Logo
ScienceStack
Table of Contents
Fetching ...
Sign In

RSC-SNN: Exploring the Trade-off Between Adversarial Robustness and Accuracy in Spiking Neural Networks via Randomized Smoothing Coding

Keming Wu, Man Yao, Yuhong Chou, Xuerui Qiu, Rui Yang, Bo Xu, Guoqi Li

TL;DR

This work investigates adversarial robustness in Spiking Neural Networks and reveals that Poisson coding shares foundational properties with randomized smoothing, providing a theoretical basis for robustness observed in Poisson-encoded SNNs. It introduces Randomized Smoothing Coding (RSC) and Quantification Trade-off Estimation (QTE) to navigate the accuracy-robustness trade-off, supported by theoretical analysis of covariance and equivalence with Poisson coding. To mitigate clean-accuracy loss, Efficient-RSC Training (E-RSCT) uses knowledge distillation from pre-trained ANNs in conjunction with a pre-synaptic loss, yielding improved robustness while recapturing accuracy. Experiments across CIFAR-10/100, Tiny-ImageNet, and ImageNet show state-of-the-art adversarial robustness for RSC-SNN, with open-source code, highlighting practical impact for safety-critical SNN deployments.

Abstract

Spiking Neural Networks (SNNs) have received widespread attention due to their unique neuronal dynamics and low-power nature. Previous research empirically shows that SNNs with Poisson coding are more robust than Artificial Neural Networks (ANNs) on small-scale datasets. However, it is still unclear in theory how the adversarial robustness of SNNs is derived, and whether SNNs can still maintain its adversarial robustness advantage on large-scale dataset tasks. This work theoretically demonstrates that SNN's inherent adversarial robustness stems from its Poisson coding. We reveal the conceptual equivalence of Poisson coding and randomized smoothing in defense strategies, and analyze in depth the trade-off between accuracy and adversarial robustness in SNNs via the proposed Randomized Smoothing Coding (RSC) method. Experiments demonstrate that the proposed RSC-SNNs show remarkable adversarial robustness, surpassing ANNs and achieving state-of-the-art robustness results on large-scale dataset ImageNet. Our open-source implementation code is available at this https URL: https://github.com/KemingWu/RSC-SNN.

RSC-SNN: Exploring the Trade-off Between Adversarial Robustness and Accuracy in Spiking Neural Networks via Randomized Smoothing Coding

TL;DR

This work investigates adversarial robustness in Spiking Neural Networks and reveals that Poisson coding shares foundational properties with randomized smoothing, providing a theoretical basis for robustness observed in Poisson-encoded SNNs. It introduces Randomized Smoothing Coding (RSC) and Quantification Trade-off Estimation (QTE) to navigate the accuracy-robustness trade-off, supported by theoretical analysis of covariance and equivalence with Poisson coding. To mitigate clean-accuracy loss, Efficient-RSC Training (E-RSCT) uses knowledge distillation from pre-trained ANNs in conjunction with a pre-synaptic loss, yielding improved robustness while recapturing accuracy. Experiments across CIFAR-10/100, Tiny-ImageNet, and ImageNet show state-of-the-art adversarial robustness for RSC-SNN, with open-source code, highlighting practical impact for safety-critical SNN deployments.

Abstract

Spiking Neural Networks (SNNs) have received widespread attention due to their unique neuronal dynamics and low-power nature. Previous research empirically shows that SNNs with Poisson coding are more robust than Artificial Neural Networks (ANNs) on small-scale datasets. However, it is still unclear in theory how the adversarial robustness of SNNs is derived, and whether SNNs can still maintain its adversarial robustness advantage on large-scale dataset tasks. This work theoretically demonstrates that SNN's inherent adversarial robustness stems from its Poisson coding. We reveal the conceptual equivalence of Poisson coding and randomized smoothing in defense strategies, and analyze in depth the trade-off between accuracy and adversarial robustness in SNNs via the proposed Randomized Smoothing Coding (RSC) method. Experiments demonstrate that the proposed RSC-SNNs show remarkable adversarial robustness, surpassing ANNs and achieving state-of-the-art robustness results on large-scale dataset ImageNet. Our open-source implementation code is available at this https URL: https://github.com/KemingWu/RSC-SNN.
Paper Structure (26 sections, 3 theorems, 31 equations, 4 figures, 9 tables, 1 algorithm)

This paper contains 26 sections, 3 theorems, 31 equations, 4 figures, 9 tables, 1 algorithm.

Table of Contents

  1. Introduction
  2. Background and Related Work
  3. Spiking Neural Network
  4. Adversarial Attacks
  5. Randomized Smoothing
  6. Method
  7. Quantification Trade-off Estimation
  8. Randomized Smoothing Coding (RSC)
  9. Theoretical Analysis for Randomized Smoothing Coding
  10. Checks for RSC Gradient Obfuscation
  11. Efficient-RSC Training (E-RSCT)
  12. Experiments
  13. Experimental Setup
  14. Performance under attacks.
  15. The effectiveness of E-RSCT.
  16. ...and 11 more sections

Key Result

Theorem 3.2

The covariance matrix of Poisson coding before and after the attack satisfies:

Figures (4)

  • Figure 1: An illustration of the trade-off between adversarial robustness and accuracy can be represented by the absolute value of the slope, indicating the SNN model's adversarial robustness. The area of a triangle can quantitatively estimate this trade-off. It is important to note that the slope illustrates the correlation between accuracy and attack strength, rather than implying a specific linear relationship.
  • Figure 2: Visual verification of equivalence of randomized smoothing coding and Poisson coding.
  • Figure 3: Ablation experiment for noise level $\sigma^2$.
  • Figure 4: Supplementary visual verification of equivalence of RS and Poisson coding. (a) An example of feature maps processed by RS and Poisson coding selected from CIFAR100. (b) An example of feature maps processed by RS and Poisson coding selected from Tiny-ImageNet.

Theorems & Definitions (4)

  • Definition 3.1
  • Theorem 3.2
  • Theorem 3.3
  • Proposition 3.4