Toward Robust Spiking Neural Network Against Adversarial Perturbation
Abstract
As spiking neural networks (SNNs) are deployed increasingly in real-world efficiency critical applications, the security concerns in SNNs attract more attention.
Currently, researchers have already demonstrated an SNN can be attacked with adversarial examples.
How to build a robust SNN becomes an urgent issue.
Recently,many studies apply certified training in artificial neural networks (ANNs), whichcan improve the robustness of an NN model promisely.
However, existing certifications cannot transfer to SNNs directly because of the distinct neuron behavior andinput formats for SNNs.
In this work, we first design S-IBP and S-CROWN thattackle the non-linear functions in SNNs’ neuron modeling.
Then, we formalize theboundaries for both digital and spike inputs.
Finally, we demonstrate the efficiencyof our proposed robust training method in different datasets and model architectures.
Based on our experiment, we can achieve a maximum 37 .
7% attack errorreduction with 3 . 7% original accuracy loss.
To the best of our knowledge, this isthe first analysis on robust training of SNNs.
Introduction
Spiking neural networks (SNNs) are a class of models that have the potential ability to simulate thebehavior of neuron circuits in the brain.
Among the rich biological characters of SNNs, the eventdriven information propagation mechanism makes SNNs easy to deploy with limited computationresources.
Many neuromorphic chips are designed to achieve low power SNN inference, such as
TrueNorth (Akopyan et al., 2015), Loihi(Davies et al., 2018), SpinalFlow (Narayanan et al., 2020)and H2Learn
(Liang et al., 2021b).
With more attention to the study of SNNs the security issues also raise concerns in the community.
Adversarial attack (Szegedy et al., 2013; Carlini & Wagner, 2017; Athalye et al., 2018; Xu et al.,2020b) is one of the most intuitive ways to evaluate the robustness of a model.
In adversarial attacks,the attacker generates adversarial examples to fool a model predicting wrong.
Currently, SNNs aredemonstrated can be attacked through adversarial examples (Sharmin et al., 2019; Liang et al., 2021a;
Büchel et al., 2021b; Marchisio et al., 2021).
It is urgent to explore an efficient way to improve therobustness of SNN models.
Previously, researchers have investigated the impact of hyper-parameter selection (El-Allami et al.,2021) and input filtering (Marchisio et al., 2021) on the adversarial attack in SNNs.
However, thesemethods do not directly promote the classification behavior of a given SNN model.
(Büchel et al. ,2021a) proposes a robust training method that relies on the adversarial attack in the parameter space.
Unlike SNNs, how to improve the robustness of an artificial neural network (ANN) is well studied.
Recently, trianing a neural network model with certified defense methods (Wong & Kolter, 2018;
Mirman et al., 2018; Zhang et al., 2020; Xu et al., 2020a) show remarkable guarantee to improvethe model’s robustness.
CROWN-IBP (Zhang et al., 2020) is one of the most promising certifiedtraining methods with polynomial computianal cost compared with natural training.
The CROWNIBP method will compute the output boundary for a given bounded input.
However, the current CROWN-IBP method cannot be directly applied to SNNs.
Firstly, the neuron dynamic in SNNs is more complicated.
Hence, new boundary functions should be defined.
Secondly, SNNs accept bothspike and digital inputs, which requires additional boundary generalization for different input types.
Enlightened by certification training in ANNs, we designed an end-to-end robust training method toimprove the robustness of an SNN model against adversarial attacks.
Specifically, our contributionscan be summarized as follows:
• We design S-IBP and S-CROWN to tackle the non-linear fire function and temporal updatein SNNs which firstly introduce SNNs to the linear relaxation based verification family.•
We formalized ℓ 0 -norm and ℓ ∞ -norm boundaries for spike and digital inputs, respectively.• Our proposed methods are evaluated on MNIST (LeCun et al., 1998), FMNIST (Xiao et al.,2017) and NMNIST (Orchard et al., 2015) datasets. The experinetal
results show that
we can achieve a maximum 37 .
