Pith. sign in

REVIEW 6 major objections 5 minor 43 references

Towards Robust Spiking Neural Networks:Mitigating Heterogeneous Training Vulnerability via Dominant Eigencomponent Projection

T0 review · 6 major / 5 minor · reviewed 2026-08-15 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read Projecting away the largest singular component of each gradient prevents spiking neural networks from collapsing when training data distribution shifts.

desk verdict Empirically strong SNN robustness fix with a shaky theoretical story; the DEP method works across datasets but the claimed Hessian spectral radius reduction mechanism isn't proven. read the letter →

arxiv 2505.11134 v1 pith:PB56F3Y2 submitted 2025-05-16 cs.LG cs.CV

Desong Zhang , Jia Hu , Geyong Min This is my paper · ORCID
classification cs.LGcs.CV MSC 68T07
keywords spikingneuralnetworksadversarialrobustnessHessianspectralradiusdominanteigencomponentprojectionheterogeneoustrainingbackpropagationthroughtimesharpminimamodelcollapse
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

This paper claims that spiking neural networks trained the standard way—direct encoding plus backpropagation through time—are one bad batch away from total collapse, because those two mechanisms inflate the largest eigenvalue of the loss's curvature matrix. It proposes Dominant Eigencomponent Projection (DEP), a hyperparameter-free step that computes the gradient's largest singular component each batch and projects the update orthogonal to it. The paper argues this provably lowers the Hessian's spectral radius, keeps the network away from sharp minima, and thereby protects against both deliberately poisoned training batches and adversarial test-time attacks. The reported experiments back this up across CIFAR-10/100, TinyImageNet, and ImageNet, with DEP beating existing SNN defenses under FGSM and PGD attacks while also preventing catastrophic collapse during heterogeneous training.

What carries the argument

The central object is the Dominant Eigencomponent Projection (DEP) operator $P_{u_1 v_1^{\top}}(A) = \langle A, u_1 v_1^{\top} \rangle_F \, u_1 v_1^{\top} / \|u_1 v_1^{\top}\|_F^2$, applied to the matrixized gradient $M(\nabla_\theta L(\theta))$ obtained by reshaping the $k$-dimensional gradient tensor into an $m \times n$ matrix and taking its top singular vectors. Removing this component leaves an update whose quadratic form against the Hessian is at most $\lambda_2 < \lambda_1$, so the effective curvature along the chosen direction is strictly smaller than the spectral radius. This is what transfers the theoretical analysis—that BPTT's multiplicative gradient accumulation and direct encoding's repeated identical inputs inflate $\rho(H)$ exponentially in the time steps $T$—into a training procedure that avoids sharp minima.

What would settle it

Train an SNN with DEP while logging each batch the cosine similarity between the vectorized leading singular component $u_1 v_1^{\top}$ and the Hessian's top eigenvector (computed via Hessian-vector products). If the alignment is weak through training, the claimed spectral-radius reduction in Eq. (18) is not the operative mechanism, and the robustness gains would have to be attributed to generic gradient smoothing.

Watch

Extended reading notes

Core claim

DEP is the discovery: an orthogonal projection that removes from the gradient its dominant eigencomponent—the outer product $u_1 v_1^{\top}$ of the leading singular vectors of the matrixized gradient—before the gradient is applied. The paper's central claim is that this single deterministic step reduces the Hessian spectral radius, because the dominant singular direction of the gradient is (the paper assumes) aligned with the top Hessian eigenvector; removing it forces the update to lie in the subspace of curvature bounded by the second eigenvalue $\lambda_2$. Across clean, FGSM, and PGD evaluation on four datasets, DEP-trained SNNs show substantially lower $\rho(H)$ and a smaller share of the spectral radius in the top-five eigenvalues, which the paper ties to smoother loss landscapes and better robustness. In heterogeneous training, where one batch per epoch is swapped for differently-distributed data, DEP keeps the model from collapsing even at poisoning strength $b = 5$, the point where the vanilla SNN baseline fails completely.

Load-bearing premise

The proof that DEP lowers the Hessian's spectral radius depends on the top singular vectors of the gradient being aligned with the Hessian's dominant eigenvector, an alignment the paper asserts but never measures.

