Pith. sign in

REVIEW 3 major objections 4 minor 63 references

Adversarially Robust Spiking Neural Networks with Sparse Connectivity

T0 review · 3 major / 4 minor · reviewed 2026-08-15 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read A conversion algorithm transfers robust, pruned ANN weights into sparse spiking neural networks, yielding state-of-the-art adversarial robustness at high compression that end-to-end spiking training cannot reach.

desk verdict A practical and carefully evaluated recipe for sparse robust SNNs via robust ANN pretraining + pruning + conversion, with a large but attack-dependent edge over end-to-end sparse AT. read the letter →

arxiv 2505.15833 v1 pith:IMKUYUBD submitted 2025-05-16 cs.NE cs.CRcs.LG

Mathias Schmolli , Maximilian Baronig , Robert Legenstein , Ozan Özdenizci This is my paper · ORCID
classification cs.NEcs.CRcs.LG
keywords spikingneuralnetworksadversarialrobustnessANN-to-SNNconversionsparseconnectivityrobustpruningtrainingenergy-efficientinferencebackpropagationthroughtime
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

This paper tries to show that sparse, energy-efficient spiking neural networks can be made adversarially robust by converting an already-robust, already-pruned artificial neural network instead of adversarially training the spiking network from scratch. The authors claim that this conversion path beats end-to-end adversarial training of equally sparse spiking networks, both in final robustness and in training time, and that it preserves robustness at compression rates where naive pruning collapses. On CIFAR-10, for instance, a 90%-sparse converted VGG-16 spiking network reaches 21.1% robust accuracy against a strong white-box ensemble attack, while two end-to-end training baselines reach under 9%. The payoff is practical: if the claim holds, robust models for resource-constrained hardware can be obtained by recycling robust ANN training and pruning, with up to 100x fewer stored weights and an estimated 8.6x energy saving relative to dense spiking networks.

What carries the argument

The load-bearing machinery is a hybrid ANN-to-SNN conversion pipeline in which the sparse connectivity pattern and weights come entirely from an adversarially trained and robustly pruned ANN. Threshold balancing initializes per-layer firing thresholds by taking a high percentile of observed pre-activations over a longer calibration run and scaling them down; after conversion, the sparsity mask is frozen, and BPTT finetuning under a TRADES-style KL robustness objective updates weights, batch-norm parameters, and firing thresholds while sparse updates are projected through the mask. The ensemble surrogate-gradient attack (multiple piecewise-linear, exponential, and rectangular surrogates plus straight-through and conversion approximations) is what the paper uses to claim that the resulting robustness holds against rigorous, adaptive adversaries.

What would settle it

Run an adaptive white-box attack on the 90%-sparse converted VGG-16 SNN at epsilon=8/255 that optimizes the surrogate gradient family (e.g., by learning the surrogate shape per layer or by using membrane-potential-based gradients) and compare its robust accuracy with the reported 21.1% APGD-CE; a substantial drop would falsify the robustness claim.

Watch

Extended reading notes

Core claim

The central discovery the paper advances is that adversarial robustness, network sparsity, and spiking conversion compose without the usual trade-off. Starting from an ANN adversarially pretrained with TRADES and then pruned with robustness-aware importance scores (HYDRA for uniform per-layer sparsity or HARP for non-uniform per-layer sparsity), the authors transfer the sparse weights into a spiking network, calibrate firing thresholds by percentile-based threshold balancing, and then adversarially finetune only the surviving connections while keeping the sparsity mask frozen. They report that this yields sparse SNNs that surpass end-to-end adversarially trained sparse SNNs by a wide margin, and that robustness degrades gracefully with sparsity when the pruning itself is robustness-aware: with non-uniform learned pruning, a 99%-sparse VGG-16 on CIFAR-10 keeps 85.2% clean accuracy and 22.9% robust accuracy under a 10-step PGD ensemble at epsilon=8/255, whereas LWM pruning at the same sparsity retains only 44.9% clean and 9.2% robust. The paper interprets this as evidence that the ANN domain, not the SNN training dynamics, is where robust sparse structure should be obtained.

Load-bearing premise

The paper's robustness numbers assume the ensemble of surrogate-gradient attacks used in evaluation captures the worst case, so a stronger adaptive attack not covered by that ensemble could reduce the reported robustness.

