PaperlayerView exact revision on arXiv

Source-linked AI summary

Controllable Stochastic Quantization Encoding for Adversarially Robust Spiking Neural Networks

Yujia Liu, Peiyu Liu, Yajing Zheng, Tiejun Huang

arXiv:2610.01558v1cs.NE

TL;DR

SNNs are vulnerable to adversarial perturbations, while input encoding has received less attention as a robustness factor. The paper introduces stochastic quantization encoding, which adjusts input randomness through a quantization scale and connects Poisson and direct encoding. Experiments on CIFAR-10 and CIFAR-100 demonstrate its effectiveness, and the paper notes that the scale is fixed across pixels and selected empirically.

  • Problem

    SNNs remain vulnerable to adversarial attacks, while input encoding has been less explored than training-based defenses as a route to robustness.

    Source: §1 · p. 1, §2.2 · p. 3

  • Method

    The paper proposes stochastic quantization encoding, which controls input randomness through a quantization scale and recovers Poisson and direct encoding as special cases.

    Source: §1 · pp. 1–2

  • Results

    Experiments on CIFAR-10 and CIFAR-100 validate SQE's effectiveness and compatibility with existing training strategies for further robustness enhancement.

    Source: §1 · p. 2

  • Takeaways & Limitations

    Input encoding is a relevant factor in SNN adversarial robustness, and SQE can be combined with training-based defenses for further gains.

    Source: §1 · p. 2

    The quantization scale is fixed for all pixels in an image and selected empirically, limiting its flexibility.

    Source: §6 · p. 7

Abstract

from arXiv · show

Spiking Neural Networks (SNNs) have attracted increasing attention due to their impressive temporal dynamics, energy efficiency, and brain-inspired mechanisms. Although SNNs have demonstrated promising performance in image classification tasks, recent studies have shown that they remain vulnerable to adversarial attacks, where imperceptible perturbations are added to input images to mislead model predictions. Existing defense methods mainly focus on training strategies, while the role of input encoding remains less explored. An observation is that the robustness advantage of Poisson encoding over direct encoding may benefit from its inherent randomness. Motivated by this, we propose a stochastic quantization encoding method that encodes the input image with controllable randomness adjusted by the quantization scale, thereby improving the adversarial robustness of SNNs. We further show that this method constitutes a general framework that reduces to both Poisson encoding and direct encoding under different choices of the quantization scale. Since it enhances robustness at the input encoding stage, it can be combined with existing training-based defenses for further gains. Experimental results on CIFAR-10 and CIFAR-100 demonstrate the effectiveness of the proposed stochastic quantization encoding method. To sum up, this work highlights the importance of input encoding for the adversarial robustness of SNNs, providing a new perspective for understanding and improving it.

1 Introduction

SNNs remain vulnerable to adversarial perturbations, and input encoding is a less-explored factor in their robustness. The paper proposes stochastic quantization encoding (SQE), whose scale controls randomness and connects direct and Poisson encoding.

1 Introduction

  • SNNs use discrete binary spike trains and temporal dynamics, and have achieved image-classification performance comparable to ANNs in some models.Despite these capabilities, SNNs remain vulnerable to imperceptible perturbations that can cause incorrect predictions.Source: §1 · p. 1
  • SQE introduces controllable randomness at the input-encoding stage to improve SNN adversarial robustness.The quantization scale controls the randomness and the trade-off between adversarial robustness and clean accuracy.Source: §1 · pp. 1–2
  • The method provides a general encoding formulation that recovers both direct encoding and Poisson encoding under different quantization-scale choices.At N = 1 it reduces to Poisson encoding; as N increases, its values become more stable and approach direct encoding.Source: §1 · p. 2, Figure 1 · p. 2

2 Related Work

The related work reviews common adversarial attacks on SNNs and defenses that primarily modify training. It also identifies input encoding as a less-explored route, noting Poisson encoding's robustness–clean-accuracy trade-off.

2.1 Adversarial Attacks on SNNs

  • FGSM moves an input along the loss-gradient sign, RFGSM adds a small random perturbation first, and PGD iteratively updates and projects examples into an ℓ∞ neighborhood.APGD extends PGD by adapting its step size to the perturbation budget and optimization progress.Source: §2.1 · p. 2

2.2 Defense Methods for SNNs

  • Training-based defenses include adversarial training and loss regularizers, including Lipschitz constraints, gradient sparsity, and membrane-potential constraints.Adversarial training incorporates adversarial examples through a min-max optimization process.Source: §2.2 · pp. 2–3
  • Relatively few studies address SNN robustness through input encoding; Poisson encoding can improve robustness over direct encoding but typically degrades clean accuracy.Prior analysis links this trade-off to Poisson encoding's inherent randomness, motivating controllable stochastic quantization.Source: §2.2 · p. 3

3 Preliminary

The preliminaries describe LIF neuron dynamics and contrast direct and Poisson input encoding. Direct encoding repeats pixel values across time, whereas Poisson encoding samples binary inputs independently using pixel values as firing probabilities.

