Research map / Adversarial robustness and security / Certified and empirical robustness

Enhancing Adversarial Robustness in SNNs with Sparse Gradients

ICML 2024 · Adversarial robustness and security › Certified and empirical robustness · approach: Adversarial training refinements · 1 citations (OpenAlex)

Read the paperCheck your idea against 108,967 papers

AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.

Proposes sparsity regularization of the true-class probability's input gradient to narrow the gap between adversarial and random vulnerability in SNNs, combined with adversarial training, improving robustness on CIFAR-10/100 and CIFAR10-DVS.

Problem

Adversarial vulnerability of spiking neural networks (SNNs) under strong attacks; existing defenses (adversarial training, certified training, temporal or coding-based methods) are hard to train on SNNs or weak against strong attacks.

Approach

Theoretically bounds the ratio of adversarial to random vulnerability by the sparsity (l0 norm) of the input gradient of the true-class probability, then approximates l1 gradient regularization via a finite-difference term along the signed gradient direction, trained jointly with cross-entropy (optionally with PGD adversarial training).

Key results

• On CIFAR-10 VGG-11, PGD10 white-box accuracy rises from 11.53% (RAT) and 18.18% (AT) to 30.54% with SR*.
• On CIFAR10-DVS, PGD50 white-box accuracy improves from 4.4% (vanilla) and 51.6% (AT) to 61.2% with SR*.
• SR* reduces clean accuracy on CIFAR-10 WRN-16 to 85.63% from 90.97% (AT) and 93.89% (vanilla).

Measured effects reported in the paper

Surprising findings

• SNNs are markedly more robust to random perturbations of the same scale than to adversarial ones, even at large scales.
• Sparsity regularization alone (without adversarial training) substantially improves robustness over vanilla SNNs, e.g. CIFAR-10 FGSM accuracy from 5.23% to 34.79%.

Limitations

• Robustness gains come with a notable drop in clean accuracy.
• The theoretical bound relies on a first-order Taylor approximation for small epsilon and a finite-difference approximation of the l1 norm.
• Experiments are limited to VGG-11 and WRN-16 on small datasets with a fixed attack strength of 8/255.

Experimental setup

Datasets: CIFAR-10 CIFAR-100 CIFAR10-DVS

Benchmarks: CIFAR-10 CIFAR-100 CIFAR10-DVS

Metrics: classification accuracy under white-box and black-box attack clean accuracy

Baselines: RAT AT Vanilla SNN SR (without AT)

Builds on: adversarial training (PGD) gradient regularization STBP RGA attack

Closest papers by meaning

• Robust Stable Spiking Neural Networks (ICML 2024 · similarity 0.91)
• Towards Effective and Sparse Adversarial Attack on Spiking Neural Networks via Breaking Invisible Surrogate Gradients (CVPR 2025 · similarity 0.91)
• Enhancing the Robustness of Spiking Neural Networks with Stochastic Gating Mechanisms (AAAI 2024 · similarity 0.89)
• FEEL-SNN: Robust Spiking Neural Networks with Frequency Encoding and Evolutionary Leak Factor (NeurIPS 2024 · similarity 0.88)
• Synergy Between the Strong and the Weak: Spiking Neural Networks are Inherently Self-Distillers (NeurIPS 2025 · similarity 0.88)
• Adversarial Training Can Provably Improve Robustness: Theoretical Analysis of Feature Learning Process Under Structured Data (ICLR 2025 · similarity 0.88)