FEEL-SNN: Robust Spiking Neural Networks with Frequency Encoding and Evolutionary Leak Factor
Authors: Mengting Xu
De Ma
Huajin Tang
Qian Zheng
Gang Pan
Venue: NeurIPS 2024 poster (2024)
Keywords: spiking neural network
robustness
attack
Primary area: neuroscience_and_cognitive_science

Abstract: Currently, researchers think that the inherent robustness of spiking neural networks (SNNs) stems from their biologically plausible spiking neurons, and are dedicated to developing more bio-inspired models to defend attacks. However, most work relies solely on experimental analysis and lacks theoretical support, and the direct-encoding method and fixed membrane potential leak factor they used in spiking neurons are simplified simulations of those in the biological nervous system, which makes it difficult to ensure generalizability across all datasets and networks. Contrarily, the biological nervous system can stay reliable even in a highly complex noise environment, one of the reasons is selective visual attention and non-fixed membrane potential leaks in biological neurons.  This biological finding has inspired us to design a highly robust SNN model that closely mimics the biological nervous system. In our study, we first present a unified theoretical framework for SNN robustness constraint, which suggests that improving the encoding method and evolution of the membrane potential leak factor in spiking neurons can improve SNN robustness. Subsequently, we propose a robust SNN (FEEL-SNN) with Frequency Encoding (FE) and Evolutionary Leak factor (EL) to defend against different noises, mimicking the selective visual attention mechanism and non-fixed leak observed in biological systems.  Experimental results confirm the efficacy of both our FE, EL, and FEEL methods, either in isolation or in conjunction with established robust enhancement algorithms, for enhancing the robustness of SNNs.

FEEL-SNN: Robust Spiking Neural Networks with Frequency Encoding and Evolutionary Leak Factor
Mengting Xu De Ma 12 HuaJin Tang 1.2 Qian Zheng! Gang Pan 1,2
The State Key Lab of Brain-Maching Intelligence, Zhejiang University, Hangzhou, China 2 College of Computer Science and Technology, Zhejiang University, Hangzhou, China (xumengting, made, htang, qianzheng, gpan) @zju.edu.cn
Abstract
Currently, researchers think that the inherent robustness of spiking neural networks (SNNs) stems from their biologically plausible spiking neurons, and are dedicated developing more bio- bio-inspired models defend attacks. However, most work relies solely on experimental analysis and lacks theoretical support, and the direct- encoding method and fixed membrane potential leak factor they used in spiking neurons are simplified simulations of those in the biological nervous system, which makes difficult to ensure generalizability across all datasets and networks. Contrarily, the biological nervous system stay reliable even in highly complex noise environment, one of the reasons selective visual attention and non-fixed membrane potential leaks in biological neurons. This biological finding has inspired us to design a highly robust SNN model that closely mimics the biological nervous system. In study, first present unified theoretical framework for SNN robustness constraint, which suggests that improving the encoding method and evolution of the membrane potential leak factor in spiking neurons can improve SNN robustness. Suhsequently, we propose a robust SNN (FEEL-SNN) with Frequency Encoding (FE) and Evolutionary Leak factor (EL) defend against different noises, mimicking the selective visual attention mechanism and non-fixed leak observed in biological systems. Experimental results confirm the efficacy of both our FE, EL, and FEEL methods, either in isolation or in conjunction with established robust enhancement algorithms, for enhancing the robustness of SNNs. Our code is available at https///iihub..ommjjubbmm http:///jjjuuimllaaaaBaeee- lab/FEEL, SNN
Introduction
In recent years, brain-inspired spiking neural networks (SNNs) 21 have been increasingly prominent. Unlike traditional artificial neural networks (ANNs), which process a single image using floating-poin values, spiking neural networks encode spatial-pize pixel image into temporal spike train. Information is transmitted by the occurrence of spikes (using 0 to signify no spike and 1 to denote a spike) whenever the membrane potential of spiking neuron exceeds its threshold, thereby emulating biological neurons 33 37 14). The distinctive spatio-temporal characteristics, discrete representation, and event-driven properties of SNNs enable them to operate efficiently on neuromorphic hardware (26 4 20 46). This makes them increasingly applicable to a variety of tasks 42 48), such as spatio- temporal pattern recognition [41] and high-speed detection [15 As SNNs attract increasing attention from academia and industry, the issue of security (35) becomes more important. When SNNs are applied to safety-critical systems, their reliability should be major concern [TO]. While SNNs have demonstrated better robustness compared to ANNs [I] 32 31], recent studies have shown that they are still vulnerable noise [17 8) Among all types of perturbations, adversarial noise [35), which
Corresponding author
38th Conference on Neural Information Processing Systems (NcurIPS 2024).

---

Difeeutt lypees mwtnraa (llineeri baoks
The loak of neuron is changed by the o'leeurna in fon sonpantration
(a) Selective visual attention in human brain (b) Non-faxed membrane potential leak in biological neurons
Figure 1: Illustration of the (a) selective visual attention and (b) non-fixed membrane potential leak in biological nervous system.
refers to visually imperceptible alterations that can mislead well-trained network, is particularly concerning. Therefore, improving the robustmess of SNNs is crucial for their real-life deployment.
At present, researchers believe that the inherent robustness of SNN is brought by its more biologically plausible spiking neurons, and they are dedicated to developing more bio-inspired models to cope with noise attacks. Among them, some work focuses SNN robustness analysis. [11] investigates the SNNS robustness to adversarial attacks with different values of the neuron's 's firing voltage thresholds and time window boundaries.
[9] suggests that the utility of spike timing SNNs could improve the robustness against attacks. [39 32 3 analyze the adversarial accuracy of SNNs trained with leak factor in LIF spiking neurons. However, these analyses rely solely on experimental analysis and lack sufficient theoretical support to ensure generalizability across all datasets and networks. Other work aims to improve the robustness of SNN from biological aspects. [10] further introduces stochasticity in biological neurons as stochastic gating mechanism for spiking neurons to enhance model robustness. However, this may result in the loss of the original information. The noise environment encountered by the biological nervous system is highly complex, with various types of noise spanning different frequency ranges [3] Adversarial noises also exhibit different frequencies across datasets, rather than being fixed 23 1. Despite this complexity, the biological nervous system maintains robustness. This inspired us to design a highly robust SNN model that more closely mimics the biological nervous system, allowing it to adapt to and overcome the challenges posed by diverse and dynamic noise environments.
For the biological brain, as shown in Fig. (I)) there exists the selective visual attention mechanism that selectively focuses on stimuli of different frequencies over time and can filter out unwanted information 7 45]. This aids the biological nervous system in avoiding the instability caused by noise 44
Additionally, as shown in Fig. (T)), the changes in membrane potential in biological
neurons are determined by ion concentration inside and outside the cell membrane. Different environ- ments and types of nerve axon fibers can affect the degree of leak of the membrane potential 38 [3] which contributes to the biological nervous system's 's processing of complex noise B33 Motivated by these biological insights, we undertake a theoretical examination of the robustness of SNNs. We present unified framework for SNN robustness constraint, which indicates that refining the encoding technique and evolution of the membrane potential leak factor can enhance SNN robustness. Subsequently, propose robust SNN with Frequency Encoding and Evolutionary Leak factor (FEEL-SNN) to defend against different noises. Our main contributions are summarized as follows:
Through analysis of the model's adversarial loss, we theoretically present a unified frame- work for SNN robustness. Our findings suggest that enhancing the encoding method and evolution of the membrane potential leak factor can improve SNN robustness.
We propose a frequency encoding (FE) method for SNNs. FE captures information of vary- ing frequencies at different time steps, mimicking the selective visual attention mechanism observed in biological systems. FE can preserve the original information while suppressing different frequency range noises, effectively filtering out image noise.
Based on FE, we propose an evolutionary membrane potential leak factor (EL). EL ensures that different neurons in the network learn the optimal robustness leak factor at different time steps, which is aimed at learning the correlation between frequencies at different time steps. It simulates the membrane potential leak in biological neurons and ensures an enhancement in model robustness.

---

Experimental results validate that both our FE and EL methods can effectively improve the robustness SNN to different noises, and can be used in conjunction with other methods to improve the robustness further.
2 Related Work
demonstrate that compared ANNs, SNNs exhibit inherent robustness. Currently, re- searchers consider that this superior robustness of SNNs stems from their more biologically plausible spiking neurons, and they are dedicated developing more bio-inspired models to cope with noise attacks. (TT) investigate the security of SNNs from the impact of structural parameters on the robust- ness of SNNs to adversarial attacks, and demonstrate that the inherent robustness of SNNs highly conditioned by the choice of (time window; firing voltage thresholds) combination. [9] systematically demonstrates that precise spike timing conducive to improving the robustness neural networks, providing opportunities for understanding the robustness of the brain. (32 confirms that the leak factor in LIF neurons offers an extra knob to control the adversarial perturbation. (3) also investigates the role played by leak factor and concludes from frequency domain analysis that leak factor can filter freeeery components thus improving model robustness. However, the spiking neurons used in these works only offer simplified representation of the intricate dynamics of the biological system [O]. and the robustness verification of the above works is mainly carried out experimentally. lacking theoretical explanation. It's doubtful that their conclusion can adapt to other datasets and varying noises. Then, StoG [0] is proposed to further introduce stochasticity which is observed in biological neurons into the spiking neurons. The more biologically plausible StoG method can improve the robustness efficiently, however, it sacrifices a little original accuracy. In contrast to the aforementioned work, we conducted theoretical analysis of the robustness of SNNs, showing that is constrained by the encoding method and the membrane potential leak factor. We then designed a frequency encoding and evolutionary leak factor model that closely mimics the biological nervous system to enhance the robustness of SNNs.
24 31
Another method improves the robustness of SNNs by incorporating additional training strategies. 17 continuously adds newly generated adversarial examples during the training process to improve the robustness of SNN. [8] proposes regularized adversarial training scheme by performing the Lipschitz analysis on model weights. However, these methods are rooted in the concept of adversarial training [22] in ANNs, and their defense performance can be influenced by downstream tasks.
Furthermore, they all rely on simplified direct encoding approach (i.e., repeating the original image T times) input, which deviates from the visual attention mechanism observed in biological brains. Developing more biologically plausible models is essential for improving robustness and advancing SNN applications. In this work, we leverage the selective visual attention mechanism found in biological brains and introduce a frequency encoding method. This method effectively filters noise in images, enhancing the robustness of SNNs.
3 Preliminaries
3.1 Spiking Neurons
The most commonly used spiking neuron of SNNs today is the Leaky Integrate- inngrrtteand---ee and-Fire (LIF) spiking neuron [36] 6) LIF neurons simplify and computationally simulate the three main processes involved in information transmission in biological neurons: synaptic integration, membrane potential accumulation and decay, and neuronal firing. The dynamics of LIF spiking neurons in layer can be described as follows:
Wi-L.00 1>
Synaptic integration:
mi
x²
1=1
Membrane potential accurnulatiin: : =i=Xiuu - o (1-0 + m
(2)
Neuronal firing: : O = - Vaa)-
(3)
In the first layer, the injected electrical signal m accumulates from the input signal a. For
subsequent layers ( > 1. the electrical signal mf is the sum of spike signals O from the preceding
3

