SNN-RAT: Robustness-enhanced Spiking Neural Network through Regularized Adversarial Training
Abstract
Spiking neural networks (SNNs) are promising to be widely deployed in realtime and safety-critical applications with the advance of neuromorphic computing.
Recent work has demonstrated the insensitivity of SNNs to small random perturbations due to the discrete internal information representation.
The variety of training algorithms and the involvement of the temporal dimension pose more threats to the robustness of SNNs than that of typical neural networks.
We account for the vulnerability of SNNs by constructing adversaries based on different differentiable approximation techniques.
By deriving a Lipschitz constant specifically for the spike representation, we first theoretically answer the question of how much adversarial invulnerability is retained in SNNs.
Hence, to defend against the broad attack methods, we propose a regularized adversarial training scheme with low computational overheads.
SNNs can benefit from the constraint of the perturbed spike distance’s amplification and the generalization on multiple adversarial ϵneighbourhoods.
Our experiments on the image recognition benchmarks have proven that our training scheme can defend against powerful adversarial attacks crafted from strong differentiable approximations.
To be specific, our approach makes the black-box attacks of the Projected Gradient Descent attack nearly ineffective.
We believe that our work will facilitate the spread of SNNs for
safety-critical applications and help understand the robustness of the human brain.
The code is available at https://github.com/putshua/SNN-RAT
Introduction
Spiking Neural Networks (SNNs), unlike traditional Analog Neural Networks (ANNs), mimic the neuronal behaviours of a biological brain through spatio-temporal dynamics and spike representation [Gerstner et al., 2014], which represent the forefront of neural networks [Maass, 1997, Zenke et al., 2021].
The neurons evolve their membrane potentials as time goes by and transmit discrete information by 0 (nothing) and 1 (a spike).
After the transmission, the membrane potentials are reset to the rest value and wait for the incoming input.
Currently, the training algorithm of SNNs is a hot research topic due to the unique discrete spike activation.
This results in a fundamental difference in training methods compared with ANNs.
The rise of neuromorphic computing has allowed SNNs to run with more compatible hardware and a lower energy cost [Pei et al., 2019, DeBole et al., 2019, Davies et al., 2018, Nieves and Goodman, 2021, Fang et al., 2020].
The combination of SNN and neuromorphic hardware can enable numerous applications, such as spatiotemporal pattern recognition and high-speed detection [Wu et al., 2018a, Xu et al., 2020, Kim et al., 2020, Kheradpisheh and Masquelier, 2020, Zenke and Neftci, 2021].
For safety-critical applications such as autonomous driving, the reliability of the system becomes crucial, especially the robustness of the model against perturbations, such as additive Gaussian noise.
Among all the perturbations, the adversarial attack is one of the most powerful categories [Szegedy et al., 2014, Goodfellow et al., 2015].
It can generate subtle perturbations that are usually neglected by the human perception system.
The perturbations, however, can deteriorate the capability of the system, that is, the model produces incorrect labels with a high probability.
This could have serious impacts on those safety-related applications, where a single failure could have devastating results.
Up to now, a wide variety of adversarial attack methods have been proposed [Madry et al., 2018].
The vulnerability holds even from a model that is trained for the same task but with a different architecture.
The operation mechanism and structure of SNNs are similar to those of the biological brain, and studying its response to perturbation can help us understand how the human brain works.
SNNs are recognized as a new potential candidate with adversarial robustness due to its input coding and neuronal dynamics [Perez-Nieves et al., 2021, Leontev et al., 2021].
Among the coding schemes commonly used in SNN, constant input coding is considered to be more susceptible to disturbances than others, like Poisson coding [Sharmin et al., 2020].
Therefore, Kundu et al.
[2021b] suggested that careful training is required for constant input coding.
In this setting, SNNs are now facing more challenges than typical ANNs.
Because the key to constructing SNNs gradient-based attacks is back-propagation, which is the same as that of ANNs.
