HoSNNs: Adversarially-Robust Homeostatic Spiking Neural Networks with Adaptive Firing Thresholds
Authors: Hejia Geng
Peng Li
Venue: Accepted by TMLR ()

Abstract: While spiking neural networks (SNNs) offer a promising  neurally-inspired model of computation, they are vulnerable to  adversarial attacks. We present the first study that draws inspiration from neural homeostasis to design a  threshold-adapting leaky integrate-and-fire (TA-LIF) neuron model and utilize TA-LIF neurons  to construct the adversarially robust homeostatic SNNs (HoSNNs) for improved robustness. The TA-LIF model incorporates a self-stabilizing dynamic thresholding mechanism, offering a local feedback control solution to the minimization of each neuron's membrane potential error caused by adversarial disturbance.   Theoretical analysis demonstrates favorable dynamic properties of TA-LIF neurons in terms of  the bounded-input bounded-output stability and suppressed time growth of membrane potential error, underscoring their superior  robustness compared with the standard LIF neurons. When trained with weak FGSM attacks (\(\epsilon = 2/255\)), our HoSNNs significantly outperform conventionally trained LIF-based SNNs across multiple datasets. Furthermore, under significantly stronger PGD7 attacks (\(\epsilon = 8/255\)), HoSNN achieves notable improvements in accuracy, increasing from 30.90% to 74.91% on FashionMNIST, 0.44% to 36.82% on SVHN, 0.54% to 43.33% on CIFAR10, and 0.04% to 16.66% on CIFAR100.

Published in Transactions on Machine Learning Research (03/2025)
HoSNNs: Adversarially-Robust Homeostatic Spiking Neural Networks with Adaptive Firing Thresholds
Hejia Geng
hejia@ucsb.eli edu
Deportment of Electrical and Computer Engineering University of California, Santa Barbara
Peng Li
lip&ucsb. edu
Deportment Electrical and Computer Engineering University of California, Santo Barbara
Reviewed on OpenReview: https: // openrvieew. net/ met/ forum? id= UV58h.yyge
Abstract
While spiking neural networks (SNNs) offer promising neurally-inspired model of compu- tation, they are vulnerable to adversarial attacks. We present the first study that draws inspiration from neural homcostasis to design a threshold-adapting lcaky integrate-and-fire (TA-LIF) neuron model and utilize TA-LIF neurons to construct the adversarially robust homeostatic SNNs (HoSNNs) for improved robustness. The TA-LIF model incorporates a self-stabilizing dynamic thresholding mechanism, offering local feedback control solution to the minimization of cach ncuron's membrane potential error caused by adversarial distur- bance. Theoretical analysis demonstrates favorable dynamic properlies of TA-LIF neurons in terms of the bounded-input bounded-output stability and suppressed time growth of mem- brane potential error, underscoring their superior robustness compared with the standard LIF neurons. When trained with weak FGSM attacks (e = 2/255), our HoSNNs significantly outperform conventionally trained L.F-based SNNs across multiple datasets. Furthermore, under significantly stronger PGD7 attacks (e 8/255), HoSNN achieves notable improve- ments in accuracy, increasing from 30.90% to 74.91% FashionMNIST, 0.44% to 36.82% on SVHN, 0.54% to 43.33% on CIFAR10, and 0.04% to 16.66% CIFAR100.
1 Introduction
While neural network models have gained widespread adoption across many domains, glaring limitation of these models has also surfaced vulnerability to adversarial attacks (Szegedy et al., 2013 Madry et al. 2017). Subtle alterations in the input trick well-tuned neural network into producing misleading predictions, particularly for mission-criticall applications (Chakraborty et al., 2018). This vulnerability is shared by both artificial neural networks (ANNs) and spiking neural networks (SNNs) Sharmin et al. 2019 2020 Ding et al. 2022), and stands in stark contrast to the inherent robustness biological nervous systems, prompting interesting questions: Why the human brain immune to such adversarial noise? Can we leverage biological principles to bolster the resilience of artificial networks?
Motivated by these questions, we offer
perspoctive that connects adversarial robustness with homco- static mechanisms prevalent in living organisms. Homeostasis maintains essential regulatory variables within
life-sustaining range (Bernard 1865 Cooper 2008 Pennazio 2009 Jänig 2022), and is crucial for sta-
bilizing neural activity (Turrigiano & Nelson 2004),
supporting neurodevelopment (Marder & Goaillard Modell et al. 2015). Although
2006), and minimizing noisy information transfer (Woods & Wilson 2013
some udues have investigated homeostasis in SNNs, such as the generalized lesky-integrate-add-fre (GLIF)
* CCorespoondig author

---

Published in Transactions on Machine Learning Research (03/2025)
u
U
Average entire dataset
Collection of the entire network
Different samples' membrane potential dynamics
Neurons's Neural Dynamic Signature (NDS)
Network's Neural Dynamic Signature
Heat map of neural activity emror in pemaltimate layer (512 neurons)
(a)
SNN with under clean input:
UnRobust SNN, Clean inpur,
6.03
Zero error
Correct classification
6445
Clean
Distribution
SNN with LIF under
UnRobust SNN, Adversarial input,
(b)
0013
Large orror
Wrong classification
HoSNN with TA-LIF under attack:
Robust HoSNN, Adversarial input,
Adversarial Distribution
(c)
Small error
6,000
Correct classification
U
Neural Dynamic Signature
Dynamic update of threshold
Vi
Dynamic Threshold
Homeostatic regulation
U
Stabilized neural activity
Figure 1: Proposed threshold-adapting leaky integrate-and-fire (TA-LIF) neuron model and homeostatic SNNs (HoSNNs). (a) We leverage LIF SNN trained using clean data to collect neural dynamic signatures (NDS) as an anchor for the HoSNN (shown in the box above). (b) Adversarial inputs can cause large mem- brane potential deviations from the NDS in deep layers of LIF SNNs, leading to incorrect model predictions. (c) Homcostatic dynamic threshold voltage control HoSNNs anchors neural activity based on the NDS, resulting improved robustness.
models (AllenInstitute) 2018 Bellec al. 2018 2020 Teeter al. 2018 no prior work has connected
homeostasis with adversarial robustness.
We aim to close this gap by exploring online biologically-plausii defense solution based on homeostasis. The proposed approach differs from common practices such as adversarial training in a major way, it explicitly builds a localized neural-level self-adapting feedback mechanism into the dynamic operation of the proposed HoSNNs. We view the time-evolving state, i.e., membrane potential (4(a))) of each spiking neuron i in a well trained network as its representation of the semantics of the received clean input J. Porturbed membrane potential un (t((z') resulting from an adversarial input x' corresponds to distorted semantics and can ripple through successive layers to mislead the network output (Li et al. 2021 Rabanser et al.) 2019 Nadhamuni 2021 Shu et al.] 2020; Fawzi et al. 2016 Ford et al. 2019 Kang et al. 2019 Tlyas et al. 2019a). For a given pair (x, x we ensure adversarial robustness by minimizing the total induced membrane potential perturbation (xr,
We address two practical challenges encountered formulating and solving this error minimization problem. Firstly, during inference the clean membrane potential u<tlzz) reference is unknown. As shown in Fig a). define Neural Dynamic Signature (NDS), the neuron's membrane potential averaged given clean
2

---

Published in Transactions on Machine Learning Research (03/2025)
training dataset D, to provide reference for anchoring membrane potential. Secondly, since externally generated attacks are not known priori, it is desirable to suppress the perturbation of each neuron's 's membrane potential in an online manner as shown in Fig [bb. For this, we propose new threshold- adapting leaky integrate-and-fire (TA-LIF) model with a properly designed firing threshold voltage dynamics that serves as homeostatic control to suppress undesirable membrane potential perturbations, as shown in Fig Tec) We theorctically analyze the dynamic propertics of TA-LIF neurons in terms of the bounded- input bounded-output stability and suppressed time growth of membrane potential error, underscoring their superior robustness compared with the standard LIF neurons.
We visualize the working of the proposed HoSNNs versus standard LIF-based SNNs in image classification While the adversarial images generated by the Projected Gradient Descent (PGD) (Madry et al. 2017 attack can completely mislead the attention the LIF SNN, the proposed homeostasis helps the HoSNN focus on parts of the input image strongly correlated with the ground truth class label, leading to significantly improved adversarial robustness as described later.
using several CIFAR-10 images in Figure 2
Original
Clean
PGD
Original
Clean
PGD
Original
Clean
PGD
Original
Clean
PGD
SNN
HoSNN
Figure 2: The heatmaps generated by Grad-CAM (Selvaraju et al. 2019) highlight the regions of the input image that most significantly influence the classification decisions of standard SNN and proposed HoSNN based on the VGG architecture for a set of CIFAR-10 images. The adversarial images are generated using PGD7 with strength of = 6/255. HoSNN can still maintain attention to the target object under attack.
2 Background
2.1
Adversarial Attacks
Two notable adversarial attack techniques are the Fast Gradient Sign Method (FGSM) [Goodfellow et al. 2014h and Projected Gradient Descent (PGD) (Madry et al. 2017) method. Let x be an original input, y/ be the true label, L(O, x, y) the loss function with network parameters 0, and e a small perturbation magnitude, FGSM generates a perturbed imput, or an adversarial input example x' by: x' = x + PGD essentially an iterative FGSM. With 2n as the perturbed input in the n-th iteration and the step size, Projate() as the projection within the e-ball of æ, PGD updates the input by: 2n+1 Projute (zn + vign(V In. 8)]}. Other moddient-based attacks such the RFGSM (Tramer et al. 2017), Basic Iterative Method (BIM) (Kurakin et al. 2018), and DeepFool (Moosavi-Dezfooli el al.) 2016 work in a similar fashion, APGD (Croce & Hein 2020b). Beyond gradient- based methods, a significant area of concern is black-box attacks (Biggio & Roli 2018).
(0, x, v)].
Some recent studies focused on delivering more powerful allacks in SNNs. Bu el al. (2023) proposed RGA, which leveraged rate-coding in LIF neurons generate more effective adversarial attacks with time- extended enhancement. Hao et al. (2024) proposod HART, which leveraged hybrid gradient caleulation that simultaneously incorporates rale-based gradients and timing-based temporal gradients on SNNs.
2.2 Defense Methods
Adversarial training is one of the most widely adopted defense methods (Madry et al.) 2017). which retrains model by using a mixture of clean and adversarial examples. Randomization (Xie et al.) 2017) introduces stochasticity during inference and can circumvent precise adversarial attacks. The projection technique of MMsstaaa et al. 2019) reverts adversarial attacks back to a safer set. Lastly, one may first detect the presence
3

