Input-Specific and Universal Adversarial Attack Generation for Spiking Neural Networks in the Spiking Domain

TL;DR

This paper addresses adversarial vulnerabilities in Spiking Neural Networks (SNNs) by introducing two gradient-based attacks that operate entirely in the spiking domain: an input-specific attack and a universal adversarial patch. The methods use spatiotemporal gradients with Gumbel-Softmax and Straight-Through Estimator to optimize perturbations while preserving the temporal structure of spikes, and are architecture-agnostic. Empirical results on NMNIST, IBM DVS Gesture, and SHD show the input-specific attack achieves 100% ASR with extremely small perturbations, while the universal attack delivers strong ASR across inputs with sparse perturbations, enabling real-time feasibility. The findings highlight significant security implications for neuromorphic computing and motivate development of SNN-specific defenses, with demonstrated demonstration on both vision and audio-like spike streams.

Abstract

As Spiking Neural Networks (SNNs) gain traction across various applications, understanding their security vulnerabilities becomes increasingly important. In this work, we focus on the adversarial attacks, which is perhaps the most concerning threat. An adversarial attack aims at finding a subtle input perturbation to fool the network's decision-making. We propose two novel adversarial attack algorithms for SNNs: an input-specific attack that crafts adversarial samples from specific dataset inputs and a universal attack that generates a reusable patch capable of inducing misclassification across most inputs, thus offering practical feasibility for real-time deployment. The algorithms are gradient-based operating in the spiking domain proving to be effective across different evaluation metrics, such as adversarial accuracy, stealthiness, and generation time. Experimental results on two widely used neuromorphic vision datasets, NMNIST and IBM DVS Gesture, show that our proposed attacks surpass in all metrics all existing state-of-the-art methods. Additionally, we present the first demonstration of adversarial attack generation in the sound domain using the SHD dataset.

Figures (12)

• Figure 1: Vision to spikes.
• Figure 2: Sound to spikes.
• Figure 3: Input-specific adversarial attack generation flow.
• Figure 4: Universal adversarial attack generation flow.
• Figure 5: Example universal adversarial attack application in the sound domain.