Timestep-Compressed Attack on Spiking Neural Networks through Timestep-Level Backpropagation

TL;DR

This paper introduces Timestep-Compressed Attack (TCA), a new method that drastically reduces attack latency on spiking neural networks by using timestep-level backpropagation and membrane potential reuse, without sacrificing attack success.

Contribution

The paper presents TCA, a novel framework that exploits SNN properties to enable faster adversarial attacks through timestep-level evaluation and potential reuse of membrane potentials.

Findings

TCA reduces attack latency by over 56% compared to SOTA methods.

TCA maintains comparable attack success rates to existing approaches.

TCA is effective on multiple datasets and network architectures.

Abstract

State-of-the-art (SOTA) gradient-based adversarial attacks on spiking neural networks (SNNs), which largely rely on extending FGSM and PGD frameworks, face a critical limitation: substantial attack latency from multi-timestep processing, rendering them infeasible for practical real-time applications. This inefficiency stems from their design as direct extensions of ANN paradigms, which fail to exploit key SNN properties. In this paper, we propose the timestep-compressed attack (TCA), a novel framework that significantly reduces attack latency. TCA introduces two components founded on key insights into SNN behavior. First, timestep-level backpropagation (TLBP) is based on our finding that global temporal information in backpropagation to generate perturbations is not critical for an attack's success, enabling per-timestep evaluation for early stopping. Second, adversarial membrane potential reuse (A-MPR) is motivated by the observation that initial timesteps are inefficiently spent accumulating membrane potential, a warm-up phase that can be pre-calculated and reused. Our experiments on VGG-11 and ResNet-17 with the CIFAR-10/100 and CIFAR10-DVS datasets show that TCA significantly reduces the required attack latency by up to 56.6% and 57.1% compared to SOTA methods in white-box and black-box settings, respectively, while maintaining a comparable attack success rate.