Certified Adversarial Robustness for Rate Encoded Spiking Neural Networks
Authors: Bhaskar Mukhoty
Hilal AlQuabeh
Giulia De Masi
Huan Xiong
Bin Gu
Venue: ICLR 2024 poster (2024)
Keywords: Spiking Neural Networks
Randomized Smoothing
Adversarial Learning
Certified Robustness
Primary area: unsupervised, self-supervised, semi-supervised, and supervised representation learning

Abstract: The spiking neural networks are inspired by the biological neurons that employ binary spikes to propagate information in the neural network. It has garnered considerable attention as the next-generation neural network, as the spiking activity simplifies the computation burden of the network to a large extent and is known for its low energy deployment enabled by specialized neuromorphic hardware. One popular technique to feed a static image to such a network is rate encoding, where each pixel is encoded into random binary spikes, following a Bernoulli distribution that uses the pixel intensity as bias. By establishing a novel connection between rate-encoding and randomized smoothing, we give the first provable robustness guarantee for spiking neural networks against adversarial perturbation of inputs bounded under $l_1$-norm. We introduce novel adversarial training algorithms for rate-encoded models that significantly improve the state-of-the-art empirical robust accuracy result. Experimental validation of the method is performed across various static image datasets, including CIFAR-10, CIFAR-100 and ImageNet-100. The code is available at \url{https://github.com/BhaskarMukhoty/CertifiedSNN}.

Published as a conference paper at ICLR 2024
CERTIFIED ADVERSARIAL ROBUSTNESS FOR RATE ENCODED SPIKING NEURAL NETWORKS
Bhaskar Mukhoty': :. Hilal AlQuabeh ,,, Giulia De Masi Huan Xiong! (44.Binn Gu Gu
Mohamed bin Zayed University of Artificial Intelligence, UAE
ARRC. Technology Innovation Institute, UAE
BioRobotics Institute, Sant' Anna School of Advanced Studies, Pisa, Italy
Harbin Institute of Technology, China
School of Artificial Intelligence, Jilin University, China
ABSTRACT
The spiking neural networks are inspired by the biological neurons that em- ploy binary spikes to propagate information in the neural network. It has gar- nered considerable attention as the next-generation neural network, as the spik- ing activity simplifies the computation burden of the network to large extent and is known for its low energy deployment enabled by specialized neuromor- phic hardware. One popular technique to feed a static image to such a net- work is rate encoding, where each pixel is encoded into random binary spikes, following a Bernoulli distribution that uses the pixel intensity as bias. By es- tablishing novel connection between rate-encoding and randomized smooth- ing, we give the first provable robustness guarantee for spiking neural networks against adversarial perturbation of inputs bounded under 4-rrr.. We intro- duce novel adversarial training algorithms for rate-encoded models that signifi- cantly improve the state-of-the- -frtte--rttttttte empirical robust accuracy result. Experimen- tal validation of the method is performed across various static image datasets, including CIFAR-10, CIFAR-100 and ImageNet-100. The code available https::/ htt/ggttuu...... thub com httm/Bhassaaaaukkhhaooo http://www.......eeeeeeeeeeeeeee
INTRODUCTION
Spiking neural networks (SNNs) are inspired by biological neurons that are significantly energy ef- ficient compared to the conventional artificial neurons used in state-of-the-art deep neural networks. One of the reasons behind higher energy consumption by ordinary artificial neurons is thought to be the dense floating point dot products required between neuronal outputs (floating point) and the corresponding connection weights (floating point) to compute the input next-layer neuron. The artificial spiking neurons instead produce binary outputs so that the floating- replaced by the accumulation of edge weights that are selected by active spikes, over fixed num- ber of steps. Thus, the task of computing forward-par -psss through a spiking neural network, when performed in specialized neuromorphic hardware (e.g.. IBM TrueNorth (Merolla al. 2014), Intel Loihi (Daiies et al. 2018) etc.), requires significantly less power consumption.
dot product can be
Similar to the neurons in recurrent neural networks, the spiking neurons possess temporal dimen- sion (a.k.a. inference latency) and maintain their present state as the membrane potential, which gets updated each time step after receiving the input in the form of weighted spikes. To process a static input, say x E IRd the network requires a strategy to convert it into temporal sequence of spikes. One standard encoding technique, called constant or direct encoding, repeats the value x, times, assuming it to be the input potential of the first-layer neurons, so that sequential spikes are generated as output of these neurons (Guo et al. 2021). Another technique called mate-encoding, inspired by
First co-author: (bhaskar.mukhoty, halquabeh] @ gmaal.ccom "ooresponniig author: (huan.xiong.man math, jsguhin gogail.comm

---

Published as a conference paper at ICLR 2024
biological evidence, intends to approximate input [o. 1] with the rate of spikes (Eshraghian et al. 2021). It generates T binary spikes {=) using a Bernoulli distribution, 2, ~ Ber(z), so
that the average number of spikes approximates the intensity of the pixel, 1 other technique, called fime-to-firttspikk, generates a single spike, where T E/= R z. Yet an- spike timing encodes the input pixel intensity (Johansson & Birznieks 2004). It can be noted that among the encoding techniques discussed here, only rate-encoding introduces a systematic noise with the input, while the rest supply the information precisely.
As spiking neural networks aspire to replace the conventional artificial neural networks (ANN) for energy efficiency, they become exposed to intelligent attacks. Adversarial perturbation of inputs one such attack, where an input image is altered with mild perturbation imperceptible to the human eye but fool the classifier to make incorrect prediction (Goodfellow et al.] (015). Defending against such attacks is imperative for many safety-critical applications. The work in (Sharmin al.) 2020) made some important experimental observations, where they found that the rate-encoded SNNs are ad adversarially robust compared to vanilla ANN classifiers and that the robust- ness of rate-encoding drops with the increase in inference latency, T. They further conjectured that the robustness may be due to the sparse spiking activity. However, (Kundu et al., 202I) observed that constant-encoded SNNs have lower adversarial robustness compared even to ANNs, but also have low spiking activity similar to rate-encoded SNNs. The present work is thus motivated by the need to provide a theoretical proof for the empirical observations of robustness.
We start by observing an intriguing connection between rate-encoding and the randomized smooth- ing framework (Lecuyer et al. 2019). Given base classifier, the randomized smoothing technique ensures that the smooth classifier obtained as the expected classifier, under noise to the input, is ad- versarially robust. That is, for a given input x E IR the smoothed classifier provides a radius within which any perturbation to the input will not result in change of output. As the guarantee originates from the noise introduced to the input, becomes a property the smooth classifier rather than the base classifier. Nevertheless, (Salman al. 2019) observed that is possible to adversarially train a smooth classifier for better empirical results.
Considering the rate-encoded network estimate of the smoothed clas- sifier to Bernoulli noise enables us to establish the first certified robustness result for SNNs. The observation that rate and constant encoded classifiers correspond respectively the smooth and base classifiers explains the superior adversarial robustness of rate encoding. The theoretical results further reveal that the certified radius suffers a drop with increasing latency, confirming the empir- ical observations. Table 3 reports the certified accuracies at different perturbation radii under the -norm for various datasets on state-of-the-ar architectures.
Our Contributions:
To further improve the adversarial robustness of the rate-encoded classifiers, we adopt adversarial training methods for rate-encoded classifiers. Since rate-encoding uses stochasticity to introduce Bernoulli noise, employ the well-known Straight Through Estimator (STE) (Bengio al.) 2013 Yin et al. 2019) for back- pack-propagation of gradicnts to the inputs. Experimental findings demonstrate that ad versarially trained rate-encoded networks outperform their vanilla counterpart and other state- of-the-art adversarial training algorithms (Ding et al. 2022)
2 BACKGROUND AND RELATED WORK
Spiking Neural Network consists of neurons, such as Leaky Integrate and Fire (LIF) (Gerstner et al. 2014), which is governed by first-order differential equations as continuous function of time. As the hardware required to train a network of LIF neurons operate in the discrete-ting time domain, the differential equations are discretized into the following recurrent equations:
@ = ("(( 1] + Σ Wis
x (t
1 1j
{1
if ( > wen otherwise,
1 []] = h(u - wen)
(1)
where, (1) denote the membrane potential of the i-th neuron on layer 1 at time-step f, and x denotes the corresponding binary spike produced whenever (000 exceeds the fixed membrane
[t]
2

