Attacking the Spike: On the Transferability and Security of Spiking Neural Networks to Adversarial Examples
This work systematically investigates the underexplored problem of adversarial robustness in Spiking Neural Networks (SNNs). We find that white-box attacks against SNNs heavily rely on surrogate gradient techniques and exhibit severely limited transferability of adversarial examples across architectures (e.g., between SNNs and ViTs/CNNs). To address this, we first uncover a strong coupling mechanism between SNNs’ adversarial vulnerability and surrogate gradient estimation. Building on this insight, we propose Auto-SAGA—a cross-architecture universal white-box attack method that jointly optimizes adaptive self-attention gradient estimation and surrogate gradient approximation. Evaluated on CIFAR-10, CIFAR-100, and ImageNet, Auto-SAGA achieves a 91.1% improvement in attack success rate on SNN-ViT ensembles and attains three times the effectiveness of Auto-PGD on adversarially trained SNN ensembles, significantly outperforming existing baselines.