Time Is All It Takes: Spike-Retiming Attacks on Event-Driven Spiking Neural Networks
Authors: Yi Yu
Qixin Zhang
Shuhan Ye
Xun Lin
Qianshan Wei
Kun Wang
Wenhan Yang
Dacheng Tao
Xudong Jiang
Venue: ICLR 2026 Poster (2026)
Keywords: spiking neural networks
event dataset
snn
attacks
adversarial attacks
Primary area: alignment, fairness, safety, privacy, and societal considerations
TL;DR: We introduce a timing-only, rate-preserving spike-retiming attack on event-driven SNNs and a projected-in-the-loop optimizer that enforces strict feasibility under various norm budgets while achieving high attack success.

Abstract: Spiking neural networks (SNNs) compute with discrete spikes and exploit temporal structure, yet most adversarial attacks change intensities or event counts instead of timing. We study a timing-only adversary that retimes existing spikes while preserving spike counts and amplitudes in event-driven SNNs, thus remaining rate-preserving. We formalize a capacity-1 spike-retiming threat model with a unified trio of budgets: per-spike jitter $B_{\infty}$, total delay $B_{1}$, and tamper count $B_{0}$. 
Feasible adversarial examples must satisfy timeline consistency and non-overlap, which makes the search space discrete and constrained. To optimize such retimings at scale, we use projected-in-the-loop (PIL) optimization: shift-probability logits yield a differentiable soft retiming for backpropagation, and a strict projection in the forward pass produces a feasible discrete schedule that satisfies capacity-1, non-overlap, and the chosen budget at every step. The objective maximizes task loss on the projected input and adds a capacity regularizer together with budget-aware penalties, which stabilizes gradients and aligns optimization with evaluation. Across event-driven benchmarks (CIFAR10-DVS, DVS-Gesture, N-MNIST) and diverse SNN architectures, we evaluate under binary and integer event grids and a range of retiming budgets, and also test models trained with timing-aware adversarial training designed to counter timing-only attacks. For example, on DVS-Gesture the attack attains high success (over 90\%) while touching fewer than 2\% of spikes under ${B}_{0}$. Taken together, our results show that spike retiming is a practical and stealthy attack surface that current defenses struggle to counter, providing a clear reference for temporal robustness in event-driven SNNs. Code is available at https://github.com/yuyi-sd/Spike-Retiming-Attacks.

Published as a conference paper at ICLR 2026
TIME Is ALL IT TAKES: SPIKE-RETIMING ATTACKS SPIKING NEURAL NETWORKS
ON
Yi Yu', Qixin "hang""Shuhin Ye', Xun Lin', Qianshan Wei", Kun Wang",
Wenhan Yang", Dacheng Tao", Xudong Jiang'
ROOE Lab, School of Electrical and Electronic Engineering, Nanyang Technological University Generative Lab, College of Computing and Data Science, Nanyang Technological University OCUHK "Southeast University "Nanyang Technological University *Pengcheng Laboratory fyu. yi, qixin. zhang, exdjiang @ntu. edu. sg
ABSTRACT
Spiking neural networks (SNNs) compute with discrete spikes and exploit tem- poral structure, yet most adversarial attacks change intensities or event counts instead of timing. We study timing-only adversary that retimes existing spikes while preserving spike counts and amplitudes in event-driven SNNs, thus remain- ing setteprreeriing. We formalize a capacity-1 spike-retiming threat model with a unified trio of budgets: per-spike jitter Bxc. total delay B1, and tamper count By Feasible adversarial examples must satisfy timeline consistency and non- overlap, which makes the search space discrete and constrained. To optimize such retimings at scale, we use sonjected-in-the-looe (PIL) optimization: shift- probability logits yield differentiable soft retiming for backpropagation, and strict projection in the forward pass produces a feasible discrete schedule that satisfies capacity-1, non-overlap, and the chosen budget at every step. The ob- jective maximizes task loss on the projected input and adds a capacity regular- izer together with budget-aware penalties, which stabilizes gradients and aligns optimization with evaluation. Across event-driven benchmarks (CIFARIO4) IO-DVS, DVS-Gesture N-MNIST) and diverse SNN architectures, we evaluate under bi- nary and integer event grids and range of retiming budgets, and also test models trained with timing-awe aware adversarial training designed to counter timing-only at- tacks. For example, on DVS-Gesture the attack attains high success (over 90%) while touching fewer than 2% of spikes under By- Taken together, our results show that spike retiming is practical and stealthy attack surface that current de- fenses struggle to counter, providing a clear reference for temporal robustness event-driven SNNs. Code is available at httttp::/qithub... www yuyi-sd//
INTRODUCTION
Spiking Neural Networks (SNNs) compute with discrete spikes and temporal coding, in contrast to the continuous activations in ANNs, thereby enabling computation only when information rives and, on dedicated neuromorphic processors, yielding low energy and short latency (Roy et al.) 2019 Davies et al. 2018). Recent learning advances make deep SNNs trainable through spatio Temporal backpropagation with surrogate gradients (Wu et al., 2018), and refined estimators further improve gradient quality and stability for spiking nonlinearities (Lian et al., 2023). Normalization and time aware objectives support few step inference under tight latency budgets while preserving accuracy (Kim & Panda 2021 Duan et al., 2022; Rathi Roy 2023). SNNs also align with event driven sensing, where asynchronous streams naturally match the sparse and temporal nature of spik- ing computation and favor low power edge deployment (Lichtsteiner et al. 2008). These trends position SNNs as practical backbones for efficient real time perception and motivate closer look at robustness in the time domain where spike timing carries much information (Neftci et al. 2019).
"Corresponding author.

---

Published as a conference paper at ICLR 2026
Splke Remove
Spike Remove
Spike
Spike
Move
(a) 11iriiinal Event Stream Any Channel-Spatial Locations
Bousded by
Sy-sor
Boundial by muliipi tpa
(b) Previous Adversarial Attack
(c) Our Spike-Retiming Attacks
Figure I: Attack overview. (a) Original event stream. (b) Previous attacks add/remove spikes under a O-norm, limited to binary grids. (c) Ours move spikes on each event timeline, preserving counts and amplitudes, supports multiple norm types, and can be applied to both binary and integer grids.
Prior attacks on SNNs mostly inherit image domain strategies that modify intensities or event counts. On static image data or integer event grids, PGD (aadry et al.] (018)) are applied with compatible gradients (Wu et al. 2018). Rate and timing-aware variants further sharpen gradients and raise suc- cess (e.g., RGA (Bu al. 2023) and HART (Hao et al. 2024) and their follow ups (Lun et al.)
2025)) ). On event data, grid based methods operate on dense tensors using heuristic search, compat- ible gradients, or sparse rounding (Büchel et al.) 2022 Marchisio et al. 202 Liang et al.) [023]
Lun et al. 2025). Defenses include certified robustness and empirical strategies such as adversarial training with regularizers and robust objectives (Mukhoty et al. 2024 Ding et al. 2024a b).
Despite recent progress, most attacks focus surrogate gradients and mainly change values or counts (Lun et al. 2025), which can misalign with the binary interface in spike sparse regimes and tend to alter energy or rate statistics. Defenses in turn mostly regulate intensities, rates, or membrane dynamics rather than impur timing (Ding et al. 2024a). Event cameras and other neuromorphic sensors naturally exhibit timestamp noise (jitter) and readout latency, and deployed SNN pipelines usually quantize events into discrete time bins. Under these conditions, a timing-only adversary that retimes existing spikes while preserving spike counts and amplitudes is realistic: it stays within the range of sensor timing uncertainty and does not change any frame-wise intensity or rate statistics. As result, such perturbations are difficult to detect with standard intensity- or rate-based checks and directly stress the temporal computation that SNNs rely on.
In this paper, as shown in Fig. I. we introduce Spike-Retiming Attacks, a timing-only adversary that retimes existing spikes along the time axis while preserving amplitudes and counts. We aim for a unified formulation that applies across event encodings, and budget types. We cast retiming as an assignment over spike timestamps with explicit feasibility: spikes remain on the timeline, each location- location-polarity line obeys capacity-1, 1, and non-overlap holds within time bins. The framework supports three budgets, 8& for per-spike local jitter, B2 for total timing shift, and Bo for the number of tampered spikes. To optimize this discrete space at scale, we use projected-ing iintted-ii-ttte in-the-loop (PIL) optimization: shift-probability logits generate differentiable soft retiming for backpropagation, and a strict projection in the forward pass enforces feasibility and the chosen budget at every step. We optimize the logits with a budget-aware objective that maximizes task loss on the projected input and adds capacity and budget penalties, which stabilizes gradients and keeps updates comparable across budget radii. The same formulation applies to binary and integer event grids without modification.
Contributions: 1) We formalize timing-only threat with feasibility under budgets / /Bo establishing unified protocol for temporal robustness. 2) Building on this, we develop projected- in-the-loop optimization, coupling differentiable soft retiming with strict projection, yielding a scalable attack that enforces feasibility at each forward pass. 3) We further design budget-aware objective that maximizes task loss and adds capacity regularizer and budget penalties, yielding sta- ble updates and aligning optimization with evaluation. 4) Finally, we conduct a comprehensive study across datasets, encodings (binary and integer), and budget regimes, and we evaluate ad adversarially trained models, revealing a temporal weakness in event-driven SNNs and two consistent patterns: integer grids are more robust, and polarity-specinee shifts place positives later and negatives earlier.
2 RELATED WORK AND MOTIVATION
Spiking Neural Networks (SNNs) compute with discrete spikes and exploit temporal structure, offering favorable energy and latency on neuromorphic hardware (Merolla et al.) 2014). Two routes dominate for high-perfone -eegrrerformeece SNNs. ANN-SNN conversion calibrates activations and sets the simulation length, and recent pipelines cut conversion error and required time steps while preserving
accuracy (Rueckauer al. 2017 Deng & Gu 2021
Bu al. 2022). Direct training lears SNNs
2

---

Published as a conference paper at ICLR 2026
end to end with surrogate gradients. A key milestone is apatio-tempora: backpropagation (STBP), which formalizes error propagation across layers and time and makes deep SNÑs trainable from scratch (Wu et al.] 2018). Later work refines surrogate gradient shape and smoothing better match spike generation (Li et al. 2021] Wang et al. 2023), and time-aware normalization, such as tdBN (Zheng et al., 2021), supports deeper, few step models. Objectives that reward temporal efficiency, notably Temporal Efficient Training (TET) (Deng et al.) (0022) improve generalization when the time step is small. Together, these pieces bring directly trained SNNs close to ANN level accuracy at low time steps while preserving the temporal computation that motivates spiking models.
Adversarial Attacks. SNNs are vulnerable to adversarial examples inherited from DNNs (Good- fellow et al.) 2015 Miao et al., 2022] [2024a|b] Chenng et al., 2024; Cai et al., (025). yet spikes and timing create distinct attack surfaces. For directly trained SNNs, spike-aligned white-box attacks are
effective: RGA (Bu et al.) 2023) uses firing-rate cues, and HART (Hao et al. 2024) fuses rate and temporal information to strengthen STBP gradients. For event-based inputs, DVS-Attacks (Marchi- sio et al. 202 search the event stream to fool SNN pipelines, SCG (Liang et al. 2023) makes contimuous gradients spike-compatible to resolve gradient-input mismatch, SpikeFool (Büchel et a 2022) adapts SparseFool by rounding sparse floating-poii perturbations to binary values, and GSAt- parameterization. Building on this line. Lun al. (2025) propose a Potential-Dependee Surrogate Gradient (PDSG) tied to run-time membrane distributions, and a Sparse Dynamic Attack (SDA) for binary dynamic frames.
tack
Yao et al.
2024) perturbs raw events via a
Existing Defenses span certified and SNN-specific approaches. Certified robustness adapts interval bound propagation and randomized smoothing to spiking models (Mukhoty et al. 2024). Adver- sarial training is strengthened with weight or gradient regularization tailored to spikes (Ding al.,
2022 Liang et al.] 2022). Biologically inspired mechanisms modify spiking dynamics, includ- ing stochastic gating and lateral inhibition, and DVS noise filtering provides input denoising (Ding et al. 2024b; Marchisio et al.) (0211). Inherent factors such as leakage, coding schemes, and firing thresholds also influence robustness (Sharmin et al. 2019 Zhang et al. 2023). Two recent defenses for directly trained SNNs are: Liu et al. (2024d) regularize input gradient sparsity, and Ding et al.) ceaabbrane-potenttin perturbations in LIF dynamics.
(202aa) train for robust stability by minimizing
Motivation and Positioning of Our Attack. SNNs process sparse event streams where information is carried by when spikes occur rather than by continuous intensities. Prior attacks mainly alter intensities add/delete events, and many defenses certify train against intensity or count changes rather than timing. We address this gap with a timing-only attack that retimes existing spikes while preserving amplitudes and counts, producing inputs that are physically realizable, energy-consistent, and aligned with realistic sensor jitter and latency. Focusing on timing can evade intensity- -based checks and directly targets temporal computation, and it turns the search from addition to assignment on the time axis. We cast retiming into unified, norm-agnostic formulation on spike timestamps that supports Box, BJ, and Bo budgets, providing a protocol for evaluating timing robustness.
PRELIMINARY
3.1 NEURON DYNAMICS IN SPIKING NEURAL NETWORKS
Discrete-time LIF neurons. Following Yao et al. (202)) Lun et al. 2025 we adopt the stan-
[t] be the membrane potential and s ("(t E {0, 1} the spike of neuron i at layer and time t. A common recurrence is
dard leaky integrate-and-fire (LIF) neuron model IIhikevichh 2004 Let u
[
u - (0] - 8 (11)) + (n""g"="(00) + b,D 8
( [ H(, (4 VVn), (1)
where 7 is the leak, ((() and ( are weights and bias. Vin is the firing threshold, and H(-)) is the Heaviside step. A hard reset sets u to zero on spike. The LIF captures a neuron's 's spatiotemporal dynamics, and firing together with reset provides the nonlinearity solve complex tasks.
Data form & encoding. SNNs take static images or event streams as inputs. A static input is an in- tensity frame x, E (0, x x unfolded over T steps either by direct encoding (x=[t] = xx,) or rate encoding (each pixel emits Bernoulli spikes so that [zx [[]] [[]]=00 x. and æ E (0, {XxcxHxW ). Event data are binned over fixed windows into dense grids, typically as integer grids that accumulate per-bin activity/energy (a E 7 Cx xW or binary grids that record presence (x (0, 1)TxXxXxW, 20
3

---

Published as a conference paper at ICLR 2026
3.2 ADVERSARIAL ATTACKS FOR SNNS
General formulation. Given a classifier / and label an adversarial example is av x + ô that
maximizes the task loss L (e.g, cross-entropy loss) under nnor budget (Madry al.
2018
Yu et al. 2025 Xia et al. 2024a b. Liu et al. 2024a b
Li et al. 2024 2025
Zhou et al.
2023
2024a b 2025a b):
max [[f( 6), s.t. | S. 6
(2)
For frame-based inputs (static images) or integer event grids, the common choice is Bx neighbor (p oo). For binary grids, sparsity is better captured by Bo constraint.
Frame-based attacks on SNNs. Under an E budget, FGSM applies one signed step to the input:
x adv = clip/o.1f(e + (
(3)
PGD repeats signed steps with projection the Boc ball around the clean input:
(k+++) (w.,))
ao (8) + a sign(VaL([Ir*) wl))
x
x + (((e,e))
(4)
where & indexes iterations, is the step size, and (m.e) projects back the feasible region. For SNNs, V. is obtained through the spiking dynamics such as the PDSG estimator (Lun et al. 2025)
Event-data attacks (grid). We focus on dense event grids: integer and binary. Integer grids essen- tially reuse the frame-based attacks under an B& radius. For binary grids, the perturbation is an Bo flip budget where methods typically score candidate bins (via gradients/saliency) select up to the budget using straight-thouug or probabilistic discrete relaxations, and project with a keep/flip step. There is no single unified paradigm, but "score -> select project" is the common pattern.
METHODOLOGY
We formalize timing-only threat model (Sec. 4.1), develop differentiable retiming surrogate with a strict projection (Sec. 4.2), and couple them via -ntieedd---thh-ooopp optimization (Sec. 4.3).
4.1 PROBLEM SETUP
Threat model. We formalize timing-only threat model. The adversary retimes existing spikes while preserving amplitudes and spike count. Feasibility requires staying on the timeline and no overlap per event line and time bin. Budgets are B, constraints on the retimings. Unless otherwise noted, following Yao et al. 2002)); Lun et al. (2023). we assume a white-box attacker with access to model parameters and consider untargeted attacks.
Definition 1 (Spike Retiming Attack). A timing-only adversary produces an adversarial event stream by moving existing spikes along the time axis while preserving amplitudes; no spike created, deleted, or split, and at most one spike may occupy any event-line grent-line/time-bnn (capacity-
1). Let æ =ZTx xTxCxHXX be the input event tensor with E y as the ground-truth label. Flatten spatial-chaneel to j E [l....,] with N-CHW, and define the active index set A(x) {(,,5) : x x[s,]] > 0}. For each (s,j) E A(æ), choose an integer shift 8n, and set t = + da with 0 < T. The feasible assignments F(x) and the capacity-preserving place-
ment P are
F(x) = 6: 0 + 8:.s <
Vj.t: [( (8.5) E A(x), s + 5o.s = + $1
saay on simetlnee
non overia (eapactry-1) 1)
(5)
3s s.1. (s,j) E A(x); t= 80.5:
P(x; ()...]]
otherwise.
In words, 8 chooses an integer shift for each existing spike; P(æ; 8) replays the same spikes at new times. Given an SNN classifier ZTxCxHXW IP()) with logit vector f(x) and loss 2
[[((w)))) (e.g., cross-entropy loss), the timing-only attack solves
C(f(P(a;; (S)(((;))))))) 8EF(a)nE,
max
(6)
where By(s)== (8: ||0 p.A(() ( ((.)))AAA)) (5x.j 1/8 Se} is a p-norm budget over A(x))
4

