Research map / Adversarial robustness and security / Attacks on text and graphs
Robust Stable Spiking Neural Networks
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Proposes membrane potential perturbation dynamics and a dynamic LIF (DLIF) neuron with an MS-MPPD regularizer to make SNNs more robust to Gaussian noise and adversarial attacks on CIFAR-10/100.
Problem
Adversarial vulnerability of spiking neural networks, which lack sufficient robustness for safety-critical applications; prior defenses act mainly on discrete spike outputs rather than neuronal dynamics.
Approach
Derive a simplified membrane potential perturbation dynamics (MPPD) for LIF neurons without reset effects, prove it has finite L2 gain, and train with a mean-square MPPD penalty on the last spiking layer plus a dynamic LIF neuron with trainable per-time-step leak scaling.
Key results
- On CIFAR-10 VGG11, AT+Reg with rho=1.0 reaches 49.02% FGSM and 40.30% PGD7 accuracy vs 45.23% PGD7 for SNN-RAT.
- On CIFAR-100 VGG11, AT+Reg with rho=1.0 gives 36.83% FGSM and 24.25% PGD7 accuracy, vs 25.86% FGSM and 17.81% PGD7 for SNN-RAT (PGD7 is 24.25% per table).
- Ablation on VGG5 CIFAR-10 shows MS-MPPD with rho=1.0 outperforms TASAD and STD regularization in PGD robustness (28.33% PGD7 vs 27.80% and 26.82%).
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| Add MS-MPPD loss with ρ=1.0 during adversarial training | DLIF, VGG11 on CIFAR-10 · CIFAR-10 | PGD^10 accuracy: 29.06% to 37.55% | Helped |
| Add MS-MPPD loss with ρ=1.0 during adversarial training | DLIF, VGG11 on CIFAR-10 · CIFAR-10 | APGD^10 CE accuracy: 23.05% to 33.25% | Helped |
| Add MS-MPPD loss with ρ=1.0 during adversarial training | DLIF, VGG11 on CIFAR-10 · CIFAR-10 | APGD^10 DLR accuracy: 29.88% to 39.68% | Helped |
| Add MS-MPPD loss with ρ=1.0 to DLIF adversarial training (ablation) | VGG5 · CIFAR-10 | PGD^10 accuracy: 26.27 -> 27.34 | Helped |
| Increase MS-MPPD loss intensity from ρ=1.0 to ρ=2.0 (ablation) | DLIF adversarial training · CIFAR-10 | PGD^10 accuracy: 27.34 -> 26.29 | Hurt |
| Add MS-MPPD loss with ρ=1.0 to LIF adversarial training (ablation) | VGG5 · CIFAR-10 | PGD^10 accuracy: 26.38 -> 26.81 | Helped |
| Increase MS-MPPD loss intensity from ρ=1.0 to ρ=2.0 (ablation) | LIF adversarial training · CIFAR-10 | PGD^10 accuracy: 26.81 -> 21.38 | Hurt |
| Replace MS-MPPD loss with TASAD loss (ablation) | DLIF adversarial training, ρ=1.0 · CIFAR-10 | PGD^10 accuracy: 27.34 -> 26.85 | Hurt |
| Replace MS-MPPD loss with STD loss (ablation) | DLIF adversarial training, ρ=1.0 · CIFAR-10 | PGD^10 accuracy: 27.34 -> 25.75 | Hurt |
| Use DLIF instead of LIF | Naturally trained VGG11 · CIFAR-10 | PGD^7 accuracy: 0.03 -> 0.09 | Helped |
| Use DLIF instead of LIF | Naturally trained VGG11 · CIFAR-100 | PGD^7 accuracy: 0.06 -> 0.08 | Mixed |
| Add MS-MPPD loss with ρ=1.0 during Gaussian-noise training | DLIF, VGG11 · CIFAR-10 | PGD^7 accuracy: 0.18 -> 0.23 | Helped |
Surprising findings
- Natural-trained LIF and DLIF SNNs collapse almost completely under PGD and APGD attacks (near 0%), despite high clean accuracy.
- Gaussian-noise training gives only marginal robustness gains over natural training against strong PGD attacks.
Limitations
- The stability bound gamma is stated to be not tight.
- Evaluation limited to CIFAR-10/100 image classification with VGG and WRN architectures.
- Gains over SNN-RAT in the main comparison rely on combining with the RAT regularizer; the MS-MPPD term alone is less clearly superior.
Experimental setup
Datasets: CIFAR-10 CIFAR-100
Benchmarks: CIFAR-10 CIFAR-100
Metrics: clean accuracy robust accuracy under FGSM PGD APGD
Baselines: SNN-BP HIRE-SNN SNN-RAT LIF
Builds on: STBP PLIF SNN-RAT RFGSM mixup
Closest papers by meaning
- Enhancing Adversarial Robustness in SNNs with Sparse Gradients (ICML 2024 · similarity 0.91)
- FEEL-SNN: Robust Spiking Neural Networks with Frequency Encoding and Evolutionary Leak Factor (NeurIPS 2024 · similarity 0.91)
- Rethinking the Membrane Dynamics and Optimization Objectives of Spiking Neural Networks (NeurIPS 2024 · similarity 0.90)
- Enhancing the Robustness of Spiking Neural Networks with Stochastic Gating Mechanisms (AAAI 2024 · similarity 0.89)
- Rethinking Spiking Neural Networks from an Ensemble Learning Perspective (ICLR 2025 · similarity 0.88)
- Synergy Between the Strong and the Weak: Spiking Neural Networks are Inherently Self-Distillers (NeurIPS 2025 · similarity 0.88)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.