Giorgio Buttazzo

EAAI Journal 2026 Journal Article

The use of the Simplex architecture to enhance safety in deep-learning-powered autonomous systems

• Federico Nesti
• Niko Salamini
• Mauro Marinoni
• Giorgiomaria Cicero
• Gabriele Serra
• Alessandro Biondi
• Giorgio Buttazzo

Recently, the outstanding performance reached by neural networks in many tasks has led to their deployment in autonomous systems, such as robots and vehicles. However, neural networks are not yet trustworthy, being prone to different types of misbehavior, such as anomalous samples, distribution shifts, adversarial attacks, and other threats. Furthermore, frameworks for accelerating the inference of neural networks typically run on rich operating systems that are less predictable in terms of timing behavior and present larger surfaces for cyber-attacks. To address these issues, this paper presents a software architecture for enhancing safety, security, and predictability levels of learning-based autonomous systems. It leverages two isolated execution domains, one dedicated to the execution of neural networks under a rich operating system, which is deemed not trustworthy, and one responsible for running safety-critical functions, possibly under a different operating system capable of handling real-time constraints. Both domains are hosted on the same computing platform and isolated through a type-1 real-time hypervisor enabling fast and predictable inter-domain communication to exchange real-time data. The two domains cooperate to provide a fail-safe mechanism based on a safety monitor, which oversees the state of the system and switches to a simpler but safer backup module, hosted in the safety-critical domain, whenever its behavior is considered untrustworthy. The effectiveness of the proposed architecture is illustrated by a set of experiments performed on two control systems: a Furuta pendulum and a rover. The results confirm the utility of the fall-back mechanism in preventing faults due to the learning component.

EAAI Journal 2025 Journal Article

A hardware accelerator to support deep learning processor units in real-time image processing

• Edoardo Cittadini
• Mauro Marinoni
• Giorgio Buttazzo

Deep neural networks are becoming crucial in many cyber–physical systems involving complex perceptual tasks. For those embedded systems requiring real-time interactions with dynamic environments, as autonomous robots and drones, it is of paramount importance that such algorithms are efficiently executed onboard on properly designed hardware accelerators to meet the required performance specifications. In particular, some neural network architectures for object detection and tracking, as You Only Look Once (YOLO), include heavy computational stages that need to be executed before and after the model inference. Such stages are typically not incorporated in traditional accelerators and are executed on general-purpose processors, thus introducing a bottleneck in the overall processing pipeline. To overcome such a problem, this paper presents a general-purpose accelerator on a field-programmable gate array (FPGA) able to run pre-processing and post-processing operations typically required by vision tasks. The proposed solution has been tested in combination with a YOLO object detector accelerated on an Advanced Micro Devices (AMD) Xilinx Kria KR260 board mounting an UltraScale+ multiprocessor system-on-chip, achieving a significant improvement in terms of both timing performance and power consumption, and enabling onboard visual processing into drones. The proposed solution is able to boost the traditional object detection process by a factor of 4. 4, allowing the execution of the full processing pipeline at 60 frames per second (fps), versus 13. 6 fps reachable without the proposed accelerator. As a result, this work enables the use of high-speed cameras for developing more reactive systems that can respond to incoming events with lower latency.

AAAI Conference 2023 Conference Paper

Defending from Physically-Realizable Adversarial Attacks through Internal Over-Activation Analysis

• Giulio Rossolini
• Federico Nesti
• Fabio Brau
• Alessandro Biondi
• Giorgio Buttazzo

This work presents Z-Mask, an effective and deterministic strategy to improve the adversarial robustness of convolutional networks against physically-realizable adversarial attacks. The presented defense relies on specific Z-score analysis performed on the internal network features to detect and mask the pixels corresponding to adversarial objects in the input image. To this end, spatially contiguous activations are examined in shallow and deep layers to suggest potential adversarial regions. Such proposals are then aggregated through a multi-thresholding mechanism. The effectiveness of Z-Mask is evaluated with an extensive set of experiments carried out on models for semantic segmentation and object detection. The evaluation is performed with both digital patches added to the input images and printed patches in the real world. The results confirm that Z-Mask outperforms the state-of-the-art methods in terms of detection accuracy and overall performance of the networks under attack. Furthermore, Z-Mask preserves its robustness against defense-aware attacks, making it suitable for safe and secure AI applications.

AAAI Conference 2023 Conference Paper

Robust-by-Design Classification via Unitary-Gradient Neural Networks

• Fabio Brau
• Giulio Rossolini
• Alessandro Biondi
• Giorgio Buttazzo

The use of neural networks in safety-critical systems requires safe and robust models, due to the existence of adversarial attacks. Knowing the minimal adversarial perturbation of any input x, or, equivalently, knowing the distance of x from the classification boundary, allows evaluating the classification robustness, providing certifiable predictions. Unfortunately, state-of-the-art techniques for computing such a distance are computationally expensive and hence not suited for online applications. This work proposes a novel family of classifiers, namely Signed Distance Classifiers (SDCs), that, from a theoretical perspective, directly output the exact distance of x from the classification boundary, rather than a probability score (e.g., SoftMax). SDCs represent a family of robust-by-design classifiers. To practically address the theoretical requirements of an SDC, a novel network architecture named Unitary-Gradient Neural Network is presented. Experimental results show that the proposed architecture approximates a signed distance classifier, hence allowing an online certifiable classification of x at the cost of a single inference.

AIIM Journal 2008 Journal Article

Artificial consciousness: Hazardous questions (and answers)

• Giorgio Buttazzo

If human consciousness is the result of complex neural electro-chemical interactions occurring in the brain, the question of whether a machine can ever become self-aware could be a matter of time: the time necessary to fully understand the functional behavior of the brain structure, develop a mathematical model of it, and implement an artificial system capable of working according to such a model. This paper addresses several issues related to the possibility of developing a conscious artificial brain. A number of hazardous questions are posed to the reader, each addressing a specific technical or philosophical issue, which is discussed and developed in a form of a hazardous answer.

AIIM Journal 2008 Journal Article

Artificial consciousness: Theoretical and practical issues

• Giorgio Buttazzo
• Riccardo Manzotti