Robust Spiking Neural Networks Against Adversarial Attacks
Authors: Shuai Wang
Malu Zhang
Yulin Jiang
Dehao Zhang
Ammar Belatreche
Yu Liang
Yimeng Shan
Zijian Zhou
Yang Yang
Haizhou Li
Venue: ICLR 2026 Poster (2026)
Keywords: Spiking Neural Networks
Rubustness
Primary area: applications to neuroscience & cognitive science

Abstract: Spiking Neural Networks (SNNs) represent a promising paradigm for energy-efficient neuromorphic computing due to their bio-plausible and spike-driven characteristics. 
However, the robustness of SNNs in complex adversarial environments remains significantly constrained. In this study, we theoretically demonstrate that those threshold-neighboring spiking neurons are the key factors limiting the robustness of directly trained SNNs.
We find that these neurons set the upper limits for the maximum potential strength of adversarial attacks and are prone to state-flipping under minor disturbances. To address this challenge, we propose a Threshold Guarding Optimization (TGO) method, which comprises two key aspects. First, we incorporate additional constraints into the loss function to move neurons' membrane potentials away from their thresholds. It increases SNNs' gradient sparsity, thereby reducing the theoretical upper bound of adversarial attacks. Second, we introduce noisy spiking neurons to transition the neuronal firing mechanism from deterministic to probabilistic, decreasing their state-flipping probability due to minor disturbances. Extensive experiments conducted in standard adversarial scenarios prove that our method significantly enhances the robustness of directly trained SNNs. These findings pave the way for advancing more reliable and secure neuromorphic computing in real-world applications.

Published as a conference paper at ICLR 2026
ROBUST SPIKING NEURAL NETWORKS AGAINST ADVERSARIAL ATTACKS
Shuai Wang'. Malu Zhang'.2 13, Yulin Jiang' Dehaao Zhang's Ammar Belatreche", Yu Liang', Yimeng Shan' 1 Zijian Zhou', Yang Yang', Haizhou Lis.4.
University of Electronic Science and Technology of China Northumbbria University, 3 "hhenzhen Loop Area Institute, "The Chinese University of Hong Kong, Shenzhen.
ABSTRACT
Spiking Neural Networks (SNNS) represent a promising paradigm for energy- efficient neuromorphic computing due to their bio-plausible and spike-driven characteristics. However, the robustness of SNNs in complex adversarial environ- ments remains significantly constrained. In this study, we theoretically demonstrate that those hhreshold-neighooriie robustness of directly trained SNNs. We find that these neurons set the upper limits for the maximum potential strength of adversarial attacks and are prone to state-flippng under minor disturbances. To address this challenge, we propose Threshold Guarding Optimization (TGO) method, which comprises two key aspects. First, we incorporate additional constraints into the loss function to move neurons' membrane potentials away from their thresholds. It increases SNNs' gradient sparsity, thereby reducing the theoretical upper bound of adversarial at- tacks. Second, we introduce noisy spiking neurons transition the neuronal firing mechanism from deterministic to probabilistic, decreasing their state-flipping prob- ability due to minor disturbances. Extensive experiments conducted in standard adversarial scenarios prove that our method significantly enhances the robustness of directly trained SNNs. These findings pave the way for advancing more reliable and secure neuromorphic computing in real-world applications.
spiking neurons are the key factors limiting the
INTRODUCTION
Spiking Neural Networks (SNNs) Maass 1997 Gerstner & Kistler 2002; Izhikevich, 2003 Masque
lier et al., 2008) mimics biological information transmission mechanisms using discrete spikes as the medium for information exchange, representing the cutting edge of neural computation (Cao) et al.] 2020 Varghese et al.] [2016]. Spiking neurons fire spikes only upon activation and remain silent otherwise. This event-driven mechanism (Liu & Yue (2018) promotes sparse synapse operations and avoids cultiply-accummlaan (MAC) operations, significantly enhancing energy efficiency on neuromorphic platforms (Pei et al. 2019; DeBole et al.) 2019 Ma et al. 2024 Pei et al., 2019). Recently, directly training SNNs with surrogate gradient methods (Wu et al.
2019 Deng et al.) 2022 ei al. 2021 Wang et al. 2025a) has significantly reduced their performance gap with ANNS
2018
in classification tasks (Yao et al. [2024a] Shi et al.] 20244) Zhou et al., 2024 Wang al.] 2025c
Liang et al. (025). However, these directly trained SNNs rely on Backpropagation Through Time
(BPTT) (Werbos]] 1990), thereby inheriting significant robustness issues associated with ANNs.
Directly trained SNNs (Fang et al. 2021b Zhou et al., 2023 Bu et al. 2022 Duan et al. 2022) using
surrogate gradient methods often exhibit a strong dependency on specific patterns or features (Ding et al., 2022] Mukhoty et al.) 2024). rendering them particularly sensitive to minor disturbances.
This characteristic reduces robustness in complex environments, especially against finely crafted adversarial disturbances (Laskov & Lippmann| 2010). To enhance the robustness of SNNs against adversarial attacks, researchers adapt strategies from ANNs, such as adversarial training (Ho et al.) 2022 Ding et al. (022)) and certified training (Zhang et al. 2019 Liang et al. 2022). Furthermore, researchers develop optimization methods tailored to spike-driven mechanisms, integrating with
"Corresponding author; maluzhang@uustcceddee

---

Published as a conference paper at ICLR 2026
adversarial training to enhance robustness. Some researchers (Sharmin et al.
2020 Ding et al. 2023
El-Allami et al.) 2021) utilize the temporal characteristics of SNNs to counteract environmental white noise attacks. Additionally, Evolutionary Leak Factor (Xu et al.
2024), MPD-SGR Jiang
et al. (2025) and gradient sparsity regularization (SR) (Liu et al. 2024) significantly enhance the
robustness of SNNs against gradient-based attacks. However, a comprehensive and unified analysis of the robustness bottlenecks in directly trained SNNS remains lacking.
In this study, we theoretically demonstrate that threshold-neighboringg spiking neurons are a key factor influencing the robustness of directly trained SNNs under adversarial attacks. We find that these neurons provide maximum potential pathways for adversarial attacks and are more prone to state-fipping under minor disturbances. To address this, we propose Threshold Guarding Optimization (TGO) method. The TGO method aims to: (1) maximize the distance between neurons' membrane potentials and their thresholds to enhance gradient sparsity: (2) minimize the probability of state-flppiig neurons under minor disturbances. series of experiments in standard adversarial scenarios demonstrates that our TGO method significantly enhances the robustness of directly trained SNNs. The contributions of this work are summarized as follows:
We theoretically demonstrate that those hureshold-neighborte spiking neurons are critical in limiting the robustness of directly trained SNNs under adversarial attacks. These neurons set the upper limits for the maximum potential strength of adversarial attacks and are prone to state-flippngg under minor disturbances.
We propose a Threshold Guarding Optimization (TGO) method, aiming minimize hhreshold-neighboriig neurons' sensitivity to adversarial attacks. First, we integrate ad- ditional constraints into the loss function, distancing the membrane potential from the threshold. Second, we introduce noisy spiking neurons to transit neuronal firing from deter- ministic to probabilistic, reducing the probability of state flips due to minor disturbances.
We validate the effectiveness of the TGO method across various adversarial attack scenarios using different training strategies. Extensive experiments demonstrate TGO method achieves -tate-of-the-art (SOTA) performance in multiple adversarial attacks, significantly enhancing the robustness of SNNs. Notably, TGO method incurs no additional computational overhead during inference, providing a feasible pathway toward robust edge intelligence.
2 RELATED WORK
Spiking Neural Networks: SNNs offer a promising solution for resource- resource-constrained edge com- puting (Zhang et al. 2023). To enhance the performance of SNNs, Wu al. (0188) introduces the spatial-temppral backpropagation (STBP) algorithm. an adaptation of BPTT from Recurrent Neural Networks (RNNs) (Graves & Graves 2012 [ipton| 2015). This method uses surrogate functions to approximate the non-differentiable Heaviside step function in spiking neurons. Additionally, researchers explore parallel training strategies (Fang et al., 2024) within the ResNet framework (He
et al. 2016), shortcut residual connections (Zheng et al. 2022 Hu et al. 2021 Lee al. 2020 Fang ct al. achieved performance comparable to their ANN counterparts across diverse vision tasks, including image classification (Yao et al. 2024a Xiao et al. 2025), object detection ( (Wang et al.) 2025b),
202 la Zhang et al. 2025b). and Spike transformer (Li et al. 2022). Notably, SNNs have
Event tracking (Shan et al., 2025) and semantic segmentation (Zhang et al. 2025a).. Despite surrogate gradient methods (Deng et al. 2023 Yang & Chen (023) significantly improve training efficiency,
SNNs remain susceptible to adversarial attacks ANNS (Finlayson et al. 2019 Xu et al. 2020).
limiting their applicability in adversarial environments.
Robustness of SNNs in Adversarial Attacks While biologically event-driven mechanisms Marcch sio et al. 2020 Hao et al. 2020) enhance SNNs' adaptability in complex environments, empirical studies (Liang et al. 2021 Hl-Allami et al., 2021) reveal that directly trained SNNs remain vulnerable to adversarial attacks. Initial efforts to mitigate this vulnerability start with adapting Adversarial Training (AT) (Goodfellow et al. 2014 Kundu et al. 202I) and subsequently advance to Regularized Adversarial Training (RAT) (Ding et al. (022) with Lipschitz analysis. However, these approaches are constrained by additional training overhead and limited portability (Shafahi et al. 2019). Recently, researchers have developed optimization methods tailored to spike-driven mechanisms of SNNs. Such as Hao et al. (2023) enhances intrinsic robustness through rate-temporal information integration. (Xu et al. 2024) introduces FEEL-SNN with random membrane potential decay and innovative
2

