# Impact of Low-bitwidth Quantization on the Adversarial Robustness for Embedded Neural Networks

arXiv: https://arxiv.org/abs/1909.12741 · HTML: https://mlsanity.com/paper/1909.12741/

## Key facts

- Cited by 9 papers in the map (data through 14 Oct 2026).
- First posted on arXiv 27 Sep 2019.

## Built on by (most cited first, 9 of 9)

- [RobustMQ: Benchmarking Robustness of Quantized Models](https://mlsanity.com/paper/2308.02350/) (2023)
- [Improving Robustness Against Adversarial Attacks with Deeply Quantized Neural Networks](https://mlsanity.com/paper/2304.12829/) (2023)
- [Uncovering the Hidden Cost of Model Compression](https://mlsanity.com/paper/2308.14969/) (2023)
- [Adversarial Attacks on Machine Learning in Embedded and IoT Platforms](https://mlsanity.com/paper/2303.02214/) (2023)
- [When Side-Channel Attacks Break the Black-Box Property of Embedded Artificial Intelligence](https://mlsanity.com/paper/2311.14005/) (2023)
- [David and Goliath: An Empirical Evaluation of Attacks and Defenses for QNNs at the Deep Edge](https://mlsanity.com/paper/2404.05688/) (2024)
- [Properties that allow or prohibit transferability of adversarial attacks among quantized networks](https://mlsanity.com/paper/2405.09598/) (2024)
- [Quantitative Analysis of Deeply Quantized Tiny Neural Networks Robust to Adversarial Attacks](https://mlsanity.com/paper/2503.08973/) (2025)
- [AERIAL: Adversarial Evaluation of Robustness in Accuracy-Preserving Low-Precision EEG Decoders](https://mlsanity.com/paper/2609.30037/) (2026)

## Abstract (arXiv)

As the will to deploy neural networks models on embedded systems grows, and considering the related memory footprint and energy consumption issues, finding lighter solutions to store neural networks such as weight quantization and more efficient inference methods become major research topics. Parallel to that, adversarial machine learning has risen recently with an impressive and significant attention, unveiling some critical flaws of machine learning models, especially neural networks. In particular, perturbed inputs called adversarial examples have been shown to fool a model into making incorrect predictions. In this article, we investigate the adversarial robustness of quantized neural networks under different threat models for a classical supervised image classification task. We show that quantization does not offer any robust protection, results in severe form of gradient masking and advance some hypotheses to explain it. However, we experimentally observe poor transferability capacities which we explain by quantization value shift phenomenon and gradient misalignment and explore how these results can be exploited with an ensemble-based defense.