---

Published as a conference paper at ICLR 2026
Packetization for integer grids. We represent binned events as zz(,, j], where indexes discrete time bins and ; indexes an event line (a fixed pixal-polarity location); xft, is the spike count on line at time bin t. For integer event grids, we conceptually decompose each count into unit packets so that capacity- acts on packets per event line and time bin. Detailed discussion of global optimality guarantees for Eq. 6 and the computational complexity of our solver is provided in Appendix
Budgets. Budgets connect hardware plausibility, attacker power, and fair reporting. With (e) in Eq. the formulation is norm-agnostic, and we focus on three canonical cases:
B (E)= {6: 5-.i s)
Bi (z) { Σ |6., S |
Bo(s)= {5:
Σ (a.))
I[6., # 03 S $ (7)
(I.))
local jitter
total timing shift
tamper count
Bx caps per-spike jitter, aligning with timestamp uncertainty and favoring local retimings; B1 limits aggregate timing shift, providing a single global knob that scales with event density; Bg bounds how many spikes are touched, capturing stealthy, minimal-footprinn attacks.
4.2 RELAXATION AND OPTIMIZATION VIA SHIFT PROBARILITIES
The definition above specifies admissible retimings as integer assignments under capacity- and budget on 6. To optimize within this discrete space at scale, we build differentiable surrogate that keeps the forward sample feasible, provides useful gradients, and works for any choice of p in Eq 6
Shift logits as distributions over admissible targets. For each active source (s,j) E A(xx), we introduce shift logits Φ(s. j. u] on an index u E Up and define tempered probabilities
T [...j, uj exp($(s.j..u//))
(-e....,e): =]], -.
p=
Up = (0....., (1.......,T 1}, otherwise,
(8)
Σ exp(((ss WELp
where e is the radius of (e). We do not enforce the timeline constraint 0 S. 8 + u < T at this stage for p = oo; boundary handling deferred to the soft operator and the strict projection.
Soft shift operator. Given the distribution æ over admissible targets, we map each index E Up target time by Tp(s, u) s + for p oo and (s u) u otherwise. Let æ[(, j] 0 for t & {O..... 1}. The expected (soft) retiming on event line j is
S (x)((
Σ
Σ HEM
T|s.j. ul ((T =
(9)
Here r[s.j] denotes the packet at original time s event line j. and π Tis, j, u] in Eq. 8 is the probability (from the shift logits) of moving this packet by an integer offset u so that it lands at I == + u. Then (z){)( in Eq. 9 is the expected post-attack packet at (l,j), obtained by summing the contributions x r] from all sources and shifts with = 5 + u weighted by T[s; u]] We define 0 (z). For
[1,0), normalization of yields value conservation _ x... For p = oo, the same identity holds when the window E- stays within the timeline. The operator is linear and fully differentiable, providing gradients aligned with temporal retimings and leading naturally to strict projection next.
every
line: ET-1 Sx (x)[t,
Expected occupancy and capacity regularization. To align the soft distribution with capac- ity-/ before strict placement, we track the expected packet count at bin (t.j): occ, [t. jl E ((s))(()) Evey, T|s, u] (TT((s f}. We penalize only the excess beyond unit capacity,
T-1
Cap(T; x)
lcc. - 1]
(10)
A((x)
where [2] == max(2, 0) denotes the positive-part (hinge) operator.
Budget-aware soft surrogates. The budget in Eq. 6 is enforced exactly by the final projection. During optimization, we guide & with smooth surrogates matched to the chosen budget so gradients favor feasible retimings. For p oc, surrogate required because the support Moc already
5

---

Published as a conference paper at ICLR 2026
Algorithm PIL-PGG: Projected-in-the-log PGD over shift logits
I: Input: SNN f. iterations Tgd, temperature k, step size a, radius e, clipping Ømas, weights Acap, Azudger Initialize shift logits & with zeros, and mask them outside A(x)
3: for = 1 to pgd do
4: <- softmmax (
5: - 5- (m));
(a: n. Bp(e)): æPiL +- â + (a- stopgrad(@))
# strict projection in-loop
6: Compute I via Eq. 14 Update + alipl-mmax- Pmax ( + a sigu( (v))
7: end for
8: Return "dv P (a: n., Bx())
encodes the constraint. For 1, we use the step cost Cs,t = s| to define a soft total timing shift. And for p = O, we use the diagonal mass π- [8, = л [8, J. 8) to define a soft move count:
Sann TT; x)
Σ x|s.j.1] Ca.t, and Saon (T:; w)
Σ
(1- (11)
(s.)))((a)
(o.))
We push these quantities toward the target radius with normalized hinge penalties
RT(x;;) ( w)/e 1)+, p 10, and (x;(T:))
(12)
which keeps gradients comparable across c, and the strict projection later enforces the exact budgets.
Feasible strict projection under budgets. Given л, compute strict discrete retiming a P (at; n, B, (e)) that operates on A(x)) and enforces capacity-/, value conservation, and the budget (e()). The projection obeys the following rules: a) Candidate generation: For p oo, the procedure enumerates shifts u E {-E....,5) and maps each source (s.j) to the target time t = Tp(s, u) = $ + u. For p {0,1}, enumerates target times
.O...., T 1} with * b) Ordering: The algorithm sorts all candidates once by the descending score π [s. u) (or j. <) One-pass placement: The scan traverses the ordered list and places (s,j) - (t. only when the bin jt, is free. A placed source releases its origin; an unplaced source remains at 8. Targets outside the timeline are discarded implicitly by the time-axis clipping used in Sn and P* d) Budget enforcement: The implementation initializes global counters to the radius and consumes them during the score-ordered scan. For = oc, it accepts only shifts with ju| S E. For = 1, sets integer step budget B1 + traverses candidates in descending (ties by smaller It - s ) places each feasible move, and decrements B3 by /f until B = O. For = 0. it sets a move budget Bg and decrements Bn by per placement under the full procedure is in Algorithm32 2] and Appendix further explains how this strict projection achieves the budget constraint (e) exactly while maintaining capacity-1 and conserving event values.
ordering until Bg O. The
Projected-in-the-looe (PIL) straight through. Optimizing timing moves faces basic tension: the model must be evaluated on feasible inputs that respect capacity and the chosen budget, yet gradients must reflect how small retimings change the loss. Purely strict placement destroys gradients, while purely soft surrogates break the threat model seen by the network. We therefore adopt backward- pass differentiable approximation tailored to timing: the forward pass uses the strict projection [x; π (E)), )), and the backward pass follows the soft retiming = Sx(x))
æPH. Ι + (# st))
(13)
This "projected-in thn-thheloopp coupling instantiates straight-through/ thrroughbbacke http///wawwwwdprreeeeeeeee sonddd-passss approximation
for discrete operations, providing stable gradients without sacrificing exact feasibility at evaluation.
4.3 PIL-PGD: PROJECTED-IN- -NN-E------T--LLLO -OOO PGD OVER SHIFT LOGITS
Building on Eq. 13 and the additional loss Eq. 10 we optimize the shift logits by maximizing
J (((T))) v) >eap Cap(T;; a))
Abudget RTTTT;))
(14)
We update logits with a clipped sign-PGD step
clip - +max smnn ④ + www.siinnvV.. sv
(15)
where Φmax a hyperparameter that prevents logit saturation and stabilizes the softmax temperature
After the final iteration, we recompute and output the strictly feasible ady P* (a:; π,, (e)))

---

Published as a conference paper at ICLR 2026
Table 1: Results on Binary-grid DVS. We report clean Accuracy (Acc., %) and ASR (%) under Bp with p (oc, 1, 1,0 For each budget, we evaluate three radii, and dptasct-specific radii are indicated.
Dataset
Model
Acc. (8)
ASR (%)
Budger
B 2
B.
Bg
500
750
1k
200
300
400
ConvNet
99.06
100
100
13.0
53.1
98.5
N-MNIST
ResNet18 VGGSNN
99.62
100
100
100
69.2
97.4
100
78.9
100
100
99.64
98.9
100
100
26.4
65.5
94.7
18.3
81.8
99.8
Budger
B
B.
Bo
2'
2k
4k
1k
2k
4k
DVS-
ResNet18
100
98.5
Gesture
VGGSNN
95.14
96.4
100
100
53.3
5
55.6
87.2
98.9
SpResF
91.67
92.1
96.1
100
64.4
87.3
98.4
43.8
90.9
99.2
CIEARIO- DVS
18
78.30
100
100
100
51.0
77.0
97.0
26.0
42.0
80.0
VGGSNN
78.30
100
100
100
47.0
72.0
98.0
25.0
46.0
73.0
SpResF
81.30
100
100
100
84.0
100
100
52.0
92.0
100
Why this objective and update. Alg. formulates Eq. 14 within the loop: the forward path adopts strictly projected == (zx; πΟ Bp())). while the backward path differentiates through the soft shift Sq. The objective steers logits toward untargeted attacks and adds two terms, the over-occupancy Cap and the budget penalty Ry. Logits are updated by a clipped sign-PGI step, and the bound &max maintains scale and prevents early near-argmax collapse. With feasibility enforced in the forward and diffcrentiability preserved in the backward, PIL yields stable gradients without violating the threat model. The same routine applies for p {oo, 1, 0}, changing only R2 and the projection P
5 EXPERIMENT
CIFARIO-DVS (Li et al. 2017) (10,000 CIFAR- 10 images converted to event streams over 10 classes; 2 128 x 128 grid), DVS-Gesture (Amir et al. 2017) (1,063/288 train/test streams, 11 gestures; 2 128 x 228., and N-MNIST (Orchard al. 2015) (60,000/10, 10,00 0,000 rendere MNIST samples; 2x33x334 Attacks are run only on correctly- classified test samples: all DVS-Gesture, 1,000 on N-MNIST, and 100 on CIFARIO-DVS. We set time-bin 10. For N-MNIST, we use ConvNet (Fang et al. 202 Spiking ResNet18 (Fang (et al., 2 and VGGSNN (Deng et al., (0222). For the other two datasets, we replace ConvNet with SpikingResformer (SpResF) (Shi et al.) 2024). All models are directly trained SNNs.
Datasets and Models. We choose event datasets:
Evaluation. We adopt untargeted attacks under By(e) with p E foo, 1, 0}, and evaluate both binary/integer-grid events. Our metric is the Attack Success Rate (ASR) on S: ASR(B, [ST E(an)s H{ [( Attack (ar; Bx(())) Jy}. We report ASR across the budget e for each p.
Implementations. For Boc, we use E 21, For Be, we set {200, 300, 400} on N-MNIST, and (Ik, 2k, 4k} on WeS-Gestrre and CIFARIO-DVS. To keep perturbations comparable, the B2 radii are twice the Bn settings. On DVS-Gesture, (4k)) touches 2.45% of spikes, on CIFAR 1V-DVS the same 4k is 3.84%, and on N-MNIST Bo (400) 14.2%, indicating the stealthiness. Alg. 1 Juses k= 1, a= 1, @max 10, Aeap 20, >budget 10, T pgd 20 for B and T pgd = 40 for B₁ and Bo.
5.1 EXPERIMENTAL RESULTS
Results on Binary DVS Data. We first evaluate our attacks on binary grids as shown in Tab. Under B. small jitter already drives ASR near saturation; for example, most results reach over 96% at E 1. Under B,, ASR increases smoothly with budget with moderate architecture depen- dence; e.g., on
the SpikingResformer attains 98.5% at B, (4k). Under By retiming small subset of spikes is effective; for instance, on CIFAR10-DVS 10-DVS the SpikingResformer achieves 96.0% at 4k touched spikes. Overall, timing-only perturbations are highly effective on binary grids, with susceptibility shaped by the budget and the model family.
Results on Integer DVS Data. As shown in Tab. 2 integer DVS grids mirror the binary trend under B_ with fast saturation, but are consistently more robust under B, and Bn at the same nominal budgets. For example, on DVS- SyS-testure with ResNet18, the binary grid exceeds 99% ASR at B, =8k, whereas the integer grid is around the mid-60% at 8k and mid-80% at 16k; similar gap appears on CIFAR II-DSS. Under By the binary grid reaches high ASR by 4k touched spikes, while the integer grid typically requires up 8k to approach comparable levels.
7

---

Published as a conference paper at ICLR 2026
Table 2: Results on Integer-grid DVS. We report clean Accuracy (Ace., %) and ASR (%) under Bp-
Dutaset
Model
Acc. (%)
ASR (%)
Budger
Esc
8i
Bo
2
500
750
Ik
1.5k
200
300
400
600
ConvNet ResNet18
99.
100
100
100
61.8
99.2
100
100
13.0
56.
99.1
100
N-MNIST
99.62
100
100
100
53.9
93.6
99.8
100
86.1
99.8
100
100
VGGSNN
99.71
46.3
100
100
8.3
18.5
39.9
76.7
5.8
11.2
16.1
49.8
Budger
B1
Bo
1
2k
4k
8k
16k
1k
2k
4k
DVS- Gesture
8 VGGSNN
94.40
71.0
83.3
93.3
17.1
40.9
65.4
85. 1
8.9
35.3
68.0
98. 1
94.79
65.9
79.9
85.0
14.7
31.9
55.0
79.1
21.6
40.7
67.4
95.9
SpResF
92.71
70.7
79.8
84.0
36.8
52.8
68.8
80.6
26.2
46.3
70.7
80.6
CIFARIO- DVS
ResNet18
79.20
99.0
100
100
21.0
37,0
66.0
85.0
7.0
18.0
33.0
73.0
VGGSNN
78.80
98.0
100
100
26.0
43.0
67.0
87.0
16.0
25.0
46.0
78.0
SpResF
82,90
100
100
100
63.0
97.0
100
100
35.0
72.0
100
100
Clean accuracy and robustness. Accuracy is comparable across binary/integer grids for the same model and dataset (e.g., ResNet18 + DVS-Gesture: 95.14 vs. 94.40), while robustness diverges.
Why integer grids appear more robust under bin-level retiming? (i) Presence bias and narrow temporal margin on binary. Binary inputs are thresholded from integers, so training emphasizes bin-level presence features. Under bin-level retiming, shifting isolated spikes across a temporal re- ceptive field can toggle on/off patterns and induce large discrete changes in downstream activations, implying a narrow temporal margin.
(ii) Multiplicity and smoother temporal response on integer. Integer inputs preserve per-bin multiplicity. A bin-level shift moves count packets that temporal convolutions, pooling, and normalization integrate more smoothly, so the same retiming manifests as a gentler phase change in feature space. To obtain comparable feature variation, retiming typi- cally needs a larger total timing shift. (iii) Surrogate -radient and normalization stability. Although spikes are binary, gradients and normalization act on pre-spike continuous variables. With binary inputs, pre-activations concentrate near threshold, and small bin shifts move many units into and out of the surrogate-gradient support, producing spiky gradients and volatile normalization statis- tics. With integer inputs, pre-activations vary more smoothly and statistics are more stable, yielding broader tolerance to small temporal phase shifts. Theoretical explanations are in Appendix A
Ablation. We ablate 3 modules with VGGSNN and DVS-Gesture in Tab. 3 PIL (forward with the striet projection while backward with the soft shifter) is critical: replacing it with only the soft consistently lowers ASR (binary B; 98.5 - 84.3; integer B 85.0 - 63.0), showing that matching the evaluated threat while retaining gradients matters. The budget penalty R2 is also crucial, with the largest impact under B, (binary: 98.5 + 76.6, integer: 79.1 + 42.4) and noticeable drops for (bbinary:: 98.9
Table 3: Ablation. We report ASR (%). "wwo PIL" denotes replacing PPIL with (x))
Binary Grid
Integer Grid
Variant
Ba(1)
[.(kk)
Bı(16k) Bi(8k)
Full (ours)
96.4
98.5
98.9
85.0
79.1
95.9
w/o PIL
92.7
84.3
88.6
63.0
61.5
83.1
wio Cap
95.6
98.5
98.5
77.6
77.2
89.6
w/o R.
76.6
93.0
42.4
84.9
93.0, integer: 95.9-84.9). Capacity regularizer yields modest gains on binary but larger gains on integer grids; removing it reduces ASR (integer B 85.0 77.6). Overall, PIL + budget awareness account for most improvements, and capacity control helps when temporal bins become congested.
Comparisons against raw-event baselines. In addition, we also benchmark our attack against two strong raw-event baselines, SpikeFool (Büchel et al.) (002) and PDSG-SDA (Lun et al., 2025), under matched tamper-count budgets Bo on N-MNIST, DVS-Gesture, and CIFARIO-DVS. De- tailed -ucdracy-vs.-udget curves and full tables in Appendix K Overall, our timing-only, rate-preserving attack remains competitive with these raw-event methods and is often stronger on DVS-Gestun and N-MNIST, despite operating under stricter capacity and timing constraints.
5.2 ROBUSTNESS AGAINST ADVERSARIALLY TRAINED MODELS
Adversarial Training with Retiming Attacks. To assess robustness when the model is exposed during training to attacks, adopt the adversarial training (AT) (Madry al. 2018) paradigm: use attacks under budget (E) as the inner maximization and minimize robust risk in the outer loop:
min -- max L(fo(P n, B,(e))) x) s.t. π softmax(6)1x).
(16)
Since the strict projection p* is relatively slow, we optimize over & using the soft shifter Sn and apply P the final step. This keeps the inner loop efficient while still meeting budget constraints.
8

