A Unified Total Variation Framework for Membrane Potential Perturbation Dynamic
Authors: Zhao-Rong Lai
Xiwen Yuan
Ziliang Chen
Liangda Fang
Yongsen Zheng
Venue: ICLR 2026 Poster (2026)
Keywords: Membrane potential perturbation dynamic
spiking neural network
total variation
Primary area: alignment, fairness, safety, privacy, and societal considerations

Abstract: Membrane potential perturbation dynamic (MPPD) is an emerging approach to capture perturbation intensity and stabilize the performance of spiking neural networks (SNN). It discards the neuronal reset part to intuitively reduce fluctuations of dynamics, but this treatment may be insufficient in perturbation characterization. In this study, we prove that MPPD is total variation (TV), which is a widely-used methodology for robust signal reconstruction. Moreover, we propose a novel TV-$\ell_1$ framework for MPPD, which allows for a wider range of network functions and has better denoising advantage than the existing TV-$\ell_2$ framework, based on the coarea formula. Experiments show that MPPD-TV-$\ell_1$ achieves robust performance in both Gaussian noise training and adversarial training for image classification tasks. This finding may provide a new insight into the essence of perturbation characterization.

Published as a conference paper at ICLR 2026
A UNIFIED TOTAL VARIATION FRAMEWORK FOR MEMBRANE POTENTIAL PERTURBATION DYNAMIC
Zhao-Rong Lai', Xiwen Yuan Ziliang Chen', Liangda Fang', Yongsen Zheng "Ganggong Key Laboratory of Data Security and Privacy Preserving,
College of Cyber Security, Jinan University Department of Mathematics,
College of Information Science and Technology. Jinan University
RResearch Institute of Multiple Agents and Embodied Intelligence, Peng Cheng Laboratory *Department of Computer Science,
College of Information Science and Technology, Jinan University
'College of Computing and Data Science, Nanyang Technological University
DDigital Trust Centre, Nanyang Technological University lai raizhr@ jnu. edu. en, yxx2004125estu22233 jnu edu. en
c. P.zil 1 anggeahoo.. com, fangl enu. cn, yongsen. zheng@ntu.ede edu.. sg
ABSTRACT
Membrane potential perturbation dynamic (MPPD) is emerging approach capture perturbation intensity and stabilize the performance of spiking neural net- works (SNN). It discards the neuronal reset part to intuitively reduce fluctuations dynamics, but this treatment may be insufficient in perturbation characteriza- tion. In this study, we prove that MPPD is total variation (TV), which is widely- used methodology for robust signal reconstruction. Moreover, we propose a novel TV-1 framework for MPPD, which allows for a wider range of network functions and has better denoising ad advantage than the existing TV-(2 framework, based on the coarea formula. Experiments show that MPPD-TV-E, achieves robust perfor- mance in both Gaussian noise training and adversarial training for image classifi- cation tasks. This finding may provide a new insight into the essence of perturba- tion characterization.
INTRODUCTION
Spiking neural networks (SNN, Maass 1997) are a main category of NNs that have caught more and more attention these years (Shen al., 2023; Li et al., 2024; Song al., 2024). Since they have sparse activation features (Yao et al., 2025), they require less computational complexity and power in training and operating than the NNs with dense activation features (Fang et al., 2023), making an advantage in deep learning scenarios (Pei et al., 2019; Perez-Nieves & Goodman, 2021). A key concept convey binary information et al., 2024; Ding et al., 2024a), which imitates the complex dynamics in the brain (Zhang & Li, 2020; Shi et al., 2024b; Yao al., 2022). Such concept bridges the computational properties of the SNN with those of the biological neural system, which opens up promising research topic for future works.
the SNN is the membrane potential (Xu et al., 2023; Zhu
Similar other categories of NNs, SNNs are vulnerable to attacks from adversarial examples (Goodfellow et al., 2015; Kundu et al., 2021; Ding et al., 2022: Bu et al., 2023; Hao et al., 2024). It holds back upplications of SNNs to scenarios with strict security needs (Yamazaki et al., 2022; Liang et al., 2023; Wu et al., 2024; Sharmin et al., 2019; Ding et al., 2024a;b; Geng & Li, 2025). One solution this problem is effectively identify the adversarial perturbations. By observing that membrane potentials contain adversarial perturbation information in the leaky integrate-and (LIF) neuron based SNNs (Sharmin et al., 2020), kind of membrane potential perturbation dynam- ics (MPPD) is proposed to analyze the dynamic properties of such perturbation information (Ding al., 2024a). further proposes use the mean square of MPPD (MS-MPPD) regularizer to stabilize the performance of SNNs against adversarial examples.
"Corresponding author.

---

Published as a conference paper at ICLR 2026
To better highlight our motivation, first provide the formula of MPPD (Ding et al., 2024a):
=A0 - E, u (2) - (t) A(u 1]s - 1] ut 1 1])
full MPPD
MPPD
neuronol reset
where [t] and s|[t] denote the pure membrane potential and spike of neuron in layer at time respectively. The notation with the tilde superscript is the perturbed version of the corresponding variable. The full MPPD is defined as the difference between the pure and the perturbed membrane potential: t' = uy efft), which equals the MPPD part on the right side of (1) when this neuron does not fire a spike. However, if the neuron fires spike, there will be an additional neuronal rexet part, which might cause fluctuations in [[] Hence this neuronal reset part is discarded by (Ding et al., 2024a) and only the MPPD part is used. Though intuitive, this treatment may be insufficient in perturbation characterization.
In this study, we discover and prove that MPPD is total variation (TV), which is a widely-used methodology in robust signal reconstruction (Rudin et al., 1992; Chan et al., 2006; Chen et al., 2006), function approximation (Chan & Esedoglu, 2005), and invariant risk minimization (Lai & Wang, 2024; Wang et al., 2025). TV accumulates the increments of function with respect to (w.r.t)) its arguments, which well fits the perturbation of membrane potential. The proposed methodology requires only one fundamental condition that the perturbation is a measurable function of the node index and the time-step of an SNN. This means that the temporal and neuronal evolutions of the SNN should be able to capture such a perturbation and then yield significant TV. This finding may provide a new insight into the essence of characterizing perturbations.
Our main contributions can be summarized as follows: 1. that the existing MS- MS-MPPD regularized SNN training model is a standard TV-éy framework. 2. We further propose a novel TV-&, framework for MPPD (MPPD-TV-(1). over the TV-62 framework: a) The I,- function space is larger than the I,2 function space in general deep learning settings, which allows for more classes of functions to membrane potentials. b) Based on the coarea formula, TV-&1 performs better than TV-(2 in robust signal reconstruction against adversarial perturbations, which better fits the architectures of SNNs. 3. We deduce the coarea formula, the dominated TV property, and the subgradient calculation for MPPD-TV-L1 Our methodology is applicable to most SNN architectures where a TV term is used to stabilize layer-wise internal state.
We prove that MPPD is TV and verify
has at least two advantages
PRELIMINARIES AND RELATED WORKS
We introduce some preliminaries and related works on SNNs, MPPD, TV, and adversarial attacks.
2.1 MEMBRANE POTENTIAL PERTURBATION DYNAMICS
Different from typical analog neural networks (ANNs), SNNs use spike sequences to send temporal binary information. This mechanism imitates the dynamic communications of biological neural systems. To exploit temporal spike information, the LIF model (Wu et al., 2019: Kim et al., 2022; Shi et al., 2024a) can be used to characterize how neurons work in SNNs. The discrete-form differential equations of LIF are as follows:
c Aul( [t
Σ
w o [4], 400 H(((( un)) wil = o11((1 -(()),,
where [/[t] denotes the membrane potential of neuron in layer at time-step t before firing (i [N'] : 2, , E [T]: E [L]; od = 0). H is the Heaviside function such that if u/(t] is no less than the threshold thi, then the spike function { 1; else x(((] = O. w/y denotes the weight of the edge connecting neurons and j. where j is from the preceding layer (1 1). u/it]
denotes the membrane potential after firing, which resumes to the resting potential (i.e., 0) and waits for being transferred to the succeeding time-step with a decaying leaky factor X E [0, 1).
As introduced in Section 1 and (1), the MPPD is defined as (Ding et al., 2024a): [ Xe{[t 1] E, [t).
1,2, ... .T.
(3)
where As/ == s) [t] 5/ [t] denotes the difference of the presynaptic spike, and the neuronal reset part in (1) is discarded. 'Then the MS-MPPD regularized SNN training model is (Ding et al., 2024a):
min {C = Lrask + a- LMS-MPPD) w
(4)
2

---

Published as a conference paper at ICLR 2026
No
s.t. (aw.::1-CEE(s000)0000000000----- CAsSS//
ΣΣ (5)
where z E Rd (or 2) and y E Y denote the pure (or perturbed) input and the corresponding ground- truth output of the training samples, respectively. JSNN denotes the function induced by the SNN, and CE denotes the cross-entropy classifier. X is mixing hyperparameter with default value of 0.5, and a > is a regularization hyperparameter for LMS-MPPD. N denotes the number of neurons in the L-th layer (the last layer). To summarize, model (4) sums up the mean squared perturbations with a factor a to the task loss, in order to suppress such perturbations in the train- ing process. The training algorithm is standard Spatio-Temporal BackproPagation (STBP) with the triangle-like surrogate function (Deng et al., 2022) in place of the non-differentiable Heaviside function with 1 by default:
[t
max(w - |o][t] - ueal 0).
(6)
W
2.2 ADVERSARIAL ATTACKS
It is widely-recognized that NNs are vulnerable to adversarial attacks. These attacks deliberately change the input data for a little bit, in order to make the NNs give incorrect results. The SNN also suffers from this problem, although it has higher activation sparsity than the ANN. A common attack strategy is to maximize the network loss when the classifier f TRd + Y makes an incorrect classification after receiving a perturbed input (I: + 5): max (f + 5), ||
where ||ól|, < means that the attack is imperceptible with l, norm no more than an intensity hyperparameter Ç > 0. For images, < is often set as an integer multiplied by 1/255.
Fast Gradient Sign Method (FGSM, Goodfellow et al. 2015) is a fundamental attack technique to generate adversarial examples by adding small component in the same direction of the gradient sign:
i == C' (V Crask (f))
(8)
where 0 < 5" < {/|lsign( V Ct (f(z), lpp Based on FGSM, the Projected Gradient Descent (PGD, Madry et al. 2018) attack technique is further proposed to achieve a stronger attack of "first- order adversary":
1(++1) = [e:c + n (V. (J (E))))
where 17 represents the step size for single PGD iteration, and projs,[mcc denotes the projection operator onto the closed neighborhood of x with a radius of Ç. Besides the above gradient-based attack schemes, C&W is also popular optimization- attack mechanism (Carlini & Wagner, 2017).
2.3
TOTAL VARIATION
TV (Rudin al., 1992) is widely-used operator that measures the degree of variation in function. We consider open set Ω C gd and denote L (2) as the corresponding Lebesgue-integrable function space. The TV of any f E L L'()) is originally defined as (Chan et al., 2006):
V Vifl= = supff / f(x)ddvg(()) dx g CO, Rd), (I9ll.= < 1}.
(10)
where divg denotes the divergence of a differentiable function g. g has compact support contained in S and an essential supremum no larger than 1. TV quantifies the local variations of f across all dimensions of x, and then accumulates these variations over the entire domain Ω. If is non- differentiable, then |V fl is characterized via divg. But when f is differentiable, / is exactly the magnitude (i.e., the lg norm) of the gradient V..
In practice, only functions with bounded variation (BV) can be calculated, which constitute the BV function space (f I.)( : Sa /VIl < oo). Hence TV function actually refers to a BV function in this paper. TV has an important property that can be represented by the following coarea formula
(Chan et al., 2006):
J, 1())
[V :-
d
(11)
3