---

Published as a conference paper at ICLR 2024
threshold Meh- The leaky constant 3 (0, 1] determines how the membrane potential will natu- rally decay on each step after receiving the input spikes from previous layer neurons weighted by the connection weight Waj.
Given a hard classifier h : R + V where y is the set of class labels, and input x, an adversarial perturbation tries to obtain a perturbation 6, such that, h(x + 6) + h (xx,, under the restriction | V c. One popular way to obtain such a perturbation is maximize the network loss over the input perturbations:
Adversarial Attacks:
max C(ho(x + 8), []
The Fast Gradient Sign Method (FGSM) (Goodfellow et al. 2015) attack attempts to increase the loss using a single gradient step with a I1 -constraint Illlsc-conttraintt on ö, where the gradient step is d == ôo + V/ with óg = 0. Applying the norm constraint on 5 and maximizing over 17 we obtain,
5= max clip(n (-,,
6 sign( VvLC
Often, the optimization is performed over several gradient ascent steps with II as the projection operation performed on the 1n-norm ball of radius e:
8,+1 II, (ō. + 1/Vo[(ho(x + 6,),
when the projection step is performed on a L -bal, the attack is popularly known as projected gradient descent (PGD) attack (Madry et al. 2018).
Empirical Defense: To defend classifier against adversarial attacks, several strategies are proposed that provide empirical robustness to ANNs (Papernot et al. 2016; Guo et al.) 2018). One popular defense strategy is adversarial training (Madry et al.] 2018). where a classifier is trained with respect to adversarial examples instead of clean ones. As an optimization to find the worst adversarial perturbation is NP-hard, such a strategy, though empirically adequate, does not guarantee that no adversarial perturbation can exist for given input. In the context of SNNs, to improve the empirical robustness of constant-encoded networks, (Kundu et al., (021) proposed to perturb the input image separately at different time steps instead of supplying the same image repeatedly, thus avoiding any computational burden due to adversarial training. More recently. (Ding et al.] (2022) proposed the adversarial training of constant encoded SNNs with additional regularization, called regularized adversarial training (RAT), which has been shown to provide higher robustness against adversarial attacks.
Certifiable Defense: Though empirical defenses are practical, they do not ensure the absence of an adversarial perturbation. In practice, the empirical defense strategies are often broken with more potent attacks. Given an input x, a classifier h is said to be provably robust under norm lp attacks if there exists a radius r within which any perturbation to x does not change the output of the classifier, i.e.
Vx ||x 1 X'Ipp S r we have, hu(x)= = -(())
Through bounding input/output of the activation and bound propagation, certified training strategies prove whether adversarial perturbation can exist within particular radius of any input. A recent method that adopts such existing literature (Xu et al. 2020 Wang et al. 2021 to SNNs is known as (S-IBP, S-CROWN) (Liang et al. 2022).
One of the effective strategies to provide a probabilistic certificate of ro- bustness in a classifier agnostic way is through randomized smoothing (Leeuyer et al. 2019), which gives provable robustness against adversarial attacks restricted under L or l2 norm. Randomized smoothing analyses the effect of adding input noise, such as Gaussian Laplacian, to a base clas- sifier. A classifier that gives class probabilities as output is known as a soft classifier, in contrast to a hard classifier that returns the predicted class label. Given a (soft) base classifier f RRd + P(Y)., the Gaussian smoothing constructs a smooth classifier Rd + P(')::
Randomized Smoothing:
g(x) (0.,N(0. <)) E
(6)
Given, a = arg max gxx) b = arg max g(x)y and let Pa, Ps be the corresponding proba- bilities with their statistical estimates, Pa S Pa and pb S pb. we have from (Cohen et al. 2019)
arg max g(x + 5)y =a a vey
4A
||0|| 2 < x (pa) Φ (ph))
(8)
3

---

Published as a conference paper at ICLR 2024
where, Φ- is the inverse Gaussian CDF. This implies that the smooth classifier, g, when deployed in the test time, can tolerate any adversarial attack with bounded norm of radius R 2 ( (pa)
4-1 (pt)). As probabilities and ps are difficult to compute analytically, they are estimated using Monte-Carlo (MC) simulations (Cohen et al. 2019 Salman et al. 2019), by evaluating the base classifier on multiple noisy input, I.e.,
(x)
m Σ ((,) where, 2, ~ Noise(x)
that the bounds Pa S Pa and pb Ps hold with high probability.
ADVERSARIAL ROBUSTNESS USING BERNOULLI SMOOTHING
3.1 RANDOMIZED SMOOTHING VIA BERNOULLI NOISE
propose to analyze the robustness properties of classifier that uses Bernoulli noise as the source of randomness. The input to the smoothed classifier can be image E [0, 1J3, where individual pixel values I; E [0, 1] are bounded. For Bernoulli smoothing, the individual pixel intensity 2; can be treated as the bias of Bernoulli random variable, 24+
E {0,13: 2; Ber(z;)
(10)
which in vector notation we write as, ~ Ber(x). The theorem below proves that we can construct provably robust classifier using Bernoulli noise, given a base classifier f.
Theorem Given a base classifier f [0, 1j + P(Y), we construct a smooth classifier g [0, 1jd + P(Y), such that,
g(x) = Ber [f()
(11)
Let Pa maxyey g(x) y. pa maxyta g(x) then,
Vg ||811 Pa ph
arg max g(x + + = a
(12)
2
VEy
As Monte-Carlo simulations estimate the probabilities Pa and ps. we expect to obtain bounds pa 2 Pa and Ps I ps with high probability. Since, Pa pb Pa pb.
Corollary 1. We have,
Pa
P6
VO
||0|
Pa
0.5
arg max g(x g 0) yEy
where in the last equality we used the upper bound, pb :
Pa.
To prove the Theorem[] we would require to use Definition along with lemma 2 and 3
Definition 1. A function h Id + R said to be L-Lisschitz w.et. to the norm ||-I]. if.
Vx,y E Rdd [/(x) h(y)) < L||x yll
Equivalently, if h differentiable, it is L-Lipschitz if and only if.
Vx, [Vh(x)]l
where I|-11+ Rd - R denotes the dual norm of ||-I| Rd + R. and it is defined as: ||yl|- s x
Lemma 2. Let h Rdd + PPY) be soft classifier and suppose it is L-Lisschitz with respect to each of the classes > h((x), and the norm |I-1]. For a given input x, if we have Pe max h(x) Pb maxyfa h(x))y. then,
48 ||
Pa Phh
arg max h(x + 8) yEy
(13)
2L
proof for the above can be found Lemma 2.1
Li 2019)
Lemma 3. For all , is 1 1-Lipschitz under || norm.
The proof of this lemma is given in the appendix.
4