Editorial extensions

If this is right

  • On CIFAR-10, a 90%-sparse converted VGG-16 SNN reaches 21.1% robust accuracy under an APGD-CE ensemble at epsilon=8/255, versus 8.8% and 7.1% for two end-to-end sparse adversarial-training baselines.
  • At 99% sparsity with non-uniform pruning, the converted SNN retains 85.2% clean and 22.9% robust accuracy under a PGD ensemble, while a least-weight-magnitude-pruned network collapses to 44.9% clean and 9.2% robust.
  • Conversion keeps the sparse mask frozen during finetuning, so the final SNN stores up to 100x fewer weights and is estimated 8.6x more energy-efficient than a dense robust SNN.
  • The approach scales to TinyImageNet with VGG-11, where 90%-sparse SNNs retain 53.7% clean and 23.0% robust accuracy under a PGD ensemble at epsilon=2/255.
  • Because the first stage works in the ANN domain, the method inherits any future robust-training or robust-pruning advances for ANNs without redoing expensive spiking backpropagation.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • An implication the authors leave implicit is that robust sparse SNN research becomes largely downstream of ANN research: any improvement in robust training or robust pruning for ANNs should transfer through this conversion, shrinking the expensive BPTT adversarial-training part to a finetuning step.
  • The most consequential unknown is the evaluation's worst-case assumption; a natural extension would be an adaptive attack that optimizes the surrogate gradient shape and attack parameters directly against the converted network, which could either confirm or lower the reported numbers.
  • Because non-uniform per-layer pruning preserves robustness better than uniform pruning at 99% sparsity, a hardware-oriented extension would test structured masks; the relative gain over uniform masks suggests structured masks may retain the same benefit if the per-layer quotas are learned.
Share X Bluesky LinkedIn Reddit HN

Signed reviews

No signed human review yet.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

3 major / 4 minor

Summary. The paper proposes an ANN-to-SNN conversion pipeline for sparse, adversarially robust SNNs. A dense ANN is adversarially pretrained with TRADES, pruned with HYDRA/HARP learned-importance masks, converted to an SNN by threshold balancing with trainable thresholds, and then sparsely finetuned with a TRADES-style KL robustness objective while preserving the mask. The paper reports results on CIFAR-10/100 and TinyImageNet, with up to 100x weight compression and an estimated 8.6x energy-efficiency gain, and claims superiority over end-to-end adversarial training of sparse SNNs as well as state-of-the-art robustness against rigorous adversaries.

Significance. If the results hold, this is the first practical recipe for sparse adversarially robust feedforward SNNs, and it scales to TinyImageNet, a regime where BPTT-based robust training is computationally impractical. The robustness evaluation is more careful than is typical for SNN papers: it uses an ensemble of surrogate gradients, black-box Square Attack, RGA attacks, and iteration scaling, and the reported gain over end-to-end sparse AT at 90-99% sparsity is large. The authors provide public code and a precise algorithm, which supports reproducibility. The main risks are that the headline robustness numbers rest on a hand-picked ensemble of surrogate attacks rather than a demonstrated worst-case adversary, and that the key quantitative comparisons come from single runs without error bars.

major comments (3)
  1. [Section 4.2, Appendix A.3, Table A1] The central robustness claims depend on the assumption that the surrogate-gradient ensemble in Appendix A.3 is a reliable worst-case proxy for SNN adversarial robustness, but the paper provides no argument that this is so. Table A1 shows that the same model's FGSM robust accuracy varies from roughly 50% to 89% across individual surrogate components and is 41.1% only for the ensemble, which demonstrates exactly how sensitive the measured robustness is to surrogate choice. In addition, the iteration-scaling check in Table B3 stops at 40 steps without random restarts, and the Square Attack is capped at 5000 queries. To make the headline comparison (Table 1: 21.1% vs 8.8% and 7.1% under APGD-CE at epsilon=8/255) load-bearing, please report adaptive attacks beyond the fixed ensemble, such as fast-sigmoid surrogates, per-layer or per-timestep surrogate parameters, attacks through the rate-coded ReLU approximation, and PGD with multiple random restarts. If the gap persists under a substantially wider set of adaptive attacks, the claim will be much stronger; if it shrinks, the conclusions should be revised.
  2. [Section 5.1, Table 1, Figure 1] All reported accuracies are single runs without confidence intervals or multiple seeds. This matters because the end-to-end sparse AT baselines are themselves described as unstable and hyperparameter-sensitive (Section 5.1), and the headline 12-14 point robustness gap is exactly the kind of quantity that can shift with run-to-run variance. Please provide at least 3-5 independent seeds for the key comparisons (Table 1, Figure 1, and Table B4), reporting means and standard deviations, or otherwise justify that the observed differences exceed the expected variance of the training and evaluation procedure.
  3. [Section 6] The statement that the approach 'achieves state-of-the-art robustness against rigorous adversaries' is not directly supported by the experiments. The only comparison for this claim is against two end-to-end sparse AT baselines; the paper does not compare against dense robust SNN conversion (including the authors' own prior work [11]) or against other published robust SNN methods. Please add such comparisons where possible, or restrict the claim to the sparse setting and state explicitly that the comparison is limited to the baselines considered.
minor comments (4)
  1. [Table 1] The table layout makes it difficult to tell which attack rows refer to the ANN and which to the SNN; clearer subheadings or separate panels for the sparse robust ANN, the end-to-end sparse SNN baselines, and the converted sparse SNN would improve readability.
  2. [Appendix A.2] The description of threshold initialization says the threshold is set to 'the maximum value in the rho = 99.7% percentile of the distribution.' Please clarify whether this means the 99.7th percentile value itself or the maximum of the top 0.3% of observed pre-activations.
  3. [Section 4.3, Eq. (12)] The energy model counts only accumulate operations and assumes a single energy cost EAC per operation. Please state more explicitly that memory access, data movement, and the overhead of sparse indexing are not included, since the reported 8.6x gain is an estimate under this restricted model.
  4. [Throughout] The notation alternates between 'Sparse FT', 'conversion + sparse FT', and 'conversion + sparse finetuning' in Section 5 and the captions; please standardize the terminology.

