Improving Generalization and Robustness in SNNs Through Signed Rate Encoding and Sparse Encoding Attacks
Authors: Bhaskar Mukhoty
Hilal AlQuabeh
Bin Gu
Venue: ICLR 2025 Poster (2025)
Keywords: Spiking Neural Network
Adversarial Examples
Adversarial Robustness
Rate Encoding
Primary area: unsupervised, self-supervised, semi-supervised, and supervised representation learning

Abstract: Rate-encoded spiking neural networks (SNNs) are known to offer superior adversarial robustness compared to direct-encoded SNNs but have relatively poor generalization on clean input. While the latter offers good generalization on clean input it suffers poor adversarial robustness under standard training. A key reason for this difference is the input noise introduced by the rate encoding, which encodes a pixel intensity with $T$ independent Bernoulli samples. To improve the generalization of rate-encoded SNNs, we propose the *signed rate encoding* (sRATE) that allows mean centering of the input and helps reduce the randomness introduced by the encoding, resulting in improved clean accuracy. In contrast to rate encoding, where input restricted to $[0,1]^d$ is encoded in $\\{0,1\\}^{d\times T}$, the signed rate encoding allows input in $[-1,1]^d$ to be encoded with spikes in $\\{-1,0,1\\}^{d\times T}$, where positive (negative) inputs are encoded with positive (negative) spikes. We further construct efficient \textit{Sparse Encoding Attack} (SEA) on standard and signed rate encoded input, which performs $l_0$-norm restricted adversarial attack in the discrete encoding space. We prove the theoretical optimality of the attack under the first-order approximation of the loss and compare it empirically with the existing attacks on the input space. Adversarial training performed with SEA, under signed rate encoding, offers superior adversarial robustness to the existing attacks and itself. Experiments conducted on standard datasets show the effectiveness of sign rate encoding in improving accuracy across all settings including adversarial robustness. The code is available at https://github.com/BhaskarMukhoty/SignedRateEncoding

Published as a conference paper at ICLR 2025
IMPROVING GENERALIZATION AND ROBUSTNESS IN SNNS THROUGH SIGNED RATE ENCODING AND SPARSE ENCODING ATTACKS
Bhaskar Mukhoty"; Hilal AlQuabeh"", Bin Gu
1 Mohamed bin Zayed University of Artificial Intelligence, Abu Dhabi, UAE Schooo of Artificial Intelligence, Jilin University, China
ABSTRACT
Rate-encoded spiking neural networks (SNNs) are known offer superior ad- versarial robustness compared to direct-encoded SNNs but have relatively poor generalization clean input. While the latter offers good generalization input it suffers poor adversarial robustness under standard training. A key reason for this difference is the input noise introduced by the rate encoding, which encodes a pixel intensity with 7' independent Bernoulli samples. To improve the general- ization of rate-encoded SNNs, we propose the signed rate encoding (SRATE) that allows mean centering of the input and helps reduce the randomness introduced by the encoding, resulting in improved clean accuracy. In contrast rate encoding, where input restricted to [0, 1j is encoded in {0, 1 ] the signed rate encoding allows input in [-1, 1]dt be encoded with spikes in {-1, O, ] where positive (negative) inputs are encoded with positive (negative) spikes. We further construct efficient Sparse Encoding Attack (SEA) on standard and signed rate encoded input, which performs 4--orm restricted adversarial attack in the discrete encoding space. We prove the theoretical optimality of the attack under the first-order approximation of the loss and compare it empirically with the existing attacks on the input space. Adversarial training performed with SEA, under signed rate encoding, offers supe- rior adversarial robustness to the existing attacks and itself. Experiments conducted on standard datasets show the effectiveness of sign rate encoding in improving accuracy across all settings including adversarial robustness. The code available at http:://wttbbboooo/aaaaaaaaaaaas
clean
INTRODUCTION
Spiking neurons emulate the salient features of the biological neurons by maintaining a membrane potential that accumulates the weighted input spikes over time and sends output spikes whenever the potential exceeds a predetermined threshold, followed by reset in the potential (Gerstner et al., 2014). A spike is represented by a single binary number, denoting its presence or absence. In contrast to continuous activation such as Sigmoid or ReLU, communication of information through spikes simplifies the floating point vector inner product required between the weights and activations for computation of input to neuron, to the accumulation of weights selected by the presence of spikes. Such computation can efficiently implemented on neuromorphic hardware, obtaining significant energy saving, as demonstrated in specialized neuromorphic hardware, such as Intel's Loihi (Davies) ct al. 2018), IBM's TrueNorth (Akopyan et al., 2015) etc.
For static inputs such images, SNN requires each pixel to be encoded by spikes of length T. where T is known as network latency. The direct or constant encoding supplies the input in Rdd, as it is, for T time steps and assumes that the first layer of the network works an encoder, generating the spikes. However, whether neuromorphic hardware can support floating point inputs debatable. Since there is restriction in the input domain, direct encoding allows the normalization of the input, helping in better training.
"Email: (bhaskar.. .uw.oot,, halquabeb) ) @gmail com com 'Coresponding Author: jsqubinégmai 1 com

---

Published as a conference paper at ICLR 2025
(21, ..a) E [0, 1] has domain restriction. To en- code a pixel x; E [0, 1] it generates T" independent Bernoulli spikes (z:") (2)
In rate encoding approach, the imput x
E {0,1)" + 21=1 approximates I;- Due to the introduction of noise, rate encoding yields lower standard accuracy compared to direct encoding, moreover, because of the imput domain restriction, it does not allow normalization of the input. It is. however, empirically observed (Sharmin et al., 2020 and also theoretically proved (Mukhoty al. 2024) that rate-encoded network offers robustness from adversarial attacks, even without adversarial training. In contrast, direct encoded networks offer no adversarial robustmess without adversarial training. makes rate-encoded networks relevant to applications at the risk of adversarial attacks, as adversarial training for large datasets can sometimes be computationally prohibitive.
treating 2, the bias, with =5"h (1; so that, the rate of spikes +
For some background, an adversarial attack (Goodfellow et al. 2014) is test time attack that finds minimal perturbation of the input in order to change the classifier output to an incorrect class. On the other hand, to introduce robustness against adversarial attacks, adversarial training (Madry et al. 2018 performs training with adversarially perturbed input but the correct label.
Intuitively, a key reason behind the robustness of rate-encoding is the obfuscation of the original input through Bernoulli noise, which dilutes the effect of small adversarial perturbations of the input space when encoding is performed. With increasing T', the rate of spikes better approximates the input, the clean accuracy improves, but at the same time, it reduces the robustness to adversarial perturbations. A primary motivation for the present work is to reduce the randomness introduced by the encoding for fixed 7', which should improve the standard accuracy but may cause slight compromise in robustness. We observe that the randomness introduced by rate encoding can be reduced through mean- ceentrcene of the data, as the variance of a Bernoulli random variable is highest when the bias is 0.5, and any reduction the bias should result in a reduction in randomness.
Further, since adversarial perturbation in the input space must pass through the encoding space, an attack on the encoding space should be more effective if compared under a transferable budget with input space attacks. From a model perspective, receiving adversarially perturbed encoded input also makes realistic sense, as the encoder need not be a part of the model. For example, MMarhiiioo et al.) (202T) demonstrates an adversarial attack on SNN by perturbing dynamic vision sensor (DVS) images belonging to discrete space. In literature, encoding attacks have been also explored, for instance, Liang et al. (2021) presents gradient-basee adversarial attack on rate encoding, which does not incorporate a sparsity budget but introduces uncontrolled sparsity through a probabilistic sampling of mask applied to the perturbations, where the mask probability is equal the coordinate-wise magnitude of the gradient.
Our Contributions:
Rate encoding requires inputs x E [0, 1] for Bernoulli sampling, which cannot accom- modate negative inputs that arise from meca-centering the data. We propose signed rate encoding that allows rate encoding to work with both positive and negative inputs in [-1, 1] by generating signed spikes depending upon the sign of the input. We quantify the reduction in randomness following mean-centedr mean-centering and demonstrate the effectiveness of signed rate encoding in improving training and generalization performance (see Table [.
We introduce gradient-based 4o-nomm adversarial attack in the encoding space, dubbed as Sparse Encoding Attack (SEA), that alters the encoded input under a given sparsity budget and jointly optimizes the encoding restriction requiring the perturbed encoded input belonging to }} or f-1, 0, }} depending upon rate or signed rate encoding. Given the gradient information and sparsity budget, we prove that SEA maximizes the loss function under the first-order approximation of the loss. Further, to compare the lg-norm restricted encoding attacks with lac -nom restricted input space attacks, we compute expected fo- budget given an 1.- -budget (see section 4.3)
We perform adversarial training of rate-encoded SNNs with SEA and other existing input space attacks such as FGSM and PGD. The empirical performance on standard static image datasets such CIFAR- 10, CIFAR- 100, and SVHN reveals that SEA under signed rate encoding offers significantly higher robust accuracy compared to the existing methods (see T
2