---

Published as a conference paper at ICLR 2026
f(z) = ) represents the level set (or preimage) of f at the value dh. (11) indicates that this integral is calculated by aggregating all contours of (v) for every &i where the differential dı exists. Hence if f has more blocky suecewise-constane landscape, its TV will be smaller. Based on this property, minimizing TV helps to preserve discontinuous features of f. while effectively reducing noise and other unwanted fine-scale details. The TV-&, model (Rudin et al., 1992) is proposed to this end:
where (+) := {x E
inf (EL
(12)
where f E (12) denotes the recovery of the target function f, and À is hyperparameter that controls the approximation accuracy. This model aims to preserve the sharp discontinuities in the recovery í while using the residual (J - f) to capture and retain noise as well as other unwanted fine-scale details.
If f has a stronger TV condition that Jn / < co, then the following TV-l2 framework can also be used (Mumford Shah, 1985):
U V +
inf fel
(f - f)² dr
(13)
Compared with TV-4, TV-12 uses the squared TV term Jo / which does not have the coarea formula (11) and thus lacks robustness to sharp noises.
METHODOLOGY
We observe that MPPD accords with the concept of TV not only by its formulation of (3) but also by its motivation suppress perturbations. Hence aim to establish a complete theory and method- ology for the TV based MPPD, in order to improve its robustness to adversarial perturbations.
3.1 TOTAL VARIATION FORMULATION OF MEMBRANE POTENTIAL PERTURBATION DYNAM- ICS
(3) has a natural form of differences in both dimensions of time-step and node index. In the time- step dimension, the perturbation term c/[t] is influenced by its cee-step-forwwad term c/ft 1]. In the node index dimension, c[[t] is influenced by its preceding nodes Σ, Asy [t). Since the preceding nodes of given node i are fixed,
omit the layer notation to simplify expressions. Then we need to verify that both sides of (3) are well-defined in the framework of TV.
Part (a): We first examine the left side of (3). By taking the node index i, the time-step I, and the input x as arguments, the perturbation term intends to approximate the difference between the pure and the perturbed membrane potential:
c(i, x:) = v(i, f, vii, t,
v(i, t,x) u(i, t, 5),
(14)
where 8 denotes the perturbation added to the input x. We find that if d can be represented by and == 6(i, t), then the right side of (14) is exactly local variation of v w.r.t (i, at æ, which can be directly defined e(i, tt z):
<(i, x) = V (i,,))
== v(i, f, - v(i, f, + t),,
(15)
The reason is that the perturbation 5(i, t) can be embedded into the SNN at node and time-step t. The symbol V(..) means that this difference is performed the unified dimensions (i, t) via d(i, t). Then Las MPPD in (5) is exactly TV-22 term: T 21,
No J."
A
((,,) dt
Vo E Rd
(16)
where the integrations w.r.t. and / take the discrete form for discrete-time SNN.
Part (b): The right side of (3) actually re-calculates the local variation of v by exploiting the infor- mation flow based on the network structure. Similar to (15), the local variation of the spike function s can be represented by:
As f)) = t,) s(jtt x + 8(i,t)) =: V).
(17)
Then the right side of (3) can be transformed into the following local variation:
(i,, 1.x)) -1,,
5(( Vanss(it.addd(..00))
(18)
4

---

Published as a conference paper at ICLR 2026
where [()) denotes the index set of the nodes preceding i, and the weight w(i, (t)) serves measure for the integral. w(i, j(t)) is assumed to be a finite measure in this paper, which is the case in general practice of neural networks. To simplify notations, we use fo() dw(i,,(()) for the
univariate integral w.r.t. j with fixed and J1 fo(n d(((i,(()) for the bivariate integral w.r.t. the entire (i, (1)) respectively. After integrating on j. the second term of (18) is still local variation at (i, L.).. By joining both sides of (3), we can directly well define MPPD in the form of TV without entailing the neuronal reset part in (I). By this means, the perturbation 8 can be fully conveyed by the MPPD throughout different nodes and time-steps of an SNN.
Theorem 1. If the perturbation 5 is a measurable function of (i,t), t), then the following equations on local variation and TV hold:
V (i,s)((i,t AV 1,))+ [ V v(i,t,z), (19)
J. J (anp
- -/, N 1. AY Aaapp(itt 1, 5(0
1
dt di, Va.
(20)
The above integrals allow for any feasible measure rypes for i and t in the mathematical form, including both discrete and contimuous measures.
The proof is provided in Appendix A. This appendix also verifies that the integral on the right side of (19) is finite, which is necessary for the dominated TV property of Theorem 4, in order control the overall stability of an SNN. (20) is the TV-{2 version of LMS.MPPD. denoted by MPPD-TV-(2. This MPPD-TV-L2 term is finite in general situations, stated in Theorem 4. Therefore, adding LMSMMPP in (4) actually suppresses the squared TV of membrane potential throughout the entire SNN, order suppress the adversarial perturbations inside the TV. To do this, the condition that 8 is measurable of (i, L) is fundamental, otherwise å cannot be fully identified by the SNN and yield significant TV. An intuitive interpretation of the term measurable is that different magnitudes of d can be discriminated via different combinations of nodes and time-steps. This accords with the common sense that using more nodes and time-steps may improve the accuracy of identifying adversarial perturbations.
3.2 MPPD-TV-L,
In the previous subsection, we prove that MPPD is TV and the corresponding LMS-MPPD is equiv- alent to a TV-&, model. Without loss of generality, we can assume V ((,,) = 0 and / being an integer. Then (19) can be aggregated w.r.t. all the < t as follows:
V ()) E*/ J(
V00 dwl(i
(21)
which reveals a difference evolution process along the node (i) and the time-step (k) dimensions. Besides, Va,cju(,, x. is directly the sum of spike perturbations, thus its absolute value (instead of the squared value) quantifies the exact magnitude of these perturbations. Moreover, TV-&, has at least two advantages over TV- 1) TV- can exploit the coarea formula to suppress adversarial perturbations. 2) With finite measure, an 122 integrable function is also an I,1 integrable function, but the converse is not true (see Appendix A.3). Hence the 1,1 function space is larger than the L function space with finite measures for i and t (for example, when i [N]. t [T], and the counting measure is used), which allows for more classes of functions to be membrane potentials, and expands the applicability and flexibility of TV-4, These findings and advantages motivate to develop a novel TV-6, framework for MPPD (MPPD-TV-(.).
The first step is to establish the coarea formula for the membrane potential We denote the unified domain of (i, t) by θ and the corresponding measure by μ. For example, θ = [N] x [T] and u(((i,)) 1, v(t, E θ can be used for standard discrete SNN.
5

---

Published as a conference paper at ICLR 2026
Theorem 2 (Coarea Formula). If the perturbation ō is measurable function of (i, (t. the following coarea formula holds for both continuous and discrete settings:
So (ass)(i,, -
- dpdd,
Vx,
(22)
where yp denotes the Hausdorff measure induced by μ.
The proof is provided in Appendix A.2. Taking the above standard discrete SNN as example, the coarea formula counts the number of points (i, t) at which vi(.,,, equals a fixed a) then aggregates
all the infinitesimal surface areas along sb E (-o0, 00): En s (f((, E O v(i, x) = v)) Adb
In brief. the TV will increase significantly if the Hausdorff measure (f((i, t) E θ t(i,t t. = b))
corresponding to the interval [&), s + Yي) is large. Such intervals and points may contain target
perturbations and thus could be suppressed in the objective. Based on this property, we can develop
the MPPD-TV-6, framework as follows.
Theorem 3. If the perturbation ó is a measurable funcsurralleunnction of (i, t), then the following MPPD-7V-I1 well-defined:
1 V (ospe(ttt))dd
Σx*
JS (. dw)(, du, Vx.
(23)
K=
The above integrals allow for any feasible measure types in the mathematical form, including both discrete and continuous measures.
The proof is provided in Appendix A.3. This TV formulation penalizes the total accumulation of potential changes over time, not just the potential at the moment of a spike. The membrane potential v(i, evolves continuously based on input currents, even when no spike occurs. Replacing the fMS-M PPD term in (4) by the MPPD-TV-(, term in (23), the new MPPD-TV-4, framework can be used for different tasks.
3.3 PROPERTIES OF MPPD-TV-L,
We investigate two useful properties of MPPD-TV-E in this subsection. First, an important property of SNN is that the perturbation dynamics should be dominated by the spikes (Khalil, 2002). We verify that this property also holds in both MPPD-TV-L, and MPPD-TV-6, frameworks.
Theorem 4 (Dominated TV Property). To simplify notation, assume every node in layer I uses the same set of preceding nodes I in layer (I. Then for MPPD-TV-E, defined in (21) and (23) and MPPD-TV-E, TV defined in (20), the following dominated TV property holds:
J. .N I" (anno(i,t, dt di < ||willa loga( e 1 S.T (on)
(2)
(24)
h N' J. (any(i, di < || logg / [" (V,,)( audj.. VI, Vr, (25)
where [|well and ||wI] F denote the 1-norm and the Frobenius norm of the weight matrix wy con- necting layers I and (1 (1-11 1), respectively. (24) also holds in the discrete form by replacing the scaling factor ||well logx(? by [ell
1-x
The proof is provided in Appendix A.4. For general situations such as sparse or skip-connected SNN architectures, the weight matrix wi simply has zero entries corresponding to non-connections, and the set of preceding nodes [(i) is proper subset of the entire layer (1- 1). The proof structure and the fundamental dominating bound remain valid. Note that (V x)] < 1 from the definition of the Heaviside function, and the integration limits for and j are also finite. Hence the integral on the right side of (24) or (25) is finite, which is able to control the left side. This theorem indicates that the TV of membrane potential v is dominated by the TV of spike up to factor of ||wz|] I logx(4) In this factor, ||w]|] || indicates the spectral energy spread caused by the edge weight, while logx(3) indicates the scaling effect caused by temporal evolution. The closer À is set to 1, the larger scaling of spike TV is required to dominate the membrane potential TV. Nevertheless, À is