---

layer scaled by weights Wi-11- The operator @ represents element-wiss product. The membrane potential uf at time step t is the accumulation of the leaked membrane potential u from the previous time step and the newly injected signal mf. If the membrane potential uf exceeds the threshold ViA. a spike Of is generated by a Heaviside function H(.)). After spikes are produced, the membrane potential of the corresponding neurons is reset to O. Typically. A is treated as a constant value À E (0, 1] in previous work.
3.2 Adversarial Attacks
Given a classification model f with dataset (æ,, Vtrue). where x is the clean image and ytrue is the corresponding label. The adversarial attack aims generate adversarial example & that satisfies:
f()) + f(x) s.t. || æ|I, e,
(4)
where/l-Ilp is the L normo,, we use L -nom on our work, and limits the strength the perturbation to level that is indistinguishable to the human eye. Here we consider four classic adversarial attack algorithms: Fast Gradient Sign Method (FGSM) [2], Projected Gradient Descent (PGD) [22], Basic iterative Method (BIM) [18] and CW (2] attacks. The detailed formulations of these attacks can be found in the Appendix A The introduction of surrogate functions [25] 47 41] addresses the
limitation of backpropagating gradients through LIF neurons. This advancement enables effective adversarial attacks on SNNs using the aforementioned methods.
4
FEEL-SNN: Robust SNNs with Frequency Encoding and Evolutionary Leak Factor
4.1
The robustness analysis of SNNs
The robustness of the model is quantified as L(x + + after perturbation. Improving robustness entails reducing this perturbation--nee cunurbatioo-indueed loss difference.
+) 100--(ee C(x). the difference in loss value before and
27 utilizes the local linearity technique to theoretically address this difference, expressed as:
a(x + [(x:) s le v=[(=)) + g(),
where g(e, is the residual term, | is norm for vector. This theoretical framework motivates research into regularization that minimize |e ④ [=((=)] in ANNs to enhance robustness [8 29
The situation for SNNs differs slightly from that for ANNs [10] In SNNs, the perturbed input = x + is encoded into temporal trains over T time steps. Consequently, the robustness constraint for SNNs should aim to minimize the term Ee (<()
according to Eq. (5). where x' is the input encoding image at time step t, and <(t) represents the perturbation the encoding image x' at time
OC 0us
step f. By applying the BPTT rule 41), we can derive the constraint for the term >, (e(t)
des in
8C
SNNs, as presented in Theorem T (The detailed proof is in the Appendix A.2
Theorem Given an L-layered SNN intended inference T time-steps with X as the leak factor, suppose that there are N₁ neurons in layer f 1 = 1,2.... L. A E RNXT, W1-1 E R N satisfies:
min Σ (c(1)
O dax
min I
T X
II 2
I
W q
II
00 OC July
11, (6)
1.g
80!
where e is the perturbation, L is the loss function.
According to Eq. (6), the robustness of SNNs is relative to the perturbation and the leak factor X in the ! term, the model weight W in the 2 term, and the ao
But in the 3 term. Eq. (6) presents a unified framework for SNNs robustness constraint, which helps explain why weight regularization [ (the 2 term) and surrogate gradient 440 (the 3 term can promote robustness. And the previous work (3 32 3 also analyzes the inherent robustness of SNNs from the leak factor in the ! term. However, there is still lack of work on removing input perturbation and improving leak factors in the 1 term to enhance the robustness of SNNs.

---

Original image
Original
Gaussian
FGSM
PGD
BIM
CW
information
Figure 2: Visualization frequency spectrums for data observation. The first column shows three cases of original CIFARIO images. The second column shows the corresponding frequency spectrums of the images in the first column. The third column the seventh column shows frequency spectrums of corresponding added noises to the images the first column, where added noise maps the difference between the noise image and the original one. The center of each frequency spectrum represents the low- low-frequency information, and the edge area is the high-frequnncy information.
Frequeney cheoding
Input
Orginal Image
Frequency
CLS
Uptate
Treg Jeatyy treed
(a) Frequency encoding (FE)
(b) Evolutionary leaky factor (EL)
Figure Illustration of the proposed TEEL-SNN, (a) Frequency encoding simulate selective visual attention in biological brain and (b) Evolutionary leak factor to simulate the non- non-fixed membrane potential leak in biological nervous system.
4.2 Frequency encoding simulate the selective visual attention in biological brain
According to the ! term in Eq. (6). reducing input perturbations e(t) at every time step helps the model achieve reliable output. However, the encoding method that much of the current work relies on is the simplified direct encoding approach [
9 T0 (i.e., repeating T images), which repeats the noise T times and inevitably overlooks noise removal. In contrast, the biological nervous system can maintain stability even complex noise environments, benefiting from the selective visual attention mechanism 7 45 of the brain (as illustrated in Fig. (TA). The brain processes only a fraction of the information available on the retina at any given time and has the ability to filter unwanted information. To simulate the selective visual attention of the biological nervous system while effectively removing noise at different frequencies, we propose the Frequency Encoding method (FE) for SNNs. Specifically, given input image, FE transforms it into the frequency domain via Discrete Fourier Transform (DFT) 34 49 Then, FE suppresses information of different frequencies different time steps decrease <(t) shown in the term in Eq. (6) Specifically, as illustrated in Fig. 2 the information of the original image is concentrated in the low-frequency region (center area of the second column), while the noise information spans from low-frequency (center area) to high-frequenee (edgearea) regions (third to fifth columns). Therefore, to remove as much frequency noise from the image as possible, the frequency suppression range gradually increases from gighfrreuencc to low-frequency over time steps. This operator ensures that FE removes various noises present the original image while retaining its essential information, as depicted in Fig. (3)).
Formally, denote æ E M as the input image and F E CMx as its frequency representation, then the DFT (F) between and of is formulated as follows:
M 1 N
a m.n F(Im,n)
Ba.be
j2m Ba
6=u
5

---

and according to the DFT, the low-frequency parts of the image is in the center of the x". To suppress different frequency components different time steps, for given time step t. we update x tt as follows:
x² + +M@
(8)
where @ is element-wise multiplication. The matrix M E BRMN controls the scaling of different frequencies. Intuitively, M should be close to 0 for high-frequency components and close to 1 for low-frequency ones, In this study, we set M to box window with radius r, defined as:
1,
0 5 |m|, In S
Mm,n
0. else
The overall function of our Frequency Encoding (FE) module at time step t is then defined as:
T + FM, @ (x)),, i,t 21, Th.
(10)
and set
.>r if j-
(11)
In summary, the proposed FE method, as described in Eq (1O), allows us to control the frequency mask radius at each time step, enabling the suppression of different frequency ranges. This effectively removes noise at various frequencies, thereby enhancing the robustness of SNNs.
4.3 Evolutionary leak factor to simulate the non-fixed membrane potential leak in biological nervous system
Recalling the ! term in Eq. (6), in addition to the proposed frequency encoding, the selection of the leak factor À is also crucial for improving the robustness of SNNs. However, most existing work overlooks this aspect 8 17]. They often assume that all neurons in the SNN adopt the same fixed leak factor at all time steps, which contradicts the membrane potential leak mechanism of the biological nervous system. In the biological nervous system, neuron membrane potential exhibits varying degrees of leak due to different environmental conditions and axon fibers [38 13]. aiming to
enhance the processing of useful information [ illustrated in Fig. (I)). Therefore, in this study,
we draw inspiration from the biological membrane potential leak and propose a method for training SNNs with an evolutionary membrane potential leak factor (EL).
According to ! term in Eq. (6), a smaller leak À can better constrain robustness. However, excessive leak can lead to significant loss of effective information and a decrease in original accuracy. Thus, in our approach, we aim for EL to learn the correlation between frequencies at different time steps, building upon the foundation of FE to ensure effective information utilization. We propose trainable leak factor training scheme instead of the leak factor regularization term in our work. Specifically, leveraging the frequency-encoder input, we assign trainable leak factors different neurons within layer across time steps to mitigate the propagation of noise information, as shown in Fig. (3p).
Formally, the neurons in the convolutional and fully-comnected layers are defined by the LIF, as illustrated in Eq. 33), and finally the leak factor update computed as:
X = Xi m/Ai,
(12)
Oc
OL
80 au dL
00; 1-1
A
u
(13)
ax
0
du
ax
a0; du
L = LoE(æ, (a, y, W. A)
(14)
80; where out is estimated by the surrogate gradient, Dut + max luf - Ven )). denotes the constraint factor that determines the sample range to activate the gradient. Log is the commonly used Cross- Cross-Entroy loss.
80
To sum up. our FEEL-SNN focuses on the L term Eq. (6). Here, FE serves to attenuate the impact of input noise (() during each time step, while EL facilitates the continual learning of information correlations across varying time steps. This concerted effort enables more effective utilization of useful information, thereby enhancing the robustness of the model.

---

100
80
90.8 6931
Vanilla
Vanillaa
Accuracy (%)
80
+EE
Accuracy (%)
70
+FE
+FEEL
+FEEL
40
201
20
10
11.0
24
164
30
CLEAN FGSM
PGD
BIM
CW
CLEAN
PGD
BIM
CW
Attack
Attack
(a) CIFARIO, VGGI1,
(b) CIFAR100, VGGI1,
80
50
Accuracy (%)
70
+FE FEEE
+FEEL
Accurucy
60
20
10
134
122
20
CLEAN FGSM
PGD
BIM
CW
CLEAN FGSM
PGD
BIM
CW
Attack
Attack
(c) CIFARIOO, WideResNetl6, T
(d) Tiny-Imageln ImageNet, ResNet19, 7'
Figure 4: Performance of the proposed FE and FEEL under different white-box attacks. The attack perturbation
4/255 for all attacks, iterative step k 4, and step size 0.01 for PGD, BIM.
100
426.222 923
Vanilla FFB PERL
745 T4L2
Vanilla
Accuracy (%)
Accuracy (%)
60
FE
80
PERL
70
40
357
567
45.1
CLEAN FGSM
PGD
BIM
CW
CLEAN FGSM
PGD
BIM
CW
Attack
Attack
(a) CIFARIO, VGGI1, T' =
(b) CIFARI00, WideResNet16, T
Figure 5: Performance of the proposed FE and FEEL under different black-box attacks. The attack perturbation 4/255 for all attacks, and iterative step & = 4 for PGD, BIM.
Experiments
5.1 Experimental settings
The datasets we used are CIFAR-IO, CIFAR-100 (16), and Tiny-ImageNet [5]. The network chitectures include VGG11, WideResNer16, and ResNet19, We set 7 1.0 in surrogate gradient and threshold Vn, 1.0 in Eq. (3) following the general settings 6 We adopted four training strategies to determine the effectiveness of the proposed FEBL method. The first is a vanilla training scheme (BPTT), directly using raw images for training 41). The second is an adversarial training strategy, which uses examples from white-box (WB) PGD attacks (E = 2/255, iterative step & = 2) for training [12] (abbreviated as AT). The third is add Lipschitz penalty proposed [8] to the weights under the adversarial training setting (abbreviated as RAT). The fourth introduces the stochastic gating mechanisms spike firing [10] (abbreviated StoG). For all four strategies, we test their robustness with and without the proposed FE and FEEL methods. The attack methods include adversarial attacks (i.e., FGSM 112. PGD with random start (22) BIM [18, and CW (2), for both white-box and black-box attacks) and common noise attack (i.e., gaussian noise, GN). Since the DFT (F), IDFT (F-l) (Eq. 7 and Eq. (10) and frequency mask operation (M ( Pt Eq.
(8) are differentiable, the FE module can be directly utilized to generate adversarial perturbations.
7

