A Comprehensive Analysis on Adversarial Robustness of Spiking Neural Networks

Sharmin, Saima; Panda, Priyadarshini; Sarwar, Syed Shakib; Lee, Chankyu; Ponghiran, Wachirawit; Roy, Kaushik

doi:10.48550/arxiv.1905.02704

Cited by 4 publications

(8 citation statements)

References 0 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…We identify that converted SNNs fail to demonstrate more robustness than ANNs. Although authors in [24] show similar analysis, we explain with experiments the reason behind this discrepancy and, thereby, establish the necessary criteria for an SNN to become adversarially robust. Moreover, we propose an SNN-crafted attack generation technique, with the help of the surrogate gradient method.…”

Section: Introductionmentioning

confidence: 57%

Inherent Adversarial Robustness of Deep Spiking Neural Networks: Effects of Discrete Input Encoding and Non-Linear Activations

Sharmin¹,

Rathi²,

Panda³

et al. 2020

Preprint

Self Cite

View full text Add to dashboard Cite

In the recent quest for trustworthy neural networks, we present Spiking Neural Network (SNN) as a potential candidate for inherent robustness against adversarial attacks. In this work, we demonstrate that accuracy degradation is less severe in SNNs than in their non-spiking counterparts for CIFAR10 and CIFAR100 datasets on deep VGG architectures. We attribute this robustness to two fundamental characteristics of SNNs and analyze their effects. First, we exhibit that input discretization introduced by the Poisson encoder improves adversarial robustness with reduced number of timesteps. Second, we quantify the amount of adversarial accuracy with increased leak rate in Leaky-Integrate-Fire (LIF) neurons. Our results suggest that SNNs trained with LIF neurons and smaller number of timesteps are more robust than the ones with IF (Integrate-Fire) neurons and larger number of timesteps. We overcome the bottleneck of creating gradient-based adversarial inputs in temporal domain by proposing a technique for crafting attacks from SNN.

show abstract

Section: Introductionmentioning

confidence: 57%

Inherent Adversarial Robustness of Deep Spiking Neural Networks: Effects of Discrete Input Encoding and Non-Linear Activations

Sharmin¹,

Rathi²,

Panda³

et al. 2020

Preprint

Self Cite

View full text Add to dashboard Cite

show abstract

“…As discussed in Section III-B, our attack is quite different from previous work using trial-and-error input perturbation [26], [27] or SNN/ANN model conversion [28]. Beyond the methodology difference, here we coarsely discuss the attack effectiveness.…”

Section: E Effectiveness Comparison With Existing Snn Attackmentioning

confidence: 99%

“…SNN/ANN Model Conversion. S. Sharmin et al [28] convert the SNN attack problem to an ANN one. They first build an ANN substitute model that has the same network structure and parameters copied from the trained SNN model.…”

Section: B Comparison With Prior Work On Snn Attackmentioning

confidence: 99%

“…In contrast, we demonstrate the effective adversarial attack on much larger datasets including MNIST, CIFAR10, N-MNIST, and CIFAR10-DVS. For the SNN/ANN model conversion method [28], the authors show results on MNIST dataset. Whereas, the highest untargeted and targeted attack success rates are only about 75% and 65% (inferred from the figure in [28]), respectively.…”

Section: E Effectiveness Comparison With Existing Snn Attackmentioning

confidence: 99%

“…In fact, there are several prior studies on SNN attack using trial-and-error input perturbation or transferring the techniques proposed for ANN attack. Specifically, the input can be perturbed in a trial-and-error manner by simply monitoring the output change without calculating the gradient [26], [27]; the adversarial examples generated by the substitute ANN counterpart can be inherited to attack the SNN model [28]. However, they just circumvent rather than directly solve the SNN attack problem, which leads to some drawbacks that will eventually lower down the attack effectiveness.…”

Section: Introductionmentioning

confidence: 99%

See 2 more Smart Citations

Exploring Adversarial Attack in Spiking Neural Networks with Spike-Compatible Gradient

Liang

Deng

et al. 2020

Preprint

View full text Add to dashboard Cite

Spiking neural network (SNN) is broadly deployed in neuromorphic devices to emulate the brain function. In this context, SNN security becomes important while lacking in-depth investigation, unlike the hot wave in deep learning. To this end, we target the adversarial attack against SNNs and identify several challenges distinct from the ANN attack: i) current adversarial attack is based on gradient information that presents in a spatio-temporal pattern in SNNs, hard to obtain with conventional learning algorithms; ii) the continuous gradient of the input is incompatible with the binary spiking input during gradient accumulation, hindering the generation of spike-based adversarial examples; iii) the input gradient can be all-zeros (i.e. vanishing) sometimes due to the zero-dominant derivative of the firing function, prone to interrupt the example update.Recently, backpropagation through time (BPTT)-inspired learning algorithms are widely introduced into SNNs to improve the performance, which brings the possibility to attack the models accurately given spatio-temporal gradient maps. We propose two approaches to address the above challenges of gradient-input incompatibility and gradient vanishing. Specifically, we design a gradient-to-spike (G2S) converter to convert continuous gradients to ternary ones compatible with spike inputs. Then, we design a gradient trigger (GT) to construct ternary gradients that can randomly flip the spike inputs with a controllable turnover rate, when meeting all-zero gradients. Putting these methods together, we build an adversarial attack methodology for SNNs trained by supervised algorithms. Moreover, we analyze the influence of the training loss function and the firing threshold of the penultimate layer, which indicates a "trap" region under the cross-entropy loss that can be escaped by threshold tuning. Extensive experiments are conducted to validate the effectiveness of our solution, showing 99%+ attack success rate on most benchmarks, which is the best result in SNN attack. Besides the quantitative analysis of the influence factors, we evidence that SNNs are more robust against adversarial attack than ANNs. This work can help reveal what happens in SNN attack and might stimulate more research on the security of SNN models and neuromorphic devices.

show abstract

Improved robustness of reinforcement learning policies upon conversion to spiking neuronal network platforms applied to Atari Breakout game

et al. 2019

View full text Add to dashboard Cite

A Comprehensive Analysis on Adversarial Robustness of Spiking Neural Networks

Cited by 4 publications

References 0 publications

Inherent Adversarial Robustness of Deep Spiking Neural Networks: Effects of Discrete Input Encoding and Non-Linear Activations

Inherent Adversarial Robustness of Deep Spiking Neural Networks: Effects of Discrete Input Encoding and Non-Linear Activations

Exploring Adversarial Attack in Spiking Neural Networks with Spike-Compatible Gradient

Improved robustness of reinforcement learning policies upon conversion to spiking neuronal network platforms applied to Atari Breakout game

Contact Info

Product

Resources

About