Toward Reliable Evaluation of Adversarial Robustness of Spiking Neural Networks

The researchers propose a more reliable framework for evaluating the adversarial robustness of spiking neural networks (SNNs). To address the problem that the binary and discontinuous nature of spike activations causes vanishing gradients, making gradient-descent-based robustness evaluation unreliable, the paper theoretically analyzes the degree of vanishing gradients of surrogate gradients and proposes an adaptive sharpness surrogate gradient, ASSG, which adaptively adjusts the shape of the surrogate function according to the input distribution during attack iterations; it also designs an attack with adaptive step size under the L∞ constraint, SA-PGD, achieving faster and more stable convergence under inexact gradients. Extensive experiments show that the method significantly improves attack success rates across various adversarial training schemes, SNN architectures and neuron models; the experimental results also indicate that the robustness of current SNNs is significantly overestimated, highlighting the need to develop more reliable adversarial training methods. The code is open-sourced on GitHub: https://github.com/craree/ASSG-SNNs-Robustness-Evaluation