7% attack error reduction with 3 . 7% original accuracy loss
Preliminary and Related Work2.1 Spiking Neural Netowks (SNNs)
Neuron Modeling : Usually, SNNs are designed to simulate the neuron behavior in the brain.
In thiswork, we adopt the well-studied leaky integrated-and-fire (LIF) (Gerstner et al., 2014) for the neuronmodeling as Figure 1(a).
The state of a neuron at each time step is determined by its membranepotential m and its spike status s .
Specifically, a neuron will fire a spike to the post-synaptic neuronsonce its membrane potential is greater than a threshold th and its membrane potential will be resetto
at the same time.
An example of a neuron dynamic is shown in Figure 1(b) which simulates aneuron’s behavior in 5 time steps.
The spike status of a neuron can be formulated as
[Equation]
[Equation]
We use m t [ k ] and s t [ k ] to represent neurons’ membrane potentials and spike status at t -th timestep and k -th layer.
fire ( · ) is the Heaviside step function.
The membrane potential of a neuron iscomposed of spatial and temporal update that follows
[Equation]
The spatial update is a Convolution or Fully Connected or Pooling operation between the weight andthe spike events in previous layer.
The temporal update is determined by the neuron’s membranepotential and spike status in the previous time step.
Here, α is a scaling factor to control the decay.
[Figure]
Network Structure : SNNs are built with input layer, hidden layers, and output layer as Figure1(c).
In SNNs, the input layer receives spike inputs.
The hidden layers are CONV/FC/POOL that correspondto the spatial update in the neuron modeling.
Compared to ANNs, SNNs involve an additionaltemporal axis that passes the neurons’ status along with time steps.
The final recognition of an SNNis determined by the spike events of the output layer.
In this work, we adopt the rate coding, i.e., theneuron that fires the most spikes indicates the classification result.
Input Format : In this work, we focus on the image recognition tasks.
The input of an SNN can bespike events captured by DVS devices (Patrick et al., 2008).
Also, SNNs can take a digital image as input with an additional sampling.
In this work we adopt Bernoulli sampling (Deng et al., 2020) fordigital inputs that follows
[Equation]
We use ˙ x t to represent the spike input at time step t .
ˆ x is the digital input after normalization to [0 , 1] .
The example of spike and digital inputs are shown in Figure 1 (d).
Training Method : Recently, supervised learning via backpropagation through time (BPTT) has beenadopted in SNN training (Wu et al., 2018).
The BPTT-based training method can achieve a higheraccuracy and scalability compared to the unsupervised learning algorithms.
Also, the SNNs trainedwith BPTT require fewer time steps, which is more hardware friendly in the real deployment.
Thus,in this work, we focus on the SNNs trained with BPTT-based learning method.
2.2 Adversarial Attack in SNN
Adversarial attack is one of the most powerful threat models that affect a model’s security.
In thiswork, we use the adversarial attack as an assessment tool to evaluate the robustness of an SNN model.
Specifically, in this work we adopt a gradient-based attack method (Liang et al., 2021a) for SNNs.
Untargeted White-box Gradient-based Attack
: In adversarial attack, the attacker adds imperceptible noise on inputs to fool the model predicting wrong results.
In untargeted attack, the model predictsthe adversarial example as any other classes except the ground-truth, which can be formulated as
[Equation]
Here, f ( · ) is the prediction result, x is the original input, and δ is the noise added on the input.
In thiswork, we adopt white-box attack, which means the attacker knows all of the model information
The gradient-based attacks are the most efficient ways to generate adversarial examples.
In SNNs,the gradient-based attack for the spike and digital inputs can be formulated as
[Equation]
We use ˙ x ′ and ˆ x ′ to represent the spike and digital adversarial examples, i.e., x ′ = x + δ .
L and θ arethe loss function and parameters of the model, respectively.
The adversarial example is constructedby adding the gradient of inputs with the original label ( y org ) in loss function.
F is a filter functionthat samples, clips, and generates spike compatible noise.
During the attack, attackers can computethe adversarial examples iteratively.
We use n to denote the attack iteration.