---

Published in Transactions on Machine Learning Research (03/2025)
of adversarial attack and subsequently cope with it (Metzen et al.
2017a However, these defense methods are not free of limitations (Akhtar & Mian 2018). Adversarial training relies on precise gradient information and is not biologically plausible (Lillicrap et al. 2020). Randomization, projection, and detection strategies do not fundamentally address the inherent vulnerabilities of ANNs.
2.3 Spiking Neuron Models
SNNs allow for spike-based communication and computation (Furber et al. 2014 Gerstner & Kistler 2002; Deng et al.) 2020) and often leverage the Leaky Integrate-and-Fire (LIF) model for each neuron with the membrane time constant Tm:
du;(l) (((() + Ti()) - Tm (L)V (1),
(1)
Tm dt
where (I( the membrane potential, [(()) & R E, (1)ay(1) represents the input and defined as the sum of the pre-synaptic currents; Way represents the synaptic weight from neuron j to i; Vil (t) is the firing threshold of neuron i al time l. Neuron i's postsynaplic spike train is:
st( = +00
if (1) 2 V1)(() = 55(t -(tt-1)
(2)
0
otherwise
where d() is the Dirac function, and of is a postsynaptic spike time. With Tn denoting the synaptic time constant, the evolution of the generated postsynaplic current (PSC) (1))) is described by:
daz(1) = (a dt
(3)
The LIF model uses constant firing threshold. Generalized LIF (GLIF) models employ a tunable threshold with short-term memory, which increases with every emitled output spike, and subsequently decays expo-
nentially back to the baseline threshold (AllenInstitute) 2018 Bellec et al.) 2018 2020 Teeter al. 2018).
However, these models neither consider adversarial robustness nor provide mechanisms to discern 'abnormal" from 'normal' neural activity.
2.4 Spiking Neural Networks Robustness
Pei el al. 2019 emn pirical studies have demonstrated that SNNs exhibit similar susceptibilities to adversarial attacks (Shammin
While there's been growing interest in spiking neural networks (Imam & Cleland 2020:
ct al.
2019 Ding et al. 2022). line of rescarch has explored porting defensive stratogics developed for ANNs to SNNs. To improve the robust of SNNs, Kundu al. (2021) proposed a SNN training algorithm jointly optimizing firing thresholds and weights, and [iang et al. (2022) proposed certified training. Ding
et al. (022) enhanced adversarial training by using a Lipschitz constant regularizer. Özdenizei & Legenstein
(2023) introduces adversarially robust ANN-to-SNN conversion algorithm that initializes the SNN with adversarially pre-trained ANN weights, followed by robust fine-tuning. Liu et. al. (2024) improved SNN's adversarial robustness by adding a gradient sparsity regularization term in the loss function. However, these methods have not fully addressed the challenges of ensuring adversarial robustness. Additionally, they are computationally expensive and lack biological plausibility.
Another rescarch direction has focused on studying the inherent robustness of SNNs not scen in their ANN counterparts, and factors impacting robustness. (Sharmin et al. (2020) recognized the inherent resistance of SNNs to gradient-based adversarial attacks. El-Allami et al. (2021) investigated the impact of key network
parameters such as firing voltage thresholds on robustness. Chowdhury et al. (2021) ) demonstrated the LIF
model's noise-filtering capability. Li et al. (2022) explored network inter-layer sparsity. Xu et al. (2022) examined the elfects of surrogate gradient techniques on white-box attacks. While these studies have shed light on aspects of SNNs relevant to robustness, effective defense strategies are yet to be developed.
Similar to ours, some studies improve robustness from stability and biological and rational perspectives. Ding et al. 2024a) enhanced adversarial robustness by reducing the mean square of perturbations in the last
4

---

Published in Transactions on Machine Learning Research (03/2025)
neuron layer. Inspired by Stochastic Gating Mechanisms, Ding et al. (2024b) introduced randomness into spike transmission by simulating the probabilistic opening and closing of synaptic and ion channel gates. The fundamental differences between our work and theirs are: 1.We adjust the threshold in a passive and online manner instcad of delibcrately adding additional optimization loss terms to the loss function as (Ding ct al. 2024a), which significantly reduces the additional calculations for training and inference. 2.Our method does not introduce additional randomness as (Ding et al. 2024b). Thus, our method can retain high clean accuracy and ensures that the robustness does not come from gradient obfuscation (Athalye et al. 2018).
3 Method
We present the first study that draws inspiration from neural homeostasis to design threshold-adapting leaky integrate-and-fre (TA-LIF) neuron model and utilize TA-LIF neurons to construct the adversarially robust homeostatic SNNs (HoSNNs) for improved robustness.
3.1 Adversarial Robustness as a Membrane Potential Error Minimization Problem
In a well-trained network, we view the time-evolving state, i.e., membrane potential (z((|z)) of each spiking neuron i, over T' timesteps as its representation the semantics of the received clean input æ. An adversarial input x' = óz, 8.1. dar < e; where is the allack budget (strength), and da is a carefully crafted adversarial noise, may lead to a perturbed membrane potential (t()''),, which corresponds to distorted semantics and can ripple through succossive layers to mislead the network's 's decision (Li ct al.) 2021 Rabanser et al.) 2019:
Nachamuni 2021 Shu el al. 2020: Fawzi et al. 2016 Ford et al. 2019 Kang et al. 2019 Tyas et al. 2019a
For a given pair of (z, 2") one may ensure adversarial robustness of the network by minimizing the total induced membrane potential perturbation (, x") of all N nourons over T timesteps:
T
min (2, = ΣΣ
[u:(tl=') u.(((=)))))) 1|?
(4)
1= 2=
However, there exist two challenges in formulating and solving equation 4 Firstly, since the model is oblivious about the attack, it is impossible to determine how the adversarial input x' is generated, whether it has a corresponding clean input x, and what x is it exists. As such, (4(r)) is unknown, which serves as a clean reference equation R We address this problem by inducing the notion of Neural Dynamic Signature (NDS), the neuron's 's membrane potential averaged over given clean training dataset D, to provide an anchor for stabilizing membrane potential. Secondly, since externally generated attacks not known a priori, it is desirable to suppress the perturbation of each neuron's 's membrane potential in an online manner. For this, we propose a new type of spiking neurons, called threshold-adaptingg leaky integrate-and-fice (TA-LIF) neurons with a properly designed firing threshold voltage dynamics that serves as a homeostatic control to suppress undesirable membrane potential perturbations. We discuss these two techniques next.
3.2 Neural Dynamic Signature (NDS) as an Anchor
Eq 4 describes an 'ideal" optimization problem. When E,(,,')) = 0, all neuron activities under adversarial sample input are the same as normal sample input, this can cortainly achieve 'adversarial robustness" in theory, but it is impossible lo achieve in practice. There are two main limitations:(1) For a trained network, the intensity and type of attack are determined by external attackers, which means that x' has a huge range (2) For a trained network, the attack sample cannot be determined in advance, which means that it is impossible to obtain an accurate (z(t))). Under the constraints of these two problems, we still hope to adopt the idea of Eq 4 feasible approximation is that we use the available average value of the [[]] as an approximation of the unavailable (t(lz))
of variation.
training data set EZAD [t|x[]
We utilize a clean training dataset D anchor each spiking neuron i. While the membrane potential (,(t)z) shows variability across individual samples ær, its expected value over distribution D denoted by (1 act rcliable reference as illustrated in Fig [a):
u D) A EAAD (ewDD(u((((>))
(5)
5

---

Published in Transactions on Machine Learning Research (03/2025)
The Neural Dynamic Signature (NDS) of neuron i is defined temporal series vector over T timesteps: " (D) = [u] (4/P), "[ (l)1D).... uu (Ir|1))- (D) captures the average semantic activation across 'D. Adversarial perturbations induce input distributional shifts, leading to anomalous activation of out-of- distributional semantics. u (D) facilitates the identification of neuronal activation aberrations and further offers an anchor signal to bolster network resilience.
We also define the network-level NDS, (D) & (u,(D)) as the collection of NDS vectors in well- trained LIF-based SNN comprising N neurons. A densely populated SNN with N neurons typically has O(N2) weight parameters. In contrast, (D) scales O(NT). Recent algorithms have enabled training of high-accuracy SNNs with short latency operating over small number of time steps, c.g,, 5 to 10 (Zhang & Li b. Consequently, the storage overhead of NDS remains manageable.
While serving as an anchor signal, the dynamics of NDS provides a basis for under- standing the property of the proposed TA-LIF neurons. As NDS ug (1[D) of neuron i is derived from the well-trained LIF SNN, we take expectation of the LIF dynamic equation [ with a static firing threshold Vin across the entire training distribution 'D while simplifying the dynamics by approximating the effects of firing:
Dynamics of NDS
duf (d (t] + (t - T
Fm
(6)
dt
Here, (1)D) defines the average current input P x)], and (D) denotes the average firing rate EasDlSo for (x(t))) dt). tT
Hypothesis of NDS We hypothesize that in SNNs, the original neural activity within the training set holds reference significance for mitigating adversarial perturbations. This idea finds support in certain works within the Artificial Neural Network (ANN) domain, which suggest that detecting and modifying neuron activation values in feature space can alleviate adversarial issues (Silva & Najafirad 2020 Metzen et al.
2017b: Zhang et al. 2020). Some studies deny this view (Carlini & Wagnnrr 2017 Tramer 2022 Nlas et al,
2019b Li et al. 2021 In SNNs, whether membrane potential sequences can effectively address adversarial
attack problems remains unclear and needs further investigation.
Here we provide an intuitive understanding of NDS's effectiveness. Consider an adversarial sample x' = x + 8x, where the perturbation dr represents the adversarial attack. As the strength of the perturbation diminishes (5x - 0), the sample gradually converges to the original clean sample (a' + x)) Consequently, the neural activity of the attacked network, denoted as [(x',, will approach the clean neural activity, f(x),, i.e., fxx' + f(x). This alignment between the attacked and clean neural activity suggests that the network's classification result will likewise revert to the correct prediction, y' y. Therefore, if we can identify a method to reduce the discrepancy between the neural activity of the attacked network and that of the clean network, we may be able to mitigate the impact of adversarial atlacks on the classification outcome.
3.3 Cireshold-Adapting Leaky Integrate-and-Fing (TA-LIF) Neurons
3.3.1
Membrane Potential Error Minimization with NDS
Instead of examining the deviation of membrane potential u, (t)xx') caused by the adversarial input x' from the unknown (t(z), we define a new error signal e,(t]=²) & uy (t)2')- uf (t(P), and replace the optimization problem of equation 4 by more practical membrane potential error minimization problem while optimizing the dynamically changing firing threshold Vih of each neuron d:
min Ex(x'= =
Σ 0((2))22 Σ (u,(()'')u(((1)))) (11))2
sh ERT
where Vin = (t Vi (t2 2').. ViL (fr((22)) (2)). The intrinsic parameter of firing threshold has a critical role in neuronal dynamics and spiking firing. Adapting the firing threshold can mitigate the effects of adversarial noise, and offer an online homeostatic mechanism for minimizing E,(x",, which is potentially generalizable across various attack strengths and types.
6

