1 Introduction↩︎

Spiking Neural Networks (SNNs) have recently narrowed the accuracy gap with Artificial Neural Networks (ANNs) on vision benchmarks, driven by advances in deep learning [1]–[5]. Their sparse and event-driven computation offers substantial gains in energy efficiency [6], [7], making them attractive for deployment in resource-constrained environments. However, real-world scenarios often involve diverse perturbations and corruptions, making robustness a critical requirement. Realizing the advantages of SNNs in practical applications therefore depends crucially on improving both accuracy and robustness.

In this work, robustness is defined as the maximum variation in network outputs induced by bounded input perturbations. Smaller output variation indicates stronger robustness. In vision tasks, this property is typically evaluated under two settings: adversarial perturbations and common corruptions. Adversarial perturbations are deliberately designed input changes that induce misclassification [8], while common corruptions stem from conditions such as noise, blur, or weather effects [9]. Most existing SNN studies have primarily focused on improving adversarial robustness by exploiting spike coding, neural dynamics, and training strategies [10]–[13]. Recent approaches based on Poisson coding and adversarial training have achieved adversarial robustness exceeding that of ANNs [14], [15]. Poisson coding introduces stochastic spike trains to represent input intensities, effectively injecting noise that mitigates the impact of adversarial perturbations, but often at the cost of markedly reduced accuracy [16]. In contrast, direct-coded SNNs deterministically convert input intensities into precise spike trains or rates [17]–[19], achieving significantly higher accuracy and thus becoming the most widely used approaches [20]–[22]. Nevertheless, these models still fall short of ANNs in terms of adversarial robustness [23]. Furthermore, our experiments reveal a clear limitation in the robustness of SNNs to common corruptions compared with ANNs. These observations highlight a persistent accuracy–robustness problem in SNNs, which prevents them from achieving ANN-level accuracy and robustness simultaneously, as illustrated in Fig. 1.

This paper focuses on direct-coded SNNs, owing to their high accuracy and widespread use. We jointly examine their robustness under both adversarial attacks and common corruptions, aiming to achieve accuracy and robustness comparable to those of ANN counterparts. To this end, we propose Burst Spiking Neural Networks (BuSNNs), which focus on two critical factors: neural activation and connection weights.

For neural activation, traditional perspectives suggest that single-spike neurons are inherently more robust to perturbations [10], [14], [24]. However, binary spiking introduces severe quantization error, which limits representation capability and reduces accuracy [25]. Our experiments in Section [bsnbinary] further show that binary spiking causes large perturbation-induced transitions in activation states. Recent studies have attempted to alleviate quantization error using multi-spike [21], [26] or burst-spike mechanisms [27]. Motivated by these observations, we propose Burst-enhanced Spiking Neurons (BSNs). BSNs emit multiple spikes within a short temporal window and produce graded neuronal responses. As a result, small perturbations either do not change the activation state or only induce bounded burst-count variations, reducing abrupt activation transitions and improving robustness.

Regarding connection weights, constraining weight magnitudes is known to improve network stability and robustness [28], [29]. For example, in a linear transformation \(y=Wx+b\), smaller weight magnitudes reduce the sensitivity of outputs to input perturbations. Biological synapses are also regulated in an activity-dependent manner under limited resources. Inspired by competitive and constrained synaptic plasticity [30]–[32], we propose a Dynamic Weight Constraint (DWC) mechanism within BuSNNs. DWC applies different penalties to active and inactive connections according to neuronal activation states during training. Active connections are regularized to prevent excessive amplification. Inactive connections are suppressed to avoid accumulating large dormant weights. Together, these effects reduce perturbation amplification across layers and improve robustness.

Experimental results demonstrate that BuSNNs simultaneously enhance accuracy and robustness under both adversarial attacks and common corruptions. The key contributions are summarized as follows:

• We provide a comprehensive evaluation of different SNN methods, benchmarking their adversarial and corruption robustness in a fair setting with shared network architectures and training strategies. The results demonstrate an accuracy–robustness gap for SNNs relative to ANNs.

• We identify two key robustness limitations in current SNNs and propose BuSNNs to address them. BSNs reduce perturbation-induced state transitions through burst firing. DWC adaptively constrains weights according to activation states. Together, they improve robustness without sacrificing accuracy.

• We validate our approach across multiple network architectures and datasets. Experimental results demonstrate consistent improvements in both clean and robust accuracy over existing SNNs. In particular, BuSNNs exceed other SNNs and ANN counterparts on CIFAR-10 and CIFAR-100. On ImageNet, they substantially narrow the performance gap between SNNs and ANNs, and surpass ANN counterparts under the ResNet-18 backbone.

2 Related Work↩︎

Accuracy and robustness are two central criteria for evaluating SNNs. Accuracy refers to classification performance on clean inputs, whereas robustness refers to the ability to maintain performance under perturbed inputs. In this paper, we discuss both adversarial robustness and corruption robustness.

2.1 Spiking Neural Networks↩︎

SNNs are a class of biologically inspired neural networks that encode information with discrete spike events over time, mimicking the temporal dynamics and event-driven processing of biological neurons [33]. With the rise of neuromorphic computing and the demand for energy-efficient architectures, SNNs have attracted growing interest in various deep learning applications, including pattern recognition [22], [34]–[38], sensory processing [39], and motor control [40], [41]. Leveraging ANN-to-SNN conversion [25], [42]–[45] and surrogate-gradient training [1], [2], [46], SNNs have made significant performance advances.

SNN neuron designs are often inspired by neuroscience. Canonical spiking neuron models include Hodgkin–Huxley (H–H) [47], Izhikevich [48], and the LIF [49] models. While the H–H model offers detailed biophysical realism and the Izhikevich model balances biological plausibility with efficiency, LIF-based neurons have become the prevailing standard for large-scale SNNs due to their computational simplicity. Extensions such as PLIF [17], ALIF [50], and GLIF [18] further increase expressiveness by incorporating adaptive thresholds, learnable membrane dynamics, and multi-timescale behaviors. Recent works have proposed more efficient and flexible neuron designs to reduce the temporal simulation burden inherent to SNNs. For instance, parallel spiking neuron models [20], [38], [51], [52] decouple spike computation across time steps, significantly accelerating inference while maintaining temporal resolution. These developments offer the potential for SNNs to scale effectively in practical tasks.

2.2 Robustness of Spiking Neural Networks↩︎

Existing research on the robustness of SNNs has primarily focused on their resistance to adversarial attacks. They leveraged inherent SNN properties such as discrete spike encoding and non-continuous activation patterns, to obtain high adversarial robustness [10]–[12], [14], [23]. Various methods such as spike-based encoding schemes [15], leaky membrane dynamics [53], architectural adaptations [54], [55], and robustness-oriented training objectives [13], [23], [56] have been explored to further enhance this robustness.

However, deploying SNNs in real-world scenarios demands robustness of common corruptions, such as blur, variations in brightness and contrast [9]. Unlike adversarial noise, these corruptions arise from sensor imperfections or environmental fluctuations, rather than being deliberately crafted. In the ANN literature, extensive research has been conducted to enhance corruption robustness [57]–[59]. In contrast, research on corruption robustness in SNNs remains relatively limited. Recent efforts have indicated that existing SNNs often suffer substantial performance degradation on standard corruption benchmarks [52].

