SFTA: Spiking Neural Networks Vulnerable to Spiking Feature Transferable Attack

Many recent works have shown that spiking neural networks (SNNs) are vulnerable to well-crafted adversarial attacks in the white-box setting, which may lead to misclassification of the trained model. However, the information about the model is in a black-box setting and is usually unknown to the attacker, e.g., the parameters and structure of the model. So it is more challenging to counter the attack in the black-box setting, and there is still little research on this aspect in SNNs. Therefore, this work describes a transfer-based black box adversarial attack against spike feature space representations, providing insights for robust spike features in SNNs models. The attack is explicitly designed to be transferable, and more robust feature gradients are obtained by accumulating the feature gradients of the intermediate layers. Then we can successfully attack the black-box model by suppressing robust positive features and enhancing negative features. Extensive experimental evaluation demonstrates the proposed method’s effectiveness and superior performance on static and neuromorphic datasets. i.e., The attack success is 89.72% and 90% on the static MNIST and CIFAR10 datasets, and 85.97% and 69.09% on the neuromorphic N-MNIST and CIFARO-DVS datasets.