HoSNN: Adversarially-Robust Homeostatic Spiking Neural Networks with Adaptive Firing Thresholds

TL;DR

This work addresses adversarial vulnerability in spiking neural networks by introducing a biologically inspired defense that leverages threshold-adapting Leaky Integrate-and-Fire (TA-LIF) neurons and Neural Dynamic Signatures (NDS) as an anchor. The core idea is to minimize adversarial perturbations in membrane potential via online homeostatic threshold adjustments, yielding a second-order control system with provable stability properties. The resulting Homeostatic SNNs (HoSNNs) demonstrate substantial robustness gains over conventional LIF-based SNNs across Fashion-MNIST, SVHN, CIFAR-10, and CIFAR-100, under both white-box and black-box attacks, including strong PGD/APGD variants; gains persist with adversarial training and transfer to unseen attacks. The approach is computationally practical, preserves clean accuracy, and provides a biologically plausible, online defense mechanism that does not rely on gradient obfuscation or randomness. Overall, the work highlights the potential of neural homeostasis as a principled strategy to enhance the resilience of neuromorphic systems against adversarial perturbations, with broad implications for secure, energy-efficient spiking computations.

Abstract

While spiking neural networks (SNNs) offer a promising neurally-inspired model of computation, they are vulnerable to adversarial attacks. We present the first study that draws inspiration from neural homeostasis to design a threshold-adapting leaky integrate-and-fire (TA-LIF) neuron model and utilize TA-LIF neurons to construct the adversarially robust homeostatic SNNs (HoSNNs) for improved robustness. The TA-LIF model incorporates a self-stabilizing dynamic thresholding mechanism, offering a local feedback control solution to the minimization of each neuron's membrane potential error caused by adversarial disturbance. Theoretical analysis demonstrates favorable dynamic properties of TA-LIF neurons in terms of the bounded-input bounded-output stability and suppressed time growth of membrane potential error, underscoring their superior robustness compared with the standard LIF neurons. When trained with weak FGSM attacks (attack budget = 2/255) and tested with much stronger PGD attacks (attack budget = 8/255), our HoSNNs significantly improve model accuracy on several datasets: from 30.54% to 74.91% on FashionMNIST, from 0.44% to 35.06% on SVHN, from 0.56% to 42.63% on CIFAR10, from 0.04% to 16.66% on CIFAR100, over the conventional LIF-based SNNs.

Figures (8)

• Figure 1: Proposed threshold-adapting leaky integrate-and-fire (TA-LIF) neuron model and homeostatic SNNs (HoSNNs). (a) We leverage a LIF SNN trained using clean data to collect neural dynamic signatures (NDS) as an anchor for the HoSNN (shown in the box above). (b) Adversarial inputs can cause large membrane potential deviations from the NDS in deep layers of LIF SNNs, leading to incorrect model predictions. (c) Homeostatic dynamic threshold voltage control in HoSNNs anchors neural activity based on the NDS, resulting improved robustness.
• Figure 2: The heatmaps generated by Grad-CAM Selvaraju_2019 highlight the regions of the input image that most significantly influence the classification decisions of a standard SNN and proposed HoSNN based on the VGG architecture for a set of CIFAR-10 images. The adversarial images are generated using PGD7 with strength of $\epsilon = 6/255$. HoSNN can still maintain attention to the target object under attack.
• Figure 3: (a) Numerical simulations of equation \ref{['eq:err_dyn2']} show that TA-LIF can well suppress the growth of error with time. (b) Box plot of the post-synaptic current relative error distribution per layer of a SNN and a HoSNN, trained with FGSM adversarial training with $\epsilon = 2/255$ and attacked by a same CIFAR10 black-box PGD7 dataset with $\epsilon = 8/255$.
• Figure 4: Distribution of post-synaptic current relative error of a SNN and HoSNN trained with FGSM adversarial training with $\epsilon = 2/255$ and attacked by black-box PGD7 attack with $\epsilon = 8/255$.
• Figure 5: For Test (1). Performance of HoSNN under white-box FGSM and PGD7 attack.