Circularity Check

0 steps flagged · score 2.0 of 10

No significant circularity: the central robustness-accuracy claims are empirical measurements under a defined attack protocol, and the self-citations to the authors' prior conversion work are not load-bearing.

full rationale

The paper's central claim is that conversion-based sparse SNNs outperform end-to-end adversarially trained sparse SNNs in robustness and training efficiency. This is supported by measured accuracies under a specified ensemble attack protocol, not by a quantity that is fitted to the target result. No parameter is fitted to the reported robust-accuracy numbers, and the robustness numbers are not equivalent to the method's inputs by construction. The method clearly builds on the authors' prior robust ANN-to-SNN conversion work [11], including the threshold-balancing initialization and the surrogate-gradient ensemble attack, and Appendix A.2 explicitly calls the method 'an extension of the robust ANN-to-SNN conversion method introduced for densely connected neural network models [11].' These are genuine self-citations, but they provide the conversion and evaluation infrastructure rather than the paper's novel sparse-connectivity contribution. The cited prior work is published and externally evaluated, and the present paper's new empirical results are measured rather than derived from [11]. The energy-efficiency figures follow from an explicit estimator (Eq. 12) combined with measured spike counts and known connectivity masks; they are modeling estimates, not predictions that are secretly inputs. The ensemble-attack evaluation is a strength-of-evaluation concern, not a circularity: the paper does not claim a proven worst-case adversary, and Table A1 openly documents sensitivity of the numbers to the surrogate choice. Overall, the derivation chain is self-contained for its central empirical claims, with minor but non-load-bearing self-citation, consistent with a score of 2.

Assumptions & free parameters 5 free parameters · 3 assumptions · 0 invented entities

No invented physical entities are introduced. The central claim rests on three domain assumptions about conversion, attack evaluation, and mask transfer, plus several hand-chosen hyperparameters; these are listed above.

free parameters (5)
  • beta (robust finetuning trade-off) = 2
    Controls the weight of the KL robustness regularizer in Eq. (8); set by hand for all experiments and affects the clean/robust accuracy balance.
  • lambda (firing threshold scaling factor) = 0.3
    Scales initial per-layer firing thresholds during conversion to encourage spike flow; chosen by hand and may need retuning per model.
  • rho (threshold calibration percentile) = 99.7%
    Sets initial firing thresholds from the pre-activation distribution; chosen by hand following prior work.
  • T (simulation timesteps) = 8
    SNN inference latency; a central energy-accuracy trade-off number chosen by hand.
  • lambda_TRADES (ANN pretraining regularizer) = 2
    Strength of the TRADES robustness term in ANN pretraining; varies to 6 in ablations, so it is a manually selected hyperparameter affecting transferred robustness.
assumptions (3)
  • domain assumption ANN ReLU activations can be approximated by IF/LIF neuron firing rates after threshold balancing and finetuning.
    The conversion pipeline relies on this approximation for sparse networks; used in Section 3.2 and Algorithm 1.
  • domain assumption The ensemble of surrogate gradients is a sufficient proxy for worst-case adversarial robustness of SNNs.
    All robustness claims are measured under this ensemble; the paper provides an iteration sanity check but no formal guarantee (Section 4.2, Appendix A.3).
  • domain assumption Unstructured pruning masks optimized on ANNs remain beneficial after conversion and finetuning.
    The mask is frozen during SNN finetuning via Eq. (9); this is tested indirectly through comparisons to random connectivity but not proven.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Adversarially Robust Spiking Neural Networks with Sparse Connectivity." pith.science (2026). https://pith.science/paper/IMKUYUBD

@misc{pith2026250515833,
  author       = {Pith},
  title        = {Pith review of: Adversarially Robust Spiking Neural Networks with Sparse Connectivity},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/IMKUYUBD}},
  note         = {Machine review of arXiv:2505.15833}
}
read the original abstract