3pt

2.3 Accuracy and Robustness Between SNNs and ANNs↩︎

Robustness has been extensively studied in ANNs from multiple perspectives. For common corruptions, benchmarks such as IMAGENET-C and KITTI-C provide systematic evaluation protocols [9], [60]. Related benchmarks such as ImageNet-A and ObjectNet further evaluate natural distribution shifts and hard real-world examples [61], [62]. For adversarial perturbations, modern evaluations have exposed unreliable defenses and established stronger attack protocols [63], [64]. Beyond evaluation, ANN studies have also developed robustness-oriented training and representation learning methods. Representative examples include adversarial training [65], [66], data augmentation [67], [68], and knowledge distillation [58], [69], [70]. Some self-supervised learning studies further suggest that learned representations can improve both adversarial and corruption robustness [71], [72]. Together, these ANN studies provide a broader context for evaluating SNN performance and robustness beyond spike-based models.

It is often assumed that SNNs possess stronger robustness than ANNs due to their bio-inspired spike-based computation. This assumption has been mainly supported in the context of Poisson-coded SNNs. Previous studies show that SNNs using Poisson coding can outperform ANNs in adversarial robustness [14]–[16]. Such robustness is commonly attributed to the stochastic and event-driven nature of Poisson spike generation, which can reduce the sensitivity of network responses to small adversarial perturbations. However, this encoding often leads to noticeably reduced clean accuracy.

Direct-coded SNNs achieve significantly higher clean accuracy, making them widely used in modern SNN applications. However, their deterministic encoding reduces stochastic protection, which weakens the adversarial robustness observed in Poisson-coded SNNs [23]. Recent studies further indicate that SNNs still face substantial challenges under common corruptions [52]. These findings indicate that direct-coded SNNs still lack a clear mechanism for improving robustness while preserving their accuracy advantage.

Overall, existing SNN robustness studies reveal an accuracy–robustness trade-off, as summarized in Table 1. Poisson-coded SNNs benefit from stochastic spike generation, but they often sacrifice clean accuracy. Direct-coded SNNs improve recognition performance, but their robustness remains limited. This trade-off reveals a key limitation of existing SNN methods. To address this gap, BuSNN improves direct-coded SNNs from two complementary aspects. BSNs enhance spike-based activation representation through bounded burst responses. DWC constrains synaptic weights according to activation-dependent importance. Together, these designs allow BuSNN to improve clean accuracy, adversarial robustness, and corruption robustness simultaneously.

3 Burst Spiking Neural Networks↩︎

This work proposes BuSNNs to enhance SNN robustness from two complementary perspectives: neural activation and connection weights. Fig. 2 (a) illustrates the processing pipeline, where clean, corrupted, or adversarially perturbed images are processed by a network to generate recognition results. On the activation side, we introduce BSNs, which employ burst firing to produce graded activations and reduce perturbation-induced state transitions. On the weight side, we design a DWC mechanism that adaptively penalizes connection weights based on BSN activation states, effectively constraining weight magnitudes and lowering sensitivity to input perturbations. Both BSNs and DWC are generic modules that can be seamlessly integrated into existing SNN architectures without modifying their overall design.

3.1 Unified Output-Stability View of Robustness↩︎

We define robustness from the perspective of output stability. Let \(f_\theta(x)\in\mathbb{R}^K\) denote the output logits of a network with parameters \(\theta\). For a clean input \(x\) and its perturbed counterpart \(x'\), we measure the perturbation-induced output variation as: \[\Delta_\theta(x,x') = \|f_\theta(x') - f_\theta(x)\|_\infty . \label{eq:delta95output}\tag{1}\] Adversarial and corruption robustness can then be described by the same quantity under different perturbation rules. For adversarial perturbations bounded in an \(\ell_p\) ball, we consider the worst-case output variation: \[\mathcal{R}_{\mathrm{adv}}(x;\theta,\epsilon) = \sup_{\|x'-x\|_p \le \epsilon} \Delta_\theta(x,x') . \label{eq:radv}\tag{2}\] For common corruptions sampled from a corruption family \(\mathcal{C}\), we consider the expected output variation: \[\mathcal{R}_{\mathrm{corr}}(x;\theta) = \mathbb{E}_{x'\sim \mathcal{C}(\cdot|x)} \Delta_\theta(x,x') . \label{eq:rcorr}\tag{3}\]

Thus, both robustness notions reduce to controlling the output variation \(\Delta_\theta(x,x')\). This formulation also connects to classification stability. For a correctly classified clean input \(x\), let \(y\in\{1,\ldots,K\}\) denote its ground-truth class, and let \(f_\theta(x)_j\) denote the logit corresponding to class \(j\). We define the clean logit margin as \(m_\theta(x)=f_\theta(x)_y-\max_{j\neq y}f_\theta(x)_j\). This margin measures the separation between the ground-truth logit and the largest competing logit. If \(\Delta_\theta(x,x')<m_\theta(x)/2\), the prediction is preserved under the perturbation. This gives a sufficient condition for classification stability, with the derivation provided in Supplementary Materials S1-B.

Under this view, both BSNs and DWC improve robustness by reducing different sources of output variation \(\Delta_\theta(x,x')\). BSNs reduce perturbation-induced activation-state changes, while DWC constrains the weights that propagate such changes across layers.

3.2 Preliminaries of Spiking Neuron Models↩︎

In general, the forward dynamics of an SNN neuron can be abstracted as a three-stage process comprising membrane potential update (charge), spike generation (fire), and state reset (reset), which can be formulated as follows: \[\begin{align} V[t] &= \mathcal{U}(V[t{-}1], I[t]), \tag{4} \\ S[t] &= \Theta(V[t] - V_{\text{th}}), \tag{5} \\ V[t] &= \begin{cases} V[t] (1 - S[t]) + V_{\text{reset}} S[t], & \text{hard reset}, \\ V[t] - V_{\text{th}} S[t], & \text{soft reset}, \end{cases} \tag{6} \end{align}\] where \(V[t] \in \mathbb{R}\) is the membrane potential at time step \(t\), \(I[t]\) is the synaptic input current, and \(S[t] \in \{0, 1\}\) denotes the binary spike output. The function \(\mathcal{U}(\cdot)\) defines neuron dynamics, and \(\Theta(\cdot)\) emits a spike when \(V[t]\) exceeds the threshold \(V_{\text{th}}\). Once a spike occurs, the membrane potential is reset according to Eq. 6 , either to the reset potential \(V_{\text{reset}}\) or by subtracting the threshold \(V_{\text{th}}\).

