## 3 Physical and Mixed Safety
### Adversarial Attacks on CNNs, SNNs, and Neuro-Inspired Solutions Against The
The authors released their code at [[https://github.com/bfshi/VARS](https://github.com/bfshi/VARS)]([https://github.com/bfshi/VARS](https://github.com/bfshi/VARS)) (accessed on 10 June 2023). Heading up toward SNNs and DVS cameras, some works propose solutions for resilience to adversarial attacks. [PERSON] et al. [109] focused on designing adversarial attacks for the DVS cameras. They proposed five types of attack, i.e., sparse, frame, corner, dash, and MF-Aware dash attacks, and successfully performed the attacks, causing accuracy drops in the classification task performed by the SNN on two datasets, i.e., DVS128 Gesture [87] and N-MNIST [86]. They proposed applying the activity filter and the mask filter on the outcoming event stream. The authors remarked that the applied filters cannot completely defend against proposed adversarial attacks, especially against the MF-Aware dash attack. Despite the applied filters, the attack caused at least a 20% accuracy drop for the DVS128 Gesture spiking classifier and at least a 65% drop for the N-MNIST spiking classifier. [PERSON] et al. [115] revealed the adversarial Native SpikeAttack and Proxy SpikeAttack on SNNs. The attacks target bumping up the energy consumption and increasing the latency instead of fooling the SNN. Using the proposed attack methods, which increased the overall spike number to 2.5\(\times\), the authors bumped the energy consumption up to 2.3\(\times\) and increased the latency to 2.2\(\times\). Eventually, the authors proposed three defense strategies, i.e., input quantization (lowering the precision of chosen states and parameters), spike dropout (dropping random spikes), and threshold and leak modulation (raising the spike threshold and membrane leaking rate, which leads to potentially improved sparsity). They allowed only for less than a 0.5% accuracy drop while evaluating the effectiveness of the defense methods, achieving promising results. For almost each tested case, the best was the spike dropout strategy, which often significantly reduced the excessive spike activity. [PERSON] et al. [116] considered the impact of the structural parameters of spiking neurons on the resilience against white-box adversarial attacks. They proposed a methodology for testing the robustness of an SNN and remarked that security studies show that SNNs can be robust in their design by properly tuning the neurons' structural parameters. Finally, they designed trustworthy SNNs by scanning the space of the chosen parameters and finding sweet spots for achieving the best robustness. The baseline accuracy for a properly tuned SNN was around 95-98% for a broad space of structural parameter values for the MNIST dataset. After performing the attacks, the performance drastically dropped in a wide space of SNN parameters. However, the authors found a parametric sweet spot, where the accuracy dropped only from 98% to 84% after the attack. This is a splendid result compared to the rest of the parameter space, where the achieved accuracies were predominantly miserable, reaching even as low as \(\sim\)0.0%. The authors published their research source code at [[https://github.com/rda-ela/SNN-Adversarial-Attacks](https://github.com/rda-ela/SNN-Adversarial-Attacks)]([https://github.com/rda-ela/SNN-Adversarial-Attacks](https://github.com/rda-ela/SNN-Adversarial-Attacks)) (accessed on 10 June 2023). [PERSON] et al. [117] considered Time-To-First-Spike (TTFS) encoding as a resilience method to adversarial attacks on SNNs. They trained their SNN using backpropagation and explored its resistance to adversarial attack. They tested different temporal penalty values to achieve the best result. Then, the results were compared to the standard ANN adversarial attack resistance. The achieved accuracy was significantly higher for the properly tweaked SNN than for the classic ANN. The authors observed that the achieved accuracies for clean samples (non-attacking ones) were slightly better for the ANN than the SNN.