SNN-RAT: Robustness-enhanced Spiking Neural Network through Regularized Adversarial Training
Anonymous Author(s)
AffiliationAddress email
Abstract
Spiking neural networks (SNNs) are promising to be widely deployed in realtime and safety-critical applications with the advance of neuromorphic computing.
Recent work has demonstrated the insensitivity of SNNs to small random perturbations due to the discrete internal information representation.
The variety of trainingalgorithms and the involvement of the temporal dimension pose more threats tothe robustness of SNNs than that of typical neural networks.
We account for thevulnerability of SNNs by constructing adversaries based on different differentiableapproximation techniques.
By deriving a Lipschitz constant specifically for thespike representation, we first theoretically answer the question of how much adversarial invulnerability is retained in SNNs.
Hence, to defend against the broadattack methods, we propose a regularized adversarial training scheme with lowcomputational overheads.
SNNs can benefit from the constraint of the perturbedspike distance’s amplification and the generalization on multiple adversarial ϵneighbourhoods.
Our experiments on the image recognition benchmarks haveproven that our training scheme can defend against powerful adversarial attackscrafted from strong differentiable approximations.
To be specific, our approachmakes the black-box attacks of the Projected Gradient Descent attack nearly ineffective.
We believe that our work will facilitate the spread of SNNs for safety-criticalapplications and help understand the robustness of the human brain.
Introduction
Spiking Neural Networks (SNNs), unlike traditional Analog Neural Networks (ANNs), mimic theneuronal behaviours of a biological brain through spatio-temporal dynamics and spike representation[Gerstner et al., 2014], which represent the forefront of neural networks [Maass, 1997, Zenkeet al., 2021].
The neurons evolve their membrane potentials as time goes by and transmit discreteinformation by 0 (nothing) and 1 (a spike).
After the transmission, the membrane potentials are resetto the rest value and wait for the incoming input.
Currently, the training algorithm of SNNs is a hotresearch topic due to the unique discrete spike activation.
This results in a fundamental differencein training methods compared with ANNs.
The rise of neuromorphic computing has allowed
SNNs to run with more compatible hardware and a lower energy cost [Pei et al., 2019, DeBoleet al., 2019, Davies et al., 2018, Nieves and Goodman, 2021, Fang et al., 2020].
The combinationof SNN and neuromorphic hardware can enable numerous applications, such as spatio-temporalpattern recognition and high-speed detection [Wu et al., 2018a, Kim et al., 2020, Kheradpisheh and
Masquelier, 2020, Zenke and Neftci, 2021].
For safety-critical applications such as autonomous driving, the reliability of the system becomescrucial, especially the robustness of the model against perturbations, such as additive Gaussian noise.
Among all the perturbations, the adversarial attack is one of the most powerful categories [Szegedy et al., 2014, Goodfellow et al., 2015].
It can generate subtle perturbations that are usually neglectedby the human perception system.
The perturbations, however, can deteriorate the capability of thesystem, that is, the model produces incorrect labels with a high probability.
This could have seriousimpacts on those safety-related applications, where a single failure could have devastating results.
Up to now, a wide variety of adversarial attack methods have been proposed [Madry et al., 2018].
The vulnerability holds even from a model that is trained for the same task but with a differentarchitecture.
The operation mechanism and structure of SNN are similar to those of the biological brain, andstudying its response to perturbation can help us understand how the human brain works.
SNNis recognized as a new potential candidate with adversarial robustness due to its input coding andneuronal dynamics [Perez-Nieves et al., 2021, Leontev et al., 2021].
Among the coding schemescommonly used in SNN, constant input coding is considered to be more susceptible to disturbancesthan others, like Poisson coding [Sharmin et al., 2020].
Therefore, Kundu et al.
[2021b] suggestedthat careful training is required for constant input coding.
In this setting, SNNs are now facingmore challenges than typical ANNs.
Because the key to constructing SNN gradient-based attacksis back-propagation, which is the same as that of ANNs.
However, compared with ANNs, SNNscan learn through various gradient approximations.
Therefore, combining various differentiableapproximations and attack methods will pose a more severe threat to SNN [Liang et al., 2021].
The inter-layer communication of SNN is through spikes with a time dimension, which is verydifferent from ANN.