Editorial extensions

If this is right

  • DEP reduces the Hessian spectral radius of trained SNNs, measured both at clean inference and under FGSM and PGD attacks, which the paper ties to smoother loss landscapes.
  • DEP improves white-box adversarial robustness over existing SNN defenses, with double-digit accuracy gains in several FGSM and PGD settings on CIFAR-100, TinyImageNet, and ImageNet.
  • In heterogeneous training, DEP prevents catastrophic model collapse even when several poisoned batches are injected per epoch, where vanilla SNNs drop to near-zero accuracy.
  • DEP passes the standard gradient-obfuscation checklist, meaning its robustness comes from genuine invariance rather than from masking gradients.
  • DEP is hyperparameter-free and adds only one SVD and one projection per training batch, with no extra inference cost.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • Beyond the paper: if the gradient's leading singular direction reliably approximates the top Hessian eigenvector in other temporal models, the same projection would offer a cheap regularizer against sharp minima in recurrent networks, transformers with long context, and online continual learning.
  • Beyond the paper: the clean-accuracy cost of DEP (roughly 3–5 points) suggests a robustness–accuracy tradeoff; combining DEP with knowledge distillation or with perturbations that only remove the dominant component on poisoned batches might reclaim most of that loss.
  • Beyond the paper: a direct test of the mechanism is to measure the cosine similarity between $\operatorname{vec}(u_1 v_1^{\top})$ and the top Hessian eigenvector during training; strong alignment would confirm the proof's premise, weak alignment would suggest the gains come from generic smoothing rather than spectral-radius reduction.
  • Beyond the paper: the batch-level poisoning scenario implies that attackers should concentrate perturbations into single batches; a practical extension is to evaluate DEP against adaptive attacks that interleave clean and poisoned samples across batches to try to circumvent the projection.
Share X Bluesky LinkedIn Reddit HN

Signed reviews

No signed human review yet.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

6 major / 5 minor

Summary. The paper studies a vulnerability of spiking neural networks (SNNs) trained with direct encoding and backpropagation through time (BPTT): introducing a single batch from a slightly different data distribution can cause catastrophic model collapse. The authors attribute this to an exceptionally large Hessian spectral radius produced by repeated inputs in direct encoding and multiplicative gradient accumulation in BPTT. They propose Dominant Eigencomponent Projection (DEP), a hyperparameter-free method that removes the dominant singular component of the gradient before each update, claiming this reduces the Hessian spectral radius and prevents sharp minima. The empirical evaluation is extensive: on CIFAR-10/100, TinyImageNet, and ImageNet, DEP improves robustness against FGSM and PGD attacks in both vanilla and adversarial training, reduces inference-time Hessian eigenvalues, and partially mitigates collapse under batch-level heterogeneous poisoning. The paper includes a gradient-obfuscation checklist and black-box attack results.

Significance. The paper identifies a practically important and previously underappreciated failure mode of SNNs trained with direct encoding and BPTT, and it proposes a simple, cheap, and hyperparameter-free mitigation with sizeable robustness gains in multiple settings. The empirical study is broad and includes white-box and black-box attacks, a Hessian analysis, and a heterogeneous-training protocol with explicit poisoning settings. If the empirical claims hold, DEP is a useful addition to the SNN robustness toolbox. However, the paper's central theoretical contribution—the root-cause analysis and the proof that DEP reduces the Hessian spectral radius—is not rigorous. The derivation in Sec. 3.2 relies on an unproven alignment between gradient singular vectors and Hessian eigenvectors, and the quantity bounded in Eq. (18) is not the spectral radius. The empirical Hessian measurements (Table 2) are consistent with the mechanism but do not establish it. The paper would be acceptable if the theory is substantially weakened or corrected and the claims are brought in line with what is actually shown.