---

Published as a conference paper at ICLR 2026
Table 4: Results of AT with timing-only attacks VGGSNN and DVS-Gesture. Following com-
monly used metrics in AT, we report clean accuracy (Acc., %) and robust accuracy (%).
Grid
Adversarially trained model
Acc.
(1())
(2)
(3)
(2k))
Rohust Ace. (%)
(4k))
(8k))
Bollk)
By(2k)
By(4k)
Integer Binary
(x.(1)
22.92
9.72
6.60
7.29
15.63
12.50
9.03
19.45
16.67
10.42
(8k))
48.26
9.37
3.82
2.43
18.05
9.37
6.25
27.77
17.01
6.25
Bu(4k)
22.57
5.90
3.47
2.43
11.11
9.38
4.17
14.58
12.15
5,56
(1)
52.08
27.08
27.43
29.86
44,79
43.40
34.72
46.87
43.75
39.23
B, (8k)
68.75
40.62
40.98
43,40
64.58
61.81
54.51
68.40
64.58
55.56
Bo(4k)
72.22
40.97
38.19
37.50
67.01
60.41
51.38
70.49
64.58
51.38
Results. We do experiments with VGGSNN on DVS-Gesture. Tab. 4 shows AT on the integer grid yields a better clean-robust trade-off. With Bi (8k), the integer model keeps clean accuracy at 69% and reaches robust accuracy > 60% at small B2 radii, settling in the mid-50% at 8k. The gains transfer to By (= 55 55-68%) and to & (+2 41-43%). Training with Bo gives the highest clean accuracy (== 72%) and robust accuracy > 50%. On the binary grid, the clean accuracy reaches around 23 48%, and robustness remains weak even under the matched budget.
the integer grid
Insights. (i) Robustness tracks clean accuracy: if clean collapses, robustness is limited. (ii) In- teger temporal inertia: integer grids aggregate multi- bit counts per bin, adding inertia making the inner maximization less destructive; this stabilizes training and improves cross-budget transfer. (iii) Destructive inner maximization: our attack is highly destructive. Even with AT it substantially reduces clean accuracy, while robustness gains remain modest, highlighting the need for more prac- tical defenses and training schemes in future work. See Appendix [ standard non-timing AT baselines. Additional AT experiments, including multi-norm timing AT and TRADES- -assd timing AT, are reported in Appendix
for a detailed comparison with
5.3 DISCUSSION
negative (chl) (8()))
positive Ichō) H,(4k)
(1(
Time-shift distribution. Fig. 2 illustrates the time- shift on the binary DVS-Gesture, and shows a clear polarity pattern: the positive channel tends to delay (red-shiff) and the negative channel tends to advance (blue-shift). Under B,, most shifts are bin with a smaller mass at 2. Under Bo, shifts reach farther.
04-
Probabiilty
84-
1:0
Figure 2: Time-shift distribution (w/o 0).
Time-bins
We evaluate under different
Table 5: ASR (%) on VGGSNN (DVS-Gesture) We vary time bins T, neuron models (PLIF, PSN), and targeted attacks. "Default" is the main config.
time bins in Tab. [ On the binary grid, finer bins create more active time bins, so under a fixed B, or Bo budget the attacker must retime many more positions to achieve the same ef- fect, which drives sharp ASR drop (e.g., By: 90.6 + 29.1 1 from 7020 to T==40) On the in- regergrid. finer binning mostly redistributes the same spike counts. Temporal convolutions and normalization integrate summed counts within each receptive field, so the integrated mass re- mains stable The attacker can still rephase high-count packets under B,, and under Bo moving few high-mass bins remains impactful. This mass-preserving yet phase-shifting effect explains why ASR stays high at T 200 across budgets.
Binary Grid
Integer Grid
Variant
(8k))) Edd (..))
(16kk)) (x(8k)
Default setup
96.4
98.5
98.9
85.0
79.1
95.9
Time-bins
T 20
97.1
90.6
48.0
97.4
79.8
92.4
7=
30
93.8
49.2
70.5
87.0
T=
89.9
29.1
13.3
95.0
57.8
81.7
Neuron
PLIF
96.7
99.6
96.3
95.1
92.9
98.9
PSN
100
100
100
97.3
79.3
88.6
Targeted Attack
26.8
57.3
62.8
24.6
29.7
47.2
Neuron.
PLIF (Fang et al. 2021a) surpasses LIF in most cases (e.g., integer ; 92.9). PSN (Fang et al. 2023) saturates on the binary grid and remains high on the listed integer entry, indicating that richer membrane dynamics permit easier timing manipulations.
We evaluate neuron models in Tab. 5
Targeted Attack. We evaluate targeted attacks with O as the target label in Tab. 5 Targeted ASR is lower than untargeted across both grids, with the largest drop under _ Increasing the budget may mitigate this gap. Appendix M further reports random-target experiments on integer
/ VGGSNN, comparing our timing attack with the raw-event baseline PDSG-SDA (Lun et al. 2025). Under matched B, budgets, our attack attains targeted ASR comparable to PDSG-SDA, indicating that the relatively low targeted success is an intrinsic difficulty of attacks against event grids.

---

Published as a conference paper at ICLR 2026
(1)
(Bk))
Bo(4k)
Origin
Ours
Diff
Shift (poct Shift (neg)
Ours
Diff
Shift (poc) Shift (neg)
Ours
Dift
Shift rocs)
Shift (nog)
Hand Clapping
Origin
Ours
Shift (post
Shift (neg)
Ours
CIf
Shift (pod)
Shift (meg]
Ours
Shift rocd)
Shift (nog)
Right Hand
Figure 3: Visualization of Desture across selected frames (Frame 3/6 in odd/even rows). Ori- gin shows the clean frame (positive in green, negative in blue), Ours shows the retimed frame under a fixed retiming budget. Diff highlights changes (new in green, removed in red, unchanged in gray, polarity swap yellow). and Shift (pos) / Shift (neg) map per- per-polarity time shifts (delay in red, advance in blue, zero in gray, no spike in black). Shift color intensity scales with the absolute shift.
Transferability. Our transferability and multi-model ensemble experiments follow the standard surrogate- to victim and ensemble-base protocols from transferable attacks on image models (Liu iet al. 2017 Mahmood et al. 2021). In Appendix we experiments on VGGSNN - ResNet18 and Spiking Our attack transfers across architectures, with higher success the CNN-like ResNet18 due to the VGGSNN surrogate. Further work may explore stronger targeted objectives, and surrogate ensembles to improve transferability. Additional results on ensemble-based multi- model and multi multi-norm norm multi-model timing attacks, following Xu et al. (2025), are in Appendix
Visualization analysis. Fig. compares three timing budgets on binary events. With (1),,, the attack induces local jitter: Shift shows thin red and blue halos near edges, and Diff' concentrates on contours. With B1 (8k), shifts redistributed across many pixels, so Shift and Diff' spread more and intensities rise. With B, (4k), only a few spikes move, giving sparse bright red and blue points and few Diff hits, often away from the main motion. Across budgets, the adversarial frame stays close to the clean one because counts are preserved and only timing changes. A recurring pattern that key action strokes in hands and arms remain largely intact, while many retimings land on background or incidental spikes. This exposes sensitivity to nonsalient timing that still shapes membrane integration and decision timing- motivates defenses that reduce such reliance, for example, saliency-aware timing regularization foreground regions, AT with timing-only budgets that emphasize foreground stability, and objectives that penalize background timing.
Robustness to filtering defenses. We evaluate three simple label-free filtering defenses (refractory, temporal, and spatial smoothing) on binary DVS-Gesture VGGSNN. See Appendix L for details. Across a wide range of defense strengths, moderate filtering already costs tens of percentage points in clean accuracy while barely reducing the ASR of our timing-only only attack, and our method is at least robust to these defenses the value-based PDSG-SDA (Lun et al.) 2025). Only extremely aggressive filtering can substantially suppress our attack, but this simultaneously collapses clean accuracy, underscoring that simple intensity-based pre-processing is insufficient against our attack.
CONCLUSION
We establish spike retiming as timing-only threat event driven SNNs under budgets Boo Bi, Bo- We introduce projected in the loop (PIL): the forward pass uses a strictly projected input and the backward differentiates through soft shifter, with capacity regularizer and budget penalty. Across multiple event datasets and binary and integer grids, the attack achieves high success with small footprint. Our analysis shows integer grids are more robust because multiplicity smooths pre- activations and stabilizes normalization. Adversarial training yields partial gains yet reduces clean accuracy, motivating practical timing aware defenses. These results set a reference for temporal robustness and elevate timing primary axis for evaluation and defense in event driven SNNs.
10

---

Published as a conference paper at ICLR 2026
ACKNOWLEDGEMENT
This work was carried out at the Rapid-Rich Object Search (ROSE) Lab, Nanyang Technological University (NTU), Singapore. This research is supported by the National Research Foundation, Singapore and Infocomm Media Development Authority under its Trust Tech Funding Initiative, and the National Research Foundation, Singapore, under its NRF Professorship Award No. NRF- P2024-001. Any opinions, findings and conclusions or recommendations expressed in this material are those of the author(s) and do not reflect the views of National Research Foundation, Singapore and Infocomm Media Development Authority.
ETHICS STATEMENT
This work analyzes timing-only adversarial attacks event-driven spiking neural networks to ex- pose failure modes and inform defenses. Aware of dual-use risks, we restrict experiments to public benchmarks and open-source models (never deployed or proprietary systems) and disclose only what necessary for scientific reproducibility without enabling turnkey misuse. Any released artifacts will use research-only license with default "evaluation-only" configurations; potentially abusable components (e.g., automated black-box attack pipelines) are down-scoped. We also outline practical safeguards for defenders (timing-jitter augmentation, count-invariant timing checks, and certifica- tion baselines). No new data were collected; no human subjects or personally identifiable informa- tion are involved: usage complies with dataset licenses. We adhere the ICLR Code of Ethics and research-integre norms, report limitations transparently, and keep computational budgets modest limit environmental impact.
REFERENCES
Arnon Amir, Brian Taba, David Berg, Timothy Melano, Jeffrey McKinstry, Carmelo Di Nolfo, Tapan Nayak, Alexander Andreopoulos, Guillaume Garreau, Marcela Mendoza, Jeff Kusnitz, Michael Debole, Steven Esser, Tobi Delbruck, Myron Flickner, and Dharmendra Modha. low power, fully event-based gesture recognition system. In Proc. IEEE Int'l Conf. Computer Vision and Puttern Recognition, 2017.
Eric Balkanski, Harrison Chase, Kojin Oshiba, Alexander Rilee, Yaron Singer, and Richard Wang. Adversarial attacks on binary image recognition systems. CoRR, abs/2010.11782. 2020. doi: 00.488500rxXi.2200..111
Tong Bu, Wei Fang, Jianhao Ding, Penglin Dai, Zhaofei Yu, and Tiejun Huang. Optimal ann- snn conversion for high-accuracy and ultra-low-lan lontlancyy spiking neural networks. Proc. Inr' I Conf. Learning Representations, 2022.
Tong Bu, Jianhao Ding, Zecheng Hao, and Zhaofei Yu. Rate gradient approximation attack threats deep spiking neural networks. In Proc. IEEE Int'l Conf. Computer Vision and Pattern Recogni- tion, pp. 7896-7906, 2023.
Jonas Büchel, Thilo Stadelmann, et al. Adversarial attacks on spiking convolutional neural networks. Frontiers Neuroscience, 16: 111106199 2022.
Xiaowen Cai, Daizong Liu, Xiaoye Qu, Xiang Fang, Jianfeng Dong, Keke Tang, Pan Zhou, Lichao Sun, and Wei Hu. Towards building model/prompt transeraraae attackers against large vision- language models. Proc. Annual Conf. Neural Information Processing Systems, 2025.
Shuyu Cheng, Yibo Miao, Yinpeng Dong, Xiao Yang, Xiao-Shan Gao, and Jun Zhu. Efficient black-box adversarial attacks via bayesian optimization guided by function prior. In Proc. Int'l Conf. Machine Learning, 2024.
Francesco Croce and Matthias Hein. Mind the box: lı-apgd for sparse adversarial attacks on image classifiers. Proc. Int'l Conf. Machine Learning, volume 139, pp. 2201-2211. PMLR, 2021.
Mike Davies, Narayan Srinivasa, Tsung- Han Lin, Gautham Chinya, et al. Loihi: A neuromorphic manycore processor with on-chip learning. IEEE Micro, 38(1):22-9, 2018.

---

Published as a conference paper at ICLR 2026
Shikuang Deng and Shi Gu. Optimal conversion of conventional artificial neural networks to spiking neural networks. In Proc. Int'l Conf. Learning Representations, 2021.
Shikuang Deng, Yuhang Li, Shanghang Zhang, and Shi Gu. Temporal efficient training of spiking neural network via gradient re-weighting. In Proc. Int'l Conf. Learning Representations, 2022.
Jianhao Ding, Tong Bu, Zhaofei Yu, Tiejun Huang, and Jian K. Liu. SNN-RAT: Robustness- enhanced spiking neural network through regularized adversarial training. In Proc. Annual Conf. Neural Information Processing Systems, volume 35, pp. 24780-24793, 2022.
Jianhao Ding, Zhiyu Pan, Yujia Liu, Zhaofei Yu, and Tiejun Huang. Robust stable spiking neural networks. In Proc. Int'l l Conf. Machine Learning, volume 235 of PMLR, pp. 11016-11029, 2024a.
Jianhao Ding, Zhaofei Yu, Tiejun Huang, and Jian K. Liu. Enhancing the robustness of spiking neural networks with stochastic gating mechanisms. In Proc. AAAI Conf. on Artificial Intelligence, 2024b.
Chuang Duan, Zeyu Wang, Jianhao Ding, Zhaofei Yu, and Tiejun Huang. Temporal effective batch normalization in spiking neural networks. In Proc. Annual Conf. Neural Information Processing Systems, 2022.
Wei Fang, Zhaofei Yu, Ding Chen, Timothée Masquelier, Tiejun Huang, and Yonghong Tian. In- corporating learnable membrane time constant to enhance learning of spiking neural networks. In Proc. IEEE Ini'l Conf. Computer Vision, 2021a.
Wei Fang, Zhaofei Yu, Yanqi Chen, Tiejun Huang, Timothée Masquelier, and Yonghong Tian, Deep residual learning in spiking neural networks. In Proc. Annual Conf. Neural Information Process- ing Systems, volume 34, 2021b.
Wei Fang, Zhaofei Yu, Zhaokun Zhou, Ding Chen, Yanqi Chen, Zhengyu Ma. Timothée Masquelier, and Yonghong Tian. Parallel spiking neurons with high efficiency and ability to learn long-term dependencies. In Proc. Annual Conf. Neural Information Processing Systems, 2023.
lan J. Goodfellow, Jonathon Shlens, and Christian Szegedy. Explaining and harnessing adversarial examples. In Proc. Int't I Conf. Learning Representations, 2015.
Zecheng Hao, Tong Bu, Xinyu Shi, Zihan Huang, Zhaofei Yu, and Tiejun Huang. Threaten spiking neural networks through combining rate and temporal information. In Proc. Int'l Conf. Learning Representations, 2024.
Eugene M Izhikevich. Which model to use for cortical spiking neurons? IEEE Iransactions on neural networks, 15()):1063-1070, 2004.
Youngeun Kim and Priyadarshini Panda. Revisiting batch normalization for training low-latency deep spiking neural networks from scratch. Frontiers in Neuroscience, 15:773954, 2021.
Fengpeng Li, Kemou Li, Haiwei Wu, Jinyu Tian, and Jiantao Zhou. DAT: Improving adversarial robustness via generative amplitude mix-up in frequency domain. In Proc. Annual Conf. Neural Information Processing Systems, pp. 127099-127122 127128, 2024.
Fengpeng Li, Kemou Li, Haiwei Wu, Jinyu Tian, and Jiantao Zhou. Toward robust learning via core feature-aware adversarial training. JEEE Trans. on Information Forensics and Security, 20: 6236-6251, 2025.
Hongmin Li, Hanchao Liu, Xiangyang Ji, Guoqi Li, and Luping Shi. Cifarl0-dvs: An event-stream dataset for object classification. Frontiers in Neuroscience, 11:309, 2017.
Yuhang Li, Yufei Guo, Shanghang Zhang, Shikuang Deng, Yongqing Hai, and Shi Gu. Differen- tiable spike: Rethinking gradient-descent for training spiking neural networks. In Proc. Annual Conf. Neural Information Processing Systems, 2021.
Shuang Lian, Jiangrong Shen, Qianhui Liu, Ziming Wang, Rui Yan, and Huajin Tang. Learnale surrogate gradient for direct training spiking neural networks. In International Joint Conferences Artificial intelligence Organization, pp. 3002-3010, 2023.
12