However, compared with ANNs, SNNs can learn through various gradient approximations.
Therefore, combining various differentiable approximations and attack methods will pose a more severe threat to SNNs [Liang et al., 2021].
The inter-layer communication of SNNs is through spikes with a time dimension, which is very different from ANNs.
Therefore, one question can be raised naturally: whether and to what extent does spike communication detain adversarial invulnerability?
And, are there training tools that can help SNNs defend against the threats described above?
This paper aims to extend the Lipschitz analysis theory to spike representation and propose a more robust training algorithm on this basis.
Our main contributions are summarized as follows:
• We design and summarize different differentiable approximations which can be deployed in gradient-based attacks to show the vulnerability of SNNs.
Backward pass through time and rate are found to be capable of constructing stronger attacks.
• We theoretically analyze the l 2 perturbation distance on the representation of spikes and give a mathematical expression of the spiking Lipschitz constant.
• We propose a regularized adversarial training scheme for SNNs.
It not only constrains the spiking Lipschitz constant but also exploits the mixture of the identified strong single-step adversarial attacks.
• Our experiments show that the proposed scheme can significantly improve the adversarial robustness in the image recognition tasks.
The trained model exhibits better resistance under stronger Projected Gradient Descent attacks compared to the vanilla models.
Background and Related Work 2.1 Robustness of Spiking Neural Networks
The concept of spike representation is where SNNs are different from ANNs.
Typically, the input is encoded as sequences ( T × N 0 ), with T denoting the total number of time-steps and N 0 denoting the number of the input nodes.
The neurons in SNNs, like ANNs, receive a linear combination of the previous layer’s output.
The mechanism of leaky-integrate-fire (LIF) leads to the non-linearity nature of SNNs.
Overall, the dynamic of the membrane potential m l ( t ) of neurons in layer l ( l = 1 , 2 , · · · , L ) at time-step t ( t = 1 , 2 , · · · , T ) can be described by:
[Equation]
where s l ( t ) denotes the binary spikes of neurons in layer l at time t , which equals to 1 if there is spike.
m l ( t − ) denotes the instantaneous state of membrane potential before triggering a spike, which accumulates the weighted input from presynaptic neurons in the last layer.
When the potential exceeds the predefined threshold θ , a spike is generated at time t , and the membrane potential m l ( t ) is reset to zero.
Otherwise the membrane potential m l ( t ) either leaks by λ for LIF model ( λ ∈ (0 , 1) ), or maintains for Integrate-and-Fire (IF) model ( λ = 1 ).
The leaking potentials described above intuitively smooth the noise in the input current, which is an appealing characteristic for trustworthy neural networks.
Indeed, SNNs can demonstrate robustness under certain conditions.
Sharmin et al.
[2020] presented their pioneering work on input discretization and leaky rate.
They highlighted that specific input coding could improve the robustness of SNN.
Up to now, Poisson coding, latency coding, and time-to-first-spike coding have been proven to have an effect on small datasets [Sharmin et al., 2020, Leontev et al., 2021, Nomura et al., 2022].
Sharmin et al.
[2019] also found that SNNs trained by surrogate functions can boost the robustness of Poisson coding.
Whereas, SNNs are not completely secure.
Marchisio et al.
[2020] pointed out that black-box attacks can also attack SNNs.
El-Allami et al.
[2021] searched for the structural parameters of SNNs to improve the robustness.
Among rate coding, constant input coding (or direct coding) is shown to detain less robustness, which has been discussed in several papers [Kim et al., 2022, Kundu et al., 2021b].
Based on careful observations, Kundu et al.
[2021b] asserted that fine training is essential for the robustness of direct-coding SNNs.
Motivated by this, we propose a regularizer that can promote robust training schemes for SNNs.
2.2 Gradient-based Adversarial Attacks
Most adversarial attacks consider a perturbation δ in an l p ball around clean data x and can be formulated as an optimization problem:
[Equation]
where y is the target, L is the loss function, f denotes the network with W as parameters, and ϵ is the parameter that guarantees the perturbation is imperceptible.
