A white-box adversarial sample generation method and system for a liquid state machine

Abstract

This invention relates to a white-box adversarial example generation method and system for liquid state machines, belonging to the field of neural network security. It aims to address the problem that existing methods cannot effectively handle non-differentiable cyclic components and gradient calculation failures caused by random pulse coding in liquid state machines. The method constructs a computable and stable gradient propagation path from model loss to the original input through gradient splitting and time-averaged gradient approximation. It includes a cyclic process of forward propagation and backward gradient calculation. The corresponding system includes a data input and preprocessing module, a target model loading and inference module, a gradient calculation module, an attack algorithm integration module, and an adversarial example synthesis and feedback module. This invention achieves an effective white-box attack on liquid state machines for the first time, with advantages such as high attack success rate, good perturbation concealment, and strong scalability, providing a powerful tool for evaluating the security of spiking neural networks.

Description

Technical Field

[0001] This invention belongs to the field of artificial intelligence security and spiking neural network technology, specifically relating to a white-box adversarial sample generation method and system for liquid state machine architecture. Background Technology

[0002] With the rapid development of artificial intelligence technology, deep neural networks have been widely used in key fields such as image recognition, speech processing, and autonomous driving. However, deep neural networks are vulnerable to adversarial attacks. Adding minute perturbations to the input that are imperceptible to the human eye can cause the model to produce high-confidence erroneous outputs, posing a serious challenge to the security of AI systems in practical deployments.

[0003] Spiking neural networks (SNNs), as the third generation of artificial neural networks, leverage the event-driven characteristics of discrete pulses. They offer significant advantages over traditional artificial neural networks in terms of power consumption and latency, making them particularly suitable for resource-constrained deployments in robotics, wearable devices, and edge computing. SNNs process continuous information as discrete pulse sequences by simulating the dynamics of biological neurons. Among these, liquid state machines (LSMs), a typical recurrent spiking neural network architecture, exhibit excellent performance in time-series signal processing tasks due to their fixed, high-dimensional, and dynamic reservoir characteristics, while also having relatively low training costs.

[0004] Currently, research on the adversarial robustness of spiking neural networks is still in its early stages and has significant limitations. Existing research mainly focuses on feedforward spiking convolutional neural networks, while there is a lack of in-depth exploration of the adversarial vulnerability of spiking neural networks with recurrent structures, such as liquid state machines. This is primarily because the core of a liquid state machine—the "liquid layer"—is composed of fixed, non-differentiable recurrent connections, making traditional white-box attack methods based on gradient backpropagation, such as fast gradient sign attacks, inapplicable to this type of structure. When the gradient backpropagates to the liquid layer, it is interrupted due to the non-differentiability of the recurrent connections, resulting in the inability to calculate the effective gradient of the input relative to the loss.

[0005] For liquid state machines, existing work mainly relies on black-box attacks or transfer attacks based on alternative models. Black-box attacks typically require extensive queries to the target model, which is inefficient, and the generated perturbations lack specificity, resulting in limited success rates and large perturbations. The effectiveness of transfer attacks heavily depends on the similarity between the alternative and target models in architecture and decision boundaries; for unique structures like liquid state machines, transfer attacks often perform poorly. Furthermore, the input to liquid state machines is usually a sequence of impulses. For continuous data such as static images, it needs to be encoded into impulses first. This encoding process is usually random, leading to a lack of deterministic, differentiable mapping between the input and the activations within the network, further hindering the direct application of gradient-based white-box attack methods.

[0006] Therefore, there is an urgent need in the current technological field for a white-box adversarial attack method that can effectively attack recurrent spiking neural networks such as liquid state machines. This method needs to solve two core problems: first, how to bypass non-differentiable components in the network and reconstruct effective input gradients; second, how to overcome gradient noise and instability caused by random pulse coding. Summary of the Invention

[0007] (a) Technical problems to be solved This invention aims to address the shortcomings of existing attack methods targeting liquid state machines, such as the inability to effectively handle gradient interruptions caused by non-differentiable components within the network, as well as gradient noise and instability caused by random pulse coding. Existing black-box attacks suffer from low efficiency, large disturbances, and poor migration attack effects.

[0008] (II) Technical Solution To address the aforementioned issues, this invention proposes a white-box adversarial sample generation method and system for liquid state machines. The core idea is to construct a computable and stable gradient propagation path from the model loss function to the original input data through two core strategies: "gradient splitting" and "time-averaged gradient approximation," thereby driving the efficient generation of adversarial perturbations. A corresponding system is designed to implement this method.

