Spiking neural networks (SNNs) compute with discrete spikes and exploit temporal structure, yet most adversarial attacks change intensities or event counts instead of timing. We study a timing-only adversary that retimes existing spikes while preserving spike counts and amplitudes in event-driven SNNs, thus remaining rate-preserving. We formalize a capacity-1 spike-retiming threat model with a unified trio of budgets: per-spike jitter $\mathcal{B}_{\infty}$, total delay $\mathcal{B}_{1}$, and tamper count $\mathcal{B}_{0}$. Feasible adversarial examples must satisfy timeline consistency and non-overlap, which makes the search space discrete and constrained. To optimize such retimings at scale, we use projected-in-the-loop (PIL) optimization: shift-probability logits yield a differentiable soft retiming for backpropagation, and a strict projection in the forward pass produces a feasible discrete schedule that satisfies capacity-1, non-overlap, and the chosen budget at every step. The objective maximizes task loss on the projected input and adds a capacity regularizer together with budget-aware penalties, which stabilizes gradients and aligns optimization with evaluation. Across event-driven benchmarks (CIFAR10-DVS, DVS-Gesture, N-MNIST) and diverse SNN architectures, we evaluate under binary and integer event grids and a range of retiming budgets, and also test models trained with timing-aware adversarial training designed to counter timing-only attacks. For example, on DVS-Gesture the attack attains high success (over $90\%$) while touching fewer than $2\%$ of spikes under $\mathcal{B}_{0}$. Taken together, our results show that spike retiming is a practical and stealthy attack surface that current defenses struggle to counter, providing a clear reference for temporal robustness in event-driven SNNs. Code is available at https://github.com/yuyi-sd/Spike-Retiming-Attacks.

翻译：脉冲神经网络（SNNs）利用离散脉冲进行计算并利用时间结构，然而大多数对抗性攻击改变的是强度或事件计数而非时序。我们研究了一种仅改变时序的对抗攻击，它在事件驱动SNNs中重定时现有脉冲，同时保持脉冲计数和幅度不变，从而维持脉冲发放率不变。我们形式化了一个容量为1的脉冲重定时威胁模型，采用统一的三种预算约束：单脉冲抖动预算 $\mathcal{B}_{\infty}$、总延迟预算 $\mathcal{B}_{1}$ 和篡改计数预算 $\mathcal{B}_{0}$。可行的对抗样本必须满足时间线一致性和非重叠性，这使得搜索空间是离散且受约束的。为了大规模优化此类重定时操作，我们采用循环内投影（PIL）优化方法：移位概率逻辑值通过反向传播产生可微的软重定时，而前向传播中的严格投影则生成满足容量为1、非重叠性以及每一步所选预算约束的可行离散调度方案。优化目标最大化投影输入上的任务损失，并添加容量正则化项及预算感知惩罚项，从而稳定梯度并使优化与评估目标一致。在多个事件驱动基准数据集（CIFAR10-DVS、DVS-Gesture、N-MNIST）和多样化的SNN架构上，我们在二进制和整数事件网格以及一系列重定时预算下进行评估，同时测试了采用旨在抵御纯时序攻击的时序感知对抗训练所训练的模型。例如，在DVS-Gesture数据集上，该攻击在 $\mathcal{B}_{0}$ 预算下仅触及不到 $2\%$ 的脉冲即实现了高成功率（超过 $90\%$）。综合来看，我们的结果表明脉冲重定时是一种实用且隐蔽的攻击面，现有防御措施难以有效应对，这为事件驱动SNNs的时间鲁棒性研究提供了明确的参考。代码发布于 https://github.com/yuyi-sd/Spike-Retiming-Attacks。