---

Published in Transactions on Machine Learning Research (03/2025)
3.3.2 Error Minimization of TA-LIF Neurons as Second- Recond-Order Homeostatic Control System Subtracting equation from equation gives the following dynamics of the error ei(t):
de,(tlx') (t,(t)²)) AIi(t==) Fm..., (tlx') (D)
Tm
(8)
dt
where AT((1)))) & 11(4ar)- 1 (11), and r1(2') A
fo sitt fr represents the average firing rate under with respect to time and incorporating the threshold
the adversarial input r'. Differentiating equation dynamics yields:
g
Le,(t) dt2
de,(t) dt
dV (t) E(t),
Tm
+ TmTm
(9)
dt
where e(l) d1 and omit the notational dependencies on x' for clarity. Importantly, equation 9 de
characterizes the error dynamics (t) as a second-order control system influenced by the external disturbance
=(t) with avi(() serving as the control term.
dt
We seck to solve the membrane potential error minimization problem in equation 7 scheme that leads to proper error dynamics based on the second-order error system of equation To this end, utilize control signal dV (6) provide negative feedback control to suppress ex(t)='):
by designing a control
dVi (te((t)z') - (t)D))
(10)
dt
where 0g is neuron-level learnable parameter, dictating the pace of firing threshold adjustment.
TA-LIF model. equation I equation 2 and equation 10 together delineate the proposed TA-LIF model.
We construct a homcostatic SNN (HoSNN) using TA-LIF neurons, where each TA-LIF ncuron maintains its unique 0g and Via (t). To extract precise semantic information from D, we collect the NDS for the HoSNN from a well-trained LIF-SNN with identical network configurations. 0, and network weights W of the HoSNN can be jointly optimized using a training algorithm such backpropagation.
During inference with the optimized 0,, ViA. (t) is adapted in unsupervised manner according to equation 10 Intuitively, if TA-LIF neuron i shows a abnormal increased activation relative to the reference NDS, Vi (t) would be stepped up to suppress the increase in membrane potential. Conversely, if the neuron is abnormally
inhibited, Vi (t) would be tuned down. Figure 3(a) a)) compares the LIF and TA-LIF models via numerical simulation of equation g showing the growth of error (t) over time. We set the e(t) as Gaussian white noise {(t) NO, 1) and repeated the simulation 1000 times. The membrane potential error of TA-LIF (red
area) significantly smaller than that of LIF (blue area), revealing TA-LIF's dynamic robustness under noisy input perturbations.
The feedback control in equation 10 offers straightforward means to implement homcostasis, which in turn enhances the adversarial resilience of the proposed HoSNNs. Furthermore, this homeostatic rontrol exhibits two favorable dynamic properties presented next, underscoring its relevance solving the membrane potential error minimization problem of equation 7 as feedback control solution.
3.3.3 Theoretical Dynamic Properties of TA-LIF Neurons
We highlight key properties of the TA-LIF dynamics from two perspectives: bounded- bounded-output (BIBO) stability of membrane potential error and suppressed time growth of error comparison with the standard LIF model. See Appendix for complete derivation of these properties.
BIBO Stability If system is BIBO stable, then the output will be bounded for every input to the system that is bounded. The characteristic equation and its roots of the proposed second-order TA-LIF dynamics
equation g incorporating the homeostatic control equation 10 are:
-1
V A2:
s + 1 P: $1.2
(11)
2Tm

---

Published in Transactions on Machine Learning Research (03/2025)
Distribution per Layer SNN and HoSNN
0.4
eitt) over 10 simulations
LIF,
SMN ernor
HoSMIN
TA-LIF, 6, 0.5
0.2
0.8
Mean Line at 0
Distribution of
0.0
0.4
-0.2
-0.4
5
10
15
20
0.0
output
Time
conv
cony
canv
canv
cany
(a) Numerical simulations of equation ters Tm ==1.
g with parame-
(b) Box plot of the post-synaptic current relative error distribution per layer of SNN and HoSNN.
Figure 3: (a) Numerical simulations of equation show that TA-LIF can well suppress the growth of error with time. (b) Box plot of the post-synaplic current relative error distribution per layer of a SNN and a HoSNN, trained with FGSM adversarial training with 2/255 and attacked by a same CIFAR10 black-box PGD7 dataset with e 8/255.
For sccond-order system to be BIBO, the roots of its characteristic equation must be negative real have a negative real part, which is clearly the case for the TA-LIF model with both 0g and r; > O, affirming the BIBO stability of the TA-LIF model. This signifies that when the adversarial input perturbation e(I) is bounded, the deviation the TA-LIF neuron's 's membrane potential (t) is also bounded, showing the good control of crror under various attack intensitics.
Suppressed Time Growth of Membrane Potential Error To analyze the evolution of membrane potential error induced by injected imput perturbations over time, we follow the common practice (Gerstner et al., 2014 Abbott & Van Vreeswijk 1993 Brunel 2000 Renart et al.] 2004) to approximate AT(1) equation as Wiener process, representing small, independent, and random perturbations. Consequently, the driving force =(t) the right of equation 9 can be approximated by white noise {(t) with zero mean and variance o². By the theory of stochastic differential equations (Kloeden et al. 1992). this leads to the following mean square error for the LIF and TA-LIF models, respectively:
LIF
dVi
=0 (c)(t) 0(0²t)
T2 02
(t (t-Tm Tm Ti t/Tm)
(12)
dt
dVi th
0,e; = (c)(1)) = 0(02)= = Tmo0²
cos (wi)) + sin (wil)
TA-LIF
2r,0; 1 - e
(13)
dt
2wr Tin
where W1 V r.O: क Importantly, the mean square error of the TA-LIF neuron is O(o²) and does not grow with time while that of LIF neurons grows unbounded with time. The suppression of time growth of membrane potential error by the TA-LIF model underscores its superiority over the LIF model in terms of adversarial robustness.
3.4 Homeostatic SNNs (HoSNNs)
We further introduce the homeostatic SNNs (HoSNNs), which deploy TA-LIF neurons as the basic compute units to leverage their noise immunity. Architecturally, HoSNNs can constructed by adopting typical conncctivity such as dense or convolutional layers, with two learnable parameters: synaptic weights W and threshold dynamics parameter 0 per equation 10 We extract the network-level NDS UNET(D) from L.FF-base SNN with identical architecture well-trained the clean data distribution D. The HoSNNs

---

Published in Transactions on Machine Learning Research (03/2025)
optimization problem can be described as:
W 0 = arg min
Σ
Ctrai (I, W,0, (a)
(14)
W.O
{a.s)
S.L. V th (x) arg min me (W, O, V Veh
(15)
where x and y are an /nput/label pair; (-rain()) is the loss over a training dataset that can include clean/adverss examples, or a combination of the two; mmmm - Li=0 neurons' membrane potential error in equation 7 In practice, Lmem is optimized online by the homeostatic control of firing threshold during the forward process. Lerain (.) is optimized by gradient during the backward process, for which any backpropagation based training algorithm such as BPTT (Neftci et al.) 2019 Wu et al.] 2018), BPTR (Lee et al. 2020), or TSSL-BP (Zhang & Li 2020 can be applied to optimize the network based on equation 14
is the sum of all
3.5 Complexity Analysis of HoSNN
In a standard Spiking Neural Network (SNN), the number of neurons is n, with weights w = On²) and training time T. For Higher-order Spiking Neural Networks (HoSNNs), additional space required to store the learnable parameters 0; O()), but this storage cost is negligible compared to the network weights. The primary additional cost in training HoSNN is training the baseline SNN first. The extra time due to the TA-LIF model's dynamic threshold calculation is minimal (<10%). Therefore, the overall training time for a HoSNN is about 27. The dynamic threshold adjustment during inference has negligible impact, so the inference cost of a trained HoSNN is almost identical to that an SNN. There are some challenges in the training of HoSNN. (1) 0, Initialization: Initializing 0 too large (> 1) can destabilize training. It is recommended to set 8, between and 0.5, with smaller values needed for complex datasets. (2) Optimizer Choice: HoSNNs converge slower in later training stages, especially in adversarial settings. Using the Adam optimizer with cosine decay learning rate helps achieve similar convergence speeds as SNNs.
4 Experiments
4.1
Experimental Setup
The proposed HoSNNs compared with LIF-based SNNs with identical architecture across four benchmark
datasets: Mushion-MNISTY (FMNIST) (Xiao et al.;
2017). Street View House Numbers (SVHN) (Netzer
et al.] 2011 CIFAR1O and CIFARI00 (Krizhevsky 2009 VGG-5/9/11 (Simonyan & Zisserman 2015)
convolutional neural network (CNN) architectures of different sizes and depths are utilized. Widely used methods including FGSM (Goodfellow el al.) 2014 RFGSM (Tramèr et al.] 2017), PGD (iteration = 7, 20, 40) (Madry et al., 2017), and BIM (Kurakin et al. (0018) are used to generate both white woxtte-bxx and black-box attacks. To test stronger attacks, introduce APGD (Croce& & Hein 2020a) in our whitc-box attack, with cross entropy loss (APGDcE), difference of logits ratio loss (APGDDLR) and targeted attack (T-APGD). Unless otherwise specified, PGD refers to PGD7. The dynamically changing firing thresholds of the HoSNNs are exposed to the attacker and utilized in the gradient calculation when generating white-box attacks. We independently trained SNNs with the same architecture and used their white-bot attacks as the black-box attacks to the HoSNNs.
For each HoSNN, an Lls-- SNN with an identical architecture is trained on the corresponding clean dataset to derive the NDS. Model training employs the BPTT learning algorithm (T = 5), leveraging sigmoid surrogate gradient (Xu et al. 2022 Neftci et al.) 2019 Wu et al. 2018). The learning rate for each 8: in equation 10 which controls the adaptation of the firing threshold of TA-LIF neurons, is set to 1/10 of that for the network weights, ensuring hyperparameter stability during training. We ensure that 0, is non-negative during optimization. We train four types of models: SNNs and HoSNNs on a clean datasct and weak FGSM-basod adversarial training datasct, respectively. For FGSM adversarial training, we set the attack budget to e 2/255 on FMNIST, SVHN and CIFAR10 as in (Ding et al.) (002) and 4/255 on CIFAR100 in (Kundu et al. 2021 For iterative attacks (PGD & BIM), we adopt
9

---

Published in Transactions on Machine Learning Research (03/2025)
parameters 2.5xe/steps and steps 7, 20, 40 in accordance with DDng et al. 2022 Mode experimental settings are in the Appendix C.
4.2 Adversarial Robustness under White-box Attacks
Robustness without adversarial training Table I compares HoSNNs and SNNs intrinsic resilience without adversarial training. Both types of network are trained exclusively on the clean dataset, and then subjected to e 8/255 white-box adversarial attacks. The HoSNNs show consistently higher accuracy than the SNN counterparts under all four datasets and four attacks. For example, on CIFAR-10, the HoSNN siguificantly improves accuracy from 20.86% to 54.76% under FGSM, from 0.54% to 15.32% under PGD7, from 0.69% 10.35% under APGD with cross entropy loss, from 4.44% to 16.02% under T-APGD.
Robustness with adversarial training In Table 2 we evaluate the enhanced robustness of HoSNNs under adversarial training. We train both the SNNs and HoSNNs using FGGSM adversarial training and then expose them to c 8/255 white-box attacks. The results show a significant boost in robustness for HoSNNs when using adversarial training. Furthermore, the HoSNNs noticeably outperform the SNNs trained using the same FGSM adversarial training. For example, on CIFAR10, the HoSNNs improve the accuracy of the corresponding SNN to 33.98% from 37.93% under FGSM attack, and 43.33% from 12.42% under PGD7 attack, from 8.23% 38.89% under APGD-CE attack. On CIFAR100, the HoSNN improves the accuracy to 16.66% from 8.82% under PGD7 attack, from 7.75% to 12.55% under APGD-CE attack.
Dataset
Net
Clean
FGSM
RFGSM
BIM7
PGD7
PGD20
PGD40
APGD
APGDDLR
T-APGD
Fashion
x
92.92
56.01
70.02
38.85
30.90
28.73
27.88
23.22
40.25
39.67
MNIST
92.96
65.36
76.10
49.02
35.79
32.99
32.63
37.78
61.01
50.57
SVHN
x
95.51
26.07
42.94
2.26
0.44
0.18
0.13
7.73
0.81
93.55
44.87
57.27
12.91
4.33
1.87
1.47
3.09
12.26
5.32
CIFAR
x
92.47
20.86
38.72
3.29
0.54
0.38
0.3
0.69
7.03
4.44
92.43
54.76
62.33
28.06
15.32
11.58
10.74
10.35
27.39
16.02
CIFAR
x
74.00
5.74
8.94
0.10
0.04
0.01
0.00
0.00
0.01
0.01
100
71.98
13.48
12.27
0.50
0.19
0.02
0.02
2.55
0.02
0.02
Table Training on clean dataset. Whitebox attack results on Mashion-MNIST, SVHN, CIFAR10 and CIFAR100 under various lypes of attack with an intensity of e 8/255. The data the left and right are based training using the clean and weak FGSM datasets, respectively. HoSNNs (denoted as v) provide greater robustness than SNNs (denoted as x) under all attacks and datasets.
Dataset
Net
Clean
FGSM
RFGSM
BIM7
PGD7
PGD20
PGD40
APGDgE
APGDDLR
T-APGD
Fashion MNIST
92.08
74.12
83.12
68.36
62.92
61.97
61.43
55.47
68.25
62.56
92.31
84.7
87.99
79.61
74.91
73.53
73.21
67.94
76.24
74.48
SVHN
X
93.85
48.37
68.81
30.09
18.46
15.52
14.79
9.70
25.66
20.82
92.84
61.78
75.60
48.83
36.82
32.24
30.89
28.20
47.89
43.96
CIFAR
X
91 .87
37.93
59.50
22.31
12.42
11.03
10.63
8.23
16.8
14.62
90.00
63.98
71.07
52.33
43.33
40.97
40.02
38.89
37.94
41.69
CIFAR
x
68.72
22.54
36.93
13.58
8.82
7.88
7.52
7.75
7.51
5.4
100
64.64
26.97
41.45
21.09
16.66
15.83
15.37
12.55
13.66
10.2
Table 2: Training on FGSM dataset (e = 2/255). Whitebox attack results on Fashion-MNTST. SVHN, CIFAR1O and CIFAR100 under various types of attack with an intensity of = 8/255. The data on the left and right are based on training using the clean and weak FGSM datasets, respectively. HoSNNs (denoted as v) provide greater robustness than SNNs (denoted as x) under all attacks and datasets.
4.3 Adversarial Robustness under Black-box Attacks
Layer-wise Relative Error of Post-synaptic Currents Perturbation membrane potential caused by adversarial inputs can alter the output spike train of each neuron, and the resulting shifts in its post-synaptic current (PSC) propagate through the successive layers. The PSC at) is calculated by equation 3 To
10