---

Published as a conference paper at ICLR 2026
usually set very close to 1 to simultaneously keep the smoothness of temporal evolution and ensure the above dominated TV property.
The right side of (23) is nondifferentiable w.r.t. the weight (t), thus w(i, cannot be trained by mainstream learning architectures like Pytorch', To solve this problem, we complete the backpropagation module with a closed-form subgradient calculation of (23). This strategy is widely- used to deal with nondifferentiable terms in general machine learning tasks (Lin et al., 2024a;b).
Proposition 5 (Subgradient Calculation). subgradient of (23) w.r.t. the weight jo(i, can be calculated as follows:
1. Ow((,(())
Σ 1 I JI
x) kk
du
k=0
sign(
(un)s(,ttk, j(,))
A (i..)s(,,t-k,,)) dp. (26)
((a)
R=
k==
The proof is provided in Appendix A.5. can be seen that this subgradient calculation works as a standard gradient calculation and will not cause additional computational complexity. Based on this property. the MPPD-TV-L, framework compatible with mainstream learning architectures and enables the training of SNNs. Moreover, this subgradient captures the sensitivity of the TV to the weights at every timestep I, regardless of whether the potential crosses the threshold and reset. By minimizing the TV, the model weights are enforced to produce membrane potential trajectories that are globally smoother and less responsive to small changes in the input (noise). This inherent smoothness regulates the weight updates such that even small, sub-threshold input perturbations suppressed by a sensitvve weight profile.
EXPERIMENTS
To test the performance of the proposed MPPD-TV-E, framework in improving the robustness of SNNs, we basically follow the evaluation baseline of (Ding et al., 2022; 2024a) to conduct image classification experiments. The code is available at https: / /gi thub. com/laizzrz MPPD-TV. TV.
4.1 EXPERIMENTAL SETUP
In the training stage, VGGII (Simonyan Zisserman, 2015) and WRNI6 (WideResNet- (,Zagoruykko & Komodakis, 2017)) with Dynamic LIF (DLIF, (Ding al., 2024a)) neurons used as backbones of SNNs, while CIFAR 10, CIFAR 100 (Krizhevsky, 2009), and Tiny ImageNet (Le & Yang, 2015) are used data sets CIFAR 10 and CIFAR 100 have 60000 32 x 32 images, categorized into 10 and 100 classes, respectively. Tiny ImageNet is a large-scale data set with 500 64 x 64 downsized images for each of the 200 classes. In the training procedure, the time-step for SNN to infer forward is set to 8. Gaussian noise and adversarial noise (AT, Wong et al. 2020) are used perturbations to construct training samples. In addition, the adversarial noise together with the regularizer of (Ding et al., 2022) is also used (AT+Reg), Perturbation strengths are set to <= 10/255 for Gaussian noise, Ç = 6/255 for AT, and Ç 7/255 for AT+Reg. The SGD opti- mizer is used with starting learning rate of 0.01, then the learning rate is reduced to zero via cosine annealing.
In the fest stage, the FGSM (Goodfellow et al., 2015), C&W (Carlini & Wagner, 2017). PGD (Madry et al., 2018), Auto-PGD (APGD), and AutoAttack (Croce & Hein, 2020) schemes are used to construct adversarial test samples, with attack intensity uniformly set to C 8/255. The number of steps for PGD ranges from 7 to 40, while the 10-step APGD based on the cross-entropy (CE) loss and the difference- of- of-loogis--rtii (DLR) is used. All these settings including Ç strictly follow those of (Ding et al., 2024a) to make fair comparisons.
Eight kate-of-the-aa methods are taken into comparisons: SNN-BP (Sharmin al., 2020), HIRE- SNN (Kundu et al., 2021), SNN-RAT (Ding et al., 2022), FEEL (Xu et al., 2024), SR (Liu et al., 2024), ANN-PGD-AT (Madry al., 2018), ANN-RiFT (Zhu et al., 2023), and MPPD-TV-&, (Ding
hhttpss//pytorch.orr//

---

Published as a conference paper at ICLR 2026
et al., 2024a). SNN-BP is deep SNN with inherent adversarial robustness based discrete input encoding and non-linear activations. HIRE-SNN is an mnergy-efficient deep SNN that can harness the inherent robustness. SNN-RAT'E is SNN with regularized adversarial training that can enhance robustness. FEEL is an SNN with frequency encoding and evolutionary leak factor. SR is an SNN with sparsity regularization of gradients. MPPD--T--2 is originally kind of robust stable SNNs, which is found to be a TV-62 framework in the context of this paper. Hence it is denoted by MPPD- TV-L2 to be comparable to the proposed MPPD-TV-L, framework. Besides, standard SNNs without MPPD (Non-MPPD) are also taken into comparisons as ablation studies. The default settings of these competitors are used in the experiments, where the regularization strength is set to a = 1 for both MPPD-TV-E, and MPPD-TV-(1
Table 1: Classification accuracies (%) of different methods CIFAR 10 and CIFAR 100.
Porturbation
Model
Clean APGD, U APGD FGSM PGD PGD PGD PGD CW AutoAttack
CIFAR 10
SNN-BP
89.3
15.0
3,8
HIRE-SNN, VGGS
87.9
35.5
5.3
VGGG1
90.74
45.23
21.16
VGGLL
87.850
21.960
32.620
41,920
30.060
28.220
19.970
19.540
$3.580
1.630
SR. SRGIG
88,980
27.340
28.400
42.810
30.360 30.230
31.040
31.150
59.550
22,870
ANN-PGI VGG11
78.630
33,240
35.070
44.040
35.840 34,900
34,440
34,360
56.650
20.420
ANN-RiFT.VGGII
80,980
30.100
32.970
41.050
35,390 35,300
35.310
35.100 55.250
22.310
79.870
30.640
27.460
34,240
34. 34,960
34.790
34,310
60.930
19.830
ANN-
81,260
31,080
24,830
36.850
36.800
36.810
36.660
35,870
61.140
20.010
COn-MPPD.VGGGI
91,410
0.130
0.220
0.220
0.160
0.110
0.110
10.010
0.000
MPPD-TV-62. VGG11
90.990
0.130
0.160
15.160
0.230
0.110
0.060
0.060
10,410
0.000
Gaussian
MPPD-TV-4,NVGG1
92.230
0,340
0.400
20.250
1.140
0,620
0.410
0.370
13.030
0.290
Non-MPPD.
91.050
0.020
0.040
11.780
0.080
0.020
0,020
0.020
7,500
0.000
MPPD-TV-(,,
WRRN1
90.520
0.030
0.030
12.540
0.100
0.040
0.030
0.040
8.840
0,010
MPPD-TV-G.WRRT
W
92.390
0,060
0,040
15,350
0,420
0.270
0,180
0.150
10,520
0.010
VGGG1
85,030
29.820
34.350
46 66.960
52.520
34.600
34.240
33,850
60.640
16.390
MPPD-TV-2,
85,170
27.780
35.300
46,510
34.510
33, 33,200
32,260
32,470
63,050
19.75
86.110
36.590
45,260
51.890 42.840
41.560
41.150
40.850
66.680
23.040
AT
Nom-MPPD,WRNI6
84,720
26.870
31,770
50.090
33,000 31,460
29,
29.720
56,340
19,450
MPPD-TV-62.WRNI
84.380
30,270
34,150
49, 9509500
35.650 34.030
33.430
32.660
59.110
21.340
MPPD-TV-G,,WEL WRNN6
86.340
32.320
37.440
$2.500
39.040 37.900
36.740
36.290
63.870
22.920
Non-MPPD.VGGII
85.770
32,570
35,960
49,980
38.060 36.290
35.000
34.720
$3.870
14.06
MPPD-TV-6g. VGGI1
84,910
33.620
39,490
54.520
39.030
36.570
34.533
33,270
54.340
19.070
AT+Reg
MPPD-TV-6, VGG11
86,390
35,160
38.630
50,970
40.730
39,070
38,060
37.670
62.400
23.530
Non-MPPD,,RNII
84,640
35,500
38,270
56.880
40.290
37.380
34.870
33,270
50,250
11,160
MPPD-TV-6, WRNI6
84,220
33.530
37.430
58.320
100
35. 300
32,700
31.310
$3.570
13.69
MPPD-TV- TV. WRN16
85.400
36.680
39.580
57.440
41.490 38.260
35.900
34.780
60.580
18.010
CIFAR 100
BEVGIT
64.4
13.3
6.3
HIRF-SNN, VGGIT
65.6
16.4
2.9
VANGRA
68.89
25.86
17.81
FEEL VG
66.530
15,440
15,380
16.680
5.560
5,310
8,020
7,930
14.880
0,810
SRGI 67,930
11,530
11.740
19.690
13.160
13.180
13.750
13.740
25.350
10.540
ANN-PID-ATVGGII
47.050
15.120
15.630
20.340
16.350
15.850
15.750
15.600
34.760
7,470
ANN-RIFT.VGII
48,880
15.710
16.550
21.840
21.730
21.720
21.710
21.710
34.160
8.320
ANN-PGD-AT.WRN
$5.040
15.270
19.070
21.420
18. 970
18.890
18.110
18.590
34.250
4,290
ANN-RIFTWRNI6
52.480
14.620
18,560
18.560
18.540
18.540
18.520
18.360
35.010
7.870
Non-MIPDD.VGGI
68.770
0.540
1.120
8.330
0.980
0.710
0.690
0.570
11.030
0.080
SPPD-TV-62.VGGi
68,900
0.390
1.080
8.470
0.690
0.540
0..770
0.350
13.340
0.090
Gaussian
MPPD-TV-L, VGG11
69.410
0.820
1.520
8.680
1.390
1.150
1.070
0.960
12.640
0.250
Mon-MPPD, WRNI6
66.260
0.290
0.700
8,700
0.450
0.330
0.290
0.210
9.680
0.000
MPPD-TV-4,, WRNN6
65.990
0.190
0.810
9.070
0..10
0.290
0..140
0.090
13.130
0.110
MPPD-TV-6, WRNI6
67.770
0.350
1.010
8.210
0.560
0,430
0.350
0.360
12,570
0.050
Noo-MPPD.VGGII
56,370
16.460
19,400
25.260
19.950
19,300
19,140
19,010
34.170
8.560
MPPD-TV-2, VGGI1
57.820
12.920
16.690
24.550
16.440
15.600
15.180
14.960
34,650
8.450
AT
MPPD-TV-G,
58.410
16.600
19.670
25.720
20.570
19,970
19.710
19.440
35.210
11,590
Mon-MIPD..WNNI.
55.580
16.530
20,490
29.580
20.110
18.
18.080
17.950
37.810
6.470
MPPD-TV-6,,WRNE
54.720
13,570
17.620
25.790
16.850
16.050
15.410
15,030
38.630
8.750
MPPD-TY-,,WRNIG
MPPD-TV-6, WWNI6
56.060
16.630
19,830
27.400
20.000
19.270
18.480
18.420
39.370
9.140
Non-MPPD. VGGI1
62.190
21.550
23,440
34.370
24.680 22.650
20.850
20.060
35.820
6,260
MPPD-TV-+2.VGGE
61.980
19.480
24.220
35.940
23.010 20.380
17.940
16.650
36.640
5,680
AT+Reg
MPPD-TV-A, VGG11
62.710
21.740
23,700
34.390
25.360
23.650
21.520
20.620
39.710
10,800)
Non-MPFD,WRNIO
53.740
15,730
19.110
28.710
18.220
16.960
15.980
15,290
31.880
4,330
HPPD-TV-&,
54.010
15.510
21.550
33.000
19.210
17.090
15.270
443900
33,870
5,350
MPPD-TV-E, WRNI6
54.140
17.910
20.790
29.770
20.550
19.100
17.870
17.300
35.450
8.490
8