Deployment of deep neural networks in resource-constrained embedded systems requires innovative algorithmic solutions to facilitate their energy and memory efficiency. To further ensure the reliability of these systems against malicious actors, recent works have extensively studied adversarial robustness of existing architectures. Our work focuses on the intersection of adversarial robustness, memory- and energy-efficiency in neural networks. We introduce a neural network conversion algorithm designed to produce sparse and adversarially robust spiking neural networks (SNNs) by leveraging the sparse connectivity and weights from a robustly pretrained artificial neural network (ANN). Our approach combines the energy-efficient architecture of SNNs with a novel conversion algorithm, leading to state-of-the-art performance with enhanced energy and memory efficiency through sparse connectivity and activations. Our models are shown to achieve up to 100x reduction in the number of weights to be stored in memory, with an estimated 8.6x increase in energy efficiency compared to dense SNNs, while maintaining high performance and robustness against adversarial threats.

Figures

Figures reproduced from arXiv: 2505.15833 by the authors.

Figure 1
Figure 1. Comparing our method with end-to-end (E2E) AT, via clean (solid) and robust (dashed) accu￾racies evaluated with PGDens at ϵ = 8/255 (90% sparse VGG-16 SNN on CIFAR-10). Sparsity in E2E training was initialized either randomly, or by using the ANN connectivity as in our method. efficient method (i.e., total wall-clock time: E2E SNN AT: 40.6 hours vs Ours: 24.5 hours, see Appendix A.2 for details). This is due to the … view at source ↗
Figure 2
Figure 2. Clean (solid lines) and robust (dashed lines) accuracies of converted SNNs evaluated with [PITH_FULL_IMAGE:figures/full_fig_p008_2.png] view at source ↗

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

63 extracted references · 52 canonical work pages

  1. [11]

    Transactions on Machine Learning Research, 2024

    OzanÖzdenizciandRobertLegenstein.Adversariallyrobustspikingneuralnetworksthrough conversion. Transactions on Machine Learning Research, 2024

    work page 2024

  2. [1]

    Intriguing properties of neural networks

    Christian Szegedy, Wojciech Zaremba, Ilya Sutskever, Joan Bruna, Dumitru Erhan, Ian Goodfellow, and Rob Fergus. Intriguing properties of neural networks. arXiv preprint arXiv:1312.6199, 2013

    arXiv 2013

  3. [2]

    Towards deep learning models resistant to adversarial attacks

    Aleksander Madry, Aleksandar Makelov, Ludwig Schmidt, Dimitris Tsipras, and Adrian Vladu. Towards deep learning models resistant to adversarial attacks. arXiv preprint arXiv:1706.06083, 2017

    arXiv 2017

  4. [3]

    Adversarial robustness may be at odds with simplicity.arXiv preprint arXiv:1901.00532, 2019

    Preetum Nakkiran. Adversarial robustness may be at odds with simplicity.arXiv preprint arXiv:1901.00532, 2019

    arXiv 1901

  5. [4]

    Adversarial robustness vs

    ShaokaiYe,KaidiXu,SijiaLiu,HaoCheng,Jan-HenrikLambrechts,HuanZhang,AojunZhou, Kaisheng Ma, Yanzhi Wang, and Xue Lin. Adversarial robustness vs. model compression, or both? InProceedings of the IEEE/CVF International Conference on Computer Vision, 2019

    work page 2019

  6. [5]

    Hydra: Pruning adversarially robust neural networks.Advances in Neural Information Processing Systems, 33, 2020

    Vikash Sehwag, Shiqi Wang, Prateek Mittal, and Suman Jana. Hydra: Pruning adversarially robust neural networks.Advances in Neural Information Processing Systems, 33, 2020

    work page 2020

  7. [6]

    Holistic adversarially robust pruning

    Qi Zhao and Christian Wressnegger. Holistic adversarially robust pruning. InThe Eleventh International Conference on Learning Representations, 2022

    work page 2022

  8. [7]

    Hire-snn: Harnessing the inherent robustness of energy-efficient deep spiking neural networks by training with crafted input noise

    Souvik Kundu et al. Hire-snn: Harnessing the inherent robustness of energy-efficient deep spiking neural networks by training with crafted input noise. InProceedings of the IEEE/CVF International Conference on Computer Vision, pages 5209–5218, 2021

    work page 2021

Show all 63 references
  1. [8]

    SNN-RAT: Robustness en- hanced spiking neural network through regularized adversarial training.Advances in Neural Information Processing Systems, 35:24780–24793, 2022

    Jianhao Ding, Tong Bu, Zhaofei Yu, Tiejun Huang, and Jian Liu. SNN-RAT: Robustness en- hanced spiking neural network through regularized adversarial training.Advances in Neural Information Processing Systems, 35:24780–24793, 2022