---

Published as a conference paper at ICLR 2026
encoding mechanisms, and Ding al. 2024b) develops gradient SR to strengthen defenses against Fast Gradient Sign Method (FGSM) Goodfellow et al. 2014) and Projected Gradient Descent (PGD) (addry] 2017). Despite these advances, these strategies achieve significant enhancements only through synergistic integration with AT' and RAT strategies. Moreover, a theoretical analysis of SNNs' inherent vulnerabilities in adversarial environments is still lacking. Thus, devising more effective robustness optimization strategies for SNNs remains a focused research.
3
PRELIMINARIES
3.1 SURROGATE GRADIENT FOR DIRECT TRAINED SNNS
SNNs effectively model the complex dynamics of biological neurons. Within the Leaky Integrate- and-Fire (LIF) framework, the membrane potential transitions through three key stages: integration, leakage, and firing. During integration, the membrane potential V(( accumulates over time in response to incoming spikes. When Vttl exceeds predefined threshold Vth. it triggers a spike that may influence downstream neurons. Following the spike, the membrane potential is reset to specified baseline Vreset, preparing the neuron for subsequent inputs, which can be described as:
Vit] TUit 1] + W
S[1] = + (V Vat.)
U - where r is the membrane time constant, W represents the synaptic weights, S14 denotes the spike time t, and ((-) is the Heaviside step function, indicating firing when V|t exceeds Vaa In the directly trained SNNs, the total loss L with respect to the weights W can be described as:
(1-5(() (1- + ST,,
(3)
ØL OW
ØL @1 [
Σ
as OV Ow
where σर represents the gradient of non-differentiable step function involving the derivative of the Dirac ô-function, which is typically replaced by surrogate gradients with derivable curves.
0S
Various forms of surrogate gradients have been utilized, such as rectangular (Wu et al.] 2018 2019). triangular (Esser et al., 2016; Rathi & Roy| 2020), and exponential (Shrestha & Orchard 2018 curves. Surrogate gradients provide a diffcrentiable approximation to non-differentiable functions.
3.2 ADVERSARIAL ATTACKS
Adversarial attacks, including the Fast Gradient Sign Method (FGSM) (Goodfellow al. 2014)and Projected Gradient Descent (PGD) (Madry) (017). rely on the model's 's gradient information to craft adversarial examples. FGSM generates such examples by applying a single-step perturbation designed to maximize the model's prediction error. The adversarial input is calculated as:
Xadv = x' + si Btne))
(5)
where Xadv is the adversarial example, is the original input, is the perturbation magnitude, C(x, Ymme) is the loss function, and V,,n(V (yme)) gives the sign of the gradient concerning the input. This process leverages the model's 's loss landscape to introduce minimal disturbances that significantly increase the classification error. Building on this, PGD iteratively refines adversarial examples by applying gradient updates and projecting them back into a bounded e-ball centered on the original input. The attack rule of PGD can be expressed as:
(+1 Clip,,e (xaav + a hign(V..[(e (x Mrree))
where x the adversarial example at iteration perturbation remains within the prescribed e-ball. PGD employs a multi-step approach to more precisely explore the disturbance space, producing adversarial examples closer to the optimal solution. At the same time, it strictly constrains the magnitude of disturbances, ensuring the perturbed input remains nearly indistinguishable from the original data to human observers. Multi-PGD improves robustness evaluation by reducing sensitivity to initialization and increasing the likelihood of finding stronger adversarial examples. APGD PGD) automates and stabilizes the attack by adaptively adjusting hyperparameters such step size and scheduling, enabling consistently strong performance with minimal manual tuning. These two methods serve as standard benchmarks for evaluating the adversarial defense capabilities of neural networks.
the step size, and Clipx,c ensures that the
3

---

Published as a conference paper at ICLR 2026
4 METHODS
4.1 ROBUSTNESS ANALYSIS OF DIRECTLY TRAINED SNNS
To explore the key factors affecting the adversar- ial robustness of SNNs, conduct detailed analysis the SNNs' dynamic properties un- der adversarial attacks. Our findings highlight two critical vulnerabilities associated with those threshold-ne threshold-neighborinng spiking neurons. First, they establish theoretical upper bound for the maximum potential strength of adversarial at- tacks. Second, they exhibit higher probability of state-fipping under minor disturbances.
Vin
V(
t
f2
VER
ViD
maximum potential gradient-based attack path: Adversarial attacks strategically modify input disturbances to maximize the expected loss, with these disturbances typically aligning with the gradient of the input data. The metric Rav ff, x, c) quantifies the maximum potential strength of an adversarial attack the neural network f at a specific input x, where the dis- turbances are constrained within unit ly-norm ball and scaled by the factor e. This measure is mathematically expressed as follows:
Origin
t D::eeollaizztton
Hyper
Figure 1: Red traces represent membrane potential dynamics of spiking neurons under adversarial at- tack. Only membrane potentials near thresholds undergo spike pattern transitions, while others re- main unchanged.
Rad (,, max
[[ ed) f())
1
7 aims to find the disturbance that maximizes the squared output difference while remaining within an -n-norm ball. Applying Taylor expansion with the Lagrange remainder, we expand it as follows:
60)= f(x) + (e5) + (e5)²
2 Hy(x + EEd)-
(8)
where & E (0,1) serves as the expansion coefficient. Let f R8 - R be continuously differentiable neural network function at point æ, and let > 0 be sufficiently small. The matrix (x) and (x) respectively denote the Hessian and Jacobian matrix of the function f(-) at point æ.
Utilizing the Cauchy-Schwar Schwarz inequality Steele 2004 and assuming that || lp 1, the upper bound of the difference caused by the minor disturbance can be expressed as:
[s + 66) - ((x))1 < (11J,(00)1l++ 2 Amma
Eq represents the sensitivity of f at ir to disturbances along 8. [x)())]] is the & norm of the Jacobian matrix, and Ammax is the maximum eigenvalue of (z) Then, we derive the upper bound on the Radv:
Rad (,),,,) 2 +(2).
(10)
The Jacobian matrix (,) can be expressed as the collection of gradients of each component of the function:
|| (x) = Asmax
Σ V((
(11)
According to 11 the sensitivity of SNNs to adversarial disturbances is correlated with the &g norm of their Jacobian matrix, where higher gradient & norms indicate greater susceptibility to adversarial attacks. Notably, directly trained SNNs typically rely surrogate gradients, which exhibit peak values near the threshold. As the number of threshold-neipe neiisbod-n spiking neurons increases, the l norm of the gradients in SNNs also rises, thereby enlarging Rad (f, x, e). Consequently, these neurons significantly raise the theoretical upper limit of adversarial perturbation strength. Details can be found in Appendix
B
4

---

Published as a conference paper at ICLR 2026
Strong State-flipping Probability: Adversarial attacks introduce carefully crafted small disturbances into the input data, achieving their disruptive effects. These disturbances propagate through the multi-layers, causing state-flipping in spiking neurons and ultimately altering the final output. Due to the spike-driven nature, changes occur only when spiking neurons' membrane potential crosses the threshold.
Theorem Let Vtt] be the membrane potential, Vth the threshold, and n/t] (0, random perturbation. The probability Pmip of each neuron's 's flipping is given by:
Vis Vin-Vid
VV 2 Vaa
Piip
(
1
VIn
V < Van-
where O denotes the cumulative distribution funnciootionnuuccionn (CDF) of the standard normal distribution.
Theorem T defines the relationship between neuronal membrane potential and their state- cate-flipping probability. Specifically, when Vi]] 2 Veh. the neuron output switches from 1 to O, and when V[U < Vih. it flips from 0 to 1. Since the CDF of the standard normal distribution o(-) is increasing monotonically, Phip increases the membrane potential V[t] approaches the threshold potential Van- whether Vit] is above or below As shown in Fig. [ small noise perturbations mainly cause state flips in neurons near the threshold, while fluctuations elsewhere have little effect spike outputs. Therefore, state flipping directly increases the instability of activation patterns, and its impact on the upper bound of adversarial attacks is summarized follows.
Theorem For a discrete spike pattern mapping f : R R"" small perturbations εó around input x induce finite set of activation pattern transitions. The adversarial robustmess upper bound can be approximated as:
Rado 2, S =² ISRSK
||
where K denotes the number of activation regions intersecting the perturbation ball Be(x), and AA, E RRmx is the affine transformation matrix for activation pattern A ((I, ux(x) 2 0,).
Theorem 2 proves that a larger K expands the set of possible transformations (represented by affine matrices AAa), thereby increasing the potential impact of adversarial perturbations on the system. As the proportion of threshold-near neurons increases, K grows, leading to heightened adversarial vulnerability. summary, neighhooni spiking neurons play a crucial role in the adversarial robustness of SNNs. To address this, we propose optimization strategy designed to mitigate their impact, thereby strengthening the overall resilience SNNs in adversarial environments.
4.2
THRESHOLD GUARDING OPTIMIZATION METHOD
4.2.1
MEMBRANE POTENTIAL CONSTRAINTS
The surrogate gradients of threshold- neighbbrinn spiking neuron, significantly influence the (1] [| of SNNs. To mitigate this effect, we propose additional constraints each spiking neuron layer to optimize the membrane potential distribution, ensuring it remains as distant as possible from the threshold. The membrane potential constraint function can be described as:
1 C(V(+)) = TN Σ (0, 5 IV(t): - Vn,
(12)
((V(t)) computes the average quadratic penalty when membrane potentials V (t),, of neurons in layer 1 approach the firing threshold Vin N and 7 represent the number time steps and the total number of layers in the SNNs, respectively. The hyperparameter 8 establishes a margin around Vth where proximate potentials incur proportional penalties. Subsequently, we integrate this constraint with the target loss function, defining the overall loss within the framework of Lagrangian constraints (Kim & 2023), which can be expressed as:
Jeong 2021
Yoo & Jeong
L(x, A) = Loss(x) + A Σ c(V())))
(13)
5

---

Published as a conference paper at ICLR 2026
Miversattal Attads
Belare Attock Label Dog
Mily (HHO))
+
+
Label
Probdatte
Laluui Cat
Input Image
Inpat Image "Dog"
Progagatios
Barkoand Propagation
Moise
After Attack
Response of Membrane potentaa
Membraae potuetaal Constraint
Vanilla ui Neuron
Flipping Probability
Origin
Vi
+222
Nouse LiF Neuron
Sirti-Fiyciur Probubiiit
10
Molse
T.
Whe
Ours
Spiie Global Optima Solution
L1: Turget Function
Constraint Furction
Spotial Imput
Temporal Input
Neisa Input
Figure 2: Mechanism and working principle of the TGO method. (a) The TGO method combines membrane potential constraints with noisy LIF neuron models for adversarial defense. (b) Gradient- based adversarial attacks illustrate how disturbances affect input images. (c) The joint optimization of the objective and constraint functions drives neuron membrane potentials away from the firing threshold. (d) The noisy LIF model effectively reduces the probability of state flips caused by small input disturbances, enhancing model stability.
Here, Loss(x) is the original loss function, C(V(t))) represents the penalty term for the membrane potentials across all layers, and is a dynamically adjusted parameter that controls the significance of the constraint. We reveal that using fixed magnitude for À hinders network convergence and constraint satisfaction. Specifically, a larger À leads to significant performance degradation and poor convergence during the initial training phase, while smaller À fails to enforce the constraint effectively. Therefore, to achieve an optimal balance between gradients sparsity and performance, we propose dynamic which can be described
0.5 Amax (I-cos
epoch
(14)
epoch
In the dynamic adjustment strategy, À initially set low allow extensive exploration of parameter space and prevent premature constraints on V(t) distributions. As À increases, constraints intensify, pushing V [t] further from Vín and ensuring strict adherence the operational threshold. Membrane neurons, thereby decreas- ing ())x)) 2 SNNs. However, during training, some neurons inevitably remain near the threshold due to their significant impact on the loss function. Therefore, additional strategies are required to enhance the robustness of these critical neurons.
potential constraints effectively reduce the number of threshold-neighben
4.2.2 NOISY SPIKE NEURONS FOR MITIGATING STATE-FLIP PROBABILITY
As previously mentioned, these neurons exhibit high sensitivity to minor disturbances, readily under- going state flipping by crossing the firing threshold. Such flipping not only increases output instability but can also severely disrupt the network's 's overall output through cascade effects. Consequently, introduce the Noisy-LIF neuron model (Gerstner et 2014) complementary mechanism to membrane potential constraints, significantly reducing the probability of state flipping in critical neurons and thereby enhancing the robustness of directly trained SNNs against adversarial attacks. The dynamics of Noisy-LIF LIF can be described as:
V = = 10c-1]=0 + W S + Elt,
(15)
where E(t] denotes Gaussian white noise. V(t) = rU(t - 1] + WST is the membrane potential of the LIF model before the addition of noise. In the traditional LIF model, spike generation is