---

Published in Transactions on Machine Learning Research (03/2025)
reveal the source of HoSNNs robustness, examine the relative error in PSC induced by adversarial attacks. On CIFAR1O, we use the 8/255 black-box PGD7 attack to attack SNN and HoSNN trained with the 2/255 FGSM adversarial training. For neuron i, we record its PSC ax(t) and df(t) under each pair of clean and adversarial imput, respoctively, and then calculate the difference c
PSo (t) _ la,(t) d((t) as an error metric. The layer-wise distributions of the relative error e ef are plotted in Figure 3 and Figure 4
The experiment results show that each error distribution of the HoSNN has a significantly reduced mean compared with that of the SNN, and has its probability mass concentrated low PSC error values, reveal- ing the favorable internal self-stabilization introduced by the proposed homeostasis. Correspondingly; the HoSNN delivers an accuracy of 76.62%, significantly surpassing the 46.97% accuracy of the SNN.
conv 1
conv 2
conv 3
conv 4
HoSNN
HoSNN
HoSNN
HoSMN
Density of
600
Mean:
SNN
800
SNN
600
SNN
Moan:
Density of o.
400
SNN
1.8c.03
Mean:
2.7e-03
Density
Mean:
2.5e-03
Density
Mean:
2 8e-03
Mean:
3.7e-03
300
400
300
200-
0.00
0.004
0.008
8.000
0.004 Value
0.008
dou0
0.004 Value
0.008
8000
0.004
0.008
Valuee
Value
conv 5
FC 1
FC 2
output
HeSNN
HoSNN
HoSNN
HoSNN
Density of e:
1000
Mean: 6 6.2e-04
Mean: 7.1e-03
Deasity of e:
60
Mean: 6. 6e-63
Density of a
500
Mean:
1.1e-03
Mean: 2.2c-03
Density
Mean: 1.2e-02
Mean: 1.3e-02
Mean:
4.9e:03
40-
30
250
0.000
0.004
0.008
8.00
0.02
0.04
8.00
0.02
0.04
0.000
0.005
0.010
0.015
Value
Value
Value
Value
Figure Distribution of post-synaptic current relative error of a SNN and HoSNN trained with FGSM adversarial training with = 2/255 and attacked by black-box PGD7 attack with 8/255.
Black Box Robustness Table 3 evaluates the robustness of SNNs (denoted as x) and HoSNNs (denoted as v) against black-box at- tacks. All models are trained by weak FGSM adversarial training and tested by c 32/255 black-box attacks generated using separately trained SNNs with identical architecture. Ta- ble 3 shows that the HoSNNs exhibit signifi- cantly stronger black-box robustness than the SNN counterparts. For example on CIFAR- 10, the HoSNN outperforms the traditional SNN under the FGSM and PGD7 attacks with 11.7% and 13.31% accuracy improvements, re- spectively. On CIFAR-100, HoSNN improves the PGD7 accuracy from 6.74% to 16.90%
Dataset
Net.
Clean
FGSM
RFGSM
PGD7
BIM7
Fashion MNIST
92.08
66.26
80.09
74.08
73.43
92.31
68.31
80.73
75.12
74.09
93.85
17.37
42.64
21.16
36.70
SVHN
92.84
19.08
44.57
25.97
40.75
CIEAR
91.87
13.48
8.79
0.11
0.31
10
90.00
25.18
31.11
13.42
23.34
CIFAR 100
68.72
12.18
17.87
6.74
17.36
64.64
14.54
24.32
16.90
32.04
Table 3: SNNs and HoSNNs black-box attack accuracy, trained with FGSM adversarial training and tested by dif- ferent black-box attack methods with = 32/255.
4.4 Checklist for gradient obfuscation
For a detailed chock of gradient obfuscation (Athalye et al.) 2018 Carlini al., 2019). we provide comprehensive inspection and data (in Appendix D). HoSNNs pass all five tests as show in Table
For Test (1) We plot the curves of white-box FGSM and PGD7 attacks on four datasets in Figure 5 and Table [ with attack budgets from to 64/255 to ensure that. the network be completely fooled. The
11

---

Published in Transactions on Machine Learning Research (03/2025)
Items to identify gradient obfuscation
HoSNN
Experiment
(1) Single-step allack performs better compared to ileralive attacks
Fig
and Table
(2) Black-box attacks perform better compared to white-box attacks
Fig
and Table
(3) Incrcasing perturbation bound can't increase attack strength
Fig
and Table
Unbounded atlacks can't reach 100% success
Fig
and Table
T0
(5) Adversarial example can be found through random sampling
Fig
Table 4: Checklist for gradient obfuscation
red curve the accuracy under FGSM, while the blue curve PGD7. From the Figure that all itcrative attacks are much stronger than single-step attack.
we can confirm
HcSNN-WB-FCSM WGD
80
H-SAN-WB-FGGMM
60--1
WBSSM
Accurncy
Accuragy
70-
Accira
200
60
40-
60
40+
30
Hc5NB WB FGSM
10-
02008 .6
02008
16
10
(2308
16
/25G
x/205
x2255
(a) Pashion- MNIST
(b) SVHN
(c) CIFAR-10
(d) CIPAR-100
Figure 5: For Test (1). Performance of HoSNN under white-box FGSM and PGD7 attack.
For Test (2) We plot the curves of whitc-box and black-box PGD7 attacks on four datasets in Figure 6 and Table g with atlack budgets from 0 64/255 to ensure that the network can be completely fooled. The green curve is the accuracy under black-box PGD7 attack, while the blue curve under white-box. From the Figure 0 can confirm that all white-box attacks are much stronger than black-box.
80
PGD HuSNN-WR.PGD
60
PGD
HRSNMAWB-PGD
20
Accuracy
500
HUSNNN-W-PPG
01
30
HcSNN--B-PPDD
HcSNIN PGD
10-
07-12
00025
70355
</255
</255
</255
</265
(a) Fashion-
(b) SVHN
(c) CIFAR-10
(d) CIFAR-100
Figure 6: For Test (2). Performance of HoSNN under white-box and black-box and PGD7 altack.
For Test (3) & (4) We increasing perturbation bound can't increase attack strength & Unbounded attacks can't reach ~ 100% success, we plot the curves of white-box and black-box PGD7 attacks on four datasets in Figure 7 and Table 10 with attack budgets e from 0 to 64/255 to ensure that the network can be completely fooled. The blue curve is HoSNN's accuracy under whito-box PGD7 attack, while the yellow curve SNN's baseline. From the Figure 7 we can confirm that as perturbation bound increasing HoSNN's accuracy is decreasing and all unbounded attacks reach 100% success.
For Test (5) Since all gradient- based attacks work, there is no need to use random sampling methods. Therefore Test (5) passed obviously. Figure model performance with and without adversarial training (ADV) under woite-box PGD7 attacks with varying intensities: e 2, 4, 6, 8/255. The proposed HoSNNs consistently outperform the SNNs in terms of model accuracy across all attack intensities and four datasets.
12

---

Published in Transactions on Machine Learning Research (03/2025)
SW--WB
SNN-WB-PGD
H.SPNAWB-PGD
170
80-
SNN-WB-PGD
HoSNN-WB-PGD
Test Accurocy
-00
701
SNN-WWS-PGD
HoSNN-WB-PGD
600
14
50
40-
07
30
10-
6/250
4/200
4,200
</200
(a) Dashion-MNISS
(b) SVHN
(c) CIFAR-10
(d) CIEAR-100
Figure 7: For Test(3) and (4). Performance of HoSNN under larger white-box PGD7 attack.
AISS SUN ADV HESHN
IMAR--AIV
SUN ADV
SMN ADV
Hishi
HuShiN
SMM
MOCKNN ADV
SUN--ADV
H6SKN
SNN
1/39
(a) MNSST
(b) SVHN
(c) CIFAR-10
(d) CIFAR-100
Figure 8: For (5).(5). Performance of SNNs and HoSNNs as a function of whitc-box PGD7 attack intensity.
4.5
Comparison with other works
We compare our method against recent state-of-the-ar defense methods under white-box FGSM and PGD7 attacks in Table 5 We tested all three methods on the same VGG7 network architecture, detailed in Appendix A. We use e = 2 FGSM adversarial training for CIFAR1O and e = for CIFAR100. Adversarial ex- amples are generated from the gradient of BPTT. Our adversarially trained models achieved the highest defense accuracies,
Data
Methods
Clean
FGSM
PGD7
Ding et al
2022
83.45
39.69
20.14
CIFAR-
10
Ozdenizei Legenstein
2023
91 86
41.55
27.35
Our work
90.00
63.98
42.63
Ding al.
2022
67.47
25.38
15.66
CIFAR- 100
Ondenizei Legenstein
2023
87.26
13.45
Our work
64.64
26.97
16. 66.66
Table 5: Comparison with others work. We use 6 2 FGSM adversarial training for CIFAR10 and = 4 for CIFAR100. Ad- versarial examples are generated from the gradient of BPTT.
5 Discussions
This paper presents the first work on bi- ologically inspired homeostasis for enhancing adversarial robustness of spiking neural networks. Specifically, we propose new TA-LIF model with a threshold adaptation mechanism and use TA-LIF neurons con- robust HoSNN networks. Yet. there is room for future investigations including better
struct inherently trading off between model accuracy under clean and adversarial inputs. More broadly, recognize the vast and yet untapped potential of biological homcostasis in neural network rescarch. The relationship between the properties of individual neurons and the overall performance of the network warrants further exploration.
6 Acknowledgement
This material is based upon work supported by the National Science Foundation under Grants No. 1948201
and No. 23.0170.
13