---

Published as a conference paper at ICLR 2025
2 BACKGROUND
Neuronal Dynamics: The neurons of the SNN following the Leaky Integrate and Fire (LIF) model
(Gerstner al. 2014) are governed by differential equation similar RC-parallel eircuit, which after Euler forward discretization, given as:
( [t] = B(u, 1 1] - st - -(uu))) + Σ Wiys (1 [t)
[t].
[1 if [t] > (
| [t] = (u, uth)
ueh
(2)
otherwise,
where, u: (6] denotes the membrane potential of the i-th neuron in I-th layer at the time step E [7]. The potential recursively depends upon its residual potential from the previous time step with a leaky factor B, where 0
1, and spikes s (t) received from layer 1 weighted by Wij- When
membrane potential [t] exceeds a predetermined threshold ūth, it generates binary spike s;" [1] represented by the Heaviside 11, followed by reset in the membrane potential at the next time step. The total number of steps for which the network dynamies executed is called the latency of the network, denoted by T. The inputs to the network are supplied for T steps using some encoding technique discussed earlier, and the network output is computed by taking the temporal average of the final layer output over the latency period.
Let ho Rdd + P(Y) denote a classifier parameterized by which given input returns the probabilities of the class labels in V Given training data (x,, (s) E S, the network minimizes the loss over 0, computed w.r.t the true labels y::
Surrogate Training:
min
Σ X.RRES
C(ho(x:),
We use direct training, where minimization is performed using gradient decent updates computed via back-propagation through time (BPTT) (Wu al., (018)) However, due the Heaviside function involved, which has zero gradient everywhere except at discontinuity, it is customary to use a differentiable surrogate function in the backward pass and Heaviside the forward. The surrogate gradients can also be replaced with zeroth order derivative of the Heaviside (Mukhoty et al. (023).
Adversarial Examples: Given classifier he. an additive adversarial perturbation 8x intends alter the predicted class for given input x:
arg max (x), * arg max (x(x + 6x),
(4)
Solving the above task while minimizing norm on 8x is NP-hard, owing the non-convexity the classifier hig Considering the white box attack scenario where the adversary can access the network architecture and parameters, one tries to find perturbation 8x using the loss as a proxy objective (Goodfellow et al. 2014)).
arg max (x + +),,) [|8|
(5)
Since the loss is non-co,vex, it common to work with its first-order approximation, [(hg(x v) = ((ho(x), + 8 V.V ()))))))))))) y), in which case, the objective becomes:
6x arg max 5th ( [
(6)
The Fast Sign Gradient Method (FGSM) Goodffllow et al. 2014) solves the problem for Iac -orm restriction on 5. The problem can also attempt to be solved over multiple FGSM steps, each followed by projection operations II, that enforce the norm restriction, known Projected Gradient Descent (PGD) (Madry et al. 2018)
8 (6, + a sign (ig + 0.)).
As the perturbed image must satisfy constraints of input space, e.g., x + 8, E [0, 1] it requires an additional projection. It is established that joint optimization of norm and the input space restriction
3

---

Published as a conference paper at ICLR 2025
is superior to the sequential projections required to ensure them (Croce & Hein 2021). Inspired by this, we perform a joint optimization these objectives in the proposed ly norm attack (see eqn. 14)
Adversarial Training:
To train classifier that performs reasonably well even under adversarial perturbations, it was proposed (Madry et al. 2018) that the classifier be trained with perturbed input + 6x but with original label y.
min
max (( 8). X.DES [
(8)
Though computationally more expensive than standard training due to inner maximization required to find the perturbation, the objective forces classifier output be invariant across the radius of perturbation, introducing bias that often leads to drop in clean accuracy, but offers better robust accuracy against the adversarial attack (Pang et al. 2022
SIGNED RATE ENCODING
3.1 QUANTIFICATION OF RANDOMNESS
We start by quantifying the amount of randomness introduced by rate encoding (RATE). To this end, we would like to measure how far on expectation two binary encodings can be when measured under lo oonomm. Consider image input [0, 1]d, encoded twice independently at particular time step,
ie., z, 2 (er(x), where, 2, 2 E {0, já. So that we have,
Ez 1|| 2110] = Σ E Ber &.l = > x.(1 - x.) = 2 (x, 1-xx =: (x) (9)
The randomness l (x) is proportional to the sum of the pixel variances, e.g., if every pixel has an intensity of 0.5, two encodings at any particular time step will vary on coordinates expectation. natural question that follows whether it is possible to reduce the randomness. We can reduce the variance of the pixels if we push them towards boundaries 0 or 1, as the variance is highest 0.5. A standard way to do it is mean centering. making the pixels have O intensity on average. However, this will require negative intensities to be encoded, case not supported by rate encoding.
3.2 SIGNED RATE ENCODING VIA SIGNED BERNOULLI
We propose signed rate encoding (sRATE) to allow negative as well as positive pixel intensities, I [-1, 1], to be rate encoded. For this, whenever pixel intensity is positive, generate the spikes in {0, 1} using Bernoulli sampling, while, if the intensity is negative, we generate spikes in (0, 1), treating the magnitude of the intensity the bias of negative Bernoulli variable.
2, =Ber(zz) = { Ber(x;) if 2 0
(10)
Ber( -2:a) if < 0
so that, E (-1,0, 1}. with,
P(:; = 1) = x;;[1;; 2 x P(z P(z=-1)- -xx1<< <0]= =0]=; x7 P(4 = 0) = x x
[xv|
(1I)
The notation, x , are respectively known as positive and negative part, both non-negative quantities, denoting the magnitude of the number with either sign, but zero otherwise. Eqn. [1 uses the identity |x:| x + x for a compact representation. We refer to the random variable defined above (eqn. TO I1 signed Bernoulli (abbr. sBer) and the corresponding encoding signed rate encoding (SRATE). Given an input x E [--,,1] 1]6, generates the encoding in (-1,0,1) 1) by
sampling independently from the sBer distribution for T steps.
We quantify the randomness introduced by signed rate encoding similar to eqn. Given E [-1, compute the expected lo-ormm distance of two independent signed Bernuulii encoding z, 2
4

