Exploring Adversarial Attack in Spiking Neural Networks with Spike-Compatible Gradient
arXiv:2001.01587
Abstract
Recently, backpropagation through time inspired learning algorithms are widely introduced into SNNs to improve the performance, which brings the possibility to attack the models accurately given Spatio-temporal gradient maps. We propose two approaches to address the challenges of gradient input incompatibility and gradient vanishing. Specifically, we design a gradient to spike converter to convert continuous gradients to ternary ones compatible with spike inputs. Then, we design a gradient trigger to construct ternary gradients that can randomly flip the spike inputs with a controllable turnover rate, when meeting all zero gradients. Putting these methods together, we build an adversarial attack methodology for SNNs trained by supervised algorithms. Moreover, we analyze the influence of the training loss function and the firing threshold of the penultimate layer, which indicates a "trap" region under the cross-entropy loss that can be escaped by threshold tuning. Extensive experiments are conducted to validate the effectiveness of our solution. Besides the quantitative analysis of the influence factors, we evidence that SNNs are more robust against adversarial attack than ANNs. This work can help reveal what happens in SNN attack and might stimulate more research on the security of SNN models and neuromorphic devices.
References in corpus (10)
- DeepXplore: Automated Whitebox Testing of Deep Learning Systems
- Spatio-Temporal Backpropagation for Training High-performance Spiking Neural Networks
- STDP-based spiking deep convolutional neural networks for object recognition
- Robust Physical-World Attacks on Deep Learning Models
- Surrogate Gradient Learning in Spiking Neural Networks
- Direct Training for Spiking Neural Networks: Faster, Larger, Better
- Discretization based Solutions for Secure Machine Learning against Adversarial Attacks
- Attacking Binarized Neural Networks
- Combinatorial Attacks on Binarized Neural Networks
- Exploring the Back Alleys: Analysing The Robustness of Alternative Neural Network Architectures against Adversarial Attacks