%%
%% This is file `sample-sigconf.tex',
%% generated with the docstrip utility.
%%
%% The original source files were:
%%
%% samples.dtx  (with options: `sigconf')
%% 
%% IMPORTANT NOTICE:
%% 
%% For the copyright see the source file.
%% 
%% Any modified versions of this file must be renamed
%% with new filenames distinct from sample-sigconf.tex.
%% 
%% For distribution of the original source see the terms
%% for copying and modification in the file samples.dtx.
%% 
%% This generated file may be distributed as long as the
%% original source files, as listed above, are part of the
%% same distribution. (The sources need not necessarily be
%% in the same archive or directory.)
%%
%% Commands for TeXCount
%TC:macro \cite [option:text,text]
%TC:macro \citep [option:text,text]
%TC:macro \citet [option:text,text]
%TC:envir table 0 1
%TC:envir table* 0 1
%TC:envir tabular [ignore] word
%TC:envir displaymath 0 word
%TC:envir math 0 word
%TC:envir comment 0 0
%%
%%
%% The first command in your LaTeX source must be the \documentclass command.
\documentclass[sigconf]{acmart}
%% NOTE that a single column version is required for 
%% submission and peer review. This can be done by changing
%% the \doucmentclass[...]{acmart} in this template to 
%% \documentclass[manuscript,screen]{acmart}
%% 
%% To ensure 100% compatibility, please check the white list of
%% approved LaTeX packages to be used with the Master Article Template at
%% https://www.acm.org/publications/taps/whitelist-of-latex-packages 
%% before creating your document. The white list page provides 
%% information on how to submit additional LaTeX packages for 
%% review and adoption.
%% Fonts used in the template cannot be substituted; margin 
%% adjustments are not allowed.
\usepackage{orcidlink}
\usepackage{microtype}
\usepackage{graphicx}
\usepackage{subfigure}
\usepackage{booktabs} % for professional tables
\usepackage{bm}
\usepackage{xcolor}
% hyperref makes hyperlinks in the resulting PDF.
% If your build breaks (sometimes temporarily if a hyperlink spans a page)
% please comment out the following usepackage line and replace
% \usepackage{icml2024} with \usepackage[nohyperref]{icml2024} above.
\usepackage{hyperref}

\let\Bbbk\relax

% For theorems and such
\usepackage{amsmath}
\usepackage{amssymb}
\usepackage{mathtools}
\usepackage{amsthm}
\usepackage{hyperref}
\usepackage{algorithm}
\usepackage{algorithmic}
% \usepackage{algpseudocode}
\usepackage{multirow}
\usepackage{adjustbox}

% \renewcommand\footnotetextcopyrightpermission[1]{}

\theoremstyle{plain}
\newtheorem{theorem}{Theorem}[section]
\newtheorem{proposition}[theorem]{Proposition}
\newtheorem{lemma}[theorem]{Lemma}
\newtheorem{corollary}[theorem]{Corollary}
\theoremstyle{definition}
\newtheorem{definition}[theorem]{Definition}
\newtheorem{assumption}[theorem]{Assumption}
\newtheorem{observation}[theorem]{Observation}
\theoremstyle{remark}
\newtheorem{remark}[theorem]{Remark}


%%
%% \BibTeX command to typeset BibTeX logo in the docs
\AtBeginDocument{%
  \providecommand\BibTeX{{%
    \normalfont B\kern-0.5em{\scshape i\kern-0.25em b}\kern-0.8em\TeX}}}

%% Rights management information.  This information is sent to you
%% when you complete the rights form.  These commands have SAMPLE
%% values in them; it is your responsibility as an author to replace
%% the commands and values with those provided to you when you
%% complete the rights form.
% \copyrightyear{2024}
% \acmYear{2024}
% \setcopyright{acmlicensed}
% \acmConference[MM '24] {Proceedings of the 32nd ACM International Conference on Multimedia}{October 28--November 1, 2024}{Melbourne, VIC, Australia.}
% \acmBooktitle{Proceedings of the 32nd ACM International Conference on Multimedia (MM '24), October 28--November 1, 2024, Melbourne, VIC, Australia}
% \acmISBN{979-8-4007-0686-8/24/10}
% \acmDOI{10.1145/3664647.3680639}

\copyrightyear{2024}
\acmYear{2024}
\setcopyright{acmlicensed}\acmConference[MM '24]{Proceedings of the 32nd ACM International Conference on Multimedia}{October 28-November 1, 2024}{Melbourne, VIC, Australia}
\acmBooktitle{Proceedings of the 32nd ACM International Conference on Multimedia (MM '24), October 28-November 1, 2024, Melbourne, VIC, Australia}
\acmDOI{10.1145/3664647.3680639}
\acmISBN{979-8-4007-0686-8/24/10}
% \copyrightyear{2024}
% \acmYear{2024}
% \acmDOI{XXXXXXX.XXXXXXX}

%% These commands are for a PROCEEDINGS abstract or paper.
% \acmConference[MM'24]{Make sure to enter the correct
  % conference title from your rights confirmation email}{October 28 - November 1,
  % 2024}{Melbourne, Australia.}
%
%  Uncomment \acmBooktitle if th title of the proceedings is different
%  from ``Proceedings of ...''!
%
%\acmBooktitle{Woodstock '18: ACM Symposium on Neural Gaze Detection,
%  June 03--05, 2018, Woodstock, NY} 
% \acmISBN{978-1-4503-XXXX-X/18/06}


%%
%% Submission ID.
%% Use this when submitting an article to a sponsored event. You'll
%% receive a unique submission ID from the organizers
%% of the event, and this ID should be used as the parameter to this command.
%%\acmSubmissionID{123-A56-BU3}

%%
%% For managing citations, it is recommended to use bibliography
%% files in BibTeX format.
%%
%% You can then either use BibTeX with the ACM-Reference-Format style,
%% or BibLaTeX with the acmnumeric or acmauthoryear sytles, that include
%% support for advanced citation of software artefact from the
%% biblatex-software package, also separately available on CTAN.
%%
%% Look at the sample-*-biblatex.tex files for templates showcasing
%% the biblatex styles.
%%

%%
%% The majority of ACM publications use numbered citations and
%% references.  The command \citestyle{authoryear} switches to the
%% "author year" style.
%%
%% If you are preparing content for an event
%% sponsored by ACM SIGGRAPH, you must use the "author year" style of
%% citations and references.
%% Uncommenting
%% the next command will enable that style.
%%\citestyle{acmauthoryear}
\settopmatter{printacmref=true}
%%
%% end of the preamble, start of the body of the document source.
\begin{document}

%%
%% The "title" command has an optional parameter,
%% allowing the author to define a "short title" to be used in page headers.
\title[RSC-SNN: Exploring the Trade-off Between Adversarial Robustness and Accuracy in SNNs]{RSC-SNN: Exploring the Trade-off Between Adversarial Robustness and Accuracy in Spiking Neural Networks via Randomized Smoothing Coding}

%%
%% The "author" command and its associated commands are used to define
%% the authors and their affiliations.
%% Of note is the shared affiliation of the first two authors, and the
%% "authornote" and "authornotemark" commands
%% used to denote shared contribution to the research.


\author{Keming Wu}
\orcid{0000-0002-9972-2577}
\authornote{Equal contribution.}
\affiliation{%
  \institution{Chongqing University}
  % \streetaddress{1 Th{\o}rv{\"a}ld Circle}
  \city{Chongqing}
  \country{China}
  }
\email{wukemingcqu@gmail.com}


\author{Man Yao}
\orcid{0000-0002-0904-8524}
\authornotemark[1]
\affiliation{%
  \institution{Institute of Automation, Chinese Academy of Sciences}
  % \streetaddress{1 Th{\o}rv{\"a}ld Circle}
  \city{Beijing}
  \country{China}
  }
\email{man.yao@ia.ac.cn}

\author{Yuhong Chou}
\orcid{0009-0003-7788-7287}
\affiliation{%
  \institution{Xi'an Jiaotong University}
  % \streetaddress{1 Th{\o}rv{\"a}ld Circle}
  \city{Xi'an}
  \country{China}
  }
\email{yuhong_chou@outlook.com}

\author{Xuerui Qiu}
\orcid{0009-0008-3734-4671}
\affiliation{%
  \institution{Institute of Automation, Chinese Academy of Sciences}
  % \streetaddress{1 Th{\o}rv{\"a}ld Circle}
 \city{Beijing}
  \country{China}
  }
\email{qiuxuerui2024@ia.ac.cn}

\author{Rui Yang}
\orcid{0009-0000-8337-1058}
\affiliation{%
  \institution{Software Security Technology Company Ltd}
  % \streetaddress{1 Th{\o}rv{\"a}ld Circle}
  \city{Beijing}
  \country{China}
  }
\email{Yangrui@softsafe-tech.com}

\author{Bo Xu}
\orcid{0000-0002-1111-1529}
\affiliation{%
  \institution{Institute of Automation, Chinese Academy of Sciences}
  % \streetaddress{1 Th{\o}rv{\"a}ld Circle}
  \city{Beijing}
  \country{China}
  }
\email{xubo@ia.ac.cn}

\author{Guoqi Li}
\orcid{0000-0002-8994-431X}
\affiliation{%
  \institution{Institute of Automation, Chinese Academy of Sciences}
  % \streetaddress{1 Th{\o}rv{\"a}ld Circle}
  \city{Beijing}
  \country{China}
  }
\email{guoqi.li@ia.ac.cn}
\authornote{Corresponding author.}
%%
%% By default, the full list of authors will be used in the page
%% headers. Often, this list is too long, and will overlap
%% other information printed in the page headers. This command allows
%% the author to define a more concise list
%% of authors' names for this purpose.
\renewcommand{\shortauthors}{Keming Wu et al.}

%%
%% The abstract is a short summary of the work to be presented in the
%% article.
\begin{abstract}
Spiking Neural Networks (SNNs) have received widespread attention due to their unique neuronal dynamics and low-power nature. Previous research empirically shows that SNNs with Poisson coding are more robust than Artificial Neural Networks (ANNs) on small-scale datasets. However, it is still unclear in theory how the adversarial robustness of SNNs is derived, and whether SNNs can still maintain its adversarial robustness advantage on large-scale dataset tasks. This work theoretically demonstrates that SNN's inherent adversarial robustness stems from its Poisson coding. We reveal the conceptual equivalence of Poisson coding and randomized smoothing in defense strategies, and analyze in depth the trade-off between accuracy and adversarial robustness in SNNs via the proposed Randomized Smoothing Coding (RSC) method. Experiments demonstrate that the proposed RSC-SNNs show remarkable adversarial robustness, surpassing ANNs and achieving state-of-the-art robustness results on large-scale dataset ImageNet. 
\end{abstract}

%%
%% The code below is generated by the tool at http://dl.acm.org/ccs.cfm.
%% Please copy and paste the code instead of the example below.
%%
\begin{CCSXML}
% <ccs2012>
%  <concept>
%   <concept_id>00000000.0000000.0000000</concept_id>
%   <concept_desc>Do Not Use This Code, Generate the Correct Terms for Your Paper</concept_desc>
%   <concept_significance>500</concept_significance>
%  </concept>
%  <concept>
%   <concept_id>00000000.00000000.00000000</concept_id>
%   <concept_desc>Do Not Use This Code, Generate the Correct Terms for Your Paper</concept_desc>
%   <concept_significance>300</concept_significance>
%  </concept>
%  <concept>
%   <concept_id>00000000.00000000.00000000</concept_id>
%   <concept_desc>Do Not Use This Code, Generate the Correct Terms for Your Paper</concept_desc>
%   <concept_significance>100</concept_significance>
%  </concept>
%  <concept>
%   <concept_id>00000000.00000000.00000000</concept_id>
%   <concept_desc>Do Not Use This Code, Generate the Correct Terms for Your Paper</concept_desc>
%   <concept_significance>100</concept_significance>
%  </concept>
% </ccs2012>