---

Published as a conference paper at ICLR 2025
sBer(x), at fixed time step with, 2, 2 {-1,0,13*
Egg Bz, ||| -21o] ]
Σ
E n, -Bee - Σ
P( 2.) Σ
(1
P( 2))
1=1
d
Σ P(z 1, 1) - P(z = -1, -1, P( = 21 = 0))
i=1
d
d = Σ
Σ (1 - (x;t)² - -x,,)² - 1x)1))
(1
|x, - (1 11s11)3))
=
1=1
1=1
2[xx 1- xx|) =: (x
(12)
Note that eqn. T2 goes back gracefully to eqn.
9 with inputs restricted to [0, I].
(1
(x))
Denoting the empirical mean as μ + X; E [0, 1J=, we compute the factor,
0.5
0.20
ki (x)
(xxx)== = k 11)
(13)
0.6
0.2
0.4
0.6
0.8
which, represents the factor by which the ran- domness reduces following mean centering of particular input x.
Figure 1: Signed Bernoulli reducing randomness after mean-centering of CIFAR-10 10 dataset.
Tab. reports the quantities 11, At and K3 after taking the average on the training set of multiple standard datasets, along with channel-wise average pixel intensities. The SVHN dataset shows the highest reduction in randomness, followed by ImageNet-100, CIFAR- 10 and CIFAR-100, For CIFAR- 100, although avg. ky (x μ is higher than avg. kn (x), we still obtain reduction in randomness, as reported by avg. kg (x). Fig. I attempts to
illustrate the possible reduction in randomness due to the mean centering of dataset, with shaded
areas highlighting the standard deviation of pixel intensities before and after the centering.
We note that the reduction in randomness offered by SRATE is data-dependent result; such a reduction may not always happen. Tab. shows that the rate of spikes in the input layer has a significant reduction in SRATE compared to RATE, which is possible when [r; - pl] I; for most 2; [0, 1], which also implies a reduction in randomness as the function
Characterizing Randomness Reduction:
xx1 - x) is an increasing function in the region [0, 0.5). Observe, [ l < > 0 < < 2x,
As 2 is true for x; [0. 1]. the condition fails only when μ > 2x; or, æ4 > 0.5, thus, de E 1 0.5) guarantees randomness reduction. However, it is only a sufficient condition.
CIFAR-10
CIFAR-100
SVHN
ImageNet-106 100
32 x 32 x (0.425, 0.415, 0.384)
32 32 x
32 x 32 3 (0.378, 0.384, 0.410)
224 x 224 x 3 (0.458, 0.450, 0.389)
pixel (x)
(0.439, 0.418, 0.378)
994.18
953.09
1106.59
54701.22 .22 43998.53
1x(x 14) ka(x)
942.39
964.14 14
830.33 1.44
1.11
1.05
1,366
Table 1: Dataset statistics and their randomness reduction factor (kz) due to signed rate encoding averaged over training data points.
4 SEA: SPARSE ENCODING ATTACKS
4.1 ADVERSARIAL ATTACK ON RATE ENCODING
is natural for an SNN classifier to receive encoded inputs, thus creating possibility of an adversarial attack on the encoded input. Let us consider the classifier be : {0, 1] 1]dx2 P())), that receives rate-encoded input z (1) (2(1),z(2)
222) .2(2).... .... ... (T), with (1)) (0,1)² and produces probabilities for
5

---

Published as a conference paper at ICLR 2025
(g))(g:)
-1
0
sign(g.)
-1
0
Zi
0
2
-1
-1
0
-1
8
0
-1
0
0
0
8
0
-1
-2
2
1
0
0
0
0
Table 2: 8, + 24 {0,1)
Table 3: 8,
E {-1,0,13
individual classes. To construct untargeted attack the encoding {0, 1]dxT we may want to restrict the changes to most k coordinates in frame ( E {0, 1)4. Thus, we would like to solve the following optimization problem, following the first-order approximation of the loss function as described in eqn. 6
8
arg max 6:41 (80) (8
(8, VzL(ho(z + +),
(14)
where [8(1) 8(2) 80), and the restriction ( + (()) E [0, implies that g()) {-1, 0, 13 Since the optimization problem is over finite and non-empty feasible set, it must attain global maximum. However, the argument on which it attains the maxima may be unique, and we would like to find one of them and call it 8*, But first, let solve the problem without the sparsity constraint.
8 := arg max
(6, VzCho(zz + 6).
(15)
( E
As the objective is linear in 8, the solution of the problem can be given coordinate-wise With the renaming g = VeC E Rdx7 the solution is given as:
9 (1) 0, =0
8/0)
9i (t) < 0, =1
0 otherwise
sign(g) (1) (H(g))) 2 0j(1 -2102(0)
2(") (1 (1-11g I[9 2 0))2(²)
(16)
(1) and gi the choice of 8,9 that Table elaborates the solution by observing that once fix z
maximizes the quantity 8/41 9; while respecting the constraint 21 8(t) E {0. 1} is straightforward
Lemma 1. The solution defined as per eqn. 16 an optimal solution to the optimization problem
in eqn. 15
We give the proof in the supplementary section A.I
With å present in hand, it is not difficult to find 8*. To maximize the inner product (6, g) under sparsity budget, we would like to choose the top k no-zero coordinates of ((t), according to the magnitude 8f gi
(L(z)
(t) We define permutation и specific to the time step such that, < implies
z + 8 (0,
2 (1,1)
(()) (1) 2 (()) (t)
Gay for i,j E [1,2,... .... ,d. (1(1)
keeps the top coordinates of ((t) with respect and sets the rest to zero:
21
((t)
if i otherwise
(0,
(1,
(+())
(17)
0
Lemma 2. 8* obtained as per eqn. the optimization problem of eqn. 14
17 is maximizer of
Figure 2: Sparse Encoding Attack on rate encoding for given time-step, with d=2 and k=1
Time Complexity: To implement the operation in eqn. 17
needs to find the indices of top-k elements of array which holds the elements

---

Published as a conference paper at ICLR 2025
). It can be implemented with a partitioning algorithm with the time com- 91 oi 92 plexity of Old + k), making the attack as efficient as other gradient-based attacks.
(3)
(00)
Highlighting the sparse nature of the attack the encoding, we name it Sparse Encoding Attack SEA. Fig. 2 gives a visual example of the attack, where we intend to perform a 1-sparse perturbation the point (1, 1) on which the gradient is assumed to be (-0.5, 1). Although the gradient has the largest component in the direction of 22, any positive progress in that direction is not possible due the violation of the feasibility condition. But, in the direction of 21, change is possible, and SEA gives us 8 = (-1,0). Next, we construct the same attack adapted to signed rate encoding.
4.2 SPARSE ENCODING ATTACK ON SIGNED RATE ENCODING
To construct sparse encoding attack on signed rate encoding, we change the encoding space to {, 1,1, fixing a time step i, so that eqn. 14 is reformulated as:
arg max
(6, VzC(ho(z + 8).
(18)
8:v (80)) (000
The feasibility constraint ensures that, 8(1) E (-2, -1, 0, 1. 2) Similar to rate encoding, we first construct coordinate-wist solution to the problem without the sparsity restriction, similar to eqn. [6 and given by Tab. 3 can be compactly expressed as:
(ig =!") (iign(g))
(19)
Given 8, 8" can be obtained following the definition of eqn. 17 proven by a similar argument as presented in Theorem
The optimality of the solution can be
4.3 COMPARISON OF SEA WITH INPUT SPACE ATTACKS
To compare input space attacks with encoding attacks, given any adversarial perturbation 6х in input space, we need to know the change in sparsity it may cause in the encoding space. To quantify this for rate encoding, we consider a corrupted input vector x x x 6x with ||xx|| & E [0, 1] and
find E zz 21lo]. with the assumption, Z ~ Ber(x) and ~ Ber(x).
(x, 6x) Bx,2[12 2|lo] Σ
F
2:
Σ
(1
x. ).i x1;(1 fft))
Σ xx)xx))== + 5.) + x:(1 - vs - 8:) = 2(x, 1 x) + (8x, 2x)
(20)
The expression for hi (x, 5x) reduces k (x) (see eqn. as we set &x = Thus, the quantity (6x, 2x)| gives the expected sparsity change the encoding of due to input perturbation dz. Fig. 4 plots this quantity averaged over the training dataset, where 6x are found for each x by FGSM/PGD attack, under different values of shown in x-axis. It can observed from the figure, that for an lo attack of radius 255. the expected change in sparsity is
k = -x)
k 10. Thus, is fair to compare encoding. See Tab. | such a comparison.
8 FGSM/PGD attacks with SEA k 10, under the rate 255
For computation of the sparsity budget for SRATE, obtain:
4x (x, 8x) Ex (x) z 2||o]
|||| + (1 x x 81) (x* (x + 8)+) (xx(xx 8)
(21)
where, the derivation is given in appendix section A.2 Thus, giving effective sparsity of the SEA attack, as i h2(x,, 8x) k2 (x(x) ) as plotted in Fig. d).
h2 (x, 6x) also reduces to k2(x) with 8x
5 EXPERIMENTS
Our experiments attempt to cover two aspects: first, the improvement in generalization by signed rate encoding over standard rate encoding, and secondly, the effectiveness of sparse encoding attack and
7

