面向脉冲神经网络对抗鲁棒性的可靠评测
Towards Reliable Evaluation of Adversarial Robustness for Spiking Neural Networks
对做 SNN 或脉冲类模型对抗鲁棒性评测的人，ASSG 提供了一种按输入分布自适应调整替代函数形状、缓解梯度消失的梯度估计手段，SA-PGD 则在梯度不精确时用自适应步长稳定收敛，可直接替换现有 PGD 评测流程，避免高估鲁棒性。
原文依据 we introduce the Adaptive Sharpness Surrogate Gradient (ASSG), which adaptively evolves the shape of the surrogate function according to the input distribution during attack iterations
摘要译文
由模型翻译 · 术语统一 · 请对照原文核对关键结论脉冲神经网络（SNN）利用基于脉冲的激活来模拟大脑高能效的信息处理方式。然而，脉冲激活的二值且不连续的特性会导致梯度消失，使得通过梯度下降进行对抗鲁棒性评测变得不可靠。尽管已有研究提出了改进的替代梯度方法，但这些方法在强对抗攻击下的有效性仍不明确。我们提出了一个更可靠的 SNN 对抗鲁棒性评测框架。我们从理论上分析了替代梯度中梯度消失的程度，并引入自适应锐度替代梯度（ASSG），该方法在攻击迭代过程中根据输入分布自适应地演化替代函数的形状，从而在缓解梯度消失的同时提升梯度精度。此外，我们设计了 L_infinity 约束下具有自适应步长的对抗攻击——稳定自适应投影梯度下降（SA-PGD），在梯度不精确的情况下实现更快、更稳定的收敛。大量实验表明，我们的方法在不同对抗训练方案、SNN 架构和神经元模型上均大幅提升了攻击成功率，为 SNN 对抗鲁棒性提供了更泛化、更可靠的评测。实验结果进一步揭示，当前 SNN 的鲁棒性被显著高估，并凸显了对更可靠的对抗训练方法的需求。代码已发布于 https://github.com/craree/ASSG-SNNs-Robustness-Evaluation。
英文原文摘要 1599 字符
Spiking Neural Networks (SNNs) utilize spike-based activations to mimic the brain's energy-efficient information processing. However, the binary and discontinuous nature of spike activations causes vanishing gradients, making adversarial robustness evaluation via gradient descent unreliable. While improved surrogate gradient methods have been proposed, their effectiveness under strong adversarial attacks remains unclear. We propose a more reliable framework for evaluating SNN adversarial robustness. We theoretically analyze the degree of gradient vanishing in surrogate gradients and introduce the Adaptive Sharpness Surrogate Gradient (ASSG), which adaptively evolves the shape of the surrogate function according to the input distribution during attack iterations, thereby enhancing gradient accuracy while mitigating gradient vanishing. In addition, we design an adversarial attack with adaptive step size under the L_infinity constraint--Stable Adaptive Projected Gradient Descent (SA-PGD), achieving faster and more stable convergence under imprecise gradients. Extensive experiments show that our approach substantially increases attack success rates across diverse adversarial training schemes, SNN architectures and neuron models, providing a more generalized and reliable evaluation of SNN adversarial robustness. The experimental results further reveal that the robustness of current SNNs has been significantly overestimated and highlighting the need for more dependable adversarial training methods. The code is released at https://github.com/craree/ASSG-SNNs-Robustness-Evaluation