% <ccs2012>
% <concept>
% <concept_id>10010147.10010178.10010224</concept_id>
% <concept_desc>Computing methodologies~Computer vision</concept_desc>
% <concept_significance>500</concept_significance>
% </concept>
% </ccs2012>


\end{CCSXML}

\ccsdesc[500]{Computing methodologies~Computer vision; Bio-inspired approaches}

%%
%% Keywords. The author(s) should pick words that accurately describe
%% the work being presented. Separate the keywords with commas.
\keywords{Spiking Neural Networks,  Adversarial Learning, 
 Randomized Smoothing}

%% A "teaser" image appears between the author and affiliation
%% information and the body of the document, and typically spans the
% %% page.
% \begin{teaserfigure}
%   \includegraphics[width=\textwidth]{sampleteaser}
%   \caption{Seattle Mariners at Spring Training, 2010.}
%   \Description{Enjoying the baseball game from the third-base
%   seats. Ichiro Suzuki preparing to bat.}
%   \label{fig:teaser}
% \end{teaserfigure}

% \received{20 February 2007}
% \received[revised]{12 March 2009}
% \received[accepted]{5 June 2009}

%%
%% This command processes the author and affiliation and title
%% information and builds the first part of the formatted document.
\maketitle

% \begin{figure}[t]
% % \vskip 0.2in
% \begin{center}
% \centerline{\includegraphics[width=0.85\columnwidth]{Figure/icml_top_draw.pdf}}
% \caption{Comparison with other methods.}
% \label{fig:comp}
% \end{center}
% \vskip -0.3in
% \end{figure}

\section{Introduction}
Owing to the distinctive event-driven nature \cite{bohte2000spikeprop} and remarkable biological plausibility \cite{gerstner2014neuronal}, SNNs have gained recognition as the third generation of artificial neural networks \cite{maass1997networks,Nature_2}. Compared with ANNs, SNNs employ discrete binary signals for information transfer among spiking neurons, where spikes are generated solely when the membrane potential surpasses the firing threshold. After deployment to neuromorphic chips \cite{2014TrueNorth,davies2018loihi,Nature_1,Speck}, SNNs have demonstrated their effectiveness and efficacy in a variety of scenarios, including static visual tasks\cite{yao2023spike,yao2024spikedriven}, dynamic visual processing \cite{Gallego_2020_DVS_Survey,yao2023attention}, speech classification \cite{yin2021accurate,rao2022long}.


Direct \cite{wu2019direct} and Poisson coding \cite{van2001rate} are two popular coding strategies for SNNs, which define how information is represented via spike patterns \cite{deng2020rethinking}. For SNNs, a static input $x\in {{\mathbb{R}}^{d}}$ needs to be converted into a time sequence input using coding strategies. Direct coding will repeatedly input $x$ for $T$ times. Poisson coding uses frequency approximation to generate $T$ binary spikes $\left\{ {{p}_{i}} \right\}_{i=1}^{T}$ so that the average number of spikes approximates the intensity of the pixel $\frac{1}{T}\sum\nolimits_{i=1}^{T}{{{p}_{i}}}\approx x$. Coding methods play a crucial role in determining the network's computational efficiency and resilience to perturbations. Existing empirical studies have shown that the adversarial robustness of SNNs using Poisson coding is higher than that of ANNs, and the robustness decreases as the time step increases \cite{sharmin2020inherent}. In contrast, SNNs using direct coding have poorer adversarial robustness than ANNs \cite{kundu2021hire}. 

% Although existing research suggests that SNNs are more robust than ANNs under some conditions on small datasets such as CIFAR10 and CIFAR100 \cite{sharmin2019comprehensive,leontev2021robustness, nomura2022robustness}, SNNs still show vulnerability when facing attack samples designed for SNNs \cite{bu2023rate}. 

The impact of direct coding and Poisson coding on the adversarial robustness has not been systematically analyzed, which undermines the potential advantages of SNNs over ANNs in terms of adversarial robustness. Moreover, it is still unknown whether SNN can still maintain the adversarial robustness advantage on large-scale tasks, because previous work has only been verified on small datasets such as CIFAR-10/100 \cite{sharmin2019comprehensive,leontev2021robustness, nomura2022robustness,bu2023rate}. We are interested in why the adversarial robustness of SNNs employing Poisson coding is stronger. We note that randomized smoothing and Poisson coding have similar features in enhancing adversarial robustness, although they may seem like two different approaches. Randomized smoothing builds a base classifier by introducing noise \cite{cohen2019certified}, in contrast, Poisson coding converts the input into a binary probability. 

% The comparison of different coding methods is shown in Figure \ref{fig:comp}.

% Specifically, we establish the equivalence relationship b



Inspired by this, we theoretically establish the connection between randomized smoothing and Poisson coding via analyzing the statistical characteristics of them. We found that Poisson coding shares fundamental statistical properties with randomized smoothing, such as expectation and variance, introducing similar noise smoothing. Since existing research has shown that randomized smoothing can bring certified adversarial robustness, based on this observation, we can understand why SNNs using Poisson coding have adversarial robustness.
However, our theoretical analysis shows that SNNs with Poisson coding are greatly affected by perturbation while bringing about the problem of reduced clean accuracy. Therefore, it is urgent to establish a guiding principle for the trade-off between accuracy and robustness in the design of defense methods against adversarial examples in SNNs. We analyze in depth the trade-off between accuracy and adversarial robustness in SNNs via a novel Randomized Smoothing Coding (RSC) method, which significantly improves the adversarial robustness of SNNs. To further exploit the potential of this approach, we propose a new training method designed for RSC-SNN. Experimental results on extensive datasets show that randomized smoothing coding greatly enhances the adversarial robustness of SNNs. Simultaneously, The final results indicate a trade-off between accuracy and adversarial robustness, which is consistent with the conclusions of ANNs \cite{tsipras2018robustness,su2018robustness, zhang2019theoretically}. Furthermore, We also propose an empirical estimation method to quantify the trade-off called Quantification Trade-off Estimation (QTE) to help design defense methods with better trade-offs. The main contributions of our work are summarized as follows:

% Further, we can theoretically reveal the adversarial robustness of Poisson-encoded SNNs.

% 通过分析xxx，我们发现他的期望和方差吻合。

% 由于随机平滑能带来可验证的鲁棒性（），所以基于这种等价，我们就能理解泊松编码SNN也具有对抗鲁棒性。
% 但是，坏消息是，容易受到扰动。
% 我们建立了trade-off来规避解决这个问题。 
% 具体地，把我们的方法描述一下
% 训练讲一下，结果亮一下。

% Our theoretical analysis shows that SNNs with Poisson coding are greatly affected by perturbation while bringing about the problem of reduced clean accuracy. 

% To provide a guideline for designing defense methods against adversarial samples in SNNs, we first analyze the theoretical sources of the inherent adversarial robustness of SNNs. Observed that both randomized smoothing \cite{cohen2019certified} and Poisson coding improve adversarial robustness by introducing randomness, we theoretically verified the equivalence between them. To better analyze the trade-off problem between adversarial robustness and accuracy in SNNs, we provide an estimation method to quantify the trade-off called Quantification Trade-off Estimation. Further, we explore the trade-off between adversarial robustness and accuracy in SNNs by introducing a novel randomized smoothing Coding (RSC). Experimental results on extensive datasets show that randomized smoothing Coding greatly enhances the adversarial robustness of SNNs, while its inherent randomness leads to a clean accuracy decrease. In order to alleviate this problem, We propose a new training method designed for RSC-SNN. 
% While enhancing the robustness of SNNs, it is equally crucial to uphold clean accuracy. The trade-off between adversarial robustness and accuracy in ANNs has always been studied in the academic community \cite{zhang2019theoretically}. Existing research shows that adversarial robustness might be incompatible with standard accuracy \cite{tsipras2018robustness,su2018robustness}. However, the research on the trade-off between robustness and accuracy in SNNs is still a problem worth exploring, which can be called the robustness and accuracy problem. The problem is shown in Figure \ref{fig:tot}.

% The intersection of the straight line and the y-axis represents the clean accuracy, and the intersection with the x-axis represents the attack intensity when the accuracy is 0.

% Our goal is to increase the area of the triangle while ensuring that the intersection point with the y-axis decreases as little as possible.




% we draw inspiration from randomized smoothing (RS). The randomized smoothing technique shows superior robust defense performance in ANNs \cite{cohen2019certified} by incorporating the randomness of Gaussian noise into the training and inference process. We observed that both randomized smoothing and Poisson coding improve robustness by introducing randomness, and theoretically verified the equivalence between them. In order to further enhance the robustness of SNN, we introduced an innovative method called randomized smoothing Coding (RSC). Experimental results on extensive datasets show that RSC greatly enhances the robustness of SNN, while its inherent randomness leads to a clean accuracy decrease. In order to alleviate this problem, We propose a new training method designed for RSC-SNN. 
% Within the domain of SNNs, two prevalent coding strategies, direct coding \cite{wu2019direct} and Poisson coding \cite{van2001rate}, define how information is represented through spike patterns. These coding methods play a crucial role in determining the network's computational efficiency and resilience to perturbations. While direct coding suffers from reduced robustness in the face of perturbations, Poisson coding exhibits a degree of robustness but often at the cost of longer time steps due to stochastic sampling.
\begin{itemize}
\item We establish the connection between Poisson coding and randomized smoothing for the first time, which is a novel insight contributing to the field. Furthermore, we prove the conceptual equivalence of randomized smoothing and Poisson coding, which provides a theoretical foundation for the robustness of Poisson-encoded SNNs.
We proposed a novel coding method called \textbf{randomized smoothing coding}.

\item Observing the inherent clean accuracy drop caused by randomized smoothing coding, we propose a new training method called Efficient Randomized Smoothing Coding Training (\textbf{E-RSCT}) specifically for randomized smoothing coding.

\item Experimental results show that RSC-SNNs show remarkable adversarial robustness in image recognition and achieves state-of-the-art results on datasets including large datasets Tiny-ImageNet, ImageNet, while achieving a better trade-off under the metric of Quantification Trade-off Estimation.

% Experimental results also show that the novel training method improves both clean accuracy and robustness of RSC-SNN.
\end{itemize}

\section{Background and Related Work}
\subsection{Spiking Neural Network}
Spiking neurons are the basic units of SNNs, which are abstracted from the dynamics of biological neurons. The leaky-integrate-and-fire (LIF) neuron model is widely acknowledged as the simplest model among all popular neuron models while maintaining biological interpretability, in contrast to the many-variable and complex H-H model \cite{hodgkin1952quantitative}. It also has a significantly lower computational demand \cite{roy2019towards,pei2019towards}. We adopt the LIF neuron model and translate it to an iterative expression with the Euler method \cite{wu2018spatio}. Mathematically,  the LIF-SNN layer can be described as an iterable version for better computational traceability:
\begin{equation}
\begin{cases}
{u}_{i}^{(l)}[t+1]={h}_{i}^{(l)}[t]+f({w^{(l)}},{x}_{i}^{(l-1)}[t]) \\
{s}_{i}^{(l)}[t]={\Theta} ({u}_{i}^{(l)}[t+1]-\vartheta)\\
    {h}_{i}^{(l)}[t+1]= \tau {u}_{i}^{(l)}[t+1](1-{s}_{i}^{(l)}[t]),
\end{cases}
\label{eq:lif}
\end{equation}
where $\tau$ is the time constant, $t$ and $i$ respectively represent the indices of the time step and the $l$-th layer, $ w$ denotes synaptic weight matrix between two adjacent layers, $f(\cdot) $ is the function operation stands for convolution (Conv) or fully connected (FC), $x$ is the input, and  ${\Theta(\cdot)}$ denotes the Heaviside step function. When the membrane potential ${u}$ exceeds the firing threshold $\vartheta$, the LIF neuron will trigger a spike $ S$. Moreover,  $h$ represents the membrane potential after the trigger event which equals $\tau {u}$.

