Adversarial Membrane Potential Reuse (A-MPR)

• The paper introduces A-MPR, which replaces the online membrane potential accumulation with optimized, stored states to enable immediate gradient flow in SNNs.
• It employs a dual-objective optimization—combining similarity and adversarial warm-start losses—to fine-tune pre-computed membrane images per target class, improving attack success rates by 1–3%.
• The method significantly reduces attack latency by bypassing the inefficient warm-up phase, cutting computation by up to 56.6% in both white-box and black-box scenarios.

Searching arXiv for the specified paper to ground the article and citation. arXiv search query: (Kang et al., 19 Aug 2025) Adversarial Membrane Potential Reuse (A-MPR) is a mechanism introduced within the timestep-compressed attack (TCA) framework for spiking neural networks (SNNs) to reduce adversarial attack latency by bypassing the initial membrane-potential accumulation phase. In a direct-training SNN, the first timesteps are used to build membrane potential until neurons begin firing; during this warm-up phase, firing activity is near zero and gradient signals are weak. A-MPR addresses this by replacing the on-the-fly accumulation of membrane potentials for the initial timesteps with pre-computed, class-conditioned membrane potentials that are stored offline and loaded at runtime, so that forward- and backpropagation begin immediately from a later timestep (Kang et al., 19 Aug 2025).

1. Conceptual basis and motivation

A-MPR is motivated by the observation that standard gradient-based adversarial attacks on SNNs incur substantial latency because they process multiple timesteps sequentially. Within this setting, the initial timesteps are described as inefficiently spent accumulating membrane potential rather than contributing meaningfully to attack generation. Observation O2 states that “Gradients extracted from the initial timesteps are ineffective due to low neuron firing activity,” which identifies the warm-up regime as a source of wasted computation (Kang et al., 19 Aug 2025).

In this formulation, A-MPR constructs a “membrane image” offline for each target label $y$. The stored object is a set of pre-computed membrane potentials for the initial timesteps, denoted $\{u_{\ell,1}^*, \dots, u_{\ell,t_1}^*\}$. At runtime, these pre-computed states initialize the network, eliminating the need to recompute the same accumulation process for timesteps $1,\dots,t_1$. This design is specifically tied to the temporal dynamics of SNNs rather than being a direct extension of ANN attack procedures (Kang et al., 19 Aug 2025).

A plausible implication is that A-MPR reframes the early temporal dynamics of an SNN attack as a reusable state-initialization problem rather than a mandatory online simulation phase. In the context of TCA, this allows attack computation to begin from a temporally advanced state without altering the subsequent update rule for later timesteps.

2. Formal definition in the LIF dynamics

In a direct-training SNN, each neuron’s membrane potential $u_{\ell,t}$ at layer $\ell$ and timestep $t$ is updated online as

$$u_{\ell,t} = \tau\,u_{\ell,t-1} + W_\ell\,s_{\ell-1,t} + \eta_{\ell,t},$$

where $\tau$ is the leak factor, $W_\ell$ the synaptic weight, $s_{\ell-1,t}$ the incoming spike, and $\{u_{\ell,1}^*, \dots, u_{\ell,t_1}^*\}$0 the reset term (Kang et al., 19 Aug 2025). The associated spike output is

$\{u_{\ell,1}^*, \dots, u_{\ell,t_1}^*\}$1

A-MPR modifies the dynamics for the initial timesteps $\{u_{\ell,1}^*, \dots, u_{\ell,t_1}^*\}$2 by replacing online updates with stored values:

$\{u_{\ell,1}^*, \dots, u_{\ell,t_1}^*\}$3

where $\{u_{\ell,1}^*, \dots, u_{\ell,t_1}^*\}$4 are pre-computed and stored offline. For timesteps $\{u_{\ell,1}^*, \dots, u_{\ell,t_1}^*\}$5, the model resumes the standard update beginning from $\{u_{\ell,1}^*, \dots, u_{\ell,t_1}^*\}$6 (Kang et al., 19 Aug 2025).

