Spike-PTSD: A Bio-Plausible Adversarial Example Attack on Spiking Neural Networks via PTSD-Inspired Spike Scaling

Abstract

Spiking Neural Networks (SNNs) are energy-efficient and biologically plausible, ideal for embedded and security-critical systems, yet their adversarial robustness remains open. Existing adversarial attacks often overlook SNNs' bio-plausible dynamics. We propose Spike-PTSD, a biologically inspired adversarial attack framework modeled on abnormal neural firing in Post-Traumatic Stress Disorder (PTSD). It localizes decision-critical layers, selects neurons via hyper/hypoactivation signatures, and optimizes adversarial examples with dual objectives. Across six datasets, three encoding types, and four models, Spike-PTSD achieves over 99% success rates, systematically compromising SNN robustness. Code: https://github.com/bluefier/Spike-PTSD.

Figures (9)

• Figure 1: Motivation behind Spike-PTSD and analogies between the post-traumatic stress response of the PTSD-affected brain and AEAs against SNNs.
• Figure 2: Forward and backward processes with surrogate gradients in direct SNN training and AEAs. $s$ and $n$ denote spike and $n$-th layer, respectively.
• Figure 3: The overview of Spike-PTSD framework with three key modules: (i) Determine the target layer ($l_t$) during spike-brain profiling on computational time or ASR. (ii) Then, select target class ($y_t$) and neurons ($\mathcal{N}_t$) in $l_t$ according to spike-sensitivity and fired spikes under the targeted attack setting (the orange region). (iii) Finally, set the spike objective of $\mathcal{N}_t$ and update the perturbation ($\delta$) during the combined optimization process (the purple region) to generate AEs ($\hat{x}$).
• Figure 4: Specific process of INI for untargeted attacks.
• Figure 5: Ablation studies on different target spike layers in VGGDVS (a) and hyperparameters (b).