A variety of models instantiate the neuron dynamic \(\mathcal{U}(\cdot)\), such as LIF [49], PLIF [17], and GLIF [18]. Among them, the LIF model updates its membrane potential recursively with temporal decay: \[\begin{align} \mathcal{U}(V[t{-}1], I[t]) = \left(1 - \frac{1}{\tau_m}\right)V[t-1] + \frac{1}{\tau_m} I[t], \label{eq:lif95recursive} \end{align}\tag{7}\] where \(\tau_m\) is the membrane time constant. This recursive form depends on \(V[t{-}1]\) and therefore limits parallel computation across time steps. To address this limitation, PSN [20] reformulates the membrane potential with a closed-form update, which unrolls the recursion into a temporal convolution over all past inputs: \[\begin{align} V[t] = \frac{1}{\tau_m} \sum_{i=0}^{t} \left(1 - \frac{1}{\tau_m}\right)^{t - i} I[i].\label{eq:lif95closed} \end{align}\tag{8}\] For an input sequence with \(T\) time steps and \(N\) neurons, PSN defines the membrane potential as a weighted summation over all historical input currents: \[\begin{align} V[t] = \sum_{i=0}^{T-1} W_{t,i} \cdot I[i], \label{eq:psn95sum} \end{align}\tag{9}\] where the temporal kernel \(W_{t,i} = \frac{1}{\tau_m} \left(1 - \frac{1}{\tau_m} \right)^{t - i}\) encodes exponentially decaying influence over past inputs. By incorporating the firing process in Eq. 5 and omitting the reset in Eq. 6 , PSN expresses neuron dynamics in a matrix formulation: \[\left\{ \begin{align} \mathbf{V} &= \mathbf{W} \mathbf{I}, \quad \mathbf{W} \in \mathbb{R}^{T \times T},\;\mathbf{I} \in \mathbb{R}^{T \times N}, \\ \mathbf{S} &= \Theta(\mathbf{V} - \mathbf{B}), \quad \mathbf{B} \in \mathbb{R}^{T},\;\mathbf{S} \in \{0, 1\}^{T \times N}, \end{align} \right. \label{eq:psn}\tag{10}\] where \(\mathbf{I}\) denotes the input current sequence, \(\mathbf{V}\) the membrane potential, \(\mathbf{B}\) a learnable threshold vector, and \(\mathbf{S}\) the spike output. This feedforward formulation removes recurrent dependencies and enables parallel evaluation across time steps, thereby improving training and inference efficiency.

The Memory-based Parallel Spiking Neuron (MPSN) [52] extends PSN by introducing a memory-based modulation. Instead of directly using \(\mathbf{I}\), the input current is dynamically modulated by a learned memory unit \(\mathbf{M} \in \mathbb{R}^{T \times N}\): \[\left\{ \begin{align} \mathbf{V} &= \mathbf{W} \, g(\mathbf{M}, \mathbf{I}), \quad \mathbf{W} \in \mathbb{R}^{T \times T},\;\mathbf{I}, \mathbf{M} \in \mathbb{R}^{T \times N}, \\ \mathbf{S} &= \Theta(\mathbf{V} - \mathbf{B}), \quad \mathbf{B} \in \mathbb{R}^{T},\;\mathbf{S} \in \{0, 1\}^{T \times N}, \end{align} \right. \label{eq:pmsn6}\tag{11}\] where the modulation function is defined as \(g(\mathbf{M}, \mathbf{I}) = \mathbf{I} + \mu \mathbf{M}\), and \(\mu\) is a scaling factor, with a default value of 0.1. This memory mechanism enables the model to capture statistically stable features from clean samples, thereby improving robustness to noisy or corrupted inputs. In this work, we adopt MPSN as the base neuron model and extend its binary spike to burst spike.

3.3 Burst-enhanced Spiking Neurons↩︎

Conventional SNN neurons typically produce binary outputs, which are insufficient to encode fine-grained input intensities or to distinguish between similar stimuli, potentially impairing accuracy and robustness. In contrast, biological neurons frequently exhibit burst spiking, which refers to short sequences of spikes emitted in rapid succession, as illustrated in Fig. 2 (b). This spiking pattern is widely observed across brain regions [73]. It is believed to enhance the reliability of information transmission, thereby improving robustness to input perturbations [74], [75].

3.3.1 Biological modeling and burst definition↩︎

Biologically, burst spiking is a firing pattern in which a neuron emits brief clusters of high-frequency action potentials, producing multiple spikes within a short time window. Let \(s(t)\) denote the spike train in continuous time, and let \(\Delta t_b>0\) the burst window. A burst event starting at time \(t\) can be formulated as: \[\begin{align} \mathrm{Burst}(t) = \{\, \tau \mid s(\tau)=1,\;t \le \tau < t+\Delta t_b \,\}. \label{eq:burst95set95ct} \end{align}\tag{12}\] In general, burst activity can convey information through multiple factors, such as burst onset time, within-burst spike timing, and the number of spikes within the burst window.

3.3.2 From biological mechanisms to computational abstractions↩︎

SNNs for computer vision commonly adopt a coding paradigm in which neuronal activation is summarized by firing rates over time. Motivated by voltage-based spike generation models [76] and multi-bit spiking formulations [21], [26], we use spike-count coding to represent burst spiking. The spike count \(N_{\text{burst}}[t]\) can be approximated by the membrane potential surplus above the firing threshold. We therefore define a deterministic mapping from the membrane potential \(V[t]\) to \(N_{\text{burst}}[t]\): \[\begin{align} N_{\text{burst}}[t] = \mathcal{B}\!\left(V[t] - V_{\text{th}}\right), \label{eq:burst95count} \end{align}\tag{13}\] where \(\mathcal{B}:\mathbb{R}\to\{0,1,\dots,\theta_{\text{burst}}\}\) is a quantized linear mapping of the excess potential: \[\begin{align} \mathcal{B}(x) \;=\; \min\!\left( \theta_{\text{burst}},\;\left\lfloor \max(x,0) + \frac{1}{2} \right\rfloor \right). \label{eq:burst95spiking95neuron} \end{align}\tag{14}\] Here \(x\) denotes the membrane surplus \(V[t]-V_{\text{th}}\) measured in normalized threshold-equivalent units, and \(\theta_{\text{burst}}\) specifies the maximum number of spikes allowed in each burst to ensure stability. Unless otherwise stated, \(\theta_{\text{burst}}\) is set to 4 in all experiments. Under this normalization, each additional unit of surplus results in an additional spike emission within the burst window. This form provides a bridge from the biological burst count to a discrete response that can be computed in SNNs.

3.3.3 Neuron model↩︎

We propose BSNs (Fig. 2 (c)) based on the MPSN model in Eq. 11 by incorporating the burst spiking in Eq. 14 into it. While the burst-spiking mechanism can be integrated into other models, we adopt MPSN for its strong performance. The BSN is defined as follows: \[\begin{align} \left\{ \begin{aligned} \mathbf{V} &= \mathbf{W} \, g(\mathbf{M}, \mathbf{I}), \quad \mathbf{W} \in \mathbb{R}^{T \times T},\;\mathbf{I}, \mathbf{M} \in \mathbb{R}^{T \times N}, \\ \mathbf{S} &= \mathcal{B}(\mathbf{V} - \mathbf{B}), \quad \mathbf{B} \in \mathbb{R}^{T},\;\mathbf{S} \in \{0,1,\dots,\theta_{\text{burst}}\}^{T \times N}. \end{aligned} \right. \label{eq:bsn} \end{align}\tag{15}\] When BSNs are trained end-to-end, the burst mapping \(\mathcal{B}(\cdot)\) is non-differentiable at integer boundaries and piecewise constant elsewhere. We therefore use a smooth arctangent-shaped surrogate in the backward pass: \[\frac{\partial \mathcal{B}}{\partial x} \approx \sigma(x) = \frac{\alpha}{1+(\alpha x)^2}\,\boldsymbol{1}_{\big(0 < x < \theta_{\text{burst}}\big)},\] where \(\alpha=4\), and \(\boldsymbol{1}_{(\cdot)}\) denotes the indicator function. Compared with standard binary spiking neurons, BSNs provide a richer output space while preserving the parallel computation pattern of the parallel spiking neuron family.