[0009] This invention first provides a white-box adversarial sample generation method for liquid state machines: The overall flow of the method of the present invention is as follows: Figure 1 As shown, it is divided into a forward propagation phase and a backward gradient calculation phase, which are executed cyclically in two phases: (1) Forward propagation phase Step ① Encoding: The initialized adversarial examples are encoded into pulse sequences, completing the mapping from sample data to the input form of a spiking neural network; Step 2 Input Layer Transmission: The pulse sequence is converted into input current through the input layer, realizing the conversion from discrete pulse signal to continuous current signal; Step ③ Current calculation: The input current is summed with the liquid layer current to obtain the current of each neuron; Step 4: State Activation: The activation state of the neurons in the liquid layer is obtained through the activation function. At the same time, the liquid layer current in the next time step is updated according to the liquid layer state and the internal connections of the liquid layer. The liquid layer current is a continuous value, and the liquid layer state is the activation value of the neuron, 0 or 1. Step ⑤ Time averaging: Perform time averaging on the liquid layer states stored within the preset time step window to obtain the pulse firing rate; Step 6: Classification Output: Input the distribution rate into the classification layer to obtain the classification result. Combine the true label with the loss calculated using cross-entropy to complete the output of the forward process.

[0010] (2) Backward gradient calculation stage Step ① Backpropagation of loss: The loss of the classification result is propagated backward along the classification layer to the firing rate, providing an error signal for gradient optimization. This stage is completed through matrix calculation. Step 2: Time-averaged backpropagation: The error in the release rate is backpropagated to the liquid layer state within the preset time step through time averaging, assuming that each time step contributes equally to the release rate; Step ③: Proxy gradient propagation: The error of the liquid layer state is propagated to the activation stage through proxy gradients to solve the problem of non-differentiability of the activation function in the spiking neural network; Step 4: Gradient splitting: The gradient of the activation circuit comes from the liquid layer current and the input current. The non-differentiable cyclic connection gradient corresponding to the liquid layer current is discarded, and the gradient is propagated in reverse to the input current. Step ⑤ Pulse Gradient: The gradient of the pulse sequence is obtained from the input current gradient through matrix calculation; Step 6: Time averaging and adversarial example update: The estimated gradient of the adversarial example is obtained through time averaging, and the adversarial example is updated.

[0011] Throughout the entire cycle, "gradient splitting" realizes the approximate propagation of the non-differentiable subgradient of the liquid layer to the input current, while "time-averaged gradient approximation" solves the gradient backpropagation of the non-differentiable random process from adversarial samples to pulse sequences. Ultimately, a calculable and stable gradient propagation path is constructed to support the efficient generation of adversarial perturbations.

[0012] Furthermore, this invention also provides a white-box adversarial system for liquid state machines. The system architecture for implementing the above method is as follows: Figure 2 As shown, it includes the following main functional modules: (1) Data input and preprocessing module It is responsible for receiving raw data and, as needed, calling the internal pulse coding submodule to convert continuous data into a pulse sequence. Input devices include a dynamic vision sensor and an RGB camera. The output of the dynamic vision sensor meets the input requirements through frame calculation, and the RGB camera completes data conversion through a pulse coding submodule such as Poisson coding.

[0013] (2) Target Model Loading and Inference Module It integrates or invokes the spiking neural network model to be attacked, and is responsible for performing the forward propagation calculation of the model and outputting the prediction results.

[0014] (3) Gradient calculation module According to preset rules, gradients are calculated during backpropagation. The core function is to identify non-differentiable components such as fixed loop connections in the model and perform gradient truncation or redirection operations to ensure that gradients can bypass these components and flow to the input layer.

[0015] (4) Attack Algorithm Integration Module It encapsulates various gradient-based white-box attack algorithms, including FGSM, BIM, and GBA-SDA. It receives input gradients from the gradient calculation module and calculates specific adversarial perturbations based on the selected algorithm and parameters.

[0016] (5) Adversarial Example Synthesis and Feedback Module The generated perturbation is added to the original input to synthesize an adversarial example. This adversarial example is then fed back to the target model loading and inference module for further inference, verifying the attack effect and forming a closed-loop testing process.