Therefore, one question can be raised naturally: whether and to what extent doesspike communication detain adversarial invulnerability?
And, are there training tools that can help
SNNs defend against the threats described above?
This paper aims to extend the Lipschitz analysistheory to spike representation and propose a more robust training algorithm on this basis.
Our maincontributions are summarized as follows:
• We design and summarize different differentiable approximations which can be deployed ingradient-based attacks to show the vulnerability of SNNs.
Backward pass through time andrate are found to be capable of constructing stronger attacks.
• We theoretically analyze the l 2 perturbation distance on the representation of spikes and
give a mathematical expression of the spiking Lipschitz constant.
• We propose a regularized adversarial training scheme for SNNs.
It not only constrains thespiking Lipschitz constant but also exploits the mixture of the identified strong single-stepadversarial attacks.
• Our experiments show that the proposed scheme can significantly improve the adversarial
robustness in the image recognition tasks.
The trained model exhibits better resistance understronger Projected Gradient Descent attacks compared to the vanilla models.
Background and Related Work
2.1 Robustness of Spiking Neural Networks
The concept of spike representation is where SNNs are different from ANNs.
Typically, the input isencoded as sequences ( T × N 0 ), with T denoting the total number of time-steps and N 0 denotingthe number of the input nodes.
The neurons in SNNs, like ANNs, receive a linear combination ofthe previous layer’s output.
The mechanism of leaky-integrate-fire (LIF) leads to the non-linearitynature of SNNs.
Overall, the dynamic of the membrane potential m l ( t ) of neurons in layer l( l = 1 , 2 , · · · , L ) at time-step t ( t = 1 , 2 , · · · , T ) can be described by:
[Equation]
where s l ( t ) denotes the binary spikes of neurons in layer l at time t , which equals to 1 if thereis spike.
m l ( t − ) denotes the instantaneous state of membrane potential before triggering a spike,which accumulates the weighted input from presynaptic neurons in the last layer.
When the potentialexceeds the predefined threshold θ , a spike is generated at time t , and the membrane potential m l ( t ) is reset to zero.
Otherwise the membrane potential m l ( t ) either leaks by λ for LIF model ( λ ∈ (0 , 1) ),or maintains for Integrate-and-Fire (IF) model ( λ = 1 ).
The leaking potentials described above intuitively smooth the noise in the input current, which is anappealing characteristic for trustworthy neural networks.
Indeed, SNNs can demonstrate robustnessunder certain conditions.
Sharmin et al.
[2020] presented their pioneering work on input discretizationand leaky rate.
They highlighted that specific input coding could improve the robustness of SNN.
Upto now, Poisson coding, latency coding, and time-to-first-spike coding have been proven to have aneffect on small datasets [Sharmin et al., 2020, Leontev et al., 2021, Nomura et al., 2022].
Sharminet al.
[2019] also found that SNNs trained by surrogate functions can boost the robustness of Poissoncoding.
Whereas, SNNs are not completely secure.
Marchisio et al.
[2020] pointed out that black-boxattacks can also attack SNNs.
El-Allami et al.
[2021] searched for the structural parameters of SNNsto improve the robustness.
Among rate coding, constant input coding (or direct coding) is shown todetain less robustness, which has been discussed in several papers [Kim et al., 2022, Kundu et al. ,2021b].
Based on careful observations, Kundu et al.
[2021b] asserted that fine training is essential forthe robustness of direct-coding SNNs.
Motivated by this, we propose a regularizer that can promoterobust training schemes for SNN.
2.2 Gradient-based Adversarial Attacks
Most adversarial attacks consider a perturbation δ in an l p ball around clean data x and can beformulated as an optimization problem:
[Equation]
where y is the target, L is the loss function, f denotes the network with W as parameters, and ϵ is theparameter that guarantees the perturbation is imperceptible.
Here, we introduce two widely adoptedgradient-based adversarial attack algorithms: Fast Gradient Sign Method (FGSM) and Projected
Gradient Descent method (PGD).
FGSM .
As one of the simplest methods, the main idea of FGSM is to perturb the data along the signof the gradient to increase the perturbed linear output, which can be expressed as follows [Goodfellowet al., 2015]: [Equation]
[Equation]
PGD .
