SNN-RAT: Robustness-enhanced Spiking Neural Network through Regularized Adversarial Training
Anonymous Author(s)
AffiliationAddress email
Abstract
Spiking neural networks (SNNs) are promising to be widely deployed in realtime and safety-critical applications with the advance of neuromorphic computing.
Recent work has demonstrated the insensitivity of SNNs to small random perturbations due to the discrete internal information representation.
The variety of trainingalgorithms and the involvement of the temporal dimension pose more threats tothe robustness of SNNs than that of typical neural networks.
We account for thevulnerability of SNNs by constructing adversaries based on different differentiableapproximation techniques.
By deriving a Lipschitz constant specifically for thespike representation, we first theoretically answer the question of how much adversarial invulnerability is retained in SNNs.
Hence, to defend against the broadattack methods, we propose a regularized adversarial training scheme with lowcomputational overheads.
SNNs can benefit from the constraint of the perturbedspike distance’s amplification and the generalization on multiple adversarial ϵneighbourhoods.
Our experiments on the image recognition benchmarks haveproven that our training scheme can defend against powerful adversarial attackscrafted from strong differentiable approximations.
To be specific, our approachmakes the black-box attacks of the Projected Gradient Descent attack nearly ineffective.
We believe that our work will facilitate the spread of SNNs for safety-criticalapplications and help understand the robustness of the human brain.
Introduction
Spiking Neural Networks (SNNs), unlike traditional Analog Neural Networks (ANNs), mimic theneuronal behaviours of a biological brain through spatio-temporal dynamics and spike representation[Gerstner et al., 2014], which represent the forefront of neural networks [Maass, 1997, Zenkeet al., 2021].
The neurons evolve their membrane potentials as time goes by and transmit discreteinformation by 0 (nothing) and 1 (a spike).
After the transmission, the membrane potentials are resetto the rest value and wait for the coming input current.
Currently, the training algorithm of SNNs is ahot research topic due to the unique discrete spike activation.
This results in a fundamental differencein training methods compared with ANNs.
The rise of neuromorphic computing has allowed
SNNs to run with more compatible hardware and a lower energy cost [Pei et al., 2019, DeBoleet al., 2019, Davies et al., 2018, Nieves and Goodman, 2021, Fang et al., 2020].
The combinationof SNN and neuromorphic hardware can enable numerous applications, such as spatio-temporalpattern recognition and high-speed detection [Wu et al., 2018a, Kim et al., 2020, Kheradpisheh and
Masquelier, 2020, Zenke and Neftci, 2021].
For safety-critical applications such as autonomous driving, the reliability of the system becomescrucial, especially the robustness of the model against perturbations, such as additive Gaussian noise.
Among all the perturbations, the adversarial attack is one of the most powerful categories [Szegedy et al., 2014, Goodfellow et al., 2015].
It can generate subtle perturbations that are usually neglectedby the human perception system.
The perturbations, however, can deteriorate the capability of thesystem, that is, the model produces incorrect labels with a high probability.
This could have seriousimpacts on those applications in security, where a single failure could have devastating results.
Upto now, a wide variety of adversarial attack methods have been proposed [Madry et al., 2018].
Thevulnerability holds even from a model that is trained for the same task but with a different architecture.
The operation mechanism and structure of SNN are similar to those of the biological brain, andstudying its response to perturbation can help us understand how the human brain works.
Thus,apart from the accuracy performance of SNNs, it is necessary to improve the adversariality of SNNs.
Small perturbations can be overlooked thanks to the spike generating mechanism. As a result, SNNsbecome a new potential candidate with adversarial robustness Perez-Nieves et al.
Sharminet al. [2020] reported a slightly better robust performance of SNN against ANN. Can SNNs resiststronger attacks?
Sharmin et al.
[2019] indicated a better performance on black-box attacks comparedwith ANNs. However, when encountered with stronger white-box attacks, SNNs are also vulnerable.
In fact, SNNs are now facing more challenges than typical ANNs.
On the one hand, SNNs can obtainweight updates through biological inspiration or gradient propagation. The update amount of weightsis the key to constructing adversarial attacks. Therefore, when the gradient generation method isspecified, the adversarial algorithm in the traditional ANN can be seamlessly applied to the SNN.