---

Published as a conference paper at ICLR 2026
deterministic: neurons emit spike whenever the membrane potential Vit surpasses the firing threshold Va. Details are described in Appidex|E As a result, even small noise perturbations can cause significant output flips if they drive the membrane potential above the threshold. By introducing <(4). the output transitions to an expected value rather than a binary outcome. For small changes [V[[] around Vin, the change in spike probability, interpreted as the flipping probability, can be approximated using Taylor expansion with the first order:
AP(S: = VIg El!) ~ - (=) (=)]
(16)
where 2 V and o6-) represents the PDF of the standard normal distribution. Then the derivative of the approximated flipping probability AP(S; = 1 V(t, {[() with respect to o, denoted
a(P)) can be expressed as: as 80
((P) = AV[I
((z) x² (=2
(17)
For values of V[[] close to Vin an appropriate choice of a can ensure that 22 < 1. Under these conditions, a(AP) is negative, implying that the flipping probability decreases monotonically with 0g increasing a. This observation indicates that increasing the noise level ar reduces the sensitivity of the flipping probability to small perturbations in the membrane potential V(O,, thereby enhancing the buffering effect of the Noisy-LIF neuron against such disturbances. Overall, the membrane potential constraints and noisy-LIF neurons the TGO method work synergistically, The constraints ensure that most neuronal potentials are distanced from the threshold, while the noisy-LIF neurons further reduce the probabilities of state flipping in those threshold- neighbornnn spiking neurons. This integrated approach significantly enhances the adversarial robustness of SNNs.
Table 1: Comparative robustness performance under different training strategies on CIFAR-10 using WRN-16. SOTA performances are marked in gray.
Adversarial Attacks
Model
Train
Method
Clean
FGSM
RFGSM
PGD7
PGDI0
PGD20
PGD40
Vanilla Deng et al.
2022
93.32
14.05
31.21
0.00
0.00
0.00
0.00
BPTT
TGO(Ours)
88.79
51.40
71.38
11.67
6.14
1.52
0.45
WRN-16
AT Kundu al.
2021
91.32
39.14
74.31
21.15
17.45
14.41
12.93
AT
TGO(Ours)
88.16
63.03
79.69
42.52
35.01
24.76
20.11
RAT
Ding al.
2022
91.44
42.02
75.89
23.90
19.81
16.24
14.18
RAT
TGO(Ours)
87.33
69.16
79.28
54.59
47.69
38.07
33.13
EXPERIMENTS
5.1 EXPERIMENTS SETTING
In this study, the TGO method is evaluated in image classification tasks using the CIFAR-10, CIFAR- 100 (Krizhevsky et al. 2009) datasets. The employed network architectures include VGG-11 and WideResNet-II 16 with a width of 4 and depth of 16 (Xu et al.) 2024 Ding et al. 2024a 6). All SNN models are simulated for T=4 time steps. Unless otherwise specified, the default Amax is set to 0.4 for WRN-16 and 0.6 for VGG-11. We employ multiple ad adversarial attack methods, including FGSM (Goodfellow et al., 2014) and RFGSM (Wong al., (020)) and PGD (Madry) (017). They are all assessed using a fixed attack intensity of 8/255 and step size of 0.01, with the number of iterations specified in the attack name (e.g.. PGD 10). Notably, RFGSM refers to introducing a small random disturbance samples before applying FGSM. Moreover, three training strategies are implemented to test our TGO method: first, a vanilla training strategy (BPTT) Wu et al. (2018) using
original images, which incurs additional training costs; second. AT Kundu et al. (2021) strategy involves training with white-box PGD attacks (attack intensity of 2/255 and step size le 2); third, RAT incorporates Lipschitz penalties Ding al. (2022) into the adversarial training.
7

---

Published as a conference paper at ICLR 2026
Table 2: Comparative results of robustness across different methods and conditions on cifar100.
SOTA performances are marked in gray
Adversarial Attacks
Model
Train
Method
Clean
FGSM
RFGSM
PGD7
PGD10
PGD20
PGD40
Vanilla Deng al
2022
71.42
0.18
0.04
DLIF
Ding et al.
2024a
70.79
6.95
0.08
0.05
0.00
0.00
BPTT
StoG Ding ct al.
2024b
70.44
8.27
0.49
TGO(Ours)
69.47
17.20
38.23
2.30
1.33
0.69
0.42
VGG-11
AT Kundu
2021
66.27
17.20
45.13
8.30
8.16
7.52
AT
StoG Ding al.
20246
66.37
23.45
14.42
TGO(Ours)
65.93
24.16
47.90
12.83
10.12
8.72
6.50
RAT Ding et al.
2022
67.76
20.87
46,21
11.14
9.34
7.66
6,90
RAT
StoG
Ding
2024b
62.26
33.40
23.15
TGO(Ours)
65.64
33.84
51.44
18.84
14.59
10.57
8.90
Vanilla Deng al.
2022
73.46
6.36
11.15
0.01
0.00
0.00
0.00
DLIF
Ding et
2024a
73.85
8.08
0.00
0.00
0.00
0.00
BPTT
SR
Ding
2024b
69.15
9.84
34.43
1.22
0.86
0.52
0.3
TGO(Ours)
69.04
23.90
41.17
3.26
1.84
0.67
0.35
WRN-16
AT
Kundu et al.
2021
68.57
21.18
46.60
11.14
9.22
7.50
6.72
DLIF
Ding et
2024a
65.86
25.90
15.20
14.03
13.37
13.30
AT
SR
Ding al.
2024b
62.8
28.27
48.91
21.93
18.46
12.28
9.78
TGO(Ours)
64.49
41.99
55.01
27.78
22.75
15.99
12.91
RAT
Ding ct al.
2022
67.59
25.07
48.92
13.60
11.41
9.07
8.35
RAT
DLIF
Ding et
2024a
66.57
33.05
18.75
16.23
12.16
9.44
TGO(OurS)
64.22
40.35
54.53
25.79
20.93
14.02
10.77
5.2 COMPARE WITH THE SOTA METHODS
To evaluate the effectiveness of the proposed TGO method, we imple- ment three training strategies (BPTT, AT, and RAT) and compare them with other SOTA robustness meth- ods. Specifically, we replicate the and RAT configurations. Table and Table reports the classification ac- euracy of various network architec- tures under different attack scenar- ios the CIFAR-I0 and CIFAR-100 datasets. Our results show that the TGO method consistently achieves SOTA performance across nearly all tested architectures. Significantly, un- der the BPTT training strategy, our TGO method enhances performance by 10-20% in FGSM and RFGSM at- tack scenarios. outperforms other robustness methods.
SREAD
SREAE TGD-NT
SREAT TOR-NT
TED+AT
Acomecyto
40
6/235
70
70-
10
Astan
Assuxl
Astuc
Figure 3: Performance comparison of TGO (ours) and SR with AT across different perturbation budgets and different Amax- Experiments are conducted on CIFAR-100 dataset using WR architecture.
Additionally, the TGO strategy is highly compatible with both AT and RAT approaches, achieving approximately 10% performance improvement under PGD10, PGD20, and PGD40 attacks in the WRN-16 model. Similar to other constraint based approaches, our method achieving a 3%-5% % increase in performance under adversarial attacks. We conducted experiments across various per-
8

---

Published as a conference paper at ICLR 2026
turbation magnitudes (2, 4, 8/255) and different Amax values (0.2, 0.3, 0.4, 0.6). As shown in
Fig. 4 TGO consistently outperforms SR across all perturbation levels, demonstrating its superior robustness. Additionally, increasing Amax results in trade-off: while clean accuracy decreases, robustness improves, highlighting the balance between accuracy and robustness.
Moreover, evaluated the TGO method against more advanced attack strategies: Auto-PGD (APGD) (Croce & Hein 2020) and Multi-Targeted PGD (MTPGD) (Gowal et al. (019). MTPGD presents unique challenges due to its multi-targeted nature, simultaneously considering multiple misclassification objectives, We implemented MTPGD with random initialization to avoid gradient masking and gradient clipping for stable optimization. We take comparative analysis of our TGO method and the SR method, using consistent hyperparameter settings (momentum=0.9, c=8/255). TGO introduces randomness, thereby enhancing its adversar-
The incorporation of noisy-LIF ial robustness with inherent variability. We further evaluate TGO's performance under the EoT constraint Athalye et al. (2018). As shown in Table TGO outperforms SR under both MTPGD and APGD attacks even with the EoT constraint. Results across all attack scenarios conclusively demonstrate TGO's significant robustness improvements against diverse adversarial threats.
Vanilla SNN
TGO (Ours)
Vanilla SNN
TGO (Ours)
7000
Threchold 62.06%
16000
Threshold 15.16%
14000
Frquencc
Frequeney
(8000)
:2002
122
8000
2000
6000
2000
1000
2000
Membrane Potential
Membrane Potential
Loss Landscape
Loss Landscape
Figure 4: Comparison of membrane potential distributions and loss landscapes: The TGO-optimized SNN decreases membrane potentials near the threshold by approximately 40% and effectively circumvents adversarial traps during RFGSM attacks.
5.3 ABLATION STUDY
In this study, we evaluate the two core com- ponents of the TGO method: membrane potential constraint (MC) and the noisy- LIF (NLIF) model through series of ab- lation experiments. The experiments are performed using two training strategies: vanilla BPTT and RAT, with the CIFAR- 100 dataset and VGG-11 architecture en- suring result reliability.
Table 3: Performance on MTPGD (Gowal et al. 2019 and APGD (Croce & Hein, 2020) with BoT Athalye
et al. (2018) CIFAR-I00 (WRN- 16); APGD uses CE loss; EoT repeats N=3.
MTPGD Attack
Model
7
10
20
40
AT Kundu
2021
10.01
7.56
5.66
3.92
As shown in Table[4] our experimental re- sults reveal several key findings. First, the
SR+AT Ding et (024bb
16.88
13.67
9.52
7.33
vanilla SNN exhibits significant vulnerabil- ity FGSM attacks, achieving only 5.92% classification accuracy. highlighting the ur- gent need improve adversarial robust- ness. Second, each individual component TGO significantly improves network per- formance in adversarial attacks, confirming their efficacy in strengthening the robust- ness of SNNs. Notably, MC and NLIF en- hance each other synergistically rather than functioning independently, which further confirms TGO is a holistic protection strategy specifically targeting neurons near the threshold.
TGO+AT(BoT)
21.23
16.35
10.58
7.40
APGD Attack
Model
7
10
20
40
Kundu al.
2021)
9.34
6.85
4.34
3.62
SR+AT Ding et al. TGO+AT(EoT)
(202bb)
14.48
12.78
8,83
7.20
18.93
14.32
9.71
7.53
To better understand TGO's regulatory mechanism on the dynamics of spiking neurons, we analyze the membrane potential distributions of both vanilla and TGO-optimized SNNs. As shown in