---

Published as a conference paper at ICLR 2025
CLEARENATI SEAARATE AEAUSNATE
SCAPRETE Ey SCANSEATE)
Taainng Accurscy
Tesh A.0.ACCU...
CLEANIATT
Epocts
Epochs
Epochs
Figure 3: We compare the performance of rate encoding (RATE) and signed rate encoding (SRATE) on CIFAR-10. 10. can be observed that a significant improvement in training is offered by SRATE, and it is reflected consistently across the training loss, training accuracy and test accuracy. similar observation can be made on adversarial training with SEA.
it's adversarial training. We use standard datasets such as 1FFAR-10/100 (Krizhessky et al. 2009).
SVHN (Netzer et al.) 2011) and Imagenet- (Deng al., 2009) for comparing the algorithms.
Following recent work use the standard VGGSNN (Deng et al. 2022) architecture based on
VGG-11 having the configuration 004C3-122C3-AP2-256C5
512C3-AP2-FC) for all datasets, except for Imagenet- 100 where 12--2-123--1123--P2-555
SEW- EeW-Resnet-34 (Fang et al.,
2021
Competitors: We compare with standard 40 norm based input space attacks such as FGSM GGoddfellow et al. 2014) and PGD (Madry et al. 2018). Implementation of the input space attacks requires sack-propagation of gradient through the stochasticity of Ber /Ber. We use the straight- through estimator (Bengio et al.) 2013), as demonstrated for input space attacks with rate encoding (Mukhoty et al. 2024).
Complementary to standard training on clean data (CLEAN) and additive Gaussian Noise (GN), we perform adversarial training with FGSM, PGD and SEA attacks. The training and test attack radii for each attack are supplied in Tab 10 along with complete details on the training hyper- parameters. Since both attack and adversarially trained models have the same name, we denote the attacks with small cases, while the models are highlighted in the capital within the figures and Tab 6 We use the Back Propagation Through Time (BPTT) (Wu et al. (018)) algorithm for finding gradients for adversarial attack and model parameters. A comparison of BPTT with BPTR (Back Propagation Through Rate) Ding al. (2022) supplied Tab. I1 shows the BPTT attack to superior, except in two cases, where BPTR performs better in the CIFAR- 100 dataset.
Training:
5.1 SIGNED RATE ENCODING VS RATE ENCODING:
We compare the training loss, training accuracy and test accuracy at the end of each training epoch offered by SRATE and RATE three datasets. Fig reveals that the loss converges much faster in SRATE compared to RATE, in CIFAR-10. Also evident from the figure, the advantage in training is reflected in test accuracies, where SRATE is found to offer higher accuracy than RATE, consistently after each epoch. similar trend can be found for adver- sarial training, as depicted under the SEA attack. Figures for CIFAR-100 and SVHN datasets are supplied the appendix (sce Fig. 5). which show approximately similar results.
RATE
SRATE
Diff.
78.79
82.05
3.26
82.22
84.41
2.19
83.41
85.41
2.00
10
84.21
86.34
2.13
Table 4: Comparison of clean test accu- racy on different latencies for CIFAR- 10, shows improvement offered by signed rate encoding rate encoding.
To the exact improvement in standard accuracies on different datasets, need to compare the columns represented by CLEAN in Tab 6 and rows represented by clean. Such comparison shows that SRATE offers 3.26 3.26%, 4.18% and 3. 76% higher standard / clean accuracy for CIFAR-10, 100 and SVHN than RATE. Improvement generalization is also reported for ImageNet- 100, where test accuracy is improved by 1%, reported in Tab.
8

---

Published as a conference paper at ICLR 2025
COMBATO
COMPRNTO BATTI
PC
ACCLEC
(a) SEA attack vs. (b) FGSM attack vs.
(c) PGD attack vs.
(d) & vs.
Figure 4: We fix the adv. trained models (highlighted by the legends) of CIFAR-10 dataset from Tab. о and perform sensitivity study on attack strength by varying (a) &o in SEA, (b) in FGSM and (c) PGD. Observe, SRATE models offering higher robustness than corresponding RATE model and (ii) adv. training with SEA and SRATE offering much higher robustness under SEA attack and comparable robustness against other attacks. Please refer to Tab. 13 for exact numbers the plots.
The advantages of SRATE over RATE, is also reflected when compared under different training latencies, as shown in Tab. reporttng clean test accuracy for CIFAR- 10 dataset.
Comparison of Sparsity: We compute the layer-wise spiking rate of the neurons, where the number of spikes in neuron is normalized by latency T and averaged over the neurons in the layer. Tab. 5 compares the statistics for RATE and SRATE at inference time on different datasets with their respective networks (SEWResNet for Imagenet- 100, VGGSNN for others) for CLEAN models. We can observe that spikes in the input layer have reduced signifi- cantly in SRATE due mean centering. Further, the spike rate averaged over all neurons in the network remains comparable or slightly higher for SRATE.
Dataset CIFAR-10
Encoding
Input
Avg.
RATE
0.48
0.053
SRATE
0.22
0,061
SVHN
RATE
0.46
0.058
SRATE
0.20
0.062
CIFAR-TOD
RATE
0.48
0.082
SR ATE
0.23
0.085
ImageNet-100
RATE
0.43
0.083
SRATE
0.22
0.084
Table 5: Rate of spikes in the input layer shows significant reduction in SRATE, while slightly increases the average spiking activity in the network. Detailed results are provided Tab. 9
5.2 EFFECTIVENESS
OF SPARSE ENCODING ATTACKS
Tab. G shows application of SEA on RATE and SRATE, both as an attack and with adversarial training. The sparsity budget k 10 for SEA in RATE is
found to be comparable with To -attack radius of 255 as shown in Fig 4(d) and discussed in section
4.3 For each of the T frames, SEA is allowed to change at most k pixcls out d, for a reference, in CIFAR-10, with d 32 x 32 x 3 3072, where k = 10 amount to changing only 0.326% of pixels per frame. Observe that the SEA has a comparable performance to FGSM attack, even with = 10, and significantly beats all attacks with the budget
20.
The columns of Tab. compare different adversarial training algorithms, under the mentioned attacks. It can be observed that adv. training with SEA under SRATE, offers higher robust accuracy compared to other models and across the attacks, as highlighted in the last column. To explain, why SEA under RATE, is not as good, one may refer Fig. (d) and Tab. [4] which shows that the equivalent sparsity for 255 is 10 for RATE, while is 4 in SRATE We perform adversarial training with SEA at & = 5 for both RATE and sR STA, possibly causing SEA model under RATE to perform worse under attacks of magnitude equivalent to 10.
T=4
ImageNet- 100
Attack
RATE
SRATE
clean
71.22
72.22
gn
71.38
72.06
fgsm
22.54
21.76
pgd
11.04
11.62
sea,
k=10
67.06
65.4
sea,
k=20
64.64
61.44
Table Comparison signed rate encoding with rate encoding trained on clean data, on ImageNet-100..
We consider the adversarially trained models of CIFAR-I0 from Tab. and perform sensitivity studies on attack strength by varying in SEA and e in FGSM and PGD. We can observe SRATE models offering higher robustness than corresponding RATE models and adv. training with SEA and SRATE offering much higher robustness under SEA attack and comparable robustness against other attacks.