---

Table 1: Performance of the proposed FE and FEEL with different training strategies. The perturbation 8/255 for all attacks, and iterative step k step size 0.01 for PGD, BIM. The dataset is CIFAR 100 with T' the network is VGGI1. The improvement brought by our method is shown in parentheses.
Methods
clean
GN
FGSM
PGD
BIM
CW
Vanilla
72.93
68,93
0.16
0.14
6.53 7.63 (+1)10)
Vanilla+FE (Ours)
72.67 (-0.26)
69.40 (+0.47)
5.18 (=0.27)
0.31 (+0.15)
0.24 (+0.10)
Vanilla-FEEL (Ours)
73.79 (+0.86)
68.05 68.05(-0.88)
9.60 (+4.69)
2.04 (+1.88)
1.81 (+1.57)
6.66 (+0.13)
AT P
69.14
68.27
17.21
8.63
8.13
16.54
AT-FE (Ours)
69.34 34 (+0.20)
68 (+0.40)
17.65 (+0,44)
8.92 (+0.29)
8.33 (+0.20)
21.49 (+4.95)
AT+HEEL (Ours)
69.79 (+0,65)
69.02 (+0.75)
18.67 (+1.46)
11.07 (+2.44)
10.56 (+2.43)
21.78 (+5.24)
RAT 8
70.03
69.26
18.88
8.87
7.93
20.79
RAT+FE (Ours)
69.74 (-0.29)
68.35 (-0.91)
18.74 (-0.14)
9.70 (+0.83)
8.91 (+0.98)
27.16 (+6.37)
RAT+FEEL (Ours)
69.80 (-0.23)
68.46 (-0.80)
19.08 (+0.20)
12.36 (+3.49)
11.96 (+4.03)
25,52 (+4.73)
StoGi 10
72.22
61.63
5.92
0.26
0.20
19.87
StoG+FE (Ours)
73.13 (+0.91)
67.68 (+6.02)
6.95 (=1.03)
0.22 (-0.04)
0.25 (+0.05)
23,02 (+3.15)
StoG+FEEL (Ours)
72.13 (-0:09)
65.96 (+4.33)
9.15 (+3.23)
0.55 (+0.29)
0.31 (+0.11)
24.79 (+4.92)
AToStoG AT+StoG+FB (Ours)
69.24
63.35
19.64
9.77
3.23
44.79
69.45 (+0.21)
68.83 (+5.48)
20.06 (+0.42)
10.69 (+0:92)
3.24 (+0.01)
38.56 (-6.23)
AT+SiUGH+EEL (Ours)
69,53 (+0..29)
68.47 (+5.12)
18:27 (-1.37)
11.52 (+1.75)
3,90 (+0.677
45,18 (+0.39)
RAT-StoG
69.12
68,37
29.25
15,43
6.91
32,08
RAT+SioG-FE (Ours)
68.97 15)
68.52 (+0.15)
31.65 (+2.40)
17.49 (+2.06)
8.57 (+1.66)
47.16 (+15.08)
RAT+SIuG+FEEL (Ours)
69.97 (+0.85)
68.15 (:0.22)
31.68 (+2.43)
18.07 (+2.64)
8.89 (+1.98)
50.56 (+18.48)
Therefore, the adversarial perturbations are applied to the image domain before FE. In our study, for CIFARIO and CIFARI00 dataset with T 4, we set [16, 14, 12, 10). For CIFARIO and CIFAR100 dataset with T 8, we set r = [16, 14, 12, 10, 8, 6, 4, 2/. For Tiny-ImageNet with T = 4,
we set r (2,330 28, 26]. The impact of the frequency masking radius r on robustness detailed in More detailed experimental settings can be found in Appendix A.3
Section 5.3
5.2 Overall performance for various attack types
White-box attack. First, we integrate the proposed FE and FEEL methods into the standard training (vanilla) of SNNs. We present experimental results for method various datasets (ie.. CIFAR- 10, C00AR-100, and ImageNe) using different networks (i.e., VGG11, WideResNet16,, and ResNet19) under white-box attacks, as summarized in Fig. 4 Our findings demonstrate that across all attacks, FE and FEEL can enhance model robustness and maintain the original accuracy. Specifically, on VGGI with CIFAR- 10, compared to the vanilla method (shown in blue bar), FEEL enhances model robustness by up to 15% and 6% against PGD and CW attacks, respectively. at time step 4. Similar trends are observed across other datasets and networks. Moreover, it is clear from the Fig. that simple FE application can effectively improve the robustness of SNN, and EL can further effectively improve the robustness based on FE.
Black-box attack. We utilize a model trained with a different seed to generate perturbed images for black-box attacks. The efficacy of our FE and FEEL method under various attacks is illustrated in Fig. [5] Across all models and datasets, the same observation can be obtained as the white-box performance. FE and FEEL consistently outperform vanilla training. Notably, with T = 8, FEEL enhances robustness (attacked by CW) by up to 4.27% compared to the vanilla approach, when on 16 with CIFARI00.
Comparison with state-of-the-art work on robustness of SNN. To further evaluate the effective- ness of our FE and FEEL methods, compare it with ttateoffthee-rt (SOTA) robust SNN methods, namely AT [2], RAT [8 and StoG [TO] in Tab. From Tab. I we observe that FE and FEEL can en- hance the original accuracy and robustness of these SOTA methods. For example, when under attack by PGD, SNN-RAT improves the robustness of the original model ( (Vanilla) from 0.16% to 8.87%, our FE (RAT+FE) enhances the robustness of RAT (RAT) to 9.70%. FEEL further enhances the robustness of RAT (RAT+FEEL) to 12.36%. These experimental results underscore the effectiveness of our FE and FEEL methods.
More experimental results of our FE, EL., and FEEL with different time steps, datasets, and networks can be found in Appendix. A.4
8

---

5.3 Ablation study
Performance under different e and iterative step We plot the accuracy of the white-box and black-box scenarios under PGD attack with varying e and iterative step & in Fig. c and Fig, 7 respectively. The results indicate that the accuracy of our FEEL models decreases slowly compared to that of vanilla models.
Vindl
6055
(a) CIFARIO,WE
(b) CIFARIOBBB (c) CIFARI00, (d) CIFARIOO,BB
Figure 6: Performance of the white-box (WB) and black-box (BB) scenarios under PGD attack with different
perturbation e, the iterative step ls = 4, the network is VGGI1.
Vialk
Veeiaa
Vards
FS22 (Pac)
(a) CIFARIO,WE WB
(b) CIFARIOBBB (c) CIFAR100,WD WB
(d) CIFARIOO.BB
Figure 7: Performance of the white-box (WB) and black-box (BB) scenarios under PGD attack with different
iterative step k. the perturbation 4/255, the network is VGGII.
Rationality of FE method. To further verify the effectiveness of FE which crops information from high-frequency to low-frequency over time steps, we compare it with an alternative strategy, Inverse-FE (IFE), which crops information from low-frequency to high-frequency over time steps. As shown in Tab. 2 IFE causes a significant drop in clean accuracy (64.81% vs. vanilla 92.64%) This demonstrates that a substantial amount of valid information lost, verifying that valid information is concentrated in the low-frequency area. In contrast, FE not only effectively removes noise (21.56% vs. vanilla 15.59% when under PGD attack) but also minimizes the loss of valid information (92.26% vs. vanilla 92.64%).
Table 2: Performance (%) of the proposed Frequency Encoding (FE) and the alternative strategy Inverse-FE (IFE). The perturbation = 4/255 for all attacks, and iterative step k = 4, step size a = 0.01 for PGD. The datasct is CIFARIO 10 with time step T = 4, the network is VGG11.
Method|
Clcan
GN
FGSM
PGD
BIM
CW
Vanilla IFE
92.64
91.28
35.47
15,59
14.95
6.92
64.81
64.48
12.33
4.44
4.25
4.18
FE
92.26
92.02
39.67
21.56
21.05
10.12
Effect of frequency masking radius r on robustness. We investigate the frequency masking radius robustness to SNNs, defined in Eq. (9). which governs the degree of frequency suppression at each time step. We present three different strategies to illustrate the superiority of our method as shown in Tab. 3 The first strategy employs a direct encoding method, wherein the frequency information outside a fixed radius r is removed from each original image, followed by T-step image replication (using different r for each image, akin to data augmentation), of Tab. 3. The second strategy utilizes FE but with a uniform radius r across all time steps, as shown in rows 2 to 5 of Tab. 3 The third strategy is the FE method proposed in this study, where a different r is applied to each time step to remove as many noise frequencies as possible, as depicted in the last row of Tab. From Tab. 3 we observe that across various selections, our method outperforms the first and second strategies in all attack scenarios.
depicted in the first row
Rationality of EL method. According to Eq. ( the leak factor controls the residual membrane potential between time steps. A smaller leak factor may lead to weakened temporal modeling capability of the SNN, leading decline in network performance (28). Considering the leak factor's

---

Table 3: Effect of frequency masking radius on robustness. The attack is PGD with perturbation e 1/255,
iterative step a 0.01, and iterative step l: 4. The dataset is CIFAR1O with T 4, the network is VGGII.
ro 16, m 14,r2 12, r3 r.
Encode
I
clean
GN
FGSM
PGD
BIM
CW
Direct FE FE FE FE FE (Ours)
[ro]a, [rx
l, [re]4,
[ra]a
70.88
69.73
14.43
4.33
4.19
6.21
4
62.01
60.73
9.47
2.28
2.17
4.79
68.78
67.55
13.62
4.74
4.35
6.37
1r
69.96
69.26
14.60
5.38
5.20
6.87
[ra]4
70.95
70.39
15.72
5.41
5.22
7.45
[ro, F1, (2, r2]
71.40
70.59
16.80
6.89
6.62
8.09
dual role in original information transmission (Eq. (2) and robustness enhancement (Eq, (6). we propose EL. The EL dynamically learns the optimal robustness leak factor across different time steps and neurons, which also increases the expression capability of SNN, helping maintain clean accuracy and improving robustness. We further compare EL with two alternative strategies. The first strategy sets all leak factors to O. The second strategy, termed Reg-El EL (REL), adds L2 regularization to the EL to further constrain the leak factor. As shown in Tab. 6 in Appendix. A.44 small leak factor significantly reduces clean accuracy (vanilla 92.64% vs. REL 88.52% vs. EL. with X = 0.0 at 31.76%), ) consistent with analysis above. Besides, small leak factor does increase the robustness of SNN (c.g., under PGD attack, EL with À = 0.0 is 63.80%, REL is 29.98 9998, compared to vanilla 15.59%). This also aligns with the proposed robustness framework (Eq. (6) by demonstrating that controlling the leak factor improves robustness. And our EL method ensures improvements in both robustness and original accuracy (e.g.. the PGD defense accuracy of EL is 30.27%, compared to 15.59% for vanilla, and the clean accuracy of EL is 92.73%. compared to 92.64% for vanilla). In Appendix. A.4 we further verify the proposed EL does not destroy the impact of other terms in Eq. (6) on the robustness of SNN.
All the above experimental results illustrate the rationality and effectiveness of method.
6 Conclusions and Discussions
Conclusion: In this study, drawing inspiration from the selective visual attention and dynamic membrane potential leak observed biological nervous systems, we introduce a robust SNN with Frequency Encoding and Evolutionary membrane potential Leak factor (FEEL-SNN). Specifically, our approach theoretically presents a unified framework for SNN robustness, demonstrating that refining the encoding technique and evolving the membrane potential leak factor can enhance SNN robustness. Then we propose a novel image encoding method for SNNs, termed frequency encoding (FE). FE captures information of varying frequencies at different time steps, which preserves the original information while suppressing different frequency range noises, effectively filtering out image noise. Building upon FE, we propose an evolutionary leak factor (EL.. EI. ensures that different neurons in the network learn the optimal robustness leak factor at different time steps. It facilitates the continual learning of information correlations actoss varying time steps, enabling more effective utilization of pertinent information and thereby enhancing SNN robustness. Experimental results validate that both our FE and EL methods can effectively improve the robustness of SNN different noises, and can be used in conjunction with other methods to improve the robustness further.
Limitation: Our focus has been primarily on static datasets. In future work, how to propose reliable and effective encoding method for the DVS datasets a topic worthy of study.
Broader Impact: In neuroscience, the selective visual attention and non-fixed membrane potential leak considered to contribute to the robustness of biological nervous systems. By using SNN as research tool, computational modeling of biological nervous systems can be further facilitated. We can contribute valuable insights to ongoing discussions in neuroscience regarding robustness.
7 Acknowledgement
This work was supported in part by the STI 2030 Major Projects under Grant 20212D00000000, in part by the National Natural Science Foundation of China (61925603, 62376247, U20A20220, and 62334014), and in part by the grants from Key R&D Program of Zhejiang (2022C01048).
10

