Spiking Neural Networks (SNNs) utilize spike-based activations to mimic the brain's energy-efficient information processing. However, the binary and discontinuous nature of spike activations causes vanishing gradients, making adversarial robustness evaluation via gradient descent unreliable. While improved surrogate gradient methods have been proposed, their effectiveness under strong adversarial attacks remains unclear. We propose a more reliable framework for evaluating SNN adversarial robustness. We theoretically analyze the degree of gradient vanishing in surrogate gradients and introduce the Adaptive Sharpness Surrogate Gradient (ASSG), which adaptively evolves the shape of the surrogate function according to the input distribution during attack iterations, thereby enhancing gradient accuracy while mitigating gradient vanishing. In addition, we design an adversarial attack with adaptive step size under the $L_\infty$ constraint-Stable Adaptive Projected Gradient Descent (SA-PGD), achieving faster and more stable convergence under imprecise gradients. Extensive experiments show that our approach substantially increases attack success rates across diverse adversarial training schemes, SNN architectures and neuron models, providing a more generalized and reliable evaluation of SNN adversarial robustness. The experimental results further reveal that the robustness of current SNNs has been significantly overestimated and highlighting the need for more dependable adversarial training methods.

翻译：脉冲神经网络（SNNs）利用基于脉冲的激活来模拟大脑高能效的信息处理过程。然而，脉冲激活的二元性和不连续性会导致梯度消失，使得基于梯度下降的对抗鲁棒性评估变得不可靠。尽管已有改进的代理梯度方法被提出，但它们在强对抗攻击下的有效性仍不明确。我们提出了一种更可靠的SNN对抗鲁棒性评估框架。我们从理论上分析了代理梯度中梯度消失的程度，并引入了自适应锐度代理梯度（ASSG），该方法在攻击迭代过程中根据输入分布自适应地演化代理函数的形状，从而在缓解梯度消失的同时提高梯度准确性。此外，我们在$L_\infty$约束下设计了一种具有自适应步长的对抗攻击方法——稳定自适应投影梯度下降（SA-PGD），能够在梯度不精确的情况下实现更快、更稳定的收敛。大量实验表明，我们的方法在不同对抗训练方案、SNN架构和神经元模型上均显著提高了攻击成功率，为SNN对抗鲁棒性提供了更通用和可靠的评估。实验结果进一步揭示，当前SNNs的鲁棒性被显著高估，并突显了对更可靠对抗训练方法的需求。