---

Published as a conference paper at ICLR 2026
Table 4: Ablation study of our TGO method CIFAR-100 with VGG-11.
BPTT
MC
NLIF
Clean
FGSM
RFGSM
PGD40
Clean
FGSM
REGSM
PGD40
x
X
71.4
5.9
25.0
0.0
67.8
20,9
46.2
6.9
/
64.3 (-7.2)
17.1 (+11.2)
25.9 (+0.9) 0.5 (+0.5) 61.4 (-6.4)
26.2 (+5.3)
42.7 (-3.)) 6.2 (-0.7)
X
(-0.))
8.1 (+2.1)
(+6.6)
(+0.1)
68.1 (+0.4)
25.2 (44.3)
50.1 (+3.9)
9.1 (+2.2)
/
66.9 21.5 (+15.5)
39.1 (+14.1) 0.5 (+0.5) 63.3 (-3.8) 33.8 (+13.0)
50.8 (+4.6) 9.3 (42.4)
F TGO reduces the number of wwesshold-eiighoriing neurons by 40%, strongly supporting our hypothesis that threshold seahholddneighboring neurons are key adversarial robustness in SNNs.
Additionally, we compare the loss landscapes of vanilla and TGO TGGOooptmmzed SNNs under RFGSM attacks with the BPTT training strategy. The loss landscape of our TGO method exhibits smoother gradient trajectories, while the vanilla SNNs show multiple local optima and peaks, demonstrating the effectiveness of TGO in defending against gradient-based adversarial attacks. Moreover, we present heatmaps of V v. y for CIFAR- 100 examples Tsipras et al. (2018): Liu et al. (2024). As shown in Fig the TGO method produces a sparser gradient, with heatmap contours more closely to the original image than the vanilla SNNs.
Vanilla SNN CIFARION 100
TGO (Ours)
Figure 5: Heatmaps of V Vu.f, where f denotes vanilla SNN or our TGO (pt-mizid SNN.
CONCLUSION
This study thoroughly analyzes the vulnerabilities of directly trained SNNs under adversarial attack conditions and theoretically confirms that neeihoold-eiighboring spiking neurons define the upper limits of adversarial attack effectiveness. To address this issue, we propose TGO method, which consists of two aspects. First, membrane potential constraints distance neurons from their thresholds, thereby reducing the upper limits of adversarial attacks. Second, noisy-LIF model transitions the neuronal firing mechanism from deterministic to probabilistic, effectively reducing the probability of state flips caused by minor disturbances. Extensive experiments prove that our TGO method significantly enhances the robustness of directly trained SNNs against various adversarial attacks.
7 ACKNOWLEDGMENTS
This work was supported by the National Natural Science Foundation of China (Grants 62576080 and 62220106008), the Sichuan Science and Technology Program (Grant 2024NSFTD0034) the Guangdong Introducing Innovative and Entrepreneurial Teams (Grant 2023ZT 10x044,, and the Shenzhen Science and Technology Research Fund (Grant JCYJ202208 88 0000000002.
10

---

Published as a conference paper at ICLR 2026
REFERENCES
Anish Athalye, Logan Engstrom, Andrew Ilyas, and Kevin Kwok. Synthesizing robust adversarial examples. In International conference on machine learning, pp. 284-293. PMLR, 2018.
Tong Bu, Jianhao Ding, Zhaofei Yu, and Tiejun Huang. Optimized potential initialization for low- latency spiking neural networks. In Proceedings of the AAAI conference on artificial intelligence, volume 36, pp. 11-20, 2022.
Keyan Cao, Yefan Liu, Gongjie Meng, and Qimeng Sun. An overview on edge computing research. IEEE access, 085711485722) 2020.
Francesco Croce and Matthias Hein. Reliable evaluation of adversarial robustness with an ensemble of diverse parameter-fres free attacks. In International conference on machine learning, pp. 2206-2216. PMLR, 2020.
Michael V DeBole, Brian Taba, Amon Amir, Filipp Akopyan, Alexander Andreopoulos, William P Risk, Jeff Kusnitz, Carlos Ortega Otero, Tapan K Nayak, Rathinakumar Appuswamy, et al. Truenorth: Accelerating from zero 64 million neurons in 10 years. Computer, 52(5):20-29, 2019.
Shikuang Deng, Yuhang Li, Shanghang Zhang, and Shi Gu. Temporal efficient training of spiking neural network via gradient re- weighting. arXiv preprint arXiv:2202. /946, 2022.
Shikuang Deng, Hao Lin, Yuhang Li, and Shi Gu. Surrogate module learning: Reduce the gradient error accumulation in training spiking neural networks. In International Conference on Machine Learning, pp. 7645-7657. PMLR, 2023.
Jianhao Ding, Tong Bu, Zhaofei Yu, Tiejun Huang, and Jian Liu. Snn-rat: Cobustness-enhance spiking neural network through regularized adversarial training. Advances in Neural Information Processing Systems, 15:247800-2799, 2022.
Jianhao Ding, Zhaofei Yu, Tiejun Huang, and Jian K Liu. Spike timing reshapes robustness against attacks in spiking neural networks. arXiv preprint arXiv:2306.05655 2023.
Jianhao Ding, Zhiyu Pan, Yujia Liu, Zhaofei Yu, and Tiejun Huang. Robust stable spiking neural networks. arXiv preprint urXiv:2405.20694 2024a.
Jianhao Ding, Zhaofei Yu, Tiejun Huang, and Jian K Liu. Enhancing the robustness of spiking neural networks with stochastic gating mechanisms. Proceedings of the AAAI Conference on Artificial Intelligence, volume 38, pp. 492-502, 2024b.
Chaoteng Duan, Jianhao Ding, Shiyan Chen, Zhaofei Yu, and Tiejun Huang. Temporal effective batch normalization in spiking neural networks. Advances in Neural Information Processing Systems, 35:34377-34390. 2022.
Rida El-Allami, Alberto Marchisio, Muhammad Shafique, and lhsen Alouani. Securing deep spiking neural networks against adversarial attacks through inherent structural parameters. In 202/ Design Automation & Test in Europe Conference & Exhibition (DATE), pp. 774-779. IEFF, 2021.
Steven K Esser, Paul A Merolla, John V Arthur, Andrew S Cassidy, Rathinakumar Appuswamy, Alexander Andreopoulos, David Berg, Jeffrey L McKinstry, Timothy Melano, Davis R Barch, et al. From the cover: Convolutional networks for fast, energy-efficient neuromorphic computing. Proceedings of the National Academy of Sciences of the United States of America. 113(41):11441, 2016.
Wei Fang, Zhaofei Yu, Yanqi Chen, Tiejun Huang, Timothée Masquelier, and Yonghong Tian. Deep residual learning in spiking neural networks. Advances in Neural Information Processing Systems, 24169, 2021a.
Wei Fang, Zhaofei Yu, Yanqi Chen, Timothée Masquelier, Tiejun Huang, and Yonghong Tian. Incorporating learnable membrane time constant to enhance learning of spiking neural networks. In Proceedings of the IEEE/CVF international conference on computer vision, pp. 2661-2677 2021b.
11

