Towards Reliable Evaluation of Adversarial Robustness for Spiking Neural Networks

TL;DR

This work addresses the unreliable evaluation of adversarial robustness in Spiking Neural Networks due to gradient-vanishing spike activations. It introduces a theoretically grounded framework combining Adaptive Sharpness Surrogate Gradient ($ASSG$) with a stability-focused attack optimizer, Stable Adaptive Projected Gradient Descent ($SA$-PGD), to produce more accurate gradients and reliable robustness assessments. The authors derive an upper bound on gradient-vanishing for surrogate gradients and show how input-dependent sharpness improves gradient fidelity, while SA-PGD ensures efficient and stable adversarial optimization under $L_\infty$ constraints. Across diverse SNN architectures, neuron models, and training schemes, the approach yields higher attack success rates and reveals that prior robustness estimates were optimistic, underscoring the need for dependable adversarial training and evaluation in SNNs.

Abstract

Spiking Neural Networks (SNNs) utilize spike-based activations to mimic the brain's energy-efficient information processing. However, the binary and discontinuous nature of spike activations causes vanishing gradients, making adversarial robustness evaluation via gradient descent unreliable. While improved surrogate gradient methods have been proposed, their effectiveness under strong adversarial attacks remains unclear. We propose a more reliable framework for evaluating SNN adversarial robustness. We theoretically analyze the degree of gradient vanishing in surrogate gradients and introduce the Adaptive Sharpness Surrogate Gradient (ASSG), which adaptively evolves the shape of the surrogate function according to the input distribution during attack iterations, thereby enhancing gradient accuracy while mitigating gradient vanishing. In addition, we design an adversarial attack with adaptive step size under the $L_\infty$ constraint-Stable Adaptive Projected Gradient Descent (SA-PGD), achieving faster and more stable convergence under imprecise gradients. Extensive experiments show that our approach substantially increases attack success rates across diverse adversarial training schemes, SNN architectures and neuron models, providing a more generalized and reliable evaluation of SNN adversarial robustness. The experimental results further reveal that the robustness of current SNNs has been significantly overestimated and highlighting the need for more dependable adversarial training methods.

Figures (7)

• Figure 1: (a). Curves of the surrogate gradient function $g(x)$ and its integral under different sharpness parameters $\alpha$. (b). Illustration of the adaptive mechanism of the surrogate gradient sharpness parameter in ASSG during adversarial attacks.
• Figure 2: The distribution of the sharpness parameter $\alpha_{i,t}^l$. The vertical lines denote the mean and the 90th percentile (P90), respectively.
• Figure 3: The loss curves of SA-PGD for different gradient approximation methods.
• Figure 4: ASR for attacks using Atan surrogate gradients with different values of $\alpha$ and ASSG with different values of $A$.
• Figure 5: ASR of different attack methods at varying iteration numbers when using ASSG as the surrogate gradient.

Theorems & Definitions (7)

• Definition 1
• Theorem 1
• Corollary 1
• Theorem 1
• proof
• Corollary 1
• proof