---

Published as a conference paper at ICLR 2025
T=4
CIFAR-10, 10, Rate Encoding
CIFAR-10, Signed Rate Encoding
ATTACK
CLEAN
GN
FGSM
PGD
SEA
CLEAN
GN
FGSM
PGD
SEA
clean
78.79
78.87
75.54
77.07
75.3
82.05
82.01
78.51
79.78
79.06
gn
79.23
78.58
75.92
77.51
75.12
82.13
81.83
78.26
79.7
78.01
fgsm
44.83
44.35
53.93
53.16
42.31
44.3
43.59
55.1
53.81
56.58
Pgd
38.87
38.41
49.68
48.83
37.19
36.88
37.03
50.21
48.47
51.87
sea, k=10
44.31
43.89
47.37
46.94
55.33
39.61
39.94
49.05
48.07
80.18
k=20
28.74
28.15
34.67
34.52
43.16
29.06
29.23
40.36
38.75
75.77
Avg
52.46
52.04
56.19
56.34
54.74
52.34
52.27
58.58
58.10
70.25
T=4
SVHN, Rate Encoding
SVHN, Signed Rate Encoding
clean
85.66
85.84
85.87
86.04
85.01
89.44
89.59
89.64
89.87
83.98
gn
85.44
85.73
85.97
85.65
85.01
89.14
89.38
89.44
89.53
81.93
fgsm
44.09
44.15
50.26
48.33
41.94
43.37
44.06
49.94
48.23
67.57
pgd
38.82
38.77
45.03
43.31
35.82
35.46
35.43
42.45
40.53
65.76
sca, k= 10
37.81
37.61
38.13
37.89
54.06
34.62
35.10
35,26
35.13
92.27
k=20
21.46
21.75
22.36
22.63
32.66
23.55
23.72
24.93
24.97
87.21
Avg
52.21
52.31
54.60
53.98
55.75
52.60
52.88
55.28
54.71
79.79
T=4
CIFAR 100, Rate Encoding
CIFAR- 100, Signed Rate Encoding
clean
50.56
50.75
46.58
47.07
46.67
54.74
54.51
49.59
51.74
50.35
gn
50.03
51
46.41
46.72
46.15
54.6
54.06
49.64
51.93
49.69
fgsm
22.21
21.92
28.45
30.27
20.53
22.33
22.11
30.81
29.7
31.38
pgd
18.53
18.6
26.08
27.79*
17.99
18.44
18.78
28.22
27.04
27.08
sca, k=10
25.84
26.47
26.91
30.28
30.58
21.4
21.81
28.04
27.85
58.53
sca, k=20
16.39
16.2
18.66
22.37
22.03
12.87
13.56
20.63
20.49
54.66
Avg 30.59
30.82
32.18
34.08
30.66
30.73
30.81
34.49
34.79
45.28
Table 6: A comparison of adversarially trained models (in columns) and attacks (in rows), with "CLEAN' and 'clean' respectively denoting standard training and standard accuracy. The 'Avg.' row shows the average of accuracies in that column. A column-win tisse comparison between RATE and ATA reveals improvement in standard accuracy and occasional compromise in robust accuracy, anticipated due to reduction randomness. However, adv. training with SEA attack under SRATE, offers superior robust accuracy across all attacks. obtained by BPTR, see Tab. 11 for BPTT vs. BPTR.]
6 CONCLUSION AND LIMITATION
Rate encoding is standard communication model of neurons that was discovered very early in neuroscience (Gerstner et al. 2014). In computational models spiking neurons, plays an important due to their biological plausibility and robustness properties. In the present work, we explore novel aspects of rate encoding by quantifying their randomness and consequently trying to reduce it, which leads to the signed rate coding. The signed rate encoding has biological plausibility due to its similarity with the excitatory and inhibitory neurotransmitters that help generate and suppress spikes. The proposed technique offers better convergence in training and improves clean accuracies. Further, the proposed computationally efficient and theoretically supported sparse adversarial attack in the encoding space shows the vulnerability of such network if the attacker has access the encoded input. Finally, adversarial training with encoding attack combined with signed rate encoding offers superior adversarial robustness, demonstrated by thorough empirical findings across three standard datasets. Despite its unique ad adversarial robustness properties and the proposed improvement in clean accuracy, there remains scope for further improvement achieving state-of-the-ee clean accuracy using rate-encoding models.
ACKNOWLEDGEMENT
This work is part of the research project "ENERGY-BASED PROBING FOR SPIKING NEURAL NETWORKS" performed at Mohamed bin Zayed University of Artificial Intelligence (MBZUAD, in collaboration with Technology Innovation Institute (TII) (Contract No. TII/ARC/2003/2021),
10

---

Published as a conference paper at ICLR 2025
REFERENCES
Filipp Akopyan, Jun Sawada, Andrew Cassidy, Rodrigo Alvarez-Icaza, John Arthur, Paul Merolla, Nabil Imam, Yutaka Nakamura, Pallab Datta, Gi-Joon Nam, et al. Truenorth: Design and tool flow of a 65 mw 1 million neuron programmable neurosynaptic chip. IEEE transactions computer-aided design of integrated circuits and systems, 34(10):1537-1557, 2015.
Srinivas Anumasa, Bhaskar Mukhoty, Velibor Bojkovic, Giulia De Masi, Huan Xiong, and Bin Gu. Enhancing training of spiking neural network with stochastic latency. In Proceedings of the AAAI Conference on Artificial Intelligence, volume 38, pp. 10900-10908, 2024.
Yoshua Bengio, Nicholas Léonard, and Aaron Courville. Estimating propagating gradients through stochastic neurons for conditional computation. arXiv preprint
2013.
Francesco Croce and Matthias Hein. Mind the box: (_1-apgd for sparse adversarial attacks on image classifiers. In International Conference Machine Learning, pp. 2201-2211. PMLR, 2021.
Mike Davies, Narayan Srinivasa, Tsung-Han Lin, Gautham Chinya, Yongqiang Cao, Sri Harsha Choday, Georgios Dimou, Prasad Joshi, Nabil Imam, Shweta Jain, et al. Loihi: A neuromorphic manycore processor with on-chip learning. leee Micro, 38(1):82-8 99, 2018.
Jia Deng, Wei Dong, Richard Socher, Li-Jia Li, Kai Li, and Li Fei-Fei. Imagenet: A large-scale hierarchical image database. In 2009 IEEE conference on computer vision and pattern recognition, pp. 248-255. leee, 2009.
Shikuang Deng, Yuhang Li, Shanghang Zhang, and Shi Gu. Temporal efficient training of spiking neural network via gradient re- re-weighting. arXiv preprint arXiv:2202.11945 2022.
Jianhao Ding, Tong Bu, Zhaofei Yu, Tiejun Huang, and Jian Liu. Snn-rat: dooustmess-ehhance spiking neural network through regularized adversarial training. Advances in Neural Information Processing Systems, 1-224780-24995 2022.
Wei Fang, Zhaofei Yu, Yanqi Chen, Tiejun Huang, Timothée Masquelier, and Yonghong Tian. Deep residual learning in spiking neural networks. Advances in Neural Information Processing Systems, 34:21056-21069, 2021.
Wulfram Gerstner, Werner M Kistler, Richard Naud, and Liam Paninski. Neuronal dynamics: From single neurons to networks and models of cognition. Cambridge University Press, 2014.
lan J Goodfellow, Jonathon Shlens, and Christian Szegedy. Explaining and harnessing adversarial examples. arXiv preprint arXiv:1412.6572, 2014.
Charles R Harris et al. Array programming with Numpy. Nature, 585(7825):357-36,,, 2020.
John D Hunter. Matplotlib: A 2d graphics environment. Computing in science & engineering, 9(3): 90-95, 2007.
Alex Krizhevsky, Geoffrey Hinton, et al. Learning multiple layers of features from tiny images. Master's thesis, University of Tront, 2009.
Ling Liang, Xing Hu, Lei Deng, Yujie Wu, Guoqi Li, Yufei Ding, Peng Li, and Yuan Xie. Exploring adversarial attack in spiking neural networks with spike-compatible gradient. IEEE transactions on neural networks and learning systems, 34(5):2569-255 2021.
Aleksander Madry, Aleksandar Makelov, Ludwig Schmidt, Dimitris Tsipras, and Adrian Vladu. Towards deep learning models resistant to adversarial attacks. In International Conference on Learning Representations, 2018.
Alberto Marchisio, Giacomo Pira, Maurizio Martina, Guido Masera, and Muhammad Shafique. Dvs-attacks: Adversarial attacks on dynamic vision sensors for spiking neural networks. In 202! International Joint Conference Neural Networks (IJCNN), pp. 1-9. IEFF, 2021.
11