PGD is an iterative version of FGSM, which offers a more powerful attack [Madry et al., 2018]and is convinced to reasonably approximate the optimal attack.
The iteration can be summarized as:
[Equation]
where k denotes the number of the iteration step and α is the step size of each iteration.
Π ϵ denotesthat the data in each iteration should be projected onto the space of the l p ball around clean data xw.r.t.
ϵ .
Apart from these popular gradient-based attacks, RFGSM can be viewed as a randomizedversion of FGSM [Tramèr et al., 2018], and BIM is a kind of iterative attack similar to PGD [Kurakinet al., 2017].
All these methods are exploited to verify the vulnerability of SNN in this work.
Byapplying differentiable approximations in back-propagation, the gradient-based attacks can alsothreaten SNN.
In this work, we execute white-box (WB) and black-box (BB) attacks for scenarioswhere attackers have knowledge of or no knowledge of the model.
Without specific instructions, we set ϵ to 8 / 255 for all methods for the purpose of testing.
For iterativemethods like PGD and BIM, the attack step α = 0 .
01 , and the step number is 7.
2.3 Defense Methods
The earlier research on ANN has discovered that adversarial attacks can cause the amplification ofactivation magnitude [Szegedy et al., 2014].
They measured the distance between clean and perturbedactivation and suggested an analysis framework based on Lipschitz analysis as:
[Equation]
where Lip l is the Lipschitz constant for layer l .
By penalizing the Lipschitz constant, the distortionof input is stabilized [Cisse et al., 2017].
Using exact estimation of Lipschitz bounds to certify therobustness of ANN has been popular [Arjovsky et al., 2017, Fazlyab et al., 2019, Weng et al., 2018,
Miyato et al., 2018].
Yet there is no work currently working on the Lipschitz bound of SNN.
Apart from the analysis framework, adversarial training is the most powerful tool for defense, whichis defined as a saddle point problem [Madry et al., 2018]:
[Equation]
where the maximization process can be accomplished by applying different attack methods.
Byutilizing the adversarial input, the adversarial training learns to classify adversarial examples correctly.
All these methods are based on deep ANNs, which are locally differentiable and have well-definedderivatives.
In this paper, we aim to construct an analysis framework for non-differentiable SNNsand strengthen the adversarial training.
Vulnerability of Spiking Neural Networks
3.1 Spiking Neural Network under Attack
Although SNNs are more robust than ANNs under some conditions, most SNNs are still vulnerable when effective adversarial attack methods are applied.
Previous works have experimentallydemonstrated that gradient attack methods such as FGSM can be applied to SNNs [Sharmin et al.
However, because of the non-differentiable property of spiking neurons, the gradientsobtained by backpropagation are not necessarily accurate, which may cause inefficient attacks.
Thus,this defensive nature of SNNs can be thought of as obfuscated gradients [Athalye et al., 2018], whichmay create a false sense of security about SNNs.
Therefore, in this paper, we first reconsider the attacks for SNNs by utilizing a combination of attackmethods and gradient approximations.
We follow the Backward Pass Differentiable Approximation(BPDA) technique [Athalye et al., 2018] to overcome the obfuscated gradients.
The key idea of the
BPDA is to use a differentiable approximation in the backward pass while the forward pass unchanged.
Similar differentiable approximation techniques have been used for training SNNs.
Based on these,we design, compare, and summarize different differentiable approximations for SNNs.
3.2 Differentiable Approximation
for Spiking Neural Networks
Conversion-based Approximation.
The Conversion-based Approximation (CBA) for SNN wasfirst proposed by Sharmin et al.
Since an SNN can be converted from an ANN Rueckaueret al.
[2017], Han et al.
[2020], the adversarial examples can be generated from an ANN with sharedweights and bias from the source SNN.
However, this method approximates the spiking neuron usingthe ReLU activation function on both forward pass and backward pass, which is contrary to the ideaof the BPDA algorithm and is proved to be ineffective [Song et al., 2018].
Backward Pass Through Time.
The most commonly used differentiable approximation is the
Backward Pass Through Time (BPTT) with surrogate gradients.
In this method, the non-differentiableneuron fire function is replaced by a differentiable function on the backward pass.
By combining
Eq.
