HIRE-SNN: Harnessing the Inherent Robustness of Energy-Efficient Deep Spiking Neural Networks by Training with Crafted Input Noise

• Earlier noisy-input training schemes for ANNs incurred significant extra training time and non-negligible clean-accuracy drops.Source: §1 · p. 1
• Prior claims of inherent SNN robustness were mostly based on small datasets and shallow models, while rate-coded inputs incurred high inference latency.Earlier work attributed robustness partly to sparse spiking activity.Source: §1 · p. 2
• The paper asks whether low-latency deep SNNs retain robustness under white-box and black-box attacks and whether efficient training can improve robustness while preserving clean accuracy.Source: §1 · p. 2
• Despite reduced average spike counts, direct-input deep SNNs have lower accuracy than equivalent ANNs on white-box and black-box attack images.The comparison is reported across multiple attacks.Source: §1 · p. 2
• HIRE-SNN trains on different crafted-noise variants of each image across time-step periods, avoiding extra training time and reducing intermediate-gradient memory.Weights are updated after each period.Source: §1 · p. 2

2.1. SNN Fundamentals

• SNN layers propagate spikes over T time steps; inference compares output-neuron spike totals, while LIF decay is λ=1 for IF and λ<1 for LIF.The LIF dynamics are compared with ReLU, and T is also the inference latency.Source: §2.1 · p. 2
• SNN training requires T forward and backward passes, and approximate gradients address undefined binary-spike gradients at the cost of slow convergence and high memory use.Source: §2.1 · p. 2
• ANN-to-SNN conversion initializes thresholds, but converted models can require high latency; hybrid direct-input training is used to reduce inference latency.The hybrid approach follows conversion with a few epochs of direct-input SNN training.Source: §2.1 · pp. 2–3

2.2. Adversarial Attacks

• FGSM perturbs input pixels along the sign of the loss gradient, with ϵ setting attack severity.Source: §2.2 · p. 3
• PGD iteratively updates an adversarial sample and projects it into the benign image’s ϵ-L∞ neighborhood, using α as the attack step size.Source: §2.2 · p. 3
• White-box attackers have complete model-parameter access; black-box attackers lack it and generate weaker perturbations.Source: §2.2 · p. 3

3. Initial Study: SNN Robustness Analysis

• The study evaluates traditionally trained SNNs initialized with weights and thresholds from an equivalent trained ANN conversion against white-box and black-box attacks.The analysis is intended to motivate the later training algorithm.Source: §3 · p. 3, §3.1 · p. 3

3.1. Performance Analysis

• Direct-coded deep SNNs generally have lower SA but higher TASA than rate-coded SNNs, especially in initial convolution layers; this suggests sparse-activity observations may extend when measured with TASA.Figure 3 shows per-layer TASA for VGG5 on CIFAR-10 and VGG11 on CIFAR-100.Source: §3.1 · p. 3, Figure 3 · p. 3
• 6.2% accuracy on the PGD black-box attack for VGG11 SNN, versus 15.25% for its ANN equivalent, shows traditional training can leave deep SNNs less robust.Table 1 compares performance under white-box and black-box attacks on CIFAR-10 and CIFAR-100.Source: §3.1 · p. 3, Table 1 · p. 4
• Reducing T does not significantly improve adversarial-image accuracy and lowers clean accuracy; rate-coded SNNs generally need more training time and memory to reach competitive accuracy.The T-sweep analysis is for VGG11 on CIFAR-100.Source: Figure 4 · p. 3, §3.1 · p. 4
• LIF layers do not reliably reduce perturbations in direct-input SNNs: leak helps only within a range, and layerwise spike PD may rise regardless of classification correctness.The authors conclude that rate-coded robustness factors are absent or require careful tuning in direct-input SNNs.Source: §3.1 · p. 4, Figure 5 · p. 4

4. HIRE-SNN Training

• Different perturbed image variants are generated and used for training at intervals of ⌊T/N⌋ steps, enabling adversarial variants without additional training time.Figure 6 contrasts traditional and proposed training; its example uses T = 4 and N = 2.Source: §4 · p. 5, Figure 6 · p. 5
• Because binary spike-train gradients are undefined, training uses a linear surrogate-gradient approximation for backpropagation and parameter updates.The damping factor γ controls the approximate backpropagation error.Source: §4 · p. 5
• Input gradients craft each period's pixel perturbation, with noise step ϵs and bound ϵt controlling its update and range.The current batch begins with the prior batch's final-period perturbation; subsequent periods use the preceding period's perturbation.Source: §4 · p. 5
• Weights, thresholds, and leak parameters are trainable, a choice the authors say helps retain clean-image accuracy at low latencies.The perturbation bound ϵs is chosen small enough to avoid significant clean-image accuracy loss.Source: §4 · p. 5

5.1. Experimental Setup

• For each model variant, evaluation uses three differently trained networks; PGD uses an L∞ neighborhood bound of 8/255, step size 0.01, and 7 iterations, while FGSM uses the same bound.Source: §5.2 · p. 6, §5.1 · p. 6

5.2. Performance Against WB and BB Attacks

• Up to 13.7% and 10.4% accuracy improvement on CIFAR-10 and CIFAR-100, respectively, is reported for the proposed SNN over traditionally trained SNNs.The white-box evaluation also reports improvements of up to 12.2% and 8.8% on CIFAR-10 and CIFAR-100, respectively, with negligible clean-image performance compromise.Source: §5.2 · p. 6
• The proposed training uses up to approximately 25% less GPU memory than traditional training, with no extra GPU training time.The reported comparison measures normalized memory and average training time for batches of 200 images.Source: §5.2 · p. 6, Figure 7 · p. 6

5.3. Discussion

• PGD robustness decreases as iterations increase but nears an asymptote after K = 40, and the authors conclude obfuscated gradients are not a significant source of robustness.FGSM performs worse than iterative PGD, while both can still fool the trained networks.Source: §5.3 · p. 7
• Crafted noise improves adversarial performance over Gaussian noise by up to 6.5% for white-box and 9.7% for black-box attacks; fixed threshold and leak parameters retain attack gains but reduce clean accuracy.Gaussian-noise training provides no noticeable adversarial improvement over traditional training in the VGG11 CIFAR-100 experiment.Source: §5.3 · p. 7, Figure 9 · p. 7
• Increasing ϵ_s consistently improves white-box and black-box adversarial accuracy, with up to approximately 2% clean-image performance loss.The models also outperform rate-coded robust SNNs with similar clean accuracy and up to 25× lower inference latency.Source: §5.3 · pp. 7–8, Figure 10 · p. 8

5.4. Computation Energy

• For HIRE-SNN VGG11, computation energy is up to 4.6× lower than a rate-coded SNN and 10× lower than an ANN with 32-bit floating point.With 32-bit integer implementation, the respective energy advantages are up to 3.9× and 53×.Source: §5.4 · p. 8, Figure 11 · p. 8

6. Conclusions

• The paper analyzes the inherent robustness of low-latency direct-input SNNs under adversarial attacks.It reports up to 13.7% improved accuracy on black-box FGSM attack images over traditionally trained direct-input SNNs.Source: §6 · p. 8
• The proposed training algorithm uses carefully crafted input noise to harness SNN robustness without additional training time.Source: §6 · p. 8
• Compared with rate-coded robust SNNs, the models perform similarly or better on clean and perturbed images, with up to 25× lower latency and approximately 4.6× lower computation energy.Source: §6 · p. 8