, on the other hand, measures the variance rather than the expectation over the weights neighborhood:

\[\text{Var}\nabla:(f,\mathcal{X})\rightarrow\left(\mathbb{V}_{X_{\text{ inst}},\mathcal{N}}\left[\frac{\partial f}{\partial w_{l}+\mathcal{N}} \right]\right)_{l\in\{1,\dots,L\}} \tag{10}\]

Black Box CriterionOriginally, black box attribution methods aimed at iteratively explaining the sensitivity of a DNN without accessing intermediate activations and weights, hence not using gradients, simply by zeroing out pixels and observing the induced accuracy drop. These methods have however fallen out of flavor due to high computational costs.

Hsic(Novello, Fel, and Vigouroux, 2022) is a recent attempt at designing faster black-box attribution methods, that consists in modelling the dependencies between images regions or patches and variations of the predictive function. We propose to adapt this method by grouping together weights belonging to different neurons, and denote this operation hsic:

\[\text{HSIC}:(f,\mathcal{X})\rightarrow\left(\mathbb{E}_{\mathcal{X}}\left[ \text{hsic}(w_{1})\right],...,\mathbb{E}_{\mathcal{X}}\left[\text{hsic}(w_{L}) \right]\right) \tag{11}\]

### Reduction Methods

In addition to the choice of a criterion for fine-grained weight relevance estimation, we also need to propose candidates for the reduction function \(\psi\) in Equation 3. This function needs to be a projection to an ordered set such as \(\mathbb{R}\). In our experiments, we studied several reduction options, the first and simplest of which is simply the average of the absolute values for each dimension of the computed fine-grained criterion. For instance, if we choose \(W\) as function \(\phi\), \(C(f,\mathcal{X})_{l}\) boils down to computing the mean absolute value among weights for each layer \(l\). Similarly, we investigate using percentiles as well as \(l_{1}\), \(l_{2}\) and \(l_{\infty}\) norms.

## 3 Experiments

Our empirical evaluation of the proposed criteria is three-fold. First, we propose a novel testbed for evaluating the relevance of each criterion to measure the layer-wise sensitivity, and rank the layers accordingly (equation 2). Second, we demonstrate the importance of layer-wise sensitivity assessment for designing stronger baselines for DNN compression (pruning and quantization) and robustness to hardware failures in realistic scenarios.

### Layer Importance Ranking

Synthetic dataset:to evaluate the criteria proposed in Section 2 for layer-wise sensitivity assessment, we constructed a dataset of models and their corresponding layers ranking ground truth. Specifically, we considered a simple binary classification task on Moon dataset (Pedregosa et al., 2011). We consider various DNN designs, including vanilla sequential networks (similar to VGG (Simonyan and Zisserman, 2014) architecture), networks that include skip-connection (_skip_) blocks (such as ResNets network family (He, Zhang et al., 2016), with and without stochastic depth (_skip_+_SD_) (Huang et al., 2016)) as well as transformer (_transfo_) architectures. For each of these architectural designs, we randomly sample the number of blocks or layers (uniformly between 2 and 6) as well as the layer width (uniformly between 8 and 128) for each layer. We trained each network using ADAM optimizer with learning rate \(0.01\) for 6 epochs. Every network reached approximately \(100\%\) test accuracy.
Layer importance ground truth generation:to generate the ground truth layer ranking, we apply a perturbation to the weights or activations and measure its impact on the final accuracy, _i.e._ we directly measure \(\mathcal{I}(f,\epsilon_{l})\) (Equation 1) induced by specific layer-wise perturbations \(\epsilon_{l}\). These perturbations were sampled from different distribution that simulate several scenarios. For each noise distribution, we varied the signal-to-noise ratio in order to evaluate the behavior of the model w.r.t. more or less difficult settings.

* Multiplicative impulse (pepper), denoted \(\mathcal{U}\) where a uniformly drawn random subset (corresponding to a proportion between 0 and \(100\%\)) of weights or activations are set to 0. This corresponds to unstructured (_i.e._ at the weight level) or structured (_i.e._ at the channel or neuron level) respectively.
* Additive Gaussian noise \(\mathcal{N}(0,\sigma)\), with \(\sigma\in]0,max(w\in w_{l})]\) applied to either weights or activations. This setting bears similarities with quantization process as small, additive perturbations are added to each weight or activation.
* Additive impulse or Dirac \(\mathcal{D}\) noise where a large perturbation (between 0 and \(max(w\in w_{l})\)) is applied to a proportion between 0 and \(100\%\) of uniformly drawn random weights or activations. This bears similarity with random bit swaps as a restricted set of weights or activations undergoes significant, non-zero changes.