---

Published as a conference paper at ICLR 2026
Wei Fang, Zhaofei Yu, Zhaokun Zhou, Ding Chen, Yanqi Chen, Zhengyu Ma. Timothée Masquelier, and Yonghong Tian. Parallel spiking neurons with high efficiency and ability to learn long-term dependencies. Advances in Neural Information Processing Systems, 36, 2024.
Samuel G Finlayson, John D Bowers, Joichi Ito, Jonathan L Zittrain, Andrew L Beam, and Isaac Kohane. Adversarial attacks medical machine learning. Science, 363(6433):2287-23833) 2019.
2019.
Wulfram Gerstner and Werner M Kistler. Spiking neuron models: Single neurons, populations, plasticity. Cambridge university press, 2002.
Wulfram Gerstner, Werner M Kistler, Richard Naud, and Liam Paninski. Neuronal dynamics: From
single neurons networks and models of cognition. Cambridge University Press, 2014.
Ian J Goodfellow, Jonathon Shlens, and Christian Szegedy. Explaining and harnessing adversarial examples. arXiv preprint arXiv:1412.6572, 2014.
Sven Gowal, Jonathan Uesato, Chongli Qin, Po-Sen Huang, Timothy Mann, and Pushmeet Kohli.
An alternative surrogate loss for pgd-based adversarial testing. arXiv preprint 1rXiv:1910.09338, 2019.
Alex Graves and Alex Graves. Long short-term memory. Supervised sequence labelling with recurrent neural networks, pp. 37-45, 2012.
Yunzhe Hao, Xuhui Huang, Meng Dong, and Bo Xu. A biologically plausible supervised learning method for spiking neural networks using the symmetric stdp rule. Neural Networks, 121:387-395, 2020.
Zecheng Hao, Tong Bu, Xinyu Shi, Zihan Huang, Zhaofei Yu, and Tiejun Huang. Threaten spiking neural networks through combining rate and temporal information. In The Twelfth International Conference on Learning Representations, 2023.
Kaiming He, Xiangyu Zhang, Shaoqing Ren, and Jian Sun. Deep residual learning for image recognition. In Proceedings of the IEEE conference on computer vision and pattern recognition, pp. 770-778, 2016.
Jiacang Ho. Syung-Gook Lee, and Dae-Ki Kang. Attack-less adversarial training for a robust adversarial defense. Applied Intelligence, 52(()):364 4381, 2022.
Yangfan Hu, Huajin Tang, and Gang Pan. Spiking deep residual networks. IEEE Transactions on Neural Networks and Learning Systems, 340$):5000-5205, 2021.
Eugene M Izhikevich. Simple model of spiking neurons. IEEE Transactions neural networks, 14 (6):1569-1572) 2003.
Runhao Jiang, Chengzhi Jiang, Rui Yan, and Huajin Tang. Mpd-sgr: Robust spiking neural networks with membrane potential distribution--riier surrogate gradient regularization. arXiv preprint 1rXiv:2511.121999 2025.
Guhyun Kim and Doo Seok Jeong. Cbp: backpropagation with constraint on weight precision using lseudo-lagrange multiplier method. Advances in Neural Information Processing Systems, 34: 28274-2888 28285, 2021.
Alex Krizhevsky, Geoffrey Hinton, al. Learning multiple layers of features from tiny images. 2009.
Souvik Kundu, Massoud Pedram, and Peter A Beerel. Hire-snn: Harnessing the inherent robustness of energy-efficient deep spiking neural networks by training with crafted input noise. In Proceedings of the IEEE/CVF International Conference on Computer Vision, pp. 5209-5218. 2021.
Pavel Laskov and Richard Lippmann. Machine learning adversarial environments. learning, 81: 11-11999 2010.
Machine
Chankyu Lee, Syed Shakib Sarwar, Priyadarshini Panda, Gopalakrishnan Srinivasan, and Kaushik Roy. Enabling spike-basse based backpropagation for training deep neural network architectures. Frontiers in neuroscience, 14:497482, 2020.
12

---

Published as a conference paper at ICLR 2026
Hongmin Li, Hanchao Liu, Xiangyang Ji, Guoqi Li, and Luping Shi. Cifar10-dvs: event-stream dataset for object classification. Frontiers in neuroscience, 11:309, 2017.
Yudong Li, Yunlin Lei, and Xu Yang. Spikeformer: novel architecture for training fighhpperformncee low-latency spiking neural network. arXiv preprint urXiv:2211. 2022.
Yuhang Li, Yufei Guo, Shanghang Zhang, Shikuang Deng, Yongqing Hai, and Shi Gu. Differentiable spike: Rethinking gradient-descent for training spiking neural networks. Advances in Neural Information Processing Systems, 01223266-23499 2021.
Ling Liang, Xing Hu, Lei Deng, Yujie Wu, Guoqi Li, Yufei Ding, Peng Li, and Yuan Xie. Exploring adversarial attack in spiking neural networks with spike-compationn gradient. IEEE transactions on neural networks and learning systems, 34(5):2599-2833 2021.
Ling Liang Kaidi Xu, Xing Hu, Lei Deng, and Yuan Xie. Toward robust spiking neural network against adversarial perturbation. Advances in Neural Information Processing Systems, 35:10244- 10256, 2022.
Yu Liang, Yu Yang, Wenjie Wei, Ammar Belatreche, Shuai Wang, Malu Zhang, and Yang Yang. Bso: Binary spiking online optimization algorithm. arXiv preprint arXiv:2511.12500 2025.
Zachary Chase Lipton. A critical review of recurrent neural networks for sequence learning. arXiv
Preprint, CoRR, abs/1506.000// 2015.
Daqi Liu and Shigang Yue. Event-driven continuous stdp learning with deep structure for visual pattern recognition. IEEE transactions on cybernetics, 49(4): 2018
Yujia Liu, Tong Bu, Jianhao Ding, Zecheng Hao, Tiejun Huang, and Zhaofei Yu. Enhancing adversarial robustness in snns with sparse gradients. In Forty-first International Conference on Machine Learning, 2024.
De Ma, Xiaofei Jin, Shichun Sun, Yitao Li, Xundong Wu, Youneng Hu, Fangchao Yang, Huajin Tang, Xiaolei Zhu, Peng Lin, al. Darwin3: large-scale neuromorphic chip with novel isa and on-chip learning. National Science Review, 11(5):waae 102, 2024.
Wolfgang Maass. Networks of spiking neurons: the third generation of neural network models. Neural networks, 10(9):165--1671, 1997.
Aleksander Madry. Towards deep learning models resistant to adversarial attacks. arXiv preprint 1706 2017.
Alberto Marchisio, Giorgio Nanfa, Faiq Khalid, Muhammad Abdullah Hanif, Maurizio Martina, and Muhammad Shafique. Is spiking secure? comparative study on the security vulnerabilities of spiking and deep neural networks. In 2020 International Joint Conference on Neural Networks (JJCN)) pp. 1-8. IEEE, 2020.
Timothée Masquelier, Rudy Guyonneau, and Simon J Thorpe. Spike timing dependent plasticity finds the start of repeating patterns in continuous spike trains. PloS one, 3(1 31377, 2008
Bhaskar Mukhoty, Hilal AlQuabeh, Giulia De Masi, Huan Xiong, and Bin Gu. Certified adversarial robustness for rate encoded spiking neural networks. In The Twelfth International Conference Learning Representations, 2024.
Jing Pei, Lei Deng, Sen Song, Mingguo Zhao, Youhui Zhang, Shuang Wu, Guanrui Wang, Zhe Zou, Zhenzhi Wu, Wei He, et Towards artificial general intelligence with hybrid tianjic chip architecture. Nature, 572(7767):006-111 2019.
Nitin Rathi and Kaushik Roy. Diet-snn: Direct input encoding with leakage and threshold optimization in deep spiking neural networks. arXiv preprint 2000v:2008.00 2033060000,,6588, 2020.
Ali Shafahi. Mahyar Najibi, Mohammad Amin Ghiasi, Zheng Xu, John Dickerson, Christoph Studer, Larry S Davis, Gavin Taylor, and Tom Goldstein. Adversarial training for free! Advances in neural information processing systems, 32, 2019.
13

---

Published as a conference paper at ICLR 2026
Yimeng Shan, Zhenbang Ren, Haodi Wu, Wenjie Wei, Rui-Jie Zhu, Shuai Wang, Dehao Zhang, Yichen Xiao, Jieyuan Zhang, Kexin Shi, et al. Sdtrack: A baseline for event- based tracking via spiking neural networks, arXiv preprint 2o0.::25000008033, 2025.
Saima Sharmin, Nitin Rathi, Priyadarshini Panda, and Kaushik Roy. Inherent adversarial robustness of deep spiking neural networks: Effects of discrete input encoding and non-linear activations. In Computer Vision-ECCC 2020: 16th European Conference, Glasgow, UK, August 23-28, 2020, Proceediiggs, Part XXIX 16, pp. 399-414. Springer, 2020.
Xinyu Shi, Zecheng Hao, and Zhaofei Yu. Spikingresformer: Bridging resnet and vision transformer in spiking neural networks. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pp. 5610-5619, 2024.
Sumit B Shrestha and Garrick Orchard. Slayer: Spike layer error reassignment in time. Advances in neural information processing systems, 31, 2018.
J Michael Steele. The Cauchy-Schwarz master class: an introduction to the art of mathematical inequalities. Cambridge University Press, 2004.
Dimitris Tsipras, Shibani Santurkar, Logan Engstrom, Alexander Tumne, and Aleksander Madry. 2018.
Robustness may be at odds with accuracy. arXiv preprint
Blesson Varghese, Nan Wang, Sakil Barbhuiya, Peter Kilpatrick, and Dimitrios S Nikolopoulos. Challenges and opportunities edge computing. In 2016 IEEE international conference on smart cloud (SmariCloud), pp. 20-26. IEEE, 2016.
Shuai Wang, Dehao Zhang, Ammar Belatreche, Yichen Xiao, Hongyu Qing, Wenjie Wei, Malu Zhang, and Yang Yang. Ternary spike-based neuromorphic signal processing system. Neural Networks, 187:107333, 2025a.
Shuai Wang, Malu Zhang, Dehao Zhang, Ammar Belatreche, Yichen Xiao, Yu Liang, Yimeng Shan, Qian Sun, Enqi Zhang. and Yang Yang. Spiking vision transformer with saccadic attention. arXiv preprint 250: /2677, 2025b.
Shuai Wang, Haorui Zheng, Yukun Chen, Ammar Belatreche, Guoqing Wang, Yeying Jin, Jibin Wu, Malu Zhang, Yang Yang, and Haizhou Li. Snn-ft: Temporal-coder spiking neural networks for fourier transform. IEEE Transactions Neural Networks and Learning Systems, 2025c.
Paul J Werbos. Backpropagation through time: what it does and how do it. Proceedings of the IEEE, 78( 18510):1550-1560, 1990.
Eric Wong, Leslie Rice, and J Zico Kolter. Fast is better than free: Revisiting adversarial training. arXiv preprint arXiv:2001. 2004990000..099,, 2020.
Yujie Wu, Lei Deng, Guoqi Li. Jun Zhu, and Luping Shi. training negh-performance spiking neural networks. Frontiers in neuroscience. 12:331, 2018.
backpropagation for
Yujie Wu, Lei Deng, Guoqi Li, Jun Zhu, Yuan Xie, and Luping Shi. Direct training for spiking neural networks: Faster, larger, better. In Proceedings of the AAAI conference artificial intelligence, volume 33, pp. 1311-1318, 2019.
Yichen Xiao, Shuai Wang, Dehao Zhang, Wenjie Wei, Yimeng Shan, Xiaoli Liu, Yulin Jiang, and Malu Zhang. Rethinking spiking self-attention mechanism: Implementing a-xnor similarity calculation in spiking transformers. In Proceedings of the Computer Vision and Pattern Recognition Conference, pp. 5444-5454, 2025.
Han Xu, Yao Ma, Hao-Chen Liu, Debayan Deb, Hui Liu, Ji-Liang Tang, and Anil K. Jain. Adversarial attacks and defenses images. graphs and text: A review. International journal of automation and computing, 17:151-178, 2020.
Mengting Xu, De Ma, Huajin Tang, Qian Zheng, and Gang Pan. Feel-snn: Robust spiking neural networks with frequency encoding and evolutionary leak factor. In The Thirty-eighth Annual Conference Neural Information Processing Systems, 2024.
14

