Robust Spiking Neural Networks Against Adversarial Attacks

Shuai Wang; Malu Zhang; Yulin Jiang; Dehao Zhang; Ammar Belatreche; Yu Liang; Yimeng Shan; Zijian Zhou

cs.CVFeb 24, 2026

Robust Spiking Neural Networks Against Adversarial Attacks

Authors: Shuai Wang, Malu Zhang, Yulin Jiang, Dehao Zhang, Ammar Belatreche, Yu Liang, Yimeng Shan, Zijian Zhou,

Organizations: University of Electronic Science and Technology of China · Shenzhen Loop Area Institute · Northumbria University · The Chinese University of Hong Kong, Shenzhen

Abstract

Spiking Neural Networks (SNNs) represent a promising paradigm for energy-efficient neuromorphic computing due to their bio-plausible and spike-driven characteristics. However, the robustness of SNNs in complex adversarial environments remains significantly constrained. In this study, we theoretically demonstrate that those threshold-neighboring spiking neurons are the key factors limiting the robustness of directly trained SNNs. We find that these neurons set the upper limits for the maximum potential strength of adversarial attacks and are prone to state-flipping under minor disturbances. To address this challenge, we propose a Threshold Guarding Optimization (TGO) method, which comprises two key aspects. First, we incorporate additional constraints into the loss function to move neurons' membrane potentials away from their thresholds. It increases SNNs' gradient sparsity, thereby reducing the theoretical upper bound of adversarial attacks. Second, we introduce noisy spiking neurons to transition the neuronal firing mechanism from deterministic to probabilistic, decreasing their state-flipping probability due to minor disturbances. Extensive experiments conducted in standard adversarial scenarios prove that our method significantly enhances the robustness of directly trained SNNs. These findings pave the way for advancing more reliable and secure neuromorphic computing in real-world applications.

Figures & tables

Figure 1: Red traces represent membrane potential dynamics of spiking neurons under adversarial attack. Only membrane potentials near thresholds undergo spike pattern transitions, while others remain unchanged.

Figure 2: Mechanism and working principle of the TGO method. (a) The TGO method combines membrane potential constraints with noisy LIF neuron models for adversarial defense. (b) Gradient-based adversarial attacks illustrate how disturbances affect input images. (c) The joint optimization of the objective and constraint functions drives neuron membrane potentials away from the firing threshold. (d) The noisy LIF model effectively reduces the probability of state flips caused by small input disturbances, enhancing model stability.

Model	Train	Method	Adversarial Attacks
			Clean	FGSM	RFGSM	PGD7	PGD10	PGD20	PGD40
WRN-16	BPTT	Vanilla Deng et al. (2022)	93.32	$14.05$	$31.21$	$0.00$	$0.00$	$0.00$	$0.00$
		TGO(Ours)	$88.79$	51.40	71.38	11.67	6.14	1.52	0.45
	AT	AT Kundu et al. (2021)	91.32	$39.14$	$74.31$	$21.15$	$17.45$	$14.41$	$12.93$
		TGO(Ours)	$88.16$	63.03	79.69	42.52	35.01	24.76	20.11
	RAT	RAT Ding et al. (2022)	91.44	$42.02$	$75.89$	$23.90$	$19.81$	$16.24$	$14.18$

Table 1: Comparative robustness performance under different training strategies on CIFAR-10 using WRN-16. SOTA performances are marked in gray .

Model	Train	Method	Adversarial Attacks
			Clean	FGSM	RFGSM	PGD7	PGD10	PGD20	PGD40
VGG-11	BPTT	Vanilla Deng et al. (2022)	$71.42$	$5.92$	$24.95$	$0.18$	$0.07$	$0.04$	$0.02$
		DLIF Ding et al. (2024a)	$70.79$	$6.95$	-	$0.08$	$0.05$	$0.00$	$0.00$
		StoG Ding et al. (2024b)	$70.44$	$8.27$	-	$0.49$	-	-	-
		TGO(Ours)	$69.47$	17.20	38.23	2.30	1.33	0.69	0.42
	AT	AT Kundu et al. (2021)	$66.27$	$17.20$	$45.13$	$8.30$	$9.62$	$8.16$	7.52

Table 2: Comparative results of robustness across different methods and conditions on cifar100. SOTA performances are marked in gray .

Figure 3: Performance comparison of TGO (ours) and SR with AT across different perturbation budgets $\epsilon$ and different $\lambda_{\text{max}}$ . Experiments are conducted on CIFAR-100 dataset using WRN-16 architecture.

Figure 4: Comparison of membrane potential distributions and loss landscapes: The TGO-optimized SNN decreases membrane potentials near the threshold by approximately 40% and effectively circumvents adversarial traps during RFGSM attacks.

