{"id":"5c5bd90b-4f2c-473f-a8b2-0aef7fb9a72d","arxiv_id":"2508.11279","paper_version":1,"verdict":"UNVERDICTED","confidence":"LOW","novelty_score":6.0,"correctness_risk":"unknown","formal_verification":"none","parameter_count":2,"one_line_summary":"RTE is a unified training objective that boosts adversarial robustness of SNNs by hardening each temporal sub-network and reducing cross-time attack transferability.","lead":"This paper proposes a new training method called Robust Temporal self-Ensemble (RTE) that strengthens each time-step of a spiking neural network and stops attacks from jumping between time-steps. The method claims to give spiking networks better accuracy and resistance to adversarial attacks at the same time, which matters for low-power AI deployed in security-sensitive settings.","discovery_kind":"new_method","skeptic_critique":{"model":"deepseek-v4-flash","headline":"Main risk: RTE's gains may arise from unequal evaluation protocols—especially inference-time temporal ensembling or timestep/attack budgets—rather than from the proposed training loss; the corrupted full text prevents auditing the experiments.","rationale":"The reader identified the same load-bearing assumption: the reported comparisons must use a fair and consistent evaluation protocol. I agree that this is the key condition for the central claim. My stress-test sharpens the concern by pointing specifically at inference-time temporal ensembling, since RTE is explicitly a temporal ensemble method and its advantage could be attributed to ensembling rather than to the proposed training objective. The full text is corrupted, so I cannot verify whether the experimental section controls for this. Because the paper is unverifiable from the provided input, the reader's UNVERDICTED verdict is appropriate. I do not see an internal inconsistency in the abstract itself: the proposed loss terms (per-sub-network robustness and cross-time adversarial transfer reduction) are coherent with the stated goal. The risk is empirical and evaluative, not mathematical. A concrete replication with matched timesteps, attacks, and inference modes would settle whether the claimed consistent superiority is real. No ad hominem is intended; this is the standard check for any empirical robustness paper.","tokens_in":11785,"tokens_out":3148,"duration_ms":36534,"concrete_test":"Obtain the released code or full paper and reproduce the main comparison table under three controlled conditions: (1) identical architecture and timestep count T for all methods; (2) identical attack protocol—e.g., PGD-20 or AutoAttack with the same epsilon, iterations, and restarts; (3) two inference modes for every method: last-timestep output and T-timestep temporal averaging. If RTE's advantage over the strongest baseline collapses or falls below noise when all methods use the same T and temporal averaging, then the headline claim is an ensemble artifact. Also record training epochs, batch sizes, and wall-clock/FLOPs to ensure the stochastic-sampling schedule does not confer a hidden compute advantage.","verdict_should_be":"UNCHANGED","load_bearing_attack":"The central claim is empirical: RTE consistently improves the robust-accuracy trade-off for SNNs. For that claim to hold, RTE must be compared against baselines under identical attack types, perturbation budgets, SNN architectures, number of timesteps, and inference-time ensembling. The abstract describes RTE as training per-timestep sub-networks and using stochastic sampling; at inference, if RTE averages outputs over all timesteps while baselines are evaluated at a single timestep or fewer timesteps, the reported improvement could be an ensemble effect rather than evidence that RTE's loss reshapes temporal robustness. Similarly, the stochastic sampling strategy may effectively increase training epochs or augmentations; if baselines are not given equivalent compute, the trade-off comparison is unfair. The provided full text is corrupted, so no experimental table, attack configuration, or ablation is legible; the existence of matched comparisons is therefore the least secure premise. This is not an accusation of unfair practice, but a minimal condition for the empirical claim to be meaningful.","agreement_with_reader":"agree"},"referee_report":{"model":"deepseek-v4-flash","summary":"The manuscript proposes Robust Temporal self-Ensemble (RTE), a training framework for spiking neural networks that treats the network across timesteps as an ensemble of temporal sub-networks. It claims to improve the robustness of each sub-network while reducing the temporal transferability of adversarial perturbations, integrating these objectives into a unified loss with a stochastic sampling strategy. The central claim is empirical: RTE is said to consistently outperform existing training methods in the robustness-accuracy trade-off across multiple benchmarks, with additional analyses of the internal robustness landscape. However, the provided full text is heavily corrupted and largely unreadable, and the abstract reports no quantitative results, attack model, or comparison protocol. As presented, the empirical claim cannot be verified.","tokens_in":12048,"tokens_out":5101,"duration_ms":64784,"significance":"If the central claim holds, the paper would offer a useful and conceptually interesting perspective on SNN robustness: explicitly treating temporal unfoldings as sub-network ensembles and targeting both per-timestep fragility and cross-timestep adversarial transfer. This is a plausible direction for robust spiking models and could be relevant to the cs.LG community. The proposed framework also makes falsifiable predictions about improved robustness-accuracy trade-offs, and the temporal-diversity analysis is potentially valuable. However, no experimental evidence is legible in the supplied manuscript, and the abstract is qualitative only. The significance of the contribution therefore cannot currently be assessed beyond the conceptual level.","major_comments":[{"comment":"The central claim—\"RTE consistently outperforms existing training methods in robust-accuracy