RSC-SNN: Exploring the Trade-off Between Adversarial Robustness and Accuracy in Spiking Neural Networks via Randomized Smoothing Coding

Authors: keming  wu
yuhong  chou
xuerui  qiu
rui  yang
guoqi  li
man  yao
bo  xu
Venue: acmmm_org_ACMMM_2024_Conference
Published: 2024-03-30 13:39:13

Abstract: Spiking Neural Networks (SNNs) have received widespread attention due to their unique neuronal dynamics and low-power nature. Previous research empirically shows that SNNs with Poisson coding are more robust than Artificial Neural Networks (ANNs) on small-scale datasets. However, it is still unclear in theory how the adversarial robustness of SNNs is derived, and whether SNNs can still maintain its adversarial robustness advantage on large-scale dataset tasks. This work theoretically demonstrates that SNN's inherent adversarial robustness stems from its Poisson coding. We reveal the conceptual equivalence of Poisson coding and randomized smoothing in defense strategies, and analyze in depth the trade-off between accuracy and adversarial robustness in SNNs via the proposed Randomized Smoothing Coding (RSC) method. Experiments demonstrate that the proposed RSC-SNNs show remarkable adversarial robustness, surpassing ANNs and achieving state-of-the-art robustness results on large-scale dataset ImageNet. Our open-source implementation code is available at  ~\href{https://github.com/KemingWu/RSC-SNN}{\textit{https://github.com/KemingWu/RSC-SNN}}.