In what follows, we evaluate the capacity of each criterion (as a combination of a fine-grained criterion and reduction method, both of which will be assessed separately) to guess the correct order (as indicated by \(\mathcal{I}(f,\epsilon_{l})\) for all above mentioned perturbations \(\epsilon_{l}\)): this setting is however very challenging as each order has to be retrieved exactly. Lastly, we ensured that the dataset was not biased _i.e._ that there is sufficient diversity in term of layer ranking for the different architectures and perturbations. These elements can be found in the dataset online description.

Empirical criteria validation and comparison:First, a comparison between the different weight relevance criteria is summarized in Table 1. First, on average it appears that zeroth and first order attribution techniques such as gradients (\(\nabla\)) and weight \(\times\) gradient (\(W\times\nabla\)) achieve the highest results on par with more sophisticated criterion like GradCam++ at lower computational cost. Second, when looking specifically at more complicated DNN architectures such as networks with skip-connections and transformers, we observe that the more naive techniques do not work well while more recent and complex techniques such as GradCam++, SmoothGrad, Vargrad and HSIC achieve the best results. However, no method truly achieves satisfactory results on transformers in this challenging setting.

Second, Table 2 shows results for the different reduction methods, averaged among all weight relevance criteria. Using \(l_{1}\) norm achieves the worst results as, contrary to the simple average reduction method, it does not normalize the importance measurement w.r.t. the layer width. Overall the best results are obtained using \(l_{\infty}\) norm, _i.e._ intuitively considering the largest sensitivity (_i.e._ fine-grained weight relevance) across all neurons in the layer.

Generally speaking, There is no all-around best fine-grained weight relevance method that works for all architectures and perturbations. However, we can highlight a few key takeaways:

* The \(\nabla\), \(W\times\nabla\), GradCam++ and IDGI methods are generally speaking solid candidates criteria for weight relevance estimation.
* Statistical criteria such as Var\(\nabla\) are good choices for residual architectures.
* GradCam++, Smooth\(\nabla\) and Var\(\nabla\) are the best for transformers though not as reliable as for other architectures.
* \(l_{\infty}\) norm is the best reduction method in all tested cases.

Bearing this in mind, in what follows, we apply layer-wise importance ranking to DNN compression as well as robust inference.

### Applications to DNN Compression

Experiments on pruning

From layer-wise relevance to pruning budgetization:Given a target pruning rate \(\gamma\) for DNN \(f\) with weights \(w\), we ought to remove \(\gamma\sum_{l}\Omega(w_{l})\), where \(\Omega(w_{l})\) denotes the number of weights in \(w_{l}\). We simply assign the per-layer pruning rates \(\gamma_{l}\) based on the weighting given by the importance score:

\[\gamma_{l}=\alpha*\gamma*C(f,\mathcal{X})_{l} \tag{12}\]

with \(\alpha\) a normalizing constant such that \(\gamma\sum_{l}\#w_{l}=\sum_{l}\gamma_{l}\#w_{l}\).

DNN pruning results:in the frame of TinyML perr challenge (community 2021) we use the proposed criteria to set the budget and prune a ResNet-8 network, removing \(20\%\) of neurons (_i.e._ structured pruning). Table 3 shows the accuracies of the models pruned using all the criteria introduced in Section 2 for layer-wise relevance estimation and budgeting (in rows, with \(l_{\infty}\) as the reduction method) and the same criteria for selecting neurons to prune within each layer (in columns). First, overall, we observe a wide discrepancy in the accuracies averaged among columns (last line) as well as among rows (last column): this suggests that, while the method for intra-layer neuron pruning, onto which the

Figure 1: Mixed precision assignment using IDGI (Yang, Wang, and Bilgic 2023) and PowerQuant (Yvinec et al. 2023).
community has been focusing so far, is very important, the inter-layer relevance and budgetization is also of paramount importance. Second, we observe that \(\nabla\) and \(Var\nabla\) performs the best overall for layer-wise relevance in that context. In particular, \(\nabla\) for layer-wise relevance assessment combined with IDGI as neuron pruning criterion offers the best performance, with GradCam++, \(Smooth\nabla\) and \(Var\nabla\) also working well in tandem with integrated gradient (IG, GIG, IDGI) neuron selection criteria, echoing the results from [22]. This confirms the results obtained in Section 3.1. Overall, these results motivate further research and distinction between inter and intra-layer importance evaluation criteria.