[0017] (III) Beneficial Effects Compared to existing technologies, the invention has the following beneficial effects: 1. This invention is the first to achieve an effective white-box attack on the special neural network architecture of liquid state machines, filling a technological gap; 2. This invention directly utilizes the internal information of the model through precise gradient splitting, avoiding the large number of queries required by black-box attacks, resulting in a high success rate and high efficiency in attacking. 3. The adversarial examples generated by this invention have small perturbations and good concealment; the proposed core ideas of gradient splitting and time-averaged gradient approximation are universal and can be extended to other neural network models with non-differentiable components or random input encoding. 4. This invention provides a practical analytical tool for security assessment of spiking neural networks, especially recurrent spiking neural networks, which helps to promote the development of more robust models and defense mechanisms. Attached Figure Description

[0018] Figure 1 This is a flowchart illustrating the overall process of generating adversarial examples according to the present invention. Figure 2 This is a block diagram of the system modules of the present invention; Figure 3 The graph shows the test results of the GBA algorithm and the benchmark algorithm on N-MNIST. Figure 4 Visualizations of different attack algorithms; Figure 5 The graph shows the test results of the GBA algorithm and the benchmark algorithm on DVS-Gesture. Detailed Implementation

[0019] The following is in conjunction with the appendix Figures 1 to 5 The specific embodiments of the present invention will be described in detail so that those skilled in the art can fully implement the present invention.

[0020] 1. Experimental Preparation This embodiment selects two representative neuromorphic datasets, N-MNIST and DVS-Gesture, as test objects to evaluate the effectiveness of the proposed "Gradient Bypass Attack" (GBA). During the testing process, the three GBA-based attack schemes of this invention (GBA-SDA, GBA-BSBIM, GBA-BSFGSM) are compared with various benchmark methods, including black-box attack schemes (Frame Attack, Corner Attack, Dash Attack) and transfer attack-based schemes (Trans-SDA (SMLP), Trans-SDA (SCNN)).

[0021] 2. Method Implementation Steps According to the method proposed in this invention, an adversarial system is constructed, and a cyclic process of forward propagation and backward gradient calculation is executed sequentially: (1) Execution of the forward propagation phase First, raw data is acquired through the input device of the data input and preprocessing module. If the data is continuous data acquired by an RGB camera, it is converted into a pulse sequence using Poisson coding in the pulse coding submodule. If the data is acquired by a dynamic vision sensor, a pulse sequence is obtained through frame calculation. The pulse sequence is then input into the liquid state machine model in the target model loading and inference module. Input layer propagation is performed, converting the pulse sequence into input current. The input current is summed with the liquid layer current to obtain the current of each neuron. The activation state of the liquid layer neurons is obtained through an activation function, and the liquid layer current for the next time step is updated. The time average of the liquid layer states within a preset time step window is used to obtain the pulse firing rate. The firing rate is input into the classification layer to obtain the classification result, and the loss is calculated using cross-entropy in conjunction with the ground truth labels.

[0022] (2) Execution of the reverse gradient calculation stage The loss is propagated backward along the classification layer to the firing rate, then backward through time averaging to the liquid layer state within a preset time step. The error in the liquid layer state is propagated to the activation stage via a surrogate gradient. A gradient splitting strategy discards non-differentiable cyclic connection gradients, and the gradient is backpropagated to the input current. The gradient of the pulse sequence is obtained through matrix calculation, and the estimated gradient of the adversarial example is obtained through time averaging. The gradient calculation module passes this estimated gradient to the attack algorithm integration module, which selects FGSM, BIM, or GBA-SDA algorithms to calculate the specific adversarial perturbation. The adversarial example synthesis and feedback module adds the adversarial perturbation to the original input to synthesize the adversarial example, and feeds it back to the target model loading and inference module for further inference, verifying the attack effect and forming a closed-loop test.

[0023] 3. Experimental Results and Analysis Figure 3This paper demonstrates the effectiveness of different attack methods on the N-MNIST dataset, reporting accuracy and L0 norm. Specifically, we compare the proposed GBA scheme with various benchmark methods, including the black-box attack schemes FrameAttack, Corner Attack, and Dash Attack, as well as the transfer-based attack scheme Trans-SDA. Experiments show that our three different GBA-based attack schemes achieve significantly higher accuracy than all state-of-the-art methods. Specifically, GBA-SDA achieves 100% accuracy, while GBA-BSBIM and GBA-BSFGSM achieve 99.14% and 98.72%, respectively. In contrast, black-box attacks and transfer-based attacks show significantly lower performance. The SDA attack using SMLP and SCNN as alternative models achieves 6.79% and 13.90% accuracy, respectively, highlighting the architectural differences between these SNNs and LSMs, making them highly resistant to this type of attack. This demonstrates that our proposed white-box attack framework, GBA, provides a more direct and effective attack method by bypassing the liquid layer gradient. Furthermore, GBA maintains superior stealth. For example, GBA-SDA modifies only 72 events, while Frame Attack requires modifying 536 events, nearly seven times the perturbation. Similarly, GBA-BSBIM and GBA-BSFGSM use a similar number of modified elements as transition-based SDA, although their accuracy is significantly higher. Corner Attack and Dash Attack have relatively fewer modified elements, but these two black-box query-based attacks are more time-consuming.