---

Published as a conference paper at ICLR 2025
Bhaskar Mukhoty, Velibor Bojkovic, William de Vazelhes, Xiaohan Zhao, Giulia De Masi, Huan Xiong, and Bin Gu. Direct training of snn using local zeroth order method. In A. Oh, T. Naumann, A. Globerson, K. Saenko, M. Hardt, and S. Levine (eds.), Advances in Neural Information Processing Systems, volume 36, pp. 18994-19014 4. Curran Associates, Inc., 2023.
Bhaskar Mukhoty, Hilal AlQuabeh, Giulia De Masi, Huan Xiong, and Bin Gu. Certified adversar- ial robustness for rate encoded spiking neural networks. The Twelfth International Confer- ence on Learning Representations, 2024. URL 5bNYF0CqxY
net http:vviwwwnee/oruunmto forum?id
Yuval Netzer, Tao Wang, Adam Coates, Alessandro Bissacco, Baolin Wu, Andrew Y Ng, et al. Reading digits in natural images with unsupervised feature learning. In NIPS workshop deep learning and unsupervised feature learning, pp. 4. Granada, 2011.
Tianyu Pang, Min Lin, Xiao Yang, Jun Zhu, and Shuicheng Yan. Robustness and accuracy could be reconcilable by (proper) definition. In International Conference on Machine Learning, pp. 17258-17277. PMLR, 2022.
Adam Paszke, Sam Gross, Francisco Massa, Adam Lerer, James Bradbury, Gregory Chanan, Trevor Killeen, Zeming Lin, Natalia Gimelshein, Luca Antiga, et al. Pytorch: An imperative style, high-performance deep learning library, Advances in Neural Information Processing Systems, 32: 8024-8035, 2019.
Jeffrey Reback, Wes McKinney, et al. pandas-powerful data structures for data analysis, time series, and statistics. Zenodo, 025:257, 2020.
Saima Sharmin, Nitin Rathi, Priyadarshini Panda, and Kaushik Roy. Inherent adversarial robustness of deep spiking neural networks: Effects of discrete input encoding and non-linear activations. In Computer Vision-ECCV 2020: 16th European Conference, Glasgow, UK, August 23-28, 2020, Proceedings, Part XXIX 16, pp. 399-414. Springer, 2020.
Chawin Sitawarin, Zachary J Golan-Strieb, and David Wagner. Demystifying the adversarial robust- ness random transformation defenses. In International Conference on Machine Learning, pp. 20232 20252. PMLR, 2022.
Yujie Wu, Lei Deng. Guoqi Li. Jun Zhu, and Luping Shi. Spatio-temporal backpropagation for training high-performance spiking neural networks. Frontiers in neuroscience, 12:331, 2018.
12

---

Published as a conference paper at ICLR 2025
A APPENDIX
A.1 PROOF OF LEMMAS
Lemma 1. in eqn. 75
The solution defined per eqn. 16 is an optimal solution to the optimization problem
Proof. We will give proof by contradiction. Let assume, that given any [0,1)axT there exists, d such that z + δ E {0, 10.11 with (5, > (6.g). Now,
( (8, g)
8 99
(
((4
>
> 8, > ((0)
or (1)
<0 < 1
In the rest of the proof, we omit the notation for time-step assuming it is understood.
If gi > 0, 8 > 8G, we have,
0
8: =1 = 8 > = 8 = 8, + $ [0,1]
= = 8,30 = 8, , = 8 $ {0,
24 =
If gi < 0, 5 < 8, we have,
8, 0 = 8, <0 _ 8,+ <0
<,+ = 8, 2 {0
2, =
8, =-1 = 8, <1 - + - 5, + $ 10
2, =
As under all cases, we reach contradiction and prove that such å can exist.
Lemma 2. 8 obtained as per eqn. 17 is a maximizer of the optimization problem of eqn. 14
Proof. From Lemma we know, that for given g; there exists no 7(0) such that, 8, 9j 8,
(1)
Thus, for each coordinate i, we know that, 8( is an optimal choice. Let's assume there is another k-sparse vector, chosen from 8(()) according to गे such that,
8 my 9
However, this is impossible as π represents the sorting, 80 (+(() given by eqn. 17 is indeed an optimal solution. As the argument holds for any time-step 5* is an optimal solution.
9
(
0ng 982
(00) (2)
...
Ond Fas- Thus,
(t)
A.2 COMPARISON OF BUDGET FOR SIGNED RATE ENCODING
ExxaBer(x) [||z
&||o]
d
E,,,, |||2 Eollol = Σ
P(2 2. Σ (1 - (1-P(z; 2))
1=1
P(2: = 1,,, 1) P(z; 1, = -1) P(2 0, 0))
d
(1 xx (x: + +00++ - 27 (x: + 6,) - -1- [z -11-1=))(1 |r, + &1D)
1=1
x. (xx + 6,)+ 2, (z) + 8.) + | + (1 - (z.1) |2 &.1)
|x|||
+ (1 |x| xx 81) (xx
(x
+ 5) (x_ (x+
(22)
13

---

Published as a conference paper at ICLR 2025
A.3 ADDITIONAL RESULTS
To further strengthen the study, we include results for the aggregated model (Sitawarin et al. 2022
Z :.... zi (T) where, s.t. z Ber(x) with z, 2 {0. 1ja We report the test results using. 2i=1 h(z,), with
Mukhoty et al. 2024). Ze = [z (1)
(2)
10, approximating the smooth classifier, (zm-Ber(x)) [A]) The existing results reported earlier stands for m 1.
The adversarial attacks are performed using the loss function, over the aggregated classifier. For fgsm and pgd attack, now there is additional aggregation over m, that follows the back-propagationn pipeline. While for SEA, the encoding space becomes {0, 1 1]xx''xm where we have z; {0, 1) jxx
6, (-1,00 1, 1]dxT, and similar sparsity restrictions ||o!0 k.
Results reported in Table & shows improvement clean accuracies when compared 6 (uses 1), and attacks becoming stronger reducing robust accuracies in some cases. Despite aggregation improving attack strengths, SEA with SRATE offers superior robustness.
T=4, m=10
CIFAR-10, Rate Encoding
CIFAR-10, Signed Rate Encoding
ATTACK
CLEAN
GN
FGSM
PGD
SEA
CLEAN
GN
FGSM
PGD
SEA
clean
84.1
83.4
79.36
81.6
79.02
85.51
85.3
81.37
83.41
82.7
gn
83.61
83.38
79.4
81.43
79.15
85.25
85.2
81.41
83.38
82.62
igsm
40.06
39.84
49.19
50.39
40.89
40,43
40.43
51.76
49.37
51.91
pgd
33.27
32.88
43.96
43.72
34.03
32.96
33.12
45.17
43.3
45.17
sca, k=10
50.47
49.79
51.46
53.29
60.18
45.63
45.69
55.14
53.51
85.67
sea, k=
35.97
35.86
40.16
41.22
49.06
35.83
35.59
46.89
44.95
81.77
Avg
54.58
54.19
57.26
58.61
57.06
54.27
54.22
60.29
59.65
71.64
T=4, 10
SVHN, Rate Encoding
SVHN, Signed Rate Encoding
clean
91.98
92.07
91.84
92.12
90.60
93.41
93.58
93.40
93.42
90.89
gn
91.93
91.998
91.77
91.89
90.63
93.32
93.42
93.33
93.43
89.94
fgsm
44.58
44.9
50.29
48.11
41.81
44.00
43.87
49.85
48.16
71.72
Pgd
34.96
34.58
40.60
38,25
31.86
33.20
32.65
39.37
37.42
66.04
k=10
49.2
49.29
49.80
49.34
63.76
44.54
45,22
44.61
45.29
96.21
sea, k=20
31.58
31.68
31.52
31.28
40.05
33.29
33.88
32.22
33.60
93.14
Avg
57.37
57.42
59.30
58.50
59.79
56.96
57.10
58.80
58.55
84.66
T=4, m=10
CIFAR- 100, Rate Encoding
CIFAR 100, Signed Rate Encoding
clean
55.09
55.33
50.15
50.2
49.93
58.17
58.53
53.19
55.18
55.16
gn
55.08
55.01
50.66
50.22
49.51
58.29
58.39
53.37
54.8
54.7
fgsm
26.47
26.69
29.83
33.35*
25.3
26.61
26.82
32.37
33.23
31.78
Pgd
18.47
18.66
24.79
28.09
18.66
18.55
18.79
27.55
27.03
25.16
sea, k=10
34.4
34.76
32.25
34.63
33.91
31.96
31.76
34.19
35.15
64.73
sea, k=20
27.2
27.35
27.51
29.85
28.9
24.52
24.65
30.01
30.45
61.45
Avg
36.12
36.30
35.87
39.16
34.37
36.35
36.49
38.45
39.31
48.83
Table 8: Inference performed using aggregation of model output with respect to input noise with m 10, the attacks updated accordingly. Similar to Tablo the results show improvement offered by SRATE, along with effectiveness SEA method in adversarial training. obtained by BPTR, as the is lower than BPTT.
Dataset
Encoding
Input
CIFAR-I0 10
RATE
0.480
0.116
0.075
0.026
0.023
0.015
0.009
0.013
0.025
0.036
0.023
SRATE
0.220
0.155
0.089
0.026
0.026
0.066
0.008
0.013
0.028
0.041
0.025
CIFAR
0,480
SRATE
0,230
0.167
0.161
0.048
0.049
0.033
0.020
0.035
0.060
0.047
0.070
SVHN
RATH
0.460
0.163
0.054
0.021
0.018
0.009
0.003
0.007
0.025
0.038
0.027
SRATE
0.200
0.184
0.070
0.018
0.028
0.042
0.031
Table 9: Table reports the layer-wise spiking rate of the neurons for different datasets VGGSNN architecture. It can be observed that SRATE offers lower average sparsity.
14