---

Published as a conference paper at ICLR 2026
Shuangming Yang and Badong Chen. Effective surrogate gradient learning with high-order informa- tion bottleneck for spike-based machine intelligence. IEEE transactions on neural networks and learning systems, 2023.
Man Yao, Jiakui Hu, Zhaokun Zhou, Li Yuan, Yonghong Tian, Bo Xu, and Guoqi Li. Spike-driven transformer. Advances in neural information processing systems, 36, 2024a.
Yanmeng Yao, Xiaohan Zhao, and Bin Gu. Exploring vulnerabilities in spiking neural networks: Direct adversarial attacks on raw event data. In European Conference on Computer Vision, pp. 412-428. Springer, 2024b.
Donghyung Yoo and Doo Scok Jeong. Cbp-qsnn: Spiking neural networks quantized using con- strained backpropagation. JEEE Journal on Emerging and Selected Topics in Circuits and Systems, 2023.
Dehao Zhang, Malu Zhang, Shuai Wang, Jingya Wang, Wenjie Wei, Zeyu Ma, Guoqing Wang, Yang Yang, and Haizhou Li. Dendritic resonate-and- neuron for effective and efficient long sequence modeling. arXiv preprint arXiv:2509. 10:.:22999///8 /7/86, 2025a.
Huan Zhang, Hongge Chen, Chaowei Xiao, Sven Gowal, Robert Stanforth, Bo Li, Duane Boning, and Cho-Jui Hsich. Towards stable and efficient training of verifiably robust neural networks. arXiv preprint 1906. 06316, 2019.
Jilin Zhang, Dexuan Huo, Jian Zhang, Chunqi Qian, Qi Liu, Liyang Pan, Zhihua Wang, Ning Qiao, Kea-Tiong Tang, and Hong Chen. 22.6 anp-i: A 28nm 1.5 pj/sop asynchronous spiking neural network processor enabling sub-o. pj/sample on-chip learning for edge-ai applications. In 2023 IEEE International Solid-Star State Circuits Conference (ISSCC), pp. 21-23. IEEE, 2023.
Malu Zhang, Shuai Wang, Jibin Wu, Wenjie Wei, Dehao Zhang, Zijian Zhou, Siying Wang, Fan Zhang, and Yang Yang. Toward energy-efficient spike-based deep reinforcement learning with temporal coding. IEEE Computational Intelligence Magazine, 20(2):45-3 57, 2025b.
Hanle Zheng, Yujie Wu, Lei Deng, Yifan Hu, and Guoqi Li. Going deeper with directly-trainet larger spiking neural networks. In Proceedings of the AAAI conference artificial intelligence, volume 35, pp. 11062-11011 1070, 2021.
Chenlin Zhou, Liutao Yu, Zhaokun Zhou, Zhengyu Ma, Han Zhang, Huihui Zhou, and Yonghong Tian. Spikingformer: Spike- driven residual learning for transformer-base spiking neural network. arXiv preprini ar30v:2304.1 1954, 2023.
Chenlin Zhou, Han Zhang, Zhaokun Zhou, Liutao Yu, Liwei Huang, Xiaopeng Fan, Li Yuan, Zhengyu Ma, Huihui Zhou, and Yonghong Tian. Okformer: Hierarchical spiking transformer using qk attention. arXiv preprint arXiv:2403.1653. 2024.
15

---

Published as a conference paper at ICLR 2026
A ROBUSTNESS OF OUR TGO METHOD FOR NEUROMORPHIC DATASETS
Table 5 illustrates the performance comparison between our proposed TGO+AT method and the standard Adversarial Training (AT) baseline with 1ideResNet--6 the DVS-CRIAFIO neuromor- phic dataset. In this study, we integrated TGO with conventional adversarial training, resulting in consistent improvements across all evaluation metrics. As evidenced in the table TGO+AT not only enhances clean sample accuracy by 1.9% but also significantly improves robustness against various adversarial attacks, with particularly notable gains against stronger iterative attacks such as PGD7 (+4.1%) and PGD30 (+3.6%). Furthermore, we evaluated the efficacy of our approach
Table 5: Performance Comparison DVS-CRIAF10 Dataset
Model
Clean
FGSM
RFGSM
PGD7
PGD10
PGD30
PGD50
AT
72.2
57.4
65.2
46.9
45.6
45.2
44.2
TGO+AT
74.1
59.7
68.0
51.0
48.1
48.8
46.2
against event-based attacks (Yao et al., 2024b) using WideResNet-16 on DVS-CRIAFIO (Li al. 2017). The Attack Success Rate (ASR) for standard AT was measured at 44.32%, whereas AT+TGO achieved a substantially lower ASR of 31. .00%. This reduction ASR indicates enhanced robustness, further demonstrating the effectiivnesss of the TGO methodology in mitigating vent-based adversarial attacks.
B GRADIENT-BASED UPPER BOUND OF ADVERSARIAL ATTACK
Theorem: Let f: Rm + T be a continuously differentiable neural network function at point æ, and let be sufficiently small. The adversarial perturbation measure Rad e) satisfies:
(J, E) S ( + O(e²),
(18)
where (x) the Jacobian matrix of function f(-) at point
Proof: We begin by defining our objective as the maximization of the squared difference between f(x eδ) and fx), subject to the constraint || $ 1:
Radv e)) argmax (11/(x + cd) - [(x) 8), 11
(19)
Next, we apply Taylor's theorem with the Lagrange remainder for the vector-valued function fx c() around point æ. Specifically, for 8 with ||ö||, S 1, there exists & E (0, 1) such that:
f(x ( s()) + (e0) (ed)
H + Eed),
(20)
where (x) the Jacobian matrix of the function f-) at the point x, and Hy is the Hessian tensor of second derivatives. Substituting this expansion into the squared difference, we obtain:
[l + c0) - f(z) |
(c5) H + {Ed) 2
(21)
I (1,,())(00)22 + (((6))
+c5)
(22)
Combining Eq. 19 and the Cauchy-Scheee Sehhwar- inequality, we can systematically expand each component of the Eq. 22 For the first term, it can be expand as follows:
(=)(() & (=) S {
(23)
For the second term of Eq. 22 we can expand it by utilizing the E, norm characteristic of the Hessian matrix. can be defined as follows:
[ + (60)
A [ S 2
(24)
16

---

Published as a conference paper at ICLR 2026
where Ammaz is the maximum eigenvalue of the Hessian matrix. Substituting these bounds into the expression for the squared difference, we obtain:
[ +6) s(=)) < (1))) Am ())
Hman
(25)
4
Thus, the adversarial perturbation measure satisfies the following upper bound:
Rad (J, 2,,,) S < +
(26)
where O(²²) represents a higher-order infinitesimal of c². Since e is a very small quantity, the term OEea) in the formula can be neglected. Consequently, the theoretical upper bound of the adversarial perturbation is primarily dependent on the f2 norm of Jy(x), Specially, y (a) can be expressed as the collection of gradients of each component the function:
(z)
(2(
(y(2)=
(27)
(z))
The norm of the Jacobian matrix is related the gradients through the following expression:
||,(<>)11 = (m = AJmax Σ EVIO)VVO))
(28)
Where Amaa denotes the maximum eigenvalue of the matrix, which reflects the largest possible stretching effect of the Jacobian matrix, directly linking the gradient magnitudes to the overall sensitivity of the network's output.
C ACTIVATION-BANT UPPER BOUND OF ADVERSARIAL ATTACK
Theorem: For discrete spike pattern mapping f: _R Rd small perturbations eò around input induce a finite set of activation pattern transitions. The adversarial robustness upper bound can be approximated as:
Rea (f. 2. 22)
max ISRSK
|AA.1
where K denotes the number of activation regions intersecting the perturbation ball (z)x), and AA, Rmxx is the affine transformation matrix for activation pattern A ((1, u,(x) 2 0.)-
Proof: Consider an SNN represented by the function f R" + R", where R" denotes the input space and R denotes the output space. The adversarial perturbation measure input point x E Rn with a perturbation radius & > 0 is defined as:
Radv (f, xx max |
(29)
where 8 represents the perturbation direction vector constrained by the p-norm unit ball. Given the piecewise-lineal nature of the SNN, small perturbations around an input x lead to a finite set of possible activation pattern changes. Specifically, the activation pattern any input can be defined as:
A(z) = (1., u (x)(()
(30)
where us (x) denotes the membrane potential of neuron at layer 1, and 8 denotes the correspond- ing firing threshold. Consequently, each distinet activation pattern corresponds uniquely convex polyhedral region in the input space defined as:
R far E R A(x) = A}.
(31)
Within any such region R.. the network behaves affine transformation described by:
f(x) A bA
(32)
17

---

Published as a conference paper at ICLR 2026
where AA R and bu Rm are determined entirely by the network's weights and biases under the specific activation pattern A. For sufficienlly small perturbations ensuring x + E RA, the network's 's output change can explicitly be expressed as:
f(x + =d) - f(x) = =A
(33)
Utilizing the properties of operator norms, we bound the change in network output within the given region by:
G(x) (z + + - f()) G(x) S e² A
(34)
where ||AAllp-2 denotes the operator norm of the matrix AA defined with respect to the input p-norm and output 2-norm. Considering all possible regions intersecting the perturbation ball
(x) = fi + Eō || S 1}, we derive the global bound for the adversarial perturbation measure as:
(a x. SE
||AA,1 ISASK
max
(35)
where K represents the finite number of distinet activation regions intersecting (z(x). Further analyzing the structure of the matrices AA2, one observes that the sensitivity of these matrices
primarily depends on neurons whose membrane potentials u (xr) are near their firing thresholds g Consequently, larger distances between membrane potentials and thresholds indicate greater activation stability, leading to smaller variations in the affine transformation AA, and ultimately reducing the operator norm ||A llp-2. Formally stated, as the absolute difference between the
(1) (a)) and the threshold g(0) increases, the adversarial perturbation measure membrane potential u;
strictly decreases:
I (x) - 1 = Ra Rf, x, 4.
(36)
D PROOF OF THE PROBABILITY FOR SPIKING NEURONS' STATE FLIPPING
Theorem: Consider spiking neuron with membrane potential V[I at time I, firing threshold Vah and subject to Gaussian white noise perturbation v/{{ NN(0, o²). The probability Ptip of the
neuron's 's state transition (flipping) is given by:
+
Víl. V
if V(t 2 Vth.
Paip
+ Vaa vI1),
if V(t < Vin.
where (--) denotes the cumulative distribution function (CDF) the standard normal distribution.
Let consider the stochastic dynamics of the neuron's 's membrane potential under noise perturbation. Define the poise-perturber membrane potential as H' V[I + v/4), where v/4] ~ (O, o²) represents additive Gaussian white noise. The neuron's state transition probability depends on whether this perturbed potential crosses the threshold Vth. We analyze this probability by considering two distinct cases.
Proof:
For Case 1, when Vit] 2 Vin, the deterministic dynamics would result in the neuron firing (output state = 1). However, the presence of noise can induce transition to the non-firte non-firing state (0). This flip occurs if and only if the perturbed potential falls below threshold:
H' Vin
V(dl + nit] Vun
n|t] < Vtb V(t].
(37)
Since n/t]] follows normal distribution with mean 0 and variance o², we can standardize this inequality. The probability of transition from state to 0 is:
P Pi-o P(n[() < Vaa V(() + Vih -1I0
V[4
(38)
where the last equality follows from the definition of the standard normal CDF
For Case 2, when V[(] Vin. the deterministic dynamics would result in no firing (output state 0). A transition to the firing state (1) occurs when noise pushes the membrane potential above threshold:
H' Vnn
Ay4 + n((
Vin
n|t] 2 Vob V(I].
(39)
18

