{"id":"1e6e6b86-86cd-4563-b02d-798a8130741e","arxiv_id":"2505.15833","paper_version":1,"verdict":"CONDITIONAL","confidence":"MODERATE","novelty_score":6.0,"correctness_risk":"medium","formal_verification":"none","parameter_count":5,"one_line_summary":"A conversion pipeline turns robustly trained, pruned artificial networks into sparse spiking networks that keep adversarial robustness and cut stored weights by up to 100x.","lead":"This paper describes a conversion pipeline that turns adversarially trained, pruned artificial neural networks into sparse spiking neural networks, preserving robustness while cutting stored weights by up to 100x. It offers a route toward adversarial robustness in memory-limited, energy-constrained edge devices.","discovery_kind":"new_method","skeptic_critique":{"model":"deepseek-v4-flash","headline":"Robustness numbers rest on a hand-picked surrogate-gradient ensemble, not a proven worst-case attack; the paper's own Table A1 shows sensitivity to surrogate choice, so a stronger adaptive attack could shrink or invert the headline gap.","rationale":"The reader's weakest assumption identifies the same load-bearing concern: the ensemble surrogate-gradient attack is treated as a worst-case evaluation, but no proof or exhaustive search establishes that. I agree with this assessment. The concern is load-bearing because the paper's headline superiority claim is an empirical statement about robustness numbers; every reported accuracy in Tables 1, 2, B1, B2, and Figure 2 depends on the quality of the adversary. If a stronger adaptive attack substantially lowers the reported robustness, the gap over end-to-end AT could vanish, and the 'state-of-the-art robustness' claim would not be warranted. The paper does provide meaningful evidence in the right direction: Table A1 decomposes the ensemble, Table B3 shows monotonic decrease with more PGD iterations, RGA attacks are included, and Square Attack provides a query-based check. These are real and should be credited. However, they do not close the gap between 'a strong, diversified heuristic attack' and 'a worst-case adversary.' The sensitivity visible in Table A1 — individual surrogates leaving 50–89% robust accuracy while the ensemble reaches 41.1% — is precisely the pattern one would expect before a stronger surrogate is found. I therefore keep the reader's CONDITIONAL verdict: the central claim is plausible and the evaluation is better than typical, but it should be accepted only after the proposed adaptive-attack test is run. If the robustness numbers survive that test, the concern is resolved; if not, the verdict should move toward REJECT.","tokens_in":20976,"tokens_out":15877,"duration_ms":163764,"concrete_test":"Using the public repository, run an adaptive attack on the 90%-sparse VGG-16 SNN from Table 1 with (a) surrogate-gradient families not in the ensemble (e.g., fast sigmoid and piecewise-linear with gamma_w swept continuously over [0.05, 10], including per-layer gamma_w), (b) 10 random restarts and 100 PGD/APGD steps per restart, and (c) adversarial examples generated against the source sparse robust ANN and transferred to the SNN. If the best robust accuracy under APGD-CE at epsilon=8/255 falls below the 8.8% end-to-end baseline, the evaluation is not worst-case and the claimed superiority over end-to-end AT is unsupported.","verdict_should_be":"UNCHANGED","load_bearing_attack":"The central numerical claim — that conversion-based sparse SNNs are more robust than end-to-end AT of sparse SNNs (21.1% vs 8.8%/7.1% under APGD-CE at epsilon=8/255) — is only as strong as the attack used to measure it. That attack is a hand-picked ensemble of surrogate gradients (Appendix A.3), and the paper provides no argument that this ensemble is a worst-case proxy. Its own Table A1 shows how sensitive the numbers are: for the same 90%-sparse VGG-16 SNN, individual surrogate components leave between roughly 50% and 89% robust accuracy under FGSM, while the ensemble strengthens the attack to 41.1%. Nothing rules out a surrogate outside this list (e.g., per-layer or per-timestep surrogate parameters, fast-sigmoid surrogates, or attacks on the rate-coded ReLU approximation) being substantially stronger. The iteration-count check in Table B3 goes only to 40 steps without random restarts, and the black-box Square Attack is capped at 5000 queries. Hence the reported 12–14 point gap over the end-to-end baselines could shrink or invert under a stronger adaptive attack.","agreement_with_reader":"agree"},"referee_report":{"model":"deepseek-v4-flash","summary":"The paper proposes an ANN-to-SNN conversion