Here, we introduce two widely adopted gradient-based adversarial attack algorithms: Fast Gradient Sign Method (FGSM) and Projected
Gradient Descent method (PGD).
FGSM .
As one of the simplest methods, the main idea of FGSM is to perturb the data along the sign of the gradient to increase the perturbed linear output, which can be expressed as follows [Goodfellow et al., 2015]:
[Equation]
PGD .
PGD is an iterative version of FGSM, which offers a more powerful attack [Madry et al., 2018] and is convinced to reasonably approximate the optimal attack.
The iteration can be summarized as:
[Equation]
where k denotes the number of the iteration step and α is the step size of each iteration.
Π ϵ denotes that the data in each iteration should be projected onto the space of the l p ball around clean data x w.r.t.
ϵ .
Apart from these popular gradient-based attacks, RFGSM can be viewed as a randomized version of FGSM [Tramèr et al., 2018], and BIM is a kind of iterative attack similar to PGD [Kurakin et al., 2017].
All these methods are exploited to verify the vulnerability of SNN in this work.
By applying differentiable approximations in back-propagation, the gradient-based attacks can also threaten SNN.
In this work, we execute white-box (WB) and black-box (BB) attacks for scenarios where attackers have knowledge of or no knowledge of the model.
Without specific instructions, we set ϵ to 8 / 255 for all methods for the purpose of testing.
For iterative methods like PGD and BIM, the attack step α = 0 .
01 , and the step number is 7.
2.3 Defense Methods
The earlier research on ANNs has discovered that adversarial attacks can cause the amplification of activation magnitude [Szegedy et al., 2014].
They measured the distance between clean and perturbed activation and suggested an analysis framework based on Lipschitz analysis:
[Equation]
where Lip l is the Lipschitz constant for layer l .
By penalizing the Lipschitz constant, the distortion of input is stabilized [Cisse et al., 2017].
Using exact estimation of Lipschitz bounds to certify the robustness of ANNs has been popular [Arjovsky et al., 2017, Fazlyab et al., 2019, Weng et al., 2018,
Miyato et al., 2018].
Yet there is no work currently working on the Lipschitz bound of SNNs.
Apart from the analysis framework, adversarial training is the most powerful tool for defense, which is defined as a saddle point problem [Madry et al., 2018]:
[Equation]
where the maximization process can be accomplished by applying different attack methods.
By utilizing the adversarial input, the adversarial training learns to classify adversarial examples correctly.
All these methods are based on deep ANNs, which are locally differentiable and have well-defined derivatives.
In this paper, we aim to construct an analysis framework for non-differentiable SNNs and strengthen the adversarial training.
Vulnerability of Spiking Neural Networks 3.1 Spiking Neural Network under Attack
Although SNNs are more robust than ANNs under some conditions, most SNNs are still vulnerable when effective adversarial attack methods are applied.
Previous works have experimentally demonstrated that gradient attack methods such as FGSM can be applied to SNNs [Sharmin et al., 2019, 2020].
However, because of the non-differentiable property of spiking neurons, the gradients obtained by backpropagation are not necessarily accurate, which may cause inefficient attacks.
Thus, this defensive nature of SNNs can be thought of as obfuscated gradients [Athalye et al., 2018], which may create a false sense of security about SNNs.
Therefore, in this paper, we first reconsider the attacks for SNNs by utilizing a combination of attack methods and gradient approximations.
We follow the Backward Pass Differentiable Approximation (BPDA) technique [Athalye et al., 2018] to overcome the obfuscated gradients.
The key idea of the
BPDA is to use a differentiable approximation in the backward pass while the forward pass unchanged.
Similar differentiable approximation techniques have been used for training SNNs.
Based on these, we design, compare, and summarize different differentiable approximations for SNNs.