Onthe other hand, adversarial methods based on event-driven data were also studied [Marchisio et al.,2021]. Moreover, the specific bit-flip-flop adversarial attack was proposed by Liang et al. These works undoubtedly bring severe challenges to the robustness of SNNs.
Fortunately, for event-driven data input as well as the internal communication of SNNs, there is acommonality: information is expressed through spikes.
Therefore, one question can be raised naturally: whether and to what extent does the representation of spikes detain adversarial invulnerability?
But up to now, there are few studies to date to consider a theoretical approach for robust analysis of
SNNs, especially from the perspective of spiking representation. At present, the Lipschitz conditionis commonly used to analyze the perturbation of ANNs [Rahnama et al., 2020, Szegedy et al., 2014, Cisse et al., 2017]. The representation of spikes differs significantly from neural activation of ANNs,so the analysis of instability in ANNs cannot be used directly.
This paper aims to extend the Lipschitzanalysis theory to spike representation and propose a more robust training algorithm on this basis.
Our main contributions are summarized as follows:
• We design and summarize different differentiable approximations which can be deployed in gradient-based attacks to show the vulnerability of SNNs.
Backward pass through time and rate are found to be capable of constructing stronger attacks.
• We theoretically analyze the l 2 perturbation distance on the representation of spikes andgive a mathematical expression of the spiking Lipschitz constant.
• We propose a regularized adversarial training scheme for SNNs.
It not only constrains thespiking Lipschitz constant but also exploits the mixture of the identified strong single-stepadversarial attacks.
• Our experiments show that the proposed scheme can significantly improve the adversarial
robustness in the image recognition tasks.
The trained model exhibits better resistance under stronger Projected Gradient Descent attacks compared to the vanilla models.
Background and Related Work
2.1 Inherent Robustness of Spiking Neural Networks
The concept of spike representation is where SNNs are different from ANNs.
Typically, the input isencoded as sequences ( T × N 0 ), with T denoting the total number of time-steps and N 0 denotingthe number of the input nodes.
The neurons in SNNs, like ANNs, receive a linear combination ofthe previous layer’s output.
The mechanism of leaky-integrate-fire (LIF) leads to the non-linearitynature of SNNs.
Overall, the dynamic of the membrane potential m l ( t ) of neurons in layer l ( l = 1 , 2 , · · · , L ) at time-step t ( t = 1 , 2 , · · · , T ) can be described by:
[Equation]
where s l ( t ) denotes the binary spikes of neurons in layer l at time t , which equals to 1 if thereis spike.
m l ( t − ) denotes the instantaneous state of membrane potential before triggering a spike,which accumulates the weighted input from presynaptic neurons in the last layer.
When the potentialexceeds the predefined threshold θ , a spike is generated at time t , and the membrane potential m l ( t )is reset to zero.
Otherwise the membrane potential m l ( t ) either leaks by λ for LIF model ( λ ∈ (0 , 1) ),or maintains for Integrate-and-Fire (IF) model ( λ = 1 ).
The leaking membrane potentials described above intuitively smooth the noise in the input current,which is an appealing characteristic for trustworthy neural networks compared with analog neuralnetworks.
Sharmin et al.
[2020], Marchisio et al. [2020] and others compared the performances of
SNNs to those of ANNs against adversarial attacks and found the inherent robustness of SNNs.
Theycontributed the advantage to the discrete activation and neuronal dynamics.
Considering the effectof dynamic, Sharmin et al.
[2019] have done a comparative study on the robustness of SNNs usingsurrogate training and conversion, where conversion-based SNNs are believed to contain less dynamicinformation.
The study shows that SNNs trained by surrogate functions are more adversarially robust.
These studies imply the importance of dynamics.
Without extra training and only by searching forthe structural parameters of spiking neurons (threshold θ and inference time T ), the robustness of a SNN model can increase to its optimum [El-Allami et al., 2021].
Based on this observation, Kunduet al.
[2021] further proposed adversarial learning methods to adjust those neuronal parameters.