MTPGD Attack
Model	7	10	20	40
AT Kundu et al. (2021)	10.01	7.56	5.66	3.92
SR+AT Ding et al. (2024b)	16.88	13.67	9.52	7.33
TGO+AT(EoT)	21.23	16.35	10.58	7.40
APGD Attack
Model	7	10	20	40

Table 3: Performance on MTPGD ( Gowal et al., 2019 ) and APGD ( Croce & Hein, 2020 ) with EoT Athalye et al. (2018) on CIFAR-100 (WRN-16); APGD uses CE loss; EoT repeats

N{=}3

		BPTT				RAT
MC	NLIF	Clean	FGSM	RFGSM	PGD40	Clean	FGSM	RFGSM	PGD40
✗	✗	71.4	5.9	25.0	0.0	67.8	20.9	46.2	6.9
✓	✗	64.3 (-7.2)	17.1 (+11.2)	25.9 (+0.9)	0.5 (+0.5)	61.4 (-6.4)	26.2 (+5.3)	42.7 (-3.5)	6.2 (-0.7)
✗	✓	70.6 (-0.8)	8.1 (+2.1)	31.7 (+6.6)	0.1 (+0.1)	68.1 (+0.4)	25.2 (+4.3)	50.1 (+3.9)	9.1 (+2.2)
✓	✓	66.9 (-4.6)	21.5 (+15.5)	39.1 (+14.1)	0.5 (+0.5)	63.3 (-3.8)	33.8 (+13.0)	50.8 (+4.6)	9.3 (+2.4)

Table 4: Ablation study of our TGO method on CIFAR-100 with VGG-11.

Figure 5: Heatmaps of $\nabla_{x}f_{y}$ , where $f$ denotes a vanilla SNN or our TGO-optimized SNN.

Appendix figures & tables1 asset

Supplementary material from the paper’s appendix.

Appendix

Model	Clean	FGSM	RFGSM	PGD7	PGD10	PGD30	PGD50
AT	72.2	57.4	65.2	46.9	45.6	45.2	44.2
TGO+AT	74.1	59.7	68.0	51.0	48.1	48.8	46.2

Appendix

Table 5: Performance Comparison on DVS-CRIAF10 Dataset

Adversarial Robustness

Adversarial robustness studies how well AI systems withstand deliberately crafted inputs, training-data corruption, and other attacks.

See all 479 papers

Quantifying How Training Gradient Sparsity Affect Spiking Neural Network Accuracy And Robustness
Sep 28, 2025Nhan Trong Luu, Duong Trung LuuNeural Network Generalization Neural Network Robustness
College of Information and Communication Technology, Can Tho University, Vietnam · College of Engineering and Computer Science, VinUniversity, Hanoi, Vietnam · Center of Digital Transformation and Communication, Can Tho University, Vietnam
Controllable Stochastic Quantization Encoding for Adversarially Robust Spiking Neural Networks
Oct 1, 2026Yujia Liu, Peiyu Liu, Yajing Zheng +1Adversarial Robustness Spiking Neural Networks
NERCVT, School of Computer Science, Peking University, China · State Key Laboratory for Multimedia Information Processing, School of Computer Science, Peking University, China · Institute for Artificial Intelligence, Peking University, China
Burst Spiking Neural Networks
Jul 5, 2026Jiahong Zhang, Sijun Shen, Man Yao +5Distribution Shift Robustness Neural Network Robustness
Institute of Automation, Chinese Academy of Sciences, Beijing 100045, China · School of Artificial Intelligence, University of Chinese Academy of Sciences, Beijing 100049, China · State Key Laboratory of Media Convergence and Communication, Communication University of China, Beijing 100024, China +3

Sep 28, 2025J/K move · Enter open · S save

Quantifying How Training Gradient Sparsity Affect Spiking Neural Network Accuracy And Robustness

Nhan Trong Luu, Duong Trung Luu

College of Information and Communication Technology, Can Tho University, Vietnam · College of Engineering and Computer Science, VinUniversity, Hanoi, Vietnam · Center of Digital Transformation and Communication, Can Tho University, Vietnam

Neural Network Generalization Neural Network Robustness Adversarial Robustness Spiking Neural Networks Neural Network Training Dynamics

Open paper AskPDF arXiv

Spiking Neural Networks (SNNs) have recently received increasing attention in both computational neuroscience and artificial intelligence owing to their potential for energy-efficient computation and reduced memory requirements. Despite these advantages, improving adversarial robustness in SNNs (particularly for vision-based applications) remains an emerging and relatively underexplored research problem. Recent work has suggested that encouraging sparse gradients can act as a regularization mechanism to improve resistance against adversarial perturbations. In this study, we report an unexpected observation: under certain architectural configurations, SNNs inherently exhibit sparse gradients and can attain state-of-the-art adversarial defense performance without requiring any explicit regularization strategy. Further investigation reveals an inherent trade-off between robustness and generalization. Specifically, increased gradient sparsity enhances resistance to adversarial attacks but may reduce the model's generalization capability, whereas denser gradients tend to improve generalization while simultaneously increasing susceptibility to adversarial perturbations. These findings provide new perspectives on the role of gradient sparsity in the training dynamics of SNNs.

Abstract

Adversarial Robustness

Explore similar work

Quantifying How Training Gradient Sparsity Affect Spiking Neural Network Accuracy And Robustness

Controllable Stochastic Quantization Encoding for Adversarially Robust Spiking Neural Networks

Burst Spiking Neural Networks