    2022

  2. [9]

    Enhancingtherobustnessofspiking neural networks with stochastic gating mechanisms

    JianhaoDing, ZhaofeiYu, TiejunHuang, andJianKLiu. Enhancingtherobustnessofspiking neural networks with stochastic gating mechanisms. InProceedings of the AAAI Conference on Artificial Intelligence, volume 38, pages 492–502, 2024

    2024

  3. [10]

    Enhancing adversarial robustness in SNNs with sparse gradients

    Yujia Liu, Tong Bu, Jianhao Ding, Zecheng Hao, Tiejun Huang, and Zhaofei Yu. Enhancing adversarial robustness in SNNs with sparse gradients. InInternational Conference on Machine Learning. PMLR, 2024

    2024

  4. [12]

    Towards spike-based machine intelligence with neuromorphic computing

    Kaushik Roy et al. Towards spike-based machine intelligence with neuromorphic computing. Nature, 575(7784):607–617, 2019

    2019

  5. [13]

    Advancing neuromorphic com- puting with Loihi: A survey of results and outlook.Proceedings of the IEEE, 109(5):911–934, 2021

    Mike Davies, Andreas Wild, Garrick Orchard, Yulia Sandamirskaya, Gabriel A Fonseca Guerra, Prasad Joshi, Philipp Plank, and Sumedh R Risbud. Advancing neuromorphic com- puting with Loihi: A survey of results and outlook.Proceedings of the IEEE, 109(5):911–934, 2021

    2021

  6. [14]

    Spatio-temporalbackpropagationfor training high-performance spiking neural networks.Frontiers in Neuroscience, 12:331, 2018

    YujieWu,LeiDeng,GuoqiLi,JunZhu,andLupingShi. Spatio-temporalbackpropagationfor training high-performance spiking neural networks.Frontiers in Neuroscience, 12:331, 2018. 10

    2018

  7. [15]

    Direct training for spik- ing neural networks: Faster, larger, better

    Yujie Wu, Lei Deng, Guoqi Li, Jun Zhu, Yuan Xie, and Luping Shi. Direct training for spik- ing neural networks: Faster, larger, better. InProceedings of the AAAI Conference on Artificial Intelligence, volume 33, pages 1311–1318, 2019

    2019

  8. [16]

    Neural Networks, 10(9):1659–1671, 1997

    WolfgangMaass.Networksofspikingneurons: thethirdgenerationofneuralnetworkmodels. Neural Networks, 10(9):1659–1671, 1997

    1997

  9. [17]

    Enabling spike-based backpropagation for training deep neural network archi- tectures

    Chankyu Lee, Syed Shakib Sarwar, Priyadarshini Panda, Gopalakrishnan Srinivasan, and Kaushik Roy. Enabling spike-based backpropagation for training deep neural network archi- tectures. Frontiers in Neuroscience, page 119, 2020

    2020

  10. [18]

    Surrogate gradient learning in spiking neural networks: Bringing the powerofgradient-basedoptimizationtospikingneuralnetworks

    Emre O Neftci et al. Surrogate gradient learning in spiking neural networks: Bringing the powerofgradient-basedoptimizationtospikingneuralnetworks. IEEESignalProcessingMag- azine, 36(6):51–63, 2019

    2019

  11. [19]

    Fast-classifying, high-accuracy spiking deep networks through weight and threshold balanc- ing

    PeterUDiehl,DanielNeil,JonathanBinas,MatthewCook,Shih-ChiiLiu,andMichaelPfeiffer. Fast-classifying, high-accuracy spiking deep networks through weight and threshold balanc- ing. InInternational Joint Conference on Neural Networks (IJCNN), pages 1–8, 2015

    2015

  12. [20]

    Conversion of continuous-valued deep networks to efficient event-driven networks for image classification

    Bodo Rueckauer, Iulia-Alexandra Lungu, Yuhuang Hu, Michael Pfeiffer, and Shih-Chii Liu. Conversion of continuous-valued deep networks to efficient event-driven networks for image classification. Frontiers in Neuroscience, 11:682, 2017

    2017

  13. [21]

    Going deeper in spikingneuralnetworks: Vggandresidualarchitectures

    Abhronil Sengupta, Yuting Ye, Robert Wang, Chiao Liu, and Kaushik Roy. Going deeper in spikingneuralnetworks: Vggandresidualarchitectures. FrontiersinNeuroscience , 13:95, 2019

    2019

  14. [22]

    Enabling deep spiking neural networks with hybrid conversion and spike timing dependent backprop- agation

    Nitin Rathi, Gopalakrishnan Srinivasan, Priyadarshini Panda, and Kaushik Roy. Enabling deep spiking neural networks with hybrid conversion and spike timing dependent backprop- agation. arXiv preprint arXiv:2005.01807, 2020

