Research map / Adversarial robustness and security / Attacks on text and graphs
Towards Effective and Sparse Adversarial Attack on Spiking Neural Networks via Breaking Invisible Surrogate Gradients
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Proposes a potential-dependent surrogate gradient (PDSG) for attacking SNNs without knowing the training SG, and a sparse dynamic attack (SDA) with a generation-reduction paradigm for sparse adversarial perturbations on binary DVS frames.
Problem
Gradient-based adversarial attacks on spiking neural networks are hampered because the surrogate gradient is invisible to an inference-only attacker, and binary dynamic (DVS) inputs yield non-differentiable, incompatible gradients requiring sparse perturbations.
Approach
Derives a surrogate gradient from the zeroth-order two-point estimate under a normal membrane-potential assumption (Gaussian shape set by membrane potential variance), right-shifted by 0.5σ for calibration; SDA then selects pixels via contributing gradients and finite differences, and prunes redundant flips with binary search.
Key results
- PDSG reaches 100% attack success rate on ImageNet (HST-10-768, PGD, eps=8/255) versus 99.98% for HART.
- SDA reaches 82% ASR on CIFAR10-DVS with l0<800 (0.24% of pixels), versus 70% for SpikeFool under the same constraint... (SpikeFool 70% at l0<200 vs SDA 82% at l0<800 comparison per Table 2)
- SDA median l0 on CIFAR10-DVS is 303 pixels, about 62% of SpikeFool's median.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| use PDSG instead of HART | SNN attacks on ImageNet with HST-10-768 · ImageNet, FGSM, ε=8/255 | ASR (%): 76.61 -> 79.71 | Helped |
| use PDSG instead of HART | SNN attacks on ImageNet with HST-10-768 · ImageNet, PGD, ε=8/255 | ASR (%): 99.98 -> 100.00 | Helped |
| use PDSG instead of HART | SNN attacks on CIFAR10 with ResNet18 · CIFAR10, FGSM, ε=8/255 | ASR (%): 46.72 -> 79.56 | Helped |
| use PDSG instead of HART | SNN attacks on CIFAR10 with ResNet18 · CIFAR10, PGD, ε=8/255 | ASR (%): 98.64 -> 100.00 | Helped |
| use SDA instead of SpikeFool | binary dynamic image attacks on ResNet18 · CIFAR10-DVS, ℓ0 < 800 | ASR (%): 70.0 -> 82.0 | Helped |
| use SDA instead of SpikeFool | binary dynamic image attacks on ResNet18 · CIFAR10-DVS, dynamic evaluation | median ℓ0: 491.00 -> 303.00 | Helped |
| add C&W loss to top-k gradient selection (ablation) | SDA on CIFAR10-DVS · CIFAR10-DVS | ASR (%): 69.0 -> 72.0 | Helped |
| add finite differences (ablation) | SDA with top-k gradients and C&W loss on CIFAR10-DVS · CIFAR10-DVS | ASR (%): 72.0 -> 75.0 | Helped |
| add perturbation reduction (ablation) | SDA generation on CIFAR10-DVS · CIFAR10-DVS | ASR (%): 75.0 -> 78.0 | Helped |
| add PDSG (ablation) | SDA on CIFAR10-DVS · CIFAR10-DVS | ASR (%): 78.0 -> 82.0 | Helped |
| shift PDSG right by bias b (ablation) | PDSG attacks on SNNs · CIFAR10, FGSM, ε=8/255 | ASR (%) | Helped |
| vary the model timestep (ablation) | PDSG attacks on ResNet18 · CIFAR10 | ASR (%) | No clear effect |
Surprising findings
- The training-phase surrogate gradient is not always the most effective choice for attacking, and fixed attack SGs perform inconsistently across training SGs.
Limitations
- Attack success on CIFAR10-DVS and DVS-Gesture remains moderate for some baselines and settings; PDSG on DVS binary inputs is only partially effective.
- PDSG relies on a normal-distribution assumption for membrane potential that holds only approximately.
- Calibration offset b=0.5σ is a hand-chosen hyperparameter; too large an offset decreases ASR.
Experimental setup
Datasets: CIFAR10 CIFAR100 ImageNet N-MNIST DVS-Gesture CIFAR10-DVS
Benchmarks: CIFAR10 CIFAR100 ImageNet N-MNIST DVS-Gesture CIFAR10-DVS
Metrics: attack success rate l0-norm of perturbation median l0
Baselines: STBP RGA HART SCG SpikeFool GSAttack
Builds on: STBP PGD C&W loss SparseFool SCG
Closest papers by meaning
- Towards Reliable Evaluation of Adversarial Robustness for Spiking Neural Networks (CVPR 2026 · similarity 0.91)
- Enhancing Adversarial Robustness in SNNs with Sparse Gradients (ICML 2024 · similarity 0.91)
- SNN-RAT: Robustness-enhanced Spiking Neural Network through Regularized Adversarial Training (NeurIPS 2022 · similarity 0.89)
- Rate Gradient Approximation Attack Threats Deep Spiking Neural Networks (CVPR 2023 · similarity 0.89)
- Threaten Spiking Neural Networks through Combining Rate and Temporal Information (ICLR 2024 · similarity 0.89)
- Robust Stable Spiking Neural Networks (ICML 2024 · similarity 0.87)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.