2.3 Certified Training
[Figure]
Recently, the certified training (Gowal et al., 2018; Zhang et al., 2020; Xu et al., 2020a) has beendemonstrated to improve the guaranteed robustness of a neural network.
In this work, we leveragethe CROWN-IBP method (Zhang et al., 2020), one of the state-of-the-art certified training that canachieve tighter bounds in accepctable training cost.
Considering a digital input data bounded withℓ ∞ -norm, the goal of CROWN-IBP is to identify whether arbitrary input data within the boundarycan fool the model.
The CROWN-IBP contains two parts of bounding methods: IBP (Gowal et al.,2018) and CROWN (Zhang et al., 2018).
IBP :
In IBP processing, the lower and upper bounds of each layer’s feature map are computed alongthe forward propagation.
During the bound computation, the linear operation can be easily boundedonce we know the maximum and minimum values of input.
However, the upper and lower boundafter the non-linear operations need to be dedicated to analysis.
Once we acquire the bounds of outputwe can evaluate the robustness of the model for the given input purbation set.
CROWN : Unlike IBP, CROWN bounds the model in a backward propagation manner recursively.
The goal of CROWN is to formulate the output bounds as a linear equation of input.
In order toachieve this goal, every operation in an NN model should be bounded by two linear equations.
Although CROWN can achieve very tight bounds, the computinal cost is remarkably higher than
IBP.
So CROWN-IBP, by combining the fast IBP bounds in a forward bounding pass and CROWN in a backward bounding pass can efficiently and consistently outperforms IBP baselines on trainingverifiably robust neural networks. Integrate with Other Approaches :
One of the promising characteristics of certified training is thatit can be integrated with other algorithms.
For example, the combination of certified training andadversarial training can further improve the robustness of a model (Balunovi´c & Vechev, 2020; Fan& Li, 2021).
For the operations which can improve the performance of a model and only involvelinear operations, the certified training algorithm can be directly applied without causing additionalrelaxation losing (Tsuzuku et al., 2018; Wang et al., 2021).
Currently, the adversarial training (Kunduet al., 2021) and batch normalization (Kim & Panda, 2020, 2021; Bhattacharjee et al., 2022) aredemonstrated the effectiveness to improve the robustness of an SNN model, which have the potentialto be integrated into our proposed design in future.
Methodology
3.1 S-IBP & S-CROWN
As described in Section 2.3, the core mission of certification training is to find the bound of IBP and
CROWN for each function.
The information propagation in SNNs includes fire , temporal updateand spatial update as shown in Figure 1(a).
In this subsection, we detail the upper bound and lowerbound of S-IBP and S-CROWN for each function.
During the bound formulation of a function, weassume the S-IBP bounds for function inputs have been acquired.
Fire : The fire function describes the relation between the membrane potential m t and spike s t of aneuron as Equation 1 and 2, i.e. once the neuron’s membrane potential is greater than a threshold th ,the neuron will fire a spike.
Assume we have already acquired the S-IBP upper bound m ut and lowerbound m lt for membrane potential, the S-IBP bounds for spike can be calculated with
[Equation]
During S-CROWN, we need to find two linear equations to bound the fire function.
When the
S-IBP upper bound of membrane potential m ut is smaller than the threshold th , we can concludethat the neuron must not fire.
Also, when the S-IBP lower bound m lt is greater than the threshold,we can make sure the neuron must fire.
Thus, we mainly need to consider the unstable case, i.e.,m lt < th ≤ m ut .
In order to achieve the lowest bound relaxation, we design two boundary systems as
Figure 2(a) and (b).
We use the red line to represent the fire function.
The blue and yellow linesrepresent the boundary functions.
When the S-IBP lower bound of membrane potential m lt far smallerthan th , we set the S-CROWN lower bound to s t = 0 and the S-CROWN upper bound is a line thatcrosses ( m lt , 0) and ( th, 1) .
On the contrary, when m ut is far larger than th , we set the S-CROWNupper bound to s t = 1 and the S-CROWN lower bound is a line that passes ( th, 0) and ( m ut , 1) .
Overall, the S-CROWN boundary for the fire function under different cases can be summarized as [Equation] [Equation] 𝑚
[Equation]
[Equation]
𝑚 !