---

Published as a conference paper at ICLR 2026
Table 2: Classification accuracies (%) of different methods on Tiny ImageNet.
Perturbation
Model
Clean
APGD
APGD
NLR
FGSM
PGD*
PGD
10
PGD30
PGD
40
CW
AutoAttack
FEEL VGGII
55,230
8,380
8,930
15.860
10.670
10.270
10.150
10.090
1.720
0,570
SR.IG
56.010
8.510
8.780
16.940
11.960
11,580
11.370
11.180
2.450
2,880
ANN-
23,330
1.290
1,980
5.200
2.380
2.150
2.070
1.600
0.760
0.470
24.510
1,400
2.460
6,780
2.270
2.170
1.830
1.610
1.220
0.620
ANN-PGIDAT WRI11
15.040
0.670
0.900
3,510
1.470
1.280
1.010
0.690
0.620
0.190
WNN-RIFTWRNIG
14.670
1.030
1,670
3,270
1.690
1.440
1.110
0.860
0,510
0.070
Non-MPPD. IGGII
54,280
2.020
2.260
9.870
3,380
3.040
2.910
2.950
0,820
10.590
MPPD-TV-C, VGGI1
55,470
1.980
2.380
10.110
3.420
3.290
3,430
3,290
1.990
11.460
Gaussian
MPPD-TV-E. .GGLI
$6,530
2.380
2.770
10.340
3.770
3.660
3,580
3.470
2.500
12.310
Non Non-MPPD.WRNI6
43.110
1,970
1.630
6,380
2.350
2.270
2,190
2.070
0.740
1.070
MPPD-TV-22 WRN16
44.290
2.070
1,980
6.540
2.520
2,410
2.370
2.240
2,080
1.230
MPPD-TV-6, WRN16
46.750
2.820
2.780
7,050
3.720
3.710
3.590
3,680
2.460
1,380
Non-MPPD.VGGII
47,880
8.750
9.840
18.310
13,940
12,830
12.570
11.830
0,980
3.740
MPPD-TV-G, VGG11
48,380
8.350
9.460
19.450
13.210
13,080
13.050
12.770
1.430
3.890
AT
SEND-TV-&.VGGII
49.290
9.520
10.720
20.770
14.090
13,660
13.420
13,290
2.790
4,080
Non-MPPD.WRNIG
33.620
3.710
4,030
12,250
6,950
6,310
6.110
6.040
1.400
2.070
MPPD-TV--2 WRRN16
33,990
4.230
4.960
12,730
7.360
7.290
7.170
2.450
2.310
MPPD-TV-,, WRNN6
WRN16
35.000
5.420
5.730
13.720
7.840
7,480
7.330
7.240
3.170
2.660
Nen-MPPD.VGGII
49,390
8.850
9,740
22,090
12,820
12,640
12.340
12.290
1.390
5.570
MPPD-TV-6,.GGGT
50.720
9.740
10.080
23 23.080
13,970
13.610
13.480
13,250
1.270
6,290
AT+Reg
MPPD-TV-6. VGGIL
52,990
10.440
11,050
23.440
14,290
13,980
13.520
13,430
2.990
6.720
Non-MPPD, WRNI6
28.660
6.310
5.920
12,470
7.770
7.540
7.390
7.280
1.190
3.750
MPPD-TV-EE, WRRN16
29.090
6.720
6.180
12.350
8.280
7.940
7.770
7.490
2,580
3.950
MPPD-TV-,, WRN16 31.240
7.060
6.740
13.260
9.720
9,500
9.450
9.280
3.110
4.210
Table 3: Classification accuracies (%) of MPPD-TV-L, with different regularization strengths.
Model
Clean
10 APGD
APGD
FGSM
PGD"
PGD
2
PGD 40
CW
AutoAttack
CE
AT.a = 0.0 82,990
26.370
29.940
40.360
30.990
29.860
29.460
29.540
51.910
18,870
AT,a 0.5
83.250
28.100
31.420
41.400
32.470
31.470
31.380
30.860
54.800
20,800
AT,a 1.0 83.640
29.250
31.940
42.230
33.350
32.620
32.150
31.830
55.640
22.270
AT.a -2.0 82.860
30.090
32.840
42.800
34.140
33.450
32,960
32.820
57.660
23.190
AL.a 83.750
30.640
33.560
43,580
34.690
33,910
33.400
33.280
57.690
22.760
AT.a 3.0 83.550
30.430
33,240
43.330
34.540
33.420
33.120
32.780
60.070
25.020
AT,o = 3.5 84.010
30.460
33.910
43.630
34.680
33.830
33.360
33.130
56.670
13.590
AT,o 4.0 83.470
30.850
33.470
43,490
34.640
33.610
33,070
33.140
58.050
22.340
4.2 EXPERIMENTAL RESULTS
Image classification results of different methods are provided in Tables 1 and 2. MPPD-TV-2 outperforms other competitors in most cases for both VGG11 and WRN16 architectures on all of CIFAR 10, CIFAR 100, and Tiny ImageNet data sets. Taking the VGGI1 architecture with the AT training scheme on CIFAR 10 as an example, MPPD-TV-&, achieves classification accuracies of (45.260% 51.890%, 42.840%). compared with (34.350%, 46.960% 35.520%) of Non-MPPD and (35.300% 46.51%% 34.510%) of MPPD-TV-(2 for the APGD 10 spectively. Besides, MPPD-TV-(, outperforms MPPD-TV-6, and Non-MPPD on both clean and perturbed data. This indicates that MPPD-TV-L, really improves robustness not just against adver- sarial perturbations, but also against other types of detrimental noise. Note that AT+Reg is already a heavy double penalization for non-robust dynamics. The fact that MPPD-TV-L, shows little further improvement under AT+Reg suggests that MPPD-TV-E, is implicitly achieving the desired robust regularization effect that the explicit Reg treatment of (Ding al., 2022) is designed for. In the more common and important training scenario AT, MPPD-TV-E, consistently shows better perfor- mance, which proves its practical necessity and advantage as a standalone, effective robust training method. These results indicate that MPPD-TV-E, is effective in suppressing adversarial perturba- tions. The runtimes of different methods with VGGII and AT on the three data sets are provided in Table AI, which indicates that MPPD-TV-(, runs the fastest among the competitors. The gradient magnitudes for different methods with WRN16 architecture and AT training scheme on Tiny Ima- geNet are provided in Figure AI, which show that MPPD-TV-L, converges quickly to a low gradient magnitude level around the 400-th iteration, and maintains the lowest gradient magnitude among the competitors.
DLR FGSM, and PGD attacks,

