Abstract
Spiking neural networks (SNNs) compute with discrete spikes and exploit temporal structure, yet most adversarial attacks change intensities or event counts instead of timing. We study a timing-only adversary that retimes existing spikes while preserving spike counts and amplitudes in event-driven SNNs, thus remaining rate-preserving. We formalize a capacity-1 spike-retiming threat model with a unified trio of budgets: per-spike jitter $\mathcal{B}_{\infty}$, total delay $\mathcal{B}_{1}$, and tamper count $\mathcal{B}_{0}$. Feasible adversarial examples must satisfy timeline consistency and non-overlap, which makes the search space discrete and constrained. To optimize such retimings at scale, we use projected-in-the-loop (PIL) optimization: shift-probability logits yield a differentiable soft retiming for backpropagation, and a strict projection in the forward pass produces a feasible discrete schedule that satisfies capacity-1, non-overlap, and the chosen budget at every step. The objective maximizes task loss on the projected input and adds a capacity regularizer together with budget-aware penalties, which stabilizes gradients and aligns optimization with evaluation. Across event-driven benchmarks (CIFAR10-DVS, DVS-Gesture, N-MNIST) and diverse SNN architectures, we evaluate under binary and integer event grids and a range of retiming budgets, and also test models trained with timing-aware adversarial training designed to counter timing-only attacks. For example, on DVS-Gesture the attack attains high success (over $90\%$) while touching fewer than $2\%$ of spikes under $\mathcal{B}_{0}$. Taken together, our results show that spike retiming is a practical and stealthy attack surface that current defenses struggle to counter, providing a clear reference for temporal robustness in event-driven SNNs. Code is available at this https URL.
Abstract (translated)
脉冲神经网络（SNNs）利用离散的脉冲和时间结构进行计算，然而大多数对抗性攻击会改变强度或事件计数而不是时间。本文研究了一种仅基于时间调整现有脉冲而不保留其时间和幅度的时间型对手，在事件驱动的SNN中，这种对手保持了速率不变。我们形式化了一个容量为1的脉冲重定时威胁模型，并使用统一的预算组合：每个脉冲抖动$\mathcal{B}_{\infty}$、总延迟$\mathcal{B}_{1}$和篡改计数$\mathcal{B}_{0}$。可行的对抗性示例必须满足时间线一致性与非重叠条件，这使得搜索空间既离散又受约束。为优化大规模脉冲重定时，我们采用了投影内循环（PIL）优化方法：通过转移概率对数获得可微软重定时以进行反向传播，并在正向传递中使用严格的投影生成满足容量1、非重叠以及选定预算条件的可行离散时间表。目标是最大化在投影输入上的任务损失，同时添加了容量正则化器和预算感知惩罚项，这有助于稳定梯度并使优化与评估保持一致。跨事件驱动基准（CIFAR10-DVS、DVS-Gesture、N-MNIST）及多种SNN架构，在二进制和整数时间网格以及广泛的重定时预算下进行评测，并测试了针对时间型攻击训练的模型。例如，在DVS-Gesture上，该攻击在$\mathcal{B}_{0}$条件下以少于2%的脉冲接触量实现了超过90%的成功率。总体而言，我们的结果显示脉冲重定时是一种实用且隐蔽的攻击面，现有的防御手段难以应对，并为事件驱动SNN的时间鲁棒性提供了一个清晰参考。代码可在该链接处获得。
URL
https://arxiv.org/abs/2602.03284
