Rethinking adversarial attacks on neuromorphic models

Abstract Spiking neural networks (SNN) are biologically inspired artificial neural networks that emulate the behaviour of biological neurons in spiking-based computational units. However, machine learning models are known to be vulnerable to adversarial noise, and particularly to universal adversarial perturbations (UAP) and adversarial patch (AP) attacks. Despite the claimed inherent robustness of SNNs to adversarial noise, attacks with UAP and AP remain under-explored in the spiking domain. This paper revisits the adversarial noise generation method from its first principles. Specifically, we consider a realistic spiking-aware setting that takes into account constraints from the neuromorphic domain, such as event sparsity and spike-timing integrity. We introduce our approach for creating Spiking-compatible adversarial attacks and a spiking UAP and AP destined for event-based computer vision systems. We propose a novel, efficient spike-based adversarial noise generation approach that respects neuromorphic constraints and show that SNNs can be the victims of more tangible and realistic types of attack.