---

Published as a conference paper at ICLR 2026
Moreover, MPPD-TV-Lz achieves more robust performance than MPPD-TV-6z, especially for the PGD attacks. For instance, when training both VGG11 and WRNI6 architectures with Gaus- sian noise on CIFAR 100, MPPD-TV-(, achieves significantly higher classification accuracies than MPPD-TV-2z on all the PGD attacks. Specifically, the accuracies of MPPD-TV-(1 with VGG1 on PGD", PGD "0 PGD and PGD are 1.390%, 1.150%, 1.070%, and 0.960%, respectively, which significantly higher than those of MPPD-TV-Ez: 0.690%, 0.540%, 0.470%, and 0.350%. More- over, as the number of iterative steps increases for the PGD attack, the gap between MPPD-TV-E, and MPPD-TV-(2 also increases. It indicates that MPPD-TV-L, is more advantageous when the perturbations get more adversarial.
4.3 REGULARIZATION STRENGTH &
To investigate the impact of regularization strength a, we use the VGG5 model to conduct experi- ments CIFAR 10, shown in Table 3. The values of are set to 0.0 4.0, respectively. Results show that MPPD-TV-(; achieves higher accuracies with a > 0 than those with a = against ad- versarial attacks, which indicates that MPPD-TV-L, is effective in extracting and suppressing such adversarial perturbations, As varies, the accuracies of MPPD-TV-L, reach their peaks around 2.5 3.0.
Next, we evaluate the adversarial robustness of MPPD-TV-L, with a VGGII architecture pre-trained on CIFAR 10 by subjecting it to PGD 10 attacks with gradually increasing intensity, then plot the resulting accuracy curves in Figures 1a and 1b. Specifically, we increase the attack intensity from 10/255 to 100/255 by increments of 10/255. Results indicate that the MPPD-TV-L, curves (a = 1) decrease more gradually than the Non-MPPD curves (a 0) as the intensity increases, especially with AT training samples. We also calculate the actual TV values for MPPD-TV-I, and Non-MPPD, shown in Figures Ic and 1d. Results indicate that MPPD-TV-4, (a 1) indeed produces less TV than Non- Mon-MPPD (a= = 0), which accords with the design intention of MPPD-TV..L
Accuracy,AT
Accuracy,AT+Reg Reg
MPPD-TV-L Gaussin
MPPD-TV-I 1,AT+Reg
10b
Accuracy
60
AT, a=1
AT, a-0
Accuracy|%%
60
80
AT Rog. a-0
RTg a=1
Total Total Variation
90
80
Caussion, a-0
Caussion, 0=1
ata Variation
200
220
AT-Reg a=0
XT-Rteg d=1
7D
180
160
50
140
20
20
40
120
30
100
100
100
40
100 Epoch
40 60
Attack Intensity
Attack Intensity
Epoch
(a) Accuracy, AT
(b) Accuracy, AT+Reg
(c) TV. Gaussian
(d) TV. AT+Reg
Figure 1: Accuracies and actual TV values of MPPD-TV-4, (a = 1) and Non-MPPD (a 0).
CONCLUSION
Membrane potential perturbation dynamic (MPPD) is a new method to capture and suppress adver- sarial perturbations for spiking neural networks (SNN), However, discards the neuronal reset part without reliable theoretical foundation. To fix this problem, we formulate that MPPD is total varia- tion (TV) and its regularization scheme is essentially a TV- model (MPPD-TV-(2) Based on this insight, we propose the MPPD-TV-E, model to further improve the robustness of SNNs. Because the I function space is larger than the T.2 function space with finite measures, MPPD-TV-L, facilitates broader classes of functions to be membrane potentials, thus expands its applicability and flexibil- ity. Moreover, MPPD-TV-L, can exploit the coarea formula while MPPD-TV-6, cannot, hence the former has better performance than MPPD-TV-6, in robust signal reconstruction against adversarial perturbations, which better fits the architectures of SNNs. The only fundamental requirement of the proposed theory is that the perturbation a measurable function of the node index and the time-step of an SNN, otherwise this perturbation cannot be captured to yield significant TV.
Experimental results show that the MPPD-TV-6, framework achieves better performance than other -fate-of-the-art methods in most test scenarios, and shows better robustness in complicated environ- ments with adversarial perturbations and signal distortions. In summary, we establish a theoretically- sound TV formulation for MPPD, which provides new insight into the essence of perturbation characterization for SNNs. Our methodology is applicable to most SNN architectures where TV term is used to stabilize layer-wise internal state. Future works may lie in applying the above theory to improve robustness of neuromorphic computing systems in safety-critical applications, such as autonomous driving and industrial control.
10

---

Published as a conference paper at ICLR 2026
ACKNOWLEDGMENTS
This work is supported in part by the National Natural Science Foundation of China (grant numbers: 62541606, 621 02176103, 62206110, and 62276114), in part by The Major Key Project of PCL (No. PCL2025A02 and No. PCL2024A04), and in part by the National Research Foundation, Singapore and Infocomm Media Development Authority under its Trust Tech Funding Initiative. Any opinions, findings and conclusions or recommendations expressed in this material those of the author(s) and do not reflect the views of National Research Foundation, Singapore and Infocomm Media Development Authority.
REFERENCES
Tong Bu, Jianhao Ding. Zecheng Hao, and Zhaofei Yu. Rate gradient approximation attack threats deep spiking neural networks. In Proceedings of the IEED/CVF Conference Computer Vision and Puttern Recognition (CVPR), pp. 7896-7906, June 2023.
Nicholas Carlini and David Wagner. Towards evaluating the robustness of neural networks. In 2017 IEEE Symposium Security and Privacy (SP), pp. 39-57. IEEE, 2017.
T. Chan, S. Esedoglu, F. Park, and A. Yip. Total Variation Image Restoration: Overview and Recent Developments, pp. 17-31. Springer US, Boston, MA, 2006.
T.F. Chan and Esedoglu. Aspects of total variation regularized ( function approximation. SIAM Journal on Applied Mathematics, (65):1817-1837, 2005.
Terrence Chen, Wotao Yin, Xiang Sean Zhou, Dorin Comaniciu, and Thomas S. Huang. Total variation models for variable lighting face recognition. IEEE Transactions on Pattern Analysis and Machine Intelligence, 28(9): 1519-1524, 2006.
Francesco Croce and Matthias Hein. Reliable evaluation of adversarial robustness with an ensemble of diverse parameter-fiee free attacks. In Hal Daumé III and Aarti Singh (eds.), Proceedings of the 37th International Conference on Machine Learning, volume 119 of Proceedings of Machine Learning Research, pp. 2206-2216. PMLR, 13-18 Jul 2020.
Shikuang Deng, Yuhang Li, Shanghang Zhang, and Shi Gu. Temporal efficient training of spiking neural network via gradient re-weighting. In The Tenth International Conference on Learning Representations, 2022.
Jianhao Ding, Tong Bu, Zhaofei Yu, Tiejun Huang, and Jian Liu. SNN-RAT: Robustness -eattneess-ehaaceddd spiking neural network through regularized adversarial training. Advances in Neural Information Processing Systems, 15:224800-27993 2022.
Jianhao Ding, Zhiyu Pan, Yujia Liu, Zhaofei Yu, and Tiejun Huang. Robust stable spiking neural networks. In Proceedings of the 41st International Conference on Machine Learning, IC...24. JMgR.org, 2024a.
Jianhao Ding, Zhaofei Yu, Tiejun Huang, and Jian K. Liu. Enhancing the robustness of spiking neural networks with stochastic gating mechanisms. Proceedingy of the AAAI Conference on Artificial Intelligence, 38()):422550, Mar. 2024b.
Wei Fang, Zhaofei Yu, Zhaokun Zhou, Ding Chen, Yanqi Chen, Zhengyu Ma, Timothée Masquelier, and Yonghong Tian. Parallel spiking neurons with high efficiency and ability to learn long- term dependencies. In A. Oh, T. Naumann, A. Globerson, K. Sacnko, M. Hardt, and S. Levine Advances in Neural Information Processing Systems, volume 36, pp. 53674-53687. Curran Associates, Inc., 2023.
Herbert Federer. Curvature measures. Transactions of the American Mathematical Society, 93(3): 418-491 1959.
Hejia Geng and Peng Li. HoSNNs: adversarially-robuu robust homeostatic spiking neural networks with adaptive firing thresholds. Transactions Machine Learning Research, 2025. ISSN 2835-8856.

---

Published as a conference paper at ICLR 2026
Ian J. Goodfellow, Jonathon Shlens, and Christian Szegedy. Explaining and harnessing adversarial examples. In Yoshua Bengio and Yann LeCun (eds.), 3rd International Conference on Learning Representations, ICLR, 2015.
Zecheng Hao, Tong Bu, Xinyu Shi, Zihan Huang, Zhaofei Yu, and Tiejun Huang. Threaten spiking neural networks through combining rate and temporal information. In The Twelfth International Conference on Learning Representations, 2024.
H.K. Khalil. Nonlinear Systems. Pearson Education. Prentice Hall, 2002. ISBN 9780130673892
Youngeun Kim, Hyoungseob Park, Abhishek Moitra, Abhiroop Bhattacharjee, Yeshwanth Venkate- sha, and Priyadarshini Panda. Rate coding or direct coding: Which one is better for accurate, robust, and energy-efficiee spiking neural networks? In ICASSP 2022 2022 IEEE International Conference on Acoustics, Speech and Signal Processing (ICASSP), pp. 71-75, 2022.
Alex Krizhevsky. Learning multiple layers of features from tiny images. 2009.
Souvik Kundu, Massoud Pedram, and Peter A Beerel. Hire-snn: Hamessiin the inherent robustness of energy-efficient deep spiking neural networks by training with crafted input noise. In Proceed- ings of the IEEE/CVF international conference computer vision, pp. 5209-5218, 2021.
Zhao-Rore Rong Lai and Weiwen Wang. Invariant risk minimization is a total variation model. In Pro- ceedings of the 41st International Conference on Machine Learning, volume 235, pp. 25913- 25935. PMLR, 21-27 Jul 2024.
Ya Le and Xuan Yang. Tiny imagenet visual recognition challenge. CS 231N, 7(7):3, 2015.
Yaxin Li, Qi Xu, Jiangrong Shen, Hongming Xu, Long Chen, and Gang Pan. Towards efficient deep spiking neural networks construction with spiking activity based pruning. In Ruslan Salakhut- dinov, Zico Kolter, Katherine Heller, Adrian Weller, Nuria Oliver, Jonathan Scarlett, and Felix Berkenkamp (eds.), Proceedings of the 41st International Conference on Machine Learning, vol- ume 235 of Proceedings of Machine Learning Research, pp. 29063-29073. PMLR, 21-27 Jul 2024.
L Ling Liang, Xing Hu, Lei Deng, Yujie Wu, Guoqi Li, Yufei Ding, Peng Li, and Yuan Xie. Exploring adversarial attack in spiking neural networks with compatill gradient. IEEE Transactions on Neural Networks and Learning Systems, 34(5):2569-2588 2023.
Yizun Lin, Zhao-Rong Lai, and Cheng Li. A globally optimal portfolio for m-sparse sharpe ratio maximization. In Advances in Neural Information Processing Systems, volume 37, pp. 17133- 17160, 2024a.
Yizun Lin, Yangyu Zhang, Zhao-Rong Lai, and Cheng Li. Autonomous sparse mean-CVaR port- folio optimization. In Proceedings of the 41st International Conference on Machine Learning, volume 235 of Proceedings of Machine Learning Research, pp. 30440-30456. PMLR, 21-27 Jul 2024b.
Yujia Liu, Tong Bu, Jianhao Ding, Zecheng Hao, Tiejun Huang, and Zhaofei Yu. Enhancing adver- sarial robustness in smns with sparse gradients. In Proceedings of the 41st International Confer- ence on Machine Learning, ICML'24. JMLR.org, 2024.
Wolfgang Maass. Networks of spiking neurons: the third generation of neural network models. Neural Networks, 10(9):1659-1671. 1997.
Aleksander Madry, Aleksandar Makelov, Ludwig Schmidt, Dimitris Tsipras, and Adrian Vladu. Towards deep learning models resistant to adversarial attacks. In International Conference Learning Representations (ICLR), 2018
David Mumford and Jayant Shah. Boundary detection by minimizing functionals, I. In Proceedings of IEEE Conference on Computer Vision and Pattern Recognition, pp. 22-26, 1985.
Jing Pei, Lei Deng, Sen Song, Mingguo Zhao, Youhui Zhang, Shuang Wu, Guanrui Wang, Zhe Zou, Zhenzhi Wu, Wei He, et al. Towards artificial general intelligence with hybrid tianjic chip architecture. Nature, 572(7767::006-111, 2019.
12