[Equation] 𝑚 ! [Equation] [Equation]
𝑡ℎ
[Equation]
𝑡ℎ) 𝒎 𝒕 𝟏 − 𝒔 𝒕 𝒛 𝒕 = 𝒎 𝒕
[Equation]
𝟏 − 𝒔 𝒕 ) 𝒎 𝒕 𝒎 𝒕 𝒎 𝒕 𝑡ℎ 𝑡ℎ 𝑡ℎ 𝑡ℎ 1𝑚 !
# 𝒔 𝒕 𝒔 𝒕
[Figure] Temporal Update : According to Equation 3, the temporal update of membrane potential can beformalized as αm t (1 − s t ) .
Since α is a constant factor, in this subsection we do not include it in theboundary analysis.
Assume z t = m t (1 − s t ) , and the S-IBP upper and lower bound for membranepotential at time step t has been acquired.
The relation between m t and z t can be described through
Figure 2(c).
Based on the LIF model, the membrane potential will be reset to 0 once its value acrossesthe pre-defined threshold th .
Thus, the S-IBP bounds for z t can be computed with
[Equation]
When m ut < th or m lt ≥ th , there is no boundary relaxation in S-IBP.
We only need to consider theboundary when m lt < th ≤ m ut (unstable case), where z t ∈ [ min (0 , m lt ) , th ) for unstable case.
During S-CROWN, z t can be also bounded without relaxation when m ut < th and m lt ≥ th .
The
S-CROWN upper bound (blue plane) and lower bound (yellow plane) for z t when m lt < th ≤ m ut isshown in Figure 2(d).
Here we use an additional (1 − s t ) axis to help us build the boundary.
Notethat the membrane potential is related to the spike status.
Once s t = 1 → (1 − s t ) = 0 , m t mustgreater than th and z t = 0 .
When s t =
→ (1 − s t ) = 1 , m t must smaller than th and z t = m t .
Thus we need to find two planes to bound these two function (red lines in Figure 2(d)).
In summary,the S-CROWN boundary for the temporal update can be formulated as
[Equation]
Spatial Update
The spatial update in SNNs is shown in Equation 3.
Similar to ANNs, the spatial update in SNNs iscomposed of CONV/FC/POOL (in this work we focus on the CONV and FC).
In SNNs CONV/FCtakes spike events and weight as input.
Since the spike events are in binary format, the S-IBP ofspatial update can be implemented with
[Equation]
We use sp t to represent the result of the spatial update.
⊗ denotes CONV/FC operation.
In Equation11, s lt [ k ] = 1 represents those pre-synaptic neurons in layer k who are must fire.
The stable firedpre-synaptic neurons contribute the same for both S-IBP upper and lower bound of sp t .
The unstabledpre-synaptic neurons can be represented with ( s lt [ k ] =
∩ s ut [ k ] = 1 ), whose upper and lower boundfor spike status are 1 and 0.
These unstable pre-synaptic neurons will perform CONV/FC with thepositive and negative weights to affect the S-IBP upper and lower bound of sp t .
Since the spatial update is a linear operation, the S-CRWON for spatial update does not haverelaxation.
We do not need to design boundary functions to bound the spatial update in SNNs.
3.2 Input Boundary Formalization
In SNNs, the input layer of an SNN model only accept binary spike.
The special data format for theinput layer leads to different boundary formalizations for spike and digital images.
Spike Input : An example of spike input is shown in Figure 1(d).
All elements in a spike data are inbinary format.
For each element ˙ x t [ i ] in a spike input, the boundary of that element can be eitherstable cases: ˙ x ut
[ i ] = ˙ x lt [ i ] = 0 ; ˙ x ut [ i ] = ˙
x lt [ i ] = 1 or unstable case: ˙ x ut
[ i ] = 1 , ˙ x lt [ i ] = 0 .
For aspike input with uncertainty noise, we can only control how many data points in the spike input areunstable.
Thus, the boundary for a spike input can be formulated with ℓ 0 -norm.