Main paper: 
 introduction: 
 Owing to the distinctive event-driven nature [3] and remarkable biological plausibility [11] , SNNs have gained recognition as the third generation of artificial neural networks [18, 25] . Compared with ANNs, SNNs employ discrete binary signals for information transfer among spiking neurons, where spikes are generated solely when the membrane potential surpasses the firing threshold. After deployment to neuromorphic chips [6, 20, 22, 37] , SNNs have demonstrated their effectiveness and efficacy in a variety of scenarios, including static visual tasks [35, 36] , dynamic visual processing [10, 38] , speech classification [24, 39] .Direct [33] and Poisson coding [31] are two popular coding strategies for SNNs, which define how information is represented via spike patterns [7] . For SNNs, a static input 𝑥 ∈ R 𝑑 needs to be converted into a time sequence input using coding strategies. Direct coding will repeatedly input 𝑥 for 𝑇 times. Poisson coding uses frequency approximation to generate 𝑇 binary spikes {𝑝 𝑖 } 𝑇 𝑖=1 so that the average number of spikes approximates the intensity of the pixel 1 𝑇 𝑇 𝑖=1 𝑝 𝑖 ≈ 𝑥. Coding methods play a crucial role in determining the network's computational efficiency and resilience to perturbations. Existing empirical studies have shown that the adversarial robustness of SNNs using Poisson coding is higher than that of ANNs, and the robustness decreases as the time step increases [28] . In contrast, SNNs using direct coding have poorer adversarial robustness than ANNs [15] .The impact of direct coding and Poisson coding on the adversarial robustness has not been systematically analyzed, which undermines the potential advantages of SNNs over ANNs in terms of adversarial robustness. Moreover, it is still unknown whether SNN can still maintain the adversarial robustness advantage on largescale tasks, because previous work has only been verified on small datasets such as CIFAR-10/100 [4, 17, 21, 27] . We are interested in why the adversarial robustness of SNNs employing Poisson coding is stronger. We note that randomized smoothing and Poisson coding have similar features in enhancing adversarial robustness, although they may seem like two different approaches. Randomized smoothing builds a base classifier by introducing noise [5] , in contrast, Poisson coding converts the input into a binary probability.Inspired by this, we theoretically establish the connection between randomized smoothing and Poisson coding via analyzing the statistical characteristics of them. We found that Poisson coding shares fundamental statistical properties with randomized smoothing, such as expectation and variance, introducing similar noise smoothing. Since existing research has shown that randomized smoothing can bring certified adversarial robustness, based on this observation, we can understand why SNNs using Poisson coding have adversarial robustness. However, our theoretical analysis shows that SNNs with Poisson coding are greatly affected by perturbation while bringing about the problem of reduced clean accuracy. Therefore, it is urgent to establish a guiding principle for the trade-off between accuracy and robustness in the design of defense methods against adversarial examples in SNNs. We analyze in depth the trade-off between accuracy and adversarial robustness in SNNs via a novel Randomized Smoothing Coding (RSC) method, which significantly improves the adversarial robustness of SNNs. To further exploit the potential of this approach, we propose a new training method designed for RSC-SNN. Experimental results on extensive datasets show that randomized smoothing coding greatly enhances the adversarial robustness of SNNs. Simultaneously, The final results indicate a trade-off between accuracy and adversarial robustness, which is consistent with the conclusions of ANNs [29, 30, 41] . Furthermore, We also propose an empirical estimation method to quantify the trade-off called Quantification Trade-off Estimation (QTE) to help design defense methods with better tradeoffs. The main contributions of our work are summarized as follows:• We establish the connection between Poisson coding and randomized smoothing for the first time, which is a novel insight contributing to the field. Furthermore, we prove the conceptual equivalence of randomized smoothing and Poisson coding, which provides a theoretical foundation for the robustness of Poisson-encoded SNNs. We proposed a novel coding method called randomized smoothing coding. Spiking neurons are the basic units of SNNs, which are abstracted from the dynamics of biological neurons. The leaky-integrate-andfire (LIF) neuron model is widely acknowledged as the simplest model among all popular neuron models while maintaining biological interpretability, in contrast to the many-variable and complex H-H model [14] . It also has a significantly lower computational demand [23, 26] . We adopt the LIF neuron model and translate it to an iterative expression with the Euler method [32] . Mathematically, the LIF-SNN layer can be described as an iterable version for better computational traceability:EQUATIONwhere 𝜏 is the time constant, 𝑡 and 𝑖 respectively represent the indices of the time step and the 𝑙-th layer, 𝑤 denotes synaptic weight matrix between two adjacent layers, 𝑓 (•) is the function operation stands for convolution (Conv) or fully connected (FC), 𝑥 is the input, and Θ(•) denotes the Heaviside step function. When the membrane potential 𝑢 exceeds the firing threshold 𝜗, the LIF neuron will trigger a spike 𝑆. Moreover, ℎ represents the membrane potential after the trigger event which equals 𝜏𝑢. 