–Eq. 3, the backward pass can be described as follows:
[Equation]
The final result ∂L ∂ s 0 ( t ) can be calculated by recursively calculating this equation across both layersand time-steps.
And since we use the constant input coding for SNNs, the gradient of the image isexactly ∂L ∂ s 0 ( t ) .
The non-differentiable part ∂ s l +1 ( t ) ∂ m l +1 ( t − ) is replaced by a surrogate gradient functionto get a smooth backward pass.
The backward pass through time technique uses a similar gradientapproximation as the Spatio-Temporal-Backward-Propagation training algorithm
[Wu et al., 2018b].
Since the gradient generated from this method is useful for training, it is very likely to generateeffective gradients.
Backward Pass Through Rate.
Another differentiable approximation is the Backward Pass Through
Rate (BPTR).
In this method, the backward pass takes the derivative directly from the average firing
[Table]
rate of the spiking neurons between layers.
We consider neurons at each time-step equivalent, and thederivative is determined by the average firing rate.
[Equation]
Since the relationship of the firing rates in adjacent layers for non-leaky IF neuron is nearly linear[Sengupta et al., 2019], the gradients of ∂ 1 T (cid:80) Ti =
s l
+
( i ) /∂
1 T (cid:80) Ti =
s l ( i ) can be approximatedusing the straight-through estimator [Bengio et al., 2013].
Similar to Lee et al.
[2020], here we use theconstant 1 T to approximate the value of ∂ 1 T (cid:80)
Ti =
s l
+
( i ) /∂
1 T (cid:80) Ti =
s l ( i ) at Eq.
The backwardpass of the complete neuronal dynamic is approximated by one single function, and the gradient willnot accumulate through time-steps.
As the forward pass still follows the rule of the spiking neurons,the obtained gradients will be more accurate than the conversion-based attack.
3.3 Effective Attack with Backward Pass through Time and Rate
To compare the effectiveness of the above three differentiable approximation techniques in constructing gradient-based attacks for SNNs, we applied combinations of three gradient-based methods(FGSM, RFGSM, PGD) and three differentiable approximation techniques (CBA, BPTR, BPTT)to two baseline models.
The two models, VGG-11 and WideResNet-16, are trained on the CIFARdataset using BPTT with no additional defenses.
The number of time-steps is set to T = 8 .
As shown in Tab. 1, the CBA is the most ineffective differentiable approximation technique to construct attacks for SNNs.
The performance of all models under attack using CBA is significantly higherthan that of models under attack using BPTR and BPTT.
As we have discussed in Sec. 3.2 when using
CBA, the changes in both forward pass and backward pass cause inaccuracy in the generated gradient.
Both the BPTT and BPTR methods, combined with different attack methods, can significantly reducethe performance of the given model.
Among all single-step attack combinations, FGSM(BPTR),
RFGSM(BPTT), FGSM(BPTT), and RFGSM(BPTT) can generate efficient and effective adversarialexamples for all the testing models.
Among all multi-step attacks, the PGD(BPTT) always beats otherattack combinations.
These results suggest different properties between BPTT and BPTR.
The BPTTapproximation contains extra temporal information that is useful when using multi-step attacks, whilethe BPTR approximation saves more computation resources when back-propagating through firingrates and can get comparable results on single-step attacks.
Methods: Perturbation Analysis and Regularized Adversarial Training
The previous section identifies threats from effective differentiable approximations combined withgradient-based attacks.
In this section, we will give a theoretical perturbation analysis under SNNattacks and propose a regularized adversarial training scheme.
4.1 Perturbation Analysis for Spike Representation
Current perturbation analysis of ANN considers the distance of continuous activation ∥ a l − (cid:101) a l ∥and the rectified linear outputs ∥
f ( a l ) − f ( (cid:101) a l ) ∥ .
Kundu et al.
[2021b] used this rate-based distanceto bridge the robustness of ANN and SNN.
Spike trains in SNN not only contain rate informationbut also have a temporal structure.
To evaluate the distance in the spike train space, various kernelmethods are proposed for neuronal identification and encoding [Weng et al., 2018].
Inspired by these works, we propose to model the distortion of the spike response using the spike train distance,which may bridge the robustness of SNN to the discovery of neuroscience and is also sensitive to thechange of both firing rate and temporal information.