---

Published as a conference paper at ICLR 2024
3.2
SMOOTHING AND ITS APPLICATION TO SNN
Armed with the proof that the smooth classifier is robust when single Bernoulli variable is used encode a pixel 24, let us now move the more practical situation of rate-encoding, where T- independent Bernoulli variables encode the input pixel. To fix the notation, let us consider constant encoding replicating the original input x R T times, creating temporal encoding that we denote using the notation [x]". To be consistent, let us denote base classifier fr [0, 1] + P(V) which accepts the input without the encoding, and further let us define, fr(x) fr([x]"), where the classifier fr [0. _] IP()) receives the replicated input. The notation of fr helps us demonstrate the definition of the corresponding smooth classifier, which receives replicated input [x]" encoded with independent Bernoulli noise. The smooth classifier gr be defined as:
[0, 1] + P())) can now
gr (x) = Ber (x.) (/T ((2), "2, zai)]
(14)
where, the smooth classifier gr uses independent Bernoulli variables 2, = (2i,1; Ei, ... F..T) E {0, 1)" to encode each input pixel x; E [0, 1]. The notation Ber (a;) describes the joint Bernoulli distribution of T variables, each having the same bias xq. We can now show,
Lemma 4. For all 9r (x), is -ip-s-iipschitz under I1-ll--norm.
We differ the proof to the appendix.
Theorem 5. For the smooth classifier gr defined as above, and Pa maxyyy ()) pb
maxy4a gr (x(x)y we have:
Pa Pb
V6 |00|1
arg max gr (x +) yEy
(15)
2T 3T
The proof of the theorem follows from lemma and It is interesting to note that Theorem D special case of 5 when T 1.
Corollary 2. Similar to corollary if we estimate Pa 2 Po with high probubility. then robustness
Pa-0.5 T3
guarantee on the perturbation ō |0012
holds with the same probability.
One may highlight that the certified radius drops quickly with T, which, we agree, can perhaps be improved with tighter bound on the Lipschitzness. Also, the largest ( fraddisss on which an input can obtain a robustness guarantee is upper bounded by 0.5, with T = 1. To put it in perspective, it allows 255 which, assuming 8-bit encoding of pixels, allows single pixel be changed by 127 or 127 pixels to be changed by 1. In comparing the results with Gaussian smoothing, one may find that their guarantee can hold for arbitrary radius. However, certificates for larger radii require significantly large number of MC simulations. Moreover, such results are impossible for discrete random variables such as Bernoulli.
a change of 127
3.3 PREDICTION AND CERTIFIED ROBUSTNESS
Estimation of the smooth classifier gr (x) requires MC simulations, which corresponds the eval- uation of the base classifier fr on rate-encoded input. To evaluate gr, we use the predict and certify functions described in Algorithm [ and 2 which are similar to that of (Cohen et al. 2019). with the exception that the Gaussian noise is replaced by multi-Ba Bertiulli noise. The sub-routine RateEncode (fr. x, m) evaluates the classifier fr after rate-encoding the input x. The process is repeated times, and the vector counds records the number of times a particular class is predicted. For proof that Algorithm bounded a. please refer to proposition (Cohen et al. 2019) that in turn uses results from (Hung & Fithian 2019). Algorithm describes the certify function, which works in two stages. First, using my MC simulations, it identifies the predicted class é., then find the lower bound Pa. it uses another m simulations. Proof that Algorithm makes an incorrect prediction with probability upper bounded by
makes an incorrect prediction &n # gT(x) with a probability upper
also be found in proposition 2 (Cohen et al., 2019).
Certified Test Accuracy: For each input x, the certify function either abstains or returns the pre- dicted class with a l radius, within which no adversarial example exists. Two conditions are verified
5

---

Published as a conference paper at ICLR 2024
each imput data point to obtain the certified test accuracy of model at given radius First, the predicted class should match the target label y; second, the radius returned by the certify function should be larger equal to The fraction of test data that satisfies both conditions without abstain- ing gives the certified test accuracy of a model. Observe that this is an estimate of the true certified test accuracy, we only have estimate of the smooth classifier gr- However, the estimate be improved by reducing the error rate a given Algorithms I and 2.
Algorithm predict Gr (x)
Algorithm 2 certify 9r around x
Require: fr, m,
Require: fr. mo,
counds <- RateEncode (fr, x.)
counts0 < RateEncode( ffrxx, x, ma)
&a, G. top indicies in counts
& + top index in counts0
couutts( Na: na counts[Ca], counts(ea]
courds <- RateeEncode ( x, m²)
BinomPValuc Ra + no, 0.5) I a then
Pa. < Lo
a)
return E..
If Pa 2 0.5 then
else
return prediction é., radius Ps 0.5
return abstain
73"-1
else
end if
return abstain
end
ADVERSARIAL TRAINING OF SNN CLASSIFIER
The notion of adversarial training can be seen as min-max problem, where the objective is first maximized with respect to bounded input perturbations and then minimized over the model param-
eters.
min S
max L(ho(x + 8).
(16)
X
Since exactly solving the inner maximization is often not possible, one of the most common ap- proaches of optimization is to alternately solve (approximately) the inner maximization with the help of adversarial attacks and then partially solve the outer minimization using methods such as mini-batch stochastic gradient descent (SGD). Each mini- SGD step would require obtaining the adversarial images + 8", computed with respect to the latest network weight that is updated after the SGD step.
As we would like to use the smooth classifier as the final classifier for robustness properties, it is natural choose he = 9r.9 o in adversarial training, which has been demonstrated as an effective approach for ANN (Salman et al.) 2019). However, there are two difficulties. First, we can only estimate the classifier y using 9. as given in equation / thus forcing us to use he = 9r..- For the computational efficiency of the adversarial training process, we use m = 1, a prediction of the smooth classifier, which corresponds to a single evaluation of the rate-encoded classifier. In constant encoding, performing adversarial training corresponds setting, he fr,e-
1 to obtain
Secondly, to carry out the adversarial attack for inner maximization, we need to compute the gradient of with respect the input, which, following the chain rule, requires back- tokk--rpppgating through the stochastic node that rate-encodes the input x. We employ the Straight Through Estimator (Hinton 2012 Bengio al. 2013). which estimates the gradient of stochastic node assuming there is an identity function in the backward pass of the node, enabling gradient-based attacks to find adversarial examples.
EXPERIMENTS
Competitors: We compare the performance of the proposed methods with state-oftthe-ar adver- sarial training algorithms in SNN. We refer to the models trained with un-perturbed data as CLEAN and when perturbed with Gaussian as GN. We generate adversarial images using FGSM and PGD attacks implemented using back-propagation through time (BPTT) with 255 and refer to the corresponding adversarially models by the attack name followed by the abbreviation of encoding, where (C) and (R) stands for constant and rate, respectively. To identify the attacks separately from the corresponding adversarial training algorithms, they are named small letters, e.g., the FGSM attack assuming rate-encoded model is referred to fgsm(R). Further, the training of adversarial

---

Published as a conference paper at ICLR 2024
BCC. CleaniR)
50
Accuracy
nob aec, Clean(l))
Accuracy 40
SCC, m- 10
FGSMONI
aestain, m-10
02
m=100
acc,
FOD JOC. PSDKR)
40
Sampling
Error
(a)
(b)
m2_arc, FGSMARL me1
50
190,0 FOSMIR), m-10
FSSMIC) ro0_acc,
Accuracy
70-
82
Clean(R)
30
40
FGSMIR)
10D acc. FGSMIR)
Temporal latency,
c/255
(c)
(d)
Figure 1: (a) shows the clean and robust accuracy of smooth classifiers improve with m and saturates quickly before m=20. The improvement is more significant for clean accuracy compared to robust accuracy. Fig. (b) shows the effect of error rate a on the prediction. For m 100, the prediction accuracy does not deteriorate
10-2, as helps avoid the high abstain rate suffered in the case of m = 10. Fig. (c) empirically confirms that with larger T, the clean accuracy of rate- encoded classifiers improves, while the robust accuracy drops. Fig. (d) compares robustness of the FGSM(R) model with its competitors, with radius of -nom attacks varying in the range 255 255 - Prediction of the FGSM(R) model with m offers superior robust accuracy for most 1 beats competitors in the higher range of e.
cases, while prediction using
models, when performed with regularization proposed by Regularized Adversarial Training (Ding et al. 2022). is identified by (RAT). We do not compare with (Kundu et al. 2021 as RAT offers superior adversarial robustness.
Dataset and Network Architecture: We use standard static image dataset such as CIFAR-10, CIFAR-100 (Krizhessyy al., 2009), SVHN (Netzer et al., 201T)) and ImageNet- (Deng al. 2009). They are temporally encoded using constant or rate encoding for the SNN classifier to be trained T 4. We use
(Fang et al. 2021) architecture for Imagenet-100 and VGGSNN architecture for other datasets. The VGGSNN Is based on VGG-11 and has the config- 2055500---55333---112222
uration et al. 2022).
011122233-5213-P2-1122222 51125222223-122-P2---- (Deng
Clean and Robust Accuracy: The clean accuracy of model its accuracy on uncorrupted test images. To evaluate the smooth classifier, we employ Algorithm) 1 for the prediction, which returns output conventional rate-encoded network when m 1, 10, = and study the effect of prediction
To demonstrate the smooth
classifier, also make predictions with separately, see [b). To avoid the scenario where the classifier abstains from prediction due to low statistical confidence, models. The empirical robust accuracy is the prediction accuracy when input images are corrupted with specific adversarial attacks. With the exception to Fig []) where we study the effect of attack
1, making the accuracies comparable to the constant
radius, the loc -nrm radius is set to e 255
5.1 COMPARISON EMPIRICAL ROBUST ACCURACY
Table compares the constant encoded network under different training algorithms with the rate- encoded counterpart. We highlight the minimum accuracy against all attacks for each training method, reported column-wise. The minimum robust accuracy represents the empirical robust-