---

Published in Transactions on Machine Learning Research (03/2025)
References
Larry F Abbott and Carl Van Vreeswijk. Asynchronous states in networks of pulse-coupled oscillators. Physical Review E, 48(2):1483, 1993.
Naveed Akhtar and Ajmal Mian. Threat of adversarial attacks on deep learning in computer vision: A survey. Ieee Access, 6:14410 14430, 2018.
AllenInstitute. Allen Cell Types Database, cell feature search. AllenInstitute, 2018.
Anish Athalye, Nicholas Carlini, and David Wagner. Obfuscated gradients give false sense of security: Circunventing defenses to adversarial examples. In International conference machine learning, pp. 274-283. PMLR, 2018.
Guillaume Bellec, Darjan Salaj, Anand Subramoney, Robert Legenstein, and Wolfgang Maass. Long short- term memory and learning-to-leart in networks of spiking neurons. Advances in neural information pro- cessing systems, 31, 2018.
Guillaume Bellec, Franz Scherr, Anand Subramoney, Elias Hajek, Darjan Salaj, Robert Legenstein, and Wolfgang Maass. A solution to the learning dilemma for recurrent networks of spiking neurons. Nature communications, 11(1):3625, 2020.
Claude Bernard. Introduction à l'élude de la médecine expérimentale. Number 2. Baillière, 1865.
Battista Biggio and Fabio Roli. Wild patterns: Ten years after the rise of adversarial machine learning. In Proceedings of the 2018 ACM SIGSAC Conference on Compuler and Communicationss Securily, pp.
2154-2156, 2018.
Nicolas Brunel. Dynamics of sparsely connected networks of excitatory and inhibitory spiking neurons. Journal of computational neuroscience, 8:183-208 2000.
Tong Bu, Jianhao Ding, Zecheng Hao, and Zhaofei Yu. Rate gradient approximation attack threats deep spiking neural networks. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pp. 7896-7906, 2023.
Nicholas Carlini and David Wagner. Adversarial examples not easily detected: Bypassing ten detection methods, 2017. URL https://arxiv. orgg/bs////000 wttp:///www//ba///..777220 07263
Nicholas Carlini, Anish Athalye, Nicolas Papernot, Wieland Brendel, Jonas Rauber, Dimitris Tsipras, lan Goodfellow, Aleksander Madry, and Alexey Kurakin. On evaluating adversarial robustness, 2019.
Anirban Chakraborty, Manaar Alam, Vishal Dey, Anupam Chattopadhyay, and Debdeep Mukhopadhyay. Adversarial attacks and defences: A survey. arXie preprint SKG::1810000066 2018.
Sayeed Shafayet Chowdhury, Chankyu Lee, and Kaushik Roy. Towards understanding the effect of leak in spiking neural networks. Nearocomputing, 464:83 94, 2021.
Steven J Cooper. From claude bernard walter cannon. emergence of the concept of homeostasis. Appetite, 51(3):419-427 2008.
Francesco Croce and Matthias Hein. Reliable evaluation of adversarial robustness with an ensemble of diverse parameter-free attacks. In International conference machine learning, pp. 2206-2216. PMLR, 2020a.
Francesco Croce and Matthias Hein. Reliable evaluation of adversarial robustness with an ensemble of diverse parameter-free atlacks, 2020b. URL httpp::/aaxxiv.orr//b///222.
Lei Deng, Yujic Wu, Xing Hu, Ling Liang, Yufei Ding, Guoqi Li, Guangshe Zhao, Peng Li, and Yuan Xic. Rethinking the performance comparison between smns and anns. Neural networks, 121:294 307, 2020.
Jianhao Ding, Tong Bu, Zhaofei Yu, Tiejun Huang, and Jian Liu. Snn-rat: Robustnces-enhaneed spik- ing neural network through regularized adversarial training. Advances in Neural Information Processing 2022.
Systems,
14

---

Published in Transactions on Machine Learning Research (03/2025)
Jianhao Ding, Zhiyu Pan, Yujia Liu, Zhaofei Yu, and Tiejun Huang. Robust stable spiking neural networks.
arXiv preprint or Xiv:2224 05. 20694, 2024a.
Jianhao Ding, Zhaofei Yu, Tiejun Huang, and Jian K. Liu. Enhancing the robust of spiking neural networks with stochastic gating mechanisms. Proceedings of the AAAI Conference Artificial Intelligence, 381)4492-502, Mar. 2024b. doi: 1.1609/aaai... v3811.27804. URL https://ojs. aaai org/index.....ooo.ooooooo php/
AAAT/article//veew/rr555
Rida El-Allami, Alberto Marchisio, Muhammad Shafique, and Ihsen Alouani. Securing deep spiking neural networks against adversarial atlacks through inherent structural parameters. In 2021 Design, Aulomation & Test in Europe Conference & Exhibition (DATE), pp. 774-779. IEEE, 2021.
Alhussein Fawzi, Seyed-Mohsen Moosavi-Dezfooli, and Pascal Frossard. Robustness of classifiers: from adversarial to random noise. Advances in neural information processing systems, 29, 2016.
Nic Ford, Justin Gilmer, Nicolas Carlini, and Dogus Cubuk. Adversarial examples are a natural consequence of test error in noisc. arXiv preprint arXwv:1901110513, 2019.
Steve Furber, Francesco Galluppi, Steve Temple, and Luis A Plana. The spinnaker project. Proceedings of the IEEE, 102(5):652 665, 2014.
Wulfram Gerstner and Werner M Kistler. Spiking neuron models: Single neurons, populations, plasticity. Cambridge university press, 2002.
Wulfram Gerstner, Werner M Kistler, Richard Naud, and Liam Paninski. Neuronal dynomics: From single
neurons to networks and models of cognition. Cambridge University Press, 2014.
Tan J Goodfellow, Jonathon Shlens, and Christian Szegedy. Explaining and harnessing adversarial examples. arXiv preprint Xrx: 1.Xxx:1112: 121122.672 2014.
Zecheng Hao, Tong Bu, Xinyu Shi, Zihan Huang, Zhaofei Yu, and Tiejun Huang. Threaten spiking neural networks through combining rate and temporal information. In The Twelfth International Conference Learning Representations, 2024. URL https::/ net http::///pppneeeeeeeeeee//orroo
Andrew Ilyas, Shibani Santurkar, Dimitris Tsipras, Logan Engstrom, Brandon Tran, and Aleksander Madry. Adversarial examples are not bugs, they are features. Advances in neural information processing systems, 32, 2019a.
Andrew Tlyas, Shibani Santurkar, Dimitris Tsipras, Logan Engstrom, Brandon Tran, and Aleksander Madry. Adversarial examples are not bugs, they are features, 2019b. URL httra:///arriv.orr//a/////90000 02175
Nabil Imam and Thomas A Cleland. Rapid online learning and robust recall in a neuromorphic olfactory circuit. Nature Machine Intelligence, 2(3):181 191, 2020.
Wilfrid Jänig. The integrative action of the autonomic nervous system: neurobiology of homeostasis. Cam- bridge University Press, 2022.
Daniel Kang, Yi Sun, Dan Hendrycks, Tom Brown, and Jacob Steinhardt. Testing robustness against unforeseen adversaries. arXio preprint wwXX::1908.00 2019.
Peter E Kloeden, Eckhard Platen, Peter E Kloeden, and Eckhard Platen. Stochastic differential equations. Springer, 1992.
Alex Krizhevsky. Learning multiple layers of features from tiny images. Technical report, Citeseer, 2009.
Souvik Kundu, Massoud Pedram, and Peter A Beerel. Hire-snn: Harnessing the inherent robustness of energy-efficien deep spiking neural networks by training with crafted input noisc. In Proceedings of the IEEE/CVE International Conference Computer Vision, pp.
2021.
Alexey Kurakin, Ian J Goodfellow, and Sany Bengio. Adversarial examples in the physical world. In Arlificial intelligence safely and securily, pp- 99 112. Chapman and Hall/CRC, 2018.
15

---

Published in Transactions on Machine Learning Research (03/2025)
Chankyu Lee, Syed Shakib Sarwar, Priyadarshini Panda, Gopalakrishnan Srinivasan, and Kaushik Roy. Enabling spike-based backpropagation for training deep neural network architectures. Fronliers in neuro- science, pp. 119, 2020.
Tianlin Li, Aishan Liu, Xianglong Liu, Yitao Xu, Chongzhi Zhang, and Xiaofei Xie. Understanding adver- sarial robustness via critical attacking route. Information Sciences, 547:568-51 5788 2021.
Yanjie Li, Xiaoxin Cui, Yihao Zhou, and Ying Li. A comparative study on the performance and security evaluation of spiking neural networks. IEEE Access, 10:117572 117581, 2022.
Ling Liang, Kaidi Xu, Xing Hu, Lei Deng, and Yuan Xie. Toward robust spiking neural network against adversarial perturbation. Advances in Neural Information Processing Systems, 35:10244-10253 2022.
Timothy P Lillicrap, Adam Santoro, Luke Marris, Colin J Akerman, and GeofTrey Hinton. Backpropagation and the brain. Nature Reviews Neuroscience, 21(6))333 346, 2020.
Yujia Liu, Tong Bu, Jianhao Ding, Zecheng Hao, Tiejun Huang, and Zhaofei Yu. Enhancing adversarial robustness in smns with sparse gradients. arXiv preprint orXiv:4405.00555 2024.
Aleksander Madry, Aleksandar Makelov, Ludwig Schmidt, Dimitris Tsipras, and Adrian Vladu. Towards deep learning models resistant to adversarial attacks. ar preprint wrxii:1706.06088 2017.
Eve Marder and Jean-Mare Goaillard. Variability, compensation and homeostasis in neuron and network function. Nature Reviews Newrosciience, 7(7):563 574, 2006.
Jan Hendrik Metzen, Tim Genewein, Volker Fischer, and Bastian Bischoff. On detecting adversarial pertur- bations. arXiv preprint arXiv:170..00 04267, 2017a.
Jan Hendrik Metzen, Tim Genewein, Volker Fischer, and Bastian Bischoff. On detecting adversarial pertur- bations, 2017b. URL http:///arrav...oggbb/////. 042667
Harold Modell, William Cliff, Joel Michael, Jenny McFarland, Mary Pat Wenderoth, and Ann Wright. A physiologist's view of homeostasis. Advances in physiology education, 2015.
Seyed-Mohsen Moosavi-Dezfooli Alhussein Fawzi, and Pascal Frossard. Deepfool: simple and accurate method to fool deep neural networks. In Proceedings of the IEEE conference on computer vision and pattern recognition, pp. 2574-2582, 2016.
Aamir Mustafa, Salman Khan, Munawar Hayat, Roland Goecke, Jianbing Shen, and Ling Shao. Adver- sarial defense by restricting the hidden space of deep neural networks. In Proceedings of the IEEE/CVF International Conference on Computer Vision, pp. 3385 3394, 2019.
Kaveri Nadhamuni. Adversarial Examples and Distribution Shift: A Representations Perspective. PhD
thosis, Massachusetts Institute of Tochnology, 2021.
Emre O Neftci, Hesham Mostafa, and Friedemann Zenke. Surrogate gradient learning in spiking neural networks: Bringing the power of gradient- based optimization to spiking neural networks. IEEE Signal Processing Magazine, 36(6):51 -6,3, 2019.
Yuval Netzer, Tao Wang, Adam Coates, Alessandro Bissacco, Bo Wu, and Andrew Y Ng. Reading digits in natural images with unsupervised feature learning. 2011.
Katsuhiko Ogata. Modern control engineering fifth edition. 2010.
Ozan Ozdenizci and Robert Legenstein. Adversarially robust spiking neural networks through conversion.
arXiv preprint arXim:2311.09260 2023.
Jing Pei, Lei Deng, Sen Song, Mingguo Zhao, Youhui Zhang, Shuang Wu, Guanrui Wang, Zhe Zou, Zhenzhi Wu, Wei He, et al. Towards artificial general intelligence with hybrid tianjic chip architecture. Nature 572(7767):106-11) 2019.
16