---

Published as a conference paper at ICLR 2026
Nicolas Perez-Nieves and Dan Goodman. Sparse spiking gradient descent. In M. Ranzato, A. Beygelzimer, Y. Dauphin, P.S. Liang, and J. Wortman Vaughan (eds.), Advances Neu- ral Information Processing Systems, volume 34, pp. 11795-11808 1808. Curran Associates, Inc., 2021. URL.
wwwiinngn..neuuieeeeee neurips cttccc/pppa.eee.... tttpppeeffleespppee////aa aa- pdff.
file/ 61 F
Leonid Rudin, Stanley Osher, and Emad Fatemi. Nonlinear total variation based noise removal algorithms. Physica D: Nonlinear Phenomena, 60(1):259-268, 1992.
Saima Sharmin, Priyadarshini Panda, Syed Shakib Sarwar, Chankyu Lee, Wachirawit Ponghiran, and Kaushik Roy, A comprehensive analysis adversarial robustness of spiking neural networks. In 2019 International Joint Conference on Neural Networks (IJCNN), pp. 1-8. IEEE, 2019.
Saima Sharmin, Nitin Rathi, Priyadarshini Panda, and Kaushik Roy. Inherent adversarial robustness of deep spiking neural networks: Effects of discrete input encoding and non-line non-linear activations. In European Conference on Computer Vision, pp. 399-414. Springer, 2020.
Jiangrong Shen, Qi Xu, Jian Liu, Yueming Wang, Gang Pan, and Huajin Tang. Esl-snns: An evolutionary structure learning strategy for spiking neural networks. In Proceedings of the AAAI Conference on Artificial Intelligence, volume 37, pp. 86-93, 2023.
Xinyu Shi, Jianhao Ding, Zecheng Hao, and Zhaofei Yu. Towards energy efficient spiking neu- ral networks: An unstructured pruning framework. In The Twelfth International Conference on Learning Reprexentations, 2024a.
Xinyu Shi, Zecheng Hao, and Zhaofei Yu. Spikingresformer: Bridging resnet and vision transformer in spiking neural networks. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR), pp. 5610-5619, June 2024b.
Karen Simonyan and Andrew Zisserman. Very deep convolutional networks for large-scale image recognition, 2015. URL https:/// /tte:///aaxiiiiii wtwaaaaxiii..oo org/ abs 0abs/1409/ 1..40991555 1556.
Tianyu Song, Guiyue Jin, Pengpeng Li, Kui Jiang, Xiang Chen, and Jiyu Jin. Learning a spiking neural network for efficient image deraining. IJCAI '24, 2024. ISBN 178-1-956792-00-11
Yuanchao Wang, ation based invariant risk minimization. In The Thirteenth International Conference on Learning Representations, 2025.
Lai, and Tianqi Zhong. distof-distribution generalization for total vari-
Eric Wong, Leslie Rice, and J Zico Kolter. Fast is better than free: Revisiting adversarial training. In The Eighth International Conference on Learning Representations, 2020.
Keming Wu, Man Yao, Yuhong Chou, Xuerui Qiu, Rui Yang, Bo Xu, and Guoqi Li. Rsc-snn: Exploring the trade-off between adversarial robustness and accuracy in spiking neural networks via randomized smoothing coding. In Proceedings of the 32nd ACM International Conference on Multimedia, MM '24. pp. 2748-2756. New York, NY, USA, 2024. Association for Computing Machinery. ISBN 9798400706868.
Yujie Wu, Lei Deng, Guoqi Li, Jun Zhu, Yuan Xie, and Luping Shi. Direct training for spiking neural networks: Faster, larger, better. In Proceedings of the AAAI conference on artificial intelligence, volume 33, pp. 1311-1318, 2019.
Mengting Xu, De Ma, HuaJín Tang, Qian Zheng, and Gang Pan. Feel-snn: Robust spiking neural networks with frequency encoding and evolutionary leak factor. In A. Globerson, L. Mackey, D. Belgrave, A. Fan, U. Paquet, Tomezak, and C. Zhang (eds.), Advances Neural Information Processing Systems, volume 37, pp.
Curran Associates, Inc., 2024.
Qi Xu, Yuyuan Gao, Jiangrong Shen, Yaxin Li, Xuming Ran, Huajin Tang, and Gang Pan. Enhancing adaptive history reserving by spiking convolutional block atten- tion module in recurrent neural networks. In A. Oh, T. Naumann, A. Globerson, K. Saenko, M. Hardt, and S. Levine (eds.), Advances in Neural Information Pro- cessing Systems, volume 36. pp. 58890-58901. Curran Associates, Inc., 2023. URL https: 6872444400655effeccc1i1111566603
/ http:///ooeeeenn..eeeeeeeeee neurips cccpippp.ccpppppeeeeeeeee httpapeeffileeepppe////0000 /iie//
13

---

Published as a conference paper at ICLR 2026
Kashu Yamazaki, Viet-Khoa Vo-Ho, Darshan Bulsara, and Ngan Le. Spiking neural networks and their applications: A review. Brain Sciences, 12(7):863, 2022.
Man Yao, Xuerui Qiu, Tianxiang Hu, Jiakui Hu, Yuhong Chou, Keyu Tian, Jianxing Liao, Luzi- wei Leng, Bo Xu, and Guoqi Li. Scaling spike-driven transformer with efficient spike firing approximation training. IEEE Transactions on Pultern Analysis and Machine Intelligence, 47(4): 2973-2990, 2025.
Xingting Yao, Fanrong Li, Zitao Mo, and Jian Cheng. Glif: A unified gated leaky integrate-and-fire neuron for spiking neural networks. In S. Koyejo. S. Mo- Cho, and Oh (eds.). Advances Neural In- formation Processing Systems, volume 35, pp. 32160-32171. Curran Associates, Inc., 2022. URL http::::/pprrceeeenn..eeeeosooo ctwpiips.cc/pppp.ee fi 1l12fff6448000a@867777dee6666---
hamed, A. Agarwal, D. Belgrave, httppp/ccccccc....ooocco/oeeaaaa
pdf.
Sergey Zagoruyko and Nikos Komodakis. Wide residual networks, 2017. URL https: //apivaaxxvv.v
org/abs//605. 07146.
Wenrui Zhang and Peng Li. Temporal spike sequence learning via backpropagation for deep spiking neural networks. H. Larochelle, M. Ranzato, R. Hadsell, M.F. Balcan, and H. Lin (eds.), Advances in Neural Information Processing Systems, volume 33, pp. 12022-12033. Cur- ran Associates, Inc., 2020. URL httptt paper/2020/ file/ http:////.......111111111331a1a.
neuripp www.eeewwwss...peeeeoeeeeee cwppaper.pppppppppppppoppece...e files/
Kaijie Zhu, Xixu Hu, Jindong Wang, Xing Xie, and Ge Yang. Improving generalization of ad- versarial training via robust critical fine-tuning. In Proceedings of the IEEE/CVF International
Conference on Computer Vision (ICCV), pp. 4424 4434, October 2023.
Yaoyu Zhu, Jianhao Ding, Tiejun Huang. Xiaodong Xie, and Zhaofei Yu. Online stabilization of spiking neural networks, In The Twelfth International Conference on Learning Representations, 2024.
14

---

Published as a conference paper at ICLR 2026
A APPENDIX
A.1 PROOF OF THEOREM 1
Proof. Part (I): We first verify that the following local variation is well-defined:
V Va,oy((i (,2) == v(i, (, - v(i, 1, x + ō(i, ())-
(27)
Let x. 8 E I and ti, E O, where the domain θ can be 00 NJ x I for the continuous setting, [0: :] x : 7| for the discrete setting, or [0: M] x [0, T or [0, NJ x [0: T" for the mixed setting. Denote the r-algebras of e, Rd, and R by $, G, and H,, respectively. F can take the product o- algebra w.r.t. its two arguments and I. For either argument, the power set or the Lebesgue o-algebra can used for the discrete or continuous setting, respectively. and H take the d-dimensional and one-dimensional Lebesgue o-algebras by default, respectively. The o-algebra of θ x I takes the product o-llgebra # x 4.
As necessary condition, SNN, otherwise this SNN cannot process the input information. Because 6 2 ト+ R is measurable, given any set FF E F, we have 6(F) g. Consider
x + I should be a measurable function of (i, t,)) for eligible
fixed point in R then (I: + 8(F)) is
translation of ((F). According to the property of Lebesgue o-algebra, (z + ((F) E 9. Therefore, ((F) f x I and v(F (x 8(F)) H from the measurability of v. Hence the
(or Fx forward mapping of v is well-defined.
Conversely, given any set H H, the preimage 8- -
x & from the measurability
of v. Again from the property of Lebesgue o-algebra, the translation (g - x) E G. Then from the measurability of 6, the preimage 8 0- - x) &. Denote the intersection of F and 8 (g x) by
F := F n 8-'(g (g z). Since the o olalgebra I is closed under intersection, F E F.. By fixing as a constant function of (i, t). we consider v as a composed function: vo (x + 8) θ + R. Then the above deduction indicates that the preimage (v o (ær + -)) F' E $. Hence (æ: + 6) also a measurable function of (i, 1) and the inverse mapping (u (ar + 6)) is well-defined.
Summarizing the above deductions, we verify that v(i, (, t)) is measurable function of (i, t) for any fixed x. Since (i, t, x.) in (27) is a subtraction between two measurable functions, also a measurable function of (i, t) for any fixed x. Hence (i,,) is well-defined and can be calculated in practice.
Part (2): Next, we need to verify that fa( V (in)) (i)) is well-defined. The spike function can be rewritten as:
s(jt,,z) = H(((,, u.))
(28)
Since (u[j, (x,x - ues)) and the Hcaviside function are both measurable functions, their compos- ite s(i, 2, also measurable function. Following similar deductions to Part (I), the local variation V ((.))s(j,t,
is also a well-defined measurable function. With fixed i, the weight function (i), is naturally a measure on J(i). With fixed / and x, Vi,n)s 4, æ)) is also a measurable function restricted on (i). Hence S Vo,nssj,, f, .)) dio(),((i) is a well-defined Lebesgue integral. Moreover, since (,,,)s(,,,, x,) & 1 from the definition of the Heaviside func- tion, ( Vi. t, dw (i)) is also finite integral with a finite measure (i).. This is crucial for the dominated TV property of Theorem 4 that controls the overall stability of an SNN.
Again by similar deductions to Part (1), V Va,))(( x-1, is also well-defined measurable function. Hence (19) holds in a well-defined measurable sense. As for (20), we can use either counting measure or Lebesgue measure for the discrete or continuous setting of i and t, respectively. Then both sides of (20) are well-defined Lebesgue integrals, forming a TV-&2 term. Moreover, this MPPD- TV-L2 term is finite in general situations, as stated in Theorem 4.
A.2 PROOF OF THEOREM 2
Proof. To simplify notations, we fix and omit the input variable in the rest of the appendices if not specified. We use the notations in Appendix A.I. Since v is measurable, given any set H. E H, (ol=)-1(H) F. On the other hand, the interval type [4, + Av) E H from the definition
15