---

Published as a conference paper at ICLR 2025
116
CANTMrT CLSATINNTE SCAURATII
SCAPREE SCANSAATTE
0.58 600
Thainin Accurscy
Tesn Accuuayy
CLEANIATT CLEAN
250
10-
Epocts
Epochs
Epochs
SSA/AATI)
Triniig ACCUrDCY
Test Accuraay
SA WIATE SOUUTE SEAUSATE)
E. LLFANARATES CLEANOAATEE
SEAUSWITT
360
175
Epocts
Pporhs
Eporhs
Figure 5: Comparison between rate encoding and signed rate encoding over training epochs reporting training loss, training accuracy and test accuracy for CIFAR- -00 (top) and SVHN (bottom).
A.4 TRAINING DETAILS
We list the specific hyper-parameters used to train our models in Tab. 10 SEA on SVHN dataset, we use k for SRATE, but for RATF, as RATE does not converge
For adversarial training with
on k 5.
Table 10: Training and testing hyper-parameters
UIFAR-10/100
ImageNet-100
SVHN
Number epochs
200
200
200
Mini batch size
128
128
128
T
4,6,8,10"
4
4
LIF:
0.5
0.5
0.5
LIF: up
LIF: uya
Learning Rate
0.1
0.1
0.1
GN/FGSM/PGD (train):
8/255
2/255
GN/FGSM/PGD (test):
8/255
8/255
8/255
SEA (train):
na
2,
SEA (test):
10, 20
10, 20
10, 20
PGD (train): 77
2/255
1/255
PGD (test): 7
2/255
2/255
2/255
PGD (train) Iteration
PGD (test) Iteration
Optimizer: SGD with momentum: 0.9, weight decay: 5 x 10-1, rate Scheduler: cosine annealing
A.5 SOFTWARR
The following a list of the main libraries used in this work:
Numpy Hamris et al. 2020
Pytorch Paszke et al. 2019)
Matplotlib (Hunter 2007
Pandas (Reback et al. 2020
We thank the creators and contributors of these open-source libraries for their contributions.
15

---

Published as a conference paper at ICLR 2025
T=
CIFAR- 10, Rate Encoding (RATE)
CIFAR-10, Signed Rate Encoding (SRATE)
ATTACK
CLEAN
GN
FGSM
PGD
SEA
CLEAN
GN
FGSM
PGD
SEA
fgsm-bptt
44.83
44,35
53.93
53.16
42.31
44.3
43.59
55.1
53.81
56.58
fgsm-bptr
58.52
57.69
66.8
63.45
59.97
55.3
54.89
61.95
60.87
64.28
Pgd-bptt pgd-bptr
38.87
38.41
49.68
48.83
37.19
36.88
37.03
50.21
48.47
51.87
54.89
53,69
65.15
60.46
57.05
48.97
50.04
58.73
57.39
60.51
T=4
SVHN, Rate Encoding (RATE)
SVHN, Signed Rate Encoding (SRATE)
fgsm-bptt
44.09
44.15
50.26
48.33
41.94
43.37
44.06
49.94
48.23
67.57
fgsm-bptr
61.37
59.01
64.11
62.57
59.11
60.31
59.58
67.01
65.55
72.47
Pgd-hptt Pgd-hptr
38.82
38.77
45.00
43.31
35.82
35.46
35.43
42,45
40.53
65.76
60.61
57.66
62.79
61.56
57.06
55.58
54.99
64,92
62.31
71.76
T=4
CIFAR-100, Rate Encoding (RATE)
CIFAR 100, Signed Rate Encoding (SRATE)
fism-bptt fgsm-bptr
22.21
21.92
28.45
37.8
20.53
22.33
22.11
30.81
29.7
31.38
27.82
28.16
32.53
30.27
28.02
26.81
28.61
33.67
33.9
34.92
pgd-bptt 18.53
18.6
26.08
35.93
17.99
18.44
18.78
28.22
27.04
27.08
pgd-bptr
25.16
24.92
30.45
27.79
25.13
23.78
24.96
30.64
31.75
32
Table 11:
Comparison between BPTT and BPTR attack shows BPTT offers stronger attack in all cases except for CIFAR-100, where in PGD adversarial training, BPTR constructs a stronger attack than BPTT, highlighted in bold.
T=6
T=8
T=10
CLEAN
RATE
SRATE
RATE
SRATE
RATE
SRATE
clean
82.22
84.41
83.41
85.41
84.21
86.34
gn
81.3
84.14
83.47
85.42
83.76
85.65
fgsm
42.87
42.3
41.37
41.58
39.89
39.81
pgd
35.42
33.46
32.94
32.38
30.73
30.2
sea, k=10
46.28
42.38
48
43.06
47.54
44.05
k=20
31.61
30.79
33.02
31.39
33.31
32.97
Table 12: Improvement in standard accuracy offered by signed rate encoding across different latency, observed in training CLEAN model CIFAR-10 dataset. We train separate models handle inference latencies, which can be replaced by single model following Anumasa et al. (2024).
16