3.2 Differentiable Approximation for Spiking Neural Networks
Conversion-based Approximation.
The Conversion-based Approximation (CBA) for SNN was first proposed by Sharmin et al.
Since an SNN can be converted from an ANN [Rueckauer et al., 2017, Han et al., 2020, Deng and Gu, 2021, Ding et al., 2021, Bu et al., 2022a,b], the adversarial examples can be generated from an ANN with shared weights and bias from the source SNN.
However, this method approximates the spiking neuron using the ReLU activation function on both forward pass and backward pass, which is contrary to the idea of the BPDA algorithm and is proved to be ineffective [Song et al., 2018].
Backward Pass Through Time.
The most commonly used differentiable approximation is the
Backward Pass Through Time (BPTT) with surrogate gradients [Neftci et al., 2019, Fang et al., 2021b].
In this method, the non-differentiable neuron fire function is replaced by a differentiable function on the backward pass.
By combining Eq. [-
 –Eq.-]1–Eq. 3, the backward pass can be described as:
[Equation]
[Table]
The final result ∂L ∂ s 0 ( t ) can be calculated by recursively calculating this equation across both layers and time-steps.
And since we use the constant input coding for SNNs, the gradient of the image is exactly ∂L ∂ s 0 ( t ) .
The non-differentiable part ∂ s l +1 ( t ) ∂ m l +1 ( t − ) is replaced by a surrogate gradient function to get a smooth backward pass.
The backward pass through time technique uses a similar gradient approximation as the Spatio-Temporal-Backward-Propagation training algorithm
[Wu et al., 2018b].
Since the gradient generated from this method is useful for training, it is very likely to generate effective gradients.
Backward Pass Through Rate.
Another differentiable approximation is the Backward Pass Through
Rate (BPTR).
In this method, the backward pass takes the derivative directly from the average firing rate of the spiking neurons between layers.
We consider neurons at each time-step equivalent, and the derivative is determined by the average firing rate.
[Equation]
Since the relationship of the firing rates in adjacent layers for non-leaky IF neuron is nearly linear [Sengupta et al., 2019], the gradients of ∂ 1 T (cid:80) Ti =
s l
+
( i ) /∂
1 T (cid:80) Ti =
s l ( i ) can be approximated using the straight-through estimator [Bengio et al., 2013].
Similar to Lee et al.
[2020], here we use the constant 1 T to approximate the value of ∂ 1 T (cid:80)
Ti =
s l
+
( i ) /∂
1 T (cid:80) Ti =
s l ( i ) at Eq.
The backward pass of the complete neuronal dynamic is approximated by one single function, and the gradient will not accumulate through time-steps.
As the forward pass still follows the rule of the spiking neurons, the obtained gradients will be more accurate than the conversion-based attack.
3.3 Effective Attack with Backward Pass through Time and Rate
To compare the effectiveness of the above three differentiable approximation techniques in constructing gradient-based attacks for SNNs, we applied combinations of three gradient-based methods (FGSM, RFGSM, PGD) and three differentiable approximation techniques (CBA, BPTR, BPTT) to two baseline models.
The two models, VGG-11 and WideResNet-16, are trained on the CIFAR dataset using BPTT with no additional defenses.
The number of time-steps is set to T = 8 .
As shown in Tab. 1, the CBA is the most ineffective differentiable approximation technique to construct attacks for SNNs.
The performance of all models under attack using CBA is significantly higher than that of models under attack using BPTR and BPTT.
As we have discussed in Sec. 3.2 when using
CBA, the changes in both forward pass and backward pass cause inaccuracy in the generated gradient.
Both the BPTT and BPTR methods, combined with different attack methods, can significantly reduce the performance of the given model.
Among all single-step attack combinations, FGSM(BPTR),
RFGSM(BPTT), FGSM(BPTT), and RFGSM(BPTT) can generate efficient and effective adversarial examples for all the testing models.