Denote the output spike train of the l th layer as
S l = { s l ( t ) | t = 1 , 2 , · · · , T } ∈
χ T × N l ( χ ∈ { 0 , 1 } ), where T is the number of time-steps and N l isthe number of neurons in layer l .
Then the perturbation distance can be formulated as ( p ≥ 1 ):
[Equation]
where ∥ · ∥ p,p denotes the l p entry-wise matrix norm and ∥ · ∥ p denotes the l p vector norm.
(cid:101)
S l isthe perturbed version of S l .
Since the p power of spike activation values (0 and 1) are themselves,without loss of generality we set p = 2 .
In Theorem 1, we obtain a Lipschitz constant for the spiketrain distance.
Theorem 1.
Given an L-layered SNN intended to inference T time-steps with θ as threshold, supposethat there are N l neurons in layer l for l = 1 , 2 , · · · , L .
W l ∈ R N l × N l − 1 .
For layer l , it satisfies:
[Equation]
(13) where Λ l is a Lipschitz constant and Γ l is a constant for layer l , which can be expressed as:
[Equation]
[Equation]
where γ l = sup s ̸ =0 , s ∈
χ Nl − 1 ∥ W l s ∥ ∞ + sup s ̸ =0 , s ∈
χ Nl − 1 ∥ − W l s ∥ ∞ .
χ
= { 0 , 1 } , ψ = {− 1 , 0 , 1 } .
In Eq.
14, Λ l is referred to as the spiking Lipschitz constant .
Since the inter-layer spike signalsare not purely linear and the effect of the spiking generation mechanism cannot be neglected, theinequality relationship expressed by Eq.
13 is not exactly the same as the definition of the classical
Lipschitz constant [O’Searcoid, 2006].
Nonetheless, this does not affect our understanding of theamplification effect of spike distance.
On the right side of Eq. 13, there is an additional constant Γ lrelated to the weight.
The appearance of Γ l is associated with the spike generation and the boundingof the current.
The determination of Γ l adopts a very loose constraint (see our proof in the Appendix),and its effect on the spike distance is additive, so we will still focus on how to constrain the spiking
Lipschitz constant while not magnifying the additive item excessively.
4.2 Constraining Spiking Lipschitz Constant
Here we explain why SNNs are thought to be more robust than ANNs and how to constrain thespiking Lipschitz constant in Eq. 13.
Szegedy et al.
[2014] has concluded that the upper boundof the Lipschitz constant for ReLU-based layers is the largest singular value of the weight matrix,
i.e., sup x ̸ =0 ∥ W l x ∥ 2 ∥ x ∥for layer l .
The difference between the classical Lipschitz constant and thespiking Lipschitz constant lies in the vector domain.
The classical Lipschitz constant is the attainedsupremum for any vector x ̸ = 0 .
In the case of the SNN layer, its Lipschitz constant is constrained inthe space { x ̸ = 0 , x ∈ ψ N l − 1 , ψ = {− 1 , 0 , 1 }} , a subspace of x ̸ = 0 .
Inspired by this, we can derivean inequality between the classical Lipschitz constant and the spiking Lipschitz constant, which ispresented in Proposition 1 (The detailed proof is in the Appendix).
Proposition 1.
Given a weight matrix with real values W l ∈ R N l
[Equation]
N
[Equation]
[Equation] [Equation]
It satisfies:
[Equation]
where ∥ W l ∥ 2 is the induced l 2 matrix norm, and σ max ( W l ) is the largest singular value of W l .
According to Eq.
16, the spiking Lipschitz constant Λ l is less than σ max ( W l ) .
The primary goal isto constrain the training through a weight regularizer.
However, Λ l is hard to estimate, whereas there are numerous ways to modulate the spectral norm σ max ( W l )
[Miyato et al., 2018, Cisse et al., 2017,
Yoshida and Miyato, 2017].
Thus, we choose to adopt spectral norm regularization into our proposedtraining scheme.
The target of regularization is to control the spectral norm to approach 1 :
[Equation]
Such that according to Eq.
16, we can also meet the criterion that Λ l is less than 1 for each layerl .