major comments (6)
  1. [§3.2, Eqs. (16)-(18)] The derivation treats the left and right singular vectors u_i, v_i of the gradient matrix as if they were eigenvectors of the Hessian H(θ). Eq. (17) asserts κ_std ≈ λ_1 based on alignment of the gradient with 'the principal Hessian eigenvector u_1 v_1^T', and Eq. (18) expands the projected gradient in the basis {u_i v_i^T} to compute the Rayleigh quotient. For a general neural-network Hessian there is no reason for the gradient's singular vectors to coincide with Hessian eigenvectors, and no proof is supplied. Without this identification, the inequality κ_DEP ≤ λ_2 is not established.
  2. [§3.2, Eq. (18)] Even if the algebra of the Rayleigh quotient were correct, κ_DEP is the curvature along one particular update direction, namely v^T H v / ||v||^2. It is not the spectral radius ρ(H) = max_{x≠0} x^T H x / ||x||^2. Bounding the curvature along the projected gradient says nothing about the maximum over all directions, so the claim that 'DEP strictly reduces the spectral radius of the Hessian' does not follow. The authors should either replace 'spectral radius' with 'local sharpness along the update direction' or provide a genuine bound on ρ(H).
  3. [§3.2, Eq. (18)] The expansion on the right-hand side sums only over the 'diagonal' terms u_i v_i^T for i = 2,...,mn. The set {u_i v_i^T} is not a basis of the orthogonal complement of u_1 v_1^T; cross terms u_i v_j^T with i ≠ j also contribute to any vector orthogonal to u_1 v_1^T. Consequently, the denominator and numerator in the expression for κ_DEP are not the full projections of the gradient, and the inequality does not follow even under the (unproven) alignment assumption.
  4. [§3.1, Eqs. (6)-(11)] The 'root cause' analysis relies on unstated approximations. In particular, Eq. (7) replaces the sum of squared gradient norms by T exp(2T λ̄_J), and Eq. (11) multiplies the BPTT and direct-encoding factors without derivation. These steps are heuristic; the paper does not prove that the Hessian spectral radius grows as claimed. The experimental observation of collapse in Fig. 2 is credible, but the theoretical attribution to an exceptionally large ρ(H) is not established by the present analysis.
  5. [§4.4, Table 3] With b=1, DEP already loses about 50 points of clean accuracy on CIFAR-10 under c/+p_0 (90.21% to 40.58%) and similar drops on other datasets. While the degradation is less catastrophic than the near-total failure of the vanilla baseline, it still constitutes a major collapse, which conflicts with the abstract's statement that DEP 'prevents' catastrophic model collapse. The claims in the Abstract and Section 1 should be softened to 'mitigates', and the residual vulnerability should be discussed.
  6. [§4.3, Table 2] The Hessian measurements are consistent with the proposed mechanism but do not validate it. DEP alters the training trajectory, so lower ρ(H) at inference could result from any form of gradient smoothing and does not confirm that the projection reduces the spectral radius during training. A controlled experiment (e.g., measuring ρ(H) before and after individual DEP updates) would be needed to support the causal claim.
minor comments (5)
  1. [§5] The Conclusion refers to the method as 'Domain Eigencomponent Projection'; the name used elsewhere is 'Dominant Eigencomponent Projection'.
  2. [Abstract] The abstract contains the typo 'dis crete' instead of 'discrete'.
  3. [§3.2] The notation vec(M(∇θL(θ))) is used in Eq. (17), but H(θ) is defined on R^{mn×mn}; the vectorization operator should be introduced explicitly before its first use.
  4. [§3.2, Eq. (16)] The eigenvalue ordering λ_1 > λ_2 ≥ ... assumes positive leading eigenvalues. Since Table 2 reports Pr(H) > 1, indicating negative eigenvalues among the top five, the authors should state whether |λ_1| or λ_1 is intended in the inequalities.
  5. [§1] The claim that DEP is 'hyperparameter-free' should clarify that the number of projected components is fixed to one; the projection rank could be viewed as a design choice. Also, the broader-impact statement that DEP introduces 'negligible computational overhead' would benefit from a runtime comparison against baselines.

Circularity Check

1 steps flagged · score 6.0 of 10

Empirical robustness gains are independently benchmarked, but the theoretical guarantee that DEP reduces the Hessian spectral radius is definitional: the gradient's dominant singular vectors (Eq. 13) are silently identified with the Hessian's dominant eigenvector (Eqs. 17-18), making the reduction a restatement of the identification.

  1. self definitional [Sec. 3.2, Eqs. (12)-(18)]
    "We define the dominant eigencomponent ... as the outer product of leading singular vectors u1, v1, that is, u1v⊤1. ... This scenario is particularly pronounced when the gradient is closely aligned with the principal Hessian eigenvector u1v⊤1. ... after the DEP update, the resulting gradient direction ... is explicitly projected orthogonal to u1v⊤1, rigorously ensuring a curvature bound given by Eq. (18). ... Thus, DEP strictly reduces the spectral radius of the Hessian."

