# Adversarial Attacks on Spiking Convolutional Neural Networks for Event-based Vision

arXiv: https://arxiv.org/abs/2110.02929 · HTML: https://mlsanity.com/paper/2110.02929/

## Key facts

- Cited by 14 papers in the map (data through 14 Oct 2026).
- Builds on 21 of its 38 references that are in the map.
- First posted on arXiv 6 Oct 2021.

## Builds on (most cited first, 21 of 21)

- [Adam: A Method for Stochastic Optimization](https://mlsanity.com/paper/1412.6980/) (2014)
- [Towards Deep Learning Models Resistant to Adversarial Attacks](https://mlsanity.com/paper/1706.06083/) (2017)
- [Intriguing properties of neural networks](https://mlsanity.com/paper/1312.6199/) (2013)
- [Categorical Reparameterization with Gumbel-Softmax](https://mlsanity.com/paper/1611.01144/) (2016)
- [Estimating or Propagating Gradients Through Stochastic Neurons for Conditional Computation](https://mlsanity.com/paper/1308.3432/) (2013)
- [Theoretically Principled Trade-off between Robustness and Accuracy](https://mlsanity.com/paper/1901.08573/) (2019)
- [DeepFool: a simple and accurate method to fool deep neural networks](https://mlsanity.com/paper/1511.04599/) (2015)
- [Surrogate Gradient Learning in Spiking Neural Networks](https://mlsanity.com/paper/1901.09948/) (2019)
- [Adversarial Patch](https://mlsanity.com/paper/1712.09665/) (2017)
- [Threat of Adversarial Attacks on Deep Learning in Computer Vision: A Survey](https://mlsanity.com/paper/1801.00553/) (2018)
- [Wild Patterns: Ten Years After the Rise of Adversarial Machine Learning](https://mlsanity.com/paper/1712.03141/) (2017)
- [Converting Static Image Datasets to Spiking Neuromorphic Datasets Using Saccades](https://mlsanity.com/paper/1507.07629/) (2015)
- [SparseFool: a few pixels make a big difference](https://mlsanity.com/paper/1811.02248/) (2018)
- [Convolutional Networks for Fast, Energy-Efficient Neuromorphic Computing](https://mlsanity.com/paper/1603.08270/) (2016)
- [A scalable multi-core architecture with heterogeneous memory structures for Dynamic Neuromorphic Asynchronous Processors (DYNAPs)](https://mlsanity.com/paper/1708.04198/) (2017)
- [Inherent Adversarial Robustness of Deep Spiking Neural Networks: Effects of Discrete Input Encoding and Non-Linear Activations](https://mlsanity.com/paper/2003.10399/) (2020)
- [Optimizing the energy consumption of spiking neural networks for neuromorphic applications](https://mlsanity.com/paper/1912.01268/) (2019)
- [Exploring Adversarial Attack in Spiking Neural Networks with Spike-Compatible Gradient](https://mlsanity.com/paper/2001.01587/) (2020)
- [DVS-Attacks: Adversarial Attacks on Dynamic Vision Sensors for Spiking Neural Networks](https://mlsanity.com/paper/2107.00415/) (2021)
- [Adversarial Training for Probabilistic Spiking Neural Networks](https://mlsanity.com/paper/1802.08567/) (2018)
- [Adversarial Attacks on Binary Image Recognition Systems](https://mlsanity.com/paper/2010.11782/) (2020)

## Built on by (most cited first, 14 of 14)

- [State Space Models for Event Cameras](https://mlsanity.com/paper/2402.15584/) (2024)
- [Towards Effective and Sparse Adversarial Attack on Spiking Neural Networks via Breaking Invisible Surrogate Gradients](https://mlsanity.com/paper/2503.03272/) (2025)
- [Adversarially Robust Spiking Neural Networks Through Conversion](https://mlsanity.com/paper/2311.09266/) (2023)
- [Input-Triggered Hardware Trojan Attack on Spiking Neural Networks](https://mlsanity.com/paper/2503.21793/) (2025)
- [Time Is All It Takes: Spike-Retiming Attacks on Event-Driven Spiking Neural Networks](https://mlsanity.com/paper/2602.03284/) (2026)
- [Time-Distributed Backdoor Attacks on Federated Spiking Learning](https://mlsanity.com/paper/2402.02886/) (2024)
- [Flashy Backdoor: Real-world Environment Backdoor Attack on SNNs with DVS Cameras](https://mlsanity.com/paper/2411.03022/) (2024)
- [Input-Specific and Universal Adversarial Attack Generation for Spiking Neural Networks in the Spiking Domain](https://mlsanity.com/paper/2505.06299/) (2025)
- [Advancing Neuromorphic Computing: Mixed-Signal Design Techniques Leveraging Brain Code Units and Fundamental Code Units](https://mlsanity.com/paper/2403.11563/) (2024)
- [On the Adversarial Robustness of Spiking Neural Networks Trained by Local Learning](https://mlsanity.com/paper/2504.08897/) (2025)
- [Adversarially Robust Spiking Neural Networks with Sparse Connectivity](https://mlsanity.com/paper/2505.15833/) (2025)
- [Generating Adversarial Events: A Motion-Aware Point Cloud Framework](https://mlsanity.com/paper/2602.08230/) (2026)
- [Driving up Inference Energy on SNNs: Per-Sample and Universal Sponge Attacks](https://mlsanity.com/paper/2607.27990/) (2026)
- [Stealth Is a Relation, Not a Property: How Event Representations Create Blind Spots for Timing Attacks in Event-Based Perception](https://mlsanity.com/paper/2609.36386/) (2026)

## Abstract (arXiv)

Event-based dynamic vision sensors provide very sparse output in the form of spikes, which makes them suitable for low-power applications. Convolutional spiking neural networks model such event-based data and develop their full energy-saving potential when deployed on asynchronous neuromorphic hardware. Event-based vision being a nascent field, the sensitivity of spiking neural networks to potentially malicious adversarial attacks has received little attention so far. We show how white-box adversarial attack algorithms can be adapted to the discrete and sparse nature of event-based visual data, and demonstrate smaller perturbation magnitudes at higher success rates than the current state-of-the-art algorithms. For the first time, we also verify the effectiveness of these perturbations directly on neuromorphic hardware. Finally, we discuss the properties of the resulting perturbations, the effect of adversarial training as a defense strategy, and future directions.