---

Published in Transactions on Machine Learning Research (03/2025)
Sergio Pennazio. Homeostasis: history of biology. In Biology Forum/ Forum/Rivista di Biologia, volume 102, 2009.
Stephan Rabanser, Stephan Günnemann, and Zachary Lipton. Failing loudly: An empirical study of methods for detecting dataset. shift. Advonces in Neural Information Processing Systems, 32, 2019.
Alfonso Renart, Nicolas Brunel, and Xiao-Jing Wang. Mean-field theory of irregularly spiking neuronal popu- lations and working memory in recurrent cortical networks. Computational neuroscience: A comprehensive approach, pp. 431 151-499,400 2004.
H. Risken. The Fokker-Planch Equation: Methods of Solution and Applications. Springer, New York, 2 edition, 1996. doi: 14.0077997--3-622--654444
Ramprasaath R. Selvaraju, Michael Cogswell, Abhishek Das, Ramakrishna Vedantam, Devi Parikh, and Dhruv Batra. Grad-cam: Visual explanations from deep networks via gradient- based localization. International Journal of Compuler Vision, 128(2):336 359, October 2019. ISSN 1573-1405. doi:
10.1007/s11263 019-01228-1 URL http: dtw.:/.oo...o/.....oo 1tt.////.....///0111111111111 00007//811268-09--112---
Saima Sharmin, Priyadarshini Panda, Syed Shakib Sarwar, Chankyu Lee, Wachirawit Ponghiran, and Kaushik Roy. comprehensive analysis on adversarial robustness of spiking neural networks. 2019 International Joint Conference on Neural Networks (IJCNN), pp. 8. LEEE, 2019.
Saima Sharmin, Nitin Rathi, Priyadarshini Panda, and Kaushik Roy. Inherent adversarial robustness of deep spiking neural networks: Effects of discrete input encoding and non-linear activations. In Computer Vision-ECCV 2020: 16th European Conference, Glasgow, UK, August 23 28-28, 2020, Proceedings, Part Springer, 2020.
XXIX 16, pp.
Manli Shu, Zuxuan Wu, Micah Goldblum, and Tom Goldstein. Prepare for the worst: Generalizing across domain shifts with adversarial batch normalization. 2020.
Samuel Henrique Silva and Peyman Najafirad. Opportunities and challenges in deep learning adversarial robustness: A survey, 2020. URL https://arxiv. wttp://.wrrg//bbbo.o.ooom
Karen Simonyan and Andrew Zisserman. Very deep convolutional networks for large-scale image recognition. In Proceedings of the international conference on learning representations (ICLR), 2015.
Christian Szegedy, Wojciech Zaremba, llya Sutskever, Joan Bruna, Dumitru Erhan, lan Goodfellow, and Rob Fergus. Intriguing properties of neural networks. arXio preprint 1112. 6199, 2013.
Corinne Teeter, Ramakrishnan Tyer, Vilas Menon, Nathan Gouwens, David Feng, Jim Berg, Aaron Szafer, Nicholas Cain, Hongkui Zeng, Michael Hawrylyez, et al. Generalized leaky integrate-and-fre models classify multiple neuron types. Nature communications, 9(1):709, 2018.
Florian Tramèr, Alexey Kurakin, Nicolas Papernot, Ian Goodfellow, Dan Boneh, and Patrick McDaniel. Ensemble adversarial training: Attacks and defenses. orXiv preprint arXiv:1705. 072007724, 2017.
Florian Tramèr. Detocting adversarial examples is (nearly) hard as classifying them, 2022. URL https: //arxii.org/ab////111
Gina G Turrigiano and Sacha Nelson. Homeostatic plasticity in the developing nervous system. Nature reviews neuroscience, 5(2):97-107, 2004.
George E Uhlenbeck and Leonard S Ornstein. On the theory of the brownian motion. Physical review, 36 (5): 1930.
Nicolaas Godfried Van Kampen. Stochastic processes in physics and chemistry, volume 1. Elsevier, 1992.
Ming Chen Wang and George Eugene Uhlenbeck. On the theory of the brownian motion ii. Reviews of modern physics, 17(2-3):323, 1945.
H Arthur Woods and Keaton Wilson. An information hypothesis for the evolution of homcostasis. Trends in ecology & evolution, 28(5):283 2298,289, 2013.
17

---

Published in Transactions on Machine Learning Research (03/2025)
Yujie Wu, Lei Deng, Guoqi Li, Jun Zhu, and Luping Shi. Spatio-temporal backpropagation for training high-performance spiking neural networks. Frondiers in newroscience, 12:331, 2018.
Han Xiao, Kashif Rasul, and Roland Vollgraf. Fashion-mnis
novel image dataset for benchmarking machine learning algorithms. arXiv preprint 1 077.07747, 2017.
Cihang Xie, Jianyu Wang, Zhishuai Zhang, Zhou Ren, and Alan Yuille. Mitigating adversarial effects through randomization. arXiv preprint 1rXiv:1711.011 2017.
Nuo Xu, Kaleel Mahmood, Haowen Fang, Ethan Rathbun, Caiwen Ding, and Wujie Wen. Securing the spike: On the transferabilty and security of spiking neural networks adversarial examples. arXiv preprint ar Xiv: 033558, 2022.
Chongzhi Zhang, Aishan Liu, Xianglong Liu, Yitao Xu, Hang Yu, Yuqing Ma, and Tianlin Li. Interpreting and improving adversarial robustness of deep neural networks with neuron sensitivity. 1EEE Transactions on Image Processing, 30:1291-1300 2020.
Wenrui Zhang and Peng Li. Temporal spike sequence learning via backpropagation for deep spiking neural networks. Advances in Neural Information Processing Systems, 33:12022 12033, 2020.
A
Appendix
We mainly present the derivation of the second-order dynamic equation of TA-LIF in dynamic stability analysis in C the detailed experimental setup in D and checklist for gradient obfuscation in P
B Derivation of TA-LIF Dynamic Equation
In this section, we derive the approximale second-order dynamic equations of the threshold-adapling leaky integrate-and-Ff and-fiir (TA-LIF) neurons and subsequently analyze them.
B.1
LIF Dynamics
To facilitate our discussion, let's commence by presenting the first-order dynamic equations of the LIF neuron at time t:
du,(t) -u; (1) + 1,(() - Tm 8:));(()) Vt)
Tm
(16)
dl
The input current is defined as
I,(t) R Σ (t)
(17)
The spiking behavior (t) is defined as:
to0 (t 2 Vin
st(
Σ 8(t t!)
(18)
0 otherwise
And the post-synaptic current dynamics are given by:
da;(1) -
+8(()
(19)
dt
Where:
Tma Represents the membrane time constant.
18

---

Published in Transactions on Machine Learning Research (03/2025)
[ttt:: Denotes the imput, which is the summation of the pro-synaptic currents.
way: Stands for the synaptic weight from neuron j neuron i.
(t):: Refers to the post-synaptic current induced by neuron j at time t.
Vaa: Is the static firing threshold.
i Indicates the f-th spike time of neuron i.
Tat Is the synaptic time constant.
B.2 Neural Dynamic Signature
Let's begin by reviewing the definition of the Neural Dynamic Signature (NDS). Given a data instance a sampled from distribution D, the NDS of neuron i, contingent upon the training distribution D, can be reprosented temporal series vector u ((D). Specifically, time t, it holds the value:
u (t(D) & EgnD un (t]x)], for E [0,2]
(20)
To derive the dynamics of NDS, start by revisiting Equation equation 16 rewriting it with respect to
du,(t)z) -u((t))) + 1((t)) - (t
Tm
(21)
dt
For the convenience dynamic analysis, we choose to approximate the discontimuous Dirac function term s; (t(ar) with the average firing rate rE( x) of neuron The average firing rate calculated by
r,(x) f (1((|z) dt
(22)
We take this approximation to address discontinuity of Dirac funtion, as rı(2) and s;(t(r) have the same integral value over time: the number of neuron firings. Substituting Equation equation 22 into Equation equation 21 and computing the expectation on both sides, we have:
du: (4/x)) [u; + Eg-D (1/=)) - Tm Fnina/rr(())))
Ti Bg
(23)
dt
Here, we denote the average input current of neuron over the entire dataset
(+ A (z>D[[,(t(=)]
(24)
and the average spike frequency of neuron i over the entire dataset as:
(D) A Ez>d(r;(>)
(25)
With the definition from Equation equation 20 the dynamics of NDS can be expressed
duž (t|D) dl
Tm
-u, (1[) + - (m,
(26)
As mentioned in the main text, we usually expect NDS to have precisc semantic information of the distribu- tion D. So NDS should obtained through a well-trained model with optimal weight parameter W For clarity in the following sections, we use W to represent the actually used NDS:
du, W- = - Wt D) + W' D) Tm. D)Vu.
Tm
(27)
dt
19

---

Published in Transactions on Machine Learning Research (03/2025)
B.3 TA-LIF Dynamics
In this section, we delve deeper into the dynamical equations governing the TA-LIF and derive its second-order dynamic equation
dt,(t) u.,(t) L(t) - Tm (t)
mm
(28)
The synaptic input (t),, the spike generation function (t) and post-synaptic current dynamics of TA-LIF are defined same as equation 17qquaionn [8pquation [9 For specific network parameter W and sample z' drawn from D', the dynamic equation governing the threshold Vi (t) is:
dVi (1 x²) = (te,(tWW,
(29)
dt
where the error signal, utilizing the NDS as given in equation 20 is defined as:
(t W, x²) W x²) (t) D)
(30)
Applying the continuity approximation for the Dirac function as per equation 22 and incorporating the conditional dependency of W and r', rewriting the dynamics for TA-LIF equation 28 as:
(t W x') + W x²) - Tma (W, (t (t x²)
Tm
W,
(31)
dt
Subtracting equation 27 from equation 31 and employing equation 30
denoting
A x²) L(t|W, ,'') 17
(32)
we derive the Ist-order dynamic of W,,'')
(t W, x²) -e x') (, In. VL x)) -r; D)
(33)
dt
Differentiating equation obtain:
33 with respect time and utilizing the threshold dynamics from equation 30 we
de [ W x²) Tm
de,(t[W,x') d x²) Om0rr.WW (
(34)
dt2
dt
dt
For sussinctness, we will omit dependencies on W and x', resulting in TA-LIF dynamics in the main text equation 26
de,(t) Tm
de,(t) +rmm)iee(()=== dt)(t)
(35)
dt2 dt
For the standard LIF neurons where 0, + 0, the equation simplifies to:
dei(t)
de,(!) dt dt
Tm
dt2 +
(36)
dt
C Dynamic Stability Analysis
In this section, we analyze the stability of equation 35 and equation 36 to explore the influence of our dynamic threshold mechanism the noise suppression ability of the TA-LIF neuron.
20