3.3.4 Robustness Interpretation of Burst Spiking↩︎

Eq. 1 measures the output variation caused by input perturbations. At the neuron level, such variation is partly induced by perturbation-driven changes in the membrane surplus. BSNs reduce this effect through the burst response in Eq. 14 . Let \(u\) denote the normalized membrane surplus, and let \(\mathcal{Q}=\{k+\frac{1}{2} \mid k=0,\dots,\theta_{\text{burst}}-1\}\) denote the set of burst-response boundaries induced by \(\mathcal{B}\). We define the distance from \(u\) to the nearest response boundary as \(d_{\mathcal{Q}}(u)=\min_{q\in\mathcal{Q}} |u-q|\). If \(|\delta|<d_{\mathcal{Q}}(u)\), then \(u+\delta\) stays in the same response interval and \(\mathcal{B}(u+\delta)=\mathcal{B}(u)\). If the perturbation crosses response boundaries, the burst-count change is bounded by the number of unit-spaced response intervals crossed: \[\bigl|\mathcal{B}(u+\delta)-\mathcal{B}(u)\bigr| \le \left\lceil|\delta|\right\rceil . \label{eq:burst95stability}\tag{16}\] These properties allow BSNs to suppress perturbations that remain within the same response interval and limit the activation change when response boundaries are crossed. Under the output-variation view in Eq. 1 , this reduces the activation perturbation propagated to later layers. Theorem 1 in Supplementary Materials S1-C formalizes this activation-side effect by showing how the burst-count change in Eq. 16 determines the perturbation signal received by the next layer. BSNs therefore act on the activation side.

3.4 Dynamic Weight Constraint↩︎

Robustness to input perturbations can be intuitively understood from the perspective of network connectivity. Consider a simple linear mapping \(y = Wx + b\). Smaller values of connection weights \(W\) reduce the sensitivity of the output \(y\) to perturbations in the input \(x\). However, excessively reducing the weights often degrades model performance, indicating the need for a well-designed mechanism to regulate weight magnitudes. Such regulation naturally occurs in biological neural systems through synaptic plasticity, where synaptic strengths are adjusted under various biological constraints.

3.4.1 Competitive and constrained synaptic plasticity↩︎

In biological neural systems, synaptic connections evolve under limited metabolic resources, structural capacity, and homeostatic balance. These constraints help maintain efficient information processing and prevent unstable growth of synaptic strength. From this perspective, we focus on two mechanisms, synaptic competition and synaptic constraint.

Synaptic competition refers to the process in which synapses compete for survival and efficacy based on their relative activity levels [30], [31]. Active synapses that contribute effectively to postsynaptic responses are strengthened and preserved, whereas less active or redundant synapses are gradually weakened and eliminated [32]. This process can be modeled as: \[\frac{d w_i}{dt} = p_i \cdot h(w_i) - \lambda \sum_{j \ne i} p_j \cdot u(w_j), \label{eq26}\tag{17}\] where \(w_i\) denotes the weight of synapse \(i\), \(p_i\) represents its activity level, and \(h(\cdot)\) and \(u(\cdot)\) govern potentiation and competitive suppression, respectively. This formulation captures how the strengthening of one synapse can inhibit others, leading to sparse and selective connectivity.

Synaptic constraint reflects the fact that neurons cannot increase all synaptic strengths without limit. Let \(w_i\ge 0\) denote the strength of synapse \(i\). Assuming a positive total synaptic strength \(\sum_j w_j>0\), this constraint can be described by normalization-like dynamics: \[\frac{d w_i}{dt} = \eta \left( \rho_i - \frac{w_i}{\sum_j w_j} \right), \qquad \rho_i\ge 0,\quad \sum_i\rho_i=1, \label{eq28}\tag{18}\] where \(\rho_i\) is the normalized activity-dependent target share. The term \(w_i/\sum_j w_j\) denotes the current share of synapse \(i\) in the total synaptic strength, i.e., the relative fraction of the available synaptic-strength budget assigned to this synapse rather than its absolute magnitude. Thus, the dynamics compare the target share \(\rho_i\) with the current normalized share \(w_i/\sum_j w_j\). A synapse is strengthened when its current share is below the target, and weakened when it exceeds the target. This prevents unbounded growth of all synapses and limits disproportionate dominance among active synapses, thereby helping maintain stable connectivity [77]. Since \(\sum_i\rho_i=1\) and \(\sum_i w_i/\sum_j w_j=1\), the total synaptic strength is conserved under Eq. 18 . At equilibrium, we have: \[w_i^\ast = \rho_i Q, \label{eq30}\tag{19}\] where \(Q=\sum_jw_j^\ast\) is the total synaptic-strength budget determined by the conserved total strength. Eq. 19 indicates that, under a constrained total budget, the equilibrium synaptic strength is proportional to activity.

These two principles motivate the design of DWC. The competition principle motivates a penalty on inactive or weakly active connections with large weights. The constraint principle motivates an activity-weighted penalty on active connections.

3.4.2 From biological mechanisms to regularization formulation↩︎

Directly modeling these biological mechanisms is difficult in gradient-based SNN training. We therefore translate the core principles into a weight-regularization framework, termed DWC. It contains two complementary terms, as shown in Fig. 2 (d). The synaptic competition suppresses inactive connections with excessively large weights. The synaptic constraint regularizes active connections according to their activation strength. Together, they reduce redundant or unstable connections and lower weight-side sensitivity to perturbations.

To formulate the synaptic competition model in Eq. 17 , we define \(w_i=h(w_i)\) to represent Hebbian-like linear potentiation and \(|w_j|=u(w_j)\) to capture the suppressive influence of stronger neighboring synapses: \[\frac{d w_i}{dt} = p_i w_i - \lambda \sum_{j \ne i} p_j |w_j|.\] For inactive connections (\(p_i = 0\)), the potentiation term vanishes, and the dynamics reduce to a purely inhibitory drift proportional to the total active mass in the neighborhood: \[\label{eq:inactive95dynamics} \frac{d w_i}{dt} = -\,\lambda \sum_{j \ne i} p_j |w_j|.\tag{20}\]

To capture this inhibitory effect, we introduce a static convex penalty that enforces a layerwise reference level determined by the active channels. For an input \(x\), let \(\mathcal{I}^{(l)}_x\) denote the set of active channels at layer \(l\), and \(\overline{\mathcal{I}^{(l)}_x}\) its complement (the inactive channels). For layer \(l\), define the maximum weight norm among active channels as: \[\label{eq:M95def} M^{(l)}(x) = \begin{cases} \max\limits_{k \in \mathcal{I}^{(l)}_x} \| W^{(l)}_k \|_1, & \mathcal{I}^{(l)}_x \neq \varnothing,\\[2pt] 0, & \mathcal{I}^{(l)}_x = \varnothing. \end{cases}\tag{21}\] Based on this active reference, we define the following competitive penalty on inactive connections. This penalty mainly affects inactive channels with large weights: \[\label{eq:Pcomp95layer} \mathcal{P}^{(l)}_{\text{comp}}(x) = \sum_{c \in \overline{\mathcal{I}^{(l)}_x}} \max\!\bigl( \| W^{(l)}_c \|_1,\; M^{(l)}(x) \bigr).\tag{22}\] Aggregating over layers gives: \[\label{eq:Pcomp95total} \mathcal{P}_{\text{comp}}(x) = \sum_{l=1}^{L} \mathcal{P}^{(l)}_{\text{comp}}(x).\tag{23}\]

Eq. 19 indicates that, under a constrained total synaptic budget \(Q=\sum_j w_j\), the equilibrium strength of each synapse is proportional to its activity share. Here \(w_i\) denotes a non-negative biological synaptic strength. In deep neural networks, however, trainable weights are signed, and the corresponding synaptic strength is more naturally represented by the weight magnitude. Thus, a direct constraint can be written as \(\sum_i \left||w_i|-\rho_i\sum_j |w_j|\right|\). In practice, this objective couples all synapses through the global budget term \(\sum_j |w_j|\), which is inconvenient for stochastic gradient training. We therefore use a tractable activity-weighted surrogate \(\sum_i a_i |w_i|\). Here \(a_i\) denotes the activation-dependent coefficient of synapse \(i\), and it can be viewed as the computational counterpart of \(\rho_i\). This term is not an algebraically exact reformulation of Eq. 19 , but a separable convex proxy that preserves its key effect: weights associated with stronger activity are more explicitly constrained during training. The derivation of this regularization form is detailed in Supplementary Materials S1-D.