    Eq. (13) defines u1v1^T as the leading singular component of the gradient matrix M(∇θL), not of the Hessian H(θ). Eqs. (17)-(18) then reuse the same outer-product basis as the eigendecomposition of H(θ), calling u1v1^T 'the principal Hessian eigenvector' and bounding κDEP by λ2 after projecting it out. The claimed reduction of the Hessian spectral radius is therefore a tautological consequence of the identification of the gradient's dominant singular component with the Hessian's dominant eigencomponent; the proof assumes the very correspondence needed to establish the conclusion. Table 2's lower measured ρ(H) is a post-hoc trajectory effect, not an independent validation of this identification.

full rationale

The paper's headline empirical contribution is not circular: DEP is a fixed, hyperparameter-free gradient transform evaluated against independent SOTA baselines (StoG, DLIF, HoSNN, FEEL) and standard attacks (FGSM, PGD) on CIFAR-10/100, TinyImageNet, and ImageNet, with white-box and black-box checks. Those accuracy numbers are external, and the robustness gains do not depend on fitting any parameter to the reported metrics. The theoretical mechanism section, however, contains a definitional short-circuit. Eq. (13) defines the 'dominant eigencomponent' as the leading singular vectors of the gradient matrix. Eqs. (17)-(18) then identify this object with the principal Hessian eigenvector and use the same SVD outer products as the eigenbasis of H(θ). Under that identification, projecting out u1v1^T trivially yields κDEP ≤ λ2; the 'reduction of the spectral radius' is a restatement of the assumption that the removed gradient direction is the dominant Hessian direction. This is not an externally derived mathematical fact. Because the empirical claims are self-contained and no load-bearing self-citations appear, the circularity is confined to the theoretical guarantee, but it does affect the paper's central explanatory claim that DEP reduces the Hessian spectral radius. Hence a partial-circularity score of 6 is appropriate.

Assumptions & free parameters 0 free parameters · 3 assumptions · 0 invented entities

The central claim rests on two unproven premises: (1) that large Hessian spectral radius is the cause of model collapse in hetero-training, and (2) that the gradient's dominant singular component aligns with the Hessian's dominant eigenvector. The first is a domain assumption supported only by correlation; the second is an ad hoc assumption introduced in the DEP proof. The method itself introduces no new physical entities or fitted constants.

assumptions (3)
  • domain assumption Large Hessian spectral radius is the cause of catastrophic collapse in hetero-training.
    The paper links sharp minima (large ρ(H)) to instability, citing [3], but does not prove that a single bad batch collapse is caused by ρ(H) rather than other optimization effects. Location: Sec. 3.1.
  • ad hoc to paper The gradient's leading singular vectors align with the Hessian's dominant eigenvector.
    Eq (18) claims κ_DEP ≤ λ2 by assuming the projected gradient's components along Hessian eigenvectors (u_i v_i^T) are the same as the SVD basis of the gradient. This is not established and is generally false; without it, projecting out the top gradient singular component does not guarantee a reduction in Hessian spectral radius. Location: Sec. 3.2, Eq (16)-(18).
  • domain assumption BPTT gradient accumulation leads to exponential growth as in Eq (6).
    The approximation in Eq (6) treats the Jacobian product as multiplicative with average log-eigenvalue; this is a heuristic common in RNN analysis but not a rigorous bound. Location: Sec. 3.1 Eq (5)-(7).

how reviews work

0 comments
Cite this review

Pith. "Pith review of Towards Robust Spiking Neural Networks:Mitigating Heterogeneous Training Vulnerability via Dominant Eigencomponent Projection." pith.science (2026). https://pith.science/paper/PB56F3Y2

@misc{pith2026250511134,
  author       = {Pith},
  title        = {Pith review of: Towards Robust Spiking Neural Networks:Mitigating Heterogeneous Training Vulnerability via Dominant Eigencomponent Projection},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/PB56F3Y2}},
  note         = {Machine review of arXiv:2505.11134}
}
read the original abstract

Spiking Neural Networks (SNNs) process information via discrete spikes, enabling them to operate at remarkably low energy levels. However, our experimental observations reveal a striking vulnerability when SNNs are trained using the mainstream method--direct encoding combined with backpropagation through time (BPTT): even a single backward pass on data drawn from a slightly different distribution can lead to catastrophic network collapse. Our theoretical analysis attributes this vulnerability to the repeated inputs inherent in direct encoding and the gradient accumulation characteristic of BPTT, which together produce an exceptional large Hessian spectral radius. To address this challenge, we develop a hyperparameter-free method called Dominant Eigencomponent Projection (DEP). By orthogonally projecting gradients to precisely remove their dominant components, DEP effectively reduces the Hessian spectral radius, thereby preventing SNNs from settling into sharp minima. Extensive experiments demonstrate that DEP not only mitigates the vulnerability of SNNs to heterogeneous data poisoning, but also significantly enhances overall robustness compared to key baselines, providing strong support for safer and more reliable SNN deployment.