    2005 arXiv

  15. [23]

    Diet-snn: A low-latency spiking neural network with direct input encoding and leakage and threshold optimization.IEEE Transactions on Neural Networks and Learning Systems, 2021

    Nitin Rathi and Kaushik Roy. Diet-snn: A low-latency spiking neural network with direct input encoding and leakage and threshold optimization.IEEE Transactions on Neural Networks and Learning Systems, 2021

    2021

  16. [24]

    Computing’s energy problem (and what we can do about it)

    Mark Horowitz. Computing’s energy problem (and what we can do about it). InIEEE Inter- national Solid-State Circuits Conference Digest of Technical Papers (ISSCC), pages 10–14, 2014

    2014

  17. [25]

    Explaining and harnessing adversarial examples

    Ian J Goodfellow et al. Explaining and harnessing adversarial examples. arXiv preprint arXiv:1412.6572, 2014

    2014 arXiv

  18. [26]

    Theoreticallyprincipledtrade-offbetweenrobustnessandaccuracy

    HongyangZhang,YaodongYu,JiantaoJiao,EricXing,LaurentElGhaoui,andMichaelJordan. Theoreticallyprincipledtrade-offbetweenrobustnessandaccuracy. In InternationalConference on Machine Learning, pages 7472–7482. PMLR, 2019

    2019

  19. [27]

    Improving adversarial robustness requires revisiting misclassified examples

    Yisen Wang, Difan Zou, Jinfeng Yi, James Bailey, Xingjun Ma, and Quanquan Gu. Improving adversarial robustness requires revisiting misclassified examples. InInternational Conference on Learning Representations, 2019

    2019

  20. [28]

    Consistencyregularizationforadversarialrobustness

    Jihoon Tack, Sihyun Yu, Jongheon Jeong, Minseon Kim, Sung Ju Hwang, and Jinwoo Shin. Consistencyregularizationforadversarialrobustness. In ProceedingsoftheAAAIConferenceon Artificial Intelligence, volume 36, pages 8414–8422, 2022

    2022

  21. [29]

    Inherent adversarial ro- bustness of deep spiking neural networks: Effects of discrete input encoding and non-linear activations

    Saima Sharmin, Nitin Rathi, Priyadarshini Panda, and Kaushik Roy. Inherent adversarial ro- bustness of deep spiking neural networks: Effects of discrete input encoding and non-linear activations. InEuropean Conference on Computer Vision, pages 399–414, 2020

    2020

  22. [30]

    Towardrobustspikingneuralnetwork against adversarial perturbation.Advances in Neural Information Processing Systems, 35, 2022

    LingLiang,KaidiXu,XingHu,LeiDeng,andYuanXie. Towardrobustspikingneuralnetwork against adversarial perturbation.Advances in Neural Information Processing Systems, 35, 2022. 11

    2022

  23. [31]

    A comprehensive analysis on adversarial robustness of spiking neural networks

    Saima Sharmin, Priyadarshini Panda, Syed Shakib Sarwar, Chankyu Lee, Wachirawit Ponghi- ran, and Kaushik Roy. A comprehensive analysis on adversarial robustness of spiking neural networks. InInternational Joint Conference on Neural Networks (IJCNN), pages 1–8. IEEE, 2019

    2019

  24. [32]

    Is spiking secure? a comparative study on the security vul- nerabilities of spiking and deep neural networks

    Alberto Marchisio, Giorgio Nanfa, Faiq Khalid, Muhammad Abdullah Hanif, Maurizio Mar- tina, and Muhammad Shafique. Is spiking secure? a comparative study on the security vul- nerabilities of spiking and deep neural networks. InInternational Joint Conference on Neural Networks ...

    2020

  25. [33]

    Securing deep spiking neural networks against adversarial attacks through inherent structural parameters

    Rida El-Allami, Alberto Marchisio, Muhammad Shafique, and Ihsen Alouani. Securing deep spiking neural networks against adversarial attacks through inherent structural parameters. In Design, Automation & Test in Europe Conference & Exhibition (DATE), pages 774–779. IEEE, 2021

    2021

  26. [34]

    Se- curing the spike: On the transferabilty and security of spiking neural networks to adversarial examples

    Nuo Xu, Kaleel Mahmood, Haowen Fang, Ethan Rathbun, Caiwen Ding, and Wujie Wen. Se- curing the spike: On the transferabilty and security of spiking neural networks to adversarial examples. arXiv preprint arXiv:2209.03358, 2022

    2022 arXiv

  27. [35]

    Robust stable spiking neural networks

    Jianhao Ding, Zhiyu Pan, Yujia Liu, Zhaofei Yu, and Tiejun Huang. Robust stable spiking neural networks. InInternational Conference on Machine Learning. PMLR, 2024