We note that the constraint to ∥ W l ∥ 2 can also contribute to limiting γ l , which is presented in
Proposition 2 (The detailed proof is in the Appendix).
Proposition 2.
Given a weight matrix with real values W l ∈ R N l × N l − 1 .
χ
= { 0 , 1 } .
It satisfies:
[Equation]
where ∥ W l ∥ p is the induced l p matrix norm.
In Proposition 2, the relationship between l ∞ norm and l 2 norm is based on the norm inequalitytheory.
The item in γ l defined in a constrained space, on the other hand, is strictly less than thel ∞ norm of W l .
Thus, we can conclude γ l has an upper bound determined by scaled σ max ( W l ) .
Controlling σ max ( W l ) is sufficient to limit Γ l as Γ l monotonously increases with the increase of γ l .
4.3 Regularized Adversarial Training (RAT)
Application of regularization (REG) .
Once the target of regularization is set to control the matrixnorm of weights, the next question is how to find a good regularizer to assist training.
By setting thethreshold of spiking neurons to 1, the amplification of spike distance is mainly related to Γ .
Giventhat SNN frequently suffers from gradient problems during training [Wu et al., 2018b], we eventuallysettle on an orthogonal regularization method that can help prevent the network from vanishinggradients [Lin et al., 2021].
Singular values are naturally equal to 1 when the weight matrix row isorthogonal.
Therefore, we propose to project the updating weights to the target of the orthogonalmatrix at a rate defined by β [Cisse et al., 2017]:
[Equation]
For convolutional layers that have weight matrices of 4 dimensions W ∈ R C out × C in × k × k , thesematrices should be first reorganized into 2-dimensional matrices in R C out ×
( C in × k × k ) to accomplishthe update, where k is the kernel size and C in , C out are numbers of input and output channels.
Generalizing strong SNN adversarial examples (MIX) .
As Sec. 3 suggested, SNNs are alsovulnerable under different approximations of the backward pass.
To equip the trained SNN with evenbetter invulnerability, we argument the training dataset with stronger adversarial perturbations basedon our observations.
The analyses and results in Sec.
3 imply that the single-step FGSM and RFGSMcan provide us with adequate adversaries at a relatively low computational cost.
It is worth notingthat RFGSM is recognized as an effective substitution for PGD in adversarial learning [Wong et al.
The BPTT and BPTR approximations further allow the dataset to extend to its l ∞ balls with astrong adversary compared with the CBA.
Hence, our model is trained with adversarial examplesrandomly sampled from {FGSM(BPTT), RFGSM(BPTT), FGSM(BPTR), RFGSM(BPTR)}.
Eachmini-batch of images are perturbed by a single choice from the four methods with equal probabilitybefore being fed into the network.
The network learns to generalize in the mixture of heterogeneousneighbourhoods defined by the four adversaries.
For better network training performance, we choosethe mainstream method where the network is updated by the gradients produced from BPTT withsurrogate functions [Neftci et al., 2019, Zheng et al., 2021, Fang et al., 2021].
Experiments
5.1 Experimental Setup
We validate our proposed robust SNN training scheme on the image classification tasks, where the
CIFAR-10 and CIFAR-100 datasets are used.
We train the SNN version of VGG-11 and WideResNet16 (with widening factor set as 4) for both datasets with T = 8 .
In addition, we set β = 0 .
001 and
004 for VGG-11 and WideResNet-16, respectively.
The perturbation boundary ϵ is set to 2/255when training models.
Detailed implementation is referred to in Appendix.
The images are directly fed into SNNs.
We include several gradient-based attack methods to evaluatethe adversarial performance thoroughly: FGSM [Goodfellow et al., 2015], RFGSM [Tramèr et al.
,2018], PGD [Madry et al., 2018],
BIM
[Kurakin et al., 2017].
Gaussian noise (GN) is also used totest the performance against random perturbation with the same ϵ .
5.2 Results
Performance under attacks .
Tab.
2 reports the performance of our proposed RAT scheme.
All gradient attacks are combined with powerful SNN attacks (BPTT, BPTR).
The classification accuracy inbrackets is the accuracy without the proposed training scheme.
Black-box attacks are marked with “*”in the table.
It is observed that for all the attack methods, our RAT can improve the model robustness,which is reflected in the improvement of accuracy.