Among all multi-step attacks, the PGD(BPTT) always beats other attack combinations.
These results suggest different properties between BPTT and BPTR.
The BPTT approximation contains extra temporal information that is useful when using multi-step attacks, while the BPTR approximation saves more computation resources when back-propagating through firing rates and can get comparable results on single-step attacks.
Methods: Perturbation Analysis and Regularized Adversarial Training
The previous section identifies threats from effective differentiable approximations combined with gradient-based attacks.
In this section, we will give a theoretical perturbation analysis under SNN attacks and propose a regularized adversarial training scheme.
4.1 Perturbation Analysis for Spike Representation
Current perturbation analysis of ANN considers the distance of continuous activation ∥ a l − (cid:101) a l ∥ and the rectified linear outputs ∥
f ( a l ) − f ( (cid:101) a l ) ∥ .
Kundu et al.
[2021b] used this rate-based distance to bridge the robustness of ANN and SNN.
Spike trains in SNN not only contain rate information but also have a temporal structure.
To evaluate the distance in the spike train space, various kernel methods are proposed for neuronal identification and encoding [Weng et al., 2018].
Inspired by these works, we propose to model the distortion of the spike response using the spike train distance, which may bridge the robustness of SNN to the discovery of neuroscience and is also sensitive to the change of both firing rate and temporal information.
Denote the output spike train of the l th layer as
S l = { s l ( t ) | t = 1 , 2 , · · · , T } ∈
χ T × N l ( χ ∈ { 0 , 1 } ), where T is the number of time-steps and N l is the number of neurons in layer l .
Then the perturbation distance can be formulated as ( p ≥ 1 ):
[Equation]
(12) where ∥ · ∥ p,p denotes the l p entry-wise matrix norm and ∥ · ∥ p denotes the l p vector norm.
(cid:101) S l is the perturbed version of S l .
Since the p power of spike activation values (0 and 1) are themselves, without loss of generality we set p = 2 .
In Theorem 1, we obtain a Lipschitz constant for the spike train distance.
Theorem 1.
Given an L-layered SNN intended to inference T time-steps with θ as threshold, suppose that there are N l neurons in layer l for l = 1 , 2 , · · · , L .
W l ∈ R N l × N l − 1 .
For layer l , it satisfies:
[Equation]
where Λ l is a Lipschitz constant and Γ l is a constant for layer l , which can be expressed as:
[Equation]
where γ l = sup s ̸ =0 , s ∈
χ Nl − 1 ∥ W l s ∥ ∞ + sup s ̸ =0 , s ∈
χ Nl − 1 ∥ − W l s ∥ ∞ .
χ
= { 0 , 1 } , ψ = {− 1 , 0 , 1 } .
In Eq.
14, Λ l is referred to as the spiking Lipschitz constant .
Since the inter-layer spike signals are not purely linear and the effect of the spiking generation mechanism cannot be neglected, the inequality relationship expressed by Eq.
13 is not exactly the same as the definition of the classical
Lipschitz constant [O’Searcoid, 2006].
Nonetheless, this does not affect our understanding of the amplification effect of spike distance.
On the right side of Eq. 13, there is an additional constant Γ l related to the weight.
The appearance of Γ l is associated with the spike generation and the bounding of the current.
The determination of Γ l adopts a very loose constraint (see our proof in the Appendix), and its effect on the spike distance is additive, so we will still focus on how to constrain the spiking
Lipschitz constant while not magnifying the additive item excessively.
4.2 Constraining Spiking Lipschitz Constant
Here we explain why SNNs are thought to be more robust than ANNs and how to constrain the spiking Lipschitz constant in Eq. 13.
Szegedy et al.
[2014] has concluded that the upper bound of the Lipschitz constant for ReLU-based layers is the largest singular value of the weight matrix, i.e., sup
[Equation]
for layer l .
The difference between the classical Lipschitz constant and the spiking Lipschitz constant lies in the vector domain.