This definition preserves the original LIF dynamics after the cutoff while altering only the initialization regime. The mechanism therefore does not replace the full temporal computation of the SNN; it compresses the runtime by reusing a warmed-up internal state. This suggests that the principal intervention of A-MPR lies at the level of state preparation rather than network architecture or loss definition during the later attack phase.

3. Optimization of the membrane image

The pre-computed membrane image is optimized per target class $\{u_{\ell,1}^*, \dots, u_{\ell,t_1}^*\}$7 with a cutoff $\{u_{\ell,1}^*, \dots, u_{\ell,t_1}^*\}$8, where $\{u_{\ell,1}^*, \dots, u_{\ell,t_1}^*\}$9 is the total number of timesteps and $1,\dots,t_1$0 the number of layers. The optimization combines a similarity objective and an adversarial warm-start objective (Kang et al., 19 Aug 2025).

The similarity loss is defined as

$1,\dots,t_1$1

where

$1,\dots,t_1$2

This term is used to match the pre-computed membrane potentials to real warmed-up potentials. The adversarial warm-start loss is

$1,\dots,t_1$3

where $1,\dots,t_1$4 is the SNN’s output over timesteps $1,\dots,t_1$5. The total loss is

$1,\dots,t_1$6

The role of these terms is distinct. $1,\dots,t_1$7 aligns the stored state with the actual warmed-up network state, while $1,\dots,t_1$8 biases the stored initialization toward a target class. The ablation summary reports that using only $1,\dots,t_1$9 yields a baseline ASR, adding $u_{\ell,t}$0 raises ASR by approximately $u_{\ell,t}$1–$u_{\ell,t}$2, and adding class-specific optimization contributes another approximately $u_{\ell,t}$3–$u_{\ell,t}$4 (Kang et al., 19 Aug 2025).

This decomposition indicates that A-MPR is not merely a cache of ordinary early states. The optimization objective makes the reused state simultaneously representative of warm-up behavior and useful for accelerating adversarial optimization.

4. Offline construction and runtime integration

The offline pre-computation stage takes as inputs the training set $u_{\ell,t}$5, target class $u_{\ell,t}$6, cutoff $u_{\ell,t}$7, step size $u_{\ell,t}$8, clamp range $u_{\ell,t}$9, and iterations $\ell$0. The membrane image $\ell$1 is initialized randomly in input space. For each iteration, the procedure forwards $\ell$2 through the network up to $\ell$3 to obtain $\ell$4, computes $\ell$5 for a batch of real inputs, evaluates $\ell$6 and $\ell$7, updates $\ell$8 via

$\ell$9

and clamps $t$0 to $t$1. The final $t$2 is then stored for class $t$3 (Kang et al., 19 Aug 2025).

At runtime, A-MPR is integrated into TCA together with Timestep-Level Backpropagation (TLBP). The attack loads the pre-computed $t$4 for the target class, initializes the membrane potentials for $t$5 using these values, and thereby bypasses the warm-up phase. Perturbation generation then proceeds over later windows using the accumulated cross-entropy threshold and iterative gradient-sign updates on $t$6 (Kang et al., 19 Aug 2025).

The runtime integration can be summarized as follows:

Stage	Operation	Role
Offline	Optimize and store $t$7 per class	Build reusable warmed-up state
Initialization	Set $t$8 for $t$9	Bypass warm-up
Online attack	Run windowed forward/backward updates from $$u_{\ell,t} = \tau\,u_{\ell,t-1} + W_\ell\,s_{\ell-1,t} + \eta_{\ell,t},$$0 onward	Generate adversarial perturbation

This division between offline state synthesis and online perturbation optimization is central to the method. The offline cost is amortized over all attacks and does not affect per-example runtime (Kang et al., 19 Aug 2025).