Figures

Figures reproduced from arXiv: 2505.11134 by the authors.

Figure 1
Figure 1. The vulnerability of SNNs in heterogeneous traini [PITH_FULL_IMAGE:figures/full_fig_p002_1.png] view at source ↗
Figure 2
Figure 2. SNN model collapse curves caused by hetero-traini [PITH_FULL_IMAGE:figures/full_fig_p004_2.png] view at source ↗
Figure 3
Figure 3. Performance comparison in different white box and [PITH_FULL_IMAGE:figures/full_fig_p007_3.png] view at source ↗
Figures from the paper (1 more)
Figure 4
Figure 4. Figure 4: Acc. in different K. 5 Conclusion and Discussion Conclusion. In this paper, we experimentally demonstrate that SNNs trained with direct encod￾ing and BPTT can undergo catastrophic model collapse when hetero-training which is common in real-world scenarios. Through theo…

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

43 extracted references · 33 canonical work pages

  1. [1]

    Obfu scated gradients give a false sense of security: Circumventing defenses to adversarial exampl es

    Anish Athalye, Nicholas Carlini, and David Wagner. Obfu scated gradients give a false sense of security: Circumventing defenses to adversarial exampl es. In International conference on machine learning, pages 274–283. PMLR, 2018

    work page 2018

  2. [2]

    High-performance large-scale image recognition without normalization

    Andy Brock, Soham De, Samuel L Smith, and Karen Simonyan. High-performance large-scale image recognition without normalization. In International conference on machine learning , pages 1059–1071. PMLR, 2021

    work page 2021

  3. [3]

    Why adversarial training of relu networks is difficult? arXiv preprint arXiv:2205.15130 , 2022

    Xu Cheng, Hao Zhang, Y ue Xin, Wen Shen, Jie Ren, and Quansh i Zhang. Why adversarial training of relu networks is difficult? arXiv preprint arXiv:2205.15130 , 2022

    arXiv 2022

  4. [4]

    Imagenet: A large- scale hierarchical image database

    Jia Deng, Wei Dong, Richard Socher, Li-Jia Li, Kai Li, and Li Fei-Fei. Imagenet: A large- scale hierarchical image database. In 2009 IEEE conference on computer vision and pattern recognition, pages 248–255. Ieee, 2009

    2009

  5. [5]

    Te mporal efficient training of spiking neural network via gradient re-weighting

    Shikuang Deng, Y uhang Li, Shanghang Zhang, and Shi Gu. Te mporal efficient training of spiking neural network via gradient re-weighting. arXiv preprint arXiv:2202.11946 , 2022

    arXiv 2022

  6. [6]

    Snn-rat: Robustness- enhanced spiking neural network through regularized adver sarial training

    Jianhao Ding, Tong Bu, Zhaofei Y u, Tiejun Huang, and Jian Liu. Snn-rat: Robustness- enhanced spiking neural network through regularized adver sarial training. Advances in Neural Information Processing Systems, 35:24780–24793, 2022

    work page 2022

  7. [7]

    Robust Stable Spiking Neural Networks

    Jianhao Ding, Zhiyu Pan, Y ujia Liu, Zhaofei Y u, and Tieju n Huang. Robust stable spiking neural networks. arXiv preprint arXiv:2405.20694 , 2024

    work page Pith review arXiv 2024

  8. [8]

    En hancing the robustness of spiking neural networks with stochastic gating mechanisms

    Jianhao Ding, Zhaofei Y u, Tiejun Huang, and Jian K Liu. En hancing the robustness of spiking neural networks with stochastic gating mechanisms. In Proceedings of the AAAI Conference on Artificial Intelligence , volume 38, pages 492–502, 2024

    work page 2024

Show all 43 references
  1. [9]