---

Published as conference paper at ICLR 2024
T=4
CIFAR-10, Constant Encoding
CIFAR-100, Constant Encoding
Attack
CLEAN
GN
FGSM(C)
PGD(C)
CLEAN
GN
FGSM(C)
PGD(C)
clean
92.15
91.7
79.4
79.15
72.01
70.19
54.31
53.38
gn
90.62
91.25
78.84
78.28
66.46
69.64
53.87
53.02
fgsm(C)
10,68
15.95
48.86
48.56
3.19
5.35
26.05
26.49
Pgd(C)
0.1
1.24
39.75
41.65
0.04
0.45
21.12
22.61
fgsm(R)
81.01
85.13
77.33
75.69
45.4
59.23
49.63
50.81
Pgd(R)
85.14
85.07
77.42
75.29
55.82
59.73
49.57
50.69
T=4
CIFAR-IO 10, Constant Encoding. RAT
CIFAR- 100, Constant Encoding. RAT
Attack
CLEAN
GN
FGSM(C)
PGD(C)
CLEAN
GN
FGSM(C)
PGD(C)
clean
91.29
90.86
84.13
83.33
70.85
68.87
58.1
58.05
gn
88.71
90.72
83.09
82.95
66.05
69.82
57.93
57.34
fgsm(()
25.09
29.42
54.18
53.50
10.39
13.12
35.62
34.36
pgd(C)
0.49
3
42.76
44.44
0.34
1.71
27.1
29.89
fgsm(R)
84.62
87.55
81.68
80.90
53.15
64.34
56.31
55.08
Pgd(R)
87.41
87.96
81.96
80.58
62.88
64.93
55.85
54.52
T=4, m=1
CIFAR-10, Rate Encoding
CIFAR-100, Rate Encoding
Attack
CLEAN
GN
FGSM(R)
PGD(R)
CLEAN
GN
FGSM(R)
PGD(R)
clean
79.55
79.36
76.89
76.36
50.9
50.89
45.85
46.98
gn
78.62
79.07
76.39
76.77
50.43
50.77
46.4
46.05
fgsm(C)
75.57
75.34
72.03
73.99
48.36
49.12
45.16
45.15
Pgd(C)
76.23
76.06
73.03
78.87
47.94
48.95
45.74
45.38
fgsm(R)
43.69
43.31
55.05
55.27
25.75
24.84
31.64
32.47
pgd(R)
37.37
37.4
51.63
51.59
21.98
20.72
28.56
29.99
T=4, 1=
CIFAR-10 10, Rate Encoding
CIFAR-100, Rate Encoding
Attack
CLEAN
GN
FGSM(R)
PGD(R)
CLEAN
GN
FGSM(R)
PGD(R)
clean
83.22
83.5
80.15
80.54
55.27
55.83
49.58
50.51
gn
83.54
83.41
80.33
80.41
54.82
55.2
49.84
50.15
fgsm(C)
80.29
79.94
76.41
78.22
52.76
53.6
49.19
48.3
Pgd(C)
80.6
80.05
76.73
78.59
52.54
53.73
49.07
48.8
fgsm(R)
44.93
44.89
57.89
57.85
27.61
26.32
33.46
33.88
Pgd(R)
37.74
37.58
52.27
53.08
22.79
21.5
30.03
31.05
Table 1: Experiments on CIFAR-10 and CIFAR-100 datasets demonstrate that under the strongest attacks, rate encoded classifiers offer superior robustness compared the constant encoded coun- terpart. The columns stands for different training (adversarial) procedure, while the rows stands for different adversarial attacks.
ness model when subjected to arbitrary attack. found that for constant-encoded models, Pgd(C) attack gives minimum accuracy, while for the rate-encoded models, pgd(R) is the strongest. can be observed that RAT improves the robustness of the constant encoded models. However, rate-encoded models significantly improve the robust accuracy compared RAT. For example, in CIFAR-10, CLEAN(() 37% more robust than CLEAN(()), while under adversarial training, FGSM(R), PGD(R) improve the minimum robust accuracy by 9% and 18%, respectively, com- pared to RAT. For CIFAR-100, the improvement in robust accuracy is 22% for CLEAN(R), 3% for FGSM(R), and 13% for PGD(R), considering predictions using 10.
A common criticism of the rate-encoded model is that offers lower accuracy on clean images than constant encoding. [[ a) shows on CIFAR-10 10 that the prediction of rate-encoded models can significantly improve with the better estimation of the smooth model at the test time. The same observation can be made from Table where shifting from m=l by 4-5 % across all the rate-encoded models. A further defense for rate-encoded models comes from Fig d), where we vary radius the -attack between 255 25 where 0, corresponds to clean images. It can be observed that constant encoded models quickly lose accuracy even for small perturbations, showing the relevance of rate-encoded models when there a possibility of attack. [() studies the effect of latency robustness. It separately trains the CLEAN(R) and FGSM(R) models at various T {4,6 6, 8, 10} and measures their clean and robust accuracy (against pgd(R)). The results show that although clean accuracy improves with latency, the robust accuracy
improves the clean accuracy
8

---

Published as a conference paper at ICLR 2024
ImageNet-100, T=4
clean
gn
fgsm(()
pgd(C)
fgsm(()
pgd(R)
CLEAN(C)
72.02
71.78
4.98
0.02
51.18
61.1
CLEAN(C) +RAT
65.14
63.66
7.48
0.06
51.1
57.22
CLEAN(R), m=1
62.16
52.3
55.44
19.88
12.06
CLEAN(R), m=10
64.18
64.1
58.42
60.24
28.04
19.86
SVHN, T=4
clean
gn
fgsm(C)
pgd(C)
fgsm(R)
pgd(R)
CLEAN(C)
95.36
94.71
26.6
3.11
65.61
70.56
CLEAN(C) +RAT
96.17
95.5
40.43
4.03
80.33
78.44
CLEAN(R), m=1
86.09
85.67
77.49
77.82
43.68
37.44
CLEAN(R), m=10
91.7
91.44
84.51
84.87
46.58
38.79
Table 2: Experiments on ImageNet-100 and SVHN show that rate-encoded models can offer rea- sonable clean accuracy and significantly higher robust accuracy against the strongest attacks.
T=4
CIFAR-10, Rate Encoding
CIFAR-100, Rate Encoding
r * 108
0.1
0.2
0.3
0.4
0.45
0.1
0.2
0.3
0.4
0.45
CLEAN(R)
72.48
67.62
60.29
49.71
37.01
41.8
37.62
32.02
25.36
18.49
PGD(R)
73.23
68.5
61.69
51.58
38.78
41.48
37.31
32.15
25.65
18.68
ImageNet- 100, Rate Encoding
SVHN, Rate Encoding
CLEAN(R)
51.38
46.7
41.04
33.54
24.52
81.67
76.85
69.15
56.67
41.18
Table 3: presents the certified test accuracy for rate-encoded SNN models at different 4 norm radii for various static datasets.
drops, confirming our theoretical results. In the appendix, we provide full results for T 8 to further confirm the same.
Results on other Datasets: We further compare the robustness of constant vs. rate-encoding on larger datasets. Often, for large datasets such as ImageNet, adversarial training can be computa- tionally challenging due to the size of the dataset, which gets multiplied by the temporal dimen- sion of SNN. However, rate-encoding encoded classifiers trained with clean images offer robustness properties and are computationally easier to train. Table T provides empirical robustness results for Imagenet-100 and SVHN dataset, where CLEAN(R) obtains significantly higher robust accuracy than other feasible methods.
5.2 PROVABLE ROBUSTNESS VIA CERTIFIED ACCURACY
We provide the empirical certified test accuracy of the rate-encoded smooth classifier for perturba- tion bounded under 1 noom radius. As given in Table the radius varies between
0.1
0.5
L(T)
L(T)
with L(T) = T3""1 representing the Lipschitzness of the smooth classifier as in Lemma We use the certify function with parameters mg 10, m 100, and of the ente-encoded models. The certified radii obtained are not entirely vacuous. For example, at
0.01 find the certified accuracy
= have L(T)= 108, that we can obtain a certified accuracy the radius 0.45 which is 108
larger than 255 Assuming 8-bit pixels allows single pixel in the image to changed by 1. There also remains scope to obtain the certificate at lower latencies, highlighted in the section 3.2 Fig.
1
shows a comparison between certified accuracy and robust accuracy under I attack.
DISCUSSIONS
The present work provides theoretical grounding for the empirical observations of the adversarial robustness the rate-encoded classifiers. Consequently, we improve the classifier's prediction at test time by better estimating the corresponding smooth classifier. Further, robustness of the rate-encoded classifiers by adversarial training, which uses a novel implementation of gradient- gradient-based attacks. The future scope for research remains open to reduce the gap between empirical and theoretical results on the shrinkage of the certified radius with latency and other norm- based attacks.
improve the empirical