5. Efficiency and latency reduction

Without A-MPR, an attack using the full $$u_{\ell,t} = \tau\,u_{\ell,t-1} + W_\ell\,s_{\ell-1,t} + \eta_{\ell,t},$$1 timesteps performs $$u_{\ell,t} = \tau\,u_{\ell,t-1} + W_\ell\,s_{\ell-1,t} + \eta_{\ell,t},$$2 windows of forward and backward passes, where $$u_{\ell,t} = \tau\,u_{\ell,t-1} + W_\ell\,s_{\ell-1,t} + \eta_{\ell,t},$$3 is the window size. A-MPR removes the first $$u_{\ell,t} = \tau\,u_{\ell,t-1} + W_\ell\,s_{\ell-1,t} + \eta_{\ell,t},$$4 timesteps from runtime, reducing the number of windows from $$u_{\ell,t} = \tau\,u_{\ell,t-1} + W_\ell\,s_{\ell-1,t} + \eta_{\ell,t},$$5 to $$u_{\ell,t} = \tau\,u_{\ell,t-1} + W_\ell\,s_{\ell-1,t} + \eta_{\ell,t},$$6 (Kang et al., 19 Aug 2025).

The stated efficiency analysis gives a direct estimate of saved computation: FLOPs saved are approximately $$u_{\ell,t} = \tau\,u_{\ell,t-1} + W_\ell\,s_{\ell-1,t} + \eta_{\ell,t},$$7 of the total per-attack cost. For example, when $$u_{\ell,t} = \tau\,u_{\ell,t-1} + W_\ell\,s_{\ell-1,t} + \eta_{\ell,t},$$8 and $$u_{\ell,t} = \tau\,u_{\ell,t-1} + W_\ell\,s_{\ell-1,t} + \eta_{\ell,t},$$9, the saved computation is $\tau$0 of the passes. When combined with early stopping from TLBP, the actual average latency reduction can be much higher, exceeding $\tau$1 in experiments (Kang et al., 19 Aug 2025).

Latency is measured as wall-clock time to generate one adversarial example, with a real-time target of approximately $\tau$2 for $\tau$3 operation. On CIFAR-10/100 with VGG-11 and ResNet-17 trained via STBP, TCA, which combines TLBP and A-MPR, reduces latency by up to $\tau$4 in white-box settings and up to $\tau$5 in black-box settings while maintaining comparable attack success rate (Kang et al., 19 Aug 2025).

These results locate A-MPR within a broader temporal compression strategy. A plausible implication is that the main value of A-MPR is not only the direct reduction in simulated timesteps, but also the fact that it improves the starting point from which later windowed updates operate.

6. Empirical behavior, constraints, and implications

The warm-up effect of A-MPR is reported separately from the full TCA framework. Relative to standard FGSM, A-MPR raises the initial ASR at $\tau$6 from approximately $\tau$7 to approximately $\tau$8 on VGG-11/CIFAR-10, and at $\tau$9 up to approximately $W_\ell$0 (Kang et al., 19 Aug 2025). These values are consistent with the claim that early timesteps in unmodified SNN attacks are dominated by membrane accumulation rather than informative spiking dynamics.

The method is also sensitive to clamping bounds during offline optimization. The best performance is obtained when potentials are constrained to $W_\ell$1, whereas unbounded potentials degrade ASR to below $W_\ell$2 (Kang et al., 19 Aug 2025). This indicates that the stored membrane potentials must remain within a controlled range to function effectively as a reusable warm-start state.

The stated assumptions and limitations are specific. A-MPR requires offline per-class optimization of membrane images, which is less flexible when the number of target classes is very large. The pre-computed potentials also assume static model weights; any change to the SNN requires regeneration of the stored states (Kang et al., 19 Aug 2025). Potential extensions identified for the method include adaptive A-MPR with online fine-tuning, joint optimization of $W_\ell$3 and $W_\ell$4, and extension to regression or continuous-control tasks with SNNs (Kang et al., 19 Aug 2025).

The broader impact identified for A-MPR is twofold. First, it demonstrates that warm-up inefficiencies in SNNs can be exploited for faster adversarial attacks. Second, it suggests that defenses for SNNs may need to consider both initial membrane potentials and per-timestep resilience (Kang et al., 19 Aug 2025). This suggests that A-MPR is relevant not only as an attack acceleration mechanism but also as an analytical lens on how temporal state initialization influences adversarial vulnerability in neuromorphic models.