---

Published as a conference paper at ICLR 2025
CLEAN
FGSM
PGD
SEA
CLEAN
FGSM
PGD
SEA
69.6
67.53
68.18
70.23
66.78
67.43
67.81
79.99
61.29
60.77
61.14
65.78
56.63
60.45
60.27
81.03
6
54.89
55.55
55.51
61.75
49.23
55.92
55.32
81.21
48.64
50.54
51.01
58.19
44.08
52.61
51.44
80.97
33.54
38.39
38.51
47.75
32.3
42.9
41.56
77.6
32
19.88
26.17
26.27
33.75
22.99
35.61
33.91
69.31
64
11.64
16.93
17.98
20.74
17.03
29.58
27.83
53.26
255
CLEAN
FGSM
PGD
SEA
CLEAN
FGSM
PGD
SEA
71.67
71.19
72.15
68.16
73.86
73.09
74.44
74.51
63.27
65.53
66.29
60
64.41
67.78
67.95
68.72
53.66
59.42
60.03
51.47
$4.09
60.99
60.41
62.23
44.6
53.67
53.63
42.04
44.33
55.01
53.81
56.01
16
16.8
32.7
30.83
16.72
20.04
35.32
32.25
33.7
32
3,33
10.66
12.38
4.27
8.75
18.85
17.26
13.85
64
4.94
8.48
9.42
5.16
7.88
14.32
13.45
10.23
255
CLEAN
FGSM
PGD
SEA
CLEAN
FGSM
PGD
SEA
70.98
70.15
70.78
66.88
72.75
72.21
73.3
73.06
59.36
62.21
63.11
56.52
59.9
64.53
63.99
64.67
47.7
55.53
55.14
45.76
46.51
56.77
54.96
56,84
38.33
49.17
48.76
36.94
36.74
51.01
48.47
50.82
16
23,85
39.11
38.04
22.74
22.56
39.45
36.42
40.34
32
17.04
33.03
31.23
16.99
17.6
34.05
30.7
33.31
64
10.93
25.04
24.04
11.99
12.55
25.93
23.6
23.03
Table 13: Corresponding to figure aa), (b) and (c) comparing different models from Tab. 6 under SEA (top), FGSM (middle) and PGD (bottom) attacks for different attack radius. Adversarial training with SEA under SRATE is found to offer the highest robustness across different attacks.
2
6
16
32
64
fgsm (RATE)
2.33
4.75
7.24
9.8
20.62
45,69
111.59
pgd (RATE)
2.38
4.93
7.44
9.79
17.09
27.82
54.01
fgsm (SRATE)
0.72
1.54
2.58
3.95
13.6
52.67
195.98
pgd (SRATE)
0.71
1.49
2.27
3.04
6.19
19.39
70.72
Table 14: sea budget & comparable obtained by finding 5 through fgsm and pgd attack performed on CLEAN (RATE) and CLEAN (SRATE) models, as reported in 4
17


Reviews:
[{"review_id": "kRYk4Iyy7t", "reviewer": "Reviewer_2rdR", "summary": "This paper aims to explore an input encoding that balances the robustness and generalization on clean input of the model. The authors propose the signed rate encoding (SRATE) method that improves the accuracy of the model. In addition, they also introduce the sparse encoding attack on the SRATE input. Through theoretical analysis and experiments on datasets like CIFAR-10 and CIFAR-100, the authors demonstrate that SRATE improves generalization, while adversarial training with SEA offers superior robustness compared to traditional methods.", "questions": "Sparsity is a critical feature in neural systems, offering benefits in terms of computational efficiency and reduced energy consumption. Given that this model is based on rate encoding, I wonder whether the model with SRATE encoding also leverages these advantages? \n\nIt would be valuable to know if the authors considered using the Expectation Over Transformations (EOT) method for adversarial attacks, especially since EOT is an effective approach to deal with models that incorporate randomness.", "limitations": "", "rating": 8, "confidence": 5, "soundness": 3, "presentation": 4, "contribution": 3, "strengths": "The proposed method utilizes the rate-coding input, which is not only more bio-plausible but also provides inherent advantages in robustness and sparsity, distinguishing it from models that rely on constant input encoding methods.\n\nThe authors provide a solid theoretical basis for the SRATE, demonstrating that it preserves the essential characteristics of Poisson input encoding while effectively reducing randomness. \n\nThe authors proposed a novel attack method, offering a solution for finding optimal adversarial examples under binary and sparsity constraints.", "weaknesses": "One drawback of this method is its relatively low accuracy on clean inputs, with even the non-adversarially trained model achieving only ~55% accuracy on the CIFAR-100 dataset. The significant drop in clean accuracy may not justify the robustness gains, which raises the questions about the effectiveness of this approach, particularly when other methods (e.g. adversarial training) may offer a better balance between performance and robustness.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "jbvQERx1ow", "reviewer": "Reviewer_iqc1", "summary": "The authors propose a signed rate encoding (SRATE) method that enables mean-centering of the input, reducing the randomness introduced by traditional rate encoding. This approach improves clean accuracy and enhances the generalization of rate-encoded spiking neural networks (SNNs).", "questions": "In the method section, is the encoding applied only to convert images to spike inputs, or does it also occur within spiking neurons in the network?\n\nHow could this technique be adapted for use with event-based datasets?\n\nIn Section 4.1, why does the attack rely on a first-order approximation rather than directly using the loss? What would happen if the direct loss were used instead?\n\nIn Figure 4 and Table 5, there are inconsistent notations (e.g., lowercase \"fgsm\" and uppercase \"FGSM,\" similarly for \"pgd\" and \"PGD\"). Do these represent different methods, or is this just a formatting inconsistency?\n\nHow are FGSM and PGD applied to rate-based models in this study?", "limitations": "", "rating": 6, "confidence": 5, "soundness": 3, "presentation": 2, "contribution": 3, "strengths": "The paper is well-structured and easy to follow.\nThe performance results show improvement with the proposed method.", "weaknesses": "Some details require further clarification.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "v768x06cXV", "reviewer": "Reviewer_rMY3", "summary": "This paper proposes a new encoding method for SNN input, called Signed Rate Encoding (sRATE), which is experimentally shown to reduce the randomness of encoded inputs through statistical analysis. Additionally, the paper introduces a Sparse Encoding Attack (SEA).", "questions": "My primary concerns are outlined in the Weakness section. The following points are related to writing improvements and do not affect my overall rating.\n\nQ1. As mentioned in W1, I believe the $x$ in Section 3.2 should actually be $x-\\mu$, since $x$ could otherwise be negative. However, the authors did not clarify this point.\n\nQ2. It seems unnecessary to define 'the positive and negative part' of a real number (Lines 197-199). For the sake of simplicity and readability, I believe it would be clearer to directly use piecewise linear functions instead, as this would make the formulation easier to follow.\n\nQ3. The use of the same notation $k$ for different concepts is somewhat confusing. For instance, $k$ is used to represent randomness in Section 3, but it also denotes the sparsity of perturbations in Section 4.2 and the experiments.\n\nQ4. The legend in Figure 4 is unclear, as it is difficult to distingusih between the dashed and solid lines in the legend.", "limitations": "", "rating": 5, "confidence": 4, "soundness": 2, "presentation": 2, "contribution": 2, "strengths": "S1. The sRATE is newly proposed and the analysis from randomness reduction is good.\n\nS2. Authors conduct extensive experiments in evaluating the difference between RATE and sRATE SNNs, including adversarial training with various attacks.", "weaknesses": "W1. The theoretical analysis needs improvement. From the current analysis, it is unclear why sRATE (Eq. 12) reduces randomness compared to RATE (Eq. 9). Both x and $|x-\\mu|$ (I believe the $x$ in Eq. 12 is actually $x-\\mu$, though this is not explicitly stated in Section 3.2) belongs to [0,1], meaning that the actual ranges of $k1$ and $k2$ are the same. It is the experimental results (Table 1) that demonstrate the advantages of sRATE, which weakens the motivation behind the sRATE design.\n\nW2. The novelty of the proposed SEA method seems limited. If I understand correctly, the solution in Eq. (16) appears to be a straightforward application of the FGSM attack to RATE/sRATE encoded inputs. The idea of selecting $k$ elements based on the top $k$ gradients in the SEA method is fairly straightforward. I am also somewhat confused by the results—since the perturbations generated by SEA can be considered a subset of those generated by FGSM (with SEA essentially removing some of the perturbations from the FGSM attack), it is unclear why SEA outperforms FGSM, as shown in Table 5.\n\nW3. The writing could be improved. In my view, Lemma 1 and Theorem 2 present concepts that are fairly straightforward, and it may not be necessary to dedicate much space to them in the main text. Other writing-related comments (which do not affect my overall rating) are summarized in the Questions section.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}]

Author rebuttal:

Decision: Accept (Poster)