2.2 Gradient-based Adversarial Attacks
Most adversarial attacks consider a perturbation δ in an l p ball around clean data x and can beformulated as an optimization problem:
[Equation]
where y is the target, L is the loss function, f denotes the network with W as parameters, and ϵ is theparameter that guarantees the perturbation is imperceptible.
Here, we introduce two widely adoptedgradient-based adversarial attack algorithms: Fast Gradient Sign Method (FGSM) and Projected
Gradient Descent method (PGD).
FGSM .
As one of the simplest methods, the main idea of FGSM is to perturb the data along the signof the gradient to increase the perturbed linear output, which can be expressed as follows [Goodfellowet al., 2015]:
[Equation]
PGD .
PGD is an iterative version of FGSM, which offers a more powerful attack [Madry et al., 2018]and is convinced to reasonably approximate the optimal attack.
The iteration can be summarized as:
[Equation]
(6) where k denotes the number of the iteration step and α is the step size of each iteration.
Π ϵ denotesthat the data in each iteration should be projected onto the space of the l p ball around clean data xw.r.t.
ϵ .
Apart from these popular gradient-based attacks, RFGSM can be viewed as a randomizedversion of FGSM [Tramèr et al., 2018], and BIM is a kind of iterative attack similar to PGD [Kurakinet al., 2017].
All these methods are exploited to verify the vulnerability of SNN in this work.
Byapplying differentiable approximations in back-propagation, the gradient-based attacks can alsothreaten SNN.
In this work, we execute white-box (WB) and black-box (BB) attacks for scenarioswhere attackers have knowledge of or no knowledge of the model.
2.3 Defense Methods
The earlier research on ANN has discovered that adversarial attacks can cause the amplification ofactivation magnitude [Szegedy et al., 2014].
They measured the distance between clean and perturbedactivation and suggested an analysis framework based on Lipschitz analysis as:
[Equation]
where Lip l is the Lipschitz constant for layer l .
By penalizing the Lipschitz constant, the distortion ofinput is stabilized [Cisse et al., 2017].
Apart from the analysis framework, adversarial training is themost powerful tool for defense, which is defined as a saddle point problem [Madry et al., 2018]: [Equation] W
[Equation]
where the maximization process can be accomplished by applying different attack methods.
Byutilizing the adversarial input, the adversarial training learns to classify adversarial examples correctly.
All these methods are based on deep ANNs, which are locally differentiable and have well-definedderivatives.
In this paper, we aim to construct an analysis framework for non-differentiable SNNsand strengthen the adversarial training.
Vulnerability of Spiking Neural Networks
3.1 Spiking Neural Network under Attack
Although SNNs are inherently more robust than ANNs, most SNNs are still vulnerable wheneffective adversarial attack methods are applied.
Previous works have experimentally demonstratedthat gradient attack methods such as FGSM can be applied to SNNs [Sharmin et al., 2019, 2020].
However, because of the non-differentiable property of spiking neurons, the gradients obtainedby backpropagation are not necessarily accurate, which may cause inefficient attacks.
Thus, thisdefensive nature of SNNs can be thought of as obfuscated gradients [Athalye et al., 2018], whichmay create a false sense of security about SNNs.
Therefore, in this paper, we first reconsider the attacks for SNNs by utilizing a combination of attackmethods and gradient approximations.
We follow the Backward Pass Differentiable Approximation(BPDA) technique [Athalye et al., 2018] to overcome the obfuscated gradients.
The key idea of the
BPDA is to use a differentiable approximation in the backward pass while the forward pass unchanged.
Similar differentiable approximation techniques have been used for training SNNs.
Based on these,we design, compare, and summarize different differentiable approximations for SNNs.
3.2 Differentiable Approximation for Spiking Neural Networks
Conversion-based Approximation.
The Conversion-based Approximation (CBA) for SNN wasfirst proposed by Sharmin et al.
Since an SNN can be converted from an ANN Rueckaueret al.
[2017], Han et al.
[2020], the adversarial examples can be generated from an ANN with sharedweights and bias from the source SNN.