Regrouping \(\sum_i a_i |w_i|\) by presynaptic unit gives: \[\mathcal{P}_{\text{cons}}(x) = \sum_{c \in \mathcal{I}_x} a_c\, \|W_c\|_1, \label{eq:pcons}\tag{24}\] where \(c\) denotes a presynaptic unit, \(W_c\) denotes its associated outgoing weights, and \(a_c\) is the corresponding activation coefficient. For binary spiking neurons, \(a_c=1\) for active units \(c\in\mathcal{I}_x\), and the penalty reduces to a standard \(\ell_1\) constraint on active connections. For BSNs, \(a_c\) reflects the burst activation strength, enabling the weight constraint to adapt to the activation state. Thus, Eq. 24 regularizes the weights involved in the current computation in an activation-dependent manner, discouraging the model from relying on excessively large active weights.

Combining \(\mathcal{P}_{\text{comp}}(x)\) and \(\mathcal{P}_{\text{cons}}(x)\) yields the overall DWC loss: \[\mathcal{L}_{\text{dwc}}(x) = \sum_{l=1}^{L} \sum_{c \in \overline{\mathcal{I}^{(l)}_x}} \max\!\bigl( \| W^{(l)}_c \|_1, \, M^{(l)}(x) \bigr) + \sum_{c \in \mathcal{I}_x} a_c \|W_c\|_1. \label{eq:eq34}\tag{25}\]

DWC imposes activation-conditioned penalties on network weights. For active channels, the BSN response gives \(a_c\ge 1\), while inactive channels are constrained by the competitive term. Therefore, DWC preserves the magnitude-control effect of standard \(\ell_1\) regularization. More importantly, it adapts this penalty to the input-dependent activation pattern, so that active or potentially sensitive connections are more directly constrained. This helps reduce weight-side amplification of perturbations.

Finally, the network is trained using a composite loss function: \[\mathcal{L}_{\text{total}} = \mathcal{L}_{\text{cls}} + \mathcal{L}_{\text{dwc}},\] where \(\mathcal{L}_{\text{cls}}\) is the classification loss.

3.4.3 ↩︎

Following the output-stability definition in Eq. 1 , robustness depends on how much the network output \(f_\theta(x)\) changes under a perturbed input \(x'\). BSNs reduce such changes by stabilizing neural activations. DWC further limits how the remaining activation changes are propagated through network weights. For a linear transformation in layer \(l\), this propagation satisfies: \[\begin{align} &\left\|W^{(l)} \left(\mathbf{S} ^{(l-1)}(x')-\mathbf{S} ^{(l-1)}(x)\right) \right\|_\infty \\ &\qquad\le \left\|W^{(l)}\right\|_\infty \left\|\mathbf{S} ^{(l-1)}(x')-\mathbf{S} ^{(l-1)}(x)\right\|_\infty . \end{align} \label{eq:weight95amplification95bound}\tag{26}\] Here, \(\mathbf{S} ^{(l)}(\cdot)\) denotes the spike-count activation of layer \(l\), as defined in the BSN forward model in Eq. 15 , and \(W^{(l)}\) denotes the weight matrix or convolutional kernel of layer \(l\), as used in the DWC formulation in Eq. 25 . Eq. 26 shows that smaller weight norms reduce the amplification of perturbation-induced activation changes. DWC regularizes these weights in an activation-dependent manner. The active term constrains weights involved in the current computation, while the inactive term suppresses large dormant weights that may become influential when perturbations change activation states. Thus, DWC reduces the weight-side amplification that contributes to the output variation \(\Delta_\theta(x,x')\) in Eq. 1 .

In summary, BSNs stabilize neuronal activations under perturbations, whereas DWC reduces weight-side amplification by constraining weight magnitudes. Together, they reduce the output variation of BuSNNs and contribute to improved robustness.

4 Experiments↩︎

4.1 Experimental Settings↩︎

We evaluate our proposed method across multiple datasets to assess both classification accuracy and robustness. All experiments are conducted using the SpikingJelly framework [78]. We use CIFAR-10 [79], CIFAR-100 [79], and ImageNet [80] as the primary benchmarks to evaluate the general performance of the models. To examine adversarial robustness, we follow established protocols and evaluate on adversarially perturbed versions of CIFAR-10 and CIFAR-100. Furthermore, to assess corruption robustness, we adopt the common benchmarks CIFAR10-C [9] and IMAGENET-C [9], which apply a wide range of corruptions such as noise, blur, and weather distortions to the original datasets. To ensure a thorough comparison with prior methods, we conduct comprehensive experiments using a range of network architectures, including ResNet [81], SEW ResNet [82], MS ResNet [83], VGG [84], and the Modified PLIF-Net [85].

The hyperparameters used in our experiments are listed in Table 2, where CE and TET refer to the cross-entropy loss and temporal efficient training [86], respectively, used as the classification loss. We optimize the models using SGD with a momentum of 0.9 and apply a cosine annealing schedule for the learning rate.

To ensure a fair comparison, we adopt the same data preprocessing methods as used in PSN [20] and MPSN [52]. All experiments are implemented with fixed random seeds to facilitate reproducibility. For CIFAR-10 and CIFAR-100, we use random horizontal flipping and random erasing. For each mini-batch, we randomly apply either Mixup [93] with \(\alpha=0.2\) or CutMix [94] with \(\alpha=1.0\), where \(\alpha\) controls the sampled mixing ratio. For ImageNet, we follow the conventional protocol with random resized cropping and horizontal flipping. We initialize our model with MPSN pre-trained weights to provide a better starting point for training. Similar strategies that leverage stronger initialization have been widely adopted to improve convergence and generalization [52], [95], [96]. As shown in Table 3 and 4, for SNN baselines from prior literature, we follow the time-step settings reported in the original papers. Unless otherwise specified, all experiments reported in Tables ¿tbl:tab:Adversarial95Attack?– 8 are conducted with the number of time steps set to \(T=4\).

4.2 Network Architectures↩︎

We adopt the networks with the same settings used in MPSN [52], including Modified PLIF-Net [85], VGG [84], and ResNet [81]. As illustrated in Fig. 2 (a), these networks share a common pattern in which image features are extracted by a stack of convolutional (Conv) blocks. Each block comprises convolutional layers followed by a nonlinear activation. In SNNs, the nonlinearity is implemented with spiking neurons, whereas in ANNs it is implemented with ReLU. The classifier consists of a stack of fully connected (FC) layers. Detailed configurations are provided in Supplementary Materials S2. In our BuSNN variants, we replace the original spiking neurons in these backbones with BSNs and apply DWC to the convolutional and fully connected layers, illustrating that the proposed modules can be directly used in existing SNN architectures.

