Controllable Stochastic Quantization Encoding for Adversarially Robust Spiking Neural Networks

Yujia Liu; Peiyu Liu; Yajing Zheng; Tiejun Huang

cs.NEOct 1, 2026

Controllable Stochastic Quantization Encoding for Adversarially Robust Spiking Neural Networks

Authors: Yujia Liu, Peiyu Liu, Yajing Zheng, Tiejun Huang

Organizations: NERCVT, School of Computer Science, Peking University, China · State Key Laboratory for Multimedia Information Processing, School of Computer Science, Peking University, China · Institute for Artificial Intelligence, Peking University, China

Abstract

Spiking Neural Networks (SNNs) have attracted increasing attention due to their impressive temporal dynamics, energy efficiency, and brain-inspired mechanisms. Although SNNs have demonstrated promising performance in image classification tasks, recent studies have shown that they remain vulnerable to adversarial attacks, where imperceptible perturbations are added to input images to mislead model predictions. Existing defense methods mainly focus on training strategies, while the role of input encoding remains less explored. An observation is that the robustness advantage of Poisson encoding over direct encoding may benefit from its inherent randomness. Motivated by this, we propose a stochastic quantization encoding method that encodes the input image with controllable randomness adjusted by the quantization scale, thereby improving the adversarial robustness of SNNs. We further show that this method constitutes a general framework that reduces to both Poisson encoding and direct encoding under different choices of the quantization scale. Since it enhances robustness at the input encoding stage, it can be combined with existing training-based defenses for further gains. Experimental results on CIFAR-10 and CIFAR-100 demonstrate the effectiveness of the proposed stochastic quantization encoding method. To sum up, this work highlights the importance of input encoding for the adversarial robustness of SNNs, providing a new perspective for understanding and improving it.

Figures & tables

Figure 1: Illustration of the proposed stochastic quantization encoding method. At each time step, the normalized pixel value $x$ is randomly encoded as the upper quantiztaion level $\lceil xN\rceil/N$ with probability $p_{0}$ , or as the lower quantiztaon level $\lfloor xN\rfloor/N$ with probability $1-p_{0}$ , where $N$ is the quantization scale. At different time steps, the encoded values are independently sampled from the same distribution, and together form a quantization encoded sequence. When $N=1$ , the proposed method reduces to Poisson encoding, where each encoded value is sampled from $\{0,1\}$ . As $N$ increases, the encoded values become more stable and gradually approach direct encoding.

Architecture	Training	Encoding	Clean	RFGSM	PGD10	PGD30	PGD50	APGD10	Average
VGG-11	Vanilla	direct	90.85	0.02	0.00	0.00	0.00	0.00	0.004
	Vanilla	SQE	87.36	9.53	9.43	6.75	6.36	16.82	9.78
	AT	direct	89.81	18.07	17.18	14.46	14.06	14.60	15.67
	AT	SQE	88.51	25.20	24.94	21.05	20.80	34.37	25.27
	RAT	direct	90.44	19.56	19.05	13.84	13.15	17.31	16.58
	RAT	SQE	87.42	30.09	30.22	24.77	24.05	43.41	30.51

Table 1: Effectiveness of the proposed SQE on the CIFAR-10 dataset under different training strategies, measured by classification accuracy (%). The last column reports the average accuracy across all attacks. Better results are highlighted in gray.

Architecture	Training	Encoding	clean	RFGSM	PGD10	PGD30	PGD50	APGD10	Average
WRN-16	Vanilla	direct	73.44	0.00	0.00	0.00	0.00	0.00	0.00
	Vanilla	SQE	67.82	2.93	2.79	1.74	1.61	9.04	3.62
	AT	direct	67.99	11.22	10.92	8.92	8.30	9.25	9.72
	AT	SQE	65.59	11.97	11.82	9.60	9.18	19.63	12.44
	RAT	direct	68.16	12.04	11.62	7.74	7.10	10.80	9.86
	RAT	SQE	65.22	17.89	17.96	13.35	13.04	27.34	17.92

Table 2: Effectiveness of the proposed SQE on the CIFAR-100 dataset under different training strategies, measured by classification accuracy (%). The last column reports the average accuracy over all attacks. Better results are highlighted in gray.

Figure 2: Ablation study of the quantization scale $N$ on the CIFAR-10 dataset with the VGG-11 arhitectue.

			white-box attack			black-box attack
	encoding	clean	RFGSM	APGD10	PGD50	RFGSM	APGD10	PGD50
CIFAR-10 VGG-11	direct	90.85	0.02	0.00	0.00	8.23	18.84	7.38
	SQE	87.36	9.53	16.82	6.36	60.56	74.95	62.65
	poisson	81.67	18.07	29.11	14.66	61.97	76.15	62.89
CIFAR10 WRN-16	direct	94.05	0.00	10.00	0.00	0.05	2.48	0.03
	SQE	88.95	9.20	18.63	6.06	72.01	83.60	72.98

Table 3: Comparison of direct encoding, Poisson encoding, and the proposed SQE method. The proposed SQE method is highlighted in gray, as it provides a more balanced trade-off between clean accuracy and adversarial robustness.

