Abstract:Spiking neural network (SNN) is broadly deployed in neuromorphic devices to emulate brain function. In this context, SNN security becomes important while lacking in-depth investigation. To this end, we target the adversarial attack against SNNs and identify several challenges distinct from the artificial neural network (ANN) attack: 1) current adversarial attack is mainly based on gradient information that presents in a spatiotemporal pattern in SNNs, hard to obtain with conventional backpropagation algorithms; 2) the continuous gradient of the input is incompatible with the binary spiking input during gradient accumulation, hindering the generation of spike-based adversarial examples; and 3) the input gradient can be all-zeros (i.e., vanishing) sometimes due to the zero-dominant derivative of the firing function. Recently, backpropagation through time (BPTT)-inspired learning algorithms are widely introduced into SNNs to improve the performance, which brings the possibility to attack the models accurately given spatiotemporal gradient maps. We propose two approaches to address the above challenges of gradient-input incompatibility and gradient vanishing. Specifically, we design a gradient-to-spike (G2S) converter to convert continuous gradients to ternary ones compatible with spike inputs. Then, we design a restricted spike flipper (RSF) to construct ternary gradients that can randomly flip the spike inputs with a controllable turnover rate, when meeting all-zero gradients. Putting these methods together, we build an adversarial attack methodology for SNNs. Moreover, we analyze the influence of the training loss function and the firing threshold of the penultimate layer on the attack effectiveness. Extensive experiments are conducted to validate our solution. Besides the quantitative analysis of the influence factors, we also compare SNNs and ANNs against adversarial attacks under different attack methods. This work can help reveal what happens in SNN attacks and might stimulate more research on the security of SNN models and neuromorphic devices.

The Remarkable Robustness of Surrogate Gradient Learning for Instilling Complex Function in Spiking Neural Networks

Surrogate Gradient Learning in Spiking Neural Networks: Bringing the Power of Gradient-Based Optimization to Spiking Neural Networks

Elucidating the theoretical underpinnings of surrogate gradient learning in spiking neural networks

Learnable Surrogate Gradient for Direct Training Spiking Neural Networks

Adaptive Smoothing Gradient Learning for Spiking Neural Networks.

Toward Efficient Processing and Learning with Spikes: New Approaches for Multispike Learning

Robust Transcoding Sensory Information with Neural Spikes

Adaptive Multi-Level Firing for Direct Training Deep Spiking Neural Networks

SuperSpike: Supervised learning in multi-layer spiking neural networks

The brain as an efficient and robust adaptive learner

SuperSpike: Supervised Learning in Multilayer Spiking Neural Networks

Exploiting Noise As a Resource for Computation and Learning in Spiking Neural Networks

Improving Surrogate Gradient Learning in Spiking Neural Networks via Regularization and Normalization

Differentiable Spike: Rethinking Gradient-Descent for Training Spiking Neural Networks.

Learning flow functions of spiking systems

Uncovering the Representation of Spiking Neural Networks Trained with Surrogate Gradient

Stabilizing Spiking Neuron Training

KLIF: An Optimized Spiking Neuron Unit for Tuning Surrogate Gradient Function

Directly Training Temporal Spiking Neural Network with Sparse Surrogate Gradient

Exploring Adversarial Attack in Spiking Neural Networks with Spike-Compatible Gradient.

Emergent Bio-Functional Similarities in a Cortical-Spike-Train-Decoding Spiking Neural Network Facilitate Predictions of Neural Computation