4.3 Results on Clean Images↩︎

To evaluate the proposed model, we conduct experiments on the clean image classification benchmarks CIFAR-10 [79] and ImageNet [80]. On both datasets, the proposed BuSNN achieves superior performance among existing SNNs, as listed in Table 3 and Table 4.

Compared with ANN baselines, BuSNN achieves stronger performance on CIFAR-10. On ImageNet, the SEW ResNets [82] and MS ResNet [83] architectures serve as the spiking counterpart of the standard ANN ResNets [81] and have been widely adopted in the design of residual SNNs. BuSNN with the SEW ResNet-18 backbone also surpasses its ANN counterpart (69.92% vs.%). Although a gap remains on ResNet-34 and ResNet-50, our approach substantially narrows the difference relative to previous SNN methods, demonstrating improved accuracy. In standard SNNs, binary activation restricts the network’s representation capacity, often leading to a severe accuracy degradation compared to ANNs. BuSNN uses graded multi-level spikes to enrich neuronal responses, thereby improving representational capacity and achieving stronger accuracy.

Motivated by the discrete nature of spiking activations, we additionally construct activation-quantized ANNs for a more comprehensive comparison. The activations of ANNs are discretized with quantized representations. Specifically, we adopt asymmetric uniform quantization at 8-bit and 4-bit precision (INT8 with an integer range of \([0,255]\) and INT4 with \([0,15]\)). For each layer, a scaling factor is estimated from activation quantiles to reduce the influence of outliers, after which floating-point activations are clipped and linearly mapped to the target integer range. This process makes the activation dynamics of ANNs comparable to the discrete behavior of SNNs. As shown in Table 4, our method outperforms the INT4 activation-quantized ANNs. Remarkably, BuSNN operates with \(\theta_{\text{burst}} = 4\), providing only four discrete activation levels per neuron, which is fewer than the 16 levels in INT4 ANNs, yet it achieves higher accuracy.

In addition to static image benchmarks, we further evaluate our model on the neuromorphic CIFAR10-DVS dataset [99]. Our method also achieves superior results, demonstrating its effectiveness beyond static image classification. Detailed results are provided in Supplementary Materials S3-A.

4.4 Adversarial Attack Robustness↩︎

We evaluate adversarial robustness under two classical methods, Fast Gradient Sign Method (FGSM) [8] and Projected Gradient Descent (PGD) [65]. FGSM applies a small perturbation along the sign of the input gradient to maximize the loss: \[x_{\text{adv}} \;=\; x \;+\; \epsilon \cdot \operatorname{sign}\!\bigl(\nabla_x \mathcal{L}(\hat{y}(x), y)\bigr),\] where \(\epsilon\) controls the perturbation magnitude, \(\hat{y}(x)\) denotes the network output for input \(x\), \(y\) is the ground-truth label, and \(\nabla_x \mathcal{L}\) is the input gradient of the loss \(\mathcal{L}\). PGD is an iterative extension of FGSM that uses multiple small steps with projection: \[x_{t+1} \;=\; \operatorname{Proj}_{\,x+\mathcal{S}}\!\left(x_t \;+\; \alpha \cdot \operatorname{sign}\!\bigl(\nabla_x \mathcal{L}(\hat{y}(x_t), y)\bigr)\right),\] where \(\alpha\) is the step size and \(t\) is the iteration index. The set \(\mathcal{S}=\{\delta:\|\delta\|_\infty \le \epsilon\}\) constrains the perturbation within \([-\epsilon,+\epsilon]\) in the \(\ell_\infty\) sense.

To facilitate robustness comparisons among models with different clean accuracies, we report both the absolute accuracy under adversarial perturbations and a normalized robustness metric, Score. It is defined as \(\text{Score}=A_{\mathrm{adv}}/A\), which measures the proportion of clean accuracy retained under adversarial attacks. Here \(A\) denotes the clean accuracy and \(A_{\mathrm{adv}}\) denotes the classification accuracy under FGSM or PGD attacks. Equivalently, Score can be viewed as one minus the relative accuracy degradation from clean to adversarially perturbed data. A higher Score indicates smaller relative degradation and thus stronger robustness. This metric provides a normalized view of robustness and complements absolute adversarial accuracy when comparing models with different clean accuracies.

Table ¿tbl:tab:Adversarial95Attack? compares our method with advanced neuron models, as well as with several methods developed specifically for adversarial attack scenarios. We do not use adversarial training, since our goal is to evaluate intrinsic adversarial robustness rather than the effect of robust optimization.

We report results for BuSNN and BuSNN- (BuSNN without DWC). On CIFAR-10, BuSNN achieves the best performance against single-step attacks such as FGSM. Under multi-iteration attacks, including PGD7 and PGD10, BuSNN also shows strong robustness among binary SNN models. It obtains the highest Scores among the compared SNNs and remains close to the ANN baselines. On CIFAR-100, BuSNN outperforms ANNs under both clean and adversarial conditions. Its best Scores further indicate stronger robustness.

This robustness gain comes from the complementary roles of BSNs and DWC. BSNs produce graded burst responses. When small membrane perturbations remain within the same response interval, the neuronal output does not change. Even when perturbations cross response boundaries, the burst-count change is bounded by the interval structure, as discussed in Eq. 16 . DWC further limits weight-side amplification by regularizing active connections and suppressing inactive connections with excessively large weights. This constrains the weight magnitude term in Eq. 26 , thereby reducing the amplification of perturbation-induced activation changes.

4.5 Common Corruption Robustness↩︎

Robustness to common corruptions is an essential indicator of a model’s generalization ability under image conditions. To assess this property, we adopt the CIFAR10-C [9] and IMAGENET-C [9] benchmarks, which include 19 types of image corruptions, each applied at five levels of severity. Representative examples are shown in Fig. 2 (a). All models are trained solely on clean data and are directly evaluated on the corrupted datasets without any additional fine-tuning.

We use the same normalized Score defined above to evaluate corruption robustness, with \(A_{\mathrm{adv}}\) replaced by the corrupted-data accuracy \(A_c\). Accordingly, the corruption robustness Score is computed as \(\text{Score}=A_c/A\), where \(A\) denotes the clean accuracy. For each corruption type, \(A_c\) is averaged over the five severity levels as \(A_c=\frac{1}{5}\sum_{l=1}^{5}A_l\), where \(A_l\) denotes the accuracy at severity level \(l\).

On CIFAR10-C, Table 5 summarizes accuracy under the Modified PLIF-Net backbone. Our BuSNN consistently improves average accuracy across all severities and outperforms prior SNNs. Notably, it maintains higher accuracy under conditions of greater corruption severity, such as levels \(L4\) and \(L5\). BuSNN presents minor standard deviations for different corruption types at each severity, indicating that it maintains stable performance against various corruption types. Meanwhile, BuSNN also achieves the highest Score, confirming that its robustness gains are not merely due to higher clean accuracy. Compared with the ANN trained under the same conditions, BuSNN also demonstrates superior performance. We also present comparative results under individual corruption types in Fig. 3. The comparison between MPSN and BuSNN in Fig. 3 (a) shows that similar clean accuracy can still correspond to different corruption robustness Scores. BuSNN combines the highest correspond to robustness Score with the highest clean accuracy, demonstrating that stronger robustness is achieved while preserving clean performance. Across the three representative corruptions in Fig. 3 (b)–(d), BuSNN consistently maintains the highest accuracy on CIFAR10-C at all severity levels. This advantage persists as corruption strength varies, rather than arising from a single severity level. A detailed breakdown of the results by corruption type is provided in Supplementary Materials S3-B.

