[Paper Review] Exploring Adversarial Attack in Spiking Neural Networks with Spike-Compatible Gradient

Ling Liang, Xing Hu+6 more|arXiv (Cornell University)|Jan 1, 2020

Advanced Memory and Neural ComputingEngineering52 references18 citations

TL;DR

This paper proposes a novel gradient-based adversarial attack framework for spiking neural networks (SNNs) by addressing two key challenges: gradient-input incompatibility and gradient vanishing. It introduces a gradient-to-spike (G2S) converter and a restricted spike flipper (RSF) to generate effective spike-based adversarial examples, achieving over 99% attack success rate on MNIST, CIFAR10, and DVS datasets, demonstrating SNNs' higher robustness than ANNs.

ABSTRACT

Recently, backpropagation through time inspired learning algorithms are widely introduced into SNNs to improve the performance, which brings the possibility to attack the models accurately given Spatio-temporal gradient maps. We propose two approaches to address the challenges of gradient input incompatibility and gradient vanishing. Specifically, we design a gradient to spike converter to convert continuous gradients to ternary ones compatible with spike inputs. Then, we design a gradient trigger to construct ternary gradients that can randomly flip the spike inputs with a controllable turnover rate, when meeting all zero gradients. Putting these methods together, we build an adversarial attack methodology for SNNs trained by supervised algorithms. Moreover, we analyze the influence of the training loss function and the firing threshold of the penultimate layer, which indicates a "trap" region under the cross-entropy loss that can be escaped by threshold tuning. Extensive experiments are conducted to validate the effectiveness of our solution. Besides the quantitative analysis of the influence factors, we evidence that SNNs are more robust against adversarial attack than ANNs. This work can help reveal what happens in SNN attack and might stimulate more research on the security of SNN models and neuromorphic devices.

Motivation & Objective

• Address the lack of systematic adversarial attack research in spiking neural networks (SNNs), despite their growing deployment in neuromorphic hardware.
• Overcome the challenge of incompatibility between continuous gradients and binary spike inputs in SNNs during adversarial example generation.
• Mitigate the gradient vanishing problem caused by the zero-dominant derivative of the spiking neuron firing function.
• Develop a white-box attack methodology applicable to both image and dynamic spike-based data using BPTT-trained SNNs.
• Investigate the influence of training loss functions and firing thresholds on attack effectiveness, identifying a 'trap' region under cross-entropy loss.

Proposed method

• Design a gradient-to-spike (G2S) converter that transforms continuous gradients into ternary values compatible with binary spike inputs using probabilistic sampling, sign extraction, and overflow-aware transformation.
• Introduce a restricted spike flipper (RSF) that generates ternary gradients to flip spike inputs when the input gradient is zero, using element selection and controlled turnover rate.
• Integrate G2S and RSF into a unified adversarial attack pipeline compatible with standard optimization-based attacks like CWL2 and BIM.
• Adapt the CWL2 attack to SNNs by incorporating the G2S and RSF modules, enabling gradient accumulation while respecting spiking input constraints.
• Use backpropagation through time (BPTT)-inspired learning to extract spatio-temporal gradients essential for accurate attack guidance.
• Tune the firing threshold of the penultimate layer to escape a 'trap' region in the loss landscape that reduces attack success under cross-entropy loss.

Experimental results

Research questions

• RQ1 How can continuous gradients from SNNs be effectively converted into spike-compatible ternary values for adversarial example generation?
• RQ2 What mechanisms can mitigate gradient vanishing in SNNs caused by the step-like firing function during adversarial training?
• RQ3 To what extent does the choice of training loss function (e.g., cross-entropy vs. MSE) affect the success rate of adversarial attacks on SNNs?
• RQ4 Can the firing threshold of the penultimate layer be tuned to escape a 'trap' region that reduces attack effectiveness?
• RQ5 How does the robustness of SNNs compare to ANNs under gradient-based adversarial attacks, particularly in dynamic spike-based datasets?

Key findings

• The proposed G2S and RSF methods achieve over 99% attack success rate on MNIST and CIFAR10 datasets, representing the highest performance reported for SNN adversarial attacks.
• On the dynamic Gesture-DVS dataset, the attack maintains high success rates with acceptable perturbation levels, demonstrating generalization beyond static image data.
• A 'trap' region exists in SNNs trained with cross-entropy loss, where attack success rates drop significantly, but this can be escaped by tuning the firing threshold of the penultimate layer.
• The attack success rate decreases when the regularization parameter $ c $ in the CWL2 attack is set too high (e.g., $ c = 0.5 $), reducing targeted attack success on MNIST by up to 32.45%.
• SNNs exhibit higher robustness against adversarial attacks compared to ANNs, as evidenced by the consistent performance of the attack framework across diverse datasets and configurations.
• The method is effective for both image-based and spike-based inputs, showing adaptability to different data formats and neuromorphic data representations.