spike-ptsd-adversarial

name	spike-ptsd-adversarial
category	ai_collection
description	Adversarial robustness analysis for Spiking Neural Networks. Spike-Triggered Decoupled (SpikT) attack methodology exploiting temporal vulnerability and STDP-induced sensitivity. Covers vulnerability analysis, attack implementation, and defense strategies.
trigger	adversarial attack, spiking, snn, neuromorphic, robustness, vulnerability, spike-triggered, decoupled, perturbation, defense

Spike-Triggered Adversarial Robustness for Spiking Neural Networks

Based on arXiv:2604.12103v1 [cs.LG] 14 Apr 2026 — "Adversarial Attacks on Spiking Neural Networks via a Spike-Triggered Decoupled Approach"

Core Problem

Spiking Neural Networks (SNNs) exhibit unique adversarial vulnerabilities distinct from traditional ANNs due to their temporal dynamics, binary spike communication, and membrane potential accumulation mechanisms. This skill provides a comprehensive framework for analyzing and defending against adversarial attacks on SNNs.

Key Findings

Spike-Triggered Decoupled (SpikT) Attack

• Spike-triggered vulnerability: SNNs are most vulnerable when perturbations are aligned with spike timing events rather than static activations
• Decoupled gradient: Separate gradient computation for spatial (which neuron) and temporal (when to spike) perturbations
• Temporal sensitivity: SNNs exhibit 10-50× higher sensitivity to temporally-coordinated perturbations vs. spatial-only attacks

Vulnerability Mechanisms

1. Membrane potential manipulation: Small perturbations push neurons across firing threshold
2. STDP-induced sensitivity: Synaptic plasticity rules amplify adversarial effects over time
3. Temporal accumulation errors: Leaky integrate-and-fire dynamics accumulate perturbation effects across time steps
4. Synchronization disruption: Attacks targeting spike timing can disrupt population coding

Attack Methodology

# SpikT attack framework (conceptual)
def spikT_attack(snn_model, input_spikes, epsilon, alpha, T):
    """
    Spike-Triggered Decoupled attack
    
    Args:
        snn_model: Target SNN (LIF neurons with STDP)
        input_spikes: Input spike train [T, batch, channels]
        epsilon: Maximum perturbation budget
        alpha: Step size for iterative attack
        T: Number of time steps
    
    Returns:
        adversarial_spikes: Perturbed spike train
    """
    # 1. Identify spike-triggered vulnerable time steps
    spike_times = detect_spike_events(snn_model, input_spikes)
    
    # 2. Decoupled gradient computation
    spatial_grad = compute_spatial_gradient(snn_model, input_spikes)
    temporal_grad = compute_temporal_gradient(snn_model, spike_times)
    
    # 3. Apply decoupled perturbation
    perturbation = decouple_and_apply(spatial_grad, temporal_grad, epsilon, alpha)
    
    return clip_perturbation(input_spikes + perturbation, epsilon)

Defense Strategies

1. Neural noise injection: Add controlled membrane potential noise (σ=0.1-0.3) to disrupt precise adversarial timing
2. Temporal filtering: Apply sliding-window smoothing to spike trains, filtering high-frequency adversarial patterns
3. Adversarial training with SpikT: Train with decoupled adversarial examples for robustness
4. Ensemble diversity: Combine SNNs with different time constants (τ_mem) to reduce transferability
5. Input quantization: Quantize inputs to reduce perturbation precision without degrading clean accuracy

Evaluation Metrics

Metric	Description	Typical Values
ASR (Attack Success Rate)	% of successful adversarial classifications	70-95% (undefended)
Transferability	Attack success across different SNN architectures	40-65%
Temporal Robustness	Resistance to spike-timing attacks	Varies by τ_mem
Clean Accuracy Drop	Accuracy degradation from defense mechanisms	<5% (well-tuned)

Application Scenarios

• Neuromorphic security: Securing edge neuromorphic deployments (Loihi, SpiNNaker)
• BCI robustness: Protecting brain-computer interfaces from adversarial signal injection
• Autonomous systems: Ensuring SNN-based perception systems resist adversarial sensor manipulation
• Research benchmark: Standardized adversarial robustness evaluation for SNN architectures

Implementation Notes

• SpikT attacks work best on directly-trained SNNs (ANN-SNN conversion is less vulnerable)
• Time step count (T) significantly affects vulnerability: fewer steps = more vulnerable
• STDP-enabled networks show amplified vulnerability compared to fixed-weight SNNs
• Defense via noise injection is most effective when σ matches expected input noise distribution