Input-Specific and Universal Adversarial Attack Generation for Spiking Neural Networks in the Spiking Domain
This work addresses security vulnerabilities in SNNs, which are gaining traction in applications, by developing more effective adversarial attacks, though it is incremental as it builds on existing attack methods for neural networks.
The authors tackled adversarial attacks on Spiking Neural Networks (SNNs) by proposing two novel gradient-based algorithms in the spiking domain: an input-specific attack and a universal reusable patch attack. Experimental results on NMNIST and IBM DVS Gesture datasets showed that these attacks surpassed all existing state-of-the-art methods in metrics like adversarial accuracy, stealthiness, and generation time, with the first demonstration on the SHD sound dataset.
As Spiking Neural Networks (SNNs) gain traction across various applications, understanding their security vulnerabilities becomes increasingly important. In this work, we focus on the adversarial attacks, which is perhaps the most concerning threat. An adversarial attack aims at finding a subtle input perturbation to fool the network's decision-making. We propose two novel adversarial attack algorithms for SNNs: an input-specific attack that crafts adversarial samples from specific dataset inputs and a universal attack that generates a reusable patch capable of inducing misclassification across most inputs, thus offering practical feasibility for real-time deployment. The algorithms are gradient-based operating in the spiking domain proving to be effective across different evaluation metrics, such as adversarial accuracy, stealthiness, and generation time. Experimental results on two widely used neuromorphic vision datasets, NMNIST and IBM DVS Gesture, show that our proposed attacks surpass in all metrics all existing state-of-the-art methods. Additionally, we present the first demonstration of adversarial attack generation in the sound domain using the SHD dataset.