---

Published as a conference paper at ICLR 2026
Ling Liang, Kaidi Xu, Xing Hu, Lei Deng, and Yuan Xie. Toward robust spiking neural network against adversarial perturbation. In Proc. Anmual Conf. Neural Information Processing Systems, 2022.
Ling Liang, Xing Hu, Lei Deng, Yujie Wu, Guoqi Li, Yufei Ding, Peng Li, and Yuan Xie. Exploring adversarial attack in spiking neural networks with spike-compatible gradient. IEEE Transactions on Neural Networks and Learning Systems, 2023.
Patrick Lichtsteiner, Christoph Posch, and Tobi Delbruck. A 128x128 120 db 15 us latency asyn- chronous temporal contrast vision sensor. IEEE Journal of Solid-State Circuits, 43(2):566-576, 2008.
Daizong Liu, Mingyu Yang. Xiaoye Qu Pan Zhou, Xiang Fang, Keke Tang, Yao Wan, and Lichao Sun. Pandora's 's box: Towards building universal attackers against real-world large vision- language models. In Proc. Annual Conf. Neural Information Processing Systems, 2024a.
Jun Liu, Jiantao Zhou, Jiandian Zeng, and Jinyu Tian. Difattack: Query-efficient black-box adver- sarial attack via disentangled feature space. In Proc. AAAI Conf. on Artificial Intelligence, pp- 3666-3674, 2024b.
Jun Liu, Jiantao Zhou, Jiandian Zeng, Jinyu Tian, and Zheng Li. Difattac+++: Query-efficient black- box adversarial attack via hicrarchical disentangled feature space in cross-domain. arXiv preprint arXiv:2406.03017, 2024c.
Yanpei Liu, Xinyun Chen, Chang Liu, and Dawn Song. Delving into transferable adversar- ial examples and black-box attacks. In Proc. Int'l Conf. Learning Representations, 2017.
161 1.10770...
Yujia Liu, Tong Bu, Jianhao Ding, Zecheng Hao, Tiejun Huang, and Zhaofei Yu. Enhancing adver- sarial robustness in snns with sparse gradients. In Proc. Int'l Conf. Machine Learning, volume 235 of PMLR, pp.
2024d.
Li Lun, Kunyu Feng, Qinglong Ni, Ling Liang, Yuan Wang, Ying Li, Dunshan Yu, and Xiaoxin Cui. Towards effective and sparse adversarial attack on spiking neural networks via breaking invisible surrogate gradients. In Proc. IEEE Inl'l I Conf. Computer Vision and Pattern Recognition, 2025.
Aleksander Madry, Aleksandar Makelov, Ludwig Schmidt, Dimitris Tsipras, and Adrian Vladu. Towards deep learning models resistant to adversarial attacks. In Proc. Int'l Conf. Learning Rep- resentations, 2018.
Kaleel Mahmood, Rigel Mahmood, and Marten van Dijk. On the robustness of vision transformers to adversarial examples. In Proc. IEEE Int't Conf. Computer Vision, pp. 7838-7847, 2021.
Pratyush Maini, Eric Wong, and Zico Kolter. Adversarial robustness against the union of multiple perturbation models. In Proc. Int'l Conf. Machine Learning, volume 119, pp. 6640-6650, 2020.
Alberto Marchisio, Giacomo Pira, Maurizio Martina, Guido Masera, and Muhammad Shafique. DVS-Attacks: Adversarial attacks on dynamic vision sensors for spiking neural networks. In International Joint Conference on Neural Networks, 2021a.
Alberto Marchisio, Giacomo Pira, Maurizio Martina, Guido Masera, and Muhammad Shafique. R- SNN: Robustifying spiking neural networks against adversarial attacks through noise filters for dynamic vision sensors. In IEEE/RSJ International Conference on Intelligent Robots and Systems, 2021b.
Paul A. Merolla, John V. Arthur, et al. A million spiking-neuron integrated circuit with scalable communication network and interface. Science, 345(6197):668-6735 2014.
Yibo Miao, Yinpeng Dong, Jun Zhu, and Xiao-Shan Gao. Isometric 3d adversarial examples in the physical world. In Proc. Annual Conf. Neural Information Processing Systems, 2022.
Yibo Miao, Yinpeng Dong, Jinlai Zhang. Lijia Yu, Xiao Yang, and Xiao-Shan Gao. Improving robustness of 3d point cloud recognition from a fourier perspective. In Proc. Annual Conf. Neural Information Processing Systems, volume 37, pp. 68183-68210 2024a.
13

---

Published as a conference paper at ICLR 2026
Yibo Miao, Yifan Zhu, Lijia Yu, Jun Zhu, Xiao-Shan Gao, and Yinpeng Dong. T2vsafetybench: Evaluating the safety of text-to-video generative models. In Proc. Annual Conf. Neural Informa- fion Processing Systems, volume 37, pp.
63872, 2024b.
Bhaskar Mukhoty, Hilal AlQuabeh, Giulia De Masi, Huan Xiong, and Bin Gu. Certified adversarial robustness for rate encoded spiking neural networks. In Proc. Ini'l Conf. Learning Representa- lions, 2024.
Bhaskar Mukhoty, Hilal AlQuabeh, and Bin Gu. Improving generalization and robustness in snns through signed rate encoding and sparse encoding attacks. In Proc. Int'l Conf. Learning Repre- sentations, 2025.
Emre O. Neftci, Hesham Mostafa, and Friedemann Zenke. Surrogate gradient learning in spiking Bringing the power of gradient- based optimization to spiking neural networks. IEEE Signal Processing Magazine, 36(6):51 63, 2019.
neural networks:
Garrick Orchard, Ajinkya Jayawant, Gregory K. Cohen, and Nitish Thakor. Converting static image datasets to spiking neuromorphic datasets using saccades. Frontiers in Neuroscience, 9:437, 2015.
Nitin Rathi and Kaushik Roy. Diet-snn: A low-latency spiking neural network with direct input encoding and leakage and threshold optimization. IEEE Transactions on Neural Networks and Learning Systems, 34(6):3174-3182 2023.
Kaushik Roy, Akhilesh Jaiswal, and Priyadarshini Panda. Towards spike-based machine intelligence with neuromorphic computing. Nature, 575:607-617, 2019, doi: 10. 10.1038--4136--01-16677-2
Bodo Rueckauer, Iulia-Alexandr Lungu, Yuhuang Hu, Michael Pfeiffer, and Shih-Chii Liu. Con- version of comtinuous-valued deep networks to efficient event-driven networks for image classifi- cation. Frontiers Neuroscience, 11:682, 2017.
Saima Sharmin, Priyadarshini Panda, Syed Shakib Sarwar, Chankyu Lee, Wachirawit Ponghiran, and Kaushik Roy. A comprehensive analysis adversarial robustness of spiking neural networks. In International Joint Conference on Neural Networks, pp. 1-8, 2019.
Xinyu Shi, Zecheng Hao, and Zhaofei Yu. Spikingresformer: Bridging resnet and vision transformer in spiking neural networks. Proc. IEEE Int'l Conf. Computer Vision and Pattern Recognition, 2024.
Ziming Wang, Runhao Jiang, Shuang Lian, Rui Yan, and Huajin Tang. Adaptive smoothing gradient learning for spiking neural networks. In Proc. Int'l Conf. Machine Learning, volume 202, pp. 35798-35816, 2023.
Yujie Wu, Lei Deng, Guoqi Li, Jun Zhu, and Luping Shi. Spatio-temporal backpropagation for training high-performance spiking neural networks. Frontiers in Neuroscience, 12:331, 2018.
Song Xia, Wenhan Yang. Yi Yu, Xun Lin, Henghui Ding, Lingyu Duan, and Xudong Jiang. Trans- ferable adversarial attacks on sam and its downstream models. In Proc. Annual Conf. Neural Information Processing Systems, 2024a.
Song Xia, Yi Yu, Xudong Jiang, and Henghui Ding. Mitigating the curse of dimensionality for cer- tified robustness via dual randomized smoothing. In Proc. Int'l Conf. Learning Representations, 2024b.
Nuo Xu, Kaleel Mahmood, Haowen Fang, Ethan Rathbun, Caiwen Ding, and Wujie Wen. Attacking the spike: On the transfcrability and security of spiking neural networks to adversarial examples. Neurocomputing, 656:131500 2025.
Yanmeng Yao. Xiaohan Zhao, and Bin Gu. Exploring vulnerabilities in spiking neural networks: Direct adversarial attacks on raw event data. In Proc. European Conf. Computer Vision, 2024.
Yi Yu, Song Xia, Xun Lin, Chenqi Kong. Wenhan Yang, Shijian Lu, Yap-Peng Tan, and Alex C Kot. Towards model resistant to transferable adversarial examples via trigger activation. IEEE Trans. Information Forensics and Security, 2025.
14

---

Published as a conference paper at ICLR 2026
Hongyang Zhang, Yaodong Yu, Jiantao Jiao, Eric Xing, Laurent El Ghaoui, and Michael Jordan. Theoretically principled trade-off between robustness and accuracy. In Proc. Int't I Conf. Machine Learning. volume 97, pp. 7472-7482, 2019.
Yan Zhang, Cheng Chen, Dian Shen, Meng Wang, and Beilun Wang. Take care: Improving inher- ent robustness of spiking neural networks with channel-wise activation recalibration. In IEEE International Conference on Data Mining, 2023.
Hanle Zheng, Yujie Wu, Lei Deng, Xing Hu, and Guoqi Li. Going deeper with -ireetly-trained larger spiking neural networks. In Proc. AAAI Conf. Artificial Intelligence, pp. 11062-11070, 2021.
Ziqi Zhou, Shengshan Hu, Minghui Li, Hangtao Zhang, Yechao Zhang, and Hai Jin Advelip: Downstream-agnostee adversarial examples in multimodal contrastive learning. In Proc. ACM Ini'l Conf. Multimedia, pp. 6311-6320 2023.
Ziqi Zhou, Minghui Li, Wei Liu, Shengshan Hu, Yechao Zhang, Wei Wan, Lulu Xue, Leo Yu Zhang, Dezhong Yao, and Hai Jin. Securely fine-tuning pre-trained encoders against adversarial examples. In Proceedings of the IEEE Symposium on Security and Privacy, 2024a.
Ziqi Zhou, Yufei Song, Minghui Li, Shengshan Hu, Xianlong Wang, Leo Yu Zhang, Dezhong Yao, and Hai Jin, Darksam: Fooling segment anything model to segment nothing. In Proc. Annual Conf. Neural Information Processing Systems, 2024b.
Ziqi Zhou, Yifan Hu, Yufei Song. Zijing Li, Shengshan Hu, Leo Yu Zhang, Dezhong Yao, Long Zheng, and Hai Jin, Vanish into thin air: Cross-prompt universal adversarial attacks for sam2. In Proc. Annual Conf. Neural Information Processing Systems, 2025a.
Ziqi Zhou, Bowen Li, Yufei Song, Shengshan Hu, Wei Wan, Leo Yu Zhang, Dezhong Yao, and Hai Jin. Numbod: A frequecy fusion attack against object detectors. In Proc. AAAI Conf. on Artificial Intelligence, 2025b.
15

---

Published as a conference paper at ICLR 2026
A ANALYSIS OF GRADIENTS AND NORMALIZATION UNDER BINARY VS. INTEGER INPUTS
Setup. Let X, RCCHXx denote the per-bin input (either binary (0. 13 or nonnegative integer counts), and let
A (W X)2 +
(17)
be the first pre-activation apatio-temporre convolution or linear filtering absorbed into W). Spikes are St @(A, - V(h) in the forward pass, and a surrogate a (with derivative o') is used in backprop. unit bin shift is written T₃ X, and the retining-induced perturbations are
AX -
AA, = A -
A, = (W AX),
(18)
We analyze the single-bol bin shift; multi-bin shifts and multi-spike patterns follow by additivityytriangle inequality.
1) Retiming changes pre-activations in Lipschitz way. By Young's inequality for convolu- tions, for p E (1,2),
| S [[W]| ||
(19)
Hence any bound derive in terms of ||Al|p immediately translates |AX|| via [W]
2) Surrogate-gradient support varies Lipschitzly under small shifts. pre-activations take the form
Backprop gradients w.r..
ac
ac (A, Vaa).
9t
~
(20)
0A.
as.
To quantify how many units contribute nontrivially to surrogate gradients, replace the hard band indicator by smooth C bump p I2 + [0, 1] with Lip(p) co and define the 8-smoothed gradient-support mass
A
Vih
Ms(T) = E
(21)
By the mean-value theorem and Eq.
18
Ms(r+1)- < Lip(p)
Tip(p)
[A(
[A
(7+1)
1
[W]] [[|AX]]]]
(22)
Thus, the shift-sensifivity of the surrogate-gradient support is proportional to the temporal variation
|A and scaled only by model/surrogate constants.
3) Normalization drifts (mean/variance) are controlled by AX. Let per-channel running statis-
tics over a window of N bins be
((T) 1 ΣA
0²(7)
1 N
Σ (A (1())=
(23)
A unit shift changes the mean by
||]h N
|m(T+1) 1()) Σ (1(++1) 1(1)
s n
||^l||
|АX|]
(24)
For the variance, expanding (2(++1) - oz (T) and collecting fist/ssecond-order terms gives
20(T) ||A||2
(3((+1)- <
||lA2 + 1n(r+1)-
(25)
VN
and by Eq. 19 24 this is bounded by |X|] as well. Hence both mean and variance drifts across
small shifts are linearly controlled by AXX
16

---

Published as a conference paper at ICLR 2026
4) Normalized pre-activation perturbation shrinks with the baseline scale. Consider the (affine-free free) chamnel-wise normalization
4 = -
A + AA, - (μ + Ap)
Z =
(26)
a + Ao
first-order expansion in AA Au,, Ao) yields
A4, Au
A 14
AZ
Ao.
(27)
a2
Taking & norms and using Cauchy-Schwarz together with Eq. such that
19 25
there exists ON = +
||A||2 - CN W|
| s
|
(28)
Interpretation: for the same retimed mass | 2| (i.e., same number of touched spikes and same bin shift), the normalized change is inversely proportional the baseline standard deviation o. Integer inputs aggregate multiplicities within bin; under mild independence/spariity of contributing atoms, this increases the pre-activation variance (hence o), so the normalized perturbation | becomes smaller.
5) Temporal margin and its dispersion. Define a smoothed temporal margin
Mars(T) E bbs (4 Vit)]
(29)
where tha is an even C function that equals |a| convolved with a width-ō mollifier (matching the surrogate bandwidth). By the mean-vate value theorem and Eq. [8]
[Mars(++1) Mara(r)l To B. [[I
1] Iyp.8 [W]|
(30)
Consequently the dispersion across small shifts, Var, (Mars(T)), is larger when ||X]] is larger and/or more irregular; the converse yields steadier margins.
6) Why integer > binary for timing robustness. Two mechanisms combine:
(A) Larger baseline scale a for integer inputs. Because integer grids preserve multiplicity within each bin, A, aggregates more contributing atoms than binary grids (which only encode pres- ence/absence). Under mild independence and comparable per-atom weights, Var(A) (A.) grows with the expected count per bin, so is larger for integer than for binary. By Eq. 28, the normalized effect of a fixed retimed mass || 2 is therefore smaller for integer inputs, implying:
(i) Larger total shift needed. To achieve the same normalized change (hence compara- ble feature-phase displacement and decision impact), an attacker must increase | ||2 proportionally a, i.e., needs larger total timing shift on integer inputs.
(ii) More stable
The same retiming budget produces smaller A Z 12 (Eq, (8q.28). smaller changes of gradient-support mass (Eq. 22 with replaced by Z), and smaller mean/variance drifts (Eqs. 24 25 on integer inputs.
(B) Smaller temporal variation || || for integer under rate-smoothness. Let the underlying per- location event rate vary smoothly across adjacent bins. Binarization introduces on/off boundaries: even small rate fluctuations create frequent {0, 1} flips, inflating the temporal difference || -X] X|| relative the aggregate count change.
contrast, integer counts change more gradually across bins when rates are smooth, yielding a smaller typical | for the same underlying dynamics. Plugging this into Eq. 22] Eq. 24 and Eq. 30 shows that gradient-support variation, normalization drift, and margin dispersion are all smaller for integer inputs.
Takeaway. Eq. 19 28 and 30 together establish that, under the same retiming budget, integer in- puts (i) attenuate normalized perturbations via a larger baseline o, and (ii) reduce shift-sensitivity by exhibiting smaller temporal differences || ||||| when rates are smooth. These two effects precisely explain the main-text statements: (ii) retiming on integer inputs typically requires larger total tim- ing shift to match the effect; and (iii) surrogate gradients and normalization statistics are more stable under small shifts.
17

