Fault Injection in Normalizing Flow Models for Space Applications

There are thousands of satellites in orbit around the Earth and in deep space, each performing different tasks crucial to sectors such as research, communication, Earth observation, and space science. Since the space environment differs significantly from Earth’s, the robustness and resilience of these spacecraft must be guaranteed. One of the main issues they face is radiation, which can compromise their lifespan or effectiveness. To prevent these problems, space applications use different systems designed to detect anomalies. Machine learning and artificial intelligence systems have been adopted to exploit their efficiency and decision-making capabilities. More specifically, modern anomaly detection techniques leverage neural networks to capture temporal dependencies and handle high-dimensional data effectively. However, to ensure that these solutions are robust and resilient in space, numerous tests must be conducted. This is where fault injection comes into play. In our study, we are applying a physics-informed (PI) real-valued non-volume preserving (real NVP) model, a type of normalizing flow model, for fault detection in space systems. This study begins with an analysis of the different hazards posed by the space environment, focusing on single-event upsets (SEUs) that cause malfunctions in systems. It then examines the normalizing flow network and the various proposed solutions for injection testing, such as PytorchFI and TensorFI, two injection frameworks. Following this, the study proposes a framework implemented in TensorFlow to test the network and evaluate the resilience of its components. Injections can be performed using two main fault functions, each presenting different network targets. Layer State injection involves introducing faults into the internal components of the network, such as weights and biases while leaving the input and output untouched. Layer Output Injection is where the injection is applied to the output of different layers, targeting different layers and activations functions. All those faults are generated through different operations like zeros, random, and bitflips modifying the value of a tensor, and they are done at different levels of ablation by selecting the percentage of values to inject and the depth of the layer. Results show that the most critical part of the network consists of the layers preceding the final output. As expected, bit flips in the most significant bits can lead to significantly worse performance and even system failure.