---

References
[1] Rémi Bernhard, Pieire-Alain Moëllic, Martial Mermillod, Yannick Bourrier, Romain Cohendet, Miguel Solinas, and Marina Reyboz. Impact of spatial frequency based constraints adversarial robustness. In 2021 International Joint Conference on Neural Networks (IJCNN), pages 1-8. IEEE, 2021.
[2] Nicholas Carlini and David Wagner. Towards evaluating the robustness of neural networks. In 2017 ieee symposium on security and privacy (sp). pages 39-57. Ieee, 2017.
[3] Sayeed Shafayet Chowdhuuy. Chankyu Lee, and Kaushik Roy. Towards understanding the effect of leak in spiking neural networks, Newrocomputing, 464:83-94 2021.
[4] Michael V DeBole. Brian Taba, Arnon Amir, Filipp Akopyan, Alexander Andreopoulos, William P Risk, Jeff' Kusnitz, Carlos Ortega Otero, Tapan K Nayak, Rathinakumar Appuswamy, et al. Truenorth: Accelerating from zero to 64 million neurons in 10 years. Computer, 52(5):20-29, 2019.
[5] Jia Deng. Wei Dong, Richard Socher, Li-Jia Li, Kai Li, and Li Fei-Fei. Imagenet: A large-scale hierarchical image datahase. In 2009 IEEE conference on computer vision and pattern recognition, pages 248-255.
Tece, 2009.
[6] Shikuang Deng, Yuhang Li, Shanghang Zhang, and Shi Gu. Temporal efficient training of spiking neural network via gradient re-weighting. In International Conference on Learning Representations, 2021.
[7] Robert Desimone and John Duncan. Neural mechanisms of selective visual attention. Annual review of nearoscience, 18(1) 19332222,, 1995.
[8] Jianhao Ding. Tong Bu. Zhaofei Yu. Tiejun Huang, and Jian Liu, San-rat: Robustness enhaacee spiking
neural network through regularized adversarial training. Advances in Neural Information Processing Systems, 45:24780-24799, 2022.
[9] Jianhao Ding. Zhaofei Yu, Tiejun Huang, and Jian K Liu. Spike timing reshapes robustness against attacks in spiking neural networks. arXiv preprint arXiv:2306. 200:22300.05654, 2023.
[10] Jianhao Ding, Zhaofei Yu, Tiejun Huang, and Jian K Liu. Enhancing the robustness of spiking neural networks with stochastic gating mechanisms. In Proceedings of the AAAI Conference on Artificial Intelligence, volume 38, pages 492-502, 2024.
[11] Rida El-Allami, Alberto Marchisio, Muhammad Shafique, and Ihsen Alouani. Securing deep spiking neural networks against adversarial attacks through inherent structural parameters. In 2021 Design, Automation Test in Europe Conference & Exhibition (DATE), pages 774-779. IEEE, 2021.
[12] Ian Goodfellow, Jonathon Shlens, and Christian Szegedy. Explaining and harnessing adversarial examples. arXiv preprint /4f1::/411..57 2014.
[13] Nathan W Gouwens, Staci A Sorensen, Jim Berg. Changkyu Lee, Tim Jarsky, Jonathan Ting, Susan M Sunkin, David Feng. Costas A Anastassiou, Eliza Barkan, et al. Classification of electrophysioloical and morphological neuron types in the mouse visual cortex. Nature neuroscience, 22(7):1 182-1195, 2019. [14] Jaanin Han, Ziming Wang. Jiangrong Shen, and Huajin Tang. symmettic--trresholdd relu for fast and nearly lossless ann-snn conversion. Machine Intelligence Revearch, 20(3):435-446, 2023.
[15] Yangfan Hu, Qian Zheng, Xudong Jiang, and Gang Pan. Fast-snn: Fast spiking neural network by converting quantized ann. IEEE Transactions on Puttern Analysis and Machine Intelligence, 2023.
[16] Alex Krizhevsky, Geoffrey Hinton, al. Learning multiple layers of features from tiny images. 2009.
[17] Souvik Kundu, Massoud Pedram, and Peter A Becrel. Hire-snn: Harnessing the inherent robustness of energy-efficient deep spiking neural networks by training with crafted input noise. In Proc. of International Conference on Computer Vision. pages 5209-52 5218, 2021.
[18] Alexey Kurakin, Ian Goodfellow, and Samy Bengio. Adversarial examples in the physical world. arXiv preprint
2016.
[19] Zhanfeng Liao, Yan Liu, Qian Zheng, and Gang Pan. Spiking nerf: Representing the real-world geometry by discontinuous representation. In Proceedings of the AAAI Conference on Artificial Intelligence, volume 38, pages 17790-13798 2024.
[20] De Ma, Xiaofei Jin, Shichun Sun, Yitao Li, Xundong Wu, Youneng Hu, Fangehao Yang, Huajin Tang, Xiaolci Zhu, Peng Lin, al. Darwin3: large-scale neuromorphic chip with a novel isa and on-chip learning. National Science Review, 11(5):nwac103 2024,
[21] Wolfgang Maass. Networks of spiking neurons: the third generation of neural network models. Neural
networks, 10(9):1659-165 1671, 1997.
[22] Aleksander Madry, Aleksandar Makelov, Ludwig Schmidt, Dimitris Tsipras, and Adrian Vladu. To- wards deep lcarning models resistant to adversarial attacks. In International Conference on Learning Representations, 2018.
[23] Shishira R Maiya, Max Ehrlich, Vatsal Agarwal, Ser-Nam Lim, Tom Goldstein, and Abhinav Shrivastava.
A frequency perspective of adversarial robustness. arXiv preprint arXiv:2111 1.00661, 2021.
[24] Alberto Marchisio, Giorgio Nanfa, Faiq Khalid, Muhammad Abdullah Hanif, Maurizio Martina, and Muhammad Shafique. Is spiking secure? a comparative study on the security vulnerabilities of spiking and deep neural networks. In 2020 International Joint Conference on Neural Networks (IJCNN), pages 1-8. IEEE, 2020.
[25] Emre O Neftci, Hesham Mostafa, and Friedemann Zenke. Surrogate gradient learning in spiking neural networks: Bringing the power of mrndient-based optimization to spiking neural networks. JEEE Signal Processing Magazine, 36(6):51-63, 2019.
[26] Jing Pei, Lei Deng. Sen Song. Mingguo Zhao, Youhui Zhang, Shuang Wu, Guanrui Wang. Zhe Zou, Zhenzhi Wu, Wei He. et al. Towards artificial general intelligence with hybrid tianjic chip architecture. Nature, 572(7767):1066 111, 2019.
11

---

[27] Chongli Qin, James Martens, Sven Gowal, Dilip Krishnan, Krishnamurthy Dvijotham, Alhussein Fawzi, Soham De, Robert Stanforth, and Pushmeet Kohli. Adversarial robustness through local linearization. Advances in neural information processing systems, 32. 2019.
[28] Nitin Rathi and Kaushik Roy. Diet-smn: A low-latency spiking neural network with direct input encoding and leakage and threshold optimization. IEEE Transactions on Neural Networks and Learning Systems,
347433117-3 2021.
[29] Kevin Roth, Yannic Kilcher, and Thomas Hofmann. Adversarial training is a form of data-dependent operator norm regularization. Advances in Neural Information Processing Systems, 13:14973-14985, 2020.
[30] Kaushik Roy, Akhilesh Jaiswal, and Priyadarshini Panda. Towards spike-based machine intelligence with
neuromorphic computing. Nature, 575(7784):607-617, 2019.
[31] Saima Sharmin, Priyadarshini Panda, Syed Shakib Sarwar, Chankyu Lee, Wachirawit Ponghiran, and Kaushik Roy. A comprehensive analysis on adversarial robustness of spiking neural networks. In 20/9 International Joint Conference on Neural Networks (IJCNN), pages 1-8. IERE, 2019.
[32] Saima Sharmin. Nitin Rathi, Priyadarshini Panda, and Kaushik Roy. Inherent adversarial robustness of
deep spiking neural networks: Effects of discrete input encoding and non-linear activations. In European Conference on Computer Vision, pages 399-414, Springer, 2020.
[33] Yousheng Shu, Andrea Hasenstaub, Alvaro Duque, Yuguo Yu, and David A McCormick. Modulation of intracortical synaptic potentials by presynaptic somatic membrane potential. Nature, 441(7094),6117755,
2006.
[34] Duraisamy Sundararajan. The discrete Fourier transform: theory, algorithms and applications. World
Scientific, 2001.
[35] Christian Szegedy. Wojeiech Zaremba, Ilya Sutskever, Joan Bruna, Dumitru Erhan, Ian Goodfellow, and Rob Fergus. Intriguing properties neural networks. International Conference on Learning
Representations, 2014.
[36] Doron Tal and Eric I. Schwartz. Computing with the leaky integrate-and-Fie fire neuron: logarithmic computa- tion and multiplication. Neural computation, 92):305-318, 1997.
[37] Amirhossein Tavanaei, Masoud Ghodrati, Saeed Reza Kheradpisheh, Timothée Masquelier, and Anthony Maida. Deep learning in spiking neural networks. Neural networks, 111:47-63, 2019.
[38] Corinne Teeler, Ramakrishnan Iyer, Vilas Menon, Nathan Gouwens, David Feng. Jim Berg, Aaron Szafer, Nicholas Cain, Hongkui Zeng, Michael Hawrylycz, et al. Generalized leaky integrate-and-fire models classify multiple neuron types. Nature communications, 9(1):709, 2018.
[39] Cheng Wang. Chankyu Lee, and Kaushik Roy. Noise resilient leaky integrate-and fire neurons based on multi-domain spintronic devices. Scientific Reports, 12(1): (3361, 2022.
[40] Ziming Wang. Runhao Jiang. Shuang Lian, Rui Yan, and Huajin Tang. Adaptive smoothing gradient
learning for spiking neural networks. In International Conference on Machine Learning, pages 35798-
35816. PMLR, 2023.
[41] Yujie Wu, Lei Deng, Guoqi Li, and Luping Shi. Spatio-temporal backpropagation for training high- performance spiking neural networks. Frontiers in neuroscience, 12:323875, 2018.
[42] Hayat Yedjour and Dounia Yedjour. A spatiotemporal energy model based on spiking neurons for human motion perception. Cognitive Newrodynamics, pages 1-15, 2024.
[43] Dong Yin. Raphael Gontijo Lopes, Jon Shlens, Ekin Dogus Cubuk, and Justin Gilmer. A fourier perspective model robustness in computer vision. Advances in Neural Information Processing Systems, 32, 2019.
[44] Takashi Yoshida and Kenichi Ohki. Natural images are reliably represented by sparse and variable populations of neurons in visual cortex. Nature communications, 11(1):872, 2020.
[45] Alberto 7ani and Alice Mado Proverbio. Selective attention to spatial frequency gratings affects visual processing as early as 60 msec. poststimulus. Perceplual and motor skills, (09(1):140-155 2009.
[46] Ming ZHANG, Zonghua Gu, and Gang Pan. A survey of ncuromorphic computing based on spiking neural networks. Chinese Journal of Electronics, 27(4):667-677 -674, 2018.
[47] Wenrui Zhang and Peng Li. Temporal spike sequence learning via backpropagation for deep spiking neural networks. Advances in Neural Information Processing Systems, 33:12022-12033 2020.
[48] Weixing Zhang, Zongrui Li, De Ma, Huajin Tang, Xudong Jiang, Qian Zheng, and Gang Pan. Spiking gs: Towards high-accuracy and low-cost surface reconstruction via spiking neuron- based gaussian splatting. arXiv preprint 24Xx:2410.072666 2024.
[49] Zhendong Zhang, Cheolkon Jung, and Xiaolong Liang. Adversarial defense by suppressing higu-freyuency components. arXiv preprint arXiv: / 1908, 06566, 2019.
12