---

Published as a conference paper at ICLR 2026
Table 6: Transfer ASR (%) on DVS-Gesture: attacks crafted on VGGSNN (surrogate) and evalu- ated on targets.
Binary Grid
Integer Grid
Target Model
Boc
B1
Bu
30
B1
Bu
2
3
8k
16k
4k
8k
3
8k
16k
4k
8k
ResNet18
75.9
83.5
86.5
66.0
82.1
81.0
90.8
32.2
42.1
45.0
25.6
39.1
43.2
65.9
SpikingResformer
47.0
56.2
61.6
45.9
51.8
55,4
62.7
30.7
30.4
34.4
19.0
26.3
16.4
31.5
B TRANSFERABILITY
We evaluate transfer from VGGSNN to ResNet18 and SpikingResformer on DVS-Gesture in Tab. 66 and compare against the white-box ASR in Tabs. [ and 2 On the binary grid, transfer is strong and grows with budget, with ResNer18 consistently higher than SpikingResformer. For ex- ample, increasing B1 or Bu raises ASR on the targets toward the corresponding white-box levels. This aligns with shared inductive biases early temporal filters, so presence features and phase edges crafted on VGGSNN generalize to CNN-like targets.
On the integer grid, transfer clearly weaker at small B and B1 radii, while larger Bo still yields meaningful transfer. Integer inputs preserve multiplicity and induce smoother preactivation and nor- malization, so the inner solution becomes more model-aligned and less cross- tross-model, which limits generalization from the surrogate. Overall, binary attacks transfer more readily, ResNer18 is an easier target than SpikingResformer, and increasing the budget narrows the gap to white box perfor- mance, especially under Bu where a few high-impace retimings remain effective across models.
C USE OF LARGE LANGUAGE MODELS (LLMS)
We used large language model (LLM) solely writing assistant for language editing--grammal correction, wording/fluency polishing, and minor rephrasing for clarity. The LLM was not involved research ideation, problem formulation, methodology or experiment design, coding, data analysis, result generation, or citation selection. All technical content and conclusions were authored and verified by the human authors, who take full responsibility for the paper. The LLM not eligible for authorship.
D ETHICS STATEMENT
This work analyzes timing-only adversarial attacks event-driven spiking neural networks to pose failure modes and inform defenses. Aware of dual-use risks, we restrict experiments to public benchmarks and open-source models (never deployed proprietary systems) and disclose only what necessary for scientific reproducibility without enabling turnkey misuse. Any released artifacts will research-only license with default "evaluation-only" configurations; potentially abusable components (e.g., automated black-box attack pipelines) are down-scoped. We also outline practical safeguards for defenders (timing-jittee augmentation, count-invariant timing checks, and certifica- tion baselines). No new data were collected: no human subjects or personally identifiable informa- tion are involved; usage complies with dataset licenses. We adhere the ICLR Code of Ethics and research-integrin norms, report limitations transparently, and keep computational budgets modest. limit environmental impact.
E STRICT PROJECTION P AND RATE PRESERVATION
In the main paper, we define the feasible assignment set in Eq. (5) by requiring (i) a capacity-1 constraint along each event line and (ii) rate- preteerreeriing timing-only adversary that never changes event counts or amplitudes. Here we make the strict projection pa (æ, π, B,) explicit for the global Lo budget case and clarify why it is rate-preserving by construction.
18

---

Published as a conference paper at ICLR 2026
E. ALGORITHMIC DEFINITION UNDER GLOBAL Lg BUDGET
We work on flattened event lines: an input E RXXXXXxXXX is reshaped to I E RT'X,, where N BC H W indexes event lines j (I,..., N). A non-zero entry æ[s,]] denotes one event packel (a single spike on binary grids or an integer-valued packet on integer grids). The learned shift logits are turned into probabilities j[s, t] [0, over target times E {L...., for each source packet (s.
The global Lo budget Bg upper-bounds the number of packets that may be moved (each moved packet consumes one unit of budget). The strict projection P then greedily selects packet moves (s t,j ) by prioritizing high shift probabilities (and, as tie-breaker, shorter temporal distances), while enforcing capacity-1 and the global budget. The complete procedure is given in Algorithm
Intuitively, packets whose candidates are never accepted remain at their original time indices 8, while accepted candidates correspond to pure moves of the entire packet from (8.j) to (t,j) the same event line. The additional checks with occupied and reserved guarantee that no time bin (t.j)
ever hosts more than one packet after projection, and that never overwrite original packet that still planned to stay.
E.2 RATE PRESERVATION BY CONSTRUCTION
The above algorithm is rate-preserving in strong sense:
Each original packet appears exactly once after projection. Every packet either moved once or left at its original location. No operation creates new packets or deletes existing ones; the procedure only changes their time coordinates.
Packets never change event lines. Moves are always of the form (s,j) (1,j), so packets only move along the time axis on a fixed line j.
Consequently, for every event line j. we have exact preservation of the event multiset along time:
[advit.j)) i= {a(t,
(31)
and hence the per-line and global event counts are preserved:
T
Σ adv[t. |] = Σ xlt,
Σ adv[t, olt. (.j
(32)
Equivalently, P implements a per-line permutation of non-zero packets along the time axis (with some packets possibly staying fixed), which is strictly rate-preserving for both binary and integer event grids.
In projected-in-the-tooe (PIL.) optimization, the only approximation appears in the backward pass: gradients are computed through the soft operator S,, on an expected retiming, while the for- ward evaluation of the SNN always uses the strictly projected 1 (zz, n, B,). All adversarial examples seen by the model therefore satisfy the preseereevvvnon equalities above.
E.3 EMPIRICAL SANITY CHECK OF RATE PRESERVATION
To verify that our implementation matches the intended behavior, we performed a systematic sanity check all experiments in the main paper (all datasets, models, budgets, and random seeds):
For each adversarial example, compared the per-line event configurations before and after projection.
For every event line j. we confirmed that the sorted multiset {adv[t,j]]* coincides with {x(t, ;]]?" i.e., packets are only permuted in time and never added, removed, or rescaled.
These checks were satisfied for all runs, confirming that P is rate- pnte-preserving in practice for both binary and integer grids. We will summarize aggregate statistics of this check in a small table the supplementary material.
19

---

Published as a conference paper at ICLR 2026
Algorithm Strict projection (z, nT, Bp) with global Lo budget
1: Input: flattened events x E R Tx* (time event lines), shift probabilities a E [0, 1]7xxxx global Lo
budget Bu
2: Output: projected events adv = P (a, n. Bp) reshaped back to
3: # identify active packets and candidate moves
4: has_src[ss]]]
[x]ss]] ]] 03 for all E (I....,, T). (1....,NN)
5: C+ C+n
for all [s s.t. has_src[s,]] =
7: for = to 7 do
8: if + then add (s. W.C end
9:
11: end for
12: end for
13: priority score: probability first, distance tie-breaker
14: choose tiny
for (s.j. E do
16: ksy(s.j,1) < J... j. 4 + e((T -) 1) s()
17: end for
18: sort in descending order of (s,
19: initialize states
20: occupiod[j,. 1] False, for all j.
# targets already taken by moved packets # original packets planned to stay
21: reservedfj. 4 has strc[tt]]] j]. for all j,
22: moved[jj s] x- False, for all j.s
23: adv [, 0, for all s,
24: Brem
25: greedy retiming under capacity and budget
26: for all (s.j.1) E C sorted order do
27: if Brem & O then
28: break
# budget exhausted
29: end if
30:
moved s] then
31: continue
32:
end if
# source already moved
33:
if occupied then
34: continue
35:
end if
# target already taken
36: if reserved[j. t] then
37: continue
38:
end if
# collides with stay-at-source packet
39:
accept candidate: move whole packet from (8, )) to (t,
40:
adv(t,j] [] +- x[
41:
occupied]] j, L] < True
42:
movedlj,
True
43:
reserved]j, s] +- False
44: Brem f- Brem
45: end for
46: # packets not moved stay their original time
47: for all ($ has src[s. = and moveddjj, False do
48: adv adv[s.j] <- x j[
49: end for
50: Return adv reshaped back to H,,
E.4 COMPARISON TO NON-TIMING ATTACKS
Standard image/event-domaie attacks, such PGD integer event grids attacks that insert and delete spikes, inevitably change event counts or intensities. They cannot enforce strict equalities such E, adv E. j] and [d Even if some non-ting non-timing attacks happen to induce small average rate drift certain settings, this is incidental rather than guaranteed by the threat model.
(zft.jlV for all hard constraints.
20

---

Published as a conference paper at ICLR 2026
Table 7: Adversarial training on DVS-Gesture (VGGSNN) evaluated in terms of attack success rate
(ASR, %; lower is better). The first six rows are standard non-timing AT baselines (including 11-
APGD-based AT (Croce& Hein 2021) and binary to flip AT in the spirit of (Balkanski al 2020 the last three rows are our timing-only AT.
B
B
Bg
Training scheme
clean
Avg ASR
2
3
2000
4000
8000
1000
2000
4000
L0 PGD AT (c=0.5)
64.24
45,41
50.27
55.14
10.81
21.08
36.76
8.65
14.05
34.05
30.69
Loo PGD AT (c=0.4)
71.88
48.79
54.59
S7.97
14.98
25.60 40.58
12.56
23.19 37.20
35.05
binary & flip AT (r=0.32)
77.78
54.91
67.86 71.88
10.71
22.32 43.30
8.48
18.30
39.29
37.45
binary fu flip AT (r=0.45)
74.31
53.74
63.55 66.82
10.75
21.96 38.32
8.41
20.56
35.05
35,46
4-PGD AT (f=10000)
69.10
54.17
57.69 52.66
15.53
21.56 42.11
16.53
24.57
45.63
36.72
4PPGD AT (7=14000)
67.01
51.81
58.03
55.44
10.88
22.80
43.01
13.99
23.32
40.41
35.52
Timing AT (Bxx =1)
52.08
48.00
47.33
42.67
14,00
16.67
33.33
10.00
15.99
24.67
28.07
Timing AT (Bi -8000)
68.75
40.92
40.39 36.87
6.07
10.09
20.71
0.51
6.07
19.19
20.09
Timing AT (Bo (Bo=4000)
72.22
43.27 47.12 48.08
7.21
16.35 28.86
2.40
10.58 28.86
25,86
By contrast, our spike-retiming adversary explicitly characterizes and optimizes the worst-case per- turbations under a strict rate- oatepreseervatinn constraint. This makes it qualitatively different from norm- boundde perturbations in the value or count space and highlights spike retiming distinct, timing-only attack surface.
F COMPARISON WITH STANDARD NON-TIMING ADVERSARIAL TRAINING
Following previous work (Mukhoty et al. 2025), here compare our timing-only adversarial train- ing (AT) with standard non-timing AT schemes on DVS-Gesture (integer event grid) and VGGSNN. In the main paper, Table 4 reports robust accuracy; for the same trained models, we additionally re- port attack success rate (ASR) here for easier read-to-heade comparison.
We follow standard practice and instantiate the L AT baseline with the 41PAPG attack of Croce and Hein (Croce & Hein 202T). For the binary lo flip baselines, we adopt a pixel-flip style sparse attack on binary images in the spirit of Balkanski et al. (Balkanski et al. 2020), adapted to event-grid setting. For loo. we follow the PGD AT (Madry et al. 2018).
Setup (dataset, metric, and evaluation). All results in this section are on DVS-Gesture with VGGSNN. ASR computed only over samples that are correctly classified under the clean model, exactly as in main attack experiments. Robust accuracy and ASR are related by
ASR 100% - robust accuracy.
At test time, we evaluate nine timing-only attacks with budgets B E (1,2,3). B E (2000, 4000, 8000), and Bn (1000, 2000, 4000). For each training scheme, we report: (i) clean accuracy (%); (ii) nine ASR values (lower is better); (iii) the mean of the nine ASR values (Avg ASR).
The first six rows in Table 7 are standard non-timing AT baselines; the last three rows are our timing- only AT ("Spike Retiming AT with different inner-loop budgets.
we observe that the best non- non-timing AT baselines (across foc, binary lo. and &1) achieve clean accuracies in the range 67%-78% with average ASR around 30%-37% (e.g., foo PGD AT with c=0.5 has clean 64.24% and Avg ASR 30.69%). In contrast, our timing-only AT attains: (i) for =000,0, clean 75% and Avg ASR 20.09%: (ii) for Bo=4000, clean 72.22% and Avg ASR 25% Thus, for similar clean accuracy (around 69-72%), timing AT reduces the average ASR by roughly 9-15 percentage points compared to all non-ting con-timing AT baselines. Equivalently, for fixed robustness level, timing AT maintains noticeably higher clean accuracy. We will reference this table in the main paper to make the advantage of liming-only AT over standard AT explicit.
Clean-robust trade-off vs. standard AT. From Table 7
21

---

Published as a conference paper at ICLR 2026
G ON THE OPTIMALITY AND COMPLEXITY OF THE ATTACK SOLVER
This section clarifies what can and cannot be claimed about the optimality of our attack-finding formulation in Eq. (6), and discusses its computational complexity in comparison to non-timing attacks on event data such as SpikeFool (Büchel al. 2022) and PDSG-SDA (Lun al. 2025).
G.1 OPTIMALITY OF THE INNER MAXIMIZATION
Eq. (6) defines an inner maximization over discrete, budget-constrained retimings under capacity-1 along each event line. Each non-zero packet x[s, can be shifted by an integer offset u so that it lands at + u on the same event line j. The feasible set is defined by (i) a capacity-] constraint per (t,j) 1) and (ii) global timing budgets (e.g.. Bx,, B1, Bo). Together with the non-convex SNN loss under BPTT, this yields combinatorial, non-convex optimization problem.
Under these constraints, global optimality of Eq. (6) is nor tractable; even for standard ANNs, widely used attacks such as PGD and DeepFool do not provide global optimality guarantees; similarly, event-based attacks such as SpikeFool and PDSG-SDA focus on strong, principled approximations rather than exact solutions to a discrete global optimum. Our method follows the same philosophy.
What we provide is:
structured threat model (timing-oni) only, rate- tite-preserving, capacity-1) 1) and an explicit discrete feasible set of retimings; and
projected-in-the-loopp (PIL) optimization scheme that is designed reduce the gap be- tween a soft relaxation and the discrete, budget-constrained problem.
Within the PIL framework, three components are particularly important:
Capacity regularizer (Eq. (10)). This term penalizes "over- sveerbbokking" in the expected oc- cupancy of the soft retiming S₂ (x) when multiple packets try to land in the same bin (t, It encourages the shift distribution to concentrate patterns that are close capacity- 1, so that the strict projection (x, π, B,)) resolves fewer conflicts and the final discrete assignment remains close to what the soft surrogate already optimized.
Budget-aware penalties (Eq. (12)). These regularizers penalize soft jitter, total delay, and tamper count expectation, so that the probabilities π already respect the same budgets Bx B1, Bu that P enforces exactly. This aligns the soft search space with the hard budget constraints, reducing the mismatch between the relaxed problem and the true constrained objective.
PIL loss coupling. In each update, the task loss evaluated on the strictly projected input P (rr,, म, Bp), while gradients flow through the soft surrogate (xx (together with the capacity and budget penalties). This analogous in spirit to straight-through optimization for discrete variables, but tailored to our structured retiming and budgets. It ensures that are always optimizing what we evaluate: the gradient signal is shaped to favor retimings that survive projection and remain effective under the exact constraints.
In summary, we do not claim global optimality for Eq. (6), which would be unrealistic given the combinatorial, non-convex nature of the problem. Instead, our claim is that the capacity regularizer, budget-aware penalties, and PIL coupling are explicitly designed to tighten the relaxation paoputiiioooooottiooino gap and to yield strong local optima for the true constrained problem. This is supported empirically in the ablation study (Sec. 5.1), where removing either the capacity regularizer or the budget-aware terms leads noticeably weaker attacks and less stable behavior (e.g., more failed attacks at the same budgets and larger mismatches between nominal and realized budgets).
G.2 COMPUTATIONAL COMPLEXITY AND COMPARISON TO NON-TIMING ATTACKS
Our spike-retiming attack a gradient- iterative method under a structured threat model. The per-iteration cost consists of three parts:
22