---

Published as a conference paper at ICLR 2026
of Lebesgue o-algebra. The main technique calculate the TV-1 term in (22) is partition this Lebesgue integral w.r.t. the values u along with (-o0, To do this, we observe that rational numbers are dense in (-o0, oc). Since rational numbers are countable, set of M& E N+ U {+o)} intervals with positive Lebesgue measure (i.e., positive length), as follows.
construct countable
1,2, ... .M. uit, t) is Lipsehitz continuous on Fm = {(1, 1) E θ am & v(t,t) t) < }.
{Bm = [am bm)
am < bm & 0m++1
(29)
Each interval (mm bm) contains at least one rational number, and all these intervals are mutually disjoint: Bm n B, for any m + Hence U Bm covers all the Lipschitz continuous intervals of the range of v. We only need to consider preimage sets {Fmm 1M Jm=1 where is Lipschitz continuous because the corresponding Lebesgue integrals positive only on these sets. Specifically,
1 (aauo(( ())
/ SA SeviuM m=I Fin))
V Va,yoli 6) du du
Vaavv(i t) du, m
(30)
where (M(UM=I Fm) corresponds R (UM Bm) where is discontinuous w.r.t (i. almost erywhere (a.e.). Hence ( Va,oju(i, () dp = 0 based on the definition of Lebesgue inte-
gral, which means that has zero volume. Then we just need calculate JUM=I Fm (L,)) () du. We break this down into the discrete and the continuous settings.
Part (1): For the discrete setting, direct calculation yields:
J& Fm ((,,) t) du ((Fm)) (bm am);
Vm.
(31)
Since (p(Fm) remains unchanged in the interval v E [am; bm) due to Lipschitz continuity, we have Fm = {(i,t) E ④ v(i,t) am} By letting vmm am and A thm dm ams (31) can be reformulated as
(pFm)) (6m = (((
e = = vml) :(())) Aemm
deb S(anseentiioo di
Vm.
(32)
From the o-additivity of Lebesgue integrals,
M
1 JUM_
Va = Σ J (Vnnoo(i())
Fm
M
do = J I
Σ
dy
(33)
U Bm ((L)))
(6.)):0u(..))...))
m=l
Adding the zero integral terms w.r.t. 0% (L Fmm and 1R (R both sides of (33) yields:
1 (a.n)(1 | J de
(34)
which proves the coarea formula (22).
Part (2): For the continuous setting, we can use the existing calculation for each Lipschitz contin- uous interval (Federer, 1959):
Am ((a.)enn(h)==)) /
de deb,
Vm.
(35)
Similar to the deductions in Part (1), we exploit the o-additivity of Lebesgue integrals and add the zero integral terms obtain:
M Σ
1 Fm Fm
(anyo(i))
(a,ao((i t)
Fm
m=m
16

---

Published as a conference paper at ICLR 2026
Σ J
M
Am
dp dpded /oddd//oa - P
Jecssettiiisss ded
((:)))
MM Bm
m=
Vaayoli, ()) du / de
(36)
For the mixed setting (with i discrete and continuous, or t discrete and continuous), the proof is similar the above, which is omitted here.
A.3 PROOF OF THEOREM 3
Proof. The proof is basically the as that of Theorem in Appendix A.1 except that the inte- grated function takes the absolute form | instead of the squared form 1 thus we need not repeat
again. Moreover. the MPPD-TV-L, term (23) is finite according Theorem which can be calculated and quantified in practice.
Next, we verify that the function space (O) 2 (²) when (() co, so that MPPD-TV-(, allows for broader classes of functions than MPPD-TV-Ls
(i,))(i,tt)dd
Jen(iit) Ven(issi (i)) I (on((ENnoOETTAa)ttte))))) (ayyo((, du
een (()))((,))) htw.://woooooooosssoeoooooo/oo Jen(G.DDENW..)tt...)) 1 dp
(37)
V du
(38)
<00.
The inequality (37) holds because |V (i) & (a, t)2 when V (i,))(i, > 1 in the first term, and V Vi, t)] < 1 in the second term. The inequality (38) holds due to the expansions of the integration intervals. Last, So V ((a,)v(i, t) du < xo implies Se V Va,aju(t, t)) dp < cc.
Hence (0) 2 (9).
However, ('()) # (2()). For simple counterexample, let f(t) = t e [0 and use the Lebesgue measure. Then fd' ft) dt < oo but Jo (t) dt oc. Hence f L (O) but & (2)) There are many other functions like this f.
L
A.4 PROOF OF THEOREM 4
Proof. Part (1): Without loss of generality, we define and use the following continuous version of (21) w.r.t. l::
(o,no(i,t)= 1 A/
Rk)) dwo(i, dk.
(39)
Then for the MPPD-TV- TV&, Case,
h { (a) di
= -f" (S, V (as dt
= - (f,e)
(:- p-1
* V dj di de
(40)
17

---

Published as a conference paper at ICLR 2026
x J, Ni I (V dj di dk
J.
N / Vu (15 [mm di dj di dt
(111 di /s (o.s)(ii dj djck dt
2 sup JEJ
[un(6.5)
J." Co.
A 1100lll
/
(u)))((,L-))) dj ck) di
-Iluzll1 //
(1""
2* (,,,,((,, dk dj
-Iluzll / (1""
J.TTT x x (1.))(())))) dr dj
I-"
(41)
=Ilwzel1 / (1." (1o xaa V (..0)(..)) dr) dj
-Ilwelll / (J." 1- (un))( dr dj
In(A)
-Ilwvelaa (T(AA) S I." (V.u)s(,TT) dr
=Ilwel1a loga( ) S. (V,n)s(, dr
The equality (40) holds because dwr(i,) jiii j. dj univariate differential with fixed i. The underlined terms indicate the extraction of ||wr|]1- The equality (41) exploits a change of variable := t k, which also changes the integration interval.
Theorem 4 also holds for the discrete setting of and f, whose proof is similar to the above and thus omitted here. The corresponding scaling factor for the discrete setting is ||
1-X & ||wrl log, (
Part (2): For the MPPD-TV-4, Case,
h N!
V ()) di
I,"
T
V. X I Vasssti dk di dt
I" T N (f=T
(a didr
(42)
1og3 ( L." S, UG (annooii-- di
<log3 () S." J,M (aspdeii)))))) (/ a((()))))) di
(43)
=log ( /." ( (anssir)Pas) I ( dr 1og ( 1," (isss(i dr.
=||uz|11 logi
18

---

Published as a conference paper at ICLR 2026
The underlined terms indicate the extraction of w The equality (42) exploits change of variable := t - k. The inequality (43) derived from the Schwarz inequality for the space:
(aNN6666)))))) $ ( ((..))))))))
$
(44)
A.5 PROOF OF PROPOSITION 5
Proof. First, we provide the definition of the Fréchet subdifferential of f R - IR at w, denoted by (w)): Definition (The Fréchet Subdifferential).
f(u) fww)- 2.(u (u-w)
Owf(w): ZEIR lim inf
u - w|2 20
(45)
uf
element the set On (w) called a subgradient, also denoted by 0w f for simplicity. is
for w & O, or Ow| = for well-known that a subgradient of the modulus function is 0 |/] Te] O.
As for the subgradient MPPD-TV-6, it can be calculated by exploiting the Leibniz integral rule, the Fundamental Theorem of Calculus, and the chain rule for backpropagation:
(1/
Ow(L)(()
V (i
1 (w(is(t)
x
dl) du
R=0
-/6 sign
1-1
k=
(tOaitis()) (111)
()) dp
k==
sign
X V (,,) (-)()))))))))) du.
(46)
Jo
k=0
k=
It finishes the proof.
A.6 ADDITIONAL EXPERIMENTAL RESULTS
A device with Intel(R) Xeon(R) Platinum 8352V CPU, 64-GB RAM, and NVIDIA RTX 4090 GPU is used for CIFAR 10 and CIFAR 100, while a device with an Intel(R) Xeon(R) Gold 6348 CPU, 100-GB RAM, and NVIDIA A800 GPU is used for Tiny ImageNet. The training times of different methods with VGGI1 architecture and AT training scheme on CIFAR 10, CIFAR 100, and Tiny ImageNet data sets provided in Table A1, which indicate that MPPD-TV-6, runs the fastest among the competitors. Besides, the gradient magnitudes based on the & norm for different methods with WRNI6 architecture and AT training scheme on Tiny ImageNet data are provided in Figure AI, which show that MPPD-TV-L, converges quickly to low gradient magnitude level around the 400-th iteration, and maintains the lowest gradient magnitude compared with MPPD-TV-6, and Non-MPPD. This confirms the gradient stability of MPPD-TV-(1
19

---

Published as a conference paper at ICLR 2026
Table A1:
Runtimes (in hours) of different methods with VGGI1 architecture and AT training scheme CIFAR 10, CIFAR 100, and Tiny ImageNet.
Data Set
MPPD-TV-L,
MPPD-TV-(2
AT FEEL
SR
CIFAR 10
9.95
10.01
13.75
33.89
CIFAR
10.08
11.53
14.22
34.67
Tiny ImageNet
22.38
25.14
38.02
118.09
Gradient Norm Stability Comparison
10
MPPD-TV-11
MPPD-TV-12
Gradient L2 Norm
8
Non-MPPD
6
4
0
500
1000
1500
2000
Iteration
Figure A1: l norms of gradients for different methods with WRN16 architecture and AT training scheme Tiny ImageNet.
20