Specifically, we canpick size ( ˙ x ) × ϵ elements from a spike input and set them as unstable points.
Also, the l0-normboundary can be interpreted as the probability of an unstable element, which can be formulated as
[Equation]
Here, ˙ x ′ is an arbitrary adversarial example that has at most size ( ˙ x ) × ϵ data points different from ˙ x .
Note that we can only certify the robustness of a spike input after we have picked the unstable datapoints.
Under our robustness formulation, we cannot guarantee the robustness of a spike input undera given ℓ 0 -norm.
The reason is that the search space for ℓ 0 -norm cannot be bounded.
[Figure]
Digital Input :
[Figure]
Digital inputs need an additional sampling before feeding the data to the input layer as Equation 4.
Note that we have defined the ℓ 0 -norm boundary for a spike input.
We need to further explore how todefine a boundary for a digital input when its sampled data is bounded with ℓ 0 -norm.
Based on ouranalysis, we find that the corresponding digital input boundary can be formalized with ℓ ∞ -norm as Figure 3.
We use rand t to represent a rand mask to achieve Bernoulli sampling for each time step:
[Equation]
After we bound the digital input with ℓ ∞ -norm, the upper bound of digital image becomes ˆ x u
=ˆ x + ϵ/ 2 and the lower bound is ˆ x l
= ˆ x − ϵ/ 2 .
For all elements in ˆ x , the difference between the upperbound and the lower bound is ϵ , i.e., ˆ x u
[ i ] − ˆ x l
[ i ] =
ϵ .
For each time step, ˆ x u and ˆ x l use the identicalrandom map rand t to sample the corresponding spike inputs ˙ x ut and ˙ x lt .
Based on the samplingprocessing, the probability of an element in input layer is unstable can be formulated as
[Equation]
From the static perspective, the ℓ ∞ -norm boundary for digital input is equivalent to the ℓ 0 -normboundary for spike input.
For digital inputs, although we apply ℓ ∞ -norm on input boundary, we cannot guarantee the robustnessof the input under such boundary.
Since for an digital input, the possible sampled results are equivalentto the entire space (each element in the spike input can be 1 or 0), which cannot be bounded. For both spike and digital inputs, we need to carefully select ϵ for robust training. An extremely smallϵ will cause the upper and lower bound identical which does not consistent with linear relaxation.
Alarge ϵ may cause the following robust training to diverge.
In this work, ϵ is selected based on thenoise magnitude in adversarial attacks and some empirical experiments.
3.3 Robust Training Algorithm
In this subsection, we present the end-to-end robust training for an SNN.
For the overall flow, ourmethod will first run S-IBP to get the boundary of intermediate data. Then we apply the S-CROWNwhich needs the S-IBP bound. Finally, we apply the certification-based robust training.
Flexible Time Steps : We note that for each SNN layer, the parameters are shared among differenttime steps.
Thus, we can set arbitrary time steps T ′ for the robust training.
S-IBP : During the robust training, the inputs first pass the S-IBP as Algorithm 1.
At the beginning,the input is bounded according to the input type.
Then, the intermediate data are bounded along theforward direction.
Finally, the upper and lower bound of all intermediate data are stored which willbe used during the S-CROWN phase.
Input:
[Table]
or
[Table]
T ′ ;
Func: for t = [Table] to T ′ do // input boundary formalization if ˆ x then generate random map rand t ; ˙ x ut = [Equation]
[Equation]
− rand t > 0 ? 1 : 0; ˙ x
[Equation]
=
[Equation]
rand
[Equation]
>
[Equation]
1 : 0; else Randomly
[Table]
[Table] [Table]
from
[Table]
and label
[Table]
with
[Table]
; ˙ x ut = ˙ x [Equation] = ˙ x t ; ˙ x ut [
[Table]
] =
[Table]
˙ x lt [
[Table]
t ] = 0 ; end if
[Table]
ut [0] = ˙ x ut ; s lt [0] = ˙
x lt ; inital m ut
[ k ] = m lt [ k ] = 0 for all layers. //S
[Table]
IBP for k = 1 to K do //
[Table]
update (Equation 11) m ut
[ k ]+ = sp ut
[ k ] ; m lt [ k ]+ = sp lt [ k ] //
[Table]
(Equation 9) if t < T ′ then m ut +
[ k ] =
[Table]
∗ z ut ; m lt +1 [ k ] =
α ∗ z lt ; end if //fire
(Equation 7) s ut
[Table]
] =
[Table] [Table]
ut [
[Table] [Table]
lt [
[Table]
=
[Table] ( m lt [
[Table]
] − th ) ; end for end for Return
[Table]
and lower
[Table]
of intermediate
[Table]
˙ x ut , ˙ x lt , m ut , m lt , s ut , s lt
S-CROWN : Note that the goal of S-CROWN is to formulate the output bounds of a model as linearequations of input’s upper and lower bounds.
