Robust and Efficient Adversarial Defense in SNNs via Image Purification and Joint Detection

TL;DR

This paper introduces a biologically inspired, end-to-end image purification method combined with a robust SNN classifier to defend against adversarial attacks, outperforming existing defenses in efficiency and effectiveness.

Contribution

It proposes a novel image purification framework and a multi-level SNN classifier to enhance adversarial robustness without modifying classifiers, inspired by visual masking and filtering theories.

Findings

Outperforms state-of-the-art defenses in accuracy and resource efficiency

Effective against various adversarial attack types

Seamless integration with existing models

Abstract

Spiking Neural Networks (SNNs) aim to bridge the gap between neuroscience and machine learning by emulating the structure of the human nervous system. However, like convolutional neural networks, SNNs are vulnerable to adversarial attacks. To tackle the challenge, we propose a biologically inspired methodology to enhance the robustness of SNNs, drawing insights from the visual masking effect and filtering theory. First, an end-to-end SNN-based image purification model is proposed to defend against adversarial attacks, including a noise extraction network and a non-blind denoising network. The former network extracts noise features from noisy images, while the latter component employs a residual U-Net structure to reconstruct high-quality noisy images and generate clean images. Simultaneously, a multi-level firing SNN based on Squeeze-and-Excitation Network is introduced to improve the robustness of the classifier. Crucially, the proposed image purification network serves as a pre-processing module, avoiding modifications to classifiers. Unlike adversarial training, our method is highly flexible and can be seamlessly integrated with other defense strategies. Experimental results on various datasets demonstrate that the proposed methodology outperforms state-of-the-art baselines in terms of defense effectiveness, training time, and resource consumption.