trade-off\"—is empirical, but the abstract contains no quantitative results: no robust or natural accuracy values, no perturbation budgets, no benchmark names, and no baseline comparisons. At the current level of presentation, the claim is unsupported. Headline numbers and the evaluation protocol should be stated in the abstract.","section":"Abstract"},{"comment":"The supplied full text is almost entirely unreadable because of character corruption; the experimental paragraphs and every table are garbled. I cannot verify attack types, epsilon budgets, architectures, numbers of timesteps, error bars, or baseline settings. This is not a presentation issue: the paper's only supporting evidence is empirical. A clean, machine-readable PDF with legible tables, including error bars and complete baseline configurations, is required before the claim can be assessed.","section":"Full text / Table 1"},{"comment":"The visible method description does not specify whether inference-time temporal ensembling is used and whether all baselines are evaluated under exactly the same temporal protocol. Since RTE is explicitly a temporal self-ensemble, unequal timestep or ensemble counts alone could account for reported trade-off improvements. The stress-test concern about matched evaluation therefore remains unresolved. The paper must explicitly report training/inference timesteps, attack budgets, number of attack steps, and compute budget for each baseline.","section":"Section 3 (RTE training and inference)"},{"comment":"The balance weight for the per-step robustness loss and the stochastic sampling rate are free parameters, and no legible ablation or sensitivity analysis appears in the available text. Without such analysis, the \"consistently outperforms\" claim could depend on favorable hyperparameter choices. The authors should report a sensitivity sweep or provide fixed values with clear justification.","section":"Hyperparameters"}],"minor_comments":[{"comment":"The entire text needs to be regenerated in a clean format; equations, table headers, and references are currently unreadable due to encoding corruption.","section":"Full text"},{"comment":"Replace qualitative statements such as \"consistently outperforms\" with specific numbers, e.g., robust accuracy at a given epsilon on each benchmark.","section":"Abstract"},{"comment":"Table labels and column headers are illegible in the supplied version; ensure dataset names, architectures, and evaluation metrics are clearly typeset.","section":"Tables"}],"recommendation":"uncertain","confidential_remarks":"My uncertainty is caused by the corruption of the supplied full text, not by the substance of the method. The empirical claims may be perfectly sound, but I cannot audit them from this version. I recommend requesting a clean PDF from the authors and re-reviewing; the current manuscript should not be accepted or rejected on the basis of unreadable data."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"I could only read the abstract here; the rest of the file is corrupted, so this letter is about the idea and the claims as stated, not the evidence behind them.\n\nWhat is actually new: framing an SNN as a set of temporal sub-networks and explicitly reducing cross-time adversarial transferability. Temporal ensembling itself is not new, but making per-subnetwork robustness and temporal transferability two explicit loss terms is a reasonable and distinct angle. The stochastic sampling strategy for efficiency is a sensible practical detail. That is a genuine contribution, and it is not obviously circular or fitting to a known dataset.\n\nWhat the paper does well, as far as I can tell from the abstract: it identifies a specific failure mode (vulnerabilities transferring across timesteps) that is easy to overlook, and it proposes a training objective that targets that failure mode directly. The claim that it \"reshapes the internal robustness landscape\" is vague, but the direction is reasonable.\n\nSoft spots: the central claim is an empirical one — consistent improvement in robust-accuracy trade-off across benchmarks — and I can see no numbers, no attack model, no budgets, no baselines, no ablations. The stress-test concern about evaluation protocol is the right thing for a referee to check first: if RTE averages over timesteps at inference while baselines are evaluated at a single timestep, or if the attack budgets differ, the improvement could be an ensembling artifact. This is not an accusation; it is a minimal condition for the claim to mean anything. The abstract also does not say how many timesteps are used in training versus inference, which matters for this method’s cost.\n\nOn the citation pattern and formal content: there is nothing to audit. No code or data is mentioned in what I can see, and the paper is not formally verified. That is normal for an empirical methods paper, but it means the burden sits entirely on the experimental section, which I cannot inspect.\n\nWho is this for: researchers working on adversarial robustness of SNNs, and practitioners who want a concrete training recipe. If the full paper has matched comparisons with equal compute, attack budgets, and timestep counts, it is a solid contribution. If not, the main claim falls apart.