The boundary of S-CROWN is computed from thebackward direction, and the detail is shown in Algorithm 2.
Finally, we can follow the robust trainingmethod in (Zhang et al., 2020) and use the lower bound of S-CROWN to train the SNN model.
[Table]
[Table] [Table] [Table] : //S-CROWNbuildidentity I matrix; As t [ K ] = I/T ′ ; for k = K to 1 do initial Am t [ k ] = 0 for all time steps for t =
T ′ to 1 do
//fire
(Equation 8) build m t [ k ] ∗ d 1 l + b 1 l ≤ s t [ k ] ≤ m t [ k ] ∗ d 1 u + b 1 u ;
Am t [ k ] + =
As t [ k ] − ∗ d 1 u + As t [ k ] + ∗ d 1 l ; bias + =
As t [ k ] − ∗ b 1 u + As t [ k ] + ∗ b 1 l ; //temporal update (Equation 10) if t > 1 then build m t − 1 [ k ] ∗ d 2 l + (1 − s t − 1 [ k ]) ∗ d 3 l ≤ z t − 1 [ k ] ; build m t − 1 [ k ] ∗ d 2 u + (1 − s t − 1 [ k ]) ∗ d 3 u ≥ z t − 1 [ k ] ;
Am t − 1 [ k ] = α ∗ ( Am − t
[ k ] ∗ d 2 u + Am + t
[ k ] ∗ d 2 l ) ; tmp s = α ∗ ( Am − t
[ k ] ∗ d 3 u + Am + t [ k ] ∗ d 3 l ) ; As t − 1 [ k ] − = tmp s ; bias + = sum ( tmp s ) ; end if //spatial update; As t [ k − 1]
=
Am t [ k ] ∗ w [ k − 1] ; bias + =
Am t [ k ] ∗ b [ k − 1] ; end for end for Return (cid:80) t (cid:16) As t [0] ∗ (˙ x ut + ˙ x lt ) / 2 − | As t [0] | ∗ (˙ x ut − ˙ x lt ) / 2 (cid:17) + bias
Experiment
4.1 Experiment Setup
Dataset and Network Structure : In this work, we evaluate our robust training method on threedatasets: MNIST (LeCun et al., 1998), FMNIST (Xiao et al., 2017) and NMNIST (Orchard et al.,
MNIST and FMNIST are digital datasets and NMNIST is spike dataset.
For each dataset, weuse two network structures in experiments.
The detailed setting for datasets and network structuresare shown in Table 1.
We set the firing threshold th and decay factor α to 0.25 in Equation 1 and 3. Our experiments are conducted by Pytorch 3.8.
The hardware we use is GPU V100.
[Table]
Original and Robust Training :
In original training, we adopt BPTT based training (Wu et al., 2018).
We train 80 epochs for each SNN model.
The learning rate is set to 0.01 at the beginning, it decays to0.
at the 55 th epoch.
In robust training, we use the lower bound of S-CROWN as the loss function.
During robust training, we set ϵ to 0 at the beginning.
It will increase linearly to the final ϵ during thefirst 250 training epochs.
In the last 50 training epochs, ϵ is unchanged.
Adversarial Attack : In this work we adopt the untargeted white-box gradient-based attack (Lianget al., 2021a) in SNN.
In our experiment, we select 300 examples for each dataset to apply adversarialattack.