% \textbf{SNN Coding Schemes.} 
% Within the domain of SNNs, two prevalent coding strategies, direct coding \cite{wu2019direct} and Poisson coding \cite{van2001rate}, define how information is represented through spike patterns. These coding methods play a crucial role in determining the network's computational efficiency and resilience to perturbations. While direct coding suffers from reduced adversarial robustness in the face of perturbations, Poisson coding exhibits a degree of adversarial robustness but often at the cost of longer time steps due to stochastic sampling.

% Several spike coding methods have been explored for converting visual inputs into spikes for SNNs. Weighted spike coding \cite{kim2018deep, qiu2023vtsnn} encodes each pixel into a spike train with different spike weights. Temporal coding \cite{park2020t2fsnn,comsa2020temporal} represents information using the timing of the first spike. These coding techniques have achieved promising results on smaller datasets and shallower networks. However, as dataset and model complexity increases, maintaining high performance becomes more challenging. To address this issue, rating coding \cite{van2001rate}, which encodes each pixel using spike firing frequency, has been suggested. However, it suffers from long time steps to maintain high performance, while small time steps result in lower representation resolution. Direct coding \cite{wu2019direct, qiu2023gated},   in which input is given straight to the network without conversion to spikes, and image-spike coding is done by the first \{\textit{Conv-BN}\} layer. Then repeat this procedure at each time step and feed the results to spiking neurons. Finally, these encoded spikes will be sent to the SNN architecture for feature extraction. However, direct coding suffers from reduced robustness in the face of perturbations, and Poisson coding exhibits a degree of robustness but often at the cost of longer time steps due to stochastic sampling.

\subsection{Adversarial Attacks}
\label{sec:att}
Adversarial attacks are designed to fool a model into incorrect predictions or outputs through carefully crafted inputs \cite{goodfellow2015explaining}. Given  a classifier $f:{{\mathbb{R}}^{d}}\to \mathcal{Y}$, where $\mathcal{Y}$ is the set of class labels, the purpose of an adversarial perturbation $\delta$ is to make $f\left( {x}+ {\delta}  \right)\ne f\left( {x} \right)$, which can be formulated as an optimization problem:
\begin{equation}
    \underset{{{\left\| {\delta}  \right\|}_{p}}\le \epsilon }{\mathop{\max }}\,\mathcal{L}\left( f\left( {x} +{\delta}  \right),y \right),
\end{equation}
where $f$ is the network under attack, $\mathcal{L}$ is the loss function, ${x}$, $y$ are the input and target output of the given network, respectively. $\epsilon$ is a parameter that limits the intensity of the perturbation so that it is not easily observed by the human eye. ${\delta}$ is the parameter we want to optimize. In this paper we mainly use two widely adopted gradient-based adversarial attacks: Fast Gradient Sign Method (FGSM) and Projected Gradient Descent method (PGD).

\textbf{FGSM.} As a simple but effective attack method \cite{goodfellow2015explaining}, adversarial examples are generated based on the symbolic information of the gradient to maximize the loss of the perturbed ${x} +{\delta}$, which can be formulated as
\begin{equation}
    {{{x} }_{adv}}={x} +\epsilon \times \text{sign}\left( {{\nabla }_{{x} }}L\left( f\left( {x} ,y \right) \right) \right),
\end{equation}
where $\epsilon$ denotes the strength of the attack.

\textbf{PGD.} As an iterative version of FGSM, it generates adversarial samples by adding small perturbations in the gradient direction multiple iterations and limiting the results to a certain range after each iteration \cite{madry2017towards}, which can be formulated as
\begin{equation}
   \mathbf{x}_{adv}^{\left( k \right)}={{\Pi }_{\epsilon }}\left\{ \mathbf{x}_{adv}^{\left( k-1 \right)}+\alpha \times \text{sign}\left( {{\nabla }_{\mathbf{x}}}L\left( f\left( \mathbf{x}_{adv}^{\left( k-1 \right)},y \right) \right) \right) \right\},
\end{equation}
where $k$ denotes the number of the iteration step and $\alpha$ is the step size of each iteration. ${\Pi }_{\epsilon }$ is used to ensure that the perturbation does not exceed a predefined range $\epsilon$.

For FGSM and PGD, we explore two scenarios: white-box and black-box attacks. In the white-box scenario, the attacker possesses full access to the model's topology, parameters, and gradients. Conversely, in the black-box scenario, the attacker is limited to basic information about the model. Without specific guidelines, we fix $\epsilon$ at 8/255 across all methods for testing. For iterative techniques  PGD, the attack step is set at $\alpha = 0.01$, with a total of 7 steps.

\subsection{Randomized Smoothing}
As a strategy aimed at enhancing model adversarial robustness, randomized smoothing fortifies the model's defense against attacks through the inclusion of random noise \cite{cohen2019certified}. In addition, there are many works that further explore randomized smoothing \cite{lee2019tight, yang2020randomized, zhai2020macer}.
% Its premise hinges on a fundamental observation: within the input space, the actual data typically resides within localized regions, and the injection of random perturbations within these areas can bolster the stability of the model's predictions.

In a classification scenario mapping from $\mathbb{R}^{d} \to \mathcal{Y}$, randomized smoothing constitutes a method to formulate a refined classifier $g$ from any base classifier $f$. When evaluated at $x$, the smoothed classifier $g$ identifies the class that the base classifier $f$ is most inclined to predict when $x$ undergoes perturbation by isotropic Gaussian noise:
\begin{equation}
    g\left( x \right)=\underset{c\in \mathcal{Y}}{\mathop{\arg \max }}\,\mathbb{P}\left( f\left( x+\epsilon  \right)=c \right),
\end{equation}
where $\epsilon \sim \mathcal{N}\left( 0,{{\sigma }^{2}}I \right)$.
The noise level $\sigma$ serves as a hyperparameter for the smoothed classifier $g$, dictating a trade-off between adversarial robustness and accuracy.
% it remains constant across input $x$.

\section{Method}
As aforementioned, we suggest achieving a better trade-off between adversarial robustness and accuracy for designing more practical SNN models. In this section, we first provide an empirical metric to quantify the trade-off between adversarial robustness and accuracy. We then introduce a new coding method called RSC to improve the adversarial robustness, which enhances the quantitative trade-off between adversarial robustness and accuracy. Furthermore, theoretical analysis is given to illustrate the conceptual equivalence of RSC and Poisson coding. After observing the inherent limitations of RSC, we further propose a specified training method designed for RSC to improve its clean accuracy and adversarial robustness.

% In this section, we theoretically prove the equivalence of randomized smoothing and Poisson coding in SNNs and propose a new coding method called randomized smoothing coding (RSC) to improve the robustness of SNN model. After observing the inherent limitations of RSC leading to decreased clean accuracy, we further propose a specified training method designed for RSC coding to improve its clean accuracy and robustness.

\begin{figure}[t]
% \vskip 0.2in
\begin{center}
\centerline{\includegraphics[width=0.85\columnwidth]{Figure/RA.pdf}}
\caption{An illustration of the trade-off between adversarial robustness and accuracy can be represented by the absolute value of the slope, indicating the SNN model's adversarial robustness. The area of a triangle can quantitatively estimate this trade-off. It is important to note that the slope illustrates the correlation between accuracy and attack strength, rather than implying a specific linear relationship.}
\label{fig:tot}
\end{center}
% \vskip -0.1in
\end{figure}

\subsection{Quantification Trade-off Estimation}
Quantification trade-off is important for designing methods to better trade-off. Therefore, before giving full details of our methods, we first try to formulate a Quantification Trade-off Estimation.
\begin{definition} \textit{Quantification Trade-off Estimation (QTE)}. From Figure \ref{fig:tot}, we can get that the process of achieving better trade-offs is also essentially making the area larger. For a trained model, assume that its accuracy under attack intensity $\eta$ is $A(\eta)$, Quantification Trade-off Estimation between two attack intensities ${\eta }_{a}$ and ${\eta }_{b}$ can be formulated as
\begin{equation}
\label{eq:qte}
   \text{QTE=}\left| \frac{\left( {{\eta }_{b}}-{{\eta }_{a}} \right) \left( A\left( {{\eta }_{b}} \right)+A\left( {{\eta }_{a}} \right)\right)}{2} \right|.
\end{equation}
Obviously, a larger Quantification Trade-off Estimation implies higher overall accuracy within the attack interval, signifying an improved trade-off in the model implementation. Simultaneously, it's noticeable that a smaller difference in $\left| {{\eta }_{b}}-{{\eta }_{a}} \right|$ corresponds to more accurate estimations of the model's quantification trade-offs.


% Obviously, when the QTE is larger, it means that the overall accuracy in the attack interval is higher, which means that the trade-off of the model implementation is better. At the same time, we can observe that when the difference in $\left| {{\eta }_{b}}-{{\eta }_{a}} \right|$ is smaller, the more accurate the model quantification trade-offs it estimates are.

% Obviously, when the QTE is smaller, the accuracy of the model decreases slower, which means the robustness is stronger. At the same time, we can observe that when the difference in $\left| {{\eta }_{b}}-{{\eta }_{a}} \right|$ is smaller, the model robustness represented by it is more accurate.
\end{definition}
% \begin{definition} \textit{Average Quantification Trade-off Estimation (AQTE)}. Assuming that there are $n$ points $P$ on the accuracy-attack diagram, the area of the space between two points ${\eta }_{a}$ and ${\eta }_{b}$ can be expressed by $\text{QTE}({\eta }_{a},{\eta }_{b})$. AQTE can be formulated by averaging the areas of the above intervals as
% \begin{equation}
%     \text{AQTE}=\frac{\sum\limits_{i,j\in P}{\text{QTE}\left( {{\eta }_{i}},{{\eta }_{j}} \right)}}{n-1}.
% \end{equation}
% Compared to just calculating the area between two points, if more points can be determined between the two points, the calculated AQTE can better represent the model's quantification trade-off in this interval than the QTE.
% \end{definition}

\subsection{Randomized Smoothing Coding (RSC)}

Motivated by randomized smoothing, we first introduced random smoothing of Gaussian noise into the input of SNN. For each sample input $x\in {{\mathbb{R}}^{3\times H\times W}}$, there is a given time step $T$. There are actually two ways to add noise to the input sample of the SNN model. One is to directly add a fixed noise a to the input and no longer changes at each time step, which can be formulated as
\begin{equation}\label{eq:res}
    \widetilde{x}=x+\epsilon ,\epsilon \sim \mathcal{N}\left( 0,{{\sigma }^{2}}I \right),
\end{equation}
it can also be expressed as
\begin{equation}
    \widetilde{x} \sim \mathcal{N}\left( x,{{\sigma }^{2}}I \right).
\end{equation}

Another way is to add different Gaussian noises at each time step, which can be formulated as
\begin{equation}
    \widetilde{{x}_{i}} ={{x}_{i}}+{{\epsilon }_{i}},{{\epsilon }_{i}}\sim \mathcal{N}\left( 0,{{\sigma }^{2}}I \right),i=1,\cdots ,\left| T \right|,
\end{equation}
where the noise level $\sigma$ serves as a hyperparameter for the model, dictating a trade-off between adversarial robustness and accuracy.

