Deep neural networks (DNNs) have achieved excellent results in various tasks, including image and speech recognition. However, optimizing the performance of DNNs requires careful tuning of multiple hyperparameters and network parameters via training. High-performance DNNs utilize a large number of parameters, corresponding to high energy consumption during training. To address these limitations, researchers have developed spiking neural networks (SNNs), which are more energy-efficient and can process data in a biologically plausible manner, making them well-suited for tasks involving sensory data processing, i.e., neuromorphic data. Like DNNs, SNNs are vulnerable to various threats, such as adversarial examples and backdoor attacks. Yet, the attacks and countermeasures for SNNs have been almost fully unexplored. This paper investigates the application of backdoor attacks in SNNs using neuromorphic datasets and different triggers. More precisely, backdoor triggers in neuromorphic data can change their position and color, allowing a larger range of possibilities than common triggers in, e.g., the image domain. We propose different attacks achieving up to 100\% attack success rate without noticeable clean accuracy degradation. We also evaluate the stealthiness of the attacks via the structural similarity metric, showing our most powerful attacks being also stealthy. Finally, we adapt the state-of-the-art defenses from the image domain, demonstrating they are not necessarily effective for neuromorphic data resulting in inaccurate performance.
翻译:深度神经网络(DNN)在包括图像和语音识别在内的各种任务中取得了优异的成果。然而,优化DNN的性能需要通过培训对多个超参数和网络参数进行仔细调整。高性能的DNN使用大量参数,相当于培训期间的高能量消耗量。为解决这些局限性,研究人员开发了飞跃神经网络(SNNN),这些网络的能效更高,能够以生物上合理的方式处理数据,使其非常适合涉及感官数据处理的任务,即神经变形数据。像DNNS一样,SNNS很容易受到各种威胁,例如对抗性实例和后门攻击。然而,对SNNNN的攻击和对应措施几乎完全没有被探索。本文调查了SNNNN的后门攻击应用情况,使用神经变形数据集和不同的触发器。更精确地说,神经变形数据的后门触发器可以改变其位置和颜色,使得其可能性比普通的触发器更为广泛,例如神经变形数据。像DNNNNNN一样,S,SNNNNN很容易受到各种威胁,例如对抗的例子和后门攻击。然而,因此,SNNNNNNNNNNNNNNNNNE攻击的域的域内攻击的域内攻击的域内势必然会导致有效的性攻击的有效性攻击的准确性也显示最明显的性攻击,我们最后的地面攻击的精确性也显示最明显的攻击的精确性,我们最后显示的精确性,我们通过100次的地面攻击的精确性,我们所造式攻击的精确性,最后显示的精确性。我们提出的攻击的精确性,我们最接近于不显示的是结构的攻击性,我们所攻击的精确性,最后显示的是,我们所攻击的精确性,我们所攻击的精确性,我们所造攻击的精确性,我们所造攻击的精确性,最后显示的精确性,我们所造攻击的精确性,我们所造的攻击性,最后显示的精确性,我们所造攻击的精确性,我们所造的精确性攻击的精确性攻击的精确性攻击的精确性,最后的精确性攻击的精确性攻击的精确性攻击的精确性攻击的精确性攻击的精确性能。我们所造的精确性,最后显示的精确性。我们的