---

Published in Transactions on Machine Learning Research (03/2025)
C.1 BIBO Stability of Equation equation 35
Characleristic Equalion: We first show the BIBO (Bounded Input, Bounded Output) stability Ogata 2010
of TA-LIF neurons based on equation 35 The characteristic equation of equation 35 of non-silent (T) > 0)
and non-degenerating (Tm: 0g > 0) TA-LIF LIF neurons is:
Tms T =0
(37)
and its roots are
-1 VA
$12 =
A = 4riT 0;
(38)
2mm
For A > 0: Both roots $1,2 are real and negative.
For 0: There's single negative real root.
For A < 0: Both roots are complex with negative roal parts.
For a second-order system to be BIBO, the roots its characteristic equation must be negative real or have negative parts, which clearly the case for the TA-LIF model under the above three siluutions,, affirming the BIBO stability of equation 35 The BIBO stability signifies that with the bounded driving input system equation 35 the deviation of the TA-LIF neuron's membranc potential from its targeted NDS is also bounded, demonstrating the well control of the growth of error (t)..
C.2 Stability of Equation equation 35 Under White Noise
To elucidate the dynamic characteristics of TA-LIF further, we adopt the prevalent method Abbott & (2014); Renart et al. (2004), approximating AT(() with Wiener process. This approximation effectively represents small, independent, and random perturbations. be modeled by Gaussian white noise F(!), leading the well-cstablished Langevin equation in stochastic differential equations theory Kloeden et al.
Van Vreeswijk (1993) Brunel 22000; Gerstner et al.
Hence, the driving force in equation equation
35
dAi,(t)
1992
Van Kampen (1992) Risken 1996]:
(t, 1 de,(t) dt2
+
+ (f, F(t)
(39)
Ti
dt
Denoting (-) as averaging over time, F(t) is a Gaussian white noise with variance 0² that satisfies:
(F(t))
= 0,
(F1 F (t2))
028 -t2)
(40)
(F F (12) (12n+1))
0
(F())) ... F (tzx))
Ean pairs (F(t)) (F(()
where the sum has to be taken over all the different ways in which one divide the 2n time points 4 ....2n into n pairs. Under this assumption equation 40 the solution of the Langevin equationequation 39
is Uhlenbeck & Ornstein (1930): Wang & Uhlenbeck 1945
(IAe((1)3) = Tm
sin (wh(t
( = 0
1 - 3rm cos (wi() +
(41)
2r,0,
2w Tm
where (t, = (t) (t)( and W1
|r:0: 155
While under the same assumptions equation 40
equation equation 36 yields:
02
(I)),)))3))
(t F' + Fime e/ = -
(42)
2
21

---

Published in Transactions on Machine Learning Research (03/2025)
Obviously, Gaussian white noise with zero mean equation 40 leads (e((t) 0, ([Ae,(t))3) (t). Hence,
d3I(1) F(I) = { ((()))===((+) dt
(())
(43)
Significantly, the mean square error (-- of the TA-LIF neuron remains bounded to O and doesn't 't increase over time. In contrast, under identical input perturbations, the mean square error (t)) of the LIF neuron may grow unbounded with time, highlighting its potential susceptibility to adversarial attacks.
C.3 A more intuitive explanation
We would like to provide a more intuitive explanation of Eq 9 and Eq 10 Notice that when 6, =0 according to Eq I0 TA-LIF no longer has dynamically changing threshold and thus degenerates into standard LIF. Its second-order dynamics degenerates into:
de) dt2 +
de,(1) = <(t)
Tm
dt
An example to intuitively understand these two formulas that they correspond to a driven damped oscillator in the physical world, that is, the movement of a ball connected to a spring under a driving force and damping environment. Considering (t) as the distance the ball deviates from the equilibrium position, we
dPe((t) describes the acceleration of
understand the physical meaning of each term in the formula: Tm di2
de,(t) describes the frictional resistance of the ball; ryTm (t)()) describes the restoring force of the the ball; di
spring, which is the tendency the spring to pull the ball toward the equilibrium position (c,(t) = 0); E(t)
describes the driving force exerted by the environment on the ball.
With this explanation, we can easily understand the difference between the second-order dynamics of TA-LIF and LIF. The key term is (t) For TA-LIF, it is like small ball that is constantly pulled toward its initial equilibrium position by a spring when it is subjected to external disturbances: the result is that the ball will not deviate too far (t) remains small). However, there is no such term in the dynamics of LIF, which causes (1) to become larger under external disturbances.
D Experiment Setting Details
Our evaluation encompasses three benchmark datasets: FashionMNIST, SVHN, CIFAR10, and CIFAR100. For experimental setups, we deploy:
LeNet (3205-P-64C3.PP1122-1)) for FashionMNIST.
VGGs (#CC330GP6GC33///CC--100001311 for SVHN.
VGGs [[B6G|25660000000000000222222220 for CIFARIO.
VGGs (22GGP-9600552233100005000000000
for CIFAR100.
Here, the notation 32C3 represents convolutional layer with 32 filters of size 3x3, and P stands for a pooling layer using 2 x 2 filters. For the CIFAR10 and CIFAR100 datasets, incorporated batch normalization layers and dropout mechanisms to mitigate overfitting and elevate the performance of the deep networks. In our experiments with PashionMNIST,, SVHN, and CIFAR10, the output spike train of LIF neurons was retained to compute the kernel loss, as described in Zhang & Li 2020). For CIFAR100, we directly employed softmax for performance.
For all HoSNN experiments, a preliminary training phase was carried out using an LIF SNN, sharing the same architecture, on the clean datasets to deduce the NDS. Hyperparameters for LIF and TA-LIF neurons
22

---

Published in Transactions on Machine Learning Research (03/2025)
included simulation time T = 5 Membrane Voltage Constant Tm 5, and a Synapse Constant T, 3. For the TA-LIF results in the main text, assigned 0g initialization values of 5 for FashionMNIST, SVHN, CIFARIO and 3 for CIFAR100. All neurons began with an initial threshold of 1. The step function was approximated using ((x) = 1 I+e- where I = u(t) - Vaa (t) and the BPTT learning algorithm was employod. For TA-ALIF neurons, the learning rate for 0g was set at 1/10 of the rale designated for weights, ensuring hyperparameter stability during training. We also constrained 0g to remain non-negative during optimization, ensuring a possible transition from TA-LIF to LIF. For the generation of all gradient- based adversarial attacks, we assume that the attacker can know all Vos (t) and use it in the gradient, even if it is generated dynamically and is not stored as network parameters. During training, we use (t) = V1 (0). We utilized the Adam optimizer with hyperparameters betas set to (0.9, 0.999), and the Ir = 5 x 10-4 with cosine annealing learning rate scheduler (T = epochs). We set batch size to 64 and trained for 200 epochs. All images were transformed into currents to serve as network input. Our code is adapted from [Zhang & Li p2020). The experiment used four NVIDIA A100 GPUs. For CIFARIO and CIFAR100, it took up to about 48 hours for adversarial training.
Regarding adversarial attack, we BIM. For both CIFAR10 and CIFARI0O, we allocated an attack budget with 8/255. For iterative schemes like PGD, we set a = 2.5 * e/steps and steps = 7,200, 40, aligning with the recommendations in Ding et al. 2022) For the adversarial training phase, FGSM training was used with 6 values of 2/255 for
array of attack strategies, including FGSM, RFGSM, PGD, and
CIFARIO as per Ding et al. 2022) and 4/255 for CIFAR100, following Kundu et al. 2021).
Items to identify gradient obfuscation
HoSNN
(I) Single-step attack performs better compared to iterative attacks
(2) Black-box attacks perform better compared to white-box attacks
(3) Increasing perturbation bound can't. increase aatk strength
(4) Unbounded attacks can't reach 100% success
(5) Adversarial example can be found through random sampling
Table 6: Checklist for gradient obfuscation
E More Experiment Data
Obfuscated gradients are a type of gradient masking that leads to false sense of security when defending against adversarial examples |Athalye et al. (2018); Carlini et al. 22019). Here we perform sanity checks including three obfuscated types and a checklist as per Athalye et al. 2018). First, we examine three types of obfuscated gradients. Specifically, we use the same surrogate to train HoSNN from scratch and deliver allacks; decent clean accuracy and a smooth training process indicate that it's not Shattered Gradient with nonexistent or incorrect value. As our defense doesn't 't introduce any random factors, Stochastic Gradient is not applicable. Our method also docsn't include any multiple iterations of neural network evaluation, Vanishing/Explodingg Gradient are also not applicable.
Items to identify gradient obfuscation
HOSNN
Experiment
(1) Single-step attack performs better compared to iterative attacks
Fig
and Table
(2) Black-box allacks perform better compared to white-box attacks
Fig
and Table
(3) Increasing perturbation bound can't increase attack strength
Fig
and Table
(4) Unbounded attacks can't reach 100% success
Fig
7
and Table
10
(5) Adversarial example can be found through random sampling
Fig
Table 7: Checklist for gradient obfuscation
23

---

Published in Transactions on Machine Learning Research (03/2025)
Datasct
Method
c 0
2
4
6
8
16
32
64
WB-FGSM
92.31
90.26
88.16
86.25
84.70
77.70
60.70
24.27
FMNIST
WB-PGD
92.31
89.34
85.44
80.61
74.91
47.93
5.87
0.00
WB-FGSM
92.84
83.96
75.85
68.45
61.78
43.45
28.64
20.79
SVHN
WB-PGD
92.84
80.53
63.98
47.56
35.06
10.40
2.00
0.21
WB-FGSM
90.00
77.84
71.14
67.05
63.98
56.66 66.66
48.92
26.93
CIFAR-10
WB-PGD 90.00
72.24
58.66
49.63
42.63
24.38
6.82
0.65
WB-FGSM
64.63
52.78
42.12
33.79
26.97
12.47
4.01
2.68
CIFAR-100
WB-PGD
64.64
51.20
36.82
25.23
16.65
1.99
0.00
0.00
Table 8: HoSNN accuracy data for Test1. We compared the performance under white-box FGSM and PGD attack. Our data shows that single-step attacks are strictly weaker than multi-step attacks.
Dataset
Method
6 0
4
6
8
16
32
64
BB-PGD
92.31
91.05
89.81
88.85
87.67
84.61
75.12
39.93
FMNIST
WB-PGD
92.31
89.34
85.44
80.61
74.91
47.93
5.87
0.00
BB-PGD
92.84
89.31
86.10
82.68
78.49
57.02
25.96
8.02
SVHN
WB-PGD
92.84
80.53
63.98
47.5
35.06
10.40
2.00
0.21
BB-PGD
90.00
86.55
83.46
80.11
76.61
56.77
13.43
0.92
CIFAR-10
WB-PGD
90.00
72.24
58.66
49.65
42.63
24.38
6.82
0.65
BB-PGD
64.64
61.68
59.22
56.67
54.06
42.08
16.90
1.82
CIFAR-100
WB-PGD
64.64
51.20
36.82
25.23
16.65
1.99
0.00
0.00
Table 9: HoSNN accuracy data for Test2. We compared the performance under white-bax PGD and black- box PGD attack. Our data shows that black-box attacks are strictly weaker than white-box attacks.
Dataset
Method
2
16
32
64
SNN-WB-PGD
92.92
78.87
58.03
42.27
30.54
2.71
0.00
0.00
FMNIST
HoSNN-WB-PGD
92.31
89.34
85.44
80.61
74.91
47.93
5.87
0.00
SNN-WB-PGD
95.51
44.78
9.66
1.83
0.44
0.10
0.02
0.01
SVHN
HOSNN-WI-PGD
92.84
80.53
63.98
47.56
35.06
10.40
2.00
0.21
SNN-WB-PGD
92.47
44.00
11.73
2.46
0.56
0.01
0.00
0.00
CIFAR-10
HoSNN-WB-PGD
90.00
72.24
58.66
49.65
42.63
24.38
6.82
0.65
SNN-WB-PGD
74.00
11.62
1.29
0.13
0.04
0.00
0.00
0.00
CIFAR-100
HOSNN-WB-PGD
64.64
51.20
36.82
25.23
16.65
1.99
0.00
0.00
Table 10: HoSNN accuracy data for Test31r4. We showed the performance of SNN and HoSNN under white- box PGD attack. Our data shows that increasing perturbation bound can increase aftack strength and the accuracy can drop to 0 as the attack becomes stronger.
24


