Abstract
Spiking Neural Networks (SNNs) utilize spike-based activations to mimic the brain's energy-efficient information processing. However, the binary and discontinuous nature of spike activations causes vanishing gradients, making adversarial robustness evaluation via gradient descent unreliable. While improved surrogate gradient methods have been proposed, their effectiveness under strong adversarial attacks remains unclear. We propose a more reliable framework for evaluating SNN adversarial robustness. We theoretically analyze the degree of gradient vanishing in surrogate gradients and introduce the Adaptive Sharpness Surrogate Gradient (ASSG), which adaptively evolves the shape of the surrogate function according to the input distribution during attack iterations, thereby enhancing gradient accuracy while mitigating gradient vanishing. In addition, we design an adversarial attack with adaptive step size under the $L_\infty$ constraint-Stable Adaptive Projected Gradient Descent (SA-PGD), achieving faster and more stable convergence under imprecise gradients. Extensive experiments show that our approach substantially increases attack success rates across diverse adversarial training schemes, SNN architectures and neuron models, providing a more generalized and reliable evaluation of SNN adversarial robustness. The experimental results further reveal that the robustness of current SNNs has been significantly overestimated and highlighting the need for more dependable adversarial training methods.
Abstract (translated)
脉冲神经网络（SNN）利用基于脉冲的激活来模仿大脑的能量高效信息处理方式。然而，脉冲激活的二进制和不连续特性导致梯度消失现象，使得通过梯度下降方法评估其对抗鲁棒性变得不可靠。尽管已经提出了改进的替代梯度方法，但在强对抗攻击下的有效性仍然不清楚。我们提出了一种更可靠的框架来评估SNN的对抗鲁棒性。理论上分析了替代梯度中的梯度消失程度，并引入自适应尖锐度替代梯度（ASSG），该方法根据输入分布动态调整替代函数形状，在攻击迭代过程中增强梯度精度同时减轻梯度消失问题。 此外，我们设计了一种具有自适应步长的$ L_\infty $约束下的对抗攻击——稳定自适应投影梯度下降法（SA-PGD），在不准确的梯度下实现了更快更稳定的收敛。大量实验表明，我们的方法显著提高了各种对抗训练方案、SNN架构和神经元模型中的攻击成功率，提供了对SNN对抗鲁棒性更为通用且可靠的评估方式。实验结果进一步揭示了当前SNN的稳健性被严重高估，并强调需要更加可靠地进行对抗训练的方法。
URL
https://arxiv.org/abs/2512.22522