After adding noise to $x$, we further limit the range of $\widetilde{x}$ to $[0,1]$, which can be formulated as
\begin{equation}
    \label{eq:clamp}
    {{\widetilde{x}}_{\text{clamp}}}=\text{clamp}\left( \widetilde{x} \right)=\text{clamp}\left( x+\epsilon  \right),{{\widetilde{x}}_{\text{clamp}}}\in [0,1].
\end{equation}

For the first method, we named it RSC-\uppercase\expandafter{\romannumeral1}, and the second method RSC-\uppercase\expandafter{\romannumeral2}. In the experiment, we found that RSC-\uppercase\expandafter{\romannumeral1} can bring about a substantial improvement in adversarial robustness compared to RSC-\uppercase\expandafter{\romannumeral2}, and the degree of clean accuracy decrease will be higher than that of RSC-\uppercase\expandafter{\romannumeral2}; RSC-\uppercase\expandafter{\romannumeral2} can also bring about a small improvement in adversarial robustness, and the degree of clean accuracy decrease will be lower than that of RSC-\uppercase\expandafter{\romannumeral1}. Due to the need for higher adversarial robustness, we choose RSC-\uppercase\expandafter{\romannumeral1} as our main method. 
% The training procedure of RSC-SNN is shown in Algo.\ref{alg:algorithm1}.

% \begin{algorithm}[tb]
% 	\caption{Training Algorithm of RSC-SNN.}
% 	\label{alg:algorithm1}
%     \textcolor{blue}{\textbf{Training}}\\
% 	\textbf{Input}: An SNN to be trained with RSC; a hyperparameter $\sigma$; training dataset; total training iteration: $I_{\rm train}$.\\
% 	\textbf{Output}: The well-trained SNN.
% 	\begin{algorithmic}[1] %[1] enables line numbers
% 		\FOR {all $i = 1, 2, \dots , I_{\rm train}$ iteration}
% 		\STATE Get mini-batch training data, $\bm{x}_{\rm in}(i)$ and class label, $\bm{y}(i)$;
% 		\STATE Feed the  $\bm{x}_{\rm in}(i)$ into the SNN ;
%         \STATE Generate new sample $\widetilde{x}$ by Eq.~\ref {eq:res};
%         \STATE  Process $\widetilde{x}$ to get ${{\widetilde{x}}_{\text{clamp}}}$ by Eq.~\ref {eq:clamp};
% 		\STATE Calculate the SNN output, $\bm{o}_{\rm out}(i)$ by Eq.~\ref {eq:lif} ;
% 		\STATE Compute classification loss $L_{\rm CE}={\mathcal{L}_{\rm CE}}(\bm{o}_{\rm out}(i),\bm{y}(i))$;
% 		\STATE Backpropagation and update model parameters;
% 		\ENDFOR
% 	\end{algorithmic}
% \end{algorithm}
\subsection{Theoretical Analysis for Randomized Smoothing Coding}
For the convenience of analysis, we first explain the meaning of the symbols. The input image is denoted as $\boldsymbol{x}$. The expectation of $\boldsymbol{X}$ is denoted as $\boldsymbol{E}[\boldsymbol{X}]$ and the covariance matrix is denoted as $\boldsymbol{\Sigma}_{\boldsymbol{X}}$.

For Poisson coding, the input is a random vector $\boldsymbol{X_{P}}$, where the vector follows a Bernoulli binomial distribution with probability vector $\boldsymbol{p}$. For randomized smoothing, the input is a random vector $\boldsymbol{X_{RS}}$, which follows a normal distribution centered at $\boldsymbol{x}$ with covariance $\boldsymbol{\sigma}^2$, denoted as $\boldsymbol{X_{RS}} \sim \mathcal{N}(\boldsymbol{x}, \boldsymbol{\sigma}^2)$. The following formula can be satisfied:
% \begin{equation}
% % \boldsymbol{\Sigma}_{\boldsymbol{X_{P}}} = \text{diag}(\boldsymbol{x}(1-\boldsymbol{x})) = \text{diag}(x_1(1-x_1), \ldots, x_d(1-x_d)).
% \end{equation}
\begin{equation}
\begin{aligned}
    & \boldsymbol{E}[\boldsymbol{X_{P}}] = \boldsymbol{E}[\boldsymbol{X_{RS}}] =  \boldsymbol{x} \\ 
    &\boldsymbol{\Sigma}_{\boldsymbol{X_{P}}} = \text{diag}(\boldsymbol{x}(1-\boldsymbol{x})) = \text{diag}(x_1(1-x_1), \ldots, x_d(1-x_d)).\\
    &  \boldsymbol{\Sigma}_{\boldsymbol{X_{RS}}} = \text{diag}(\boldsymbol{\sigma}^2) = \text{diag}(\sigma_{1}^2, \sigma_{2}^2, \ldots, \sigma_{d}^2).\\
\end{aligned}
\end{equation}
% \begin{theorem}\label{the:1}
% \textit{For Poisson coding, the input is a random vector $\boldsymbol{X_{P}}$, where the vector follows a Bernoulli binomial distribution with probability vector $\boldsymbol{p}$. For randomized smoothing, the input is a random vector $\boldsymbol{X_{RS}}$, which follows a normal distribution centered at $\boldsymbol{x}$ with covariance $\boldsymbol{\sigma}^2$, denoted as $\boldsymbol{X_{RS}} \sim \mathcal{N}(\boldsymbol{x}, \boldsymbol{\sigma}^2)$. The following formula can be satisfied:}
% % \begin{equation}
% % % \boldsymbol{\Sigma}_{\boldsymbol{X_{P}}} = \text{diag}(\boldsymbol{x}(1-\boldsymbol{x})) = \text{diag}(x_1(1-x_1), \ldots, x_d(1-x_d)).
% % \end{equation}
% \begin{equation}
% \begin{aligned}
%     & \boldsymbol{E}[\boldsymbol{X_{P}}] = \boldsymbol{E}[\boldsymbol{X_{RS}}] =  \boldsymbol{x} \\ 
%     &\boldsymbol{\Sigma}_{\boldsymbol{X_{P}}} = \text{diag}(\boldsymbol{x}(1-\boldsymbol{x})) = \text{diag}(x_1(1-x_1), \ldots, x_d(1-x_d)).\\
%     &  \boldsymbol{\Sigma}_{\boldsymbol{X_{RS}}} = \text{diag}(\boldsymbol{\sigma}^2) = \text{diag}(\sigma_{1}^2, \sigma_{2}^2, \ldots, \sigma_{d}^2).\\
% \end{aligned}
% \end{equation}
% \end{theorem}

\begin{figure}[ht]
    \centering    
    \subfigure[An example of feature maps processed by RS and Poisson coding selected from CIFAR10, which shows a high degree of similarity between them.]{				% 图片1([]内为子图标题)						
    \includegraphics[width=0.45\textwidth]{Figure/encoding_comparion1.pdf}}			  % 子图1的图片宽度 不能空行
    \subfigure[The average cosine similarity among three coding methods on CIFAR10, CIFAR100, and Tiny-ImageNet datasets indicates a notably high resemblance between randomized smoothing coding and Poisson coding.]{				% 图片2
    \includegraphics[width=0.45\textwidth]{Figure/encoding_comparion2.pdf}}
	% \caption{Data Screening} % 图片标题 
    \caption{Visual verification of equivalence of randomized smoothing coding and Poisson coding.} % 图片标题 
    \label{fig2}
\end{figure}

We can observe that Poisson coding and randomized smoothing coding can be considered as an equivalence in theory.

To better explain why randomized smoothing coding is better than Poisson coding, the results of the two different perturbed coding methods in a linear layer are explored through the following theorem. For the convenience of expression, we express the adversarial sample as \( \boldsymbol{x} + \boldsymbol{\epsilon} \) and  denote the linear layer as a deterministic weight matrix \( \boldsymbol{W} \), the original output as a random variable \( \boldsymbol{Y_{P/RS_{original}} } \) and the attacked output as a random variable \( \boldsymbol{Y_{P/RS_{attack}}} \). For both coding methods, the expectation of original \( \boldsymbol{Y_{original}} \) and attacked $\boldsymbol{Y_{attack}}$ are given by:
\begin{equation}
\begin{aligned}
     &\boldsymbol{E}[\boldsymbol{Y_{{original}}}] = \boldsymbol{E}[\boldsymbol{WX}] = \boldsymbol{W}\boldsymbol{E}[\boldsymbol{X}] = \boldsymbol{Wx}. \\ 
     & \boldsymbol{E}[\boldsymbol{Y_{{attack}}}] = \boldsymbol{W}(\boldsymbol{x} + \boldsymbol{\epsilon}).
\end{aligned}
\end{equation}

Although the expectations of both exhibit the same characteristics, their covariances behave differently. In Theorems \ref{the:1} and \ref{the:2}, we obtain two covariance results with Poisson coding and randomized smoothing coding.
% \begin{theorem}
% \textit{For both coding methods, the expectation of original \( \boldsymbol{Y} \) and attacked $\boldsymbol{Y}_{\text{attack}}$ are given by:}
% \begin{equation}
% \begin{aligned}
%      &\boldsymbol{E}[\boldsymbol{Y}_{\text{original}}] = \boldsymbol{E}[\boldsymbol{WX}] = \boldsymbol{W}\boldsymbol{E}[\boldsymbol{X}] = \boldsymbol{Wx}. \\ 
%      & \boldsymbol{E}[\boldsymbol{Y}_{\text{attack}}] = \boldsymbol{W}(\boldsymbol{x} + \boldsymbol{\epsilon}).
% \end{aligned}
% \end{equation}
% \end{theorem}

\begin{theorem} \label{the:1}
    \textit{The covariance matrix of Poisson coding before and after the attack satisfies:}
\begin{equation}
\begin{aligned}
     &\boldsymbol{\Sigma}_{\boldsymbol{Y_{P_{original}}}} = \boldsymbol{W}\text{diag}(\boldsymbol{x}(1-\boldsymbol{x}))\boldsymbol{W}^T. \\ 
     & \boldsymbol{\Sigma}_{\boldsymbol{Y_{P_{attack}}}} = \boldsymbol{W}\text{diag}(\boldsymbol{x}(1-\boldsymbol{x}) + \boldsymbol{\epsilon}(1-2\boldsymbol{x}) - \boldsymbol{\epsilon}^2)\boldsymbol{W}^T.
\end{aligned}
\end{equation}
\end{theorem}

% \begin{figure}[ht]
% % \vskip 0.1in
% \begin{center}
% \centerline{\includegraphics[width=1\columnwidth]{Figure/encoding_comparion.pdf}}
% \caption{Visual verification of equivalence of randomized smoothing Coding and Poisson coding. (a) An example of feature maps processed by RS and Poisson coding selected from CIFAR10, which shows a high degree of similarity between them. (b) The average cosine similarity among three coding methods on CIFAR10, CIFAR100, and Tiny-ImageNet datasets indicates a notably high resemblance between randomized smoothing Coding and Poisson coding.}
% \label{fig:eq_vis}
% \end{center}
% \vskip -0.3in
% \end{figure}



\begin{theorem}\label{the:2}
    \textit{The covariance matrix of randomized smoothing coding before and after the attack satisfies:}
\begin{equation}
\boldsymbol{\Sigma}_{\boldsymbol{Y_{RS_{original/attack}}}} = \boldsymbol{W}\text{diag}(\boldsymbol{\sigma}^2)\boldsymbol{W}^T.
\end{equation}
\end{theorem}

All the above theorems are proved in the supplementary material. 

\begin{proposition}
\textit{(\textbf{Covariance invariance of RSC.}) Poisson coding and randomized smoothing coding demonstrate distinct characteristics regarding covariance. For randomized smoothing coding, the noise variance introduced to the input remains constant and does not vary with the input itself.}
\end{proposition}
While Poisson coding and randomized smoothing share the high-level objective of enhancing adversarial robustness through noise averaging, they differ significantly in the specific nature of the noise added. Randomized smoothing employs isotropic Gaussian noise, resulting in predictable and manageable outcomes due to its uniform variance in all directions. In contrast, Poisson coding introduces noise whose covariance is influenced by both the input magnitude and perturbation attacks, leading to input-dependent variance. Consequently, the constant noise variance in randomized smoothing ensures a more stable and consistent smoothing process, potentially making it more effective in certain scenarios. 

