1 of 29

Certified Robustness: An Enquiry

Bhaskar Mukhoty

IIT Delhi

2 of 29

Adversarial Attacks

Image Courtesy: Goodfellow, Ian J., Jonathon Shlens, and Christian Szegedy. "Explaining and harnessing adversarial examples." arXiv preprint arXiv:1412.6572 (2014).

3 of 29

Formulating Adversarial Attacks

4 of 29

Generating Adversarial Attacks

step length

5 of 29

Standard vs. Robust Accuracy

Std.	GN	FGSM	PGD
92.15	90.62	10.68	0.1

6 of 29

Robustness Verification

Soundness:

Probabilistic:

7 of 29

Robustness Verification: Complete vs. Incomplete

Soundness ensures no false positive, while completeness ensures there is no false negative.

Completeness:

Incompleteness:

8 of 29

Lipschitzness Implies Robustness

Jerry Li. Lecture 14: Certified defenses iii: Randomized smoothing. https://jerryzli. github.io/robust-ml-fall19/lec14.pdf, 2019

Image Courtesy: Wikipedia

9 of 29

Lipschitzness Implies Robustness

10 of 29

An Example: Spiking Neurons

ANN

SNN, any T

SNN, T=1

Binary Activation

Temporal Dimension

Binary Input

Reset

Exp. Avg.

Efficient Accumulation

11 of 29

Robustness (at Test) and Input Encoding

0

1

0.7

0

1

0.75

Rate Encoding, T=4

Constant Encoding, T=4

Robust

Not Robust

Adv. Perturbation

12 of 29

Randomized Smoothing via Bernoulli Noise

Bhaskar Mukhoty*, Hilal AlQuabeh*, Giulia De Masi, Huan Xiong, and Bin Gu, Certified adversarial robustness for rate encoded spiking neural networks, ICLR 2024 [*first co-author]

13 of 29

Certified Accuracy

14 of 29

Adversarial Robustness in Rate-encoded SNN

Rate-encoded SNNs are more robust to adversarial attacks compared to constant-encoded SNNs.

Can we prove robustness without taking expectation on input?

How about robustness against other norms?

How about attacks on the encoding itself?

	Standard	GN	FGSM	PGD
Constant Enc.	92.15	90.62	10.68	0.1
Rate Enc.	79.55	78.62	43.69	37.37

15 of 29

SEA: Sparse Encoding Attack

Bhaskar Mukhoty, Hilal AlQuabeh, Bin Gu, Improving Generalization and Robustness in SNNs Through Signed Rate Encoding and Sparse Encoding Attacks, ICLR 2025

Given input gradient, SEA has closed for solution offering much stronger attack on changing only few pixels in each encoding frame.

Accuracy	Standard	FGSM	PGD	SEA, k=10	SEA, k=20
CIFAR-10	82.05	44.3	36.88	39.61	29.06
SVHN	89.44	43.37	35.46	34.62	23.55

16 of 29

Incomplete Verification: Interval Bound Propagation

Mao, Yuhao, Mark Niklas Mueller, Marc Fischer, and Martin Vechev. "Understanding Certified Training with Interval Bound Propagation." In The Twelfth International Conference on Learning Representations.

17 of 29

Certified Training vs. Adversarial Training

Mao, Yuhao, Mark Niklas Mueller, Marc Fischer, and Martin Vechev. "Understanding Certified Training with Interval Bound Propagation." In The Twelfth International Conference on Learning Representations.

Adversarial Training under approximates the inner maximization by finding adversarial example.

18 of 29

Open Problems

19 of 29

Questions �& �Discussions��

20 of 29

Spiking Neurons : Brief Introduction

Biological neurons require much less energy to operate than standard artificial neural networks.

One of the salient features of biological neurons is their communication through spikes.

Further, they have an event-driven and asynchronous computation model.

A neuron cell membrane accumulates the input spikes over time and sends an output spike whenever the membrane potential exceeds a predetermined threshold.

21 of 29

Blouw, Peter, et al. "Benchmarking keyword spotting efficiency on neuromorphic hardware." Proceedings of the 7th annual neuro-inspired computational elements workshop. 2019.

Why Spiking Neural Networks are Helpful?

Intel’s Loihi

IBM’s TrueNorth

22 of 29

LIF Neuron Dynamics : Euler Discretization

soft-reset

Heaviside

23 of 29

LIF Neuron Dynamics : Unrolled

24 of 29

Randomized Smoothing via Bernoulli Noise

25 of 29

Experimental Results: Certified Accuracy and Robust Accuracy

26 of 29

Proof Sketch

27 of 29

Randomized Smoothing

Cohen, Jeremy, Elan Rosenfeld, and Zico Kolter. "Certified adversarial robustness via randomized smoothing." international conference on machine learning. PMLR, 2019.

28 of 29

Randomized Smoothing

Cohen, Jeremy, Elan Rosenfeld, and Zico Kolter. "Certified adversarial robustness via randomized smoothing." international conference on machine learning. PMLR, 2019.

29 of 29

Randomized Smoothing via Bernoulli Noise

Bhaskar Mukhoty*, Hilal AlQuabeh*, Giulia De Masi, Huan Xiong, and Bin Gu, Certified adversarial robustness for rate encoded spiking neural networks, in The Twelfth International Conference on Learning Representations 2024 [*first co-author]