adversarial attacks: 
 Adversarial attacks are designed to fool a model into incorrect predictions or outputs through carefully crafted inputs [12] . Given a classifier 𝑓 : R 𝑑 → Y, where Y is the set of class labels, the purpose of an adversarial perturbation 𝛿 is to make 𝑓 (𝑥 + 𝛿) ≠ 𝑓 (𝑥), which can be formulated as an optimization problem:EQUATION)where 𝑓 is the network under attack, L is the loss function, 𝑥, 𝑦 are the input and target output of the given network, respectively. 𝜖 is a parameter that limits the intensity of the perturbation so that it is not easily observed by the human eye. 𝛿 is the parameter we want to optimize. In this paper we mainly use two widely adopted gradientbased adversarial attacks: Fast Gradient Sign Method (FGSM) and Projected Gradient Descent method (PGD). FGSM. As a simple but effective attack method [12] , adversarial examples are generated based on the symbolic information of the gradient to maximize the loss of the perturbed 𝑥 + 𝛿, which can be formulated asEQUATIONwhere 𝜖 denotes the strength of the attack. PGD. As an iterative version of FGSM, it generates adversarial samples by adding small perturbations in the gradient direction multiple iterations and limiting the results to a certain range after each iteration [19] , which can be formulated asEQUATIONwhere 𝑘 denotes the number of the iteration step and 𝛼 is the step size of each iteration. Π 𝜖 is used to ensure that the perturbation does not exceed a predefined range 𝜖.For FGSM and PGD, we explore two scenarios: white-box and black-box attacks. In the white-box scenario, the attacker possesses full access to the model's topology, parameters, and gradients. Conversely, in the black-box scenario, the attacker is limited to basic information about the model. Without specific guidelines, we fix 𝜖 at 8/255 across all methods for testing. For iterative techniques PGD, the attack step is set at 𝛼 = 0.01, with a total of 7 steps.As a strategy aimed at enhancing model adversarial robustness, randomized smoothing fortifies the model's defense against attacks through the inclusion of random noise [5] . In addition, there are many works that further explore randomized smoothing [16, 34, 40] .In a classification scenario mapping from R 𝑑 → Y, randomized smoothing constitutes a method to formulate a refined classifier 𝑔 from any base classifier 𝑓 . When evaluated at 𝑥, the smoothed classifier 𝑔 identifies the class that the base classifier 𝑓 is most inclined to predict when 𝑥 undergoes perturbation by isotropic Gaussian noise:EQUATIONwhere 𝜖 ∼ N 0, 𝜎 2 𝐼 . The noise level 𝜎 serves as a hyperparameter for the smoothed classifier 𝑔, dictating a trade-off between adversarial robustness and accuracy. 
method: 
 As aforementioned, we suggest achieving a better trade-off between adversarial robustness and accuracy for designing more practical SNN models. In this section, we first provide an empirical metric to quantify the trade-off between adversarial robustness and accuracy.We then introduce a new coding method called RSC to improve the adversarial robustness, which enhances the quantitative trade-off between adversarial robustness and accuracy. Furthermore, theoretical analysis is given to illustrate the conceptual equivalence of RSC and Poisson coding. After observing the inherent limitations of RSC, we further propose a specified training method designed for RSC to improve its clean accuracy and adversarial robustness.Quantification trade-off is important for designing methods to better trade-off. Therefore, before giving full details of our methods, we first try to formulate a Quantification Trade-off Estimation.Definition 3.1. Quantification Trade-off Estimation (QTE). From Figure 1 , we can get that the process of achieving better trade-offs is also essentially making the area larger. For a trained model, assume that its accuracy under attack intensity 𝜂 is 𝐴(𝜂), Quantification Trade-off Estimation between two attack intensities 𝜂 𝑎 and 𝜂 𝑏 can be formulated asEQUATIONObviously, a larger Quantification Trade-off Estimation implies higher overall accuracy within the attack interval, signifying an improved trade-off in the model implementation. Simultaneously, it's noticeable that a smaller difference in |𝜂 𝑏 -𝜂 𝑎 | corresponds to more accurate estimations of the model's quantification trade-offs.Motivated by randomized smoothing, we first introduced random smoothing of Gaussian noise into the input of SNN. For each sample input 𝑥 ∈ R 3×𝐻 ×𝑊 , there is a given time step 𝑇 . There are actually two ways to add noise to the input sample of the SNN model. One is to directly add a fixed noise a to the input and no longer changes at each time step, which can be formulated asEQUATIONit can also be expressed asEQUATION)Another way is to add different Gaussian noises at each time step, which can be formulated asEQUATIONwhere the noise level 𝜎 serves as a hyperparameter for the model, dictating a trade-off between adversarial robustness and accuracy.After adding noise to 𝑥, we further limit the range of 𝑥 to [0, 1], which can be formulated asEQUATION)For the first method, we named it RSC-I, and the second method RSC-II. In the experiment, we found that RSC-I can bring about a substantial improvement in adversarial robustness compared to RSC-II, and the degree of clean accuracy decrease will be higher than that of RSC-II; RSC-II can also bring about a small improvement in adversarial robustness, and the degree of clean accuracy decrease will be lower than that of RSC-I. Due to the need for higher adversarial robustness, we choose RSC-I as our main method.For the convenience of analysis, we first explain the meaning of the symbols. The input image is denoted as 𝒙. The expectation of 𝑿 is denoted as 𝑬 [𝑿 ] and the covariance matrix is denoted as 𝚺 𝑿 .For Poisson coding, the input is a random vector 𝑿 𝑷 , where the vector follows a Bernoulli binomial distribution with probability vector 𝒑. For randomized smoothing, the input is a random vector 𝑿 𝑹𝑺 , which follows a normal distribution centered at 𝒙 with covariance 𝝈 2 , denoted as 𝑿 𝑹𝑺 ∼ N (𝒙, 𝝈 2 ). The following formula can be satisfied:𝑬 [𝑿 𝑷 ] = 𝑬 [𝑿 𝑹𝑺 ] = 𝒙 𝚺 𝑿 𝑷 = diag(𝒙 (1 -𝒙)) = diag(𝑥 1 (1 -𝑥 1 ), . . . , 𝑥 𝑑 (1 -𝑥 𝑑 )).EQUATIONWe can observe that Poisson coding and randomized smoothing coding can be considered as an equivalence in theory.To better explain why randomized smoothing coding is better than Poisson coding, the results of the two different perturbed coding methods in a linear layer are explored through the following theorem. For the convenience of expression, we express the adversarial sample as 𝒙 +𝝐 and denote the linear layer as a deterministic weight matrix 𝑾 , the original output as a random variable 𝒀 𝑷 /𝑹𝑺 𝒐𝒓 𝒊𝒈𝒊𝒏𝒂𝒍 and the attacked output as a random variable 𝒀 𝑷 /𝑹𝑺 𝒂𝒕 𝒕𝒂𝒄𝒌 . For both coding methods, the expectation of original 𝒀 𝒐𝒓 𝒊𝒈𝒊𝒏𝒂𝒍 and attacked 𝒀 𝒂𝒕 𝒕𝒂𝒄𝒌 are given by: 𝑬EQUATIONAlthough the expectations of both exhibit the same characteristics, their covariances behave differently. In Theorems 3.2 and 3.3, we obtain two covariance results with Poisson coding and randomized smoothing coding.Theorem 3.2. The covariance matrix of Poisson coding before and after the attack satisfies:EQUATION)Theorem 3.3. The covariance matrix of randomized smoothing coding before and after the attack satisfies:EQUATION)All the above theorems are proved in the supplementary material. noise variance introduced to the input remains constant and does not vary with the input itself.While Poisson coding and randomized smoothing share the highlevel objective of enhancing adversarial robustness through noise averaging, they differ significantly in the specific nature of the noise added. Randomized smoothing employs isotropic Gaussian noise, resulting in predictable and manageable outcomes due to its uniform variance in all directions. In contrast, Poisson coding introduces noise whose covariance is influenced by both the input magnitude and perturbation attacks, leading to input-dependent variance. Consequently, the constant noise variance in randomized smoothing ensures a more stable and consistent smoothing process, potentially making it more effective in certain scenarios. Gradient obfuscation is the main reason why many adversarial defense methods are mistakenly considered effective. By certain methods, the neural network cannot produce accurate gradients, resulting in the inability to produce effective attacks.To evaluate the attack effectiveness of the RSC , we employ the systematic checklist presented in [1] to scrutinize the gradient obfuscation of this novel coding scheme. This assessment is primarily grounded in the data delineated in Table 3 and Table 4 within the main body of the text, with a brief summary provided in Table 1 . The detailed analysis can be found in the supplementary material.Expectation over Transformation (EOT) computes the gradient over the expected transformation to the input as a method to attack randomized models [2] . We use EOTPGD proposed by Zimmermann [42] to evaluate the effectiveness of our method. The results in Table 2 show that our method can defend against EOT attacks.We found that while RSC improved the SNN model's adversarial robustness, it also led to a certain degree of decline in clean accuracy. To alleviate this problem, we propose E-RSCT for training SNN models using RSC. Motivated by the idea of knowledge distillation, we found that the corresponding ANN have naturally high clean accuracy, so we decided to use a pre-trained