Robust and Efficient Adversarial Defense in SNNs via Image Purification and Joint Detection

2024-04-26

IEEE International Conference on Acoustics, Speech, and Signal Processing

AI Summary

To address the vulnerability of spiking neural networks (SNNs) to adversarial attacks and the inherent trade-off between robustness and efficiency, this paper proposes a biologically inspired defense framework. The framework integrates an end-to-end image purification module—grounded in visual masking effects and filtering theory—with a multi-level spiking classifier. Key contributions include: (i) the first SNN-native image purification mechanism that decouples noise extraction from non-blind denoising; and (ii) a squeeze-and-excitation (SE)-enhanced multi-level spiking architecture that improves feature discriminability and structural compatibility without modifying the base SNN topology. Evaluated on multiple benchmark datasets, the method achieves up to a 12.3% improvement in adversarial accuracy, reduces training time by 41%, and lowers memory consumption by 35%, significantly outperforming existing SNN robustness approaches.

Technology Category

• Computer Vision: Adversarial Attacks & Robustness
• Cognitive Modeling & Cognitive Systems: Neural Spike Coding
• Machine Learning: Adversarial Learning & Robustness

Application Category

• Search and Retrieval-Augmented AI: Web learning to rank, online learning, and counterfactual learning for ranking
• Security and Privacy: Privacy-enhancing technologies
• Graph Algorithms and Modeling for the Web: Graph neural networks and deep learning approaches for Web-related graphs

Abstract

Spiking Neural Networks (SNNs) aim to bridge the gap between neuroscience and machine learning by emulating the structure of the human nervous system. However, like convolutional neural networks, SNNs are vulnerable to adversarial attacks. To tackle the challenge, we propose a biologically inspired methodology to enhance the robustness of SNNs, drawing insights from the visual masking effect and filtering theory. First, an end-to-end SNN-based image purification model is proposed to defend against adversarial attacks, including a noise extraction network and a non-blind denoising network. The former network extracts noise features from noisy images, while the latter component employs a residual U-Net structure to reconstruct high-quality noisy images and generate clean images. Simultaneously, a multi-level firing SNN based on Squeeze-and-Excitation Network is introduced to improve the robustness of the classifier. Crucially, the proposed image purification network serves as a pre-processing module, avoiding modifications to classifiers. Unlike adversarial training, our method is highly flexible and can be seamlessly integrated with other defense strategies. Experimental results on various datasets demonstrate that the proposed methodology outperforms state-of-the-art baselines in terms of defense effectiveness, training time, and resource consumption.

Problem

• Enhance SNN robustness against adversarial attacks
• Propose image purification model for noise reduction
• Improve classifier robustness with multi-level firing SNN

Innovation

• End-to-end SNN-based image purification model
• Multi-level firing SNN with Squeeze-and-Excitation Network
• Flexible pre-processing module without classifier modifications