[Paper Review] Adversarially Robust Spiking Neural Networks Through Conversion

Ozan Özdenizci, Robert Legenstein|arXiv (Cornell University)|Nov 15, 2023

Advanced Memory and Neural Computing4 citations

TL;DR

This paper proposes a novel adversarially robust SNN conversion method that transfers robustness from a pre-trained robust ANN to an SNN via post-conversion adversarial finetuning of both synaptic weights and layer-wise firing thresholds. The approach achieves state-of-the-art robustness with low-latency, outperforming end-to-end SNN training by up to 2× in robust accuracy while preserving batch-normalization dynamics during conversion.

ABSTRACT

Spiking neural networks (SNNs) provide an energy-efficient alternative to a variety of artificial neural network (ANN) based AI applications. As the progress in neuromorphic computing with SNNs expands their use in applications, the problem of adversarial robustness of SNNs becomes more pronounced. To the contrary of the widely explored end-to-end adversarial training based solutions, we address the limited progress in scalable robust SNN training methods by proposing an adversarially robust ANN-to-SNN conversion algorithm. Our method provides an efficient approach to embrace various computationally demanding robust learning objectives that have been proposed for ANNs. During a post-conversion robust finetuning phase, our method adversarially optimizes both layer-wise firing thresholds and synaptic connectivity weights of the SNN to maintain transferred robustness gains from the pre-trained ANN. We perform experimental evaluations in a novel setting proposed to rigorously assess the robustness of SNNs, where numerous adaptive adversarial attacks that account for the spike-based operation dynamics are considered. Results show that our approach yields a scalable state-of-the-art solution for adversarially robust deep SNNs with low-latency.

Motivation & Objective

• To address the lack of scalable, robust training methods for spiking neural networks (SNNs) in the face of adversarial attacks.
• To overcome the limitations of end-to-end adversarial training in SNNs, which suffer from computational infeasibility and gradient confounding due to spike-based backpropagation.
• To enable the transfer of robustness from pre-trained, adversarially trained ANNs to SNNs through a conversion-based framework.
• To integrate robust learning objectives designed for ANNs into SNNs without requiring retraining from scratch.
• To maintain the benefits of batch normalization layers during conversion, avoiding their omission in standard SNN conversion pipelines.

Proposed method

• Convert a pre-trained, robust artificial neural network (ANN) into a spiking neural network (SNN) using a hybrid conversion method that preserves network structure and weights.
• Adversarially finetune both synaptic connectivity weights and layer-wise firing thresholds in the SNN to maintain and enhance robustness transferred from the ANN.
• Incorporate batch-normalization parameters from the pre-trained ANN into the SNN using a novel temporal batch normalization (tdBN) layer that supports adversarial training.
• Construct adaptive adversaries using differentiable approximations tailored to SNN dynamics, accounting for temporal spiking behavior during evaluation.
• Use rate or direct input coding with a fixed simulation time window T to evaluate SNN performance under adversarial attacks.
• Apply PGD-based adversarial attacks with varying perturbation budgets (ε) to assess robustness across multiple settings.

Experimental results

Research questions

• RQ1 Can robustness from a pre-trained, adversarially trained ANN be effectively transferred to an SNN via conversion and finetuning?
• RQ2 Does adversarial finetuning of both weights and firing thresholds in the SNN significantly improve robustness compared to standard conversion?
• RQ3 Can batch-normalization layers be preserved and effectively utilized in the SNN conversion process without compromising robustness?
• RQ4 How does the proposed method compare to end-to-end adversarial training in SNNs in terms of robust accuracy and latency?
• RQ5 To what extent does the method improve generalization to out-of-distribution corruptions such as noise, blur, and weather effects?

Key findings

• The proposed method achieves a state-of-the-art robust accuracy of 92.14% on CIFAR-10 under PGD-20 attacks with ε=1.0, outperforming prior SOTA methods.
• With 60 epochs of adversarial finetuning, the method achieves 13.18% robust accuracy on CIFAR-10, significantly outperforming a two-epoch finetuning baseline (12.97%) and a one-epoch baseline (11.42%).
• The method improves out-of-distribution generalization, achieving 83.85% average accuracy on CIFAR-10-C and 54.06% on CIFAR-100-C, surpassing both vanilla SNNs and SNN-RAT.
• The SNN-RAT baseline shows improved noise robustness but performs worse on other corruptions; in contrast, the proposed method maintains consistent gains across all corruption types.
• The ablation study confirms that the robust finetuning phase is critical, as models without it achieve only chance-level accuracy after conversion, even with direct input coding and T=8.
• The method reduces the robustness-accuracy trade-off, maintaining high clean accuracy (92.14%) while achieving strong robustness (13.18% under PGD-20).