---

Published as a conference paper at ICLR 2026
1. SNN forward and backward (BPTT). We run forward and one backward pass of the SNN on the current retimed input. This is the dominant cost shared with other white-box SNN attacks.
2. Soft retiming and regularizers. Computing S (x) and the capacity budget penalties scales with the number of candidate shifts. Let Npk be the number of non-zero packets (events) in I, and let Umax be the maximum number of allowed shifts per packet (the size the local shift set Us.j). Then the soft operator and regularizers require
O Umax)
operations per iteration. On event-driven benchmarks, Nppka & &T-H-W- W, this cost scales linearly with the sparse event count.
3. Strict projection (x, π, Bp). The greedy assignment described in Appendix operates over the same candidate set and also scales as O(Npa Umax) per iteration, with small constant factors compared to BPTT.
Overall, single iteration consists of one SNN forward-backwart pass plus additional term that linear in the number active packets and local shifts. In practice, the SNN backwdd dominates wall-clock time; the overhead of Sn and p is modest because exploits event sparsity.
Comparison to non-timing event attacks, Non-timing attacks on event data, such as Spike- Fool (Büchel al. 2022) and PDSG-SDA (Lun al.) 2025),, operate under different perturbation models (adding, deleting. or changing events in dynamic images) and use different relaxation strate- gies, but share the same high-level pattern:
SpikeFool relaxes dynamic images to continuous values, computes gradients, and iter- atively solves a linearized perturbation problem with rounding back to spike grids and straight-through gradients. The complexity is dominated by SNN forward-backward plus operations over (a large subset of) the dynamic image voxels.
PDSG-SDA introduces potential-dependerr surrogate gradients and a sparse dynamic at- tack that iteratively adds and removes spikes in dynamic images. The attack propagates gradients over all binary dynamic-image voxels and maintains sparse masks whose size scales with the grid and attack radius.
In terms of asymptotic complexity per iteration, all these methods, including ours, are dominated by the SNN forward-backward cost. The main difference lies in how they traverse the input space:
Non-timing attacks on event grids typically treat a large number of voxels (time-pixel posi- tions) potential perturbation locations, so their perturbation-update loops scale with the grid size or with large candidate subset.
Our timing-only attack never changes intensities or counts; it only retimes existing packets. The update loops scale with the number of non-zero packets and their local shift windows, which is often much smaller than the full grid size on event-sparse benchmarks.
We therefore view our method as being comparable in big-O terms to other gradient- based event attacks, while leveraging event sparsity and a structured timing-only threat model to avoid manipu- lating dense grids or solving additional global subproblems beyond BPTT.
H ADDITIONAL RESULTS ON MULTI-NORM TIMING AT AND TRADES
This section provides additional experiments (i) combining timing-based attacks with different budgets into a single multi-norm adversarial training objective, and (ii) replacing the Madry-style formulation (Madry et al.] 2018) with TRADES (Zhang al. 2019) in timing-only adversarial training. For (1) we follow the multi nuulti-petuurbtion formulation Maini et al. (Maini et al. 2020). and for (ii) we instantiate TRADES with our timing-only inner maximizer.
23

---

Published as a conference paper at ICLR 2026
Table 8: Single-norm timing AT multi-norm timing AT DVS-Gesture (VGGSNN), reported
as ASR (%, lower is better). "Binary" and "Integer" refer to the ovent-grid representation.
Grid
Training
|elean| Bx=1
B1=2k
4k
8k
BB=1k
2k
4k
Avg ASR
Binary
Single-norm =0 (1)
22.92
$7.59 71.20 68.19)
31.81
45.46 60.60
15.14
27.27
54.54
47.98
Binary Single-norm B1 (8000)
48.26
48.26
80.58
92.08 94.96
62.60
80.58 87.05
42.46
64.75 87.05
76.90
Binary
Single-norm Bu(4000)
22.57
73.86 84.63 89.23
50.78
38.4488.55
35.40
46.17
66.15
Binary
MultiNorm-Ae Avg
31.60
71.43
65.91 64.77
51.14
59.09 72.73
42.86
45,45 65.91
59.92
Binary MultiNorm-Max
36.11
79.81
78.85
77.88
64.42
77.88 81.73
51.92
71.15 77.88
73.50
Integer Single-norm B0 (1)
52.08
48.00
47.33 42.67
14.00
16.67 33.33
10.00
15,99 24.67
28.07
Integer Single-norm (8000)
68.75
40.92
40.39 36.87
6.07
10.09 20.71
0.51
6.07 19.19
20.09
Integer Single-norm Bo (4000)
72.22
43.27
47.12 48.08
7.21
16.35 28.86
2.40
10.58 28.86
25.86
Integer MultiNorm-Ar Avg
37.50
28.70
35.19 40.74
10.19
10.19 21.30
8.33
13.89 23.15
21.30
Integer MultiNorm-Maa
15.97
54.35
56.52 54.35
6.52
8.70 26.09
6.52
10.87 26.09
27.78
H.1 MULTI-NORM TIMING AT IN THE STYLE OF MAINI ET AL.
Our three timing attacks live in different combinatorial budget spaces: the per-spike jitter radius Bxx. the total latency budget B,, and the tamper-count budget Bg. Inspired by the multi-perturbation setup Maini et al. (2020). we define two multi-nomn timing objectives:
Lavg v)
Σ
max Tps Bp)),
(33)
AEB,
pE(00.1.0)
Cmax (I,
max max (ff(P (I, Tp, B))).
(34)
Pe (0).1..))) AEB,
where for each p E (oo, 1, }} the inner maximizer is our timing-only attack with the truining budgets Bo (1), B1 (8000). and Bo (4000), and P is the striet, feasible projection from the main paper.
We train these variants on WVS-Gesture with VGGSNN for both binary and integer event grids. We report attack success rate (ASR, in %) measured only on samples correctly classified by the clean model. For the single-norm rows, we reuse the same trained models as in Table 4 of the main paper and re-express their robustness in terms of ASR for comparability.
On the integer grid, the best single-norm configuration B1 (8000) attains clean accuracy 68.75% with the lowest average ASR 20.09%. The MultiNorm-Ave objective achieves comparable Avg ASR (21.30%) but its clean accuracy collapses to 37.50%, while MultiNorm-MMx further reduces clean accuracy to 15.97% and increases the Avg ASR 27.78%. On the binary grid, both multi- norm variants have high Avg ASR (N= 60-74%) despite moderate clean accuracy, and are dominated by the best single-norm configurations.
In contrast to the space setting of Maini et al. (020), where all norms share the same contin- uous pixel space, our Bxc. B1. and Bo act on different combinatorial timing budgets. When merged into a single inner maximization, the strongest budgeted component tends to dominate, producing overly aggressive timing perturbations that harm clean accuracy much more than they improve ro- bustness. This supports our choice to keep single-norm timing AT as the main recipe in the paper, and to report multi-norm variants only as complementary evidence.
H.2 TRADES vs. MADRY-STYLE TIMING AT ON BINARY GRIDS
We also investigate replacing the Madry-style adversarial training (Madry et al., 2018) with TRADES (Zhang et al., 2019) on the binary DVS-Gesture grid. We use the TRADES objective
LTRADES = {(f((z)))) v) + + KI{fo(z) [o(adv)))
(35)
and instantiate the inner maximizer Tadv with timing-only attack, using the same three training budgets as Table 4: (1),)) B1 and B, (4000). We sweep the tra parameter E (0.01, 6.0).
Table reports clean accuracy and ASR (in %) for three evaluation budgets (Bx((1), B, (4000), Bg (2000)), comparing TRADES runs PGD-style timing AT.
24

---

Published as a conference paper at ICLR 2026
FEAT
TRADES-BLL ARlNCE (4.0000)
Allaci BJ(1)
Allack: (612000)
57
42-
9,00 srack oxccess (S)
8/0300 stack curiess mon
N.2200) smai surcess mot
Figure 4: Results of TRADES V.s. PGD AT.
Table 9: TRADES vs. PGD-style timing AT on binary W-S-Gestuee. Clean accuracy and ASR (%, lower better) for three evaluation budgets.
Training scheme
clean
B =1
=1=4000
Bp=2000
TRADES 3=0.01 Boc (1) AT
52.78
96.05
92.11
88.82
TRADES 3=0.01 B1 (8000) AT
46.18
85.71
80.45
65.41
TRADES 3=0.01 B3 (4000)
52.08
80.00
74.00
69.33
TRADES 3-0.1 B.x.1+B...0 (1) AT
53.47
74.03
71.43
64.29
TRADES 3=0.1 (00.1+B1(S000 (80000)) AT
35.76
78.64
61.17
50.49
TRADES 3=0.1 B1 (4000) AT
50.69
80.82
81.51
63.01
TRADES 3=6.0 Boc (1) AT
22.22
56.25
17.19
7.81
TRADES 3=6.0 + (8000)
14.93
46,51
25.58
23.26
TRADES 3=6.0 + Bi (4000) AT
12.15
42.86
57.14
28.57
Our timing AT + (1)
22.92
57.59
45.46
27.26
Our timing AT + B (8000)
48.26
92.08
80.58
64.75
Our timing AT + Bi (1000)
22.57
73.86
58.44
46.17
To visualize the clean-robust trade-off's, Figure 4 in the supplementary plots clean accuracy against ASR for each evaluation budget, with TRADES configurations forming curves for fixed inner bud- gets and varying B, and the corresponding PGD timing-AT points marked as triangles. For several operating points, TRADES achieves lower ASR than PGD similar clean accuracy (points above- and-to-the-left of the PGD baselines), confirming that the TRADES regularization can slightly sharpen the timing-basse based robustness vs. accuracy trade-off. However, large 3 values also illus- trate the usual TRADES behavior: further reductions in ASR come at the cost of substantial clean- accuracy degradation.
Overall, these experiments show that (i) multi- timing AT, when naively aggregating B B1, and By in the style of Maini et al. (2020), offers no clear advantage over carefully tuned single- norm timing AT in our discrete retiming setting, and (ii) TRADES provides modest improvements over Madry-style timing on binary grids, but does not fundamentally change the conclusion that strong timing-only adversaries remain hard to defend against without incurring noticeable drops in clean performance.
I MULTI-MODEL AND MULTI-NORM MULTI-MODEL TIMING ATTACKS
For completeness, we also evaluate multi-model and multi-norm multi-mode timing attacks on event-driven SNNs, following ensemble idea timing attacks over multiple victim models simi- lar in spirit to ensemble attacks for SNNs (Xu et al. 2025). In all experiments below, the perturbation still a capacity-1 spike-retiming with strict rate preservation enforced by P
I.1 MULTI-MODEL. TIMING ATTACKS ON N-MNIST
Methodology. On N-MNIST, we construct an ensemble the six models used in our transfer experiments: three SNNs (ConvNet (SNN), ResNet18 (SNN), VGGSNN (SNN) and three CNN
25

---

Published as a conference paper at ICLR 2026
Table 10:
Multi-model timing attacks on binary N-MNIST (ASR, %).
Model
Clean B :1 Boc : Boe :3 B1:500
::: 750
B : 1000
:2:
Bo :00
:4:
ConvNet (SNN)
99.06 100.0
100.0
100.0
50.9
97.6
100.0
35.0
93.4
100.0
ConvNet (CNN)
99.34
100.0
100.0
100.0
92.6
99.8
100.0
42.8
97.6
99.9
ResNet18 (SNN)
99.62
97.7
100.0
100.0
28.2
70.6
96.2
29.7
89.3
99.9
ResNet18 (CNN)
99.70
100.0
100.0
100.0
96.5
99.2
99.9
34.7
90.8
98.3
VGGSNN (SNN)
99.64
100.0
100.0
100.0
32.3
99.5
25.6
100.0
VGG (CNN)
99.72
100.0
100.0
100.0
97.1
99.6
99.7
31.8
90.0
98.6
Table 11: Multi-model timing attacks on integer N-MNIST (ASR, %).
Model
Clean 8xc :1 B3 :2 Bxc :3 B :50
B1 750 B1 1000
Bo 200 :0:300 Bo Bo:100 100
Bo: :00
ConvNet (SNN) 99.19 100.0
100.0
100.0
46.6
96.4
100.0
40.2
99.2
100.0
100.0
ConvNet (CNN)
99.38 100.0
100.0
100.0
98.2
100.0
100.0
59.8
100.0
100.0
100.0
ResNet18 (SNN)
99.62
91.5
100.0
100.0
31.6
75.8
98.0
27.3
94.5
100.0
99.8
ResNet18 (CNN) 99.73
98.9
100.0
100.0
73.1
66.7
54.7
81.9
95.6
100.0
100.0
VGGSNN (SNN)
99.71
99.8
100.0
100.0
42.1
89.3
99.8
29.9
97.6
100.0
100,0
VGG (CNN) 99.79
100.0
100.0
100.0
85.0
90.7
90.0
98.4
97.0
100.0
100.0
counterparts (ConvNet (CNN), ResNet18 (CNN), VGG (CNN)), For given timing budget B, and norm p E foo, 1, 0}, we optimize
Lmm (x.
Σ ((( (P* (m)), (()))))),)) M
1
M = 6,
(36)
where fmm)) are the six models and Pa is our strict rate- anteppreeeriing projection. Budgets N-MNIST are Bo E (1,2,3) (per-spike jitter), Bi E (500, 750, 1000} (total delay), Bo E {200, 300, 400} (binary) plus (600) (integer). We report clean accuracy ("Clean"" and attack success rate (ASR, %) on deereccorrett examples.
Compared with the single-model attacks in Tables 1-2 of the main paper, these ensemble attacks remain very strong: under moderate B₁ or Bo budgets, ASR on SNNs routinely exceeds 70-90%, confirming that our timing-only adversary transfers across architectures even when optimized jointly over six models. CNN counterparts are also vulnerable, but the relative gap between SNNs and CNNs consistent with our main message: timing perturbations exploit SNN temporal dynamics more effectively than frame-based CNNs.
1.2 MULTI-NORM MULTI-MODEL TIMING ATTACKS
Definition of multi-norm timing budgets. In our setting, multi-norm timing attack means that every adversarial example simultancously satisfies: (i) a local jitter radius Bx (per-spike timing change), (ii) a total delay budget B₁ (sum of absolute delays), and (iii) a tamper-count budget Bo (number of moved spikes). We keep the same -tyle loss shift logits but in the strict projection we enforce all three budgets:
x' ='= B2. B1, Bo).
(37)
so that the final retimed events lie the intersection B n B1 n Bo under capacity-1 and rate- preserving constraints.
Multi-norm, multi-model ensemble. On N-MNIST, we instantiate a multi-norm, multi-model attack over the same --6-model ensemble (three SNNs three CNNs):
Ejoinl (x, v)
1 M
Σ
(( (P* n (m)) ( Bro B1, Bo))
(38)
We choose balanced triple of budgets Bx = B (3). B B (750), B, = Bn00)), so that maximal jitter, total latency, and tamper count remain comparable to the single-norm experiments.
26