---

A Appendix
A.1
The attacks we used in this study
Given a classification model f with dataset (æ,, Mtrue), where æ: is the clean image and ytrue is the corresponding correct label. The formulations of the attacks used in this study described as follows:
FGSM. FGSM aims perturb the original data along the sign direction of the gradient on loss function with one step to increase the perturbed linear output, thus fool the network, can be formalized follows:
a z + esign V (() Vtrue)),
(15)
where sign(-) is an odd mathematical function that extracts the sign of real number.
PGD. PGD attack is the iterative variant of FGSM. first starts from a random perturbation in the by-norm constraint around the original sample æ. then takes gradient iteration step in the sign direction to achieve the greatest loss output, can be formalized as follows:
a = x + U(-e,
(16)
k++ = Clip (a + a sign( V D(f(t)) (true)))
(17)
where & is the iterative step, a is step size for each attack iteration, e controls the perturbation level. U() is uniform function, Clip,,c {x} is the function which performs per-pixel clipping of the image I, so the result will be in L -nom e-neighbourhood of the original image æ.
BIM. Both BIM and PGD attacks iterative attacks. Different from PGD attacks, BIM updates the adversarial samples starting from the original image.
CW. CW attack is different from previous gradient- based attack methods. It is based model optimization to generate adversarial samples. Its optimization function is as follows:
minimizel| (tanh (W + 1) - ==112 + c. f(tanh(()) ()) + 1),
(18)
where f defined
(()) max(max [i -(t)); -k),
(19)
where c is a parameter to control the perturbation, Z(-): represents the logits output on label yi-
A.2 Proof for Theorem
Proof for Theorem is given as follows:
Proof. By applying the spatial-temporal backpropagation (STBP) rule
we have
QC Da
L 1(
dc
0o ou
Oue ou:
Quiti,
Ouf - duf 00:
Oul 00
Ou Oar
7,
)(
T0T
00;- du
a0 du
1=1 1.
T
dC
00T 10,-1' 801
W
(20)
0ot duf out oul
2
80 dc au 007
II kst
II
W 1.g
Therefore,
Cc (e(() ④ ex
80 OC
min
min Σ
W q 1.a
du 00! |1, (21)
13

---

A.3 More experimental settings
In our work, the training process lasts for 300 epochs for all experiments. Batch normalization are used in the network to overcome the gradient vanishing or explosion. SGD optimizer is deployed, and the initial learning rate is set 0.1. The learning rate uses a cosine annealing schedule with T mao equaling the max number of epochs. All the experiments are conducted on the PyTorch platform on NVIDIA RTX 3090.
A.4 More experimental results
In Tab. we integrate the proposed FE and FEEL methods into the standard training (vanilla) of SNNs. The same as the results in the main paper, we can see from Tab. 4 that in different datasets (i.e., CIFAR-10, CIFAR-100, and Tiny-ImageNet, different networks (i.e., VGG1 I, WideResNet 6, and 19sNet19) and different time steps (T 8), both FE and FEEL can effectively and stably improve the robustness of the vanilla model to different attacks. This further verify the effectiveness of our method.
Table 4: Performance of the proposed FE and FEEL under different white-box attacks. The attack perturbation = 4/255 for attacks, iterative step 4, and step size a 0.01 PGD, BIM. 'WR16' represents WideResNett6 and 'R19" represents ResNet19.
Datasets
networks
T
method
clean
GN
FGSM
PGD
BIM
CW
Vanilla
92.64
92.28
35.47
15.59
14.95
6.92
4
+FE (Ours)
92.26
92.02
39.67
21.56
21.05
10.12
VGG11
+FEEL (Ours)
92.73
92.59
44.25
30.27
29.34
12.39
CIFARIO
Vanilla
93.35
92.72
34.15
13.12
12.29
7.11
8
+FB (Ours)
92.92
92.04
38.34
19.45
18.59
8.94
+FEEL (Ours)
93.29
92.12
44.96
28.35
27.18
12.19
Vanilla
94.19
92.24
23.01
1.43
1.28
3.48
WR16
8
+FE
94.15
92.40
24.59
2.11
1.87
3.69
+FEEL (Ours)
91.65
91.13
27.58
5.88
5.54
3.92
Vanilla
72.11
71.30
15.26
5.30
5.01
7.01
4
+FE(Ours
71.40
70.59
16.80
6.89
6.62
8.09
VGG11
+FEBL (Ours)
72.40
70.63
23.63
14.07
13.62
7.78
CIFAR100
Vanilla
72.93
71.75
14.51
4.48
4,26
6.66
8
+FE (Ours)
72.67
71.78
15.70
6.37
5.87
7.63
+FEEL (Ours)
73.79
73.28
20.78
12.35
12.01
6.53
Vanilla
74.51
68. 24
10.41
0.81
0.73
1.87
WR16
8
+FB (Ours)
73.97
68.71
12.24
1.31
1.58
3.44
+FEEL (Ours)
74.23
66.76
11.82
3.05
2.67
4.85
Vanilla
43.72
42,64
7.98
2.91
2.94
16.48
Tiny-ImageNNct
R19
4
+FE (Ours)
44.46
44.22
8.01
3.79
3.62
15.63
+FEEL (Ours)
43.83
43.34
9.59
4.53
18.21
Performance when using the EL method alone. We have included the performance of our EL combined with the vanilla and SOTA robust methods in Tab. 5 Combined with Tab. [ It evident that both FE and EL effectively enhance the robustness of the original methods, with FEEL further improving robustness
this foundation. For instance, under PGD attack, the original AT method achieves 8.63% accuracy, while our FE increases robustness to 9.70% EL to 11.1 1515, and FEEL to 12.36%. This illustrates the effectiveness of each module of our method.
EL does not destroy the impact of other terms in Eq. (6 on the robustness of SNN. We would like to discuss how the leak factor affects other terms in Eq. (6) in two cases: 1) Icak factor À as a hyperparameter predefined before neural network training and 2) leak factor as a learnable parameter during neural network training (the proposed EL implementation).
1). In the first case, À is a fixed number during neural network training (similar c ! term). Hence, it will not affect other terms in Eq. (6) at all. To validate the correctness of our theoretical framework (i.e., smaller L term results in less perturbation in the output), we conduct additional experiments, ie., training different neural networks with different fixed À (keep the remaining settings exactly the same as that reported in experimental settings the main paper). As results shown in Tab. [6] smaller À results in a more robust model, indicating that smaller I term results in less perturbation in
14

---

Table 5: Performance (%) of EL under different attacks, represents black-box attack performance. 'WR16'
represents WideResNet16 and 'R19' represents ResNet19. 'GP" represents gradient penalty regularization.
4/255, h 4,
0.01
Setting
method
clean
FGSM
PGD
BIM
CW
CIFARIO, VGGII, 1, 74
Vanilla+EL
91.24
42.63
27.69
26.41
11.43
CIFARIO. VGGIL, T4
Vanilla+EL*
92.24
60.26
55.37
56.86
71.91
CIFARIO, VGGII, 78
Vanilla+EL
92.69
41.22
25.39
23.97
9.95
CIFARIO, WR16, 78
Vanilla+EL
91.57
23.89
3.11
2.78
3,06
CIFARIO0 VGG11, 74
Vanilla+EL
70.13
21.03
11.89
11.44
6.79
100, VGGII, 1, T8
Vanilla+EL
72.41
22.03
12.95
12.16
6,98
CIFARI00, WR16, 78
Vanilla+EL
73.20
10.87
2.14
2.12
3.86
CIFARIO0, WR16, 78
Vanilla+EL*
74.20
29.22
19.53
19.0
55.6
Tiny- ImageNee,,,, R19, 74
Vanilla+EL
45.15
9.69
4.43
4.27
21.95
CIFARIO, VGGII, 1,111,74 74
GP+EL
90.53
41.72
26.33
25.09
20.21
c c 8/255, &:
7. a
0.01
CO,, VGG11, CIFAR100, VGGI1, T8
Vanilla+FI.
71.41
9.16
1.29
1.16
6.98
AT+EI.
69.56
19.68
11.15
10.13
20.91
CIFARI00, VGGII, T8 CIFARI00, VGG11, 78
RAT+EL
69.47
19.71
11.39
10.65
24.10
StoG+EL
72.58
8.98
0.58
0.28
23.54
Table 6: Performance (%) of the proposed evolutionary leak factor (EL) with other strategies, where 'FEEL, (|Al[2)) represents EL with L2 norm regularization, 'GP" represents gradient penalty, which adds L2 norm constraint to the model gradient. The perturbation = 4/255 for all attacks, and iterative step l: 4, step size = 0.01 for PGD. The dataset is CIFARIO with T = 4. the network is VGGII.
Method
Clean
FGSM
PGD
BIM
CW
Vanilla
92.64
35.47
15.59
14.95
6.92
FEEL (A 1.0) or FE
92.26
39.67
21.56
21.05
10.12
FEEL (A 0.8)
92.45
39.83
23.19
22.40
11.04
FEEL (A 0.5)
90.31
42.72
24.05
23.12
11.71
FEEL (A = -0.3)
89.26
52.20
38.02
37.01
12.35
FEEL (A 0..0)
81.76
62.84
63.80
63.09
12.46
FEEL. (1112)
88.52
44.41
29.98
29.14
13.89
FEEL (learnable A) Ours
92.73
44.25
30.27
29.34
12.39
GP
92.63
38.77
17.53
16.60
8.07
GP+EL GR+FEEL
90.53
41.72
26.33
25.09
20.21
92.53
48.46
32.83
31.94
20.75
the output in this case. As can also be observed from Tab. 6 smaller À could also bring performance degradation for clear inputs, i.e., from 92.26% at I.O to 81.76% at = 0.0. To mitigate the performance degradation, we implement the leak factor learnable parameter.
2). In the second case. is difficult directly analyze the influence due to their complex relationship. Therefore, we analyze the influence by validating whether T term for robustness improvement affects ② term or 3 term's effectiveness for the same goal. To be specific,
on other terms in Eq.
analyzed in main paper, RAT (weights regularization) is essentially minimizing 2 term. And we now add gradient constraint via the 1.2 norm (gradient penalty regularization (GP)) to
minimize 3 term. We conduct additional comparisons with these two methods to two alternatives of our methods. These two alternatives are implemented by additionally optimizing À for methods RAT and GP (keeping remaining parts unchanged), represented RAT+EL and GP+EL, respectively. As shown in Tab. of the main paper and Tab. 5 and Tab. 6 RAT+EL and GP+EL significantly improve the robustness of RAT and GP, across different attack types and datasets, respectively. These results show that leveraging I term for robustness improvement does not interfere with 2 term or 3 term's 's effectiveness for the same goal, indicating that the leak factor does not affect other terms in Eq. (6).
In summary, results in both cases indicate that the rationality of the theoretical framework and the leak factor does not affect other terms in Eq. (6) on SNN robustness.
15

---

NeurIPS Paper Checklist
1. Claims
Question: Do the main claims made in the abstract and introduction accurately reflect the paper's contributions and scope?
Answer: [Yes]
Justification: The abstract effectively summarizes the key findings and insights presented in our paper, while the introduction further sets up the context and rationale for the study.
Guidelines:
The answer NA means that the abstract and introduction do not include the claims made the paper.
The abstract and/or introduction should clearly state the claims made, including the contributions made in the paper and important assumptions and limitations. A No or
NA answer to this question will not be perceived well by the reviewers.
The claims made should match theoretical and experimental results, and reflect how much the results can be expected to generalize to other settings.
is fine to include aspirational goals as motivation as long as is clear that these goals not attained by the paper.
2. Limitations
Question: Does the paper discuss the limitations the work performed by the authors?
Answer:
[Yes]
Justification:
The "Limitation" section can be found in Section 6 of the main paper.
Guidelines:
The answer NA means that the paper has no limitation while the answer No means that the paper has limitations, but those are not discussed in the paper.
The authors are encouraged to create separate "Limitations" section in their paper.
The paper should point out any strong assumptions and how robust the results are to violations of these assumptions (e.g.. independence assumptions, noiseless settings, model well-specification asymptotic approximations only holding locally). The authors should reflect how these assumptions might be violated in practice and what the implications would be.
The authors should reflect on the scope of the claims made, e.g., if the approach was only tested on few datasets or with few runs. In general, empirical results often depend on implicit assumptions, which should be articulated.
The authors should reflect the factors that influence the performance of the approach. For example, facial recognition algorithm may perform poorly when image resolution is low images are taken in low lighting. Or speech-to-text system might not be used reliably to provide closed captions for online lectures because it fails to handle technical jargon.
The authors should discuss the computational efficiency of the proposed algorithms and how they scale with dataset size.
If applicable, the authors should discuss possible limitations of their approach to address problems of privacy and fairness.
While the authors might fear that complete honesty about limitations might used by reviewers as grounds for rejection, worse outcome might be that reviewers discover limitations that aren't 't acknowledged judgment and recognize that individual actions in favor of transparency play impor- tant role in developing norms that preserve the integrity of the community. Reviewers will be specifically instructed to not penalize honesty concerning limitations.
the paper. The authors should use their best
3. Theory Assumptions and Proofs
Question: For each theoretical result, does the paper provide the full set of assumptions and complete (and correct) proof?
Answer: [Yes]
16