% This distinction provides a theoretical foundation for understanding the robustness observed in spiking neural networks (SNNs) with Poisson coding.

% While Poisson coding aligns with randomized smoothing at the high level concept, it differs in the specific form of noise added. Both methods enhance adversarial robustness through noise averaging, providing a theoretical foundation for the observed robustness of SNNs with Poisson coding. However, the isotropic Gaussian noise used in randomized smoothing can lead to more predictable and manageable results due to its uniform variance in all directions.

%  In Poisson coding, covariance is affected by both the magnitude of the input and perturbation attacks, which implies that the variance of the input noise is contingent on the input itself. On the other hand, in randomized smoothing coding, the noise variance added to the input remains constant. This characteristic ensures that the smoothing process in randomized smoothing coding is more stable and consistent, potentially rendering it more effective in specific scenarios.

\begin{observation}
    \textit{(\textbf{Equivalence between RSC and Poisson coding.}) The image inputs to SNNs, following processing by the  randomized smoothing coding layer, exhibit similar characteristics to that of the Poisson coding layer, displaying a notably high cosine similarity.}
\end{observation}
The phenomenon in Figure \ref{fig2}(a) stems from coding properties. Randomized Smoothing regularizes feature maps by smoothing out irregularities, enhancing robustness. On the contrary, Poisson coding, introduces binary spikes based on pixel intensity, potentially resulting in a noisier feature map. This observation is clearly depicted in Figure \ref{fig2}(a) and \ref{fig2}(b), where the average cosine similarity of randomized smoothing coding and Poisson coding stands at a notably elevated level, suggesting a equivalence between them. More visualization results are shown in the  supplementary material.


\begin{table}[ht]
\caption{Checklist for characteristic behaviors caused by obfuscated and masked gradients.}
\label{tab:check}
% \vskip 0.15in
\begin{center}
% % \begin{small}
% % \begin{sc}
% \begin{adjustbox}{width=0.6\textwidth}  % 设置表格宽度为文本宽度的100%
\begin{tabular}{lc}
\toprule
Items to identify gradient obfuscation & Test \\
\midrule
(1) One-step attacks perform better than iterative attacks & Pass\\
(2) Black-box attacks are better than white-box attacks. & Pass \\
(3) Unbounded attacks do not reach 100\% success. & Pass \\
(4) Increasing distortion bound does not increase success. &  Pass \\
(5) Random sampling finds adversarial examples. & Pass \\
\bottomrule
\end{tabular}
% \end{adjustbox}
% % \end{sc}
% % \end{small}
\end{center}
% \vskip -0.25in
% \vspace
\end{table}


\begin{table}[ht]
\caption{Results show that our proposed method can still defend against EOT attacks.}
\label{tab:eot}
% \vskip 0.15in
\begin{center}
\begin{small}
% \begin{sc}
\begin{tabular}{cccccc}
\hline
\multicolumn{1}{c}{\bf Dataset}  &\multicolumn{1}{c}{\bf Architecture} &\multicolumn{1}{c}{\bf Methods} &\multicolumn{1}{c}{\bf Clean}  &\multicolumn{1}{c}{\bf PGD} &\multicolumn{1}{c}{\bf EOTPGD}  \\
\hline
\multicolumn{1}{c}{\multirow{2}{*}{CIFAR10}}
    % \cline{2-6}
    & VGG-5 & RSC-0.1 & 80.29 & 37.28 & 28.72   \\
    & VGG-5 & RSC-0.5 & 78.67 & 58.94 & 48.93  \\
    \hline
    \multicolumn{1}{c}{\multirow{2}{*}{CIFAR100}}
    % & VGG-11 & ANN &  72.86 & 4.56  & \textit{8.5} \\
    % \cline{2-6}
    % RS-multi-2.0(\textbf{Ours})& T = 8 & 53.16\% & 
    %    25.25\% 
    %  & 21.22\%  \\
   & VGG-11 & RSC-0.1 & 57.05 & 24.35 & 18.95 \\
    & VGG-11 & RSC-0.5 & 56.25 & 33.96 & 27.14  \\
    \hline
\end{tabular}
% \end{sc}
\end{small}
\end{center}
% \vskip -0.1in
\end{table}


\subsection{Checks for RSC Gradient Obfuscation}
Gradient obfuscation is the main reason why many adversarial defense methods are mistakenly considered effective. By certain methods, the neural network cannot produce accurate gradients, resulting in the inability to produce effective attacks. 

To evaluate the attack effectiveness  of the RSC , we employ the systematic checklist presented in \cite{athalye2018obfuscated} to scrutinize the gradient obfuscation of this novel coding scheme. This assessment is primarily grounded in the data delineated in Table \ref{tab:att} and Table \ref{tab:bbatt} within the main body of the text, with a brief summary provided in Table \ref{tab:check}. The detailed analysis can be found in the supplementary material.

% Table \ref{tab:att} reveals that across all experiments, the one-step FGSM consistently underperforms the PGD, thereby attesting to the effectiveness of RSC with respect to Test(1) as enumerated in Table \ref{tab:check}. To substantiate Test(2), we launch black-box assaults on both the proposed models and the vanilla ones. The observed subdued efficacy of the black-box perturbations in Table \ref{tab:bbatt} confirms the fulfillment of Test(2). Tests (3) and (4) are rigorously examined by probing VGG-5 on the CIFAR10 dataset under escalating attack thresholds. As depicted in Figure \ref{fig:att_abl}, the classification accuracy progressively deteriorates, culminating in an accuracy indistinguishable from random chance. In line with the insights from \cite{athalye2018obfuscated}, Test(5) may only fail if gradient-based attacks are incapable of generating adversarial instances that induce misclassification. In conclusion, our findings indicate no discernible gradient obfuscation in RSC.

Expectation over Transformation (EOT) computes the gradient over the expected transformation to the input as a method to attack randomized models \cite{athalye2018synthesizing}. We use EOTPGD proposed by \citet{zimmermann2019comment} to evaluate the effectiveness of our method. The results in Table \ref{tab:eot} show that our method can defend against EOT attacks.
 % In order to identify the attack effectiveness of RSC, we adopt the checklist mentioned in \cite{athalye2018obfuscated} to systematically analyze the gradient obfuscation of the novel coding scheme. The analysis is mainly based on Table \ref{tab:att} and Table \ref{tab:bbatt} in the main text. Our brief results are presented in Table \ref{tab:check}. 

 % As shown in Table \ref{tab:att}, for all the trials, the performance of single-step FGSM is worse than its iterative counterpart PGD, which certify the success of RSC in terms of Test(1) in Table \ref{tab:check}. To verify Test(2), we conduct black-box attacks on the proposed models and the vanilla ones. The black-box perturbation performs weaker in Table \ref{tab:bbatt}, and Test(2) is satisfied. To verify Test(3)(4), we analyze VGG-5 on CIFAR10 with increasing attack bound. In Figure \ref{fig:att_abl}, the classification accuracy decreases as we increase and finally reach an accuracy of random guessing. As suggested in \cite{athalye2018obfuscated}, Test(5) "can fail only if gradient-based attacks cannot provide adversarial examples for the model to misclassify". To sum up, we found no gradient obfuscation for the RSC.


\begin{table*}[ht]
\caption{White-box attack results on four datasets of ANN and three different coding methods of SNN. The best result is highlighted with bold and the second with \underline{underlined}. The larger the better for all metrics.}
\label{tab:att}
% \vskip 0.15in
\begin{center}
% \begin{small}
% \begin{sc}
\begin{tabular}{cccccccc}
\hline
\multicolumn{1}{c}{\bf Dataset}  &\multicolumn{1}{c}{\bf Architecture} &\multicolumn{1}{c}{\bf Coding Methods} &\multicolumn{1}{c}{\bf Clean} &\multicolumn{1}{c}{\bf FGSM} &\multicolumn{1}{c}{\bf PGD} &\multicolumn{1}{c}{\bf F-QTE} &\multicolumn{1}{c}{\bf P-QTE} \\
\hline
\multicolumn{1}{c}{\multirow{5}{*}{CIFAR10}}
    & VGG-5 & ANN & 90.95 &10.89  & 0.12 & 4.07 & 3.64 \\
    \cline{2-8}
    & VGG-5 & Direct & 90.69 & 6.19 & 0.03 & 3.88 & 3.63 \\
    & VGG-5 & Poisson & 83.18  &31.20 & 22.16 & 4.58 & 4.21 \\
    % & VGG-5 & RSC-noclamp-0.1(\textbf{Ours}) & 88.30 & 26.13  & 24.16 & 0.078 & 0.080 \\
    % & VGG-5 & RSC-noclamp-0.5(\textbf{Ours}) & 83.85 & 39.60 & 29.64 & 0.055 & 0.068 \\
    & VGG-5 & RSC-0.1(\textbf{Ours}) & 80.29 & \underline{51.29} & \underline{37.28} & \underline{5.26} & \underline{4.70}  \\
    & VGG-5 & RSC-0.5(\textbf{Ours}) & 78.67 & \textbf{66.61} & \textbf{58.94} & \textbf{5.81} & \textbf{5.50}  \\
    \hline
    \multicolumn{1}{c}{\multirow{6}{*}{CIFAR100}}
    & VGG-11 & ANN &  72.86 & 4.56  & 0.13 & 3.10 & 2.92 \\
    \cline{2-8}
    & VGG-11 & Direct & 72.45 & 4.67  & 0.22 & 3.08 & 2.91 \\
    & VGG-11 & Poisson & 58.49  &19.46 & 15.56 & 3.12 & 2.96  \\
    % RS-multi-2.0(\textbf{Ours})& T = 8 & 53.16\% & 
    %    25.25\% 
    %  & 21.22\%  \\
    % & VGG-11 & RSC-single-0.05(\textbf{Ours}) &  57.51 & 25.79 
    %   & 17.91  \\
    & VGG-11 & RSC-0.1(\textbf{Ours}) & 57.05 & 32.48 & 24.35 & 3.58 & 3.22  \\
    & VGG-11 & RSC-0.2(\textbf{Ours}) & 55.42 & \underline{37.83} & \underline{29.69} & \textbf{3.73} & \underline{3.40}  \\
    & VGG-11 & RSC-0.5(\textbf{Ours}) & 51.30 & \textbf{40.81} & \textbf{33.96} & \underline{3.68} & \textbf{3.41}  \\
    % & VGG-11 & RSC-noclamp-0.5(\textbf{Ours}) & 57.81 & 23.19 &   \\
    \hline
    \multicolumn{1}{c}{\multirow{5}{*}{Tiny-ImageNet}}  
    & VGG-16 & ANN & 60.77 & 2.08  & 0.00 & 2.51 & 2.43 \\
    \cline{2-8}
    & VGG-16 & Direct & 57.90 & 2.04 & 0.01 & 2.40 & 2.32  \\
    & VGG-16 & Poisson & 48.14 & 6.79  & 2.68 & 2.20 & 2.03 \\
   % SNN-RS-0.1(\textbf{Ours})& 87.42\% & 44.22\% & 42.02\% \\
   % VGG-11 & SNN-RS-0.5(\textbf{Ours})&57.55\% & 8.67\%  & 8.93\% \\
    & VGG-16 & RSC-0.01(\textbf{Ours}) & 48.33 & 7.73  & 2.15 & 2.24 & 2.02  \\
    & VGG-16 & RSC-0.1(\textbf{Ours}) & 47.47 & \textbf{22.63}  & \textbf{13.75} & \textbf{2.80} & \textbf{2.45} \\
    \hline
    \multicolumn{1}{c}{\multirow{7}{*}{ImageNet}}
     & ResNet-19 & ANN & 67.00 & 0.66  & 0.00 & \underline{2.71} & \textbf{2.68} \\
    \cline{2-8}
    & ResNet-19 & Direct & 56.41 & 2.57 & 0.02 & 2.36 & 2.26  \\
    & ResNet-19 & Poisson & 40.21 & 10.61  & 2.68 & 2.03 & 1.72 \\
    & ResNet-19 & RSC-0.1(\textbf{Ours}) & 44.25 & \underline{17.73}  & \textbf{8.50} & 2.48 & 2.11  \\
    \cline{2-8}
    & SEW-ResNet-18 & Direct & 64.40 & 4.56 & 0.00 & 2.76 & \underline{2.58}  \\
    & SEW-ResNet-18 & Poisson & 52.29 & 15.73  & 4.70 & 2.72 & 2.28  \\
    & SEW-ResNet-18 & RSC-0.1(\textbf{Ours}) & 53.79 & \textbf{25.86} & \underline{7.38} & \textbf{3.19} & 2.45 \\
    \hline
% \hline
\end{tabular}
% \end{sc}
% \end{small}
\end{center}
% \vskip -0.1in
\end{table*}