As shown in Table 6, on the more challenging IMAGENET-C benchmark, our method remains competitive and establishes a new state of the art among SNNs. We also compare SNNs with conventional ANNs under matched backbones. Full-precision ANNs (ResNet-18/34/50) still reach the highest robustness on IMAGENET-C. However, our method reduces the gap substantially and even surpasses quantized ANN baselines. With SEW ResNet-18 and SEW ResNet-34, BuSNN produces higher C-AVG than both ANN-INT8 and ANN-INT4, whereas no previous SNN method surpasses ANN-INT8 under the same settings. In terms of Score, BuSNN delivers consistent gains over all previous SNNs at every severity level, indicating better corruption robustness and clean accuracy. Results obtained with MS ResNet backbones further demonstrate the generality of the proposed BuSNN, showing that it can effectively enhance both performance and robustness across diverse spiking residual network architectures. A detailed discussion of different corruption types can be found in Supplementary Materials S3-B.

The comparison with MPSN shows that BSNs provide richer and more stable neuronal representations for large-scale corrupted inputs. The further improvement of BuSNN over BuSNN- indicates that DWC additionally strengthens robustness by constraining synaptic weights under severe corruptions. This observation is consistent with the robustness analysis in Section 3.4.3.

4.6 Computation Overhead↩︎

SNNs have long been considered to have energy-efficiency advantages. To examine whether BuSNN preserves this desirable property, we conduct a theoretical analysis of computational overhead. Following the methodology established in [26], we estimate the overhead of different methods in terms of Accumulation (AC) operations, Multiply-Accumulate (MAC) operations, and theoretical total energy consumption.

The estimation of AC and MAC operations depends on the computational paradigms of different network models. In SNNs, each presynaptic spike triggers the accumulation of the corresponding synaptic weight into the postsynaptic membrane potential, which is counted as an AC operation. Accordingly, the AC operations reported in Table 7 are estimated by scaling the layer-wise synaptic operations with the spiking activity measured during inference over all time steps, with the burst count in BuSNN treated as accumulated spike events. By contrast, standard ReLU-based ANNs rely on continuous-valued dense activations, so their feature extraction layers are dominated by MAC operations. Thus, standalone AC operations are not considered in this theoretical evaluation. The total energy is then estimated using the corresponding unit energy costs following [26], with detailed calculation and implementation details provided in Supplementary Materials S4.

Based on these estimates, Table 7 shows that BuSNN achieves a consistent energy-performance trade-off on both CIFAR-10 and ImageNet. Compared with ReLU-based ANN baselines, BuSNN substantially reduces energy consumption through AC-dominated spiking computation. It achieves a \(4.38\times\) energy reduction on CIFAR-10 (1.82 mJ vs. 7.98 mJ) and a \(2.47\times\) reduction on ImageNet (3.39 mJ vs. 8.36 mJ). Compared with other SNN models such as LIF or SEW, BuSNN introduces a moderate increase in AC operations and energy cost. This additional cost is accompanied by stronger accuracy and robustness. These results indicate that BuSNN preserves the energy advantage of SNNs while achieving a better balance between efficiency, accuracy, and robustness.

Furthermore, previous work has demonstrated that similar theoretical energy efficiency gains successfully translate to practical hardware implementations [6], [100]. By applying the BuSNN framework in future chip designs, we expect to achieve not only low power consumption but also the high accuracy and robustness demonstrated in our experiments, thereby advancing the practical deployment of SNNs in real-world applications.

4.7 Ablation Study↩︎

4.7.1 Burst spiking↩︎

We investigate the effect of burst spiking on SNN performance. When the maximum number of spikes per burst is set to one, the proposed burst mechanism degenerates into the binary spiking scheme. Table 8 compares BuSNN with burst spiking and binary spiking neurons on the CIFAR-10 dataset using the Modified PLIF-Net architecture. The results show that burst spiking consistently improves both clean accuracy and robustness under common corruption and adversarial settings. This improvement reflects enhanced representational capacity and increased network stability against input perturbations. Additional results for different settings of the maximum number of spikes per burst are provided in Supplementary Materials S5.

4.7.2 DWC↩︎

As summarized in the preceding tables, we report results for both BuSNN- and BuSNN, where BuSNN- denotes BuSNN without using DWC. Based on Tables 3 and 4, BuSNN consistently achieves higher accuracy across datasets and architectures. Furthermore, Tables ¿tbl:tab:Adversarial95Attack?, 5, and 6 show that incorporating DWC improves model robustness in most cases. For example, DWC raises the FGSM adversarial robustness accuracy of BuSNN- on CIFAR-100 from 20.84% to 29.90%, and enhances the corruption robustness Score on IMAGENET-C using the SEW ResNet-18 backbone from 0.4482 to 0.4517. These results demonstrate that DWC can enhance robustness against both common corruptions and adversarial perturbations without compromising clean accuracy.

4.8 Burst Spiking Improves Accuracy and Robustness↩︎

 

We propose that burst spiking can enhance both the accuracy and robustness of SNNs. In conventional spiking neurons, the activation state is represented by a single spike and is therefore binary. This simplistic assumption introduces quantization error relative to ANNs, which reduces accuracy [25]. By allowing multiple spikes within a short temporal window, burst spiking alleviates quantization error and strengthens accuracy.

Regarding robustness, in conventional neurons with binary spiking, even small perturbations near the firing threshold can cause abrupt transitions in activation state, leading to accumulated errors across layers and compromised robustness. Fig. 4 (a) and Fig. 4 (b) illustrate this intuition. Burst spiking introduces graded activations that smooth transitions between states and mitigate the impact of small perturbations. To quantitatively assess this effect, we measure the neuron state flip rate under perturbations, where the active state corresponds to positive output and the inactive state to zero output. As shown in Fig. 4 (c), the flip rate in binary spiking networks increases markedly across layers as the severity of Gaussian noise grows, indicating a clear correlation between flip dynamics and perturbation sensitivity. In this figure, the x-axis represents the network layers from the first convolutional layer (denoted C1) to the fully connected layer (Fc). The five curves (L1 to L5) indicate different levels of perturbation severity.

Building on this flip-based characterization, Fig. 4 (d) compares the statistical mean and variance of flip rates across all perturbation severity levels for ANNs, binary spiking networks, and the proposed burst spiking networks. The results show that the ANN model exhibits substantially lower flip rates than binary spiking, while the proposed burst spiking mechanism significantly narrows this gap, thereby enhancing robustness against perturbations.

Additionally, we visualize the effect of burst spiking on the network’s feature space using t-SNE, as shown in Fig. 5. Compared with the binary spiking model, burst spiking exhibits markedly improved cluster compactness and inter-class separability, even surpassing ANN in clustering quality. These results indicate that burst spiking yields more discriminative and stable feature representations, thereby improving both classification accuracy and robustness to input perturbations.