pipeline for sparse, adversarially robust SNNs. A dense ANN is adversarially pretrained with TRADES, pruned with HYDRA/HARP learned-importance masks, converted to an SNN by threshold balancing with trainable thresholds, and then sparsely finetuned with a TRADES-style KL robustness objective while preserving the mask. The paper reports results on CIFAR-10/100 and TinyImageNet, with up to 100x weight compression and an estimated 8.6x energy-efficiency gain, and claims superiority over end-to-end adversarial training of sparse SNNs as well as state-of-the-art robustness against rigorous adversaries.","tokens_in":21244,"tokens_out":4881,"duration_ms":51472,"significance":"If the results hold, this is the first practical recipe for sparse adversarially robust feedforward SNNs, and it scales to TinyImageNet, a regime where BPTT-based robust training is computationally impractical. The robustness evaluation is more careful than is typical for SNN papers: it uses an ensemble of surrogate gradients, black-box Square Attack, RGA attacks, and iteration scaling, and the reported gain over end-to-end sparse AT at 90-99% sparsity is large. The authors provide public code and a precise algorithm, which supports reproducibility. The main risks are that the headline robustness numbers rest on a hand-picked ensemble of surrogate attacks rather than a demonstrated worst-case adversary, and that the key quantitative comparisons come from single runs without error bars.","major_comments":[{"comment":"The central robustness claims depend on the assumption that the surrogate-gradient ensemble in Appendix A.3 is a reliable worst-case proxy for SNN adversarial robustness, but the paper provides no argument that this is so. Table A1 shows that the same model's FGSM robust accuracy varies from roughly 50% to 89% across individual surrogate components and is 41.1% only for the ensemble, which demonstrates exactly how sensitive the measured robustness is to surrogate choice. In addition, the iteration-scaling check in Table B3 stops at 40 steps without random restarts, and the Square Attack is capped at 5000 queries. To make the headline comparison (Table 1: 21.1% vs 8.8% and 7.1% under APGD-CE at epsilon=8/255) load-bearing, please report adaptive attacks beyond the fixed ensemble, such as fast-sigmoid surrogates, per-layer or per-timestep surrogate parameters, attacks through the rate-coded ReLU approximation, and PGD with multiple random restarts. If the gap persists under a substantially wider set of adaptive attacks, the claim will be much stronger; if it shrinks, the conclusions should be revised.","section":"Section 4.2, Appendix A.3, Table A1"},{"comment":"All reported accuracies are single runs without confidence intervals or multiple seeds. This matters because the end-to-end sparse AT baselines are themselves described as unstable and hyperparameter-sensitive (Section 5.1), and the headline 12-14 point robustness gap is exactly the kind of quantity that can shift with run-to-run variance. Please provide at least 3-5 independent seeds for the key comparisons (Table 1, Figure 1, and Table B4), reporting means and standard deviations, or otherwise justify that the observed differences exceed the expected variance of the training and evaluation procedure.","section":"Section 5.1, Table 1, Figure 1"},{"comment":"The statement that the approach 'achieves state-of-the-art robustness against rigorous adversaries' is not directly supported by the experiments. The only comparison for this claim is against two end-to-end sparse AT baselines; the paper does not compare against dense robust SNN conversion (including the authors' own prior work [11]) or against other published robust SNN methods. Please add such comparisons where possible, or restrict the claim to the sparse setting and state explicitly that the comparison is limited to the baselines considered.","section":"Section 6"}],"minor_comments":[{"comment":"The table layout makes it difficult to tell which attack rows refer to the ANN and which to the SNN; clearer subheadings or separate panels for the sparse robust ANN, the end-to-end sparse SNN baselines, and the converted sparse SNN would improve readability.","section":"Table 1"},{"comment":"The description of threshold initialization says the threshold is set to 'the maximum value in the rho = 99.7% percentile of the distribution.' Please clarify whether this means the 99.7th percentile value itself or the maximum of the top 0.3% of observed pre-activations.","section":"Appendix A.2"},{"comment":"The energy model counts only accumulate operations and assumes a single energy