Inherent Adversarial Robustness of Deep Spiking Neural Networks: Effects of Discrete Input Encoding and Non-Linear Activations

Sharmin, Saima; Rathi, Nitin; Panda, Priyadarshini; Roy, Kaushik

doi:10.48550/arxiv.2003.10399

Cited by 6 publications

(8 citation statements)

References 22 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…After that, we deconvolve the accumulated gradients with weights of the first layer. These deconvolved gradients have a similar value with original gradients of images before the Poisson spike generator, which has been validated in the previous work [45]. Thus, we can get a gradient δx converted into spatial domain, and the input noise is updated with gradient δx scaled by ζ. Algorithm 4 illustrates the overall optimization process.…”

Section: Attack Scenarios For Class Leakagesupporting

confidence: 70%

PrivateSNN: Privacy-Preserving Spiking Neural Networks

Kim¹,

Venkatesha²,

Panda³

2021

Preprint

Self Cite

View full text Add to dashboard Cite

How can we bring both privacy and energy-efficiency to a neural system on edge devices? In this paper, we propose PrivateSNN, which aims to build low-power Spiking Neural Networks (SNNs) from a pre-trained ANN model without leaking sensitive information contained in a dataset. Here, we tackle two types of leakage problems: 1) Data leakage caused when the networks access real training data during an ANN-SNN conversion process. 2) Class leakage is the concept of leakage caused when class-related features can be reconstructed from network parameters. In order to address the data leakage issue, we generate synthetic images from the pre-trained ANNs and convert ANNs to SNNs using generated images. However, converted SNNs are still vulnerable with respect to the class leakage since the weight parameters have the same (or scaled) value with respect to ANN parameters. Therefore, we encrypt SNN weights by training SNNs with a temporal spike-based learning rule. Updating weight parameters with temporal data makes networks difficult to be interpreted in the spatial domain. We observe that the encrypted PrivateSNN can be implemented not only without the huge performance drop (less than ∼5%) but also with significant energy-efficiency gain (about ×60 compared to the standard ANN). We conduct extensive experiments on various datasets including CIFAR10, CIFAR100, and TinyImageNet, highlighting the importance of privacy-preserving SNN training.

show abstract

Section: Attack Scenarios For Class Leakagesupporting

confidence: 70%

PrivateSNN: Privacy-Preserving Spiking Neural Networks

Kim¹,

Venkatesha²,

Panda³

2021

Preprint

Self Cite

View full text Add to dashboard Cite

show abstract

“…iii) BNTT achieves significantly higher performance than the other methods across all noise intensities. This is because using BNTT decreases the overall number of time-steps which is a crucial contributing factor towards robustness (Sharmin et al 2020). These results imply that, in addition to low-latency and energy-efficiency, our BNTT method also offers improved robustness for suitably implementing SNNs in a real-world scenario.…”

Section: Analysis On Robustnessmentioning

confidence: 82%

Revisiting Batch Normalization for Training Low-latency Deep Spiking Neural Networks from Scratch

Kim¹,

Panda²

2020

Preprint

Self Cite

View full text Add to dashboard Cite

Spiking Neural Networks (SNNs) have recently emerged as an alternative to deep learning owing to sparse, asynchronous and binary event (or spike) driven processing, that can yield huge energy efficiency benefits on neuromorphic hardware. Most existing approaches to create SNNs either convert the weights from pre-trained Artificial Neural Networks (ANNs) or directly train SNNs with surrogate gradient backpropagation. Each approach presents its pros and cons. The ANN-to-SNN conversion method requires at least hundreds of time-steps for inference to yield competitive accuracy that in turn reduces the energy savings. Training SNNs with surrogate gradients from scratch reduces the latency or total number of time-steps, but the training becomes slow/problematic and has convergence issues. Thus, the latter approach of training SNNs has been limited to shallow networks on simple datasets. To address this training issue in SNNs, we revisit batch normalization and propose a temporal Batch Normalization Through Time (BNTT) technique. Most prior SNN works till now have disregarded batch normalization deeming it ineffective for training temporal SNNs. Different from previous works, our proposed BNTT decouples the parameters in a BNTT layer along the time axis to capture the temporal dynamics of spikes. The temporally evolving learnable parameters in BNTT allow a neuron to control its spike rate through different time-steps, enabling low-latency and low-energy training from scratch. We conduct experiments on CIFAR-10, CIFAR-100, Tiny-ImageNet and event-driven DVS-CIFAR10 datasets. BNTT allows us to train deep SNN architectures from scratch, for the first time, on complex datasets with just few 25-30 time-steps. We also propose an early exit algorithm using the distribution of parameters in BNTT to reduce the latency at inference, that further improves the energy-efficiency. Code will be made available.

show abstract

“…We also analyze the effect of varying factors such as a leak rate and related hyperparameters on SAM and overall prediction. Finally, we provide a visual understanding of previously observed results [43] that SNNs are more robust to adversarial attacks [15]. We measure the difference of heat maps between clean samples and adversarial samples using SAM to highlight the robustness of SNNs with respect to ANNs.…”

Section: Introductionmentioning

confidence: 90%

“…Previous studies [43,42] have shown that SNNs are more robust to adversarial inputs than ANNs. In order to observe the effectiveness of SNNs under attack, we conduct a qualitative and quantitative comparison between Grad-CAM and SAM.…”

Section: Adversarial Robustness Of Snnmentioning

confidence: 99%

See 1 more Smart Citation

Visual Explanations from Spiking Neural Networks using Interspike Intervals

Kim,

Panda

2021

Preprint

Self Cite

View full text Add to dashboard Cite

Spiking Neural Networks (SNNs) compute and communicate with asynchronous binary temporal events that can lead to significant energy savings with neuromorphic hardware. Recent algorithmic efforts on training SNNs have shown competitive performance on a variety of classification tasks. However, a visualization tool for analysing and explaining the internal spike behavior of such temporal deep SNNs has not been explored. In this paper, we propose a new concept of bio-plausible visualization for SNNs, called Spike Activation Map (SAM). The proposed SAM circumvents the non-differentiable characteristic of spiking neurons by eliminating the need for calculating gradients to obtain visual explanations. Instead, SAM calculates a temporal visualization map by forward propagating input spikes over different time-steps. SAM yields an attention map corresponding to each time-step of input data by highlighting neurons with short inter-spike interval activity. Interestingly, without both the backpropagation process and the class label, SAM highlights the discriminative region of the image while capturing fine-grained details. With SAM, for the first time, we provide a comprehensive analysis on how internal spikes work in various SNN training configurations depending on optimization types, leak behavior, as well as when faced with adversarial examples.

show abstract

Inherent Adversarial Robustness of Deep Spiking Neural Networks: Effects of Discrete Input Encoding and Non-Linear Activations

Cited by 6 publications

References 22 publications

PrivateSNN: Privacy-Preserving Spiking Neural Networks

PrivateSNN: Privacy-Preserving Spiking Neural Networks

Revisiting Batch Normalization for Training Low-latency Deep Spiking Neural Networks from Scratch

Visual Explanations from Spiking Neural Networks using Interspike Intervals

Contact Info

Product

Resources

About