However, this method approximates the spiking neuron usingthe ReLU activation function on both forward pass and backward pass, which is contrary to the ideaof the BPDA algorithm and is proved to be ineffective [Song et al., 2018].
Backward Pass Through Time.
The most commonly used differentiable approximation is the
Backward Pass Through Time (BPTT) with surrogate gradients.
In this method, the non-differentiableneuron fire function is replaced by a differentiable function on the backward pass.
By combining
Eq.
–Eq. 3, the backward pass can be described as follows:
[Equation]
The final result ∂L ∂ s 0 ( t ) can be calculated by recursively calculating this equation across both layersand time-steps.
And since we use the constant input coding for SNNs, the gradient of the image isexactly ∂L ∂ s 0 ( t ) .
The non-differentiable part ∂ s l +1 ( t ) ∂ m l +1 ( t − ) is replaced by a surrogate gradient functionto get a smooth backward pass.
The backward pass through time technique uses a similar gradientapproximation as the Spatio-Temporal-Backward-Propagation training algorithm
[Wu et al., 2018b].
Since the gradient generated from this method is useful for training, it is very likely to generateeffective gradients.
Backward Pass Through Rate.
Another differentiable approximation is the Backward Pass Through
Rate (BPTR).
In this method, the backward pass takes the derivative directly from the average firing
[Table]
rate of the spiking neurons between layers.
We consider neurons at each time-step equivalent, and thederivative is determined by the average firing rate.
[Equation]
Since the relationship of the firing rates in adjacent layers for non-leaky IF neuron is nearly linear[Sengupta et al., 2019], the gradients of ∂ 1 T (cid:80) Ti =
s l
+
( i ) /∂
1 T (cid:80) Ti =
s l ( i ) can be approximatedusing the straight-through estimator [Bengio et al., 2013].
Similar to Lee et al.
[2020], here we use theconstant 1 T to approximate the value of ∂ 1 T (cid:80)
Ti =
s l
+
( i ) /∂
1 T (cid:80) Ti =
s l ( i ) at Eq.
The backwardpass of the complete neuronal dynamic is approximated by one single function, and the gradient willnot accumulate through time-steps.
As the forward pass still follows the rule of the spiking neurons,the obtained gradients will be more accurate than the conversion-based attack.
3.3 Effective Attack with Backward Pass through Time and Rate
To compare the effectiveness of the above three differentiable approximation techniques in constructing gradient-based attacks for SNNs, we applied combinations of three gradient-based methods(FGSM, RFGSM, PGD) and three differentiable approximation techniques (CBA, BPTR, BPTT)to two baseline models.
The two models, VGG-11 and WideResNet-16, are trained on the CIFARdataset using BPTT with no additional defenses.
The number of time-steps is set to T = 8 .
As shown in Tab. 1, the CBA is the most ineffective differentiable approximation technique to construct attacks for SNNs.
The performance of all models under attack using CBA is significantly higherthan that of models under attack using BPTR and BPTT.
As we have discussed in Sec. 3.2 when using
CBA, the changes in both forward pass and backward pass cause inaccuracy in the generated gradient.
Both the BPTT and BPTR methods, combined with different attack methods, can significantly reducethe performance of the given model.
Among all single-step attack combinations, FGSM(BPTR),
RFGSM(BPTT), FGSM(BPTT), and RFGSM(BPTT) can generate efficient and effective adversarialexamples for all the testing models.
Among all multi-step attacks, the PGD(BPTT) always beats otherattack combinations.
These results suggest different properties between BPTT and BPTR.
The BPTTapproximation contains extra temporal information that is useful when using multi-step attacks, whilethe BPTR approximation saves more computation resources when back-propagating through firingrates and can get comparable results on single-step attacks.
Methods: Perturbation Analysis and Regularized Adversarial Training
The previous section identifies threats from effective differentiable approximations combined withgradient-based attacks.
In this section, we will give a theoretical perturbation analysis under SNNattacks and propose a regularized adversarial training scheme.
4.1 Perturbation Analysis for Spike Representation
Current perturbation analysis of ANN considers the distance of continuous activation ∥ a l − (cid:101) a l ∥and the rectified linear outputs ∥
f ( a l ) − f ( (cid:101) a l ) ∥ .