ANN as a teacher model to transfer the learned knowledge to the RSC-SNN model. E-RSCT consists of two parts of loss functions during the training process. First, in order to transfer the learned knowledge from the Backpropagation and update model parameters; 9: end for teacher model [13] , we define the loss function of the first part as L 𝐾𝐷 and use KL divergence to measure the difference between the student network and the teacher network to get L 𝐾𝐷 .EQUATION)where 𝑂 𝑡𝑒𝑎 is the output of the teacher ANN model and 𝑂 𝑠𝑡𝑢 is the output of the student SNN model. For the second part of the loss function, we use the pre-synaptic loss L 𝑃 -𝑆 [8] in training.By combining L 𝐾𝐷 and L 𝑃 -𝑆 , we get the new loss function used for the novel training as followsEQUATION)where 𝜆 is used to achieve a trade-off between L 𝐾𝐷 and L 𝑃 -𝑆 . Without special explanation, we select 𝜆 = 0.1 in the experiment. The detail of E-RSCT is shown in Algo.1. 
experiments 4.1 experimental setup: 
 We verify the effectiveness of the proposed RSC and E-RSCT on multiple datasets and compare with ANNs simultaneously. In the following experiments, SNNs using direct coding are represented by DIRECT, SNNs using RS coding are represented by RSC and SNNs using Poisson coding are represented by POISSON. For the trade-off measurement of the model under different attacks, we use F-QTE to represent the Quantification Trade-off Estimation under the FGSM attack, and P-QTE to represent the Quantification Trade-off Estimation under the PGD attack. Detailed implementation is referred to in the supplementary material. For adversarial robustness evaluation, specific hyperparameter settings are introduced in Section 2.2. In the experiments of E-RSCT, we used the hyperparameters set in Section 3.5.Clean accuracy and adversarial robustness. Clean accuracy refers to the accuracy on the clean test dataset. It was represented as CLEAN in the experiment. The evaluation of adversarial robustness accuracy is denoted as FGSM and PGD respectively.Results on different datasets. Table 3 illustrates the performance evaluation of our proposed RSC scheme. For constructing effective attacks on SNN, all gradient attacks are applied based on BPTT. The specific implementation of BPTT is in the supplementary material. The results consistently demonstrate the efficacy of our RSC in enhancing model adversarial robustness, as evidenced by notable enhancements in adversarial robustness accuracy across all attack methodologies. Particularly striking is the significant improvement in adversarial robustness against stronger white-box iterative attacks. Notably, the VGG-5 model exhibited a remarkable 58.91% increase in accuracy when attacked by PGD compared to direct coding on the CIFAR-10 dataset. Simultaneously, the improvement of F-QTE and P-QTE also shows that our method better achieves the trade-off between accuracy and adversarial robustness. The experimental results that RSC shows more adversarial robustness than Poisson coding well verify Theorem 3.2 and 3.3.Experiments on Tiny-ImageNet and ImageNet. Previous work was limited to small datasets such as CIFAR-10 and CIFAR-100. We also conducted experiments on Tiny-ImageNet and ImageNet to provide a baseline for the evaluation of SNN adversarial robustness. It can be seen that the adversarial robustness of RSC-SNN has been significantly improved compared to DIRECT and POISSON.Black-box attack results on different datasets. In this section, we assess the adversarial robustness of RSC against black-box attacks. We utilize a separately trained SNN with an identical architecture to generate white-box attack samples. The results presented in Table 4 demonstrate that RSC demonstrates significant resilience against adversarial attacks, surpassing traditional SNNs in both FGSM and PGD scenarios. This robustness positions RSC as notably more resilient to adversarial intrusions in black-box scenarios. Compared with traditional SNNs, RSC-SNN's F-QTE and P-QTE have also improved in black-box attack scenarios.Enhanced Robustness with Adversarial Training. Adversarial training, has been the most widely accepted defense method. To evaluate the combined robustness of RSC and adversarial training, we explored their transferability and scalability. We trained SNN-Direct, SNN-Poisson and RSC using low-intensity FGSM samples and then exposed them to more complex and larger 𝜖 white-box attacks. Results in Table 5 (rows 1-2 for CIFAR10 and rows 3-4 for CIFAR100) show a significant boost in robustness for RSC when combined with adversarial training. On CIFAR-10, this combination increased robustness for FGSM (to 55.58% from 51.29%) and PGD (to 43.59% from 37.28%). For CIFAR-100, resilience improved against FGSM (to 35.53% from 32.48%) and PGD (to 27.57% from 24.35%). In conclusion, the integration of RSC with adversarial training gives it the versatility to withstand a wider range of more powerful adversarial attacks.We can see from Table 3 that while RSC brings significant adversarial robustness improvement to the model, it also leads to