    Spiking jelly: An open-source machine learning infrastructure platform for spike-based intelligence

    Wei Fang, Y anqi Chen, Jianhao Ding, Zhaofei Y u, Timothée Masquelier, Ding Chen, Li- wei Huang, Huihui Zhou, Guoqi Li, and Y onghong Tian. Spiking jelly: An open-source machine learning infrastructure platform for spike-based intelligence. Science Advances , 9(40):eadi1480, 2023

    2023

  2. [10]

    Deep residual learning in spiking neural networks

    Wei Fang, Zhaofei Y u, Y anqi Chen, Tiejun Huang, Timothée Masquelier, and Y onghong Tian. Deep residual learning in spiking neural networks. Advances in Neural Information Processing Systems, 34:21056–21069, 2021

    2021

  3. [11]

    Hosnn: Adversarially-robust ho meostatic spiking neural networks with adaptive firing thresholds

    Hejia Geng and Peng Li. Hosnn: Adversarially-robust ho meostatic spiking neural networks with adaptive firing thresholds. arXiv preprint arXiv:2308.10373 , 2023

    2023 arXiv

  4. [12]

    An i nvestigation into neural net opti- mization via hessian eigenvalue density

    Behrooz Ghorbani, Shankar Krishnan, and Ying Xiao. An i nvestigation into neural net opti- mization via hessian eigenvalue density. In International Conference on Machine Learning , pages 2232–2241. PMLR, 2019

    2019

  5. [13]

    Explaining and harnessing adver- sarial examples

    Ian J Goodfellow, Jonathon Shlens, and Christian Szege dy. Explaining and harnessing adver- sarial examples. arXiv preprint arXiv:1412.6572 , 2014

    2014 arXiv

  6. [14]

    Fully spiking neural network for legged robots

    Xiaoyang Jiang, Qiang Zhang, Jingkai Sun, Jiahang Cao, Jingtong Ma, and Renjing Xu. Fully spiking neural network for legged robots. In ICASSP 2025-2025 IEEE International Confer- ence on Acoustics, Speech and Signal Processing (ICASSP) , pages 1–5. IEEE, 2025

    2025

  7. [15]

    Y oungeun Kim, Hyoungseob Park, Abhishek Moitra, Abhir oop Bhattacharjee, Y eshwanth V enkatesha, and Priyadarshini Panda. Rate coding or direct coding: Which one is better for accurate, robust, and energy-efficient spiking neural netw orks? In ICASSP 2022-2022 IEEE Internation...

    2022

  8. [16]

    Learning mult iple layers of features from tiny images

    Alex Krizhevsky, Geoffrey Hinton, et al. Learning mult iple layers of features from tiny images. 2009. 10

    2009

  9. [17]

    Dsqn: Robust path plannin g of mobile robot based on deep spiking q-network

    Aakash Kumar, Lei Zhang, Hazrat Bilal, Shifeng Wang, Al i Muhammad Shaikh, Lu Bo, Avinash Rohra, and Alisha Khalid. Dsqn: Robust path plannin g of mobile robot based on deep spiking q-network. Neurocomputing, page 129916, 2025

    2025

  10. [18]

    Hire- snn: Harnessing the inherent robustness of energy-efficient deep spiking neural network s by training with crafted input noise

    Souvik Kundu, Massoud Pedram, and Peter A Beerel. Hire- snn: Harnessing the inherent robustness of energy-efficient deep spiking neural network s by training with crafted input noise. In Proceedings of the IEEE/CVF international conference on co mputer vision , pages 5209– 5218, 2021

    2021

  11. [19]

    Ssefusion: Salient semantic enhancement for multimodal medical image fusion with mamba and dynamic spiking neural networks

    Shiqiang Liu, Weisheng Li, Dan He, Guofen Wang, and Y upi ng Huang. Ssefusion: Salient semantic enhancement for multimodal medical image fusion with mamba and dynamic spiking neural networks. Information Fusion, 119:103031, 2025

    2025

  12. [20]

    Energy-effi cient distributed spiking neural network for wireless edge intelligence

    Y anzhen Liu, Zhijin Qin, and Geoffrey Y e Li. Energy-effi cient distributed spiking neural network for wireless edge intelligence. IEEE Transactions on Wireless Communications, 2024

    2024

  13. [21]