[0024] Figure 4 The visualizations further highlight the morphological differences between the various attack methods. The leftmost column shows clean cumulative event frames, while subsequent columns display adversarial examples generated by each method. Frame attacks manifest as large, blocky perturbations that are easily visible in the cumulative frames. In contrast, corner and sprint attacks introduce scattered, point-like noise. These perturbations are poorly structured, and although relatively sparse, tend to be less effective and require greater query overhead. GBA-BSFGSM and GBA-BSBIM produce patterns with more obvious noise patterns, which improves speech recognition rates but partially sacrifices visual concealment. In contrast, GBA-SDA produces extremely sparse and precisely localized modifications focused on decision-critical regions, thus preserving the global shape of the input while reliably altering the LSM's predictions.

[0025] Figure 5 illustrates the performance of different attacks against DVS-Gesture. Similar to N-MNIST, GBA-based attacks dominate in terms of both effectiveness and stealth. Specifically, the GBA-SDA attack achieved 94.79% accuracy, the GBA-BSBIM attack reached 98.53%, and the GBA-BSFGSM attack achieved 85.29%, all significantly outperforming existing state-of-the-art methods.

[0026] For the L0 norm, the GBA-based method exhibits a relatively higher value than black-box attack schemes. In fact, as the spatial dimension of the input frame increases, gradient-based attacks naturally perturb a larger proportion of pixels. However, a fundamental limitation is that the expected value of the modified pixel proportion cannot exceed the perturbation factor, which is 0.1 in our case.

[0027] In summary, GBA-SDA significantly outperforms other methods in black-box attacks and transition-based attacks targeting neuromorphic data, validating its effectiveness as a white-box adversarial framework specifically designed for liquid state machines.

Claims

1. A white-box adversarial sample generation method for liquid state machines, characterized in that, The process includes a forward propagation phase and a backward gradient calculation phase. The forward propagation phase sequentially executes the steps of encoding, input layer propagation, current calculation, state activation, time averaging, and classification output. The backward gradient calculation phase sequentially executes the steps of loss backpropagation, time-averaged backpropagation, surrogate gradient propagation, gradient splitting, impulsive gradient, time averaging, and adversarial example update. The gradient splitting strategy discards gradients that are not microcyclically connected in the liquid layer, and the time-averaged gradient approximation strategy solves the gradient noise and instability problems caused by random impulsive encoding. A computable and stable gradient propagation path from the model loss function to the original input data is constructed to drive the generation of adversarial perturbations.

2. The method according to claim 1, characterized in that, The encoding step converts the initialized adversarial samples into pulse sequences, thus mapping the sample data to the input form of the spiking neural network.

3. The method according to claim 1, characterized in that, The state activation step obtains the activation state of the neurons in the liquid layer through the activation function. At the same time, it updates the liquid layer current for the next time step based on the liquid layer state and the internal connections of the liquid layer. The liquid layer current is a continuous value, and the liquid layer state is the activation value of the neuron, which is 0 or 1.

4. The method according to claim 1, characterized in that, The time averaging step averages the liquid layer states stored within a preset time step window to obtain the pulse firing rate.

5. The method according to claim 1, characterized in that, The surrogate gradient propagation step uses a surrogate gradient to propagate the error of the liquid layer state to the activation stage, thus solving the problem of non-differentiability of the activation function in spiking neural networks.

6. The method according to claim 1, characterized in that, The gradient shunting step propagates the gradient of the activation circuit back to the input current, discarding the gradient of the liquid layer that cannot be microcirculated.

7. A system for implementing the method of any one of claims 1 to 6, characterized in that, The system includes a data input and preprocessing module, a target model loading and inference module, a gradient calculation module, an attack algorithm integration module, and an adversarial sample synthesis and feedback module. The data input and preprocessing module receives raw data and converts it into a pulse sequence. The target model loading and inference module performs forward propagation of the model and outputs the prediction results. The gradient calculation module calculates the gradient and bypasses non-differentiable components. The attack algorithm integration module encapsulates gradient-based white-box attack algorithms and calculates adversarial perturbations. The adversarial sample synthesis and feedback module synthesizes adversarial samples and performs closed-loop verification.

8. The system according to claim 7, characterized in that, The data input and preprocessing module includes a pulse coding submodule, which uses Poisson coding to convert data.

9. The system according to claim 7, characterized in that, The attack algorithms encapsulated in the attack algorithm integration module include FGSM, BIM, and GBA-SDA.

10. The system according to claim 7, characterized in that, The input devices for the data input and preprocessing module include a dynamic vision sensor and an RGB camera.

Images