Logo
ScienceStack
Table of Contents
Fetching ...
Sign In

Adversarially Robust Spiking Neural Networks with Sparse Connectivity

Mathias Schmolli, Maximilian Baronig, Robert Legenstein, Ozan Özdenizci

TL;DR

This work tackles the challenge of achieving adversarial robustness in energy- and memory-constrained systems by building sparse, robust spiking neural networks through an ANN-to-SNN conversion framework. It first pretrains and prunes robust, sparse ANNs, then transfers their connectivity and weights to SNNs using threshold-balancing and batch-norm adaptation, followed by adversarial finetuning of the sparse SNNs. The approach exceeds end-to-end sparse adversarial training in robustness and efficiency, scaling to TinyImageNet and delivering substantial memory and energy savings (up to $100\times$ parameter compression and $8.6\times$ energy gains) while maintaining strong accuracy under rigorous ensembles of attacks. These findings imply a practical path to robust, deployable SNNs for edge devices, leveraging existing adversarial training and pruning advances in the ANN domain.

Abstract

Deployment of deep neural networks in resource-constrained embedded systems requires innovative algorithmic solutions to facilitate their energy and memory efficiency. To further ensure the reliability of these systems against malicious actors, recent works have extensively studied adversarial robustness of existing architectures. Our work focuses on the intersection of adversarial robustness, memory- and energy-efficiency in neural networks. We introduce a neural network conversion algorithm designed to produce sparse and adversarially robust spiking neural networks (SNNs) by leveraging the sparse connectivity and weights from a robustly pretrained artificial neural network (ANN). Our approach combines the energy-efficient architecture of SNNs with a novel conversion algorithm, leading to state-of-the-art performance with enhanced energy and memory efficiency through sparse connectivity and activations. Our models are shown to achieve up to 100x reduction in the number of weights to be stored in memory, with an estimated 8.6x increase in energy efficiency compared to dense SNNs, while maintaining high performance and robustness against adversarial threats.

Adversarially Robust Spiking Neural Networks with Sparse Connectivity

TL;DR

This work tackles the challenge of achieving adversarial robustness in energy- and memory-constrained systems by building sparse, robust spiking neural networks through an ANN-to-SNN conversion framework. It first pretrains and prunes robust, sparse ANNs, then transfers their connectivity and weights to SNNs using threshold-balancing and batch-norm adaptation, followed by adversarial finetuning of the sparse SNNs. The approach exceeds end-to-end sparse adversarial training in robustness and efficiency, scaling to TinyImageNet and delivering substantial memory and energy savings (up to parameter compression and energy gains) while maintaining strong accuracy under rigorous ensembles of attacks. These findings imply a practical path to robust, deployable SNNs for edge devices, leveraging existing adversarial training and pruning advances in the ANN domain.

Abstract

Deployment of deep neural networks in resource-constrained embedded systems requires innovative algorithmic solutions to facilitate their energy and memory efficiency. To further ensure the reliability of these systems against malicious actors, recent works have extensively studied adversarial robustness of existing architectures. Our work focuses on the intersection of adversarial robustness, memory- and energy-efficiency in neural networks. We introduce a neural network conversion algorithm designed to produce sparse and adversarially robust spiking neural networks (SNNs) by leveraging the sparse connectivity and weights from a robustly pretrained artificial neural network (ANN). Our approach combines the energy-efficient architecture of SNNs with a novel conversion algorithm, leading to state-of-the-art performance with enhanced energy and memory efficiency through sparse connectivity and activations. Our models are shown to achieve up to 100x reduction in the number of weights to be stored in memory, with an estimated 8.6x increase in energy efficiency compared to dense SNNs, while maintaining high performance and robustness against adversarial threats.

Paper Structure

This paper contains 27 sections, 14 equations, 3 figures, 8 tables, 1 algorithm.

Table of Contents

  1. Introduction
  2. Background
  3. Spiking Neural Networks
  4. Adversarial Robustness of Neural Networks
  5. Sparsity and Adversarial Robustness
  6. Adversarially Robust and Sparse ANN-to-SNN Conversion
  7. Pretraining Robust and Sparse ANNs
  8. Converting Pretrained ANNs to SNNs
  9. Adversarial Finetuning of Sparse SNNs
  10. Experiments
  11. Experimental Setup
  12. Evaluating Adversarial Robustness of SNNs
  13. Estimation of Energy Consumption in SNNs
  14. Experimental Results
  15. Robust ANN-to-SNN Conversion Outperforms End-to-End Sparse AT
  16. ...and 12 more sections

Figures (3)

  • Figure 1: Comparing our method with end-to-end (E2E) AT, via clean (solid) and robust (dashed) accuracies evaluated with PGD$_\text{ens}$ at $\epsilon=8/255$ (90% sparse VGG-16 SNN on CIFAR-10). Sparsity in E2E training was initialized either randomly, or by using the ANN connectivity as in our method.
  • Figure 2: Clean (solid lines) and robust (dashed lines) accuracies of converted SNNs evaluated with PGD$_\text{ens}$ at $\epsilon=8/255$ for CIFAR-10 and $\epsilon=4/255$ or CIFAR-100, for different sparsity levels. ANNs used for conversion were either dense, pruned with LWM, or layerwise uniformly or non-uniformly sparse through learned importance scores (see Appendix \ref{['appendix_evals']} for numerical details of all results).
  • Figure B1: Comparisons of per-layer average spiking rates of the resulting SNNs with the two pruning approaches. Both models maintain 90% global sparsity (i.e., 10% connectivity) and trained on CIFAR-10 using the VGG-16 architecture.