When extended to the spiking version, the relationbetween ∥ s l ( t ) − (cid:101)
s l ( t ) ∥ and ∥ s l +1 ( t ) − (cid:101) s l +1 ( t ) ∥ should be considered.
However, SNNs havethe memory of history membrane status, and the spike function is a non-differentiable function.
Simply substituting ANN activation with an average firing rate [Kundu et al., 2021] is detrimental, as it may impair the information encoded in the interspike interval. Thus, we propose to modelthe distortion using the spike train distance.
Denote the output spike train of the l th layer as
S l = { s l ( t ) | t = 1 , 2 , · · · , T } ∈
χ T × N l ( χ ∈ { 0 , 1 } ), where T is the number of time-steps and N l isthe number of neurons in layer l .
Then the perturbation distance can be formulated as ( p ≥ 1 ):
[Equation]
where ∥ · ∥ p,p denotes the l p entry-wise matrix norm and ∥ · ∥ p denotes the l p vector norm.
(cid:101)
S l isthe perturbed version of S l .
Since the p power of spike activation values (0 and 1) are themselves,without loss of generality we set p = 2 .
In Theorem 1, we obtain a Lipschitz constant for the spiketrain distance.
Theorem 1.
Given an L-layered SNN intended to inference T time-steps with θ as threshold, supposethat there are N l neurons in layer l for l = 1 , 2 , · · · , L .
W l ∈ R N l × N l − 1 .
For layer l , it satisfies:
[Equation]
[Equation] where Λ l is a Lipschitz constant and Γ l is a constant for layer l , which can be expressed as:
[Equation]
(cid:18)
[Equation]
θ (cid:19) [Equation] (cid:35) , (15) where γ l = sup s ̸ =0 , s ∈ χ
Nl − 1 ∥ W l s ∥ ∞ + sup s ̸ =0 , s ∈
χ Nl − 1 ∥ − W l s ∥ ∞ .
χ
= { 0 , 1 } , ψ = {− 1 , 0 , 1 } .
In Eq.
14, Λ l is referred to as the spiking Lipschitz constant .
Since the inter-layer spike signalsare not purely linear and the effect of the spiking generation mechanism cannot be neglected, theinequality relationship expressed by Eq.
13 is not exactly the same as the definition of the classical
Lipschitz constant [O’Searcoid, 2006].
Nonetheless, this does not affect our understanding of theamplification effect of spike distance.
On the right side of Eq. 13, there is an additional constant Γ lrelated to the weight.
The appearance of Γ l is associated with the spike generation and the boundingof the current.
The determination of Γ l adopts a very loose constraint (see our proof in the Appendix),and its effect on the spike distance is additive, so we will still focus on how to constrain the spiking
Lipschitz constant while not magnifying the additive item excessively.
4.2 Constraining Spiking Lipschitz Constant
Here we explain why SNNs are thought to be more robust than ANNs and how to constrain thespiking Lipschitz constant in Eq. 13.
Szegedy et al.
[2014] has concluded that the upper boundof the Lipschitz constant for ReLU-based layers is the largest singular value of the weight matrix,
i.e., sup x ̸ =0 ∥ W l x ∥ 2 ∥ x ∥for layer l .
The difference between the classical Lipschitz constant and thespiking Lipschitz constant lies in the vector domain.
The classical Lipschitz constant is the attainedsupremum for any vector x ̸ = 0 .
In the case of the SNN layer, its Lipschitz constant is constrained inthe space { x ̸ = 0 , x ∈ ψ N l − 1 , ψ = {− 1 , 0 , 1 }} , a subspace of x ̸ = 0 .
Inspired by this, we can derivean inequality between the classical Lipschitz constant and the spiking Lipschitz constant, which ispresented in Proposition 1 (The detailed proof is in the Appendix).
Proposition 1.
Given a weight matrix with real values W l ∈ R N l × N l − 1 .
ψ
[Equation]
[Equation]
It satisfies:
[Equation]
where ∥ W l ∥ 2 is the induced l 2 matrix norm, and σ max ( W l ) is the largest singular value of W l .
According to Eq.