### Experiments on DNN quantization

#### From layer-wise relevance to budgeting layers for quantization:

given a ranking of layers \(f_{1},...,f_{L}\) we assign a layer-wise quantization bit-width based on a target average bit-width \(b\). For instance, if \(b=4\), we assign \(3\) bits to the least important third of the layers, \(5\) bits to the most important third and \(4\) to the remaining layers. Furthermore, as in [1] we quantize activations to 8 bits. Also, contrary to prior work [23, 1], we do not apply any arbitrary quantization bit-width to the first or last layer as our goal is to show the ability of the proposed criteria to properly rank layers without manual intervention or ad hoc heuristics.

#### Quantization results:

We implement the aforementioned mixed precision scheme (using the proposed criteria to set the bit-width budget for each layer) on a ResNet-50 pretrained on ImageNet and compare with a baseline constant precision quantization in four settings: W6/A8 using two state-of-the-art methods DFQ [19] and SQuant [10], as well as W4/A4 using PowerQuant [22] and Adaround [19]. Table 4 shows the test accuracies of the quantized networks. Once again, we observe significant discrepancies between the different criteria, with e.g. \(W\) providing results significantly below the baseline and \(\nabla\) and Var\(\nabla\) systematically improving over it. This shows that estimating layer relevance is crucial to the performance of mixed precision quantization. Overall, as in previous experiments, \(\nabla,W\times\nabla\), GradCam++ as well as Var\(\nabla\) perform well on this benchmark, with the addition of IDGI with PowerQuant.

Figure 1 illustrates the budget obtained using using IDGI [22] as layer-wise relevance criterion over PowerQuant [22] as the baseline quantization method in W4/A8. What's interesting is that our approach sets a high budget to the first layer of the network (as well as a decreasing bit-width budget trend towards the end of the network): this confirms the importance of assigning a larger bit-width to the first layer of the model, as already empirically remarked in [19, 19].

To sum it up, these results on DNN pruning and quantization suggest that assessing layer-wise relevance and using it to budgetize layers in a simple, straightforward way is already enough to improve existing pruning and quantization tech

\begin{table}
\begin{tabular}{|c|c|c|c|c||c|c|c|c|c|c|} \hline Archi & Noise & W & \(\nabla\) & W \(\times\nabla\) & **GCam++** & IG & GIG & IDGI & Smooth\(\nabla\) & Var\(\nabla\) & Hsic \\ \hline Vanilla & \(\mathcal{U}\) on W & 25 & 76 & 76 & 76 & 59 & 49 & 71 & 71 & 28 & 38 \\ Vanilla & \(\mathcal{N}\) on W & 42 & 68 & 68 & 68 & 59 & 56 & 66 & 66 & 36 & 47 \\ Vanilla & \(\mathcal{D}\) on W & 32 & 60 & 60 & 33 & 41 & 60 & 48 & 60 & 43 & 60 \\ \hline Vanilla & \(\mathcal{U}\) on act & 82 & 82 & 82 & 33 & 67 & 78 & 78 & 53 & 29 & 77 \\ Vanilla & \(\mathcal{N}\) on act & 82 & 82 & 82 & 33 & 67 & 78 & 78 & 53 & 29 & 63 \\ Vanilla & \(\mathcal{D}\) on act & 82 & 82 & 82 & 33 & 67 & 77 & 77 & 55 & 28 & 49 \\ \hline \hline skip & \(\mathcal{U}\) on W & 46 & 47 & 43 & 64 & 44 & 43 & 47 & 52 & 77 & 28 \\ skip & \(\mathcal{N}\) on W & 23 & 31 & 32 & 71 & 27 & 33 & 28 & 28 & 39 & 34 \\ skip & \(\mathcal{D}\) on W & 30 & 30 & 32 & 72 & 28 & 31 & 27 & 31 & 47 & 16 \\ \hline \hline skip+SD & \(\mathcal{U}\) on W & 42 & 42 & 42 & 25 & 41 & 42 & 42 & 17 & 10 & 22 \\ skip+SD & \(\mathcal{N}\) on W & 21 & 24 & 24 & 53 & 23 & 23 & 22 & 22 & 32 & 40 \\ skip+SD & \(\mathcal{D}\) on W & 20 & 21 & 17 & 47 & 19 & 19 & 20 & 20 & 29 & 12 \\ \hline \hline transfo & \(\mathcal{U}\) on W & 0 & 0 & 0 & 22 & 0 & 0 & 0 & 6 & 12 & 0 \\ transfo & \(\mathcal{N}\) on W & 1 & 1 & 1 & 10 & 0 & 1 & 1 & 18 & 12 & 7 \\ transfo & \(\mathcal{D}\) on W & 0 & 0 & 0 & 7 & 0 & 0 & 0 & 5 & 14 & 0 \\ \hline \end{tabular} \begin{tabular}{|c|c|c|c|c|c|c|c|c|c|} \hline avg & 35 & 43 & 43 & 43 & 36 & 39 & 40 & 37 & 31 & 33 \\ \hline \end{tabular} 
\begin{tabular}{|c|c|c|} \hline Reduction Method & Avg Score & & & & & & & \\ \hline average & 37.086 & & & & & & & \\ best percentile & 38.636 & & & & & & & \\ \(l_{1}\) & 36.109 & & & & & & & & \\ \(l_{2}\) & 38.234 & & & & & & & \\ \(l_{\infty}\) & **39.809** & & & & & & & \\ \hline \end{tabular}
\end{table}
Table 2: Average score (number of correct complete orderings) for each reduction method.
niques, which is remarkable considering that implementing successful post-training, few-shot mixed precision schemes is non-trivial in practice [23]. In what follows, we show that layer-wise ranking also find applications for robust inference.