    2024

  28. [36]

    Learningbothweightsandconnectionsfor efficient neural network.Advances in Neural Information Processing Systems, 28, 2015

    SongHan,JeffPool,JohnTran,andWilliamDally. Learningbothweightsandconnectionsfor efficient neural network.Advances in Neural Information Processing Systems, 28, 2015

    2015

  29. [37]

    What’s hidden in a randomly weighted neural network? In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 11893–11902, 2020

    Vivek Ramanujan, Mitchell Wortsman, Aniruddha Kembhavi, Ali Farhadi, and Mohammad Rastegari. What’s hidden in a randomly weighted neural network? In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 11893–11902, 2020

    2020

  30. [38]

    Goingdeeperwithdirectly-trained larger spiking neural networks

    HanleZheng,YujieWu,LeiDeng,YifanHu,andGuoqiLi. Goingdeeperwithdirectly-trained larger spiking neural networks. InProceedings of the AAAI Conference on Artificial Intelligence, volume 35, pages 11062–11070, 2021

    2021

  31. [39]

    Exploring the connection between binary and spiking neural networks

    Sen Lu and Abhronil Sengupta. Exploring the connection between binary and spiking neural networks. Frontiers in Neuroscience, 14:535, 2020

    2020

  32. [40]

    Unla- beleddata improvesadversarial robustness.Advancesin NeuralInformation ProcessingSystems, 32, 2019

    Yair Carmon, Aditi Raghunathan, Ludwig Schmidt, John C Duchi, and Percy S Liang. Unla- beleddata improvesadversarial robustness.Advancesin NeuralInformation ProcessingSystems, 32, 2019

    2019

  33. [41]

    Ensemble adversarial training: Attacks and defenses

    Florian Tramèr, Alexey Kurakin, Nicolas Papernot, Ian Goodfellow, Dan Boneh, and Patrick McDaniel. Ensemble adversarial training: Attacks and defenses. arXiv preprint arXiv:1705.07204, 2017

    2017 arXiv

  34. [42]

    Security evaluation of pattern classifiers under attack.IEEE Transactions on Knowledge and Data Engineering, 26(4):984–996, 2013

    Battista Biggio et al. Security evaluation of pattern classifiers under attack.IEEE Transactions on Knowledge and Data Engineering, 26(4):984–996, 2013

    2013

  35. [43]

    On evaluating adversarial robustness

    Nicholas Carlini, Anish Athalye, Nicolas Papernot, Wieland Brendel, Jonas Rauber, Dimitris Tsipras, Ian Goodfellow, Aleksander Madry, and Alexey Kurakin. On evaluating adversarial robustness. arXiv preprint arXiv:1902.06705, 2019

    1902 arXiv

  36. [44]

    Reliable evaluation of adversarial robustness with an ensemble of diverse parameter-free attacks

    Francesco Croce and Matthias Hein. Reliable evaluation of adversarial robustness with an ensemble of diverse parameter-free attacks. InInternational Conference on Machine Learning, pages 2206–2216. PMLR, 2020

    2020

  37. [45]

    Rate gradient approximation attack threats deep spiking neural networks

    Tong Bu, Jianhao Ding, Zecheng Hao, and Zhaofei Yu. Rate gradient approximation attack threats deep spiking neural networks. InProceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 7896–7906, 2023. 12

    2023

  38. [46]

    Square attack: aquery-efficientblack-boxadversarialattackviarandomsearch

    MaksymAndriushchenko,FrancescoCroce,NicolasFlammarion,andMatthiasHein. Square attack: aquery-efficientblack-boxadversarialattackviarandomsearch. In EuropeanConference on Computer Vision (ECCV), pages 484–501. Springer, 2020

    2020

  39. [47]

    Synaptic interaction penalty: Appropriate penalty term for energy-efficient spiking neural networks.Transactions on Machine Learning Research, 2023

    Kazuma Suetake, Takuya Ushimaru, Ryuji Saiin, and Yoshihide Sawada. Synaptic interaction penalty: Appropriate penalty term for energy-efficient spiking neural networks.Transactions on Machine Learning Research, 2023

    2023

  40. [48]

    Training adversarially robust sparse networks via Bayesian connectivity sampling

    Ozan Özdenizci and Robert Legenstein. Training adversarially robust sparse networks via Bayesian connectivity sampling. InInternational Conference on Machine Learning, pages 8314–

  41. [49]

    Channel pruning for accelerating very deep neural networks

    Yihui He et al. Channel pruning for accelerating very deep neural networks. InProceedings of the IEEE International Conference on Computer Vision, pages 1389–1397, 2017

    2017

  42. [50]

    Lost in pruning: The effects of pruning neural networks beyond test accuracy.Proceedings of Machine Learning and Systems, 3:93–138, 2021