clean accuracy decline. To alleviate this problem, we proposed E-RSCT for RSC-SNN. Table 6 summarizes the clean and robust accuracy of SNN models trained with and without E-RSCT. It can be seen from Table 6 that the clean accuracy and adversarial robustness of the model trained using E-RSCT on all datasets have been improved to a certain extent. On the CIFAR10 dataset, while the clean accuracy was improved by 1.74%, its robust accuracy for FGSM and PGD was also improved by 3.23% and 2.70% respectively. On other datasets, an average accuracy improvement of more than 1% has been achieved. The experimental results concretely verify the effectiveness of our proposed training algorithm. The improvement of F-QTE and P-QTE also shows that E-RSCT achieves better trade-offs.Effect of different noise levels 𝜎 2 on RSC. Investigating the pivotal role of the noise level parameter 𝜎 2 within the novel introduced RSC framework holds significant importance in regulating the model's adversarial robustness. We conducted an exhaustive ablation study to discern the effect of parameter variations on the model's adversarial robustness. Specifically, we selected three distinct values: 𝜎 2 = 0.01, 𝜎 2 = 0.1, and 𝜎 From Figure 3 , a noticeable trend emerges: as the noise level (𝜎 2 ) escalates, there's a concurrent decline in the model's clean accuracy, a phenomenon congruent with our empirical analyses. Simultaneously, with an increase in 𝜎 2 , the model's adversarial robustness exhibits a consistent uptrend. Remarkably, the robust accuracy under various attack intensities showcases a discernible hierarchy, wherein higher 𝜎 2 values correspond to augmented adversarial robustness. Specifically, the variations in robust accuracy across different attack intensities become more pronounced with increasing 𝜎 2 . Evidently, this underscores the significance of striking a balance between clean accuracy and adversarial robustness in real-world RSC applications. Achieving this balance necessitates meticulous exploration of 𝜎 2 values to pinpoint the optimal choice aligned with specific application requisites.To evaluate the effectiveness of our proposed RSC, we compare it with the results of existing state-of-the-art work. We conduct experimental comparisons in the case of FGSM and PGD white-box attacks on the CIFAR-10 and CIFAR-100 datasets. The hyperparameters of the attack are set to 𝜖 = 8/255 for FGSM and 𝛼 = 0.01 for PGD with a total of 7 steps. The comparison results are shown in Table 7 . CIFAR-10. On the CIFAR-10 dataset, employing the RSC VGG-5 model with a noise level of 𝜎 2 = 0.1, our approach showcased Furthermore, in comparison with the best-performing outcomes [9] , our approach achieved a substantial enhancement in accuracy by 9.29% for FGSM and 18.82% for PGD attacks. CIFAR-100. On the CIFAR-100, our utilization of the RSC VGG-11 model with a noise level of 𝜎 2 = 0.1 yielded notable advancements. The provided table demonstrates that our method elevated accuracy against FGSM and PGD attacks by 29.59% and 26.65%, respectively, surpassing the performance of the vanilla model. In comparison to the top-performing outcomes, our approach showcased compelling enhancements, achieving a remarkable 9.03% accuracy improvement for FGSM and 16.29% for PGD attacks.Upon comparing our experimental outcomes with the Stateof-the-Art (SOTA) approaches on the CIFAR-10 and CIFAR-100 datasets, our proposed method showcased significant enhancements in the model's adversarial robustness. F-QTE and P-QTE also achieve comparable results to SOTA. Notably, while augmenting adversarial robustness, we observed a decline in clean accuracy compared to the vanilla model. Hence, to achieve a balance between clean accuracy and adversarial robustness, we meticulously finetuned various hyperparameters involved in the training process.Parameters like the noise level 𝜎, the proportion of the loss function 𝜆, etc., were judiciously adjusted in the E-RSCT framework for refinement. However, achieving superior results still necessitates further extensive research and exploration. 
conclusion: 
 Our present work offers a theoretical foundation for the observed empirical robustness of Poisson-encoded classifiers against adversarial attacks. Observing that randomized smoothing and Poisson coding exhibit similar characteristics, we first demonstrate the equivalence between the two, explaining why Poisson coding SNNs have adversarial robustness. Furthermore, our theoretical analysis shows that randomized smoothing is more stable than Poisson coding. On this basis we propose a novel randomized smoothing coding, which enhances the adversarial robustness of SNNs. Experimental results show that our method achieves state-of-the-art adversarial robustness. However, there is still room for further improvement in clean accuracy. Therefore, valuable future work directions include further improving the trade-off between adversarial robustness and clean accuracy. We believe our work will pave the way for further research on more applications of safety-critical SNNs. 
 