---

Published as a conference paper at ICLR 2026
Table 12: ASR (%) of multi-norm multi-model timing attacks on N-MNIST.
Model
Binary: MultiNorm
Integer: MultiNorm
B (3), Bi (750), Ba
Bzx Bi (750), Bo Bo(300)
ConvNet (SNN)
93.6
96.0
ConvNet (CNN)
94.0
99.8
ResNet18 (SNN)
93.0
92.1
ResNer18 (CNN)
71.6
44.3
VGGSNN (SNN)
91.9
94.6
VGG (CNN)
75.6
71.5
Results. Table reports ASR for this joint attack. The joint multi-norm, multi-model attack is extremely strong: ASR on all three SNNs exceeds 90% in both binary and integer grids, even though each adversarial example respects all three timing budgets simultaneously. CNN counterparts are also highly vulnerable (e.g., ConvNet (CNN) above 94% ASR), but the relative SNN-CNN gap is consistent with our single-norm and multi-model results. Compared to the single-norm ensemble attacks in Tables [I the multi- version mainly serves as more pessimistic "all-budgets- on" stress test: it does not reveal qualitatively new behavior, while the single-norm budgets Bos. B1, and Bo remain more interpretable for realistic threat models (e.g., "small jitter only" or "limited latency only").
ON Lo BUDGETS, REDUNDANT MOVES, AND RELATION TO PIXEL-WISE SPARSITY
Our threat model is timing-only and rate-preserving, so all three budgets are defined at the spike/packet level rather than per-pixel dynamic images.
What the budgets measure. After flattening [B, C, H, W] into event lines j E {1....,NY N). each non-zero entry x[s; time index (I,..., T} denotes an event packet (one spike for binary grids, or an integer-valued packet for integer grids). For a retimed example with shifts A.,j = / 8, the three budgets are
Bo0: : max
D
(39)
(s.))
Br : Σ
Dapli
(40)
(a.):A.,
Bo #((,5) : x[s,]] > 0, A... #
(41)
Thus Bo counts how many individual spikes are retimed ("tamper count"), while Ba and B₁ bound how far time these spikes are moved. This is a sensor-level notion of sparsity tailored to timing perturbations SNNs.
Why symmetric "swaps" are ruled out by projection. A toy example is swapping two active indices at the same spatial position, e.g., (1, 1, and (2, 1, 1) in TCHW, which could leave some fraee- summary unchanged while incurring Bg = 2. Two points are important here:
From the SNN's perspective, changing spike times is not neutral: membrane integration and firing decisions depend on the exact timing, so "swapping" spikes across time steps is in general genuine perturbation.
More importantly, our strict projection (x, n. B,) is explicitly designed so that such symmetric swaps are not selected. For each flattened line j and time t, we maintain reserved[j, t) (initially 1 wherever x|t.j] > 0) and occupiedlj. t (targets already taken by moved packets). When processing a candidate move (s - t,j), we skip moved j, s] is true, occupied[j, t] is true, reservedjj, is still true. A packet can only move into originally empty bins, or into bins whose original packet has already moved out and re- leased its reservation. As result, two spikes at the same spatial position cannot simply change times: moving into bin that still hosts its original spike is blocked by reservedlj, t] and capacity-1.
27

---

Published as a conference paper at ICLR 2026
Therefore, the Bo budget is not spent symmetric swaps that leave the timeline effectively changed; it spent on injective retimings into genuinely free time slots.
Optimization does not "waste" Bp. Beyond the projection logic, the optimization itself discour- ages budget waste. Shift probabilities [[, J. t] are updated to maximize the task loss evaluated on (x, π, Bp); candidate moves that do meaningfully increase the loss receive vanishing gradi- ents and their probabilities shrink relative to more damaging moves. The capacity regularizer and budget-aware penalties further push toward configurations that respect capacity-1 and budgets already in expectation. In practice, we often observe that the realized number of moved packets is below the nominal upper bound Bg, and ablations removing these regularizers yield weaker attacks and less stable budget usage.
Relation to pixel-wise to in prior DVS attacks. Prior sparse DVS attacks typically define &o the pixel/voxel level dynamic images. Our packet-level Bg be related to this pixel-wise sparsity as follows: each moved packet at (s,j) with value u >> 0 changes at most two grid voxels (t.j)-one at the source time (set from 0) and one the target time (set from 0 to v). Hence the number of changed grid voxels satisfies
|x - < 2Bp-
(42)
In the supplementary experiments, we therefore also report the number of changed (t. æ, y) positions in our adversarial examples and compare this pixel-wise lo to that of prior sparse DVS attacks under matching datasets and models.
28

---

Published as a conference paper at ICLR 2026
Table 13: Binary N-MNIST: ASR (%) under tamper-count budgets Bg-
Method
Model
Bo=200
Bo=300
Bo=400
ConvNet 13.0
53.1
98.5
Ours (timing)
ResNet18
78.9
100,0
100.0
VGGSNN
18.3
81.8
99.8
ConvNet
50.4
92.2
98.9
SpikeFool Bücchll et al. (0022
ResNet18
12.5
37.1
69.7
VGGSNN
16.2
38.7
69.5
ConvNet
64.7
93.4
97.4
PDSG-SDA Lun 2025
ResNet18
62.1
92.2
98.8
VGGSNN
13.9
38.7
72.4
Table 14: Binary DVS-Gesture: ASR (%) under tamper-count budgets Bu-
Method
Model
Bo=1000
Bo=2000
Bo=4000
ResNet18
27.7
67.9
98.5
Ours (timing)
VGGSNN
55.8
87.2
98.9
ResNet18
17.8
34.3
72.9
SpikeFool Büchel ct al.
2022
VGGSNN
14.9
18.9
25.5
ResNet18 VGGSNN
60.2
82.4
91.2
PDSG-SDA Lun et al.
2025
52.9
67.1
85.0
K COMPARISON WITH RAW-EVENT BASELINES
This section compares timing-only, rate- preeerresgging attack with two strong raw-event baselines: SpikeFool |üchel et al. (2022) and PDSG-SDA Lun et al. (2025). All methods are evaluated on the same clean models and datasets as in Tables 1-2 the main paper (N-MNIST, DVS-Gesture, CIFAR10-DVS), We always report attack success rate (ASR, %) on clean-correct examples.
Unified tamper-count budget. For a fair comparison, we express sparsity using a common lamper-count budget Bo:
For our timing-only attack, Bo is the number of event packets (s,j) whose time index changes (tamper count).
For SpikeFool and PDSG-SDA, Bg the number of event bins (f,j) whose value changes (a spike is added, removed, or its integer value is modified).
SpikeFool and PDSG-SDA operate on binary event grids by design. On integer grids, we adapt PDSG-SDA by allowing inserted spikes take the mean event value of the dataset, which preserves the method's 's behavior.
K.1 BINARY N-MNIST: OURS vs. SPIKEFOOL AND PDSG-SDA
Table 13 reports ASR Bo (200, 300, 400} for the three models in Table
On ResNer18 our timing-only attack very strong (ASR 78.9% at Bo-200 and 100% at Bo 2 300), closely matching or exceeding PDSG-SDA. On ConvNet and VGGSNN, SpikeFool and PDSG- SDA are stronger at moderate Bo, which is expected because they can freely add and delete spikes without preserving rate or per-spike jitter. Importantly, our attack achieves these ASR values while remaining rate-preserving, constrained by B and B1, and enforcing capacity 1.
K.2 BINARY DVS-GESTURE: OURS vs. SPIKEFOOL AND PDSG-SDA
We next compare ResNet18 and VGGSNN on DVS-Gesture for Bo E {1000, 2000, 4000]; see
Table 14
29

---

Published as a conference paper at ICLR 2026
Table 15: Binary CIFARIO-DVS (ResNer18): ASR (%) under tamper-count budgets Bo-
Method
Bo=1000
Bo=2000
Bo=4000
Ours (timing)
26.0
42.0
80.0
SpikeFool Büchel et al (2022
55.0
83.0
93.0
PDSG-SDA Lun et al.
2025
62.0
91.0
100.0
Accuracy vs. 96 for binry event grids
DVS
GRAR19-DVS
320
150
250
300
1202
10:00
2000
2500
3200
4002
1000
2002
20:00
2000
2000
(tarppe Madged
Haampe budgett
(Mampe bedget)
DATA, CanviRt
50A,
Spiafeed VICGANN
Figure 5: Accuracy V.s. budget curve on binary grid.
On VGGSNN our timing-only attack is the strongest across all By budgets, despite its stricter con- straints. On ResNet18, PDSG-SDA is stronger small and medium Bo, but attack still reaches high ASR (67-9% at Bo=2000 and 98.5% at 4000,,,), clearly outperforming SpikeFool. Again, PDSG-SDA enjoys larger perturbation space (free insertions/deletions and value changes), while we only retime existing spikes under B B1, By and capacity 1.
K.3 BINARY CIFARIO-DVS: OURS VS. BASELINES
For CIFARIO-DVS, we show ResNet18; VGGSNN exhibits similar trends and included in the extended tables.
On CIFARIO-DVS the raw-event baselines have clear advantage at small budgets, as they can exploit many more degrees of freedom by adding and removing spikes. Even so, our timing-only attack attains 80% ASR at 4004 showing that constrained timing perturbations alone can be very harmful.
K.4 INTEGER GRIDS
On integer N-MNIST and CIFAR1O-DVS, we compare our timing-only attack to the adapted PDSG-SDA. For example, on integer N-MNIST ResNet18: PDSG-SDA achieves ASR 48.3%, 86.1% 86.1%,0 97.3%, 99.9% at Bo E (200, 300, 400, 600), while our timing-only attack reaches 86.1%, 99.8%, 100%, 100% the same budgets. Thus, integer grids method is often stronger than PDSG-SDA even though we maintain rate preservation and timing constraints. Full integer ta- bles for all models are included in the extended supplement.
K.S ACCURACY- DEAiYVV..BBBBABB. CURVES
Following the eccuracy-vs.-conttie suggestion, we also provide accuracy-vs.-B, curves for all datasets and models, as shown in Figure and Figure
For each grid type (binary / integer), plot three subplots (N-MNIST, DVS- DeS-Gesture, CI DVS), with tamper-count budget Bo on the z-axis (including Bo=0) and accuracy under attack on the y-axis. The point at Bo=0 corresponds constraint axis. Our timing-oni only attack, SpikeFool, and PDSG-SDA appear as separate curves, and different architectures (ConvNet, ResNet18, VGGSNN) are distinguished by line style.
clean accuracy; growing Bo moves along the
On binary grids, our curves often lie on par with or below those of SpikeFool and PDSG-SDA on MNIST and DeStGes, indicating equal higher destructive power under the same Bg, despite
30

---

Published as a conference paper at ICLR 2026
Binary
Biury DVS-Geature
Biury- GPARLD-DYS
60-
1597
2002
Ryttamperbudgg
Canviet
Sphatool VOCOAN 1050-DA vG22 MM
Solaftell Conareed
Spliaf od Paal
26t VOCSWN
Figure Accuracy V.s. budget curve on integer grid.
stricter constraints. On CIFARIO-DVS, value-modifying baselines become slightly stronger large Bg, but the gap remains moderate. On integer grids, our accuracy generally drops as fast as, or faster than, PDSG-SDA, showing that a rate-preserving timing attack can be as destructive value-modifying baseline.
Overall, these comparisons provide the requested anchor: our timing-only attack competitive with, and often stronger than, leading raw-event attacks across most datasets and budgets, while operating under much stricter and physically motivated constraint set (rate preservation, per-spike jitter, total delay, and capacity 1).
L EFFECT OF SIMPLE EVENT FILTERING DEFENSES
Real event-camera pipelines often include low-level filtering to suppress jitter and noisy events. To test whether such simple propprsess can remove our timing-only, rute-preserving pertur- bations, we evaluate three concrete, label-free defenses on the binary DVS-Gesture VGGSNN configuration (one of our strongest attack settings), and compare against the non-timing baseline PDSG-SDA Lun et al. (2025).
Defenses.
All defenses operate directly on the event stream, without labels or model gradients:
Refractory filtering (re frefttctry...o firry.frrss) For each pixel, we look back over a tempo- ral window of length rp-bins; if an event has occurred in that window, new event the same pixel is dropped with probability p. This mimics a sensor-level refractory mechanism that suppresses very high gighffreyency bursts.
Temporal mean smoothing (temporal wwt.:emmmammmmmomaeeaeeeemm We convolve each sequence along the time axis with a length-3 box filter (radius 1). With probability (per sample), we replace the input by this temporally smoothed version; otherwise we keep the original. This targets short-lived temporal fluctuations and jitter.
Spatial mean smoothing (spat mal.maannnnnaaamammmmmmmaaaaaaan mea.. _mmooth)). We apply a 3x3 spatial mean filter (stride 1) each frame and, with probability p per sample, replace the input by the spatially smoothed version. This targets isolated "salt-and-pepper" spikes and enforces local spatial consistency.
To expose the clean-ro robustesss trade-off, treat p E [0, 1] defense strength knob: p=0 cor- responds to no defense, small to mogot-to- denoising, and large to very strong filtering that heavily distorts the input.
Evaluation setup. On binary DVS-Gesture VGGSNN, we report: (i) clean accuracy (clean), and (ii) attack success rate (ASR, %) under our timing attack with budgets B (1), B, (8000), Bo (4000) and the non-timing PDSG-SDA Lun et al. (2025) with Bo Bo4400)) ASR is always com- puted on clean-correct examples.
Discussion. Three trends emerge from Table 16
31

---

Published as a conference paper at ICLR 2026
Table 16: Effect of simple event filtering defenses binary DVS-Giesture / VGGSNN. We report
clean accuracy (%) and ASR (%) ) for our timing-only attack and PDSG-SDA Lun et al. 2025 under Bo (4000), as a function of defense probability p.
Defense
clean Ours B (1) Ours B, (8000) Ours Bo(4000)
BDSG-SDA Ba(4000)
0.0 95.14 14
96.7
98.5
98.5
100.0
0.1 71.53
92.7
96.6
97.0
65.5
0.2 48.96
84.4
85,8
87.2
60.2
refractory-first
0.4 27.08
70.5
70.5
71.7
57.6
0.6 15.28
47.7
47.7
47.7
43.1
0,8 14,93
46.5
46.5
46.5
41.8
1.0 16.04
40.6
44.0
48.0
33.3
0.0 95.14
96.7
98.5
98.5
100.0
0.1 84.03
95.8
95.0
97.1
35.5
0.2 72.57
95.6
92.3
33.4
temporal Lemporal.mean.moos mean..moot.
0.4 56.60
92.6
79.1
84.6
34.3
0.6 49.65
86.0
67.8
79.0
34,2
0.8 52.43
81.4
55.6
78.8
33.7
1.0 56.25
61.7
38.2
68.5
30.2
0.0 95,14
96.7
98.5
98.5
100.0
0.1 71.53
95.6
93.6
96.1
38.3
0,2 54.86
92.4
82.9
42.4
spatial peatial_mean_smon mmean_smott
0.4 32.64
59.5
38.3
59.5
39.3
0,6 23.61
4.4
1.4
13.2
17.6
0.8 21.18
4.9
3.2
14.7
14.7
1.0 22.92
5.6
4.5
3.0
2.4
Moderate filtering barely dents our timing attack but already hurts clean accuracy. p=0.2, clean accuracy drops from 95. 144 to
For example, with refractory-fizee 48.90 48.96% (a ~ 46 point loss), yet our ASR at (40000) remains high at 87 87.2%. Similar patterns hold for temporal and spatial smoothing p=0.1-0.2.
Very strong filtering can suppress the attack only at the cost of destroying the task. Spatial smoothing with p=1.0 reduces our ASR at B40000) to 3.0%, but clean accuracy also collapses to 22.92%. Strong refractory or temporal smoothing show the same trade- off.
Our timing-onle attack at least as robust filtering as strong non-timing base- line. The value- modiffinn PDSG-SDA is more easily attenuated by these filters: under temporal smoothing with p E [0.1, 0.4), its ASR drops from 100% to roughly 30-35%, whereas our ASR at (4000) remains in the 80-97% range. Under spatial smoothing with p=0.4, our ASR at (4000)) 59.5% versus 39.3% for PDSG-SDA.
Overall, these results support our main claim: simple intensity- or malue-based event filtering is not sufficient to neutralize capacity-l, rate-preserving spike retiming attacks without incurring severe clean accuracy loss. This highlights spike retiming as practically important and difficult-to-defend attack surface that calls for temporally aware defenses beyond naive denoising.
M EXTENDED RESULTS ON TARGETED TIMING ATTACKS
In this section, we expand on the targeted experiments and address two issues: (i) the fixed target label in the main text, and (ii) the lack of comparison to strong non-tin non-timing baseline.
Random-target protocol. To avoid bias from fixed target (class "0"), we adopt standard random-tant target protocol: for each clean-correct sample with ground truth label y. we draw a tar- get label ÿ # y uniformly at random and optimize the attack force the prediction to ÿ. We repeat this procedure for 5 random seeds and report mean + standard deviation of the targeted attack suc- cess rate (ASR), where success means the final prediction equals the chosen target y. As in all other
32