3.1 Neuron Dynamics in SNNs

  • The paper uses LIF neurons, whose membrane potential integrates a decayed prior potential and weighted presynaptic spikes before thresholding generates an output spike.The input image is encoded as a spike sequence at layer 0.Source: §3.1 · p. 3

3.2 Input Encoding Methods

  • For normalized pixels in [0, 1], direct encoding supplies the same pixel value at every time step, while Poisson encoding independently samples binary inputs using the pixel value as firing probability.The paper assumes RGB values are divided by 255 to normalize them.Source: §3.2 · p. 3

4 Method

SQE independently samples each pixel from adjacent quantization levels, preserving pixel intensity in expectation while bounding encoding randomness through the quantization scale. The scale connects Poisson and direct encoding and has an analogy to population coding.

4 Method

  • The method's quantization scale controls the upper bound on randomness, providing a way to adjust the encoding's stability.The method is presented as a general framework connecting Poisson and direct encoding.Source: §4 · p. 3, §4.1 · p. 3

4.1 Stochastic Quantization Encoding Method

  • SQE independently samples each pixel from adjacent quantization levels, with the upper-level probability determined by the fractional part of the scaled pixel value.When the scaled pixel value is an integer, the encoded value equals the pixel at every time step.Source: §4.1 · p. 3
  • SQE is unbiased at each time step and preserves input intensity in expectation; its randomness is quantified by the variance of the encoded value.The quantization scale bounds that randomness; larger scales tighten the bound and stabilize the sequence, while smaller scales may favor robustness at a clean-accuracy cost.Source: §4.1 · p. 4

4.2 Analysis of the Quantization Scale

  • At N = 1, SQE reduces to Poisson encoding; as N approaches infinity, its randomness approaches zero and it reduces to direct encoding.The upper and lower levels are separated by 1/N, so they approach the original pixel as N grows.Source: §4.2 · p. 4

4.3 A Biological Perspective

  • SQE resembles population coding: a larger quantization scale suppresses encoded-value randomness, while a smaller scale permits stronger fluctuations.The paper relates the scale to population size and the encoded result to information represented by population coding.Source: §4.3 · p. 4

5 Experiments

Across CIFAR-10 and CIFAR-100, SQE improves adversarial accuracy across training strategies while trading some clean accuracy. Ablations and encoding comparisons show that quantization scale controls the randomness underlying this trade-off.

5 Experiments

  • Evaluations cover CIFAR-10 and CIFAR-100, RFGSM, PGD, and APGD attacks at a perturbation budget of 8/255, and report results under the strongest tested attack configuration.Experiments use T = 8; CIFAR-10 includes VGG-11 and WRN-16, while CIFAR-100 uses WRN-16.Source: §5 · pp. 4–5

5.1 Robustness Improvement under Different Training Strategies

  • SQE generally improves adversarial accuracy with limited clean-accuracy loss on CIFAR-10 and CIFAR-100, including RAT's 9.86% to 17.92%, SR's 1.03% to 12.25%, and TGO's 0.17% to 12.02% CIFAR-100 attack averages.On CIFAR-10 VGG-11, adding SQE to AT improves APGD10 accuracy by approximately 20% with about a 1% clean-accuracy reduction; WRN-16 RAT gains approximately 17% average accuracy across attacks with less than a 5% clean-accuracy reduction.Source: Table 1 · p. 5, §5.1 · pp. 5–6, Table 2 · p. 6

5.2 Albation Study on Quantiztaion Scale

  • Increasing N from 2 to 8 raises clean accuracy by approximately 5%, while accuracies under all considered attacks fall to nearly zero.The ablation reports a trade-off: larger N makes representations more deterministic, improving clean accuracy but reducing robustness; smaller N adds randomness and improves robustness at a clean-accuracy cost.Source: Figure 2 · p. 6, §5.2 · p. 6