Compared with VGGs, Vanilla WideResNets aremore vulnerable to RFGSM attacks.
However, armed with RAT, it is even more robust than VGGs.
Black-box attacks are almost ineffective against RAT-trained models.
For stronger white-box iterativeattacks, our RAT improves the robustness from being almost completely misclassified.
For example,the VGG-11 model increases its accuracy by 34.76% under the PGD(BPTR) attack after being trainedwith RAT on the CIFAR-10 dataset.
Performance with larger ϵ .
We plot the accuracy of the white-box and black-box scenarios underthe PGD(BPTT) attack in Fig.
For white-box attacks, both models converge to almost zero afterϵ = 4 / 255 , while RAT-trained models drop their accuracy with increasing ϵ .
Black-box attacks areweaker than white-box ones.
From Fig. 1(b) and (d), the accuracy of RAT-trained models decreasescomparably slowly to that of vanilla models. [Equation]
  †        
 $ FF X U DF \ 9$1,//$5$ [Figure]      †         
$ FF X U DF \
[Figure]
VGG
[Figure]
     †        

$ FF X U DF \
[Figure]
     †        

$ FF X U DF \
[Figure]
Attack
[Table]
[Table]
     β   
  $ FF X U DF \ &/($1)*60%377 (
[Figure]
[Figure]
     β   
  $ FF X U DF \ (b)
WRN-16 β
Test          
/D\HU        ' L V W D Q FH 9$1,//$5(* (c) Perturbation Distance   
6LQJXODU9DOXH      ' H Q V LW \ 5(*9$1,//$
[Figure]
5.3 Ablation Studies
The proposed RAT scheme in Sec.
4.3 is composed of a regularizer to control the spiking Lipschitzconstant and mixed adversarial neighbourhoods for adversarial training.
We conduct ablation studiesbased on VGG-11 trained with the CIFAR-10 dataset.
The results are shown in Tab. 3.
The attackmethods are all BPTT attacks.
When trained without RAT, the performances under single-step FGSMand RFGSM are lower than 25%, and the accuracies of PGD and BIM are nearly zero.
With onlythe application of the regularization, the performance of FGSM and RFGSM increase to 26.6% and40.9%.
The single deployment of mixed adversarial training significantly improves the robustnessas the combination of heterogeneous neighbourhoods enhances data generalization.
When both theregularizer and the adversarial training are used, the model gets the best robustness.
These resultsindicate that each component in RAT alone can improve the model’s adversarial performance, andthe robustness of the model is greatly improved after they are combined.
[Table]
5.4 Effects of Regularized Adversarial Learning
We test the sensitivity of the orthogonal projection rate β on the CIFAR-10 dataset with VGG-11and WideResNet-16 structures.
As shown in Fig.
2(a) and (b), β has little effect on clean accuracy.
For the two architectures, 0.001 and 0.004 give the best accuracy under the FGSM(BPTT) attack,respectively.
To validate the effect of the regularization, the perturbation distance of each neuron layerin WideResNet-16 is visualized.
In Fig. 2(c), the colors range from light to dark denote ϵ = 2 , 4 , 8 .
Itcan be seen that the distances of the regularized model are consistently less than those of the vanillamodel, which indicates that regularization inhibits the amplification of the spike distance.
Fig.
2(d)presents the distribution of singular values of the WideResNet-16 model.
The regularization makessingular values of weights to be aggregated at 1 as expected.
Conclusions and Discussions
In this work, we are the first to give a theoretical Lipschitz analysis of perturbation for hardwarefriendly SNNs.
SNNs are more vulnerable due to their diverse and feasible gradient methods.
Therefore, we propose a specialized regularization adversarial training scheme for SNNs.
Ourexperiments demonstrate that models trained on this scheme can obtain much robustness, especiallyin black-box attacks.
We believe this work will pave the way for SNNs in energy-efficient as well assafety-critical applications.
Besides, recent works have shown that SNN can achieve good resultswithout BN [Kundu et al., 2021a].
Note that BN are included in our model, which may be harmful tothe robustness
[Wang et al., 2022].
Thus, valuable future research directions will include how to trainrobust SNNs while getting rid of the adverse effects of BN.