| Abstract: |
Spiking Neural Networks (SNNs) are the biologically inspired third generation of Artificial Neural Networks (ANNs), mimicking the behavior of biological neurons by transmitting information through discrete spikes over time [1]. Although SNNs are often considered more robust than conventional ANNs, recent studies have shown that they remain vulnerable to adversarial attacks that rely on small input-specific perturbations to alter predicted labels [2]. For years, ANNs were targeted by Universal Adversarial Attacks (UAAs), in which a single perturbation is applied across all inputs to induce misclassification [3]. Recently, SNNs were shown to be susceptible to Spiking Universal Adversarial Attacks (SUAAs) [4], a spiking version of UAAs. These attacks exploit event-based data, which are inherently sparse in both space and time and are typically captured using Dynamic Vision Sensors (DVS). One solution to secure ANNs against UAAs is adversarial training, i.e., training a model on adversarially perturbed examples to improve robustness against attacks such as Projected Gradient Descent (PGD) [5].
In this work, we study the effectiveness of standard universal adversarial defense strategies against SUAAs and demonstrate that adversarial training based on attacks such as PGD is effective against input-specific adversarial examples, but fails to improve robustness against spike-based attacks, particularly universal ones. To address this limitation, we propose, to the best of our knowledge, the first universal adversarial training framework specifically designed for SNNs to enhance robustness against SUAAs. We evaluate our approach on SNNs composed of Leaky Integrate-and-Fire (LIF) neurons using neuromorphic datasets, including N-MNIST and IBM DVS-Gesture. Experimental results show that SNNs trained with spiking universal adversarial training achieve significantly improved robustness against SUAAs and per-input spike-based adversarial attacks. In particular, on N-MNIST, spiking universal adversarial training improves test accuracy under SUAA attack from 63.54% to 93.08% for a noise budget ε = 3 × 10−4, and from 19.43% to 92.20% for ε = 4 × 10−4, and on DVS-Gesture under a SUAA attack with ε = 8 × 10−4, the accuracy increases from 50.83% to 70.83%.ACKNOWLEDGEMENTS Work supported by IRCICA (Univ. Lille, CNRS, USR 3380 – IRCICA, F-59000 Lille, France), Luxant Innovation, and the European Metropolis of Lille MEL under the Luxant-ANVI industrial chair.REFERENCES [1] H. Paugam-Moisy and S. Bohte, “Computing with spiking neuron networks,” in Handbook of natural computing. Springer, 2012, pp. 335–376. [2] I. J. Goodfellow, J. Shlens, and C. Szegedy, “Explaining and harnessing adversarial examples,” arXiv preprint arXiv:1412.6572, 2014. [3] S.-M. Moosavi-Dezfooli, A. Fawzi, O. Fawzi, and P. Frossard, “Universal adversarial perturbations,” in Proceedings of the IEEE conference on computer vision and pattern recognition, 2017, pp. 1765–1773. [4] S. Raptis and H.-G. Stratigopoulos, “Input-Specific and Universal Adversarial Attack Generation for Spiking Neural Networks in the Spiking Domain,” in International Joint Conference on Neural Networks (IJCNN), Rome, Italy, Jun. 2025. hal- 05054528. [5] A. Shafahi, M. Najibi, Z. Xu, J. Dickerson, L. S. Davis, and T. Goldstein, “Universal adversarial training,” in Proceedings of the AAAI Conference on Artificial Intelligence, vol. 34, no. 04, 2020, pp. 5636–5643. |