The classical Lipschitz constant is the attained supremum for any vector x ̸ = 0 .
In the case of the SNN layer, its Lipschitz constant is constrained in the space { x ̸ = 0 , x ∈ ψ N l − 1 , ψ = {− 1 , 0 , 1 }} , a subspace of x ̸ = 0 .
Inspired by this, we can derive an inequality between the classical Lipschitz constant and the spiking Lipschitz constant, which is presented in Proposition 1 (The detailed proof is in the Appendix).
Proposition 1.
Given a weight matrix with real values W l ∈ R N l × N l − 1 .
ψ = {− 1 , 0 , 1 } .
It satisfies:
[Equation]
where ∥ W l ∥ 2 is the induced l 2 matrix norm, and σ max ( W l ) is the largest singular value of W l .
According to Eq.
16, the spiking Lipschitz constant Λ l is less than σ max ( W l ) .
The primary goal is to constrain the training through a weight regularizer.
However, Λ l is hard to estimate, whereas there are numerous ways to modulate the spectral norm σ max ( W l )
[Miyato et al., 2018, Cisse et al., 2017,
Yoshida and Miyato, 2017].
Thus, we choose to adopt spectral norm regularization into our proposed training scheme.
The target of regularization is to control the spectral norm to approach 1 :
[Equation]
Such that according to Eq.
16, we can also meet the criterion that Λ l is less than 1 for each layer l .
We note that the constraint to ∥ W l ∥ 2 can also contribute to limiting γ l , which is presented in
Proposition 2 (The detailed proof is in the Appendix).
Proposition 2.
Given a weight matrix with real values W l ∈ R N l × N l − 1 .
χ
= { 0 , 1 } .
It satisfies:
[Equation]
where ∥ W l ∥ p is the induced l p matrix norm.
In Proposition 2, the relationship between l ∞ norm and l 2 norm is based on the norm inequality theory.
The item in γ l defined in a constrained space, on the other hand, is strictly less than the l ∞ norm of W l .
Thus, we can conclude γ l has an upper bound determined by scaled σ max ( W l ) .
Controlling σ max ( W l ) is sufficient to limit Γ l as Γ l monotonously increases with the increase of γ l .
4.3 Regularized Adversarial Training (RAT)
Application of regularization (REG) .
Once the target of regularization is set to control the matrix norm of weights, the next question is how to find a good regularizer to assist training.
By setting the threshold of spiking neurons to 1, the amplification of spike distance is mainly related to Γ .
Given that SNN frequently suffers from gradient problems during training [Wu et al., 2018b], we eventually settle on an orthogonal regularization method that can help prevent the network from vanishing gradients [Lin et al., 2021].
Singular values are naturally equal to 1 when the weight matrix row is orthogonal.
Therefore, we propose to project the updating weights to the target of the orthogonal matrix at a rate defined by β [Cisse et al., 2017]:
[Equation]
[Equation]
For convolutional layers that have weight matrices of 4 dimensions W ∈ R C out × C in × k × k , these matrices should be first reorganized into 2-dimensional matrices in R C out ×
( C in × k × k ) to accomplish the update, where k is the kernel size and C in , C out are numbers of input and output channels.
Generalizing strong SNN adversarial examples (MIX) .
As Sec. 3 suggested, SNNs are also vulnerable under different approximations of the backward pass.
To equip the trained SNN with even better invulnerability, we argument the training dataset with stronger adversarial perturbations based on our observations.
The analyses and results in Sec.
3 imply that the single-step FGSM and RFGSM can provide us with adequate adversaries at a relatively low computational cost.
It is worth noting that RFGSM is recognized as an effective substitution for PGD in adversarial learning [Wong et al.,
The BPTT and BPTR approximations further allow the dataset to extend to its l ∞ balls with a strong adversary compared with the CBA.
Hence, our model is trained with adversarial examples randomly sampled from {FGSM(BPTT), RFGSM(BPTT), FGSM(BPTR), RFGSM(BPTR)}.