---

Justification:
The full proof of our Theorem 1 can be found in Appendix A.2.
Guidelines:
The answer NA means that the paper does not include theoretical results.
All the theorems, formulas, and proofs in the paper should be numbered and cross- referenced.
All assumptions should be clearly stated or referenced the statement of any theorems.
The proofs can either appear the main paper or the supplemental material, but they appear in the supplemental material, the authors are encouraged to provide short proof sketch to provide intuition.
Inversely, any informal proof provided in the core of the paper should be complemented by formal proofs provided in appendix supplemental material.
Theorems and Lemmas that the proof relies upon should be properly referenced.
4. Experimental Result Reproducibility
Question: Does the paper fully disclose all the information needed to reproduce the main ex- perimental results of the paper to the extent that it affects the main claims and/or conclusions of the paper (regardless of whether the code and data are provided or not)?
Answer: Yes]
Justification: The experimental settings can be found Section 5.1 of the main paper and Appendix A.3 of the appendix. Our code is available in supplementary material.
Guidelines:
The answer NA means that the paper does not include experiments. If the paper includes experiments, No answer this question will not be perceived well by the reviewers: Making the paper reproducible is important, regardless of whether the code and data are provided or not.
If the contribution is dataset and/or model, the authors should describe the steps taken to make their results reproducible or verifiable.
Depending on the contribution, reproducibility can be accomplished in various ways. For example, if the contribution is novel architecture, describing the architecture fully might suffice, or if the contribution is a specific model and empirical evaluation, it may be necessary to either make possible for others to replicate the model with the same dataset, or provide access to the model. In general. releasing code and data is often one good way accomplish this, but reproducibility can also be provided via detailed instructions for how to replicate the results, access to a hosted model (e.g.. in the case of large language model), releasing of a model checkpoint, or other means that are appropriate to the research performed.
While NeurIPS does not require releasing code, the conference does require all submis- sions to provide some reasonable avenue for reproducibility, which may depend on the nature of the contribution. For example
(a) If the contribution is primarily a new algorithm, the paper should make it clear how reproduce that algorithm. (b) If the contribution is primarily
model architecture, the paper should describe the architecture clearly and fully.
(c) If the contribution is a new model (e.g., a large language model), then there should either be way to access this model for reproducing the results or way to reproduce the model (e.g., with an open-source dataset instructions for how to construct the dataset).
(d) We recognize that reproducibility may be tricky in some cases, in which case authors are welcome deseribe the particular way they provide for reproducibility, In the case of closed-source models, it may be that access to the model is limited in some way (e.g., registered users), but it should be possible for other researchers to have some path to reproducing or verifying the results.
5. Open access to data and code
Question: Does the paper provide open access to the data and code, with sufficient instruc- tions to faithfully reproduce the main experimental results, as described in supplemental material?
17

---

reproducible, they Answer: [Yes]
Justification: The experimental settings can be found in Section 5.1 of the main paper and Appendix A.3 of the appendix. Our code available in supplementary material.
The answer NA means that paper does not include experiments requiring code.
Please the NeurlPS code and data submission guidelines (https://niis.cce)
for more details.
While we encourage the release of code and data, we understand that this might not be possible, so "No" an acceptable answer. Papers cannot be rejected simply for not including code, unless this is central to the contribution (e.g., for new open-source benchmark).
The instructions should contain the exact command and environment needed to run to reproduce the results. See the NeurIPS code and data submission guidelines (https
wwwsssoooocyyyyo.o for more details.
The authors should provide instructions on data access and preparation, including how access the raw data, preprocessed data, intermediate data, and generated data, etc.
The authors should provide scripts to reproduce all experimental results for the new proposed method and baselines. If only subset of experiments should state which ones are omitted from the script and why.
At submission time, to preserve anonymity, the authors should release anonymized versions (if applicable).
Providing as much information as possible supplemental material (appended the paper) is recommended, but including URLs to data and code is permitted.
6. Experimental Setting/Details
Question: Does the paper specify all the training and test details (c.g., data splits, hyper- parameters, how they were chosen, type of optimizer, etc.) necessary to understand the results?
Answer:
[Yes]
Justification: The experimental settings can be found in Section 5.1 of the main paper and Appendix A.3 of the appendix. Our code is available in supplementary material.
Guidelines:
The answer NA means that the paper does not include experiments.
The experimental setting should be presented the core the paper to a level detail that is necessary appreciate the results and make sense of them.
The full details can be provided either with the code, in appendix, as supplemental material.
7. Experiment Statistical Significance
Does the paper report error bars suitably and correctly defined or other appropriate information about the statistical significance of the experiments?
Question:
Answer:
[No]
Justification: shared random seed is used for the reproducible purpose. Our code is available in supplementary material.
Guidelines:
The answer NA means that the paper does not include experiments.
The authors should answer "Yes" if the results are accompanied by eтror bars, confi- dence intervals, or statistical significance tests, least for the experiments that support the main claims of the paper.
The factors of variability that the error bars capturing should be clearly stated (for example, train/test split, initialization, random drawing of some parameter, or overall with given experimental conditions).
The method for calculating the error bars should be explained (closed form formula, call to a library function, bootstrap, etc.)
The assumptions made should be given (c.g., Normally distributed errors).
18

---

It should be clear whether the error bar is the standard deviation or the standard error of the mean.
is OK to report 1-sigma error bars, but one should state it. The authors should preferably report a 2-sigma error bar than state that they have 96% CI, if the hypothesis of Normality of errors is not verified.
For asymmetric distributions, the authors should be careful not to show in tables or figures symmetric error bars that would yield results that are out range (e.g. negative еπхо rates).
If error bars are reported in tables or plots, The authors should explain in the text how they were calculated and reference the corresponding figures or tables in the text.
8. Experiments Compute Resources
For each experiment, does the paper provide sufficient information on the puter resources (type of compute workers, memory, time of execution) needed to reproduce the experiments?
Question:
Answer: [Yes]
Justification: The experimental settings can be found in Section 5.1 of the main paper and Appendix A.3 of the appendix. Our code available in supplementary material.
Guidelines:
The answer NA means that the paper does not include experiments.
The paper should indicate the type of compute workers CPU GPU, internal cluster, or cloud provider, including relevant memory and storage.
The paper should provide the amount of compute required for each of the individual experimental runs as well as estimate the total compute.
The paper should disclose whether the full research project required more compute than the experiments reported in the paper (e.g., preliminary failed experiments that didn't make into the paper).
9. Code Of Ethics
Question: Does the research conducted in the paper conform, in every respect, with the NeurIPS Code of Ethics
Answer: [Yes]
Justification: We make sure that the research conducted in the paper conform, in every respect, with the NeurlPS Code of Ethics.
Guidelines:
The answer NA means that the authors have not reviewed the NeurIPS Code of Ethics.
If the authors answer No, they should explain the special circumstances that require deviation from the Code of Ethics.
The authors should make sure to preserve anonymity (e.g., there a special consid- eration due to laws or regulations in their jurisdiction).
10. Broader Impacts
Question: Does the paper discuss both potential positive societal impacts and negative societal impacts of the work performed?
Answer: [Yes]
Justification: The "Broader Impact" section can be found in Section 6 of the main paper.
Guidelines:
The answer NA means that there no societal impact of the work performed.
If the authors answer NA or No, they should explain why their work has no societal impact why the paper does not address societal impact.
Examples of negative societal impacts include potential malicious or unintended uses (e.g., disinformation, generating fake profiles, surveillance), fairness considerations (e.g., deployment of technologies that could make decisions that unfairly impact specific groups), privacy considerations, and security considerations.
19

---

The conference expects that many papers will be foundational research and not tied particular applications, let alone deployments. However, if there is direct path to any negative applications, the authors should point it out. For example, it is legitimate to point out that an improvement in the quality of generative models could be used to generate deepfakes for disinformation. On the other hand, it is not needed to point out that a generic algorithm for optimizing neural networks could enable people to train models that generate Deepfakes faster.
The authors should consider possible harms that could arise when the technology is being used as intended and functioning correctly, harms that could arise when the technology being used as intended but gives incorrect results, and harms following from (intentional or unintentional) misuse of the technology.
If there are negative societal impacts, the authors could also discuss possible mitigation strategies (e.g., gated release of models, providing defenses in addition attacks, mechanisms for monitoring misuse, mechanisms to monitor how system learns from feedback over time, improving the efficiency and accessibility ML).
11. Safeguards
Does the paper describe safeguards that have been put in place for responsible release of data or models that have a high risk for misuse (e.g., pretrained language models, image generators, scraped datasets)?
Question:
Answer: [NA]
Justification: Our paper poses no such risks.
Guidelines:
The answer NA means that the paper poses no such risks.
Released models that have a high risk for misuse or dual-use should be released with necessary safeguards to allow for controlled use of the model, for example by requiring that users adhere to usage guidelines or restrictions to access the model or implementing safety filters.
Datasets that have been scraped from the Internet could pose safety risks. The authors should describe how they avoided releasing unsafe images.
We recognize that providing effective safeguards is challenging, and many papers do not require this, but we encourage authors to take this into account and make best faith effort.
12. Licenses for existing assets
Question: Are the creators or original owners of assets (e.g.. code, data, models), used in the paper. properly credited and are the license and terms of use explicitly mentioned and properly respected?
Answer: [Yes]
We cited all the original paper that produced the code packages, models, and datasets.
Justification:
Guidelines:
The answer NA means that the paper does not use existing assets.
The authors should cite the original paper that produced the code package or dataset.
The authors should state which version of the asset is used and, if possible, include URL.
The name of the license (c.g., CC-BY 4.0) should be included for each asset.
For scraped data from a particular source (e.g., website), the copyright and terms of service of that source should be provided.
If assets are released, the license, copyright information, and terms of use in the batasets.paaeesstt
package should be provided. For popular datasets, paperswi thcode. cow datasets has curated licenses for some datasets. Their licensing guide can help determine the license of dataset.
For existing datasets that are re-packaged, both the original license and the license of the derived asset (if it has changed) should be provided.
20

---

If this information is not available online, the authors are encouraged to reach out to the asset's 's creators.
13. New Assets
Question: Are new assets introduced in the paper well documented and is the documentation provided alongside the assets?
Answer: [Yes]
Justification: Our code is available an anonymized zip file in supplementary material.
Guidelines:
The answer NA means that the paper does not release new assets.
Researchers should communicate the details of the dataset/code/moodl as part of their submissions via structured templates. This includes details about training, license, limitations, etc.
The paper should discuss whether and how consent obtained from people whose asset is used.
At submission time, remember to anonymize your assets (if applicable). You can either create an anonymized URL or include an anonymized zip file.
14. Crowdsourcing and Research with Human Subjects
Question: For crowdsourcing experiments and research with human subjects, does the paper include the full text of instructions given to participants and screenshots, if applicable, as well details about compensation (if any)?
Answer: [NA]
Justification:
Our paper does not involve crowdsourcing nor research with human subjects.
Guidelines:
The answer NA means that the paper does involve crowdsourcing nor research with human subjects.
Including this information in the supplemental material is fine, but if the main contribu- tion of the paper involves human subjects, then as much detail as possible should be included in the main paper.
According the NeurIPS Code of Ethies, workers involved in data collection, curation, or other labor should be paid at least the minimum wage in the country of the data collector.
15. Institutional Review Board (IRB) Approvals or Equivalent for Research with Human Subjects
Question: Does the paper describe potential risks incurred by study participants, whether such risks were disclosed to the subjects, and whether Institutional Review Board (IRB) approvals (or an equivalent approval/review based on the requirements of your country or institution) were obtained?
Answer: [NA]
Justification:
Our paper does not involve crowdsourcing nor research with human subjects.
Guidelines:
The answer NA means that the paper does not involve crowdsourcing nor research with human subjects.
Depending on the country in which research is conducted, IRB approval (or equivalent) may be required for any human subjects research. If you obtained IRB approval, you should clearly state this in the paper.
We recognize that the procedures for this may vary significantly between institutions and locations, and we expect authors to adhere to the NeurlPS Code of Ethics and the guidelines for their institution.
For initial submissions, do not include any information that would break anonymity (if applicable), such as the institution conducting the review.
21


