Spiking neural networks (SNNs) compute with discrete spikes and exploit temporal structure, yet most adversarial attacks change intensities or event counts instead of timing. We study a timing-only adversary that retimes existing spikes while preserving spike counts and amplitudes in event-driven SNNs, thus remaining rate-preserving. We formalize a capacity-1 spike-retiming threat model with a unified trio of budgets: per-spike jitter $\mathcal{B}_{\infty}$, total delay $\mathcal{B}_{1}$, and tamper count $\mathcal{B}_{0}$. Feasible adversarial examples must satisfy timeline consistency and non-overlap, which makes the search space discrete and constrained. To optimize such retimings at scale, we use projected-in-the-loop (PIL) optimization: shift-probability logits yield a differentiable soft retiming for backpropagation, and a strict projection in the forward pass produces a feasible discrete schedule that satisfies capacity-1, non-overlap, and the chosen budget at every step. The objective maximizes task loss on the projected input and adds a capacity regularizer together with budget-aware penalties, which stabilizes gradients and aligns optimization with evaluation. Across event-driven benchmarks (CIFAR10-DVS, DVS-Gesture, N-MNIST) and diverse SNN architectures, we evaluate under binary and integer event grids and a range of retiming budgets, and also test models trained with timing-aware adversarial training designed to counter timing-only attacks. For example, on DVS-Gesture the attack attains high success (over $90\%$) while touching fewer than $2\%$ of spikes under $\mathcal{B}_{0}$. Taken together, our results show that spike retiming is a practical and stealthy attack surface that current defenses struggle to counter, providing a clear reference for temporal robustness in event-driven SNNs. Code is available at https://github.com/yuyi-sd/Spike-Retiming-Attacks.

翻译：脉冲神经网络（SNNs）利用离散脉冲进行计算并利用时间结构，然而大多数对抗性攻击改变的是强度或事件数量而非时序。我们研究一种仅改变时序的对抗攻击，它在事件驱动的SNNs中重定时现有脉冲，同时保持脉冲数量和幅度不变，从而维持脉冲发放率不变。我们形式化了一个容量为1的脉冲重定时威胁模型，包含三个统一的预算指标：每脉冲抖动$\mathcal{B}_{\infty}$、总延迟$\mathcal{B}_{1}$以及篡改计数$\mathcal{B}_{0}$。可行的对抗样本必须满足时间线一致性和非重叠性约束，这使得搜索空间是离散且受限的。为了大规模优化此类重定时操作，我们采用循环内投影（PIL）优化方法：通过移位概率逻辑值产生可微分的软重定时以进行反向传播，在前向传播中通过严格投影生成满足容量为1、非重叠性约束及每步所选预算的可行离散调度方案。优化目标最大化投影输入上的任务损失，并加入容量正则化项与预算感知惩罚项，从而稳定梯度并使优化与评估目标对齐。我们在多个事件驱动基准数据集（CIFAR10-DVS、DVS-Gesture、N-MNIST）和不同SNN架构上，针对二进制和整数事件网格及一系列重定时预算进行评估，同时测试了专为抵御纯时序攻击而设计的时序感知对抗训练模型。例如，在DVS-Gesture数据集上，该攻击在$\mathcal{B}_{0}$预算下仅需修改少于$2\%$的脉冲即可实现高成功率（超过$90\%$）。综合而言，我们的结果表明脉冲重定时是一种实用且隐蔽的攻击途径，现有防御方法难以有效应对，这为事件驱动SNNs的时间鲁棒性研究提供了明确参考。代码发布于https://github.com/yuyi-sd/Spike-Retiming-Attacks。