---

Published as a conference paper at ICLR 2024
ACKNOWLEDGEMENT
This work is part of the research project "ENERGY-BASED PROBING FOR SPIKING NEURAL NETWORKS" performed at Mohamed bin Zayed University of Artificial Intelligence (MBZUAD), in collaboration with Technology Innovation Institute (TI)) (Contract No. TIIARRCC2203/22221,, We thank Velibor Bojkovic for proofreading the theorems.
REFERENCES
Yoshua Bengio, Nicholas Léonard, and Aaron Courville. Estimating or propagating gradients through stochastic neurons for conditional computation. arXiv preprint arXiv:1308.34:33 2013.
Tong Bu, Wei Fang, Jianhao Ding, PengLin Dai, Zhaofei Yu, and Tiejun Huang. Optimal ann- snn conversion for high-accuracy and ultra-low-latees low-latency spiking neural networks. In International Conference on Learning Representations, 2021.
Tong Bu, Jianhao Ding, Zecheng Hao, and Zhaofei Yu. Rate gradient approximation attack threats deep spiking neural networks. In Proceedings of the IEEE/CVF Conference on Computer Vision and Puttern Recognition, pp. 7896-7906, 2023.
Jeremy Cohen, Elan Rosenfeld, and Zico Kolter. Certified adversarial robustness via randomized smoothing. In International Conference on Machine Learning, pp. 1310-1320. PMLR, 2019.
Francesco Croce and Matthias Hein. Mind the box: lı-apgd for sparse adversarial attacks on image classifiers. JCML, 2021.
Mike Davies, Narayan Srinivasa, Tsung- Lin, Gautham Chinya, Yongqiang Cao, Sri Harsha Choday, Georgios Dimou, Prasad Joshi, Nabil Imam, Shweta Jain, al. Loihi: A neuromorphic manycore processor with on-chip learning. leee Micro, 38(1):82-99, 2018.
Jia Deng, Wei Dong, Richard Socher, Li-Jia Li, Kai Li, and Li Fei-Fei. Imagenet: A large-scale hi- erarchical image database. In 2009 IEEE conference on computer vision and pattern recognition, pp. 248-255, Icee, 2009.
Shikuang Deng, Yuhang Li, Shanghang Zhang, and Shi Gu. Temporal efficient training of spiking neural network via gradient re- re-weighting. arXiv preprint arXiv:2202. 19446 2022.
Jianhao Ding, Tong Bu, Zhaofei Yu, Tiejun Huang, and Jian Liu. Snn-rat: cabustness-enhancee spiking neural network through regularized adversarial training. Advances in Neural Information Processing Systems, 35:24780-2444 24793, 2022.
Jason K Eshraghian, Max Ward, Emre Neftei, Xinxin Wang, Gregor Lenz, Girish Dwivedi, Mo- hammed Bennamoun, Doo Scok Jeong, and Wei D Lu. Training spiking neural networks using lessons from deep learning. arXiv preprint arXiv:2109. 12894, 2021.
Wei Fang, Zhaofei Yu, Yanqi Chen, Tiejun Huang, Timothée Masquelier, and Yonghong Tian. Deep residual learning in spiking neural networks. Advances in Neural Information Processing Systems, 14:21056-21069, 2021.
Wulfram Gerstner, Wernrr M Kistler, Richard Naud, and Liam Paninski. Neuronal dynamics: From single neurons to networks and models of cognition. Cambridge University Press, 2014.
Ian J Goodfellow, Jonathon Shiens, and Christian Szegedy. Explaining and harnessing adversarial examples. stat, 1050:20, 2015.
Chuan Guo, Mayank Rana, Moustapha Cisse, and Laurens van der Maaten. Countering adversarial images using input transformations. In International Conference on Learning Representations, 2018.
Wenzhe Guo, Mohammed E Fouda, Ahmed M Eltawil, and Khaled Nabil Salama. Neural coding in spiking neural networks: A comparative study for robust neuromorphic systems. Frontiers in Neuroxcience, 15:638474, 2021.
10

---

Published as a conference paper at ICLR 2024
Geofry Hinton. Neural networks for machine learning, 2012. Coursera Video Lectures.
Kenneth Hung and William Fithian. Rank verification for exponential families. The Annals of Statistics, 47(2):758-782, 2019.
Roland S Johansson and Ingvars Birznieks. First spikes in ensembles of human tactile afferents code complex spatial fingertip events. Nature neuroscience, 7(2):170-177, 2004.
Alex Krizhevsky, Geoffrey Hinton, et al. Learning multiple layers of features from tiny images. 2009.
Souvik Kundu, Massoud Pedram, and Peter Beerel. Hire-snm: Harnessing the inherent robustness of energy-efficient deep spiking neural networks by training with crafted input noise. In Proceed- ings of the IEEE/CVF International Conference on Computer Vision, pp. 5209-5218, 2021.
Mathias Lecuyer, Vaggelis Atlidakis, Roxana Geambasu, Daniel Hsu, and Suman Jana. Certified robustness to adversarial examples with differential privacy. In 2019 IEEE symposium on security and privacy (SP), pp. 656-672. IEEE, 2019.
Jerry Li. Lecture 14: Certified defenses ii:: Randomized smoothing. attps://jerry: pddf 2019. Accessed: 19-09-2023.
Ling Liang, Kaidi Xu, Xing Hu, Lei Deng, and Yuan Xie. Toward robust spiking neural network against adversarial perturbation. Advances in Neural Information Processing Systems, 35:10244- 10256, 2022.
Aleksander Madry, Aleksandar Makelov, Ludwig Schmidt, Dimitris Tsipras, and Adrian Vladu. Towards deep learning models resistant to adversarial attacks. In International Conference on Learning Representations, 2018.
Paul Merolla, John V Arthur, Rodrigo Alvarez-Icaza, Andrew S Cassidy, Jun Sawada, Filipp Akopyan, Bryan L Jackson, Nabil Imam, Chen Guo, Yutaka Nakamura, et al. A million spiking- neuron integrated circuit with a scalable communication network and interface. Science, 345 (6197):668-6) -63,, 2014.
Yuval Netzer, Tao Wang, Adam Coates, Alessandro Bissacco, Bo Wu, and Andrew Y Ng. Reading digits in natural images with unsupervised feature learning. 2011.
Nicolas Papernot, Patrick McDaniel, Xi Wu, Somesh Jha, and Ananthram Swami. Distillation defense to adversarial perturbations against deep neural networks. In 2016 IEEE symposium on security and privacy (SP), pp. 597. IEEE, 2016.
Hadi Salman, Jerry Li, Ilya Razenshteyn, Pengchuan Zhang, Huan Zhang, Sebastien Bubeck, and Greg Yang. Provably robust deep learning via adversarially trained smoothed classifiers. Ad- vances in Neural Information Processing Systems, 32, 2019.
Saima Sharmin, Nitin Rathi, Priyadarshini Panda, and Kaushik Roy. Inherent adversarial robustness of deep spiking neural networks: Effects of discrete input encoding and non-linear activations. In Computer Vision-ECCV 2020: 16th European Conference, Glasgow, UK, August 23-28, 2020, Proceedings. Part XXIX 16, pp. 399 414. Springer, 2020.
Shiqi Wang, Huan Zhang, Kaidi Xu, Xue Lin, Suman Jana, Cho-Jui Hsich, and Zico Kolter. Beta-crown: Efficient bound propagation with per-neuron split constraints for neural network robustness verification. Advances in Neural Information Processing Systems, 34:29909-29921, 2021.
Yujie Wu, Lei Deng, Guoqi Li, Jun Zhu, and Luping Shi. Spatio-tempont backpropagation for training high-performance spiking neural networks. Frontiers in neuroscience, 12:331, 2018.
Kaidi Xu. Huan Zhang, Shiqi Wang, Yihan Wang, Suman Jana, Xue Lin, and Cho-Jui Hsich. Fast and complete: Enabling complete neural network verification with rapid and massively parallel incomplete verifiers. International Conference on Learning Representations, 2020.
Penghang Yin, Jiancheng Lyu, Shuai Zhang, Stanley Osher, Yingyong Qi, and Jack Xin. Under- standing straight- estimator in training activation quantized neural nets. arXiv preprint arXiv: 1903: 05662,, 2019.
11

