# A Comprehensive Analysis on Adversarial Robustness of Spiking Neural Networks

arXiv: https://arxiv.org/abs/1905.02704 · HTML: https://mlsanity.com/paper/1905.02704/

## Key facts

- Cited by 36 papers in the map (data through 14 Oct 2026).
- First posted on arXiv 7 May 2019.

## Built on by (most cited first, 30 of 36)

- [Visual Explanations from Spiking Neural Networks using Interspike Intervals](https://mlsanity.com/paper/2103.14441/) (2021)
- [DVS-Attacks: Adversarial Attacks on Dynamic Vision Sensors for Spiking Neural Networks](https://mlsanity.com/paper/2107.00415/) (2021)
- [Deep Reinforcement Learning with Spiking Q-learning](https://mlsanity.com/paper/2201.09754/) (2022)
- [Attacking the Spike: On the Transferability and Security of Spiking Neural Networks to Adversarial Examples](https://mlsanity.com/paper/2209.03358/) (2022)
- [Toward Robust Spiking Neural Network Against Adversarial Perturbation](https://mlsanity.com/paper/2205.01625/) (2022)
- [Enhancing Adversarial Robustness in SNNs with Sparse Gradients](https://mlsanity.com/paper/2405.20355/) (2024)
- [R-SNN: An Analysis and Design Methodology for Robustifying Spiking Neural Networks against Adversarial Attacks through Noise Filters for Dynamic Vision Sensors](https://mlsanity.com/paper/2109.00533/) (2021)
- [A.I. Robustness: a Human-Centered Perspective on Technological Challenges and Opportunities](https://mlsanity.com/paper/2210.08906/) (2022)
- [Towards Effective and Sparse Adversarial Attack on Spiking Neural Networks via Breaking Invisible Surrogate Gradients](https://mlsanity.com/paper/2503.03272/) (2025)
- [Adversarially Robust Spiking Neural Networks Through Conversion](https://mlsanity.com/paper/2311.09266/) (2023)
- [Special Session: Towards an Agile Design Methodology for Efficient, Reliable, and Secure ML Systems](https://mlsanity.com/paper/2204.09514/) (2022)
- [Spiking NeRF: Representing the Real-World Geometry by a Discontinuous Representation](https://mlsanity.com/paper/2311.09077/) (2023)
- [Input-Triggered Hardware Trojan Attack on Spiking Neural Networks](https://mlsanity.com/paper/2503.21793/) (2025)
- [Time Is All It Takes: Spike-Retiming Attacks on Event-Driven Spiking Neural Networks](https://mlsanity.com/paper/2602.03284/) (2026)
- [Navigating Local Minima in Quantized Spiking Neural Networks](https://mlsanity.com/paper/2202.07221/) (2022)
- [Time-Distributed Backdoor Attacks on Federated Spiking Learning](https://mlsanity.com/paper/2402.02886/) (2024)
- [Spiking Approximations of the MaxPooling Operation in Deep SNNs](https://mlsanity.com/paper/2205.07076/) (2022)
- [HoSNN: Adversarially-Robust Homeostatic Spiking Neural Networks with Adaptive Firing Thresholds](https://mlsanity.com/paper/2308.10373/) (2023)
- [Membership Privacy Evaluation in Deep Spiking Neural Networks](https://mlsanity.com/paper/2409.19413/) (2024)
- [Flashy Backdoor: Real-world Environment Backdoor Attack on SNNs with DVS Cameras](https://mlsanity.com/paper/2411.03022/) (2024)
- [Benchmarking Spiking Neural Network Learning Methods with Varying Locality](https://mlsanity.com/paper/2402.01782/) (2024)
- [MPD-SGR: Robust Spiking Neural Networks with Membrane Potential Distribution-Driven Surrogate Gradient Regularization](https://mlsanity.com/paper/2511.12199/) (2025)
- [Adversarial Defense via Neural Oscillation inspired Gradient Masking](https://mlsanity.com/paper/2211.02223/) (2022)
- [On the Privacy Risks of Spiking Neural Networks: A Membership Inference Analysis](https://mlsanity.com/paper/2502.13191/) (2025)
- [Input-Specific and Universal Adversarial Attack Generation for Spiking Neural Networks in the Spiking Domain](https://mlsanity.com/paper/2505.06299/) (2025)
- [Biologically Plausible Variational Policy Gradient with Spiking Recurrent Winner-Take-All Networks](https://mlsanity.com/paper/2210.13225/) (2022)
- [HyperSNN: A new efficient and robust deep learning model for resource constrained control applications](https://mlsanity.com/paper/2308.08222/) (2023)
- [Feature Attribution Explanations for Spiking Neural Networks](https://mlsanity.com/paper/2311.02110/) (2023)
- [On the Adversarial Robustness of Spiking Neural Networks Trained by Local Learning](https://mlsanity.com/paper/2504.08897/) (2025)
- [Izhikevich-Inspired Temporal Dynamics for Enhancing Privacy, Efficiency, and Transferability in Spiking Neural Networks](https://mlsanity.com/paper/2505.04034/) (2025)

## Abstract (arXiv)

In this era of machine learning models, their functionality is being threatened by adversarial attacks. In the face of this struggle for making artificial neural networks robust, finding a model, resilient to these attacks, is very important. In this work, we present, for the first time, a comprehensive analysis of the behavior of more bio-plausible networks, namely Spiking Neural Network (SNN) under state-of-the-art adversarial tests. We perform a comparative study of the accuracy degradation between conventional VGG-9 Artificial Neural Network (ANN) and equivalent spiking network with CIFAR-10 dataset in both whitebox and blackbox setting for different types of single-step and multi-step FGSM (Fast Gradient Sign Method) attacks. We demonstrate that SNNs tend to show more resiliency compared to ANN under black-box attack scenario. Additionally, we find that SNN robustness is largely dependent on the corresponding training mechanism. We observe that SNNs trained by spike-based backpropagation are more adversarially robust than the ones obtained by ANN-to-SNN conversion rules in several whitebox and blackbox scenarios. Finally, we also propose a simple, yet, effective framework for crafting adversarial attacks from SNNs. Our results suggest that attacks crafted from SNNs following our proposed method are much stronger than those crafted from ANNs.