    Lucas Liebenwein, Cenk Baykal, Brandon Carter, David Gifford, and Daniela Rus. Lost in pruning: The effects of pruning neural networks beyond test accuracy.Proceedings of Machine Learning and Systems, 3:93–138, 2021

    2021

  43. [51]

    Towards energy efficient spiking neural networks: An unstructured pruning framework

    Xinyu Shi, Jianhao Ding, Zecheng Hao, and Zhaofei Yu. Towards energy efficient spiking neural networks: An unstructured pruning framework. InInternational Conference on Learning Representations (ICLR), 2024

    2024

  44. [52]

    Workload-balanced pruning for sparse spiking neural networks.IEEE Transactions on Emerging Topics in Computational Intelligence, 2024

    RuokaiYin,YoungeunKim,YuhangLi,AbhishekMoitra,NitinSatpute,AnnaHambitzer,and Priyadarshini Panda. Workload-balanced pruning for sparse spiking neural networks.IEEE Transactions on Emerging Topics in Computational Intelligence, 2024

    2024

  45. [53]

    Dvs-attacks: Adversarial attacks on dynamic vision sensors for spiking neural net- works

    Alberto Marchisio, Giacomo Pira, Maurizio Martina, Guido Masera, and Muhammad Shafique. Dvs-attacks: Adversarial attacks on dynamic vision sensors for spiking neural net- works. InInternational Joint Conference on Neural Networks (IJCNN), pages 1–9. IEEE, 2021

    2021

  46. [54]

    Ex- ploring adversarial attack in spiking neural networks with spike-compatible gradient.IEEE Transactions on Neural Networks and Learning Systems, 2021

    Ling Liang, Xing Hu, Lei Deng, Yujie Wu, Guoqi Li, Yufei Ding, Peng Li, and Yuan Xie. Ex- ploring adversarial attack in spiking neural networks with spike-compatible gradient.IEEE Transactions on Neural Networks and Learning Systems, 2021

    2021

  47. [55]

    Adversarial at- tacks on spiking convolutional neural networks for event-based vision.Frontiers in Neuro- science, 16, 2022

    Julian Büchel, Gregor Lenz, Yalun Hu, Sadique Sheik, and Martino Sorbaro. Adversarial at- tacks on spiking convolutional neural networks for event-based vision.Frontiers in Neuro- science, 16, 2022

    2022

  48. [56]

    Learning multiple layers of features from tiny images.Technical Report, Uni- versity of Toronto, 2009

    Alex Krizhevsky. Learning multiple layers of features from tiny images.Technical Report, Uni- versity of Toronto, 2009

    2009

  49. [57]

    Tiny ImageNet visual recognition challenge, 2015

    Ya Le and Xuan Yang. Tiny ImageNet visual recognition challenge, 2015

    2015

  50. [58]

    Very deep convolutional networks for large-scale image recognition

    Karen Simonyan and Andrew Zisserman. Very deep convolutional networks for large-scale image recognition. InInternational Conference on Learning Representations, 2015

    2015

  51. [59]

    Wide residual networks.arXiv preprint arXiv:1605.07146, 2016

    Sergey Zagoruyko. Wide residual networks.arXiv preprint arXiv:1605.07146, 2016

    2016 arXiv

  52. [60]

    Long short-term memory and learning-to-learn in networks of spiking neurons.Advances in Neural Information Processing Systems, 31, 2018

    Guillaume Bellec, Darjan Salaj, Anand Subramoney, Robert Legenstein, and Wolfgang Maass. Long short-term memory and learning-to-learn in networks of spiking neurons.Advances in Neural Information Processing Systems, 31, 2018

    2018

  53. [61]

    Advances in Neural Information Processing Systems, 31, 2018

    SumitBShresthaandGarrickOrchard.Slayer: Spikelayererrorreassignmentintime. Advances in Neural Information Processing Systems, 31, 2018

    2018

  54. [62]

    Estimatingorpropagatinggradientsthroughstochasticneuronsforcon- ditional computation.arXiv preprint arXiv:1308.3432, 2013

    YoshuaBengioetal. Estimatingorpropagatinggradientsthroughstochasticneuronsforcon- ditional computation.arXiv preprint arXiv:1308.3432, 2013

    2013 arXiv

  55. [63]

    Obfuscated gradients give a false sense of security: Circumventing defenses to adversarial examples

    Anish Athalye, Nicholas Carlini, and David Wagner. Obfuscated gradients give a false sense of security: Circumventing defenses to adversarial examples. InInternational Conference on Machine Learning, pages 274–283. PMLR, 2018. 13 A. Details on the Experimental Setup A.1. Datas...

    2018

Pith tools

Reviewed August 15, 2026 · model on record in the stance chip above.