Each mini-batch of images are perturbed by a single choice from the four methods with equal probability before being fed into the network.
The network learns to generalize in the mixture of heterogeneous neighbourhoods defined by the four adversaries.
For better network training performance, we choose the mainstream method where the network is updated by the gradients produced from BPTT with surrogate functions [Neftci et al., 2019, Zheng et al., 2021, Fang et al., 2021a].
Experiments 5.1 Experimental Setup
We validate our proposed robust SNN training scheme on the image classification tasks, where the
CIFAR-10 and CIFAR-100 datasets are used.
We train the SNN version of VGG-11 and WideResNet16 (with widening factor set as 4) for both datasets with T = 8 .
In addition, we set β = 0 .
001 and 0 .
004 for VGG-11 and WideResNet-16, respectively.
The perturbation boundary ϵ is set to 2/ when training models.
Detailed implementation is referred to in Appendix.
The images are directly fed into SNNs.
We include several gradient-based attack methods to evaluate the adversarial performance thoroughly: FGSM [Goodfellow et al., 2015], RFGSM [Tramèr et al., 2018], PGD [Madry et al., 2018], BIM [Kurakin et al., 2017].
Gaussian noise (GN) is also used to test the performance against random perturbation with the same ϵ .
5.2 Results
Performance under attacks .
Tab.
2 reports the performance of our proposed RAT scheme.
All gradient attacks are combined with powerful SNN attacks (BPTT, BPTR).
The classification accuracy in brackets is the accuracy without the proposed training scheme.
Black-box attacks are marked with “*” in the table.
It is observed that for all the attack methods, our RAT can improve the model robustness, which is reflected in the improvement of accuracy.
Compared with VGGs, Vanilla WideResNets are more vulnerable to RFGSM attacks.
However, armed with RAT, it is even more robust than VGGs.
Black-box attacks are almost ineffective against RAT-trained models.
For stronger white-box iterative attacks, our RAT improves the robustness from being almost completely misclassified.
For example, the VGG-11 model increases its accuracy by 34.76% under the PGD(BPTR) attack after being trained with RAT on the CIFAR-10 dataset.
Performance with larger ϵ .
We plot the accuracy of the white-box and black-box scenarios under the PGD(BPTT) attack in Fig.
For white-box attacks, both models converge to almost zero after ϵ = 4 / 255 , while RAT-trained models drop their accuracy with increasing ϵ .
Black-box attacks are weaker than white-box ones.
From Fig. 1(b) and (d), the accuracy of RAT-trained models decreases comparably slowly to that of vanilla models.
     †        
 $ FF X U DF \ 9$1,//$5$ (a) VGG-11 white-box      †          $ FF X U DF \ (b) VGG
[Figure]
11 black-box      †  
[Figure]
$
[Figure]
X U DF \ ( [Figure]      †
[Figure]

[Figure]
5.3 Ablation Studies
The proposed RAT scheme in Sec.
4.3 is composed of a regularizer to control the spiking Lipschitz constant and mixed adversarial neighbourhoods for adversarial training.
We conduct ablation studies based on VGG-11 trained with the CIFAR-10 dataset.
The results are shown in Tab. 3.
The attack
     β   
  $ FF X U DF \ &/($1)*60%377
[Figure]
     β   
  $ FF X U DF \ (
[Figure]
WRN-16 β Test          
/D\HU        ' L V W D Q FH 9$1,//$5(* (
[Figure]
Perturbation Distance  
 6LQJXODU9DOXH      ' H Q V LW \ 9$1,//$5(*
[Figure]
methods are all BPTT attacks.
When trained without RAT, the performances under single-step FGSM and RFGSM are lower than 25%, and the accuracies of PGD and BIM are nearly zero.
With only the application of the regularization, the performance of FGSM and RFGSM increase to 26.6% and 40.9%.