\begin{table*}[ht]
\caption{Black-box attack results on four datasets of ANN and three different coding methods of SNN. The best result is highlighted with bold and the second with \underline{underlined}. The larger the better for all metrics.}
\label{tab:bbatt}
% \vskip 0.15in
\begin{center}
% \begin{small}
% \begin{sc}
\begin{tabular}{cccccccc}
\hline
\multicolumn{1}{c}{\bf Dataset}  &\multicolumn{1}{c}{\bf Architecture} &\multicolumn{1}{c}{\bf Coding Methods} &\multicolumn{1}{c}{\bf Clean} &\multicolumn{1}{c}{\bf FGSM } &\multicolumn{1}{c}{\bf PGD} &\multicolumn{1}{c}{\bf F-QTE} &\multicolumn{1}{c}{\bf P-QTE} \\
\hline
\multicolumn{1}{c}{\multirow{3}{*}{CIFAR10}}
    % \cline{2-6}
    & VGG-5 & Direct & 90.69 & 20.75 & 3.52 & 4.46 & 3.77 \\
    & VGG-5 & Poisson & 83.18  & \underline{43.06} & \underline{36.15} & \underline{5.05} & \underline{4.77}  \\
    & VGG-5 & RSC-0.1(\textbf{Ours}) & 80.29 & \textbf{59.25} & \textbf{49.55} & \textbf{5.58} & \textbf{5.19}  \\
    \hline
    \multicolumn{1}{c}{\multirow{3}{*}{CIFAR100}}
    % & VGG-11 & ANN &  72.86 & 4.56  & \textit{8.5} \\
    % \cline{2-6}
    & VGG-11 & Direct & 72.45 & 11.79  & 4.08 & 3.37 & 3.06 \\
    & VGG-11 & Poisson & 58.49  & \underline{31.03} & \underline{27.36} & \underline{3.58} & \underline{3.43}  \\
    % RS-multi-2.0(\textbf{Ours})& T = 8 & 53.16\% & 
    %    25.25\% 
    %  & 21.22\%  \\
    & VGG-11 & RSC-0.1(\textbf{Ours}) & 57.05 & \textbf{41.74} & \textbf{35.56} & \textbf{3.95} & \textbf{3.70}  \\
    \hline
    \multicolumn{1}{c}{\multirow{3}{*}{Tiny-ImageNet}}  
    % & VGG-16 & ANN & 60.77 & 2.08  & 4.26 \\
    % \cline{2-6}
    & VGG-16 & Direct & 57.90 & 14.82 & 8.15 & 2.91 & 2.64  \\
    & VGG-16 & Poisson & 48.14 & \underline{21.22}  & \underline{16.73} & \underline{2.77} & \underline{2.59} \\
   % SNN-RS-0.1(\textbf{Ours})& 87.42\% & 44.22\% & 42.02\% \\
   % VGG-11 & SNN-RS-0.5(\textbf{Ours})&57.55\% & 8.67\%  & 8.93\% \\
    & VGG-16 & RSC-0.1(\textbf{Ours}) & 47.47 & \textbf{35.06}  & \textbf{29.40} & \textbf{3.30} & \textbf{3.07}  \\
    \hline
    \multicolumn{1}{c}{\multirow{3}{*}{ImageNet}}
    & SEW-ResNet-18 & Direct & 64.40 & 15.75 & 11.89 & \underline{3.21} & \underline{3.05}  \\
    & SEW-ResNet-18 & Poisson & 52.29 & \underline{16.87}  & \underline{16.65} & 2.77 & 2.76 \\
    & SEW-ResNet-18 & RSC-0.1(\textbf{Ours}) & 53.79 & \textbf{29.52} & \textbf{27.91} & \textbf{3.33} & \textbf{3.27} \\
    \hline
% \hline
\end{tabular}
% \end{sc}
% \end{small}
\end{center}
% \vskip -0.1in
\end{table*}


\subsection{Efficient-RSC Training (E-RSCT)}
\label{sec:ekd}
We found that while RSC improved the SNN model's adversarial robustness, it also led to a certain degree of decline in clean accuracy. To alleviate this problem, we propose E-RSCT for training SNN models using RSC. Motivated by the idea of knowledge distillation, we found that the corresponding ANN have naturally high clean accuracy, so we decided to use a pre-trained ANN as a teacher model to transfer the learned knowledge to the RSC-SNN model.

E-RSCT consists of two parts of loss functions during the training process. First, in order to transfer the learned knowledge from the teacher model \cite{hinton2015distilling}, we define the loss function of the first part as $\mathcal{L}_{KD}$
% For the output of the teacher model and the student model, a softmax process is performed, which can be formulated as
% \begin{equation}
%     {{q}_{i}}=\frac{\exp \left( {{z}_{i}}/T \right)}{\sum\nolimits_{j}{\exp \left( {{z}_{j}}/T \right)}},
% \end{equation}
% where ${z}_{i}$ is the original output of the model, and ${p}_{i}$ is the probability of the corresponding class. $T$ controls how much the student model softens the output of the teacher model. Generally, a higher $T$ will lead to a smoother probability distribution, making it easier for the student model to learn the knowledge of the teacher model, but may reduce the overall accuracy of the model. Throughout our experiments, unless explicitly specified otherwise, we adopt a default $T$ value of 3.
and use KL divergence to measure the difference between the student network and the teacher network to get $\mathcal{L}_{KD}$.
\begin{equation}
    {\mathcal{L}_{KD}}=KL\left( {{O}_{stu}},{{O}_{tea}} \right),
\end{equation}
where ${O}_{tea}$ is the output of the teacher ANN model and ${O}_{stu}$ is the output of the student SNN model.

For the second part of the loss function, we use the pre-synaptic loss $\mathcal{L}_{P-S}$ \cite{deng2022temporal} in training. 

% The loss is composed of two parts, which can be formulated as
% \begin{equation}
%     {{\mathcal{L}}_{P-S}}=\left( 1-\alpha  \right) \frac{1}{T}\sum\limits_{t=1}^{T}{{{\mathcal{L}}_{CE}}\left[ O\left( t \right),y \right]} + \alpha {{\mathcal{L}}_{MSE}},
% \end{equation}
% where $O(t)$ represents pre-synaptic input $I(t)$ of the output layer and the hyperparameter $\alpha$ is used to control the proportion of the regular term. In the following experiments, we fix $\alpha=0.05$. The second part is a regular term:
% \begin{equation}
%     {{\mathcal{L}}_{MSE}}= \frac{1}{T}\sum\limits_{t=1}^{T}{\text{MSE}\left[ O\left( t \right),\phi  \right]},
% \end{equation}
% where $\phi$ is set to $V_{th}$.

By combining $\mathcal{L}_{KD}$ and $\mathcal{L}_{P-S}$, we get the new loss function used for the novel training as follows
\begin{equation}
    {{\mathcal{L}}_{E-RSC}}= \lambda{{\mathcal{L}}_{KD}} + {{\mathcal{L}}_{P-S}},
    \label{eq:loss}
\end{equation}
where $\lambda$ is used to achieve a trade-off between ${{\mathcal{L}}_{KD}}$ and ${{\mathcal{L}}_{P-S}}$. Without special explanation, we select $\lambda=0.1$ in the experiment. 
The detail of E-RSCT is shown in Algo.\ref{alg:algorithm2}.