cost EAC per operation. Please state more explicitly that memory access, data movement, and the overhead of sparse indexing are not included, since the reported 8.6x gain is an estimate under this restricted model.","section":"Section 4.3, Eq. (12)"},{"comment":"The notation alternates between 'Sparse FT', 'conversion + sparse FT', and 'conversion + sparse finetuning' in Section 5 and the captions; please standardize the terminology.","section":"Throughout"}],"recommendation":"major_revision","confidential_remarks":"The paper makes a plausible and potentially useful contribution, but the headline robustness comparison currently rests on an attack ensemble that the paper itself shows to be sensitive to surrogate choice, and all key numbers come from single runs. I would send a revised version back to the same referees with the adaptive-attack experiment specifically in view. The novelty relative to the authors' prior dense robust conversion work [11] is largely the combination with HYDRA/HARP and the sparse finetuning stage; a comparison with dense robust SNNs at matched accuracy would help calibrate the contribution."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"The thing to know: this paper gives a practical recipe for sparse, adversarially robust SNNs — robustly pretrain a dense ANN, prune it with HYDRA/HARP, convert to an SNN, then sparsely finetune — and shows a large, consistent edge over end-to-end adversarial training of sparse SNNs. The empirical gap (21.1% vs 8.8%/7.1% under APGD-CE ensemble at ε=8/255) is big enough that I doubt it is pure artifact, even if the exact numbers shift under stronger attacks.\n\nWhat is actually new: the combination of robust ANN pretraining, robustness-aware pruning, ANN-to-SNN conversion, and sparse post-conversion finetuning. That specific pipeline has not been tested before, and the paper scales it to TinyImageNet, which most SNN robustness work avoids. The robustness evaluation is also more careful than the SNN norm: an ensemble of surrogate gradients, iteration-count sanity checks, RGA attacks, and Square Attack. That is real credit.\n\nWhere the soft spots are, in proportion: The robustness numbers rest on a hand-picked surrogate-gradient ensemble, not a proven worst-case attack. Table A1 shows how sensitive results are to surrogate choice — individual components leave 50–89% robust accuracy under FGSM, while the ensemble drops it to 41.1%. A stronger adaptive attack outside that ensemble could shrink the headline gap. That is a valid concern, but not a fatal one: the gap is large, and the paper already includes more attack diversity than most SNN papers. More minor: all results are single runs without error bars; the end-to-end sparse AT baseline is admitted to be hard to tune, so the comparison is somewhat favorable to the proposed method; the energy-efficiency estimate is an idealized analytical calculation, not a hardware measurement; and the code link lacks a commit hash. The paper is honest about several of these limitations, which counts in its favor.\n\nThe central argument — that sparse robust SNNs are better obtained by converting robust pruned ANNs than by end-to-end BPTT — holds up. This is a solid engineering contribution, not a paradigm shift. It deserves a serious referee, and the review should push for multiple seeds, a heavier adaptive-attack analysis, and a pinned code release. I would bring it to a reading group and would cite it in my own work on SNN robustness.","headline":"A practical and carefully evaluated recipe for sparse robust SNNs via robust ANN pretraining + pruning + conversion, with a large but attack-dependent edge over end-to-end sparse AT.","tokens_in":21784,"tokens_out":1745,"would_cite":true,"duration_ms":19187,"reading_group":"yes","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"A conversion algorithm transfers robust, pruned ANN weights into sparse spiking neural networks, yielding state-of-the-art adversarial robustness at high compression that end-to-end spiking training cannot reach.","keywords":["spiking neural networks","adversarial robustness","ANN-to-SNN conversion","sparse connectivity","robust pruning","adversarial training","energy-efficient inference","backpropagation through time"],"falsifier":"Run an adaptive white-box attack on the 90%-sparse converted VGG-16 SNN at epsilon=8/255 that optimizes the surrogate gradient family (e.g., by learning the surrogate shape per layer or by using membrane-potential-based gradients) and compare its robust accuracy with the reported 21.1% APGD-CE; a substantial drop would falsify the robustness