Reviews:
[{"review_id": "82JllYJw8f", "reviewer": "Reviewer_9yb8", "summary": "", "questions": "", "limitations": "", "rating": null, "confidence": null, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "Strengths: \n- Paper is written clearly and has a good motivating narrative that well illustrates the idea.\n- Proposed idea of using bio-inspired homeostasis for adversarial robustness in SNNs is a novel approach.\n\nWeaknesses:\n- Empirical evaluations of the defense and benchmarking appears problematic in some parts, which is important from the perspective of securely/robustly solving machine learning tasks with the proposed SNN architecture.", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "No", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "paper_topic_and_main_contributions": "", "excitement": null, "reproducibility": null, "ethical_concerns": "", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "", "summary_of_contributions": "Authors propose homeostatic spiking neural networks (HoSNNs) as a novel category of bio-inspired SNNs that exploit threshold-adapting LIF neurons, to improve SNN robustness against adversarial attacks. Specifically, each neuron in the resulting adversarially trained HoSNN exploits dynamically adapting firing thresholds via a temporal neural dynamic signature anchor that is estimated using clean data on a shadow SNN with identical architecture. By adapting neuron-specific firing thresholds based on this anchor, the proposed model aims to minimize the membrane potential errors of all neurons, which are estimated by the difference in membrane potentials in response to benign versus adversarial examples. Empirical simulations on Fashion-MNIST and CIFAR-10/100 type of datasets show that the proposed method is effective when combined with adversarial training.", "claims_and_evidence_yn": "No", "claims_explanation": "", "audience_yn": "Yes", "audience_explanation": "", "requested_changes": "- Current \"Section 4.5 - Comparison with other works\" should be revised thoroughly from scratch. Table 5 is currently filled out by retrieving exact evaluation accuracies from the compared papers [Ding et al. 2022; Ozdenizci & Legenstein 2023], without carefully considering the details of these evaluations (e.g., SNN architecture, attack configuration and strength, etc.). Given the training/evaluation settings described in Section 4.1 of this submission, authors currently demonstrate a misleading benchmarking comparison of different methods. To describe: this method uses a VGG-5 for CIFAR-10 with T=5. This is a different architecture than all other methods that are compared, which actually use VGG11 architectures with more parameters, and a longer T=8 simulation length. These differences in fact make the models more vulnerable to attacks already. Furthermore, the FGSM and PGD7 attack evaluations that are retrieved from those works, in fact correspond to significantly stronger _ensemble SNN attacks_, where the surrogate gradient used by the adversary can rigorously adapt for each attacked sample. Authors' method does not appear to be evaluated in this way. Therefore, the methods are not compared on the same grounds either, which is a critical benchmarking step in empirical adversarial robustness studies. Basically, to be fair and rigorous, empirical adversarial robustness comparisons with other methods should be always performed on the same grounds, using the same architectures, and exact same adversarial attack configurations.\n \n- Could you discuss or empirically demonstrate how well the proposed approach generalizes to even slightly larger ML tasks, such as TinyImageNet classification, or residual CNN architectures?\n\n- Can the authors discuss why item (1) of the checklist for gradient obfuscation does not actually hold in their black-box attack evaluations? As far as I can see, multi-step attacks somehow perform worse than single-step attacks in the results presented in Table 3. Can the authors re-run these experiments on different seeds to generate their black-box transfer attacks?\n\n- In Section 2.1, authors also mention RGA [Bu et al. 2023], and HART [Hao et al. 2024] attacks specifically tailored for SNNs. However the paper does not evaluate the robustness of the proposed SNN against these at all, but with ANN-like attacks. Can the authors discuss why this is the case, and if it is a limitation?", "broader_impact_concerns": "N/A", "additional_comments": "", "extra_scores": {}, "extra_text": {}}, {"review_id": "yDVx2HWdAH", "reviewer": "Reviewer_prg6", "summary": "", "questions": "", "limitations": "", "rating": null, "confidence": null, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "Strengths:\n\n+ The paper overall is well written. \n+ The idea of adaptive thresholding for adversarial robustness is novel – \n+ The adversarial attack experiments support the authors claim, and their methodology is sound. \n\nWeaknesses:\n\n-\tIt is unclear to me how the feedback threshold adaptation is performed\n-\tI think the authors lightly affirm that the u* is a reliable reference for benign (as opposed to adversarial) behavior. This is not an obvious fact, quite the opposite. In fact, if that’s the case, the adversarial robustness problem would have been fundamentally solved by detecting OOD in the features space. I encourage the authors to either: \\textbf{(i)} reword their claims to frame this as a hypothesis not “expected” as in Section 3.2. \\textbf{(ii)} Or, run experiments to support this claim, like for example test if this OOD w.r.t. a reference NDS explicitly enables detecting adversarial examples. This should be the case if their assumption/hypothesis is correct. \n-\tThe approach technically involves 2 stage training: first, a training of a conventional SNN with a fixed threshold, and then, a new training for their modified architectures to re-adapt the parameters, and learn their new parameter theta. The authors should run experiments or at least discuss the computational overhead, and  training difficulty of their approach. \n-\tThe authors propose an analysis of the bounds forced by their adaptive firing at node level, which makes sense. I am unsure why would adaptive thresholding behavior at node level lead to any inherent robustness. Sigmoid activation function offers bounds at neuron level, yet, it does not offer any inherent robustness. Could the authors discuss this point? \nMinor : \n-\tFigure 3 – the subfigures are not properly labeled (a) and (b) \n-\tIn Section 3.1., the expression of the adversarial noise is not accurate. The adversarial noise is generally an additive noise not multiplicative: $\\delta.x $ -- and multiplying this by $\\epsilon$ does not make it a budget. Instead: $x’=x+ \\delta$, s.t. $\\delta < \\epsilon$", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "Yes", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "paper_topic_and_main_contributions": "", "excitement": null, "reproducibility": null, "ethical_concerns": "", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "", "summary_of_contributions": "The paper a bio-inspired approach for SNNs’ adversarial robustness. The proposed approach is essentially based on an adaptive thresholding mechanism for the neurons. Specifically, the authors propose a new adaptive neuron, i.e., TA-LIF, which incorporates an online feedback control at inference time to adjust the firing threshold. The feedback is defined based on a hypothesis that the distribution of membrane potential for clean input is a reliable reference for benign behavior, and therefore, the activation is adjusted according to the difference between the actual membrane potential and the reference expectation of the potential on supposedly clean data. \nThe authors run adversarial attacks experiments, provide a bounding analysis and run experiments to show that the approach is not a gradient masking mechanism.", "claims_and_evidence_yn": "Yes", "claims_explanation": "", "audience_yn": "Yes", "audience_explanation": "", "requested_changes": "- Clarify Feedback Threshold Adaptation\n- Support or reframe hypothesis about $u^*$\n- Discuss the computational overhead and potential challenges of the two-stage training process (conventional SNN training followed by training the modified architecture). \n- Elaborate on why adaptive thresholding at the node level inherently leads to robustness. Compare and contrast this with other bounded activation functions, such as sigmoid, which do not inherently offer robustness.", "broader_impact_concerns": "No ethical concerns", "additional_comments": "", "extra_scores": {}, "extra_text": {}}, {"review_id": "YGNzmrWhvE", "reviewer": "Reviewer_R1de", "summary": "", "questions": "", "limitations": "", "rating": null, "confidence": null, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "**Strengths**:\n\nThe theoretical foundation of the work is exceptionally strong, presenting a comprehensive mathematical analysis that rigorously proves the stability and robustness properties of the proposed TA-LIF neurons. This analysis not only validates the approach but also provides valuable insights into why the method works.\n\nThe biological inspiration behind the work represents a novel perspective in adversarial robustness research. By drawing parallels between neural homeostasis and adversarial defense, the authors open up a new direction for developing robust neural networks that align with biological principles.\n\nThe empirical evaluation is particularly thorough, covering multiple datasets, architectures, and attack types. The authors' careful consideration of gradient obfuscation issues and comprehensive ablation studies demonstrate the reliability of their results. The significant performance improvements achieved across all test cases provide strong evidence for the method's effectiveness.\n\n**Weaknesses**:\n- In Section 3.1, the transition from equation (4) to the practical implementation using NDS could be better explained. The paper jumps from the theoretical formulation to the NDS solution without fully justifying why this approximation is valid or discussing potential limitations.\n\n- In Section 3.3.2, the description of error minimization as a second-order homeostatic control system could benefit from more intuitive explanations. The connection between biological homeostasis and the mathematical formulation isn't immediately clear for readers without strong control theory background.\n\n- The performance comparison in Section 4.5 only considers white-box FGSM and PGD7 attacks. A more comprehensive comparison including other attack types (like black-box attacks) would strengthen the evaluation, especially given the paper's claims about general robustness. The authors can just briefly describe other attack types.\n\n- In Section 3.2, the storage overhead of maintaining Neural Dynamic Signatures isn't thoroughly analyzed. While the paper mentions it \"remains manageable\", concrete numbers or theoretical bounds would be more convincing.", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "Yes", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "paper_topic_and_main_contributions": "", "excitement": null, "reproducibility": null, "ethical_concerns": "", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "", "summary_of_contributions": "This paper presents an advancement in improving the adversarial robustness of SNNs through a novel bio-inspired approach. The primary contribution is the introduction of the TA-LIF neuron model, which draws inspiration from biological homeostasis mechanisms. This model represents a fundamental departure from traditional defense methods, offering a biologically plausible solution to the challenge of adversarial attacks.\n\nThe authors develop HoSNNs that leverage these TA-LIF neurons, introducing an innovative concept called Neural Dynamic Signatures that serve as reference points for stabilizing neural activity. The theoretical foundation of the work is particularly strong, providing rigorous mathematical analysis of the TA-LIF neurons' dynamic properties, including bounded-input bounded-output stability and suppressed time growth of membrane potential error.", "claims_and_evidence_yn": "Yes", "claims_explanation": "", "audience_yn": "Yes", "audience_explanation": "", "requested_changes": "- Include a more intuitive explanation of the second-order homeostatic control system in Section 3.3.2, possibly with illustrative examples\n- Expand the comparison in Section 4.5 to include more attack types\n- Add concrete analysis of NDS storage requirements in Section 3.2", "broader_impact_concerns": "N/A.", "additional_comments": "", "extra_scores": {}, "extra_text": {}}]

Author rebuttal:

Meta-review: The paper introduces a novel mechanism to improve adversarial robustness of SNNs. They provide a rigorous mathematical foundation and solid empirical evidence. Reviewer comments were adequately addressed. The work is of somewhat limited scope and does not present a significant improvement over the state of the art for machine learning tasks.
Decision: Accept (poster)