    Enhancing adversarial robustness in snns with sparse gradients

    Y ujia Liu, Tong Bu, Jianhao Ding, Zecheng Hao, Tiejun Hu ang, and Zhaofei Y u. Enhancing adversarial robustness in snns with sparse gradients. arXiv preprint arXiv:2405.20355 , 2024

    2024 arXiv

  14. [22]

    Networks of spiking neurons: the third generation of neural network models

    Wolfgang Maass. Networks of spiking neurons: the third generation of neural network models. Neural networks, 10(9):1659–1671, 1997

    1997

  15. [23]

    Towards deep learning models resistant to adversari al attacks

    Aleksander Madry, Aleksandar Makelov, Ludwig Schmidt , Dimitris Tsipras, and Adrian Vladu. Towards deep learning models resistant to adversari al attacks. arXiv preprint arXiv:1706.06083, 2017

    2017 arXiv

  16. [24]

    To- wards memory-and time-efficient backpropagation for train ing spiking neural networks

    Qingyan Meng, Mingqing Xiao, Shen Y an, Yisen Wang, Zhouchen Lin, and Zhi-Quan Luo. To- wards memory-and time-efficient backpropagation for train ing spiking neural networks. In Pro- ceedings of the IEEE/CVF International Conference on Compu ter Vision, pages 6166–6176, 2023

    2023

  17. [25]

    Introductory lectures on convex optimization: A basic cour se, volume 87

    Y urii Nesterov. Introductory lectures on convex optimization: A basic cour se, volume 87. Springer Science & Business Media, 2013

    2013

  18. [26]

    Eg-spikeformer: Eye-ga ze guided transformer on spiking neural networks for medical image analysis

    Yi Pan, Hanqi Jiang, Junhao Chen, Yiwei Li, Huaqin Zhao, Yifan Zhou, Peng Shu, Zihao Wu, Zhengliang Liu, Dajiang Zhu, et al. Eg-spikeformer: Eye-ga ze guided transformer on spiking neural networks for medical image analysis. arXiv preprint arXiv:2410.09674 , 2024

    arXiv

  19. [27]

    Pytorch: An imperative style, high-performa nce deep learning library

    A Paszke. Pytorch: An imperative style, high-performa nce deep learning library. arXiv preprint arXiv:1912.01703, 2019

    1912 arXiv

  20. [28]

    Towards artificial general int elligence with hybrid tianjic chip architecture

    Jing Pei, Lei Deng, Sen Song, Mingguo Zhao, Y ouhui Zhang , Shuang Wu, Guanrui Wang, Zhe Zou, Zhenzhi Wu, Wei He, et al. Towards artificial general int elligence with hybrid tianjic chip architecture. Nature, 572(7767):106–111, 2019

    2019

  21. [29]

    Conversion of continuous-valued deep networks to efficient event-driven networks for image classification

    Bodo Rueckauer, Iulia-Alexandra Lungu, Y uhuang Hu, Mi chael Pfeiffer, and Shih-Chii Liu. Conversion of continuous-valued deep networks to efficient event-driven networks for image classification. Frontiers in neuroscience, 11:682, 2017

    2017

  22. [30]

    Lid ar-driven spiking neural network for collision avoidance in autonomous driving

    Albert Shalumov, Raz Halaly, and Elishai Ezra Tsur. Lid ar-driven spiking neural network for collision avoidance in autonomous driving. Bioinspiration & Biomimetics , 16(6):066016, 2021

    2021

  23. [31]

    A comprehensive analysis on adversari al robustness of spiking neural networks

    Saima Sharmin, Priyadarshini Panda, Syed Shakib Sarwa r, Chankyu Lee, Wachirawit Ponghi- ran, and Kaushik Roy. A comprehensive analysis on adversari al robustness of spiking neural networks. In 2019 International Joint Conference on Neural Networks (IJ CNN), pages 1–8. IEEE, 2019

    2019

  24. [32]

    Inherent adversarial ro- bustness of deep spiking neural networks: Effects of discre te input encoding and non-linear activations

    Saima Sharmin, Nitin Rathi, Priyadarshini Panda, and K aushik Roy. Inherent adversarial ro- bustness of deep spiking neural networks: Effects of discre te input encoding and non-linear activations. In European Conference on Computer Vision, pages 399–414. Springer, 2020. 11

    2020

  25. [33]

    Carsnn: An efficient spiking neural network for event-based autonomous cars on the loihi neuromorphic research processor

    Alberto Viale, Alberto Marchisio, Maurizio Martina, G uido Masera, and Muhammad Shafique. Carsnn: An efficient spiking neural network for event-based autonomous cars on the loihi neuromorphic research processor. In 2021 International Joint Conference on Neural Networks (IJCNN), ...