Figure 3: Visualization of clean and adversarial images (generated by PGD10) after different encoding methods. For SQE and Poisson encoding, the encoded results are averaged over 8 time steps. For each encoding method, the first row shows the distribution of pixel-wise encoding randomness (Definition 1 ), with the mean randomness across all pixels indicated by the dashed line. The last row shows the difference between the encoded clean image and the encoded adversarial image.

Appendix figures & tables3 assets

Supplementary material from the paper’s appendix.

Appendix

parameters	value
learning rate	0.1
momentum	0.9
weight decay	5e-4
batch size	64
epochs	200
time step	8

Appendix

Table 4: The common parameters for all models on CIFAR-10 and CIFAR-100 datasets.

strategy	parameter	value	models
AT	attack	PGD	All
	$\epsilon$	2.0 / 255
	iteration	5
RAT	attack	PGD	All
	$\epsilon$	2.0 / 255
	iteration	5

Appendix

Table 5: Strategy-specific parameter settings for different training strategies.

Figure 4: Visualization of clean images and their corresponding adversarial images generated by PGD10 after different encoding methods. For SQE and Poisson encoding, the encoded images are obtained by averaging the encoding results over eight time steps. For each encoding method, the first row shows the distribution of pixel-wise encoding randomness (Definition 1), where the dashed line and the value in the upper-right corner indicate the mean randomness across all pixels. The last row shows the absolute difference between the encoded clean and adversarial images, illustrating the effect of adversarial perturbations after encoding. Zoom in for a better view.

Explore similar work

Quantifying How Training Gradient Sparsity Affect Spiking Neural Network Accuracy And Robustness
Sep 28, 2025Nhan Trong Luu, Duong Trung LuuSpiking Neural Networks Sparsity
College of Information and Communication Technology, Can Tho University, Vietnam · College of Engineering and Computer Science, VinUniversity, Hanoi, Vietnam · Center of Digital Transformation and Communication, Can Tho University, Vietnam
Burst Spiking Neural Networks
Jul 5, 2026Jiahong Zhang, Sijun Shen, Man Yao +5Spiking Neural Networks Neural Network
Institute of Automation, Chinese Academy of Sciences, Beijing 100045, China · School of Artificial Intelligence, University of Chinese Academy of Sciences, Beijing 100049, China · State Key Laboratory of Media Convergence and Communication, Communication University of China, Beijing 100024, China +3
Hybrid ANN-SNN Pipeline with Local Plasticity
Jun 18, 2026Denis Larionov, Khairutin Shtanchaev, Mikhail Kiselev +2Spiking Neural Networks Time-To-First-Spike
Chuvash State University, Cheboksary, Russia · LLC NForm, Moscow, Russia · Dagestan State Technical University, Makhachkala, Russia +1

Sep 28, 2025, cs.NEJ/K move · Enter open · S save

Quantifying How Training Gradient Sparsity Affect Spiking Neural Network Accuracy And Robustness

Nhan Trong Luu, Duong Trung Luu

College of Information and Communication Technology, Can Tho University, Vietnam · College of Engineering and Computer Science, VinUniversity, Hanoi, Vietnam · Center of Digital Transformation and Communication, Can Tho University, Vietnam

Spiking Neural Networks Sparsity Neural Network

Open paper AskPDF arXiv

Spiking Neural Networks (SNNs) have recently received increasing attention in both computational neuroscience and artificial intelligence owing to their potential for energy-efficient computation and reduced memory requirements. Despite these advantages, improving adversarial robustness in SNNs (particularly for vision-based applications) remains an emerging and relatively underexplored research problem. Recent work has suggested that encouraging sparse gradients can act as a regularization mechanism to improve resistance against adversarial perturbations. In this study, we report an unexpected observation: under certain architectural configurations, SNNs inherently exhibit sparse gradients and can attain state-of-the-art adversarial defense performance without requiring any explicit regularization strategy. Further investigation reveals an inherent trade-off between robustness and generalization. Specifically, increased gradient sparsity enhances resistance to adversarial attacks but may reduce the model's generalization capability, whereas denser gradients tend to improve generalization while simultaneously increasing susceptibility to adversarial perturbations. These findings provide new perspectives on the role of gradient sparsity in the training dynamics of SNNs.

Abstract

Explore similar work

Quantifying How Training Gradient Sparsity Affect Spiking Neural Network Accuracy And Robustness

Burst Spiking Neural Networks

Hybrid ANN-SNN Pipeline with Local Plasticity