4.9 DWC Reduces Weights Involved in Computation↩︎

Experimental results demonstrate that DWC contributes to improving both the accuracy and robustness of BuSNNs. The key motivation behind this improvement is that DWC effectively constrains connection weights, according to Eq. 26 . We specifically analyze the input-activated connections, whose presynaptic neurons are active during a forward pass. Only these connections participate in the actual computation and influence the output for a given input, with a small magnitude reflecting lower sensitivity of the model to input perturbations. Specifically, we define the input-activated weights as the sum of the absolute values of the weights on these connections, which reflects the total strength of the connections actively involved in the computation.

We analyze the input-activated weights obtained from the BuSNN using the Modified PLIF-Net architecture under three different training strategies: a baseline without regularization, \(\ell_1\) regularization, and DWC. The input-activated weights are computed across the CIFAR-10 dataset, considering all input samples. This allows us to assess the total number of weights involved in the model’s computations across different inputs, providing a comprehensive view of the weights actively contributing to the model’s output. As illustrated in Fig. 6, the input-activated weights of the models trained without regularization and with \(\ell_1\) regularization are nearly identical, indicating that conventional \(\ell_1\) regularization has a limited effect in reducing the weights that actively participate in computation. In contrast, the DWC strategy yields a substantial reduction in input-activated weights. These results suggest that DWC effectively suppresses the magnitude of weights actively involved in computation, thereby reducing the model’s sensitivity to input perturbations.

5 Conclusion and Discussion↩︎

In this work, we investigate the performance of SNNs in terms of accuracy on clean data and robustness under adversarial attacks and common corruptions. Through controlled comparisons with ANNs using identical architectures and training settings, we reveal that conventional SNNs still exhibit limited performance in both aspects. To address these issues, we propose BuSNNs, which consist of BSNs and DWC. BSNs enhance representational capacity and perturbation robustness by using burst spiking. DWC further improves performance by effectively constraining weight magnitudes based on the activation state of BSNs. Extensive experiments confirm that our method consistently improve both accuracy and robustness. These findings provide new insights into the design of robust and efficient SNNs and highlight the importance of jointly optimizing activations and weights in future SNN development.

Our analysis of neural activation offers a new perspective on the role of the multi-spike mechanism in SNNs. Previous works [21], [101], [102] have investigated this mechanism primarily from the standpoint of reducing quantization error, showing that multi-spike neurons can achieve higher accuracy than binary ones. SFA [26] further demonstrates that multi-spike firing can be feasibly implemented on neuromorphic hardware, providing a theoretical advantage in energy efficiency. Unlike prior multi-spike designs that mainly aim to reduce binary quantization error, BSN formulates burst firing as a membrane-potential-driven response. The suprathreshold potential strength is reflected by a bounded burst count controlled by \(\theta_{\text{burst}}\). Our results further reveal that this multi-spike mechanism not only improves accuracy but also enhances robustness. By allowing each neuron to represent graded activation strength within a short temporal window, BSNs provide finer-grained neuronal responses and reduce the quantization error caused by binary firing. Meanwhile, the graded burst levels smooth the transition between activation states, thereby improving robustness.

In addition, effectively training high-performance SNNs has long been a central challenge in the field. The surrogate gradient method, which allows SNNs to be optimized directly toward target objectives in a manner similar to ANNs, has become one of the mainstream approaches. Motivated by our focus on robustness, we introduce a weight optimization mechanism DWC inspired by biological synaptic plasticity. Such activation-dependent weight control reduces the amplification of input perturbations through network layers, thereby limiting output variation and emphasizing the crucial role of biologically grounded constraints in SNN training. We therefore argue that SNNs differ from ANNs in their training dynamics and connectivity constraints. Therefore, developing superior SNN models may require deeper biological inspiration to better exploit the unique computational properties of SNNs.

In our experiments, the proposed models outperform matched ANN counterparts in both accuracy and robustness on small-scale benchmarks, such as CIFAR-10 with Modified PLIF-Net and CIFAR-100 with VGG11. On large-scale benchmarks, including ImageNet, BuSNN consistently improves over existing SNNs. In matched IMAGENET-C settings, BuSNN surpasses INT4 and INT8 activation-quantized ANN baselines for ResNet-18 and ResNet-34, while also outperforming the INT4 baseline for ResNet-50. However, full-precision ANN baselines still retain stronger performance in most large-scale settings. Further evaluation on larger architectures, stronger ANN training recipes, and broader perception tasks remains an important direction for future work.

Since BSNs act on spike-based activation representation and DWC functions as an activation-dependent weight constraint, they can be incorporated into different SNN training objectives without changing the overall learning framework. For instance, the proposed mechanisms are potentially compatible with advanced self-supervised learning [103] and other training strategies [56], [104] for improving SNN representation and robustness. This compatibility provides a practical direction for extending BuSNNs to broader training paradigms and perception tasks. These results demonstrate that SNNs hold strong potential for lightweight, energy-efficient, and robust perception tasks, offering a promising alternative to conventional ANNs in practical scenarios.

6 Limitations↩︎

This study still has several limitations. First, we do not include comparisons with state-of-the-art ANN models that rely on highly specialized architectures, large-scale pretraining, or advanced data augmentation. Instead, we focus on standard ANN baselines under matched architectures and training protocols. This setting enables a fair and interpretable comparison between SNNs and ANNs, since the influence of the computational paradigm can be better isolated. Many advanced ANN techniques, such as data augmentation and knowledge distillation, are also complementary to our framework and can potentially be integrated into future SNN training pipelines. Second, BuSNN does not fully close the gap to ANNs on large-scale datasets. Full-precision ANNs still retain stronger performance under larger backbones. Third, BuSNN has mainly been evaluated in classification-oriented settings. Its generalizability to broader vision tasks, such as object detection and semantic segmentation, remains to be explored. Future work will further address these limitations.

7 Data Availability↩︎

All datasets used in this study are publicly available open-source datasets. The code will be publicly available on https://github.com/fourbeans/BuSNN.

Biography Section↩︎

References↩︎

---

1. This work was partially supported by CAS Project for Young Scientists in Basic Research (YSBR-116), National Distinguished Young Scholars (62325603), National Natural Science Foundation of China (62236009, U22A20103), Beijing Science and Technology Plan (Z241100004224011). (Corresponding author: Guoqi Li.)

   Jiahong Zhang and Han Xu are with the Institute of Automation, Chinese Academy of Sciences, Beijing 100045, China, and the School of Artificial Intelligence, University of Chinese Academy of Sciences, Beijing 100049, China (e-mail: zhangjiahong2023@ia.ac.cn, xuhan2023@ia.ac.cn).

   Sijun Shen is with State Key Laboratory of Media Convergence and Communication, Communication University of China, Beijing 100024, China (e-mail: sijun.shen@mails.cuc.edu.cn).

   Mingqiang Huang is with School of Artificial Intelligence, Wuhan University, Wuhan, Hubei 430079, China (e-mail: mqhuang@whu.edu.cn).

   Yonghong Tian is with Peng Cheng Laboratory, Shenzhen, Guangdong 518066, China, and the Institute for Artificial Intelligence, Peking University, Beijing 100871, China (e-mail: yhtian@pku.edu.cn).

   Man Yao, Guoqi Li, and Bo Xu are with the Institute of Automation, Chinese Academy of Sciences, Beijing 100045, China (e-mail: man.yao@ia.ac.cn, guoqi.li@ia.ac.cn; xubo@ia.ac.cn).↩︎