Reviews:
[{"review_id": "N1IVKWqSRw", "reviewer": "Reviewer_X9cd", "summary": "The paper establishes a theoretical foundation for Membrane Potential Perturbation Dynamics (MPPD) in spiking neural networks (SNNs), proving that MPPD corresponds to Total Variation. The authors propose a new framework that improves robustness to adversarial perturbations compared to the existing MPPD model. Experimental results on CIFAR-10 and CIFAR-100 demonstrate that MPPD achieves superior accuracy and robustness under various adversarial attacks.", "questions": "In the abstract, the authors state that “this finding may provide a new insight into the essence of perturbation characterization.” Could the authors clarify what specific insights are being referred to here?", "limitations": "", "rating": 6, "confidence": 4, "soundness": 3, "presentation": 3, "contribution": 2, "strengths": "- The paper provides a clear mathematical link between MPPD and total variation, offering the first formal theoretical explanation for an empirically effective mechanism in SNN robustness.\n- Experimental results on CIFAR-10 and CIFAR-100 demonstrate that MPPD achieves superior accuracy and robustness under various adversarial attacks.", "weaknesses": "- The experiments are limited to CIFAR-10 and CIFAR-100. These are small-scale image datasets. Experiments on more large-scale datasets and neuromorphic datasets are encouraged.\n- Although the paper mentions efficiency, there is no detailed analysis of training time and gradient stability.\n- The paper does not report clean test accuracy alongside adversarial robustness results.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "v8au6Cwqvf", "reviewer": "Reviewer_mt4t", "summary": "The paper presents a theoretical analysis of the Membrane Potential Perturbation Dynamic (MPPD) in Spiking Neural Networks (SNNs). The authors' main contribution is framing MPPD as a form of Total Variation. This provides a theoretical foundation for MPPD.", "questions": "Why was the continuous formulation chosen for the proposed method when the preliminary MPPD description is discrete? How is the continuous formulation implemented or made compatible with the discrete-time dynamics of an actual SNN?\n\nWhat are the clean (noise-free) accuracy scores corresponding to the results in Table 1? This is critical for assessing the performance-robustness trade-off.\n\nHow does the proposed TV loss account for sub-threshold membrane potential perturbations that do not lead to a spike reset? Does excluding these perturbations limit the model's sensitivity to low-intensity noise?\n\nMinor: The use of bold font in the main text seems arbitrary and should be applied more consistently.", "limitations": "", "rating": 4, "confidence": 4, "soundness": 3, "presentation": 2, "contribution": 2, "strengths": "The primary strength is the formal theoretical analysis offered for the MPPD approach, addressing a known gap in the field.\n​​\nThe method appears to achieve good performance, suggesting the theoretical insight translates into practical benefits.", "weaknesses": "A major issue is that Table 1 does not report the \"clean\" accuracy (performance without noise), making it impossible to evaluate the true cost of the denoising improvement.\n\n​​The choice of the key parameter ζ in Section 4.1 is not explained. It is unclear if it was set arbitrarily, tuned for this work, or copied from another paper. If compared papers in Table 1 used different ζvalues, the comparison is misleading and should be noted.\n\nThe preliminary discussion describes previous MPPD work in a discrete setting, but the proposed method uses a continuous formulation. The paper does not justify this shift or explain how the continuous form is compatible with or translates to the discrete SNN simulation.\n\nThe proposed TV loss might not fully capture the original MPPD behavior. Specifically, when a reset mechanism is involved, small perturbations that are insufficient to evoke a spike may be excluded from the loss calculation, potentially making the model less sensitive to certain types of noise.\n\n​​In Equation 2.4, using a shorter minus sign (e.g., \\text{-}) would improve visual alignment and readability.\n\n​​The statement that previous work \"lacks reliable explanations and theoretical foundation\" (Line 55) is too strong, especially if the authors' own prior work is in the same theoretical domain. This should be phrased more precisely.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "8F7rmSejzk", "reviewer": "Reviewer_sYtm", "summary": "This work is build on the concept of Membrane Potential Perturbation Dynamics (MPPD) as a method for enhancing the robustness SNNs, particularly in the face of adversarial perturbations. The authors propose that MPPD can be framed as a Total Variation (TV) model and further develop a novel MPPD-TV-L1 framework, which they show improves the robustness of SNNs in adversarial environments. The proposed approach demonstrates superior performance over existing TV-L2 models on image classification tasks using the CIFAR-10 and CIFAR-100 datasets.", "questions": "See the weaknesses section for my major concerns.\n\nIn Table 1, the cases where MPPD-TV-L1 performs worse than MPPD-TV-L2 all occur with the FGSM and the APGD_DLR. It would be helpful if the authors could provide a theoretical or intuitive explanation for this behavior.\n\nCould you include a comparison that shows the performance of ANNs in handling adversarial perturbations, to better highlight the relative robustness (if any) of SNNs?", "limitations": "", "rating": 4, "confidence": 4, "soundness": 4, "presentation": 2, "contribution": 2, "strengths": "1: This work proves that MPPD is equivalent to TV, providing a strong mathematical foundation that underpins the proposed method.\n\n2: The experimental setup is comprehensive, involving state-of-the-art methods and adversarial training schemes. \n\n3: The motivation that extend the existing TV-L2 framework to TV-L1 is well-articulated.\n\n4: The proposed framework has clear practical implications for improving the security and reliability of SNNs.", "weaknesses": "A major concern is the incremental novelty of this work. The MPPD-TV-L2 framework was already proposed in Ding et al. (2024), and this work introduces the MPPD-TV-ℓ1 framework. Furthermore, as shown in Figure 1, in the case of AT+Reg, the MPPD-TV-ℓ1 shows only minor (or no) improvement. This suggests that MPPD-TV-ℓ1 has a similar effect to the regularizer (Ding et al., 2022), which somewhat weakens the novelty and necessity of this work.\n\nThe writing and clarity of the paper can be improved. For example, the title may mislead readers into thinking that the paper proposes MPPD (which it does not). Additionally, there is no punctuation for $\\epsilon$ in Equation (3), and the term \"MS-MPPD\" looks awkward in Equations (4) and (5).", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "i9qUV4lzCn", "reviewer": "Reviewer_1NUH", "summary": "This paper reframes a heuristic SNN stabilization mechanism (MPPD) into a rigorous TV theory, generalizes it via a new ℓ₁-based variational framework, and validates its advantage in both adversarial and noisy environments.\n\n#### **1. Research Problem**\n\n* Spiking Neural Networks (SNNs) are vulnerable to adversarial and noisy perturbations that destabilize their dynamics. The existing *Membrane Potential Perturbation Dynamic* (MPPD) technique empirically improves robustness but lacks solid theoretical grounding.\n* The paper tries to reveal mathematical nature of MPPD, and how can it be formalized to enhance SNN robustness in a principled way.\n\n#### **2. Proposed Method**\n\n* The authors prove that MPPD is mathematically equivalent to Total Variation (TV)\n* Based on this equivalence, they introduce the MPPD–TV–ℓ₁ framework, extending prior ℓ₂-based formulations (MPPD–TV–ℓ₂).\n\n\n#### **3. Theoretical Contributions**\n\n* Rigorous proof that MPPD is TV under measurable perturbations.\n* Establishment of a new TV–ℓ₁ regularization theory for SNNs, encompassing:\n\n  * The coarea formula specific to SNN membrane dynamics.\n  * A dominated TV property showing layer-wise boundedness of perturbations.\n  * A closed-form subgradient that enables backpropagation through non-smooth TV terms.\n\n#### **4. Experimental Contributions**\n\n* Across CIFAR-10 and CIFAR-100, the MPPD–TV–ℓ₁ model outperforms both the ℓ₂ variant and other baselines under Gaussian noise and adversarial attacks (FGSM, PGD, CW, AutoAttack).\n* Demonstrates higher resistance to increased attack intensity and step size, confirming TV–ℓ₁’s superior denoising behavior.", "questions": "1.Can the techniques for handling spike discontinuities in the paper be generalized to other SNN research?\n2.Please add some missing citations.", "limitations": "", "rating": 6, "confidence": 4, "soundness": 3, "presentation": 2, "contribution": 2, "strengths": "### **1. Theoretical Contributions**\nOverall, this paper provides a theoretically sound bridge between signal variation analysis and adversarial robustness in SNNs, offering a new mathematical perspective for neuromorphic robustness theory with clear derivations.\n\n* Introduces a novel reinterpretation of membrane potential perturbation dynamics (MPPD) as a form of total variation (TV), unifying biological spiking dynamics and variational regularization theory in an original analytical framework.\n* Transforms prior MS-MPPD regularization (previously heuristic) into a mathematically grounded TV–ℓ₂ model and further generalizes it into the TV–ℓ₁ formulation, expanding the functional space of admissible membrane potentials and enabling sharper perturbation modeling.\n* Mathematical Rigorly establishes formal results including the Coarea formula for spiking potentials, the Dominated TV Property linking layerwise stability to weight norms, and a closed-form subgradient for optimization without additional computational cost.\n\n\n\n### **2. Experimental Contributions**\nExperimental result supports that total variation regularization can serve as a universal principle for temporal–spatial robustness in SNNs.\n\n* Conducts extensive controlled experiments on CIFAR-10 and CIFAR-100 using both VGG11 and WRN16 backbones under Gaussian and adversarial training, comparing six state-of-the-art SNN methods.\n* Demonstrates consistent and often substantial gains in adversarial accuracy, validating that MPPD-TV–ℓ₁ effectively suppresses perturbations across attack intensities and steps.\n* Shows that the closed-form subgradient introduces no measurable computational overhead while maintaining compatibility with mainstream deep learning frameworks.", "weaknesses": "Overall, this paper provides rigorous theoretical analysis and effective experimental results to demonstrate the theoretical foundations of MPPD and offer a more complete version. I particularly appreciate the paper's rigorous treatment of pulse discontinuities, which is rare but meaningful in the SNN field.\n\n1. My main concern is that MPPD has not yet become a mainstream method for SNNs, and this paper is almost entirely based on this premise, which limits its broader impact. I am not sure how interested most people in SNN field are in it. For example, can the techniques for handling spike discontinuities in the paper be generalized to other SNN research?\n\n2. Please add some missing citations. Some related work also focuses on smoothing membrane potential perturbations under adversarial attacks with uses different methods, such as dynamic thresholding (https://arxiv.org/pdf/2308.10373) and stochastic gating (https://ojs.aaai.org/index.php/AAAI/article/view/27804).\n\n3. In Theorem 4, \"assume every node i in layer L uses the same set of preceding nodes in layer L-1\" which does not hold for sparse, or skip-connected SNN architectures. Relaxing this constraint would enhance generality.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}]

Author rebuttal:

Decision: Accept (Poster)