---

Published as a conference paper at ICLR 2024
A APPENDIX
Lemma 3. For all g(x)y is 1- 1-Lipschitz under |1-I| normm
Proof.
g(x)y = BenwBertz)) 22, ,-))).
E
f((x)
222
2d })
1)
IP 2
x21)
E0,0)
Σ
20
22 ,-. ""..,,,,,
(x:
(1 - 11;)
E(0,11
E
f((1, 22 .
1 (x;)² 2 (1 1--20 xx,) 1-.,)--20
Σ
S( 20 ,..,,
,2 1) (1 x1 II (x)) (2) (1 x.)) ==,))-=4
##
Let us now take partial derivative of g(-), w.r.t. Fτ, which can be generalized to other co-ordinates in similar fashion:
0gu 0x
E
(S((L, , ".. 22 ,,,,,,) f((0, 20
24 2))
(x.) 10 (1 -=/0-=$0
2
191
Σ
II
(x=))((11- (1- [diff. of probabilities is less than 1]
#1 1 E(0.1) 191
=1
[using marginal probability]
Thus, have, 1VVa(-) I 1 which following the Definition I ensures 9(:), is 1 1-Lipschitz under norm.
Lemma 4. For all (x)y is T 113T-1-Liine -Lipschitz under I1-Il1
Proof.
(x()) Eer, ((,) 22, ",,"",,aa)) ,,,))]
Σ 7(121,2,.... 22)) IIII ((a.))))
2,(00.1T
Xm Am
Σ
f(l(2),)
22, za))
21 21) t=1
IIII
P(,,d.)))
1=1
Now, let us denote, en (22, 2a) = Σ E f((()) (((())22... ...
za))y, the sum of f for different possible values that z can assume, with the restriction that there are I's out of T binary values. Thus,
12

---

Published as a conference paper at ICLR 2024
0 0. co(22. zd) = F(((0,0, 0), 22. zally S (0)
11
0 0. 01 (Z2, T1 .zd) = f(((1,), -.. 0), 22. zd)ly + f((10,0. 0.
1), 22. ... ,zd)l 1
, 0 S cT(Zz, .. .Za)= = f(((1,1, 1,... 22, 22. ... .2))ly 1 T
T
and, P(z2.- :. .ta)
P(za)()))
f=1t=1
So that, we may write after expanding the expectation over the values that variable 21 may take:
T
gr(x)= =
E
f(l(zi,) "21,,,"""",,,,,... 22. -za)
II
ri 11 (1
=1)² -1. P(x2, .. xd)
(0,10
Σ
Σ (1 - -
((.17) k=
Let us denote h: [0, 1] + R. as the function
T
T-k
(T j (²=h)(= (-x)
T k)
(x)) = Σ
caa (1
xx) T- Σ
Ch.t Σ
0=
k=
1=0
T T- k
T -
x (-13
Ck
x.
j
0= 1=0
(T-m- m11
Cm
x (-1)t-m
[after re-indexing]
1 m
1=0 m=0
(hr(x)
(T- m
lx
1-
Σ Cm
(-1)l-m
dx
1 -
m=0
(-1+)
lad
(-1)²
[setting.j=llm]
1=1
1=0
1/2
T
(T (T- (T-1+2)
T
lad
Σ
as, S S
1 2j
2j
1=0
1/2
T!
Σ
la 1-1
(1- (T
5=
1/2
Σ to (1')
{1)
[1 - 22)!
j=0
Σ 1a!t
(1)+--
(T-1)
(2x)
T(1 + 2x T33-1
<
1-
1=1
13

---

Published as a conference paper at ICLR 2024
Taking partial derivative of g w.r.t 21,
Øgr
Σ
[11(1)))
P(a2. "1
dr1
((,11,
T3
Σ P(22. IId
(1..1100111
T3
Thus, we have. VVVll & T3 under norm ||-I|1.
which following the Definition
ensures is 1173"----isssieee Lipschitz
B ADDITIONAL EXPERIMENTS
Comparison at higher latency Table comparre the constant encoded SNN under different training algorithms with their rate encoded counterpart at T 8. Similar Table[ T 4, adversarially trained rate-encoding demonstrates superior accuracy compared to their constant encoded counter- parts. Also, one observe that for most improved when compared to 'T' 4, while the robust accuracy has dropped. Our theoretical find- ings for rate-encoded models also confirm that rate-encoded classifiers' robustness decreases with higher latency.
in rate-encoded models, the clean accuracy has
T=8
CIFAR-10, Constant Encoding
CIFAR-100, Constant Encoding
Attack
CLEAN
GN
FGSM(C)
PGD(C)
CLEAN
GN
FGSM(C)
PGD(C)
clean
90.29
92.28
81.71
82.69
73
71.2
55.21
56.96
gn
88.93
91.85
81.26
82.56
68.67
71
53.04
56.47
fgsm(C)
8,45
18.04
48.79
46.33
4.17
6.47
32.39
25.99
Pgd(C)
0.07
1.11
39.41
41.04
0.1
0.67
17.37
23.36
fgsm(R)
71.03
84.77
79.17
80.43
49.36
62.03
52.06
53.39
Pgd(R)
75.54
84.49
79.48
81.35
61.36
62.84
51.01
54.55
T=8,m=1
CIFAR-10, Rate Finending
CIFAR-100, Rate Encoding
Attack
CLEAN
GN
FGSM(R)
PGD(R)
CLEAN
GN
FGSM(R)
PGD(R)
clean
83.77
83.57
80.43
80.64
54.26
48.73
48.78
50.85
gn
76.94
82.86
80.03
79.76
53.34
48.25
48.58
50.41
[gsm(C)
70.49
78.85
76.63
77.05
51.36
42.6
47.87
48.34
pgd(C)
71.76
80.11
77.8
77.86
50.9
44.1
47.46
49.22
fgsm(R) 36.05
41.01
54.42
52.02
24.95
17.74
33.51
28.87
Pgd(R) 32.48
31.82
49.06
51.29
21.23
14.13
33.41
28.31
Table 4: Experiments on CIFAR-I0 and CIFAR-100 datasets, with T demonstrate that under the strongest attacks, rate encoded classifiers offer superior robustness compared to the constant encoded counterpart. The columns stands for different training (adversarial) procedure, while the rows stands for different adversarial attacks.
Comparison of empirical robust accuracy: We further compare the test fgsm/pgd attacks im- plemented with different back-propagation techniques such as, Back Propagation Through Time (BPTT) (Wu et al., 2018). Backward Pass Through Rate (BPTR) (Ding al.) 2022), Rate Gradi- ent Attack (RGA) (Bu et al.) 2023), and report the corresponding accuracies in the respective order. Table5 shows the experiments conducted on CIFAR- 10, where BPTT produces the strongest attacks.
Comparison under Gaussian noise attack The results in Table I with gn attack uses Gaussian perturbation: x 6, where 8 ~ NN, o²), with o = 8/255 zs 0.03I. The superior results obtained there for the constant encoded models against Gaussian noise attacks can quickly break down increase the strength the attacks, as computed in Tabld For example, at = 0.1, CLEAN(R) with m=10, provides 21.77% higher accuracy than CLEAN(C)RAT.
14