\begin{algorithm}[tb]
	\caption{Training process of E-RSCT for one epoch.}
	\label{alg:algorithm2}
        % \textcolor{blue}{\textbf{Training}}\\
	\textbf{Input}: An SNN to be trained with RSC; a hyperparameter $\sigma$; training dataset; total training iteration: $I_{\rm train}$.\\
	\textbf{Output}: The well-trained SNN.
	\begin{algorithmic}[1] %[1] enables line numbers
		\FOR {all $i = 1, 2, \dots , I_{\rm train}$ iteration} 
		\STATE Get mini-batch training data, $\bm{x}_{\rm in}(i)$ and class label, $\bm{y}(i)$;
		\STATE Feed the  $\bm{x}_{\rm in}(i)$ into the SNN ;
        \STATE Generate new sample $\widetilde{x}$ by Eq.~\ref {eq:res};
        \STATE  Process $\widetilde{x}$ to get ${{\widetilde{x}}_{\text{clamp}}}$ by Eq.~\ref {eq:clamp};
		\STATE Calculate the SNN output, $\bm{o}_{\rm out}(i)$ by Eq.~\ref {eq:lif} ;
		\STATE Compute the loss function $  {{\mathcal{L}}_{E-RSC}}= \lambda{{\mathcal{L}}_{KD}} + {{\mathcal{L}}_{P-S}}$ by Eq.~\ref {eq:loss};
		\STATE Backpropagation and update model parameters;
		\ENDFOR
	\end{algorithmic}
\end{algorithm}


\begin{table}[!ht]
\caption{Enhanced robustness with adversarial training. The best result is highlighted with bold. The larger the better for all metrics.}
\label{tab:adv}
% \vskip 0.15in
\begin{center}
\begin{small}
% \begin{sc}
\begin{tabular}{cccccc}
\hline
\multicolumn{1}{c}{\bf Dataset}  &\multicolumn{1}{c}{\bf Architecture} &\multicolumn{1}{c}{\bf Methods} &\multicolumn{1}{c}{\bf Clean} &\multicolumn{1}{c}{\bf FGSM } &\multicolumn{1}{c}{\bf PGD}  \\
\hline
\multicolumn{1}{c}{\multirow{2}{*}{CIFAR10}}
    % \cline{2-6}
    & VGG-5 & RSC-0.1 & 80.29 & 51.29 & 37.28   \\
    & VGG-5 & RSC-0.1 + Adv & 80.27 & \textbf{55.58} & \textbf{43.59}  \\
    \hline
    \multicolumn{1}{c}{\multirow{2}{*}{CIFAR100}}
    % & VGG-11 & ANN &  72.86 & 4.56  & \textit{8.5} \\
    % \cline{2-6}
    % RS-multi-2.0(\textbf{Ours})& T = 8 & 53.16\% & 
    %    25.25\% 
    %  & 21.22\%  \\
   & VGG-11 & RSC-0.1 & 57.05 & 32.48 & 24.35 \\
    & VGG-11 & RSC-0.1 + Adv & 56.25 & \textbf{35.53} & \textbf{27.57}  \\
    \hline
\end{tabular}
% \end{sc}
\end{small}
\end{center}
% \vskip -0.1in
\end{table}

\begin{table*}[!ht]
\caption{Comparison of results with E-RSCT and without E-RSCT. The best result is highlighted with bold. The larger the better for all metrics.}
\label{tab:ekd}
% \vskip 0.15in
\begin{center}
% % \begin{small}
% \begin{sc}
\begin{tabular}{cccccccc}
\hline
\multicolumn{1}{c}{\bf Dataset}  &\multicolumn{1}{c}{\bf Architecture} &\multicolumn{1}{c}{\bf Methods} &\multicolumn{1}{c}{\bf Clean} &\multicolumn{1}{c}{\bf FGSM} &\multicolumn{1}{c}{\bf PGD} &\multicolumn{1}{c}{\bf F-QTE} &\multicolumn{1}{c}{\bf P-QTE} \\
\hline
\multicolumn{1}{c}{\multirow{2}{*}{CIFAR-10}}
    & VGG-5 & Baseline & 80.29 & 51.29 & 37.28 & 5.26 & 4.70 \\
    \cline{2-8}
    & VGG-5 & +E-RSCT & \textbf{82.03} & \textbf{54.52} & \textbf{39.98} & \textbf{5.46} & \textbf{4.88} \\
    \hline
    \multicolumn{1}{c}{\multirow{2}{*}{CIFAR-100}}
    & VGG-11 & Baseline & 57.05 & 32.48 & 24.35 & 3.58 & 3.26  \\
    \cline{2-8}
    & VGG-11 & +E-RSCT & \textbf{58.04} & \textbf{34.89} & \textbf{26.67} & \textbf{3.72} & \textbf{3.39} \\
    \hline
    \multicolumn{1}{c}{\multirow{2}{*}{Tiny-ImageNet}}  
    & VGG-16 & Baseline & 47.47 & 22.63 & 13.75 & 2.80 & 2.45  \\
    \cline{2-8}
    & VGG-16 & +E-RSCT & \textbf{48.29} & \textbf{24.01} & \textbf{15.46} & \textbf{2.89} & \textbf{2.55} \\
    \hline
    \multicolumn{1}{c}{\multirow{2}{*}{ImageNet}}
    &  SEW-ResNet-18 & Baseline & 53.79 & 25.86 & 7.38 & 3.19 & 2.45 \\
    \cline{2-8}
    &  SEW-ResNet-18 & +E-RSCT & \textbf{54.77} & \textbf{27.21} & \textbf{8.84} & \textbf{3.28} &  \textbf{2.54} \\
    \hline
% \hline
\end{tabular}
% \end{sc}
% % \end{small}
\end{center}
% \vskip -0.1in
\end{table*}

% On CIFAR10, CIFAR-100, and Tiny-ImageNet, we set the time step $T=8$ for DIRECT and RSC, and the time step $T=16$ for POISSON. On ImageNet, we set the time step $T=1$ for DIRECT and RSC, and the time step $T=4$ for POISSON. We train the SNN version of VGG-5 for CIFAR-10, train the SNN version of VGG-11 for CIFAR-100, train the SNN version of VGG-16 for Tiny-ImageNet, train the SNN version of ResNet-19 and SEW-ResNet-18 \cite{fang2021deep} for ImageNet. 

% The detailed training process is presented in Appendix.
% \subsection{Results}





\section{Experiments}
\subsection{Experimental Setup}
We verify the effectiveness of the proposed RSC and E-RSCT on multiple datasets and compare with ANNs simultaneously. In the following experiments, SNNs using direct coding are represented by DIRECT, SNNs using RS coding are represented by RSC and SNNs using Poisson coding are represented by POISSON. For the trade-off measurement of the model under different attacks, we use F-QTE to represent the Quantification Trade-off Estimation under the FGSM attack, and P-QTE to represent the Quantification Trade-off Estimation under the PGD attack. Detailed implementation is referred to in the supplementary material. For adversarial robustness evaluation, specific hyperparameter settings are introduced in Section \ref{sec:att}. In the experiments of E-RSCT, we used the hyperparameters set in Section \ref{sec:ekd}. 


\subsection{Performance under attacks.}
\textbf{Clean accuracy and adversarial robustness.} Clean accuracy refers to the accuracy on the clean test dataset. It was represented as CLEAN in the experiment. The evaluation of adversarial robustness accuracy is denoted as FGSM and PGD respectively.


\begin{figure}[ht]
    \centering    
    \subfigure[Ablation experiments of noise $\sigma^{2}$ - 
 FGSM.]{				% 图片1([]内为子图标题)				
    \includegraphics[width=0.22\textwidth]{Figure/attack_ablation1.pdf}}			  % 子图1的图片宽度 不能空行
    \subfigure[Ablation experiments of noise $\sigma^{2}$ - 
 PGD.]{				% 图片2
    \includegraphics[width=0.22\textwidth]{Figure/attack_ablation2.pdf}}
	% \caption{Data Screening} % 图片标题 
 
	\caption{Ablation experiment for noise level $\sigma^2$.} % 图片标题 
    \label{fig:att_abl}
    % \vskip -0.3in
\end{figure}


\textbf{Results on different datasets.} Table \ref{tab:att} illustrates the performance evaluation of our proposed RSC scheme. For constructing effective attacks on SNN, all gradient attacks are applied based on BPTT. The specific implementation of BPTT is in the  supplementary material. The results consistently demonstrate the efficacy of our RSC in enhancing model adversarial robustness, as evidenced by notable enhancements in adversarial robustness accuracy across all attack methodologies. Particularly striking is the significant improvement in adversarial robustness against stronger white-box iterative attacks. Notably, the VGG-5 model exhibited a remarkable 58.91\% increase in accuracy when attacked by PGD compared to direct coding on the CIFAR-10 dataset. Simultaneously, the improvement of F-QTE and P-QTE also shows that our method better achieves the trade-off between accuracy and adversarial robustness. The experimental results that RSC shows more adversarial robustness than Poisson coding well verify Theorem \ref{the:1} and \ref{the:2}.

\textbf{Experiments on Tiny-ImageNet and ImageNet.} Previous work was limited to small datasets such as CIFAR-10 and CIFAR-100. We also conducted experiments on Tiny-ImageNet and ImageNet to provide a baseline for the evaluation of SNN adversarial robustness. It can be seen that the adversarial robustness of RSC-SNN has been significantly improved compared to DIRECT and POISSON.


\textbf{Black-box attack results on different datasets.} In this section, we assess the adversarial robustness of RSC against black-box attacks. We utilize a separately trained SNN with an identical architecture to generate white-box attack samples. The results presented in Table \ref{tab:bbatt} demonstrate that RSC demonstrates significant resilience against adversarial attacks, surpassing traditional SNNs in both FGSM and PGD scenarios. This robustness positions RSC as notably more resilient to adversarial intrusions in black-box scenarios. Compared with traditional SNNs, RSC-SNN's F-QTE and P-QTE have also improved in black-box attack scenarios.

% \begin{table}[ht]
% \caption{Enhanced robustness with adversarial training. The best result is highlighted with bold and the second with \underline{underlined}. The larger the better for all metrics.}
% \label{tab:rsc_with_adv}
% % \vskip 0.15in
% \begin{center}
% % % \begin{small}
% % \begin{sc}
% \begin{adjustbox}{width=0.45\textwidth}  % 设置表格宽度为文本宽度的100%
% \begin{tabular}{lcccr}
% \toprule
% ${\mathcal{L}}_{P-S}$ & ${\mathcal{L}}_{KD}$ & Clean & FGSM & PGD  \\
% \midrule
% $\surd$ & $\surd$ & 82.03 & 54.52 & 39.98 \\
% $\surd$ & $\times$ & 81.48 (\textbf{-0.55}) & 53.08 (\textbf{-1.44}) & 38.60(\textbf{-1.38}) \\
% $\times$ & $\times$ & 80.29 (\textbf{-1.74}) & 51.29 \textbf{(-3.23)}  & 37.28 (\textbf{-2.70})\\
% \bottomrule
% \end{tabular}
% \end{adjustbox}
% % \end{sc}
% % % \end{small}
% \end{center}
% % \vskip -0.3in
% % \vspace
% \end{table}