16, the spiking Lipschitz constant Λ l is less than σ max ( W l ) .
The primary goal isto constrain the training through a weight regularizer.
However, Λ l is hard to estimate, whereas there are numerous ways to modulate the spectral norm σ max ( W l )
[Miyato et al., 2018, Cisse et al., 2017,
Yoshida and Miyato, 2017].
Thus, we choose to adopt spectral norm regularization into our proposedtraining scheme.
The target of regularization is to control the spectral norm to approach 1 :
[Equation]
Such that according to Eq.
16, we can also meet the criterion that Λ l is less than 1 for each layerl .
We note that the constraint to ∥ W l ∥ 2 can also contribute to limiting γ l , which is presented in
Proposition 2 (The detailed proof is in the Appendix).
Proposition 2.
Given a weight matrix with real values W l ∈ R N l × N l − 1 .
χ
= { 0 , 1 } .
It satisfies:
[Equation]
where ∥ W l ∥ p is the induced l p matrix norm.
In Proposition 2, the relationship between l ∞ norm and l 2 norm is based on the norm inequalitytheory.
The item in γ l defined in a constrained space, on the other hand, is strictly less than thel ∞ norm of W l .
Thus, we can conclude γ l has an upper bound determined by scaled σ max ( W l ) .
Controlling σ max ( W l ) is sufficient to limit Γ l as Γ l monotonously increases with the increase of γ l .
4.3 Regularized Adversarial Training (RAT)
Application of regularization .
Once the target of regularization is set to control the matrix norm ofweights, the next question is how to find a good regularizer to assist training.
By setting the thresholdof spiking neurons to 1, the amplification of spike distance is mainly related to Γ .
Given that SNNfrequently suffers from gradient problems during training [Wu et al., 2018b], we eventually settle onan orthogonal regularization method that can help prevent the network from vanishing gradients [Linet al., 2021].
Singular values are naturally equal to 1 when the weight matrix row is orthogonal.
Therefore, we propose to project the updating weights to the target of the orthogonal matrix at a ratedefined by β [Cisse et al., 2017]:
[Equation]
For convolutional layers that have weight matrices of 4 dimensions W ∈ R C out × C in × k × k , thesematrices should be first reorganized into 2-dimensional matrices in R C out ×
( C in × k × k ) to accomplishthe update, where k is the kernel size and C in , C out are numbers of input and output channels.
Generalizing strong SNN adversarial examples .
As Sec. 3 suggested, SNNs are also vulnerableunder different approximations of the backward pass.
To equip the trained SNN with even betterinvulnerability, we argue the training dataset with stronger adversarial perturbations based on ourobservations.
The analyses and results in Sec.
3 imply that the single-step FGSM and RFGSM canprovide us with adequate adversaries at a relatively low computational cost.
It is worth noting that RFGSM is recognized as an effective substitution for PGD in adversarial learning [Wong et al.
The BPTT and BPTR approximations further allow the dataset to extend to its l ∞ balls with astrong adversary compared with the CBA.
Hence, our model is trained with adversarial examplesrandomly sampled from {FGSM(BPTT), RFGSM(BPTT), FGSM(BPTR), RFGSM(BPTR)}.
Eachmini-batch of images are perturbed by a single choice from the four methods with equal probabilitybefore being fed into the network.
The network learns to generalize in the mixture of heterogeneousneighbourhoods defined by the four adversaries.
For better network training performance, we choosethe mainstream method where the network is updated by the gradients produced from BPTT withsurrogate functions [Neftci et al., 2019, Zheng et al., 2021, Fang et al., 2021].
Experiments
5.1 Experimental Setup
We validate our proposed robust SNN training scheme on the image classification tasks, where the
CIFAR-10 and CIFAR-100 datasets are used.
We train the SNN version of VGG-11 and WideResNet16 (with widening factor set as 4) for both datasets with T = 8 .
In addition, we set β = 0 .
001 and
004 for VGG-11 and WideResNet-16, respectively.
The perturbation boundary epsilon is set {+to2/
 when+} training models.
Detailed implementation is referred to in Appendix.