---

Published as a conference paper at ICLR 2024
T=4
CIFAR-10, Constant Encoding
Attack
CLEAN
GN
FGSM(C)
PGD(C)
clean
92.15
91.7
79,4
79.15
gn
90.62
91.25
78.84
78.28
fgsm(C)
10.68
16.08
15.95
22.40
15.53
48.86
55.79
52.73
48.56
55.55
52.12
Pgd(C)
0.1
1.71
0.47
1.24
6.64
2.76
39.75
49.70
47.62
41.65
49.57
48.30
fgsm(R) R)
81.01
84.36
80.18
85.13
88.39
83.10
77.33
78.08
76.78
75.69
76.93
74.90
Pgd(R)
85.14
88.84
82.49
85.07
88.73
82.48
77.42
78.40
77.02
75.29
76.46
75.13
T=4
CIFAR-10, Constant Encoding, RAT
Attack
CLEAN
GN
FGSM(C)
PGD(C)
clean
91.29
90.86
84.13
83.33
ga
88.71
90.72
83,09
82.95
fgsm(C)
25.09
25.90
15.40
29.42
34.45
20.74
54.18
64.46
55.86
53.50
63.97
56.15
Pgd(C)
0.49
5.97
0.45
3
15.93
3.23
42.76
58,92
48.66
44.44
58.78
50.05
fgsm(()
84.62
84.06
82.94
87.55
88.59
87.11
81.68
82.56
81.45
80,90
82.53
0.63
pgd(R)
87.41
88.29
85.75
87.96
89.15
87.41
81.96
82.95
81.60
80.58
82.52
80.33
T=4, m=1
CIFAR-10 10, Rate Encoding
Attack
CLEAN
GN
FGSM(R)
PGD(R)
clean
79.55
79.36
76.89
76.36
gn
78.62
79.07
76.39
76.77
fgsm((C
75.57
78.01
75.62
75.34
77.75
75.36
72.03
73.01
73.00
73.99
75.81
74.50
Pgd(C)
76.23
78.73
76.19
76.06
78.74
76.30
73.03
74.76
73.35
74.87
76,62
75.15
fgsm(R)
43.69
55.97
46.02
43.31
54.90
45.30
55.05
62.49
56.06
55.27
63.42
55.77
Pgd(R)
37.37
51.71
39.48
37.4
50.79
40.0
51.63
59.92
52.12
51.59
61.21
51.99
T=4, m=10
CIFAR- 10, Rate Encoding
Attack
CLEAN
GN
FGSM(R)
PGD(R)
clean gn
83.22
83.5
80.15
80.54
83.54
83.41
80.33
80.41
fgsm(C)
80.29
82.65
80.05
79.94
82.04
80.37
76.41
77.97
76.82
78.22
79.88
78.6
pgd(C)
80.6
82.93
80.51
80.05
82.73
80.27
76.73
78.87
76.76
78.59
80.15
78.69
fgsm(R) R)
44.93
59.58
47.64
44.89
57.75
47.54
57.89
65.94
58.63
57.85
66.87
59.03
pgd(R) 37.74
53.68
40.97
37.58
52.2
40.46
52.27
62.07
53.77
53.08
63.93
54.19
Table 5: We compare the test fgsm/pgd attacks implemented with different back proepproppaationn tech- niques such as BPTT, BPTR, and RGA and report the corresponding accuracies in the respective order. The results show that, most often, BPTT produces the most potent attacks.
0.05
0.1
0.2
0.3
0.4
0.5
CLEAN(C)
86.53
59.58
22.8
14.63
13.14
11.73
CLAA
84.3
60.3
26.01
16.01
12.66
11.26
CLEAN(R), m=1
78.38
77.74
72.58
61.77
48.38
35.13
CLEAN(R), m=10
83.13
82.07
77.65
66.26
51.14
36.66
Table 6: Under stronger Gaussian noise rate-encdoed SNNs show superior robustness.
15

---

Published as a conference paper at ICLR 2024
Constant Encoding
Rate encoding
Attack
T=4
64
128
4
32
64
128
clean
92.58
95.47
95.47
95.51
11.83
24.12
41.5
63.11
85.84
89.1
88.98
88.97
11.54
22.8
38.35
57.4
fC)
21.02
14.25
15.85
17.56
11.14
17.43
23.64
28.8
Pgd(C)
0.2
0.03
0.02
0.03
11.24
17.56
23.54
26.2
(R)
73.59
64.54
37.34
14.7
11.49
16.36
18
15.76
Pgd(R)
87.46
82.53
58.36
11.9
11.46
17.54
18.94
13.92
Table 7: Converted SNN model trained on CIFARIO dataset
Table 8: Training hyper-parameters
CIFAR-I0/100
ImageNet- 100
SVHN
Number epochs Mini batch size
200
200
200
64
64
64
T
4,8
4
4
LIF: /3
0.5
1
0.5
LIF: up
0
LIF: ueh
1
1
Learning Rate
0.1
0.1
0.1
FGSM/PGD/GN:
8/255
8/255
8/255
PGD (train):
2/255
na na 2.55/255
PGD (train) Iteration
4
na
PGD (test):
2.55/255
2.55/255
PGD (test) Iteration
7
7
Optimizer: SGD with momentum: 0.9, weight decay: 5 10-1, Rate Scheduler: cosine annealing
Comparison under ANN-SNN converted models: The theory of randomized smoothing holds irrespective of the base classifier that we choose. That is, whether we use the base classifier (in eqn. 6) from an adversarially trained model or a converted model, the corresponding smooth classifier g, will be robust against adversarial perturbation, i.e., g(x + 5) g(r). However, if the base classifier is unfit, the prediction g(z) can incorrect, leading to poor clean and robust accuracy.
We conducted experiments on VGG-16 models obtained using ANN-1o-SNN conversion Bu et al, 2021] the CIFAR-10 dataset. Under rate-encoding, converted SNNs do not offer clean accuracy at smaller latency T, which should be considered as the limitation of the base classifier trained to work with direct inputs without the Bernoulli noise. The same happens constant encoded SNNs trained on clean images if we add significant Gaussian noise to the input (see Table6).
is interesting directly trained SNNs, the robust accuracy (minimum accuracy across among the attacks) of rate encoding surpasses that of SNNs with constant encoding. (ii) The clean accuracy of rate encoding keeps improving larger T, but the robust accuracy initially increases (due to better prediction), but eventually drops, possibly due to the effect of T as found in our theory. (T=4: 11.49, T=32:16.366 T=64: 18, T=128: 15.76). A similar observation was made in directly trained SNNs, as given in Table 4 as we evaluated the direct trained models at T=4 vs T=8. (iii) similar drop in robust accuracy for constant encoded models may hint at rate-encoded nature of spikes in general SNN layers, as reported in (Bu et al. 2023).
that, (i) while the clean accuracy of rate encoding is lower than that of
Training parameess and time Table g reports the training hyper-parameters used across the four datasets. Additionally, Table 9 reports time required by each epoch of various adversarial training methods single NVIDIA RTX A6000 GPU. For example, the column FGSM(C/R) report that both constant and rate encoded adversarial training takes same amount time for single epoch.
Comparison with L adversarial perturbations: The certified accuracy is further compared with robust accuracy obtained with respect the pgd attack within I adversarial budget. Projection
16

---

Published as a conference paper at ICLR 2024
Table 9: Training time per epoch (in seconds)
CLEAN (C/R)
GN (C/R)
FGSM(C/R)
PGD(C/R)
CIFAR-10
65
66
106
150
CIFAR-100
48
48
72
251
Imagenet- 100
704
SVHN
95
na
na
na
CIFAR-10
50
60
40
Accuracy
Accuracy
30
certified acc
certified acc
30
20
c/255
</255
ImageNet-100
SVHN
60
80
50
60
Accuracy
Accuracy
certified robust acc
cortified
40
rebust acc
20
10
c/255
c/255
Figure 2:
We compare the empirical robust accuracy of CLEAN(R) model under the PGD attack with its certified accuracy across various l radius values and for different datasets. The correspond- ing gap highlights the scope for improvement in theoretical/experimental results.
into I ball is implemented using the code from CCroce & Hein 2021 Figure compares the results on different datasets.
17