Reviews:
[{"review_id": "sj4hxDpJSg", "reviewer": "Reviewer_uyY9", "summary": "This paper aims to enhance the robustness of SNN. The authors first present a unified framework for SNN robustness. They propose a frequency encoding method that filter the noise in frequency domain. Based on that, they also propose the trainable leaky parameter to better constrain robustness. Experimental results on various datasets validate that both our FE and EL methods can effectively improve the robustness of SNN to different noises.", "questions": "See in weaknesses", "limitations": "Authors are encouraged to introduce the additional training/inference cost of the proposed method.", "rating": 4, "confidence": 5, "soundness": 1, "presentation": 2, "contribution": 2, "strengths": "The frequency encoding method is novel. The FE-SNN is able to filter out noise by processing information in the frequency domain.\n\nThe authors conducted very comprehensive experiments to demonstrate the effectiveness of the proposed method. The experiments results demonstrate that FEEL can be combined with adversarial training or other robustness enhancement algorithms to obtain more robust SNNs.", "weaknesses": "The theoretical framework is not rigorous enough. It is not obvious from Eq. 6 that a smaller TERM 1 (term 1) will result in less perturbation in the output, since the change of term 1 may affect $$. The authors need more solid theory to support the FE and EL methods.\n\nThe robustness improvement is not significant. Sometimes robustness performance of FEEL is even worse than FE.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "### **1. Could the authors explain more about why a smaller leak factor will increase robustness based on Eq. 6, since the change of term 1 may affect other terms in Eq. 6?**\nWe would like to discuss how the leak factor affects other terms in Eq. 6 in two cases: 1) leak factor $\\lambda$ as a hyperparameter predefined before neural network training and 2) leak factor $\\lambda$ as a learnable parameter during neural network training (the proposed implementation).\n\n1) CASE 1: $\\lambda$ is a **fixed value** during neural network training (similar to $\\epsilon$ in term 1). Hence, it **will not affect other terms** in Eq. 6. To validate the correctness of our theoretical framework ($i.e.$, smaller term 1 results in less perturbation in the output), we conduct additional experiments, training different neural networks with **different fixed** $\\lambda$ (keep the remaining settings the same as that reported in experimental settings in the main paper). As results shown in Tab. R1 (rebuttal appendix), a smaller $\\lambda$ results in a more robust model, indicating that **smaller term 1 results in less output perturbation**. As can also be observed from Tab. R1 (rebuttal appendix), a smaller $\\lambda$ could bring performance degradation for clean inputs, $i.e.$, from 92.26% at $\\lambda=1.0$ to 81.76% at $\\lambda=0.0$. Therefore, we implement the leak factor as a learnable parameter to mitigate performance degradation.\n\n2) CASE 2: $\\lambda$ is a **learnable parameter** updated within neural network training. It is not easy to directly analyze the influence of $\\lambda$ on other terms in Eq. 6 due to their complex relationship. Therefore, we analyze the influence by **validating whether term 1 for robustness improvement affects term 2 or term 3's effectiveness** for the same goal. To be specific, as analyzed in line 160, RAT [9] (weights regularization) is essentially minimizing term 2. We implement another comparison method which is implemented by adding a gradient constraint via the L2 norm (gradient penalty regularization (GP), same implementation as that in [D]) to minimize term 3. We compare these two methods to two alternatives of our methods. These two alternatives are implemented by additionally optimizing $\\lambda$ for methods RAT and GP (keeping remaining parts unchanged), represented as RAT+EL and GP+EL, respectively. As shown in Tab. 1 (main paper) and Tab. R1, Tab.R2 (rebuttal appendix), RAT+EL and GP+EL significantly improve the robustness of RAT and GP, across different attack types and datasets, respectively. These results show that leveraging term 1 for robustness improvement does not interfere with term 2 or term 3’s effectiveness for the same goal, indicating that the leak factor does not affect other terms in Eq. 6.\n\nIn summary, results in both cases indicate that the leak factor does not affect other terms in Eq. 6 on SNN robustness.  We would like to discuss this with you in the reviewer-author discussion period if you have further questions.\n\n### **2. The robustness improvement is not significant. Sometimes robustness performance of FEEL is even worse than FE.**\n\nWe would like to show that our robustness improvement is consistent and significant in two aspects. Kindly note that FE is essentially to fix $\\lambda=1$.\n\n1) Consistent improvement over FE by an alternative implementation for **all attack types**. As discussed in our response to **Question 1**, an alternative implementation is to strictly adhere to the theoretical framework of Eq. 6, $i.e.$, set the leak factor to 0. As can be observed from Tab. R1 (rebuttal appendix), FEEL ($\\lambda=0.0$) can achieve consistent robustness improvement over FE. This observation validates the effectiveness of our theoretical framework.\n\n2) Significant improvement over FE and SOTA methods by the proposed implementation for **average performance across different attack types** ($i.e.$, FGSM, PGD, BIM, and CW). As can be observed from Fig. 3 and Fig. 4 (main paper), FEEL significantly outperforms FE (black: 6.8% over 4.2%, white: 10.8% over 4.9%, CIFAR10, VGG11, T=4). Furthermore, as described in Tab. 1 (main paper), the average improvement of StoG+FEEL (5.8%) and StoG+FE (4.6%) are **1.6 and 1.2 times larger** than the improvement achieved by the SOTA method StoG [11] over vanilla method (3.6%).\n\n### **3. The additional training/inference cost of the proposed method.**\n\nWe would like to introduce the training/inference cost of our method in terms of 1) Training/inference time and 2) Convergence speed comparison and analysis.\n\n1) **Training/inference time**. Tab. R3  (rebuttal appendix) presents the training/inference time of the proposed method and other SOTA methods, which demonstrates that the training time added by our method is less than other methods, under the same experimental settings (detailed in lines 218, 450-454 in the main paper). Compared to StoG [11], which optimizes additional stochastic gating factors for SNN robustness, our method demonstrates more efficient training times.\nParticularly, our method has a significant advantage over adversarial training methods such as AT [13] and RAT [9], since our method does not need additional adversarial data for training. \n\n2) **Convergence speed comparison and analysis**. As shown in Fig. R2 (rebuttal appendix), incorporating our FEEL module results in faster convergence of the training loss. This may be due to the fact that our EL increases the learning ability of the network, making it converge faster.  \n\nIn summary, these observations further confirm the superiority of our approach in terms of training and inference costs.", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "muIHTz8plr", "reviewer": "Reviewer_yJ85", "summary": "This paper presents a unified framework for SNN robustness, based on this framework, this paper further proposes a frequency encoding (FE) method for SNNs to decrease the input perturbations and proposes an evolutionary membrane potential leak factor (EL) to ensure that different neurons in the network learn the optimal robustness leak factor at different time steps, thus improving the robustness of SNNs. Extensive experiments are conducted to verify the effectiveness of this method.", "questions": "please refer to the weakness", "limitations": "Yes", "rating": 7, "confidence": 5, "soundness": 3, "presentation": 3, "contribution": 3, "strengths": "1. The authors present a unified framework for SNN robustness constraints, which provides a potential explanation for the robustness improvements achieved by previous work and inspires enhancements in the encoding method and the leak factor for SNN robustness.\n\n2. The proposed FEEL method crops information from high-frequency to low-frequency to remove the input noise and learn the optimal robustness leak factor at different time steps. The extensive results demonstrate that the FEEL method is state-of-the-art. Both the FE and EL methods further enhance the robustness of current defense strategies.", "weaknesses": "1. The Frequency Encoding (FE) is proposed to suppress the perturbation $\\varepsilon (t) $ in Eq. (6). The implementation of FE is based on the cropping operation in Eq. (9). Although such an implementation gives the benefit of $\\varepsilon (t) $ suppression for $T>1$, it also brings the drawback of valid information loss. It is not clear whether the benefits outweigh the drawbacks or vice versa. Please provide more evidence or analysis to support the performance improvement by FE (as compared with direct coding) in Table 2.\n\n2. Section 4.3 introduces the implementation of considering leak factor  $\\lambda$ in the first term of Eq. (6). According to the objective of Eq. (6), an intuitive approach is to minimize  $\\lambda$. However, the authors proposed a learnable leak factor, which seems to contradict this intuitive approach. Please clarify it.\n\n3. There is a new attack method [1] specifically designed for SNNs which outperforms attacks designed for ANNs. I wonder how the proposed method in this paper performs under such a kind of attack. \n\n[1] Bu T, Ding J, Hao Z, et al. Rate gradient approximation attack threats deep spiking neural networks. Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition. 2023: 7896-7906.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "### **1. Please provide more evidence or analysis to support the performance improvement by FE.**\n\nWe would like to show our FE not only improves defense accuracy but also maintains clean accuracy from both **data observation** and **additional experimental validation**.\n\n1) **Data observation**. We visualize the frequency spectrums of CIFAR10 images alongside the added GN, FGSM, PGD, BIM, and CW noise in Fig. R1 of the rebuttal appendix. As illustrated in Fig. R1, the information of the original image is concentrated in the low-frequency region (center area of the second column), while the noise information spans from low-frequency (center area) to high-frequency (edge area) regions (third to fifth columns). The proposed FE removes noise by progressively cropping information from high-frequency to low-frequency regions over time steps. (as $r$ in Eq. 9 of the main paper gradually decreases over time). Since the information of the original image is concentrated in the low-frequency region, this method minimizes the loss of valid information from the original image.\n\n2) **Experimental validation**. To further verify the effectiveness of FE, we compare it with an alternative strategy, Inverse-FE (IFE), which crops information from low-frequency to high-frequency over time steps. As shown in Tab. R6 below, IFE causes a significant drop in clean accuracy (64.81% vs. vanilla 92.64%). This demonstrates that a substantial amount of valid information is lost, verifying that valid information is concentrated in the low-frequency area. In contrast, FE not only effectively removes noise (21.56% vs. vanilla 15.59% when under PGD attack) but also minimizes the loss of valid information (92.26% vs. vanilla 92.64%).\n\n**Table 6: Performance (%) of the proposed Frequency Encoding (FE) and the alternative strategy Inverse-FE (IFE). The perturbation $\\epsilon=4/255$ for all attacks, and iterative step $k=4$, step size $\\alpha=0.01$ for PGD. The dataset is CIFAR10 with time step $T=4$, the network is VGG11.**\n|Method|Clean|GN|FGSM|PGD|BIM|CW|\n|:-:|:-:|:-:|:-:|:-:|:-:|:-:|\n|Vanilla|92.64|91.28|35.47|15.59|14.95|6.92|\n|IFE|64.81|64.48|12.33|4.44|4.25|4.18|\n|FE|92.26|92.02|39.67|21.56|21.05|10.12|\n||||||||\n\n### **2. Please clarify why not minimize $\\lambda$ directly.**\n\nWe did not minimize $\\lambda$ directly as it would negatively impact clean accuracy on original images. This is supported by both **theoretical analysis** and **experimental validation**.\n\n1) **Theoretical analysis**. According to Eq. 2 of the main paper, the leak factor controls the residual membrane potential between time steps. A smaller leak factor may lead to a weakened temporal modeling capability of the SNN, leading to a decline in network performance [A]. Considering the leak factor's dual role in original information transmission (Eq. 2) and robustness enhancement (Eq. 6), we propose an evolutionary leak factor (EL). The EL dynamically learns the optimal robustness leak factor across different time steps and neurons, which also increases the expression capability of SNN, helping maintain clean accuracy and improving robustness.\n\n2) **Experimental validation**. We compare EL with two alternative strategies. The first strategy sets all leak factors to 0. The second strategy, adds L2 regularization to the EL to further constrain the leak factor. As shown in Tab. R1 of the rebuttal appendix, a small leak factor significantly reduces clean accuracy (vanilla  92.64% vs. FEEL ($||\\lambda||_2$) 88.52% vs. FEEL ($\\lambda=0.0$) at 81.76%), consistent with theoretical analysis above. Besides, a small leak factor does increase the robustness of SNN ($e.g.$, under PGD attack, FEEL ($\\lambda=0.0$) is 63.80%, FEEL ($||\\lambda||_2$)  is 29.98%, compared to vanilla 15.59%). This also aligns with the proposed robustness framework (Eq. 6) by demonstrating that controlling the leak factor improves robustness. And our EL method ensures improvements in both robustness and original accuracy ($e.g.$, the PGD defense accuracy of FEEL (learnable $\\lambda$) is 30.27%, compared to 15.59% for vanilla, and the clean accuracy of FEEL (learnable $\\lambda$) is 92.73%, compared to 92.64% for vanilla).\n\n### **3. The performance of the proposed method when under RGA attack[B].**\n\nWe expand the results in Tab. 1 of the main paper with the RGA strategy [B]. As results shown in Tab. R4 of the rebuttal appendix, under a PGD attack with RGA, AT+FEEL improves accuracy to 10.83%, compared to 8.57% for AT alone. Similar improvements are observed with other attacks. These results confirm that our methods (FE and FEEL) achieve state-of-the-art defense accuracy and enhance the robustness of existing approaches, even against SNN-specific attacks. This is because our FEEL method, which introduces frequency encoding and learnable leak factors, increases the complexity of spiking neurons, effectively countering attacks.", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "cfFC55grMu", "reviewer": "Reviewer_zYHj", "summary": "This article proposes a robust algorithm for spiking neural networks. The algorithm includes a frequency-domain filter with a hard threshold and trainable neuron leakage parameters. The author's motivation in organizing the paper is based on biological interpretability, adopting an engineering approach in methodology, and attempting to propose a unified, robust framework for spiking neural networks. The author combines multiple previous methods in the experiment and provides better robustness results under adversarial disturbances.", "questions": "How did the author train a network containing frequency domain filtering (FE)? What backpropagation method is currently used by the author to propagate the direction of the FE module (such as what method is used, what tools are used, and what is the speed of backpropagation)?\n \nAlthough the FE module proposed by the author improves the robustness of spiking neural networks, I would like to ask if FE will disrupt the low energy consumption characteristics of spiking neural networks. After all, frequency domain filtering seems to be more suitable in combination with traditional CNN, and the calculations here are not sparse.\n \nWhen conducting white box and black box attacks, I believe it is necessary for the adversarial model with and without FE modules to be used as attack models in the validation of the paper.", "limitations": "See weakness and questions", "rating": 5, "confidence": 5, "soundness": 2, "presentation": 3, "contribution": 2, "strengths": "The author provides better robustness against disturbances. The method was verified by the author in GN FGSM, PGD, BIM, and CW.\n\nI think the author's motivation is very important and urgent, consistent with the interests of NeurIPS.", "weaknesses": "The author proposes that the robustness of SNN lacks theoretical analysis, but in reality, the theoretical analysis provided by the author is not significantly different from the theoretical analysis in StoG. The conclusions presented in the paper corresponding to the StoG method are similar to the theory proposed by the author. The innovation point here is not clear.\n \nThe author proposes that frequency encoding is based on cognitive motivation, i.e., selective visual attention mechanism, rather than coding level, which is inconsistent with the motivation behind the dynamic innovation points of variable dynamic parameters proposed later.\n \nThe two methods proposed by the author, FE and EL, did not conduct a detailed ablation study to determine the effectiveness of the module. Especially lacking in the performance of using the EL method alone.\n \nWhat is the difference between the El method proposed by the author and the method proposed by Ding et al. in ICML 2024?\n[Ding et al., 2024] https://arxiv.org/abs/2405.20694.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "### **1. The innovation point of this work is not clear compared with StoG [11].**\nWe highlight the innovation of our theoretical analysis compared to StoG from two key perspectives:\n\n1. **Theoretical focus**. For the regularizer $|\\epsilon \\odot \\nabla_x \\mathcal{L}(x)|_1$ in Eq. 5, StoG focuses on **perturbation constraints during SNN signal transmission**. In contrast, we analyze the effects of **input noise** and spiking neuron parameters on this regularizer (shown in Eq. 6). This shift in focus allows us to explore how these factors theoretically constrain the regularizer, offering a different perspective on enhancing robustness.\n\n2. **Implementation of theoretical framework**. Unlike StoG's stochastic gating factor, we introduce a **frequency encoding method to eliminate perturbation inputs**. Tab. 1 (main paper) shows our method further enhances StoG's robustness, demonstrating that our method and idea do not conflict with StoG. Moreover, while prior studies empirically explored parameters like firing threshold [12] and leak factor [31] on SNN robustness, our robust constraint framework offers a theoretical basis for these findings.\n\nIn summary, our work advances the theoretical understanding of input noise and spiking neuron parameters to SNN robustness and proposes an innovative frequency encoding method. We will update our revised version to state the contribution of the adversarial loss constraint introduced in StoG to our theoretical analysis while emphasizing the distinctions and innovations of our approach.\n\n### **2. The cognitive motivation of FE is inconsistent with dynamic parameters proposed later.**\nThe concept of selective visual attention in [8] is described as \"visual attention focuses on one region of the visual field at a time\", closely resembling the retinal coding rather than a cognitive process, as described in lines 173-174. Inspired by this, we propose FE to capture different frequency information at different time steps in SNNs, and EL is used to better learn the correlation between information of different frequencies across time steps.\n\nFurthermore, FE and EL methods are two contributions of our work, which can be used independently and in combination to further improve the robustness of SNNs.\n\n### **3. Lack of performance when using the EL method alone.**\nWe have now included the performance of our EL alone in Tab. R2 of the rebuttal appendix. It is evident that both FE and EL effectively enhance the robustness of the original methods, with FEEL further improving robustness on this foundation. For instance, under a PGD attack, the original RAT method achieves 8.87% accuracy, while our FE increases robustness to 9.70%, EL to 11.39%, and FEEL to 12.36%. This illustrates the effectiveness of each module of our method.\n\n### **4. What is the difference between the EL method and DLIF [C]**\nOur EL and DLIF [C] optimize the leak factor to improve SNN robustness but differ in **motivation** and **implementation**.\n\n1)  **Motivation**, DLIF uses a dynamic leak factor to reduce perturbation transmission, while our approach leverages it to capture correlations across time steps via frequency encoding, thus enhancing the learning capability of SNNs further against perturbations.\n2) **Implementation**, DLIF dynamically learns the leak factor at each time step but shares it across neurons within a layer. our EL learns the optimal leak factor across time steps and among individual neurons within the same layer, leading to greater robustness, as described in lines 74-78, 212-213.\n\nWhile both methods aim to enhance robustness through leak factor optimization, our EL method achieves superior results, as shown in Tab. R7. We will cite DLIF [C] in our revision to clarify the differences.\n\n**Table R7: Performance (white-box attack) comparison with DLIF[C] (CIFAR100 with the same experimental setting in Tab.1 of [C]).**\n|Method|Clean|FGSM|PGD|\n|:-:|:-:|:-:|:-:|\n|Vanilla+DLIF|70.79|6.95|0.08|\n|Vanilla+EL|71.41|9.16|1.29|\n||||||||\n\n### **5. How did the author train a network containing frequency domain filtering (FE)?**\nWe would like to clarify that our frequency masking operation is a data preprocessing step and does not participate in model training. As shown in Eq. 10 and Fig. 2a, after frequency mask crops information from high-frequency to low-frequency at different time steps (Eq. 7, 8, 9), the frequency domain images are converted back to the spatial domain images with varying frequency information at different time steps (Eq. 10). These images are then used for training. Therefore, our backpropagation method remains identical to standard training methods, using the surrogate gradient $\\frac{\\partial O}{\\partial u} = \\frac{1}{\\gamma^2} \\max \\left( 0, \\gamma - |u - V_{th}| \\right)\n$ based on BPTT rule. More training settings are detailed in lines 218, 450-454 of the main paper and in the code provided in Supplementary Materials.\n\n### **6. Whether FE disrupts the low energy consumption characteristics of spiking neural networks.**\nAs addressed in the previous question, our FE functions as a data preprocessing method and does not participate in model training. Therefore, FE does not disrupt the low-energy performance of SNNs.\n\n### **7. It is necessary for the adversarial model with and without FE modules to be used as attack models in the validation of the paper.**\nThanks for your suggestion. The relevant experiments are included in our main paper. Fig. 3 and Fig. 4 illustrate the performance of the vanilla model with and without FE under white-box and black-box attacks, respectively. Tab. 1 presents the performance of SOTA robust SNNs with and without FE under white-box attacks. We have now added the performance of adversarial models ($i.e.$, AT [13] and RAT [9]) with and without FE under black-box attacks in Tab. R5 of the rebuttal appendix. All experimental results confirm that FE effectively enhances the robustness of the model.", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}]

