Official Code: Attacking the Spike — Mixed Dynamic Spiking Estimation (MDSE) Attack

This repository contains the official implementation for the paper:

Attacking the Spike: On the Security of Spiking Neural Networks to Adversarial Examples Nuo Xu, Kaleel Mahmood, Haowen Fang, Ethan Rathbun, Caiwen Ding, Wujie Wen Neurocomputing, Vol. 656, 2025, Article 131506

• DOI: https://doi.org/10.1016/j.neucom.2025.131506
• Publisher (ScienceDirect): https://www.sciencedirect.com/science/article/pii/S0925231225021782
• arXiv: https://arxiv.org/abs/2209.03358

Abstract

This repository implements Mixed Dynamic Spiking Estimation (MDSE), an adversarial attack for evaluating the security and robustness of spiking neural networks (SNNs), CNNs, and Vision Transformers. MDSE uses a dynamic gradient estimation scheme that exploits multiple surrogate gradient estimator functions, generating adversarial examples capable of fooling both SNN and non-SNN models. The paper evaluates the attack across a range of SNN, CNN, and ViT architectures on CIFAR-10, CIFAR-100, and ImageNet.

Keywords

spiking neural networks, SNN, SNN security, adversarial examples, adversarial attacks, adversarial robustness, machine learning security, neuromorphic computing, surrogate gradients, MDSE, PyTorch, SpikingJelly, CIFAR-10, CIFAR-100, ImageNet, vision transformer

Citation

If you use this code, please cite the paper:

@article{xu2025attacking,
  title={Attacking the spike: On the security of spiking neural networks to adversarial examples},
  author={Xu, Nuo and Mahmood, Kaleel and Fang, Haowen and Rathbun, Ethan and Ding, Caiwen and Wen, Wujie},
  journal={Neurocomputing},
  volume={656},
  pages={131506},
  year={2025},
  publisher={Elsevier},
  doi={10.1016/j.neucom.2025.131506}
}

Features

• MDSE Attack: Dynamic gradient estimation attack for SNNs
• Multi-Model Support: Attack both CNN and SNN models
• Multiple Surrogate Gradients: Support for Arctan, Linear, STDB, Erfc, Logistic, etc.
• Attack Methods: MDSE, SAGA, MIM, PGD, AutoPGD, Greedy attacks
• Datasets: CIFAR-10 and CIFAR-100 (ImageNet code paths exist but require ImageNet data and pretrained weights, which are not included)
• Model Architectures: VGG-16 CNN and DietSNN are used by the demo; ViT, BiT, ResNet and SpikingJelly loaders are included but require separately downloaded weights

Quick Start

# Clone the repository
git clone https://github.com/nuoxuxxx/attacking-the-spike-mdse.git
cd attacking-the-spike-mdse

# Install dependencies
conda env create -f SNN_environment.yml
conda activate pytorch

# Download models
# Download from Google Drive link below and extract to ./ann and ./snn directories

# Run MDSE attack
python MDSE_twomodel.py

Step by Step Guide

1. Install the packages listed in the Software Installation Section (see below)
2. Download the models from the Google Drive link listed in the Models Section
3. Move the Models folder into the directory ".\ann" and ".\snn"
4. Open the MDSE_twomodel.py file in the Python IDE of your choice. Fill the downloaded model directory. Run the main.

Usage Examples

Basic MDSE Attack:

# Default: CNN + SNN attack on CIFAR-10
AttackMethods.MDSE_two(modelDir1, SNNmodelDir2, dataset='CIFAR10')

Different Datasets:

# CIFAR-100
AttackMethods.MDSE_two(modelDir1, SNNmodelDir2, dataset='CIFAR100')

Different Attack Methods:

# SAGA attack
AttackMethods.SNN_SAGA(modelDir, syntheticmodelDir, dataset, secondcoeff=0.5)

# MDSE attack
AttackMethods.SNN_MDSE_two(modelDir1, modelDir2, dataset)

# SNN vs SNN attack
AttackMethods.SNN_MDSE_two_snnsnn(modelDir1, modelDir2, dataset)

Attack Parameters

MDSE Attack Parameters

• epsMax: 0.031 (maximum perturbation)
• numSteps: 40 (number of attack iterations)
• epsStep: 0.01 (step size)
• batchSize: 100 (batch size for attack)
• alphaLearningRate: 100000 (learning rate for gradient estimation)
• fittingFactor: 50.0 (fitting factor for optimization)

Supported Surrogate Gradient Functions

• Arctan: Arctangent surrogate gradient
• Linear: Linear surrogate gradient
• STDB: Spike-timing-dependent plasticity
• Erfc: Error function
• Logistic: Logistic function
• Sigmoid: Sigmoid function
• PiecewiseQuadratic: Piecewise quadratic
• STBPActFun: STBP activation function
• FastSigmoid: Fast sigmoid approximation

Model Configurations

• CNN Models: VGG-16, ResNet-56
• SNN Models: DietSNN, SpikingJelly ResNet, VGG-SNN
• Transformer Models: ViT-L-16, ViT-B-16, BiT-M-R50x1, BiT-M-R152x4 (if models are available)

Software Installation

We use the following software packages:

• pytorch==1.12.1
• torchvision==0.13.0
• numpy
• opencv-python
• spikingjelly

Installation via conda (recommended):

# Option 1: Use the simplified environment file
conda env create -f environment.yml
conda activate mdse

# Option 2: Use the full environment file (includes all dependencies)
conda env create -f SNN_environment.yml
conda activate pytorch

Installation via pip:

pip install -r requirements.txt

Manual installation:

pip install torch==1.12.1 torchvision==0.13.0
pip install numpy opencv-python spikingjelly
pip install timm scikit-learn matplotlib tqdm

There are more packages needed to run certain models, you may install if needed. We upload one environment yml file as reference, but there are some unnecessary libs if you only need to run the demo attack.

Models

The code supports the following model architectures:

• VGG-16 (CNN and SNN versions)
• ResNet (ResNet-56, ResNet-152)
• BP trained SNNs (Backpropagation-trained SNNs)
• DietSNN (Diet Spiking Neural Networks)
• SpikingJelly Models (Various SNN architectures)
• Transformer Models (ViT, BiT)

Download models: https://drive.google.com/drive/folders/1Evl7xhZUvwZGSaKJaIE2gwGZJCTQ3yDM?usp=sharing

Note: Model files need to be downloaded separately and placed in the appropriate directories.

System Requirements

• OS: Linux/macOS/Windows (Ubuntu 20.04.5 tested)
• GPU: CUDA-compatible GPU (recommended)
• RAM: 16GB+ (recommended)
• CUDA: 11.7+ (required for GPU acceleration)

Performance Notes:

• Attacks on ImageNet models may take longer due to larger image sizes
• CIFAR-10 attacks typically complete in reasonable time
• Performance depends on hardware specifications and model complexity

Troubleshooting

Common Issues

1. CUDA Out of Memory:

# Reduce batch size
batchSize = 32  # instead of 100

2. Model Loading Errors:

• Ensure model files are in correct directories (./ann and ./snn)
• Check model file paths in MDSE_twomodel.py

3. Import Errors:

# Install missing packages
pip install spikingjelly
pip install timm  # for transformer models

4. Performance Issues:

• Use smaller batch sizes for limited GPU memory
• Reduce numSteps for faster attacks
• Use fewer surrogate gradient functions

Getting Help

If you encounter issues:

1. Check the troubleshooting section above
2. Search existing GitHub issues
3. Create a new issue with detailed error information
4. Contact the authors

License

This project is licensed under the MIT License - see the LICENSE file for details.

Contact

For questions or concerns please contact the author at:

• nux219@lehigh.edu
• kaleel.mahmood@uri.edu
• hfang02@syr.edu