Reviews:
[{"review_id": "DcAaaxhKRM", "reviewer": "Reviewer_77u8", "summary": "The manuscript investigates the adversarial robustness of spiking neural networks (SNN). It establishes a connection between rate-encoding used for SNNs and the randomized smoothing framework from adversarial robustness. It clarifies why rate-encodings are more adversarial robust than constant-encodings, as observed previously in empirical studies. The established theory confirms the empirical observation that this benefit diminishes with increased SNN inference latency. In addition, empirical robustness is investigated using a variety of adversarial training techniques optionally combined with randomized smoothing for both constant and rate encodings.", "questions": "Multiple open questions about results in Table 1, for example:\n* Why do fgsm(R) and pgd(R) attacks not work on models trained with constant encoding? As fgsm(C) and pgd(C) do work well as expected, shouldn't this indicate that rate-encoding messes up the attack algorithms (i.e., because the gradients become noisy)?\n* As one tests attacks on both encodings (C/R), it might be good also to have clean (C/R), no? (it is rather interesting to me that models trained on C, do work that well on fgsm(R) and pgd(R) and visa versa)\n* Adversarial training is performed both for FGSM and PGD. As PGD is the “stronger” adversary, I would expect it to be more robust, yet it is not. Especially, the PGD-adversarially trained network performs worse than an FGSM-adversarially trained network if tested against a PGD adversary. This result seems counterintuitive and is consistent across different datasets. Why? What PGD adversary was employed during training (as the evaluation PGD is as expected better than FGSM) ?", "limitations": "", "rating": 8, "confidence": 3, "soundness": 3, "presentation": 2, "contribution": 3, "strengths": "* **Original Contribution:** The paper offers a unique perspective on adversarial robustness for SNNs using rate encoding. The connection between rate encoding and randomized smoothing is a novel and interesting insight contributing to the field.\n* **Theoretical work**: The authors provide a theoretical foundation for the robustness of rate-encoded SNNs. While the results rely on previous work, the extension to SNNs is novel and non-trivial (lemma 3 and 4). \n* **Comprehensive empirical results**: Additionally to the theoretical contributions, the authors combine their results with various adversarial training settings to improve empirical robustness. \n * **Clarity of introduction and background:** The paper is well-structured and provides clear explanations of the relevant concepts, making it accessible to a wide audience, including those not specialized in spiking neural networks or adversarial robustness.", "weaknesses": "## Major issues\n* **Claims and limitations**: The manuscript claims to \"introduce a novel adversarial training algorithm ... improves state-of-the-art ...\". Yet it is not very clear what the novelty exactly is (e.g. as also stated by the authors Stalman et al. 2009 did combine adversarial training and randomized smoothing. Is it the adaption to SNNs? The modifications required for the attack?). This should be more clear. Further, the manuscript claims new state-of-the-art performance in the abstract. But only \"compare the performance of the proposed methods with state-of-the-art adversarial training algorithms\" in the Experiments. These are two slightly different statements, and they should be clearly formulated (i.e. what is state-of-the-art (is there a well-established state-of-the-art in the field?), and exactly which proposed method beats it?). While the authors do discuss the obtained certified radius in section 5.3, these certifications seem way smaller than for the ANN case [2]. While a direct comparison is not necessary, this should be discussed more explicitly. \n\n* **Empirical details and clarity of experimental results**: The manuscript lacks a more comprehensive description of experimental details, which should be added to the appendix i.e., how many PGD iterations, all the training details for all adversarial training methods, the cost of training with the different methods (GPUs, time), … . There also is only a brief discussion of the empirical results, and some of the results are unclear/surprising to me (see questions). This should be discussed in more detail.\n\n* **Comparison between certified and empirical robustness**: The manuscript does analyze both the empirical and certified robustness. Yet, does treat them mostly independently. It would be helpful to e.g. take Fig 1 (d) (i.e. the empirical robustness for various epsilon) and also plot the certified robustness (with radius r=epsilon). This information is already displayed in Table 3 (although for a much smaller radius). This would nicely showcase the gap between empirical and certified robustness. While the authors do not claim tightness of the certifications, this at least should be discussed/visible.\n\n\n\n## Minor issues and recommendations:\n\n* The authors state that certified defense methods based on convex relaxations and branch and bound are restricted to ReLU activations. This is incorrect as [1], does generalize to general activation functions. The claim that these methods do not apply to SNNs may still hold and should be checked by the authors.\n* Some of the proofs rely on the differentiability of g with respect to x. It might be good to point out that g is differentiable with respect to x, even if f is not differentiable with respect to z (as is the case for SNNs, just for clarity).\n* There are some language errors (e.g. page 2 row 25) and formatting errors (whitespace in front of citations e.g. page1 first paragraph last row, page 2 row 11, ...).\n\n\n\n\n[1] Formal Verification for Neural Networks with General Nonlinearities via Branch-and-Bound  (Zhouxing Shi et. al.)\n\n[2] https://sokcertifiedrobustness.github.io/leaderboard/", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "4gjahLvoil", "reviewer": "Reviewer_NxbL", "summary": "Firstly, the author established a connection between rate coding and randomized smoothing, theoretically providing robustness guarantees against adversarial perturbations under the l1 norm. Additionally, a novel adversarial training method was introduced for rate coding, significantly enhancing state-of-the-art empirical robust accuracy results.", "questions": "1.\tIf the author believes that rate coding is crucial for the robustness of SNNs, then it is essential to conduct experiments on converted SNNs and provide a comprehensive theoretical analysis. This will not only strengthen the validity of the claim but also offer insights into how rate coding impacts the robustness across different SNN architectures.\n2.\tThe author should indeed expand the literature review to include more recent works related to SNN's attack and defense mechanisms. Relying solely on PGD and FGSM limits the scope and depth of the study. By incorporating a broader range of attack methodologies, the author can present a more holistic view of SNN's vulnerabilities and strengths in the face of adversarial attacks.", "limitations": "", "rating": 5, "confidence": 4, "soundness": 3, "presentation": 3, "contribution": 2, "strengths": "1. The author establishes a connection between rate coding and randomized smoothing, providing a robustness proof for adversarial perturbations under the l1 norm.\n2. The introduction of a new adversarial training strategy for rate coding notably enhances the state-of-the-art empirical robust accuracy.", "weaknesses": "The connection between encoding and robustness has indeed been explored in many previous studies, as evidenced by the references provided:\n1.\t\"Rate Gradient Approximation Attack Threats Deep Spiking Neural Networks\" from CVPR 2023\n2.\t\"HIRE-SNN: Harnessing the Inherent Robustness of Energy-Efficient Deep Spiking Neural Networks by Training with Crafted Input Noise\" from ICCV 2021\n3.\t\"Rate Coding Or Direct Coding: Which One Is Better For Accurate, Robust, And Energy-Efficient Spiking Neural Networks?\" from ICASSP 2022\n4.\t\"Spike timing reshapes robustness against attacks in spiking neural networks\" from Neural Networks\nGiven the substantial amount of existing work on this topic, it does seem that the author's contributions might not be as groundbreaking. Additionally, some studies, like [1], have indicated that SNNs encoded with Rate Coding using LIF neurons can be vulnerable. This further suggests a need for more innovative approaches or a unique perspective to truly stand out in this field.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "duT6zeCPc3", "reviewer": "Reviewer_wpSa", "summary": "This work presents a certified robust training framework for SNN. They mainly consider the Bernoulli noise in input and bounded by l1-norm. During robust training, they adopt STE for BP.", "questions": "See weaknesses for details", "limitations": "", "rating": 6, "confidence": 3, "soundness": 2, "presentation": 2, "contribution": 2, "strengths": "Apply certification based robust training on SNN is an interesting topic.", "weaknesses": "1.\tBased on my understanding, the bound is conducted through repeated sampling (m times), which is a statistic boundary instead of a rigorous boundary. Please make it clearly. \n2.\tThe robust training framework is not clear. Based on my understanding, the robust training is more like adding noise to inputs repletely to conduct the boundary, which seems trivial.\n3.\tThe labels in experiments are misleading, i.e. I did not find RAT in tables. \n4.\tPlease discuss [1]\n\nLiang, Ling, et al. \"Toward robust spiking neural network against adversarial perturbation.\" Advances in Neural Information Processing Systems 35 (2022).", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "KU8wKsLy30", "reviewer": "Reviewer_FaRA", "summary": "This paper pointed out that rate-encoded SNNs have superior robustness compared to constant-encoded SNNs, and then proposed an adversarial training method based on rate encoding.", "questions": "See Weakness Section.", "limitations": "", "rating": 8, "confidence": 3, "soundness": 2, "presentation": 2, "contribution": 2, "strengths": "1. The author's relevant mathematical derivation about the perturbation degree $\\boldsymbol{\\delta}$ is quite convincing, especially the connection between $\\boldsymbol{\\delta}$ and $T$ established in Theorem 5.", "weaknesses": "1. As shown in Tab.1, compared to constant-encoded SNN, rate-encoded SNN seems to have a significant loss in its clean accuracy (CIFAR10: 91.29% v.s. 83.22%, CIFAR-100: 70.85% v.s. 55.27%). I think this will significantly hinder the practical application of rate-encoded SNN.\n\n2. In Tab.1, the author's comparative perspective is that the robustness of constant-encoded SNN under PGD (C) is weaker than that of rate-encoded SNN under PGD (R), so rate-encoded SNN is better. However, I noticed that the robustness of constant-encoded SNN is better than that of rate-encoded SNN under GN attacks (CIFAR10: 90.62% v.s. 78.62%, CIFAR-100: 66.46% v.s. 50.43%), and at the same time, constant-encoded SNN maintains good defense against FGSM (R) and PGD (R). **Therefore, it seems that the so-called superior robustness of rate-encoded SNN does not have a good generalization effect, and it cannot maintain good defense ability under different attacks, which is an obvious limitations.**", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}]

Author rebuttal:

Decision: Accept (poster)