claim.","tokens_in":1685,"feed_emoji":"⚡","tokens_out":1975,"duration_ms":62726,"temperature":0.7,"pith_summary":"This paper tries to show that sparse, energy-efficient spiking neural networks can be made adversarially robust by converting an already-robust, already-pruned artificial neural network instead of adversarially training the spiking network from scratch. The authors claim that this conversion path beats end-to-end adversarial training of equally sparse spiking networks, both in final robustness and in training time, and that it preserves robustness at compression rates where naive pruning collapses. On CIFAR-10, for instance, a 90%-sparse converted VGG-16 spiking network reaches 21.1% robust accuracy against a strong white-box ensemble attack, while two end-to-end training baselines reach under 9%. The payoff is practical: if the claim holds, robust models for resource-constrained hardware can be obtained by recycling robust ANN training and pruning, with up to 100x fewer stored weights and an estimated 8.6x energy saving relative to dense spiking networks.","feed_headline":"Pruned ANN weights make sparse spiking networks robust","feed_subtitle":"Conversion beats end-to-end training: 21% robust accuracy at 90% sparsity, with 8.6x energy savings.","key_machinery":"The load-bearing machinery is a hybrid ANN-to-SNN conversion pipeline in which the sparse connectivity pattern and weights come entirely from an adversarially trained and robustly pruned ANN. Threshold balancing initializes per-layer firing thresholds by taking a high percentile of observed pre-activations over a longer calibration run and scaling them down; after conversion, the sparsity mask is frozen, and BPTT finetuning under a TRADES-style KL robustness objective updates weights, batch-norm parameters, and firing thresholds while sparse updates are projected through the mask. The ensemble surrogate-gradient attack (multiple piecewise-linear, exponential, and rectangular surrogates plus straight-through and conversion approximations) is what the paper uses to claim that the resulting robustness holds against rigorous, adaptive adversaries.","core_discovery":"The central discovery the paper advances is that adversarial robustness, network sparsity, and spiking conversion compose without the usual trade-off. Starting from an ANN adversarially pretrained with TRADES and then pruned with robustness-aware importance scores (HYDRA for uniform per-layer sparsity or HARP for non-uniform per-layer sparsity), the authors transfer the sparse weights into a spiking network, calibrate firing thresholds by percentile-based threshold balancing, and then adversarially finetune only the surviving connections while keeping the sparsity mask frozen. They report that this yields sparse SNNs that surpass end-to-end adversarially trained sparse SNNs by a wide margin, and that robustness degrades gracefully with sparsity when the pruning itself is robustness-aware: with non-uniform learned pruning, a 99%-sparse VGG-16 on CIFAR-10 keeps 85.2% clean accuracy and 22.9% robust accuracy under a 10-step PGD ensemble at epsilon=8/255, whereas LWM pruning at the same sparsity retains only 44.9% clean and 9.2% robust. The paper interprets this as evidence that the ANN domain, not the SNN training dynamics, is where robust sparse structure should be obtained.","pith_inferences":["An implication the authors leave implicit is that robust sparse SNN research becomes largely downstream of ANN research: any improvement in robust training or robust pruning for ANNs should transfer through this conversion, shrinking the expensive BPTT adversarial-training part to a finetuning step.","The most consequential unknown is the evaluation's worst-case assumption; a natural extension would be an adaptive attack that optimizes the surrogate gradient shape and attack parameters directly against the converted network, which could either confirm or lower the reported numbers.","Because non-uniform per-layer pruning preserves robustness better than uniform pruning at 99% sparsity, a hardware-oriented extension would test structured masks; the relative gain over uniform masks suggests structured masks may retain the same benefit if the per-layer quotas are learned."],"forward_implications":["On CIFAR-10, a 90%-sparse converted VGG-16 SNN reaches 21.1% robust accuracy under an APGD-CE ensemble at epsilon=8/255, versus 8.8% and 7.1% for two end-to-end sparse adversarial-training baselines.","At 99% sparsity with non-uniform pruning, the converted SNN retains 85.2% clean and 22.9% robust accuracy under a PGD ensemble, while a