    2021

  26. [34]

    Ssf: Accelerating training of spiking neural networ ks with stabilized spiking flow

    Jingtao Wang, Zengjie Song, Y uxi Wang, Jun Xiao, Y uran Y ang, Shuqi Mei, and Zhaoxiang Zhang. Ssf: Accelerating training of spiking neural networ ks with stabilized spiking flow. In Proceedings of the IEEE/CVF International Conference on Co mputer Vision, pages 5982– 5991, 2023

    2023

  27. [35]

    Spa tio-temporal backpropagation for training high-performance spiking neural networks

    Y ujie Wu, Lei Deng, Guoqi Li, Jun Zhu, and Luping Shi. Spa tio-temporal backpropagation for training high-performance spiking neural networks. Frontiers in neuroscience, 12:331, 2018

    2018

  28. [36]

    Online training through time for spiking neural networks

    Mingqing Xiao, Qingyan Meng, Zongpeng Zhang, Di He, and Zhouchen Lin. Online training through time for spiking neural networks. Advances in neural information processing systems , 35:20717–20730, 2022

    2022

  29. [37]

    Feel-snn: Robust spiking neural networks with frequency encoding and evolutionary l eak factor

    Mengting Xu, De Ma, Huajin Tang, Qian Zheng, and Gang Pan . Feel-snn: Robust spiking neural networks with frequency encoding and evolutionary l eak factor. Advances in Neural Information Processing Systems, 37:91930–91950, 2024

    2024

  30. [38]

    Hierarchical spiking-based model for efficient image class ification with enhanced feature ex- traction and encoding

    Qi Xu, Y axin Li, Jiangrong Shen, Pingping Zhang, Jian K L iu, Huajin Tang, and Gang Pan. Hierarchical spiking-based model for efficient image class ification with enhanced feature ex- traction and encoding. IEEE Transactions on Neural Networks and Learning Systems , 2022

    2022

  31. [39]

    Pyhessian: Neural networks through the lens of the hessian

    Zhewei Y ao, Amir Gholami, Kurt Keutzer, and Michael W Ma honey. Pyhessian: Neural networks through the lens of the hessian. In 2020 IEEE international conference on big data (Big data), pages 581–590. IEEE, 2020

    2020

  32. [40]

    Spiking neu ral networks in intelligent edge computing

    Guanlei Zhang, Lei Feng, Fanqin Zhou, Zhixiang Y ang, Qi yang Zhang, Alaa Saleh, Praveen Kumar Donta, and Chinmaya Kumar Dehury. Spiking neu ral networks in intelligent edge computing. IEEE Consumer Electronics Magazine , 2024

    2024

  33. [41]

    Autonomous driving with spiking neural networks

    Rui-Jie Zhu, Ziqing Wang, Leilani Gilpin, and Jason Esh raghian. Autonomous driving with spiking neural networks. Advances in Neural Information Processing Systems , 37:136782– 136804, 2024

    2024

  34. [42]

    Defending batch-level label inference and repla cement attacks in vertical federated learning

    Tianyuan Zou, Y ang Liu, Y an Kang, Wenhan Liu, Y uanqin He, Zhihao Yi, Qiang Y ang, and Y a- Qin Zhang. Defending batch-level label inference and repla cement attacks in vertical federated learning. IEEE Transactions on Big Data , 2022. 12 A Adversarial Attack Details and Con...

    2022

  35. [43]

    Table 5: Hyperparameter settings for experiments

    to compute Hessian eigenvalues. Table 5: Hyperparameter settings for experiments. Dataset Model LeaningRate WeightDecay Epoch BatchSize CIFAR-10 VGG-11 0.1 5e-5 300 128 CIFAR-100 VGG-11 0.1 5e-4 300 128 TinyImageNet VGG-16 0.1 5e-4 300 128 ImageNet NF-ResNet-18 [2] 0.1 1e-5 10...

Pith tools

Reviewed August 15, 2026 · model on record in the stance chip above.