\n\nRecommendation: send it to peer review. The idea is worth referee time, and a desk reject would be premature. But the reviewers should insist on seeing the evaluation protocol in detail, especially the timestep handling and attack settings. I would not cite it until I can verify the numbers.","headline":"A plausible SNN robustness training recipe that deserves a serious look, but the corrupted full text means the empirical core is unverified.","tokens_in":12493,"tokens_out":1220,"would_cite":false,"duration_ms":16483,"reading_group":"maybe","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"This paper proposes Robust Temporal self-Ensemble (RTE), a training method claiming that treating the timesteps of a spiking neural network as an ensemble—hardening each timestep and reducing cross-timestep transferability—yields a better r","keywords":["spiking neural networks","adversarial robustness","temporal ensembling","robust-accuracy trade-off","training framework","temporal transferability","stochastic sampling","SNN robustness"],"falsifier":"Run RTE and a standard adversarial-training baseline on the same SNN architecture and perturbation budget, then attack both with a white-box adversary that optimizes over the full temporal graph at once. If RTE's robust accuracy does not beat the baseline under that attack, the claimed reduction in temporal transferability—and with it the central mechanism—is not doing the work.","tokens_in":11713,"feed_emoji":"⚡","tokens_out":4458,"duration_ms":48644,"temperature":0.7,"pith_summary":"The paper introduces Robust Temporal self-Ensemble (RTE), a training framework for spiking neural networks that treats each timestep of the network as part of an ensemble rather than as a single computation. RTE claims that standard SNN adversarial training fails for two reasons: individual timestep sub-networks are fragile, and adversarial perturbations crafted against one timestep transfer to the others. RTE trains each sub-network to be robust and explicitly penalizes cross-timestep transferability in a unified loss, optimized with stochastic timestep sampling. The claim is that this shifts the robustness-accuracy trade-off outward: higher robust accuracy under adversarial attacks at matching or better natural accuracy, on multiple benchmarks, with temporally diversified decision boundaries.","feed_headline":"Treating SNN timesteps as a defense ensemble improves both accuracies","feed_subtitle":"A new training loss hardens every spike-timing step and stops adversarial perturbations from hopping across time.","key_machinery":"Robust Temporal self-Ensemble (RTE) is a training objective with two terms: a per-timestep robustness term that adversarially hardens each sub-network, and a temporal-diversity term that discourages adversarial perturbations from transferring across timesteps. A stochastic sampling strategy selects timesteps during optimization to keep training tractable.","core_discovery":"The central claim is that the temporal dimension of an SNN is not merely a cost to be paid for spike-based computation—it is an ensemble structure that can be used for defense. The paper's diagnosis is that the vulnerabilities of an SNN at different timesteps are correlated, so an adversary who finds one fragile timestep can exploit the whole network; RTE's losses attack this directly by making every timestep individually hard to fool and by reducing the overlap of adversarial directions across timesteps. On the evidence reported, this yields a consistently better robust-accuracy trade-off than existing SNN adversarial training methods, and it reshapes decision boundaries to be more temporal","pith_inferences":["Editorial inference: if temporal ensembling is the active ingredient, RTE should collapse to standard adversarial training at a single timestep and show growing gains as the number of timesteps increases; a trend study over timestep count would isolate the mechanism.","Editorial inference: the same per-step-hardening plus cross-step decorrelation recipe could transfer to other temporally unrolled models, such as recurrent networks or diffusion models that iterate over refinement steps.","Editorial inference: stochastic timestep sampling at inference time, not just at training time, may offer a cheap additional robustness boost by making the effective ensemble even larger."],"forward_implications":["If RTE is correct, existing SNN architectures can be made more robust simply by changing the training loss; no architectural change or extra inference cost is required.","Adversaries trying to fool an RTE-trained SNN must find perturbations that fool multiple timesteps simultaneously, which is strictly harder than fooling a single aggregated decision.","The robustness-accuracy trade-off for SNNs is not fixed: temporal structure is a resource that can be spent to gain robustness.","The paper's temporal-transferability analysis offers a diagnostic: attack success across timesteps should decrease under RTE, and this decrease should predict robust accuracy gains."],"supporting_citations":[],"fun_headline_variants":["SNN timesteps as ensemble: better robust accuracy","Hardening each spike step boosts SNN robust-accuracy","RTE: robust temporal self-ensemble for SNNs","Reduce cross-time adversarial transfer in SNNs","Make every SNN timestep robust to boost overall"],"cache_read_input_tokens":2816,"weakest_assumption_plain":"The central claim assumes that RTE is compared with baseline methods under the same attack types, perturbation budgets, architectures, and training budgets; if those are not aligned, the reported gains could come from evaluation settings rather than from RTE itself.","fun_headline_variants_meta":{"raw":{"variants":["SNN timesteps as ensemble: better robust accuracy","Hardening each spike step boosts SNN robust-accuracy","RTE: robust temporal self-ensemble for SNNs","Reduce cross-time adversarial transfer in SNNs","Make every SNN timestep robust to boost overall"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.000185,"raw_usage":{"total_tokens":1152,"prompt_tokens":732,"completion_tokens":420,"prompt_tokens_details":{"cached_tokens":256},"prompt_cache_hit_tokens":256,"prompt_cache_miss_tokens":476,"completion_tokens_details":{"reasoning_tokens":342}},"tokens_in":476,"tokens_out":420,"duration_ms":5428,"temperature":1.0,"reasoning_tokens":342,"cache_read_input_tokens":256,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-05T20:00:35.524087+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Run RTE and a standard adversarial-training baseline on the same SNN architecture and perturbation budget, then attack both with a white-box adversary that optimizes over the full temporal graph at once. If RTE's robust accuracy does not beat the baseline under that attack, the claimed reduction in temporal transferability—and with it the central mechanism—is not doing the work.","supporting_citations":[],"review_version":1}