In order to bound the noise of adversarial examples, we involve additional constraints duringthe attack.
Specifically, for digital inputs, we clip the adversarial example for each attack iteration tomake the adversarial example stay in the boundary.
For spike inputs, each attack iteration we limitthe amount of changed elements to size (ˆ x ) ∗ ϵ/ 2 and size (ˆ x ) ∗ ϵ/ 6 for FC and CONV networks toachieve the highest attack efficiency.
4.2 Robust Training in SNNs
Selection of Robust Training Time Steps T ′ :
We do not follow the original time steps duringthe robust training.
Because the spatial computations in SNNs share the same parameters between
[Table]
different time steps, we can use arbitrary robust training time steps T ′ .
In Figure 4 we analyzed theimpact of T ′ on original accuracy and S-CROWN loss.
Note that we would like to keep a higheroriginal accuracy but reduce the S-CROWN loss after the robust training.
From the result, we can findthat T ′
= 3 gives the optimal solution.
It implies that a too smaller T ′ cannot capture the temporaldynamics of SNNs and a larger T ′ may cause the boundary functions in S-CROWN to become tooloose.
Also we find that the robust training time for each epoch is 2 .
6 × , 7 . 7 × , and 12 .
9 × with respectto the original plain training when we set T ′ to 1, 3, and 5.
Thus, the selection of T ′ also affects therobust training efficiency.
In the rest of our evaluations, we set T ′
= 3 for all robust training.
Robust Training on Variaous Datasets : The analysis of robust training on different datasets withvarious ϵ and network structures is shown in Figure 5.
From the result, we have the followingobservations: 1.
During the robust training, it is more stable for a fully connected network(yellowcurves are smoother than blue curves) because of the simpler network structure.
With a larger ϵ ,the original accuracy is dropped more after the robust training.
Also, it is more difficult to achieve asmaller robust error with larger ϵ . 3.
In the MNIST dataset, when the network structure is CONV, therobust training is more stable as ϵ becomes larger.
The potential reason is that when ϵ is small, theflipped regions in spike inputs are more diverse.
In FMNIST and NMNIST datasets, when thenetwork structure is CONV, the robust training is much more fluctuating.
For FMNIST dataset, theunstable may be caused by the more complicated input data (cloths) and the lower convergence inoriginal training (final accuracy is 89.53%).
For NMNIST dataset, the unstable may come from thelarger input data size.
A larger input size indicates the potential input regions that can be attackedbecomes more.
By considering the original accuracy and S-CROWN result after the robust training,we select the ϵ as shown in Table 2.
We use FC- ϵ and CONV-
ϵ to represent the noise boundary weselected for different network structures during robust training.
4.3 Network Robustness Evaluation
We use untargeted white-box adversarial attack to compare the robustness between the original modeland the model after robust training.
The robustness comparison is shown in Table 2.
We use theoriginal error rate to reflect the accuracy of a model on the 300 test data.
The original error may havevariance during the evaluation for the digital image dataset because of the input sampling mechanism.
In our experiment, we select the attack ϵ to achieve approximately 20%, 30%, 40%, and 50% attackerror rate on the original model.
From the result, we can find that after the robust training, the modelsare harder to be attacked with adversarial example in all cases.
We also find that the model afterrobust training is more secure when the attack ϵ is larger, even though the ϵ for robust training isfar smaller.
The potential reason is that the binary behavior of the spike events causes the boundarypropagation to diverge quickly, which makes the final boundary cover more noisy inputs.
Finally, wefind that model robustness can be improved more when the network structure is CONV, since moreparamters can be adjusted under the CONV model.
From the result, we find that the CONV model in
MNIST achieves the highest robustness improvement, i.e. the attack error rate reduces 37 .
7% with3 .
7% original accuracy loss when the attack
ϵ equals 0.190.
Discussion & Conclusion
In this work, we aim to design an efficient robust training method for SNNs based on the certifiedmethods.
Specifically, we design S-IBP and S-CROWN to tackle the distinct non-linear neuronbehaviors in SNNs.
Also, we formulate the input boundary for different input types.