Author rebuttal:
We appreciate all the reviewers for the insightful feedback.  We are encouraged that they recognize the significance and urgency of our motivation [Reviewer zYHj], the novelty [Reviewer uyY9] and effectiveness [Reviewer zYHj] of our method, and the comprehensiveness [Reviewer uyY9] and extensiveness [Reviewer yJ85] of our experiments.

In response to each reviewer's comments, we have provided point-by-point replies in the corresponding sections. Figures R1-R2 and Tables R1-R5 referenced in our rebuttal are included in the **newly uploaded Rebuttal Appendix PDF**. The references are listed below. 

We will add all additional discussions and results to the final version of our paper and release relevant codes for the reproducibility of all experiments.

Welcome further discussion during the reviewer-author discussion period if there are any additional questions.


**References**

[8] Desimone, R., & Duncan, J. (1995). Neural mechanisms of selective visual attention. Annual review of neuroscience, 18(1):193–222.

[9] Ding, J., Bu, T., Yu, Z., Huang, T., & Liu, J. (2022). Snn-rat: Robustness-enhanced spiking neural network through regularized adversarial training. Advances in Neural Information Processing Systems, 35:24780–24793.

[11] Ding, J., Yu, Z., Huang, T., & Liu, J. K. (2024) Enhancing the robustness of spiking neural networks with stochastic gating mechanisms. In Proceedings of the AAAI Conference on Artificial Intelligence, volume 38, pages 492–502.

[12] El-Allami, R., Marchisio, A., Shafique, M., & Alouani, I. (2021, February). Securing deep spiking neural networks against adversarial attacks through inherent structural parameters. In 2021 Design, Automation & Test in Europe Conference & Exhibition (DATE) (pp. 774-779). IEEE.

[13] Goodfellow, I. J., Shlens, J., & Szegedy, C. (2014). Explaining and harnessing adversarial examples. arXiv preprint arXiv:1412.6572. 

[31] Sharmin, S., Rathi, N., Panda, P., & Roy, K. (2020). Inherent adversarial robustness of deep spiking neural networks: Effects of discrete input encoding and non-linear activations. In European Conference on Computer Vision, pages 399–414. Springer. 

[A] Rathi, N., & Roy, K. (2021). Diet-snn: A low-latency spiking neural network with direct input encoding and leakage and threshold optimization. IEEE Transactions on Neural Networks and Learning Systems, 34(6), 3174-3182. 

[B] Bu, T., Ding, J., Hao, Z., & Yu, Z. (2023). Rate gradient approximation attack threats deep spiking neural networks. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (pp. 7896-7906).

[C] Ding, J., Pan, Z., Liu, Y., Yu, Z., & Huang, T. (2024). Robust Stable Spiking Neural Networks. In International Conference on Machine Learning.

[D] Gulrajani, I., Ahmed, F., Arjovsky, M., Dumoulin, V., & Courville, A. C. (2017). Improved training of wasserstein gans. Advances in neural information processing systems, 30.

Meta-review: This paper presents a unified framework for SNN robustness, based on this framework, this paper further proposes a frequency encoding (FE) method for SNNs to decrease the input perturbations and proposes an evolutionary membrane potential leak factor (EL) to ensure that different neurons in the network learn the optimal robustness leak factor at different time steps, thus improving the robustness of SNNs. Experiments were conducted to verify the effectiveness of this method. Concerns were raised during review about theoretical aspects, novelty and validation, which were largely addressed in rebuttal.
Decision: Accept (poster)