### Robustness to Hardware Failure

Layer ranking and robust inference:in this section, we consider the problem of ensuring robustness w.r.t. random bit-swaps caused by hardware failures that can occur at inference time e.g. during memory transfers or weight loading. A common solution to overcome this is to verify the computations performed by a layer, _i.e._ by performing these computations twice and comparing the results 2. To limit the computation overhead induced by redundant computations, we verify only the most important layers, as budgeted by one of the

\begin{table}
\begin{tabular}{|c|c|} \hline \multicolumn{2}{|c|}{DFQ - ICCV ’19} \\ \hline method & quantization & accuracy \\ \hline W & & 73.282 \\ \hline \(\nabla\) & & 74.636 \\ \hline W \(\times\nabla\) & & 74.724 \\ \hline GCam++ & 74.546 \\ \hline IG & 74.710 \\ \hline IDGI & **74.816** \\ \hline SmoothV & & 65.284 \\ \hline VarV & & 74.284 \\ \hline HSIC & 73.902 \\ \hline - & W6/A8 & 73.904 \\ \hline - & full-precision & 75.000 \\ \hline \end{tabular} \begin{tabular}{|c|c|} \hline \multicolumn{2}{|c|}{SQuant - ICLR ’22} \\ \hline method & quantization & accuracy \\ \hline W & 74.462 \\ \hline W & 74.776 \\ \hline W\(\times\nabla\) & & 74.864 \\ \hline IG & 74.212 \\ \hline IDGI & 74.496 \\ \hline SmoothV & 74.616 \\ \hline VarV & 74.848 \\ \hline HSIC & 74.600 \\ \hline - & W6A8 & 74.596 \\ \hline - & full-precision & 75.000 \\ \hline \end{tabular} \begin{tabular}{|c|c|} \hline \multicolumn{2}{|c|}{SAQuant - ICLR ’22} \\ \hline method & quantization & accuracy \\ \hline W & 74.462 \\ \hline W & 74.776 \\ \hline W\(\times\nabla\) & 74.706 \\ \hline IG & 74.212 \\ \hline IDGI & 74.496 \\ \hline SmoothV & 74.616 \\ \hline VarV & 74.848 \\ \hline HSIC & 74.600 \\ \hline - & W6A8 & 74.596 \\ \hline - & full-precision & 75.000 \\ \hline \end{tabular} \begin{tabular}{|c|c|} \hline \multicolumn{2}{|c|}{SAQuant - ICLR ’22} \\ \hline method & quantization & accuracy \\ \hline W & 74.462 \\ \hline W & 74.776 \\ \hline W\(\times\nabla\) & 74.706 \\ \hline IG & 74.496 \\ \hline SmoothV & 74.616 \\ \hline VarV & 74.848 \\ \hline HSIC & 74.600 \\ \hline - & W6A8 & 74.596 \\ \hline - & full-precision & 75.000 \\ \hline \end{tabular} \begin{tabular}{|c|c|} \hline \multicolumn{2}{|c|}{SAQuant - ICLR ’22} \\ \hline method & quantization & accuracy \\ \hline W & 74.462 \\ \hline W & 74.776 \\ \hline W\(\times\nabla\) & 74.706 \\ \hline IG & 74.710 \\ \hline IDGI & 74.496 \\ \hline SmoothV & 74.616 \\ \hline VarV & 74.848 \\ \hline HSIC & 74.600 \\ \hline - & W6A8 & 74.596 \\ \hline - & full-precision & 75.000 \\ \hline \end{tabular} \begin{tabular}{|c|c|} \hline \multicolumn{2}{|c|}{SAQuant - ICLR ’22} \\ \hline method & quantization & accuracy \\ \hline W & 74.462 \\ \hline W & 74.776 \\ \hline W\(\times\nabla\) & 74.706 \\ \hline IG & 74.706 \\ \hline IG & 74.496 \\ \hline SmoothV & 74.616 \\ \hline VarV & 74.848 \\ \hline HSIC & 74.600 \\ \hline - & W6A8 & 74.596 \\ \hline - & full-precision & 75.000 \\ \hline \end{tabular} \begin{tabular}{|c|c|} \hline \multicolumn{2}{|c|}{SAQuant - ICLR ’22} \\ \hline method & quantization & accuracy \\ \hline W & 74.462 \\ \hline W & 74.776 \\ \hline W\(\times\nabla\) & 74.706 \\ \hline IG & 74.706 \\ \hline IG & 74.496 \\ \hline SmoothV & 74.616 \\ \hline VarV & 74.848 \\ \hline HSIC & 74.600 \\ \hline - & W6A8 & 74.596 \\ \hline - & full-precision & 75.000 \\ \hline \end{tabular} \begin{tabular}{|c|c|} \hline \multicolumn{2}{|c|}{SAQuant - ICLR ’22} \\ \hline method & quantization & accuracy \\ \hline W & 74.462 \\ \hline W & 74.776 \\ \hline W\(\times\nabla\) & 74.706 \\ \hline IG & 74.706 \\ \hline IG & 74.496 \\ \hline SmoothV & 74.616 \\ \hline VarV & 74.848 \\ \hline HSIC & 74.600 \\ \hline - & W6A8 & 74.596 \\ \hline - & full-precision & 75.000 \\ \hline \end{tabular} \begin{tabular}{|c|c|} \hline \multicolumn{2}{|c|}{SAQuant - ICLR ’22} \\ \hline method & quantization & accuracy \\ \hline W & 74.462 \\ \hline W & 74.776 \\ \hline W\(\times\nabla\) & 74.706 \\ \hline IG & 74.496 \\ \hline SmoothV & 74.616 \\ \hline VarV & 74.848 \\ \hline HSIC & 74.600 \\ \hline - & W6A8 & 74.596 \\ \hline - & full-precision & 75.000 \\ \hline \end{tabular} \begin{tabular}{|c|c|} \hline \multicolumn{2}{|c|}{SAQuant - ICLR ’22} \\ \hline method & quantization & accuracy \\ \hline W & 74.462 \\ \hline W & 74.776 \\ \hline W\(\times\nabla\) & 74.706 \\ \hline IG & 74.710 \\ \hline IG & 74.496 \\ \hline SmoothV & 74.616 \\ \hline VarV & 74.616 \\ \hline VarV & 74.848 \\ \hline HSIC & 74.600 \\ \hline - & W6A8 & 74.596 \\ \hline - & full-precision & 75.000 \\ \hline \end{tabular} \begin{tabular}{|c|c|} \hline \multicolumn{2}{|c|}{SAQuant - ICLR ’22} \\ \hline method & quantization & accuracy \\ \hline W & 74.462 \\ \hline W & 74.776 \\ \hline W\(\times\nabla\) & 74.706 \\ \hline IG & 74.496 \\ \hline SGamothV & 74.616 \\ \hline SGamothV & 74.616 \\ \hline \(\nabla\) VarV & 74.848 \\ \hline HSIC & 74.600 \\ \hline - & W6A8 & 74.596 \\ \hline - & full-precision & 75.000 \\ \hline \end{tabular} \begin{tabular}{|c|c|} \hline \multicolumn{2}{|c|}{SAQuant - ICLR ’22} \\ \hline method & quantization & accuracy \\ \hline W & 74.462 \\ \hline W & 74.776 \\ \hline W\(\times\nabla\) & 74.776 \\ \hline W\(\times\nabla\) & 74.706 \\ \hline IG & 74.706 \\ \hline IG & 74.496 \\ \hline \(\nabla\) SmoothV & 74.616 \\ \hline VarV & 74.848 \\ \hline HSIC & 74.800 \\ \hline HSIC & 74.600 \\ \hline - & W6A8 & 74.596 \\ \hline - & full-precision & 75.000 \\ \hline \end{tabular} \begin{tabular}{|c|c|} \hline \multicolumn{2}{|c|}{SAQuant - ICLR ’22} \\ \hline method & quantization & accuracy \\ \hline W & 74.462 \\ \hline W & 74.776 \\ \hline W\(\times\nabla\) & 74.776 \\ \hline W\(\times\nabla\) & 74.706 \\ \hline IG & 74.710 \\ \hline IG & 74.496 \\ \hline SmoothV & 74.616 \\ \hline VarV & 74.616 \\ \hline VarV & 74.848 \\ \hline HSIC & 74.600 \\ \hline - & W6A8 & 74.596 \\ \hline - & full-precision & 75.000 \\ \hline \end{tabular} 
\begin{tabular}{|c|c|} \hline \multicolumn{2}{|c|}{SAQuant - ICLR ’22} \\ \hline method & quantization & accuracy \\ \hline W & 74.626 \\ \hline W & 74.776 \\ \hline W\(\times\nabla\) & 74.
aforementioned criteria. Intuitively, if we rank the layers by importance and gradually increase the number of layers left unchecked under random bit swaps, the accuracy will decrease: in such a case, the slower it decreases, the better the ranking criterion for robust inference.