---

Published as a conference paper at ICLR 2026
experiments, ASR is measured only samples that are correctly classified in the clean setting, so the metric is directly comparable to our untargeted results.
Comparison with non-timing baseline. To separate limitations of our method from the intrinsic difficulty of targeted attacks, we compare against the state-of-the-art non- non-timing raw-event attack PDSG-SDA Lun et al. (2025) on the integer DVS-Gesture VGGSNN configuration, which one of the hardest settings in our paper. We evaluate both methods under increasing tamper-count budgets Bo E (4000, 8000, ]2000} and average over 5 random seeds.
Table 17: Targeted ASR (%, mean + std over 5 seeds) on integer DVS-Gesture VGGSNN under increasing tamper-count budgets Bo.
Attack
B40000)
(8000)
(1(000))
Ours (timing-only) PDSG-SDA Lun et al. (025
15.7
1.3
26.8 1 1.4
30.8 1 1.3
24.4 + 1.3
28.7 + 1.3
31.4 1.3
We further observe that when the Bg constraint is removed for PDSG-SDA, its targeted ASR satu- rates around ~ 34%, even though it is allowed to freely add and delete spikes without any rate or jitter constraints. In the supplementary (Fig. 7), we plot the mean targeted ASR as a function of Bo for both methods, showing that targeted ASR monotonically increases with budget and that our more constrained timing-only attack approaches the performance of PDSG-SDA higher budgets.
Why targeted timing-only attacks are challenging. The targeted ASR in Table 17 is notably lower than our untargeted ASR, especially on integer grids. This reflects an intrinsic challenge of the threat model rather than a flaw in the optimization: our attack capacity-1, and timing-only, so it cannot create or delete spikes and must keep at most one packet per (t. bin. Under these constraints, steering the model toward a specific target class is substantially harder than simply causing misclassification. Integer event grids add further difficulty because many bins already store multi-spike packets, and retiming must respect both the global budget Bo and the capacity constraint.
preserveege.
The comparison with PDS et al. (2025) supports this view: even a much less constrained, value-modifying attack struggles to exceed s 34% targeted ASR this setting (without tamper bound). Our timing-only attack achieves comparable performance at high budgets while respecting strict timing and rate constraints, indicating that the gap between untargeted and targeted spike- retiming attacks is a fundamental phenomenon. We highlight closing this gap target-aware objectives curriculum schedules on timing budgets-as as an interesting direction for future work.
gap-for for example via
N DISCUSSION: ADVANTAGES OF TIMING-ONLY, PRESERREGG ATTACKS
Threat model and what the extra constraint enforces. Our timing attack operates at the level of event packets on each event line. After flattening (B, C, H. W) into a line index j. each non- zero entry æ[s,]) denotes a packet at time index s (one spike on binary grids, or an integer-valued packet integer grids). Under
attack, every packet an integer offset u, landing at f = 8 + u within a bounded jitter window, while the strict projection Pt Pa n, 15,) enforces: (i) capacity-/: most one packet per (t, (ii) rate preservation: for each line j, the multiset {a
only be retimed along its own line by
is identical to (=|t, and (iii) an Eu "tamper-coum budget Bo on the number of packets that actually move (non-zero displacement). In other words, every packet that is "removed" from some (s,j) must be added back some (1,j) the same line within the budgeted jitter window: we only reorder events in time, never create or delete them.
Beyond generic raw-event to attacks. Even if a generic raw-event attack forced to preserve the global (or per-line) event count, our formulation imposes a strictly stronger and more structured constraint: (i) packets never move across pixels or polarities, (ii) capacity-1 prohibits stacking mul- tiple packets into the same (1, bin, and (iii) Bac and B, bound the local jitter and total delay. This
33

---

Published as a conference paper at ICLR 2026
leads to three advantages compared to value-based raw-event attacks such SpikeFool Büchel et al. 2022 and PDSG-SDA Lun et al. (2025) under a matched By:
Closer to physical jitter//ateney. Real DVS sensors primarily exhibit timestamp jitter and latency rather than large, structured changes in event amplitudes polarities. Our attack keeps every packet on its original pixel and polarity, preserves per-line counts exactly, and constrains temporal motion via Bo and Bi, making the perturbations resemble realistic timing noise rather than synthetic intensity artifacts.
Stealth against simple monitors and preprocessing. Because the multiset of packets each line is preserved, any monitoring that relies on per-pixel event counts, line-wise firing rates, or simple intensity statistics sees no anomaly: only the timing changes. In Ap- pendix L explicitly tested three simple, label-free pre-processors (refractory filtering, temporal mean smoothing, spatial mean smoothing) on binary DVS- and observed that moderate filtering already causes 20-40 point drops in clean accuracy, while our timing-only attack still attains > 90% ASR under Bg (4000). Under the same filters, the value-based baseline PDSG-SDA noticeably more suppressed, indicating that our additional temporal constraint makes the perturbations harder to wash out without de- stroying task performance.
VGGSNN
Directly aligned with SNN computation. SNNs encode much of their information in spike timing rather than aggregate counts. Retiming spikes while preserving counts manip- ulates the temporal decision boundary way that leaves fewer footprints in simple rate statistics. Empirically, our main results and the raw-event baseline study in Appendix K show that, under matched tamper-count budgets B,, our timing-only, rate-preserving attack achieves attack success rates comparable to higher than SpikeFool Büchel et al. (2022)
and PDSG-SDA et al. (025). despite operating in a much smaller feasible perturbation set (capacity-1 1 rate preservation jitter bounds).
Taken together, these points clarify the advantage of the "remove- saaoove-then-dddbackk- constraint: it does not merely make the attack optimization harder; it defines threat model that is (i) closer to how real event cameras behave, (ii) more stealthy with respect to standard count- or value-based checks, and (iii) still highly effective in practice, as evidenced by our comparisons to strong raw-event baselines and our robustness to- filtering experiments.
34


Reviews:
[{"review_id": "NyZfxq5ech", "reviewer": "Reviewer_92xg", "summary": "This paper proposes timing-only attacks on SNN inputs: instead of adding o removing spikes, it retimes existing ones. Feasibility is defined on the active spikes with two rules 1- stay within the timeline or timespan and avoid collisions (called capacity-1). For binary grids {0,1} you can only move spikes, and for integer grids {0,1,…} they enforce capacity-1 by packetizing counts so totals are preserved. They study three disjoint budgets: $\\mathcal{B} _\\infty$ (local jitter: each spike moves at most these $\\mathcal{B} _\\infty$ steps), $\\mathcal{B} _1$ (total timing shift: sum at most is $\\mathcal{B} _\\infty$), and $\\mathcal{B} _0$ (tamper count: move $\\mathcal{B} _\\infty$ spikes at most). The attack is found by optimizing per-spike shift logits to maximize task loss, then sorting candidates by their probabilities and greedily projecting them to a strictly feasible retiming under the chosen budget.", "questions": "I’m very excited by the introduction of the paper, but the experiments left me with some unanswered questions., most importantly: is the timing constraint really needed? So my first question, tied to the first weakness, is:\n\n- Q1: By skipping a spike-rate study, do you mean rate preservation is guaranteed by construction (via feasibility/placement) and needs no measurement?\n\nAlso, the mind-the-box attacks, which similarly incorporate feasibility into the attack problem, showed clearer clean–robust trade-offs, and another work [2] on spiking attacks (similar to retiming attack with $\\mathcal{B}_0$ but on value instated of timing) reported AT trade-offs as well. In this work, one would expect the trade-off to be at least enhanced.\n\n- Q2: Could you report full AT details and comment on clean–robust trade-off curves compared to non-timing AT?\n\nLastly (not critical, but nice to touch on) the question of optimality:\n\n- Q3: The greedy projection is practical, but what is its suboptimality versus an optimal assignment? Any bound or empirical optimality gap?\n\n[1]Croce, F., & Hein, M. (2021, July). Mind the box: $ l_1 $-APGD for sparse adversarial attacks on image classifiers. In International Conference on Machine Learning (pp. 2201-2211). PMLR.\n\n[2]Mukhoty, B., AlQuabeh, H., & Gu, B. (2025, January). Improving Generalization and Robustness in SNNs Through Signed Rate Encoding and Sparse Encoding Attacks. In The Thirteenth International Conference on Learning Representations.", "limitations": "", "rating": 6, "confidence": 4, "soundness": 3, "presentation": 3, "contribution": 3, "strengths": "- Original, well-motivated retiming-only attack; strong proposal (even if the experiments feel less persuasive).\n- Neat, precise formulation with clear feasibility and the writing is clean and readable.\n- Complete and intuitive presentation of the three timing budgets.", "weaknesses": "- The paper’s core motivation is rate-preserving, timing-only perturbations that evade naive rate detectors, but the experiments don’t directly quantify this. There’s no head-to-head against non-timing-space attacks showing for instance the rate drift,. As a result, the motivation of the paper as rate-preserving although defined in the feasible assignment (equation in (5)) may be lost in the approximation of assignment, or at worse case may not be needed if non-timing attack preserve it to some degree. \n\n- The AT isn’t compared to standard AT (e.g., $\\ell_\\infty $ PGD or binary $\\ell_0$ flips), where one should expect retiming only the spike may result in a better tradeoff.\n(note: It’s also unspecified what dataset is used in this experiment, and in line 408 I believe table 4 is the one the author means not 3).\n\n- The solutions for the attack-finding problem (equation 6) although is neat and elegant is not proved to be optimal. Further, small disussion on how complexity is measured or can be compared to non-timing attack is important to touch on.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "WHDLWQIXba", "reviewer": "Reviewer_s4Pb", "summary": "Three new threat models are proposed for event driven SNNs, per-spike jitter, total shift and tamper count. The new attack frameworks are validated on CIFAR10-DVS, DVS-Gesture and N-MNIST. Two interesting findings from this work are that adversarial training can be used to partially mitigate threats and integer grids are more robust.", "questions": "Please address the issues I mentioned in the weaknesses section of my review. For each weakness, mention how you will improve the paper or how you will include citation/discussion of existing literature works to justify your existing work. \n\nOverall I do not have very much negative feedback for the authors.", "limitations": "", "rating": 6, "confidence": 3, "soundness": 3, "presentation": 3, "contribution": 3, "strengths": "The paper (with the exception of the abstract) is well written and easy to follow. The experiments are done on a wide array of datasets and the findings are of interest.", "weaknesses": "I can only see one major weakness of the paper from a scope perspective: There are a few areas where the paper should cite existing literature either to explain why they did not do more, or explain how this could be incorporated in future work:\n\n1. For the adversarial training, since you have attacks with respect to different norms, why not combine the training against different norms together like what was done in: https://proceedings.mlr.press/v119/maini20a/maini20a.pdf\n\nAt the very least, why not use a newer training formulation like TRADES instead of the much older outdated Madry’s training formulation?\nTRADES: https://arxiv.org/abs/1901.08573\n\n2. For Transferability studies mentioned at the end and for multi-model attacks, you should cite existing transferability work in this domain and explain how your studies relate:\nTransferability A:  https://arxiv.org/abs/1611.02770\nTransferability B: https://arxiv.org/abs/2104.02610\n\nIn your transferability experiments, did you follow the same methodology as A and B, or are there deviations due to the nature of event based SNNs?\n\n3. In terms of attacks: Could you either try multi-model attacks on your event-based SNNs in a manner similar to proposed in: https://www.sciencedirect.com/science/article/pii/S0925231225021782\nIf not can you adequately explain in the paper why a multi-norm multi-model attack is either appropriate future work or not a realistic possibility? \n\nMinor Weakness: The abstract is a bit verbose and doesn’t very clearly convey the findings of the paper. The abstract writing could be significantly improved.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "Zimr4RBclt", "reviewer": "Reviewer_o8PK", "summary": "This paper proposed the Spike Timing Attack for event-based SNNs. The attack only changes the timestamp of events and keeps their intensities or counts unchanged. The projected-in-the-loop (PIL) optimization is utilized to resolve the non-differentiable problem. Experimental results demonstrated the performance of the attack in various budgets.", "questions": "1.In Line 201, what are event line and time bin? Do they both indicate timestep?\n\n2.Why Table 3 is below Table 4? In Line 408, does ‘Tab.3’ represent ‘Tab.4’?\n\n3.Which model and dataset are used in Table 4?", "limitations": "", "rating": 4, "confidence": 4, "soundness": 2, "presentation": 2, "contribution": 2, "strengths": "1.The scenario of the attack is novel and realistic. Keeping the intensity and event count unchanged, the attack can evade detection.\n\n2.The relaxation resolves the non-differential problem and optimizes the perturbation budgets.\n\n3.The discussion about robustness comparison between binary-grid and integer-grid is interesting.", "weaknesses": "1.Section 4.2 is really confusing. As a core part of the method, the meaning of every variable and equation must be clearly demonstrated. For instance, in Eq.8, does ‘shift logits’ represent the possibility of each $(s,j)$ changing to other time bins? In Eq.9, does $S(x)[t,j]$ represent the weighted possible value in $[t,j]$ after perturbation? The author should clarify what the term and equation are used for instead of only using concepts or definitions like ‘the expected soft retiming’. For section ‘feasible strict projection under budgets’, it is better to use an algorithm or a diagram instead of cluttered text.\n\n2.The budgets used in the paper are questionable. Take L0-norm as an example. If two active indices at the same spatial position ((1,0,1,1) and (2,0,1,1) in TCHW) are swapped, the frames remain unchanged, yet the B0 is 2. Will your attack method consider or optimize these redundant perturbations? Moreover, can the author compare your attack with other sparse DVS attack in L0-norm defined previously [1]? In other words, calculate the number of changed pixels in your adversarial examples to compare with previous SOTA works.\n\n3.In experimental results, the model SpikingResformer performs badly in all experiments. In [2], SpikingResformer reaches 84.8% in CIFAR10-DVS, while in Table 2 is only 70.3%. If the accuracy gap is large, why use this model? In Table 4, the accuracy is only 22% in binary grid. The effectiveness of experiments will be significantly weakened if the accuracy is too low even though the model is adversarially trained.\n\n4.The representation of the paper needs to be refined. For example, in Line 064, the sentence ‘real sensors …’ is too vague.\n\nReferences:\n\n[1] Büchel, Julian, et al. \"Adversarial attacks on spiking convolutional neural networks for event-based vision.\" Frontiers in Neuroscience 16 (2022): 1068193.\n\n[2] Shi, Xinyu, Zecheng Hao, and Zhaofei Yu. \"Spikingresformer: Bridging resnet and vision transformer in spiking neural networks.\" Proceedings of the IEEE/CVF conference on computer vision and pattern recognition. 2024.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "QF4hC0W5Ju", "reviewer": "Reviewer_thcu", "summary": "This work introduces a timing-only adversarial attack on event data in the white-box, untargeted setting. It reparameterizes the discrete optimization objective as probability distributions and, in the forward pass, uses projection and constraint proxies to fit the constraints, with a final hard projection to enforce them.", "questions": "- What is the advantage of changing the timing of the spike? Assuming we enforce a similar $\\ell_{0}$ constraint on other raw even attack methods, i.e., the perturbed image must have the exact event count as the original, then, for the spiking timing attack, it also adds additional constraint, that is, if one event is removed, then for the *same position within this time window*, we must add one additional event back. The author is encouraged to illustrate the advantage of this additional constraint by adding it back at the **exact** position.", "limitations": "", "rating": 2, "confidence": 5, "soundness": 1, "presentation": 2, "contribution": 3, "strengths": "- This work further investigates the spike-timing attack, which is novel to existing raw even SNN attacks\n - The author considered various constraints and formulated norm-agnostic constraints, reflecting the practical scenarios\n - The evaluation scenarios cover untargeted/targeted attack, robust model, black-box transfer attack with ablation on different neuron types, time bin number $T$, and constraint type $\\mathcal{B}\\_{\\infty}, \\mathcal{B}\\_{1}(8k),\\mathcal{B}\\_{0}(4k)$", "weaknesses": "I appreciate the effort the authors have put into this paper, but some crucial concerns bring it slightly below the acceptance threshold.\n1. *Lack of baseline methods.* Throughout the main paper and the appendix, there is no comparison of *any* baseline method. Without contrast, the method's performance lacks an anchor point. Moreover, the paper already cites two methods for the raw even attack. The authors are encouraged to appropriately compare the proposed method with them. \n\t> I understand the method is formulated under a new constraint; it might not be possible to enforce the baseline to obey the same constraint. However, a curve of Acc vs. constraint budget (with the baseline method shown as a horizontal line) might be straightforward for comparison, and the proposed method excels across a broader range of constraint budgets. \n2. *Lack of realistic consideration*. Lines 53-66 compose the motivation part of the spiking retiming attack. The authors state that retiming spikes is more realistic and harder to catch with intensity-based checks, since the sensors themselves exhibit jitter and latency. This is true. However, in such cases, filtering methods will be used for preprocessing to remove noisy events. *Therefore, whether these simple methods can filter out adversarial perturbations remains underexplored.* \n3. *Low performance under targeted attack*. First, in a targeted attack, the target labels are usually randomly selected, and results are averaged across different seeds. Selecting 0 as the target label produces bias in the evaluation. Second, the ASR is really low, especially under the integer grid. Also, similar to W.1, there is no comparison of baseline methods, so we don't know whether it is intrinsically problematic for a targeted attack or an issue with the proposed method. The authors are encouraged to increase the budget to provide a curve like W.1, along with comparisons of other baseline methods to illustrate the position of the proposed algorithm better.\n\nIf the above weaknesses are addressed appropriately, I am inclined to accept the paper.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}]

Author rebuttal:

Decision: Accept (Poster)