---

Published as a conference paper at ICLR 2026
Following the same probabilistic reasoning, and noting that P(n|t) 2 x) 1 P(n[t) x) for any I, the probability of transition from state to is:
Po-+1 = P(nl4 2 Vín v(O) = =1 Vih bl4
(40)
Combining these cases yields the desired expression for Phip- Note that this result naturally captures the intuition that the probability of state transition decreases as the membrane potential moves further from the threshold in either direction, due the monotonicity properties of t.
E PROOF OF THE PROBABILITY FOR NOISY-LIF'S STATE FLIPPING
Theorm: Consider Noisy-LIF neuron with membrane potential V(t]. Gaussian noise {[t] NO0 o²), and threshold Va. The probability of firing can be expressed as:
+ Vi (v[t) Elt) +
P(S V(t).
where (-)) is the CDF of the standard normal distribution. As the a increases, the probability density function @ becomes broader, reducing the sensitivity to small variations in V(t).
Proof:
The firing condition in the Noisy-LIF neuron model is given by the inequality V +[t]] 2 Vnn
To analyze the firing probability conditioned the membrane potential V Vitl and the noise E(t], start by rewriting the firing condition in terms of the standard normal distribution:
VIA
V
P(S: 1 v[t), P 2 Vn V(t) = 1 - +b
(41)
Differentiating this probability with respect to [[t] gives us the sensitivity of the firing probability to changes in the membrane potential:
aP(S: 1 11 - (VM
Vin V
(42)
where á is the probability density function of the standard normal distribution. This derivative indicates how small change in V(t] affects the probability of firing. To understand the impact of on the sensitivity, consider that as a increases, the width of & also increases, making it flatter. This change results in a decrease the magnitude of the derivative, indicating reduced sensitivity small changes in [t].
In this research, the training process for experiments extends over a duration of 300 epochs. To address potential vanishing exploding gradients, batch normalization techniques are integrated throughout the network architecture. The LIF neurons in the experiments are configured with a decay factor of 0.5 and threshold of 1. The proposed noisy LIF neurons incorporate Gaussian noise with a mean and a variance of 0.4. All experiments were conducted with 300 training iterations, repeated thrice, and the reported results are the averages of these three runs. For optimization, implement the stochastic gradient descent (SGD) algorithm, starting with a learning rate set at 0.1. The adjustment of the learning rate follows cosine annealing strategy, All experiments are performed on a Py PoTcc framework, facilitated by the computational power of an NVIDIA RTX 4090 GPU.
F VISUALIZATION OF GRADIENT SPARSITY AND LOss LANDSCAPE
To assess the effectiveness TGO in adversarial environments, we visualized the Gradient Sparsity and loss landscape of the BPTT-baasdd WR16 model under RFSGM attack, comparing TGO optimiza- tion with the vanilla SNN. The Gradient Sparsity quantifies the gradient V..fy between the label and the input image.
Gradient Sparsity: The gradient visualization begins with an input image I, E RCxH where C denotes the number of channels (e.g., RGB), and H W represents the image's spatial resolution.
19

---

Published as a conference paper at ICLR 2026
A pre-trained model fI; 8), parameterized by 6, maps the input image to a probability distribution over K' classes, denoted as p E R The prediction process is given by:
exp(2y.)
= 0();0), plun]
(43)
E exp(2t)
where =a is the pre-activation value for class k prior to the application of the softmax function. The model is optimized using the cross-entropy loss between the predicted probability distribution and the true label 3/s, formulated as:
exp(
[I, Vi) = - log plys = log
(44)
Σ> -= exp(2x)
To assess the sensitivity of the model's predictions to the input, the gradient of the loss with respect to the input image is computed, resulting in a gradient tensor g; E IRC expressed as:
OC(I, JI
g:
8s I. xr yl (- p (B:)),
(45)
where I, and correspond to the channel and spatial coordinates of the image. We compute the gradient (x) under two scenarios: (1) vanilla SNN, and (2) TGO-optimized SNN, both trained using BPTT. As shown in Fig we visualize (z) for both models on CIRAFOO. The experimental results clearly indicate that, compared to the vanilla SNN, the TGO-optimized SNN exhibits sparser gradients with respect to the input image, demonstrating the effectiveness of membrane potential constraints increasing gradient sparsity SNNs. These findings also validate that sparse gradients contribute enhancing the robustness of SNNs.
The process of visualizing the loss landscape starts with a pre-trained model parameterized by 0 R&M, where M represents the total number of parameters in the model. The performance of the model quantified using a loss function C(8), defined over a dataset of N samples
Loss Landscape:
1 Σ (((LL))))) (U(L:;)),)) vi) = log p(v)): N 1=1
(())
(46)
where f[1;; 0) denotes the output of the model for input I, is the sample-wise loss (e.g., cross- entropy), and (Is, v/) are the input and label for the i-th sample. The predicted probability distribution RK is computed via softmax as:
exp(zy.)
P
Fk = fx:;;)
(47)
E exp(=*)
where is the pre-activation value for class k, and K is the total number of classes. To visualize the local geometry of C()) around a specific parameter set 0, two directions di, d2 E RRM are defined, satisfying:
||d = d 1,
d = 0.
(48)
Typically, d, is chosen as the gradient direction:
VoC(O)
VoC(B) aL(0)
d while d2 is sampled randomly and orthogonalized to d,. The perturbed parameter vector is then
(49)
[VC(())
08
expressed
= f + ad, + 9d2, where o, 8 E IR control the magnitudes of the perturbations along di and de. At each perturbation point (a, B), the loss is computed as:
(50)
L(8')
Σ E(f[L; ad, + (d)).
(51)
The parameter space is discretized into a grid of perturbation values a E | amaxx Ammx]] and B e [- Bmaxx {max] such that the loss values form a matrix:
L [C( od, (dz)] tR Xng
(52)
20

---

Published as a conference paper at ICLR 2026
where na and ne the number of grid points along the and | directions, respectively. Finally, L visualized as either 3D surface or a 2D contour plot:
C(a, 3) Lie + ad1 + 3d2) E
(53)
where the gradient of the loss surface reveal the flatness, sharpness, or other geometric properties of (()) in the vicinity of the parameter set. As shown in the left part of Fig. ??, the 3D loss landscape reveals that the TGO-optimized model maintains stable loss convergence, demonstrating robust performance. In contrast, the vanilla SNN exhibits localized reverse peaks in the loss landscape under attack. This instability is due the FGSM gradient-bar loss gradient, causing significant fluctuations in the loss. Specifically, FGSM computes the gradient of the loss with respect the imput image and perturbs the input to maximize the loss, pushing the vanilla SNN into regions of the loss landscape that are highly sensitive to small perturbations. In contrast, the TGO-optimized model exhibits smoother transitions in the loss landscape, indicating that its optimization enhances stability against adversarial attacks.
attack, which perturbs the input along the
G LIMITATIONS
The limitations of this study include the performance evaluation of Our TGO method on larger model architectures, primarily because existing research predominantly utilizes these specific network structures and their corresponding datasets. For comparative consistency, maintained these established architectures. Additionally, we have not addressed deployment challenges related to hardware transitions, nor conducted robustness testing in authentic edge-computing adversarial environments. These limitations will be addressed in future research. The experimental results presented in this paper are reproducible, with detailed explanations of model training and configuration provided in the main text and supplemented in the appendix. Our code and models will be made publicly available on GitHub upon acceptance of this paper.
H USE OF LARGE LANGUAGE MODEL
In preparing this manuscript, we utilize a large language model (LLM) solely to aid and polish the writing. The LLM is used for grammar checking, language refinement, and improving clarity of expression. does not contribute the formulation of research ideas, methodology, experiments, data analysis, or conclusions. All presented in this paper is entirely the work of the authors.
21