Robust inference results:In Figure 2, we report the evolution of the accuracy of the model under random bit-swaps with respect to the number of layers that remain unchecked (starting from 1). Similarly to what precedes, we observe the good performance of the \(W\times\nabla\) and GradCam++ criteria. However, in this case, \(\nabla\) is the least performing criterion, which can be attributed to the fact that gradients only measure local changes and specifically target the weights, while the bit-swaps are randomly applied to both weights and activations and can induce huge changes that break this locality principle. Conversely, other methods such as \(W\times\nabla\), GradCam++ and IDGI explicitly use information on both weights and gradients for a more relevant sensitivity assessment in this context. Nonetheless, we show that it is possible to preserve the accuracy without more that 1% accuracy loss while only checking 17 layers out of 52 which significantly reduces the redundancy overhead.

## 4 Conclusion

In this work, we study and pave the way for future research on layer-wise sensitivity of Deep Neural Nets. In particular, we stem from DNN attribution techniques for input sensitivity understanding, and adapt these to derive candidates for fine-grained sensitivity assessment of the whole predictive function w.r.t. particular weights in a layer. We also list a number of candidates reduction methods to integrate these fine-grained information into a layer-wise measurement. In order to evaluate these methods and future works, we designed a synthetic dataset of neural network architectures from sequential to more complex designs with an exhaustive study of the sensitivity of the predictive function w.r.t. perturbations applied to each layer as the ground truth. We experimentally demonstrated that it is possible to retrieve the correct layer ranking in this setting, as well as derive best practices for layer-wise sensitivity assessment. We then applied this framework for two practical applications: First, DNN compression _via_ pruning and quantization (mixed precision). In this setup, we show that, with little effort, we can improve the performance of these methods by straightforwardly translating cross-layer relevance measurements into budgets for compression. Second, for robust inference, we can apply our layer-wise sensitivity assessment to check only the most relevant layers and avoid random bit-swaps caused by hardware failures.

Limitations and future Work:First, one limitation of the proposed work is that the all the proposed candidates criteria fail to achieve satisfactory performance on transformers which are currently taking over NLP and computer vision domains. Perhaps the use of more complex and specific criteria shall be considered to solve this issue. Second, the ideas proposed in this paper could offer strong benefits towards more efficient DNN design: for instance, balancing per-layer importance and runtime cost (e.g. in a framework similar to [2]) could lead to more practical architectures, as well as pruning and quantization schemes. Furthermore, the study of intermediate levels of granularity (e.g. neurons, group of neurons or computational blocks) could lead to even more efficient inference as well as less costly monitoring of hardware failures.