 Appendix:  


Decision: This paper introduces Randomized Smoothing Coding (RSC) to improve the adversarial robustness and performance of spiking neural networks (SNNs). All the reviewers agreed that this paper presents an improvement in the robustness and performance of SNNs. Three reviewers highlighted the solid theoretical contributions of the paper, particularly the analysis demonstrating the equivalence between Poisson coding and randomized smoothing coding. Two reviewers also found that the proposed methods show promising quantitative results. 

One reviewer noted the lack of comparison with related work. Other weaknesses included the niche focus on SNN robustness and insufficient explanations of critical attack parameters and terms like "white-box and black-box attacks."  

I tend to accept this paper. However, the authors should include EOT experiments in the final version.

Reviews: review: paper_summary: paper_summary: This paper proposed a method named Randomized Smoothing Coding (RSC) to enhance the robustness and performance of SNNs. The authors also provided theorems and empirical observation to discuss the equivalence between RSC and traditional Possion coding from a mathematical perspective. Experimental results under different attack scenarios validated the effectiveness of RSC.
strength_weakness: strength_weakness: 1. The theoretical analysis of this paper is solid.
2. The authors have made numerous experiments to validate the effectiveness of their proposed method.
limitations: limitations: 1. The theme of this paper is not very suitable for the MM community.
2. Considering that the robustness of SNNs is a relatively niche topic in the SNN community, the contribution of this work may not be very significant.
paper_summary: paper_summary: A method of Randomized Smoothing Coding was proposed, and it was demonstrated that Poisson coding and randomized smoothing coding can be theoretically considered equivalent.
strength_weakness: strength_weakness: 1. Figure 1 clearly illustrates the distinctions between different encodings.
2. Additionally, the perspective that Poisson coding and randomized smoothing coding can be theoretically considered equivalent is further explored. The reasons why randomized smoothing coding may be superior to Poisson coding are explained on a theoretical level, with great detail and logical coherence.
limitations: limitations: 1. In line 151, the term "trade- off" has an extra space in the middle.
2. Regarding Figure 3(a), a more comprehensive explanation is required for the feature maps after different encoding layers. For instance, why does the feature map after the RS encoding layer appear cleaner compared to that after Poisson encoding?
3. The explanation of "white-box and black-box attacks" in the text remains unclear to the reviewer.
paper_summary: paper_summary: The author aims to enhance the adversarial robustness of spiking neural networks (SNNs) by studying the spiking encoding method. They prove the equivalence of Poisson coding and stochastic smoothing as the source of SNN's robustness. They propose Randomized Smoothing Coding and Efficient-RSC Training to improve SNN's robustness and clean accuracy. Experiments show that RSC-SNN enhances adversarial robustness compared to traditional ANN and SNN. The paper concludes that SNNs can maintain their robustness advantage on large-scale tasks.
strength_weakness: strength_weakness: The paper explores the trade-off between adversarial robustness and accuracy in Spiking Neural Networks through Randomized Smoothing Coding.

The topics are relevant to ACMMM.

The performance improvement is clear on various benchmarks.
limitations: limitations: The choice of noise levels (0.01, 0.1, 0.5) is here questioned as no information on the choice of the value.

The main contributions seem to be applications of existing techniques. Comparisons with previous works that defended against adversarial noise through input transformations are deemed insufficient.

The paper lacks check for gradient obfuscation, which could mistakenly attribute effectiveness to the defense method.

The advantage of Randomized Smoothing Coding over Poisson coding is unclear, especially since Poisson coding is more hardware-friendly for SNNs.

Using RSC may lead to performance degradation, which should be discussed in the conclusion.
paper_summary: paper_summary: This paper claims to offer a theoretical analysis of the equivalence between Poisson coding and randomized smoothing. Additionally, it employs randomized smoothing to train SNNs and observes improved robustness. Inspired by knowledge distillation, the paper suggests using an ANN as a teacher to train SNNs and devises a corresponding loss function.
strength_weakness: strength_weakness: (1) Randomized smoothing is a well-known technique for enhancing the robustness of ANNs, but it has not yet been applied to SNNs. This paper makes the first attempt to transfer this technique to SNNs.

(2) Training SNNs using knowledge distillation has not been explored yet.
limitations: limitations: Q1: This paper appears to overstate its theoretical contributions. The authors merely calculate the expectation and variance without providing rigorous mathematical proof of the equivalence between Poisson coding and random smoothing.

Q2: Why is there a linear relationship between classification accuracy and attack intensity, as shown in Fig.2? Is there any therotical or experimental proof of this relationship? I disagree with this assertion. Consequently, I believe the proposed QTE is not justified.

Q3: Thr.3.2 and 3.3 are based solely on a simple linear layer and do not include an analysis of fundamental firing functions or other neuronal dynamics. This makes the paper less relevant to SNN.

Q4: The paper lacks details on critical attack parameters. Specifically, what are the $\ell_\infty$ bounds for FGSM and PGD? Additionally, how many iterations are used in these attacks?

Q5: In Fig.4, the distinction between clean accuracy and FGSM/PGD accuracy is unclear from the caption. Based on the context, I assume that the dotted lines represent clean accuracy. Given this assumption, it's unusual that the FGSM/PGD accuracy is significantly higher than the clean accuracy. This requires further clarification.

Q6: This paper presents contradictory claims: on one hand, it asserts that Poisson coding is equivalent to randomized smoothing; on the other hand, it suggests that randomized smoothing is more stable than Poisson coding. These conclusions seem to conflict. If the two strategies are truly equivalent, then Poisson coding could be represented as a form of randomized smoothing with a specific $\delta$.