Reviews:
[{"review_id": "y6MeAjAvo7", "reviewer": "Reviewer_3pNN", "summary": "This paper introduces a Threshold Guarding Optimization (TGO) method to enhance the adversarial robustness of SNNs. By regulating neuron membrane potentials and employing probabilistic firing via noisy neurons, TGO significantly reduces vulnerability to adversarial perturbations, outperforming existing methods in various adversarial scenarios.", "questions": "Can the authors provide a more detailed derivation or intuition for Eq. (7)?", "limitations": "", "rating": 6, "confidence": 5, "soundness": 3, "presentation": 3, "contribution": 2, "strengths": "- This paper is well-written and logically structured, making complex concepts accessible and easy to follow.\n- This paper provides a mathematical analysis linking “threshold-neighboring neurons” to adversarial vulnerability, which is a novel and interesting framework for SNN robustness research.\n- The authors demonstrate the effectiveness of the proposed TGO method across a wide range of adversarial attack scenarios. The experiments span multiple datasets, network architectures, and adversarial settings, showing strong and consistent results, including outperforming SOTA baselines.", "weaknesses": "- The method introduces additional hyper-parameters such as coefficient parameter $\\lambda$ and noise level $\\sigma$. However, the effectiveness of the $\\lambda$ scheduling and sensitivity of the noise level $\\sigma$ is missing.\n- The paper does not report the additional training cost introduced by the TGO compared to baselines such as adversarial trainings (AT, RAT).\n\n**Limitation**\n\nAccording to the reported results, the proposed method appears to reduce clean accuracy, indicating a potential trade-off between robustness and standard performance.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "27T5jQyVE9", "reviewer": "Reviewer_TQh4", "summary": "This paper proposed a Threshold Guarding Optimization (TGO) method for enhancing the robustness of SNNs. TGO aims to reduce the number of threshold-neighboring spiking neurons, thereby decreasing the state-flipping probability. Noisy-LIF neurons are also adopted to eliminate the influence of adversarial perturbations. Experiments results show that TGO surpasses SOTA SNN-based adversarial defense methods.", "questions": "1. In Line 079, ‘TGO combined with vanilla SNNs surpasses those adversarial training strategies for the first time’. Which experiment supports this contribution?\n\n2. Typos in formulas. Like Theorem 1, Line 272 Vth. Please check the whole manuscript.", "limitations": "", "rating": 6, "confidence": 4, "soundness": 2, "presentation": 3, "contribution": 2, "strengths": "1.The reasoning of the paper is clear and coherent. Reducing the number of threshold-neighboring spiking neurons provides a new insight in enhancing the robustness of SNNs.\n\n2.The theoretical analysis of the paper is reasonable.\n\n3.The improvement of TGO is significant, improving the robustness effectively. (Only if the experimental results are convincing, see weaknesses below)", "weaknesses": "1. In Line 021 in abstract and Line 061 in introduction, the authors mentioned their method can enhance ‘gradient sparsity’. Normally the sparsity corresponds to L0-norm [1]. However, in Theorem 1, the author aims to optimize L2-norm of the Jacobian matrix, which is inconsistent to optimizing the gradient sparsity. The term ‘sparsity’ seems inappropriate.\n\n2. What is Figure 2 used for? The main text does not mention or introduce Figure 2, leaving Figure 2 alone. What is $H[t]$ in Figure 2(a) and Figure 2(d)? Why does the state-flipping probability correspond to $H[t]$ (or $U[t]$) instead of $V[t]$? In Figure 2(c), it seems that your method only penalizes membrane potential under threshold, and membrane potential beyond threshold remains unchanged.\n\n3. The experimental results are unconvincing. \n- 3.1 The authors only conducted experiments in CIFAR100 (and a small experiment in DVS-CIFAR10). In Line 335, the authors mentioned CIFAR10, but I cannot see any experiment of CIFAR10 even in Appendix. \n- 3.2 The authors only adopted ANN-based attacks. As the paper focuses on SNNs, SNN-based attacks such as [2][3] must be included for comprehensive evaluation. \n- 3.3 In Figure 3, your method TGO+AT (about 59%) is lower than SR+AT (about 62%) in clean accuracy. However, in Table 1, TGO+AT (64.49%) is higher than SR+AT (60.37%) in clean accuracy. \n- 3.4 Moreover, the adversarial accuracy in APGD and MTPGD in Table 2 is significantly higher than PGD in Table 1. As APGD is much stronger than PGD, why does this situation occur? For instance, in Line 367, PGD10 obtained 22.75% accuracy, while in Line 399, APGD10 only obtained 29.19% accuracy.\n\nReferences:\n\n[1] Liu, Yujia, et al. \"Enhancing Adversarial Robustness in SNNs with Sparse Gradients.\" International Conference on Machine Learning. PMLR, 2024.\n\n[2] Lun, Li, et al. \"Towards Effective and Sparse Adversarial Attack on Spiking Neural Networks via Breaking Invisible Surrogate Gradients.\" Proceedings of the Computer Vision and Pattern Recognition Conference. 2025.\n\n[3] Hao, Zecheng, et al. \"Threaten spiking neural networks through combining rate and temporal information.\" The Twelfth International Conference on Learning Representations. 2024.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "nAteDReqoG", "reviewer": "Reviewer_FMzT", "summary": "This paper proposes a training strategy, termed TGO, to enhance the robustness of spiking neural networks (SNNs) against adversarial attacks such as FGSM, PGD, and their variants. The main idea is to constrain the membrane potential to remain sufficiently distant from the firing threshold, thereby reducing sensitivity to perturbations. In addition, the strategy introduces neuron-level perturbations (NLIF) and regularizes the probability of spike flipping. Experiments on the CIFAR-100 dataset demonstrate the effectiveness of the proposed approach.", "questions": "Please address W2–W5 in the Weakness section. I will consider increasing my score if these concerns are fully addressed.", "limitations": "", "rating": 4, "confidence": 3, "soundness": 3, "presentation": 2, "contribution": 3, "strengths": "**S1.** The idea is straightforward and easy to understand.\n\n**S2.** The authors conduct extensive experiments, including Expectation over Transformation (EoT) and loss landscape analysis.\n\n**S3.** As shown in the tables, TGO achieves the best robustness performance compared with state-of-the-art (SOTA) training strategies.", "weaknesses": "**W1.** The explanation of the idea is unnecessarily complicated. In particular, Theorem 2 seems redundant — it is difficult to follow due to the heavy notation, and after reading the proof in the appendix, it appears to be a straightforward extension of Theorem 1.\n\n**W2.** I believe the proof of Theorem 3 may be incorrect. According to Appendix E, the flipping probability from 1 to 0 should be expressed as the conditional probability and the same applies to the flipping probability from 0 to 1.\n$$ \nP_{1\\rightarrow 0} = P(\\eta[t] < V_{th} - V[t] | V[t] \\geq V_{th}).\n$$ \n\n**W3.** Theorem 1 is proved under an $\\ell_2$ constraint, whereas the experiments are conducted with $\\ell_\\infty$ perturbations. This inconsistency raises questions about the necessity and practical relevance of the theorem.\n\n**W4.** According to Eq. (7), the constraint loss needs to be computed in a layer-wise manner. Meanwhile, the NLIF module introduces perturbations at every layer. How efficient is TGO in terms of computation compared with other training strategies? Does the training time increase significantly as the network depth grows?\n\n**W5.** The paper does not specify the value of $\\delta$ in Eq. (7) or explain how it was chosen. Please clarify it.\n\n**W6.** The paper contains some typos, though they do not affect my overall rating. A few examples are listed below:\n\n1. Line 182: $|J_f(x)|_2^2$.\n2. In Theorem 1, $\\eta$ has a mean of 0, whereas in Lines 316–317 and Figure 2(d), another mean $\\mu$ appears.\n3. In Eq. (11), it seems that $P$ should be used instead of $\\Delta P$.\n4. The clean accuracy is not highlighted in Table 1.\n5. In Appendix C, the proof is written under the condition $||\\delta||_2 \\leq 1$ rather than $||\\delta||_p \\leq 1$.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "tpCwXPnJDO", "reviewer": "Reviewer_23Ay", "summary": "This paper introduces a Threshold Guarding Optimization (TGO) approach against the adversarial robustness problem of directly-trained spiking neural network (SNNs) architectures. The method relies on defending neurons that have membrane potentials very close to the firing threshold, which SNN adversaries essentially exploit. The defense mechanism uses (1) layerwise loss regularizers that move neuron membrane potentials away from the firing thresholds, thus effectively creates sparsity in the surrogate gradients, and (2) noisy LIF neurons to reduce the likelihood of state-flipping under minimal adversarial noise disturbances. Experiments on CIFAR-10/100 with VGG-11 and WRN-16 architectures demonstrate that TGO is effective when combined with adversarial training based methods.", "questions": "- One of the most critical components of the defense is the use of randomness and injecting noise during inference. This is well-known to significantly prohibit accurate adversarial robustness evaluations. However, authors state that they only employ EoT to investigate this in Appendix B, although EoT and reliably evaluated robust accuracies under random restarts should have been present in all evaluations of the main manuscript.\n\n- The paper talks about directly-trained SNNs and surrogate gradient choices, but never really states the exact surrogate gradient function used in training and evaluation of their models?\n\n- Following the above question, there is also already an established surrogate gradient ensemble based SNN attack, which the paper does not consider: https://openreview.net/pdf?id=I8FMYa2BdP . It essentially aims to evaluate directly trained SNNs more reliably, by allowing the white-box adversaries to try out different surrogate gradient functions for more stable attacks. This aligns with basic security principles, where white-box adversaries should have complete access and capabilities in evaluating models. I would expect the authors to evaluate their \"adversarially robust SNNs\" under such ensemble attacks, by reporting robust accuracies under surrogate gradient adaptive adversaries.\n\n- The notion of imposing gradient sparsity was already the main idea in the SR approach. How is the present paper different?\n\n- Why are the naive attacks in Table 1 for CIFAR100/WRN-16 with AT+TGO(Ours) more effective than the results in Table 5 when EoT is added? The main idea in EoT is to obtain more rigorous adversaries, without making the attack weaker?\n\n- In Table 2 APGD_CE row, increasing the steps from 80 to 100 makes the attacks slightly weaker, given the numbers in the table. This should not happen in any case. There is some ambiguity regarding the convergence of attacks. How is the attack success calculated with increasing number of iterations?\n\n- Are there any other datasets/architectures that this approach would scale and advance the SoTA? Can we use this method besides VGG and WRN type of spiking networks, or on images larger than 32x32 resolution?\n\n- In general, evaluations are also demonstrated at a stronger perturbation radius than in the training phase. Also, is there the usual \"random restarts\" idea implemented in these multi-step PGD attacks?\n\n- No hyperparameter details are present. What is the lambda hyperparameter value in the main results? It is not clearly described anywhere, and none of the results for lambdas match consistently between Table 1 and Table 7 either, there appears to be some rows shifted or something. Overall, it is not possible to extract accurate information from the current presentation of results either.\n\n- The results on DVS datasets are only present in Appendix A, very briefly without details. Can the authors elaborate further, how they actually implemented this? These attacks should be fundamentally different to implement, since the inputs are binary. How does the perturbation strength work here for instance? Also, there is a typo there: DVS-CRIAF10 -> DVS-CIFAR10.\n\n- Regarding Figure 4 right side loss landscapes - It is not described how two-dimensional loss landscape visualizations are generated?", "limitations": "", "rating": 2, "confidence": 5, "soundness": 1, "presentation": 2, "contribution": 1, "strengths": "- The paper analyzes a clear cause of adversarial robustness of SNNs, i.e., neurons having threshold-neighboring membrane potentials for test samples. This is also the case for ANN neuron activations, which naturally aligns well in this paper.\n\n- The narrative and descriptions of the TGO methodology is clear.", "weaknesses": "- Experimental evaluations are rather ambigious to draw any conclusions (e.g., noisy inference processes, potentially missing random restarts and EoT, weak attack strengths). It also appears like with simple BPTT, TGO is not highly effective as a standalone defense. Furthermore, surrogate gradient ensemble evaluations are missing, which should have been the rigorous attack baseline for SNN adversarial robustness.\n\n- There are several missing details in terms of hyperparameters, evaluation settings and consistency of the results from the main text to the appendix (where there are really informative results existing).", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}]

Author rebuttal:

Decision: Accept (Poster)