5.3 Comparsion with Poisson Encoding

  • On CIFAR-10 VGG-11, SQE raises white-box APGD10 accuracy from 0 to 16.82% versus direct encoding, with about a 3% clean-accuracy cost; Poisson reaches 29.11% but clean accuracy is 81.67%.In the black-box setting, SQE achieves comparable or better robustness than Poisson; the comparison describes SQE as balancing clean accuracy and adversarial robustness.Source: §5.3 · pp. 6–7, Table 3 · p. 7

5.4 Visulization

  • Figure 3 shows pixel-wise encoding randomness rising as N falls, while differences between encoded clean and adversarial images become sparser.In the first example, mean randomness is zero for direct encoding, approximately 0.02 as N decreases from 8 to 2, and about 0.19 for Poisson encoding.Source: Figure 3 · p. 7, §5.4 · p. 7

6 Conclusion and Discussion

The conclusion presents SQE as a way to improve SNN robustness while using the quantization scale to trade off clean accuracy and adversarial robustness. It notes that the fixed, empirically selected scale limits flexibility.

6 Conclusion and Discussion

  • A fixed quantization scale N, selected empirically for all pixels, limits SQE’s flexibility.The authors identify learnable and pixel-adaptive scales as future work that may enable a more effective trade-off between clean accuracy and adversarial robustness.Source: §6 · p. 7

A Proof of Theroem 1

The proof establishes that stochastic quantization encoding is unbiased at each time step and that its time-averaged encoding converges to the input pixel value.

A Proof of Theroem 1

B Proof of Theorem 2

Theorem 2 bounds the randomness of the encoding for any pixel value. The backward-propagation section uses a straight-through estimator to pass gradients through the non-differentiable encoding operation.

B Proof of Theorem 2

C Backward Propagation

  • Because stochastic rounding is non-differentiable, the straight-through estimator approximates it as an identity mapping in the backward pass.Source: C Backward Propagation · pp. 10–11
  • The estimator lets gradients from all time steps pass to the input pixel, enabling end-to-end network optimization while retaining stochastic quantization in the forward pass.Source: C Backward Propagation · pp. 10–11

D Proof of Theorems 3 and 4

The proofs show that SQE recovers Poisson encoding at N = 1 and approaches direct encoding as N grows. For the experiments’ discrete pixel values, N = 255 also makes the encoding deterministic.

D Proof of Theorems 3 and 4

E Training Details

Training used shared CIFAR-10/CIFAR-100 settings and an NVIDIA GeForce RTX 4090 GPU; strategy-specific parameters were set separately for AT, RAT, SR, and TGO.

Hardware

Common parameters

  • All CIFAR-10 and CIFAR-100 models used a 0.1 initial learning rate, 0.9 momentum, 5 × 10−4 weight decay, 200 epochs, batch size 64, and T = 8.Table 4 covers common parameters across both datasets.Source: E Training Details · p. 11, Table 4 · p. 11

AT and RAT

  • AT used PGD-generated training examples with perturbation budget 2.0/255 and five attack iterations; RAT used the same attack settings.Source: E Training Details · p. 11

RAT, SR, and TGO

  • RAT used BPTR with regularization weights 0.001 for VGG-11 and 0.004 for WRN-16; SR used step size 0.01 and sparsity weight 0.002, while TGO used λmax = 0.4.Table 5 summarizes strategy-specific parameter settings.Source: E Training Details · p. 12, Table 5 · p. 12

F Visualization Results

The visualizations show that lowering the quantization scale increases encoding randomness and clean-image noise, while changing the spatial pattern of encoded clean–adversarial differences. Smaller-scale encodings produce sparser difference maps, although the expected difference is preserved by unbiased stochastic quantization.

Encoding randomness

  • At N = 8, mean pixel-wise randomness was 0.002, compared with 0.182 at N = 1 (Poisson encoding), approximately 90 times higher.The randomness distribution shifts toward higher values as N decreases.Source: F Visualization Results · p. 12, Figure 4 · p. 13

Clean-image fidelity

  • As N decreases, encoding noise becomes more visible in clean images and can lower input fidelity, which may explain reduced clean accuracy.At N = 1, the first example was barely identifiable; background noise was stronger at N = 2 than at N = 8.Source: F Visualization Results · p. 12

Encoded perturbations

  • Although unbiased SQE preserves the expected clean–adversarial difference, smaller N makes difference maps sparser, which the authors suggest may weaken perturbation effects.The mean intensity is described as approximately preserved across encoders despite the spatial redistribution.Source: F Visualization Results · p. 12, Figure 4 · p. 13

Related papers

Loading 2610.01558v1…