The single deployment of mixed adversarial training significantly improves the robustness as the combination of heterogeneous neighbourhoods enhances data generalization.
When both the regularizer and the adversarial training are used, the model gets the best robustness.
These results indicate that each component in RAT alone can improve the model’s adversarial performance, and the robustness of the model is greatly improved after they are combined.
5.4 Effects of Regularized Adversarial Learning
We test the sensitivity of the orthogonal projection rate β on the CIFAR-10 dataset with VGGand WideResNet-16 structures.
As shown in Fig.
2(a) and (b), β has little effect on clean accuracy.
For the two architectures, 0.001 and 0.004 give the best accuracy under the FGSM(BPTT) attack, respectively.
To validate the effect of the regularization, the perturbation distance of each neuron layer in WideResNet-16 is visualized.
In Fig. 2(c), the colors range from light to dark denote ϵ = 2 , 4 , 8 .
It can be seen that the distances of the regularized model are consistently less than those of the vanilla model, which indicates that regularization inhibits the amplification of the spike distance.
Fig. 2(d) presents the distribution of singular values of the WideResNet-16 model.
The regularization makes singular values of weights to be aggregated at 1 as expected.
[Table]
[Table]
[Table]
5.5 Comparison with State-of-the-art Work on Adversarial Robustness of SNN
We compare our methods with the state-of-the-art models and report the results in Tab. 4. The evaluation is based on the VGG-11 experiments on the CIFAR-100 dataset.
The noise budget has been fixed to ϵ = 8 / 255 for FGSM and α = 0 .
01 , step = 7 for PGD.
The attack is based on the surrogate gradient produced by BPTT.
The performance of accuracy attacked by FGSM is 25.86% for our work, higher than that proposed by Sharmin et al.
[2020] (15.5%) and Kundu et al.
[2021b] (22.0%).
Apart from that, our clean accuracy (70.89%) is higher than that proposed by Sharmin et al.
[2020] (64.4%) and Kundu et al.
[2021b] (65.1%).
This implies that our proposed methods can bring better generalization compared to the SOTA robust models.
It is worth noting that although our training algorithm improves the robustness of SNNs, it comes at extra costs.
The cost is mainly reflected in the training time.
First, the regularization of the weights is computed every update.
Solutions to reduce the time consumption of regularization include sampling fewer weights for regularizing, or reducing the number of regularization updates.
Besides, the generation of adversarial noise, which is also included in Kundu et al.
[2021b], costs some time.
Adversarial learning is a common scheme to improve robustness, and generating adversarial examples using only BPTT differentiable approximation in SNN is a time-consuming operation.
Our algorithm mitigates the increase in training time by mixing in a faster yet efficient BPTR approximation.
To verify this, we evaluate the computational time of adversarial testing, detailed settings are referred to in Appendix.
The results show that: BPTR is almost as efficient as CBA, and
BPTT costs nearly 3 × of what CBA and BPTR take to complete testing.
Conclusions and Discussions
In this work, we are the first to give a theoretical Lipschitz analysis of perturbation for hardwarefriendly SNNs.
SNNs are more vulnerable due to their diverse and feasible gradient methods.
Therefore, we propose a specialized regularization adversarial training scheme for SNNs.
Our experiments demonstrate that models trained on this scheme can obtain much robustness, especially in black-box attacks.
We believe this work will pave the way for SNNs in energy-efficient as well as safety-critical applications.
Besides, recent works have shown that SNN can achieve good results without BN [Kundu et al., 2021a].
Note that BN are included in our model, which may be harmful to the robustness [Wang et al., 2022].
Thus, valuable future research directions will include how to train robust SNNs while getting rid of the adverse effects of BN.
Acknowledgements
We thank Yujia Liu for valuable discussions.
This work was supported by the National Natural
Science Foundation of China Grants 62176003 and 62088102, and Royal Society Newton Advanced
Fellowship of UK Grant NAF-R1-191082.