脉冲神经网络权重量化方法与对抗鲁棒性分析

Weight Quantization Method for Spiking Neural Networks and Analysis of Adversarial Robustness

类脑芯片中的脉冲神经网络(SNNs)具有高稀疏性和低功耗的特点,在视觉分类任务中存在应用优势,但仍面临对抗攻击的威胁。现有研究缺乏对网络部署到硬件的量化过程中鲁棒性损失的度量方法。该文研究硬件映射阶段的SNN权重量化方法及其对抗鲁棒性。建立基于反向传播和替代梯度的监督训练算法,并在CIFAR-10数据集上生成快速梯度符号法(FGSM)对抗攻击样本。创新性地提出一种感知量化的权重量化方法,并建立与对抗攻击的训练与推理相融合的评估框架。实验结果表明,在VGG9网络下,直接编码对抗鲁棒性最差。在权重量化前后,4种编码和4种结构参数组合方式下,推理精度损失差与层间脉冲活动的平均变化幅度分别增大73.23%和51.5%。该文指出稀疏性因素对鲁棒性的影响相关度为:阈值增加大于权重量化bit降低大于稀疏编码,所提对抗鲁棒性分析框架与权重量化方法在PIcore类脑芯片中得到了硬件验证。

Spiking Neural Networks(SNNs)in neuromorphic chips have the advantages of high sparsity and low power consumption,which make them suitable for visual classification tasks.However,they are still vulnerable to adversarial attacks.Existing studies lack robustness metrics for the quantization process when deploying the network into hardware.The weight quantization method of SNNs during hardware mapping is studied and the adversarial robustness is analyzed in this paper.A supervised training algorithm based on backpropagation and alternative gradients is proposed,and one types of adversarial attack samples,Fast Gradient Sign Method(FGSM),on the CIFAR-10 dataset are generated.A perception quantization method and an evaluation framework that integrates adversarial training and inference are provided innovatively.Experimental results show that direct encoding leads to the worst adversarial robustness in the VGG9 network.The difference between the accuracy loss and inter-layer pulse activity change before and after weight quantization increases by 73.23%and 51.5%,respectively,for four encoding and four structural parameter combinations.The impact of sparsity factors on robustness is:threshold increase more than bit reduction in weight quantization more than sparse coding.The proposed analysis framework and weight quantization method have been proved on the PIcore neuromorphic chip.