\begin{table*}[!ht]
\caption{Comparison with others works. The best result is highlighted with bold and the second with \underline{underlined}. The larger the better for all metrics.}
\label{tab:sota}
% \vskip 0.15in
\begin{center}
% \begin{small}
% \begin{sc}
\begin{tabular}{cccccccc}
\hline
\multicolumn{1}{c}{\bf Dataset}  &\multicolumn{1}{c}{\bf Architecture} &\multicolumn{1}{c}{\bf Methods} &\multicolumn{1}{c}{\bf FGSM} &\multicolumn{1}{c}{\bf PGD} &\multicolumn{1}{c}{\bf F-QTE} &\multicolumn{1}{c}{\bf P-QTE} &\multicolumn{1}{c}{\bf Clean} \\
\hline
\multicolumn{1}{c}{\multirow{6}{*}{CIFAR10}}
    & VGG-5 & Baseline & 6.19 & 0.03 & 3.88 & 3.63 & 90.69 \\
    & VGG-5 & \citet{sharmin2020inherent}\textit{\textsuperscript{ECCV}}& 15.00 & 3.80 & 4.17 & 3.72 & 89.30\\
    & VGG-5 & \citet{kundu2021hire}\textit{\textsuperscript{ICCV}} & 38.00 & 9.10 & 5.02 & 3.86 & 87.50 \\
    & VGG-5 & \citet{ding2022snn}\textit{\textsuperscript{NeurIPS}} & \underline{45.23} & \underline{21.16} & \underline{5.44} & \underline{4.48} & 90.74 \\
    % & WRN-16 & \cite{anonymous2023training}\textit{\textsuperscript{arXiv}} & 48.47 & 39.18 & 85.63 \\
    \cline{2-8}
    & VGG-5 & \textbf{Our work} & \textbf{54.52} & \textbf{39.98} & \textbf{5.46} & \textbf{4.88} & 82.03 \\
    \hline
    \multicolumn{1}{c}{\multirow{6}{*}{CIFAR100}}
    & VGG-11 & Baseline & 5.30& 0.02 & 3.15 & 2.93 & 73.33 \\
    & VGG-11 & \citet{sharmin2020inherent}\textit{\textsuperscript{ECCV}} & 15.50 & 6.30 & 3.20 & 2.83 & 64.40 \\
    & VGG-11 & \citet{kundu2021hire}\textit{\textsuperscript{ICCV}} & 22.00 & 7.50 & 3.48 & 2.90 & 65.10 \\
    & VGG-11 & \citet{ding2022snn}\textit{\textsuperscript{NeurIPS}} & \underline{25.86} & \underline{10.38} & \textbf{3.87} & \underline{3.25} & 70.89 \\
    % & WRN-16 & \cite{anonymous2023training}\textit{\textsuperscript{arXiv}} & 25.76 & 19.76 & 60.37 \\
    \cline{2-8}
    & VGG-11 & \textbf{Our work} & \textbf{34.89} & \textbf{26.67} & \underline{3.72} & \textbf{3.39} & 58.04 \\
    \hline
    \multicolumn{1}{c}{\multirow{2}{*}{Tiny-ImageNet}}
    & VGG-16 & Baseline & \underline{2.04} & \underline{0.03} & \underline{2.40} & \underline{2.32} & 57.90 \\
    \cline{2-8}
    & VGG-16 & \textbf{Our work} & \textbf{24.01} & \textbf{15.46} & \textbf{2.89} & \textbf{2.55} & 48.29\\
    \hline
    \multicolumn{1}{c}{\multirow{2}{*}{ImageNet}}
    & SEW-RESNET-18 & Baseline & \underline{4.56} & \underline{0.00} & \underline{2.76} & \textbf{2.58} & 64.40 \\
    \cline{2-8}
    & SEW-RESNET-18 & \textbf{Our work} & \textbf{27.21} & \textbf{8.84} & \textbf{3.28} & \underline{2.54} & 54.77\\
    \hline
% \hline
\end{tabular}
% \end{sc}
% \end{small}
\end{center}
% \vskip -0.1in
\end{table*}

\textbf{Enhanced Robustness with Adversarial Training.}
Adversarial training, has been the most widely accepted defense method. To evaluate the combined robustness of RSC and adversarial training, we explored their transferability and scalability. We trained SNN-Direct, SNN-Poisson and RSC using low-intensity FGSM samples and then exposed them to more complex and larger $\epsilon$ white-box attacks. Results in Table \ref{tab:adv} (rows 1-2 for CIFAR10 and rows 3-4 for CIFAR100) show a significant boost in robustness for RSC when combined with adversarial training. On CIFAR-10, this combination increased robustness for FGSM (to 55.58\% from 51.29\%) and PGD (to 43.59\% from 37.28\%). For CIFAR-100, resilience improved against FGSM (to 35.53\% from 32.48\%) and PGD (to 27.57\% from 24.35\%). In conclusion, the integration of RSC with adversarial training gives it the versatility to withstand a wider range of more powerful adversarial attacks.


\subsection{The effectiveness of E-RSCT.}
We can see from Table \ref{tab:att} that while RSC brings significant adversarial robustness improvement to the model, it also leads to clean accuracy decline. To alleviate this problem, we proposed E-RSCT for RSC-SNN. Table \ref{tab:ekd} summarizes the clean and robust accuracy of SNN models trained with and without E-RSCT. It can be seen from Table \ref{tab:ekd} that the clean accuracy and adversarial robustness of the model trained using E-RSCT on all datasets have been improved to a certain extent. On the CIFAR10 dataset, while the clean accuracy was improved by 1.74\%, its robust accuracy for FGSM and PGD was also improved by 3.23\% and 2.70\% respectively. On other datasets, an average accuracy improvement of more than 1\% has been achieved. The experimental results concretely verify the effectiveness of our proposed training algorithm. The improvement of F-QTE and P-QTE also shows that E-RSCT achieves better trade-offs.

\subsection{Ablation Studies}
% \begin{figure}[ht]
% \vskip 0.2in
% \begin{center}
% \centerline{\includegraphics[width=\columnwidth]{Figure/attack_ablation.pdf}}
% \caption{Ablation experiment for noise level $\sigma$.}
% \label{fig:att_abl}
% \end{center}
% \vskip -0.2in
% \end{figure}

\textbf{Effect of different noise levels $\sigma^2$ on RSC.}
Investigating the pivotal role of the noise level parameter $\sigma^2$ within the novel introduced RSC framework holds significant importance in regulating the model's adversarial robustness. We conducted an exhaustive ablation study to discern the effect of parameter variations on the model's adversarial robustness. Specifically, we selected three distinct values: $\sigma^{2}=0.01$, $\sigma^{2}=0.1$, and $\sigma^{2}=0.5$ to meticulously evaluate the model's adversarial robustness under varying attack intensities FGSM and PGD across multiple values ($\epsilon=2, 4, 6, 8$). The comprehensive experimental outcomes are visually presented in the Figure \ref{fig:att_abl}. The solid line shows clean accuracy, and the dotted line shows post-attack accuracy.

From Figure \ref{fig:att_abl}, a noticeable trend emerges: as the noise level ($\sigma^{2}$) escalates, there's a concurrent decline in the model's clean accuracy, a phenomenon congruent with our empirical analyses. Simultaneously, with an increase in $\sigma^{2}$, the model's adversarial robustness exhibits a consistent uptrend. Remarkably, the robust accuracy under various attack intensities showcases a discernible hierarchy, wherein higher $\sigma^{2}$ values correspond to augmented adversarial robustness. Specifically, the variations in robust accuracy across different attack intensities become more pronounced with increasing $\sigma^{2}$. Evidently, this underscores the significance of striking a balance between clean accuracy and adversarial robustness in real-world RSC applications. Achieving this balance necessitates meticulous exploration of $\sigma^{2}$ values to pinpoint the optimal choice aligned with specific application requisites.


\subsection{Comparison with State-of-the-art Work on Adversarial Robustness of SNN}
To evaluate the effectiveness of our proposed RSC, we compare it with the results of existing state-of-the-art work. We conduct experimental comparisons in the case of FGSM and PGD white-box attacks on the CIFAR-10 and CIFAR-100 datasets. The hyperparameters of the attack are set to $\epsilon=8/255$ for FGSM and $\alpha = 0.01$ for PGD with a total of 7 steps. The comparison results are shown in Table \ref{tab:sota}.

\textbf{CIFAR-10.} On the CIFAR-10 dataset, employing the RSC VGG-5 model with a noise level of $\sigma^{2}=0.1$, our approach showcased promising advancements. As indicated in the table, our method notably elevated the model accuracy against FGSM and PGD attacks by 48.33\% and 39.95\%, respectively, in contrast to the vanilla model. Furthermore, in comparison with the best-performing outcomes \cite{ding2022snn}, our approach achieved a substantial enhancement in accuracy by 9.29\% for FGSM and 18.82\% for PGD attacks.

\textbf{CIFAR-100.} On the CIFAR-100, our utilization of the RSC VGG-11 model with a noise level of $\sigma^{2}=0.1$ yielded notable advancements. The provided table demonstrates that our method elevated accuracy against FGSM and PGD attacks by 29.59\% and 26.65\%, respectively, surpassing the performance of the vanilla model. In comparison to the top-performing outcomes, our approach showcased compelling enhancements, achieving a remarkable 9.03\% accuracy improvement for FGSM and 16.29\% for PGD attacks.

Upon comparing our experimental outcomes with the State-of-the-Art (SOTA) approaches on the CIFAR-10 and CIFAR-100 datasets, our proposed method showcased significant enhancements in the model's adversarial robustness. F-QTE and P-QTE also achieve comparable results to SOTA. Notably, while augmenting adversarial robustness, we observed a decline in clean accuracy compared to the vanilla model. Hence, to achieve a balance between clean accuracy and adversarial robustness, we meticulously fine-tuned various hyperparameters involved in the training process. Parameters like the noise level $\sigma$, the proportion of the loss function $\lambda$, etc., were judiciously adjusted in the E-RSCT framework for refinement. However, achieving superior results still necessitates further extensive research and exploration.


\section{Conclusion}
Our present work offers a theoretical foundation for the observed empirical robustness of Poisson-encoded classifiers against adversarial attacks. Observing that randomized smoothing and Poisson coding exhibit similar characteristics, we first demonstrate the equivalence between the two, explaining why Poisson coding SNNs have adversarial robustness. Furthermore, our theoretical analysis shows that randomized smoothing is more stable than Poisson coding. On this basis we propose a novel randomized smoothing coding, which enhances the adversarial robustness of SNNs. Experimental results show that our method achieves state-of-the-art adversarial robustness. However, there is still room for further improvement in clean accuracy. Therefore, valuable future work directions include further improving the trade-off between adversarial robustness and clean accuracy. We believe our work will  pave the way for further research on more applications of safety-critical SNNs.


\clearpage
%%
%% The acknowledgments section is defined using the "acks" environment
%% (and NOT an unnumbered section). This ensures the proper
%% identification of the section in the article metadata, and the
%% consistent spelling of the heading.
\begin{acks}
This work was partially supported by the National Distinguished Young Scholars (62325603), the National Natural Science Foundation of China (62236009,U22A20103,62441606), the Beijing Natural Science Foundation for Distinguished Young Scholars (JQ21015), the China Postdoctoral Science Foundation (GZB20240824, 2024M753497), and the CAAI-MindSpore Open Fund, which was developed on the OpenI Community.
\end{acks}


%%
%% The next two lines define the bibliography style to be used, and
%% the bibliography file.
\bibliographystyle{ACM-Reference-Format}
\bibliography{sample-base}

%%
%% If your work has an appendix, this is the place to put it.
% \appendix

% \section{Research Methods}

% \subsection{Part One}

% Lorem ipsum dolor sit amet, consectetur adipiscing elit. Morbi
% malesuada, quam in pulvinar varius, metus nunc fermentum urna, id
% sollicitudin purus odio sit amet enim. Aliquam ullamcorper eu ipsum
% vel mollis. Curabitur quis dictum nisl. Phasellus vel semper risus, et
% lacinia dolor. Integer ultricies commodo sem nec semper.

% \subsection{Part Two}

% Etiam commodo feugiat nisl pulvinar pellentesque. Etiam auctor sodales
% ligula, non varius nibh pulvinar semper. Suspendisse nec lectus non
% ipsum convallis congue hendrerit vitae sapien. Donec at laoreet
% eros. Vivamus non purus placerat, scelerisque diam eu, cursus
% ante. Etiam aliquam tortor auctor efficitur mattis.

% \section{Online Resources}

% Nam id fermentum dui. Suspendisse sagittis tortor a nulla mollis, in
% pulvinar ex pretium. Sed interdum orci quis metus euismod, et sagittis
% enim maximus. Vestibulum gravida massa ut felis suscipit
% congue. Quisque mattis elit a risus ultrices commodo venenatis eget
% dui. Etiam sagittis eleifend elementum.

% Nam interdum magna at lectus dignissim, ac dignissim lorem
% rhoncus. Maecenas eu arcu ac neque placerat aliquam. Nunc pulvinar
% massa et mattis lacinia.

\end{document}
\endinput
%%
%% End of file `sample-sigconf.tex'.