Based on ourresults, we can achieve at most 37 .
7% attack error reduction with 3 . 7% original accuracy loss, whichdemonstrates the efficiency of our proposed method. Border Impact
SNN is a class of neural networks that inherit the biological model of the neuron dynamics in thebrain.
As the accuracy of SNNs becomes higher, the security issue attracts more attention.
In thiswork, we design S-IBP and S-CROWN that apply certification-based robust training to improve therobustness of an SNN model. Our work can help to improve the misclassification rate of an SNNin real-world deployments. We believe our work can provide a positive impact on the performanceof the SNN models. Also, we encourage researchers to seek other techniques and factors that canpotentially affect the performance of an SNN model.
A S-CROWN on Directed Encoding
Instead of rate-coding
[Table]
directed encoding is another popular input coding mechanism that directlyapplies a CONV or FC layer on the original digital as the first layer (Wu et al., 2018;
Kim et al., 2022).
Currently, the directed encoding only takes digital inputs.
Since the input does not involve samplingor binary patterns
[Table]
we can apply ℓ ∞ norm to build the input bounds.
The results of certification-basedrobust training are shown in Figure 6.
From the result
[Table]
we can find that the indicators (original acc,
S-CROWN loss, S-CROWN robust error) during training follow a similar trend as the rate-coding.
[Table]
Next
[Table]
we evaluate the model robustness against adversarial training in Table 3.
As the result, ourmethod can at most achieve 29.6% error rate reduced with 7.3% original accuracy loss, whichdemonstrated the effectiveness of our proposed method on directed encoding.
B Example of Input Bounds
[Figure]
An example of input bounds after sampling for the MNIST database is shown in Figure 7.
Here,we show the upper and lower bounds for one time step.
After we applied the bounding method in
Section 3.2 the background of the lower bound image before sampling is the same as the originalimage whose gray values are 0.
In contrast, the skeleton of the content in the upper bound imagebefore sampling is unchanged compared to the original image.
The gray values of the skeleton are 1.
Note that the unstable points are located in the region where the gray values in the bounded imagediffer from the original image.
Thus, the number of unstable points in the upper bound after samplingis more, most of them located in the background.
Checklist
For all authors...
(a) Do the main claims made in the abstract and introduction accurately reflect the paper’scontributions and scope?
[Yes]
(b) Did you describe the limitations of your work?
[Yes]
(c) Did you discuss any potential negative societal impacts of your work?
[Yes]
(d) Have you read the ethics review guidelines and ensured that your paper conforms tothem?
[Yes]
If you are including theoretical results...
(a) Did you state the full set of assumptions of all theoretical results?
[Yes]
(b) Did you include complete proofs of all theoretical results?
[N/A]
If you ran experiments...
(a) Did you include the code, data, and instructions needed to reproduce the main experi-
mental results (either in the supplemental material or as a URL)?
[Yes]
(b) Did you specify all the training details (e.g., data splits, hyperparameters, how theywere chosen)?
[Yes]
(c) Did you report error bars (e g., with respect to the random seed after running experiments multiple times)?
[Yes]
(d) Did you include the total amount of compute and the type of resources used (e
g., typeof GPUs, internal cluster, or cloud provider)?
[Yes]
If you are using existing assets (e
g., code, data, models) or curating/releasing new assets...
(a) If your work uses existing assets, did you cite the creators?
[Yes]
(b) Did you mention the license of the assets?
[Yes]
(c) Did you include any new assets either in the supplemental material or as a URL?
[No]
(d) Did you discuss whether and how consent was obtained from people whose data you’re
using/curating?
[Yes]
(e) Did you discuss whether the data you are using/curating contains personally identifiable
information or offensive content?
[Yes]
If
you used crowdsourcing or conducted research with human
subjects
(a) Did you include the full text of instructions given to participants and screenshots, if
applicable?
[N/A]
(b) Did you describe any potential participant risks, with links to Institutional Review
Board (IRB) approvals, if applicable?
[N/A]
(c) Did you include the estimated hourly wage paid to participants and the total amount
spent on participant compensation?
[N/A]