least-weight-magnitude-pruned network collapses to 44.9% clean and 9.2% robust.","Conversion keeps the sparse mask frozen during finetuning, so the final SNN stores up to 100x fewer weights and is estimated 8.6x more energy-efficient than a dense robust SNN.","The approach scales to TinyImageNet with VGG-11, where 90%-sparse SNNs retain 53.7% clean and 23.0% robust accuracy under a PGD ensemble at epsilon=2/255.","Because the first stage works in the ANN domain, the method inherits any future robust-training or robust-pruning advances for ANNs without redoing expensive spiking backpropagation."],"supporting_citations":[{"why":"Supplies the dense robust ANN-to-SNN conversion pipeline and the surrogate-gradient ensemble attack evaluation that this paper extends to sparse networks.","marker":"[11]"},{"why":"HYDRA robust pruning with learned importance scores supplies the layerwise uniform sparsity masks.","marker":"[5]"},{"why":"HARP robust pruning supplies the layerwise non-uniform sparsity masks.","marker":"[6]"},{"why":"TRADES supplies the robust pretraining objective and the KL-regularized robust loss used in SNN finetuning.","marker":"[26]"},{"why":"RFGSM supplies the inner-maximization attack used during SNN finetuning.","marker":"[41]"},{"why":"Auto-PGD supplies the APGD-CE and APGD-DLR ensemble attacks used for robustness evaluation.","marker":"[44]"},{"why":"Supplies the iterative-attack sanity-check methodology used to rule out gradient obfuscation in the robustness evaluation.","marker":"[43]"},{"why":"Diet-SNN supplies threshold balancing and hybrid conversion finetuning used for initialization.","marker":"[23]"}],"fun_headline_variants":["Sparse SNNs from pruned ANNs: 100x fewer weights, 8.6x energy","Robustness-aware pruning then SNN conversion beats dense","Convert robust ANN to sparse SNN: 22.9% robust at 99% sparsity","Prune ANN with robustness, convert to SNN: 8.6x energy, 100x memory"],"cache_read_input_tokens":23936,"weakest_assumption_plain":"The paper's robustness numbers assume the ensemble of surrogate-gradient attacks used in evaluation captures the worst case, so a stronger adaptive attack not covered by that ensemble could reduce the reported robustness.","fun_headline_variants_meta":{"raw":{"variants":["Sparse SNNs from pruned ANNs: 100x fewer weights, 8.6x energy","Robustness-aware pruning then SNN conversion beats dense","Convert robust ANN to sparse SNN: 22.9% robust at 99% sparsity","Prune ANN with robustness, convert to SNN: 8.6x energy, 100x memory"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.000277,"raw_usage":{"total_tokens":1662,"prompt_tokens":970,"completion_tokens":692,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":586,"completion_tokens_details":{"reasoning_tokens":594}},"tokens_in":586,"tokens_out":692,"duration_ms":6399,"temperature":1.0,"reasoning_tokens":594,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-15T21:00:09.537406+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Run an adaptive white-box attack on the 90%-sparse converted VGG-16 SNN at epsilon=8/255 that optimizes the surrogate gradient family (e.g., by learning the surrogate shape per layer or by using membrane-potential-based gradients) and compare its robust accuracy with the reported 21.1% APGD-CE; a substantial drop would falsify the robustness claim.","supporting_citations":[{"cited_title":"Transactions on Machine Learning Research, 2024","cited_arxiv_id":null,"evidence_quote":"Supplies the dense robust ANN-to-SNN conversion pipeline and the surrogate-gradient ensemble attack evaluation that this paper extends to sparse networks."},{"cited_title":"Hydra: Pruning adversarially robust neural networks.Advances in Neural Information Processing Systems, 33, 2020","cited_arxiv_id":null,"evidence_quote":"HYDRA robust pruning with learned importance scores supplies the layerwise uniform sparsity masks."},{"cited_title":"Holistic adversarially robust pruning","cited_arxiv_id":null,"evidence_quote":"HARP robust pruning supplies the layerwise non-uniform sparsity masks."},{"cited_title":"Theoreticallyprincipledtrade-offbetweenrobustnessandaccuracy","cited_arxiv_id":null,"evidence_quote":"TRADES supplies the robust pretraining objective and the KL-regularized robust loss used in SNN finetuning."},{"cited_title":"Diet-snn: A low-latency spiking neural network with direct input encoding and leakage and threshold optimization.IEEE Transactions on Neural Networks and Learning Systems, 2021","cited_arxiv_id":null,"evidence_quote":"Diet-SNN supplies threshold balancing and hybrid conversion finetuning used for initialization."}],"review_version":1}