We include several gradient-based attack methods to evaluate the adversarial performance thoroughly: FGSM [Goodfellow et al., 2015], RFGSM [Tramèr et al., 2018], PGD [Madry et al., 2018], BIM [Kurakin et al., 2017].
Without specific instructions, we set ϵ to 8 / 255 for all methods. For iterativemethods like PGD and BIM, the attack step α = 0 .
01 , and the step number is 7.
Gaussian noise (GN)is also used to test the performance against random perturbation.
5.2 Results
Performance under attacks .
Tab.
2 reports the performance of our proposed RAT scheme.
All gradient attacks are combined with powerful SNN attacks (BPTT, BPTR).
The classification accuracy inbrackets is the accuracy without the proposed training scheme.
Black-box attacks are marked with “*”in the table.
It is observed that for all the attack methods, our RAT can improve the model robustness,which is reflected in the improvement of accuracy.
Compared with VGGs, Vanilla WideResNets aremore vulnerable to RFGSM attacks.
However, armed with RAT, it is even more robust than VGGs.
Black-box attacks are almost ineffective against RAT-trained models.
For stronger white-box iterativeattacks, our RAT improves the robustness from being almost completely misclassified.
For example,the VGG-11 model increases its accuracy by 34.76% under the PGD(BPTR) attack after being trainedwith RAT on the CIFAR-10 dataset.
Performance with larger ϵ .
We plot the accuracy of the white-box and black-box scenarios underthe PGD(BPTT) attack in Fig.
For white-box attacks, both models converge to almost zero afterϵ = 4 / 255 , while RAT-trained models drop their accuracy with increasing ϵ .
Black-box attacks areweaker than white-box ones.
From Fig. 1(b) and (d), the accuracy of RAT-trained models decreasescomparably slowly to that of vanilla models.
The proposed RAT scheme in Sec. 4.3 is composed of a regularizer to control the spiking Lipschitzconstant and mixed adversarial neighbourhoods for adversarial training. We conduct ablation studiesbased on VGG-11 trained with the CIFAR-10 dataset.
The results are shown in Tab. 3. The attackmethods are all BPTT attacks.
When trained without RAT, the performances under single-step FGSMand RFGSM are lower than 25% [Table] and the accuracies of PGD and BIM are nearly zero. With only
[Table]
     †        
 $ FF X U DF \ 9$1,//$5$
[Figure]
     †
[Figure]
   

[Figure] \
[Figure]
     †        
 $ FF
[Figure]
U DF \
[Figure]

[Figure]
[Figure]
the application of the regularization, the performance of FGSM and RFGSM increase to 26.6% and40.9%.
The single deployment of mixed adversarial training significantly improves the robustnessas the combination of heterogeneous neighbourhoods enhances data generalization.
When both theregularizer and the adversarial training are used, the model gets the best robustness.
These resultsindicate that each component in RAT alone can improve the model’s adversarial performance, andthe robustness of the model is greatly improved after they are combined.
[Table]
5.4 Effects of Regularized Adversarial Learning
We test the sensitivity of the orthogonal projection rate β on the CIFAR-10 dataset with VGG-11and WideResNet-16 structures.
As shown in Fig.
2(a) and (b), β has little effect on clean accuracy.
For the two architectures, 0.001 and 0.004 give the best accuracy under the FGSM(BPTT) attack,respectively.
To validate the effect of the regularization, the perturbation distance of each neuron layerin WideResNet-16 is visualized.
In Fig. 2(c), the colors range from light to dark denote ϵ = 2 , 4 , 8 .
Itcan be seen that the distances of the regularized model are consistently less than those of the vanillamodel, which indicates that regularization inhibits the amplification of the spike distance.
Fig.
2(d)presents the distribution of singular values of the WideResNet-16 model.
The regularization makessingular values of weights to be aggregated at 1 as expected.
Conclusions
In this work, we are the first to give a theoretical analysis of perturbation for hardware-friendly SNNs.
SNNs are more vulnerable due to their diverse and feasible gradient methods.
Therefore, we proposea specialized regularization adversarial training scheme for SNNs.
Our experiments demonstratethat models trained on this scheme can obtain much robustness, especially in black-box attacks.