Fast and Accurate SNN Model Strengthening for Industrial Applications

Abstract

In spiking neural networks (SNN), there are emerging security threats, such as adversarial samples and poisoned data samples, which reduce the global model performance. Therefore, it is an important issue to eliminate the impact of malicious data samples on the whole model. In SNNs, a naive solution is to delete all malicious data samples and retrain the entire dataset. In the era of large models, this is impractical due to the huge computational complexity. To address this problem, we present a novel SNN model strengthening method to support fast and accurate removal of malicious data from a trained model. Specifically, we use untrained data that has the same distribution as the training data. We can infer that the untrained data has no effect on the initial model, and the malicious data should have no effect on the final refined model. Thus, we can use the model output of the untrained data with respect to the initial model to guide the final refined model. In this way, we present a stochastic gradient descent method to iteratively determine the final model. We perform a comprehensive performance evaluation on two industrial steel surface datasets. Experimental results show that our model strengthening method can provide accurate malicious data elimination, with speeds $11.7\times$ to $27.2\times$ faster speeds than the baseline method.

1. Introduction

Given the emerging security and privacy issues, malicious users or data will have a strong impact on the global performance of models [1,2]. For example, in the model training process, malicious data samples will severely reduce the global model performance, in terms of worse classification accuracy or model generalization ability. Especially in the area of spiking neural networks (SNN), little attention has been paid to these security threats, leading to a huge risk potential, such as injecting a backdoor into the spiking neural network [3].

To deal with this problem, we generally need to strengthen the model by eliminating the effects of malicious data samples. One of the simplest solutions is to remove the malicious data samples from the training data and then retrain the training data. Of course, it will take a long time to refine the original model. In the current era of large models, it becomes even impractical due to the huge computational cost and long time.

In this paper, we propose a novel SNN model strengthening method to support fast and accurate removal of malicious data samples from a trained model. To this end, our goal is to improve the initial model by removing the influence of malicious data samples that make up a small part of the training data. To achieve this, our basic idea is to introduce untrained data that has almost the same data distribution as the training data. We can infer that the untrained data has no effect on the initial model, and the malicious data should have no effect on the final refined model. Thus, we can use the model output of the untrained data with respect to the initial model to guide the final refined model. In this way, we present a stochastic gradient descent method to iteratively determine the final model.

Specifically, to make the final refined model accurate, we can further optimize the iteration objective into two conditions. The first one is the fast convergence constraint to speed up the model refinement process towards the direction of a smaller distance in the tuple between (initial model, untrained data) and (final model, malicious data). The second one is the model accuracy constraint to achieve high classification accuracy for benign data samples. We balance these two constraints for fast model strengthening and good global model accuracy. We perform a comprehensive performance evaluation on two industrial steel surface datasets. Experimental results show that our model strengthening method can provide accurate malicious data removal, with speeds $11.7\times$ to $27.2\times$ faster speeds than the baseline method.

The remainder of this paper is organized as follows. Section 2 gives the related work. Section 3 introduces our method. Section 4 presents the experimental results. Finally, Section 5 concludes this paper.

2. Related Work

Security threats and model strengthening: There are emerging security threats in deep learning [1,2], such as the well-known backdoor attacks [4,5,6], membership inference attacks [7], adversarial sample attacks [8,9], data reconstruction attacks [10,11,12], etc., leading to serious information leakage or degraded system performance [13]. Previous solutions have focused on how to detect these security threats to notify the trainer. In recent years, researchers have also paid attention to the process of model strengthening. This involves looking at how to eliminate the degradation in system performance after a threat has been detected. For example, if we have already found that there are malicious data samples in the training data, how can we achieve a correct model? A simple and naive solution is to delete the malicious data samples from the training data and retrain the model, which is usually quite time-consuming due to the huge computational load. There are several solutions to address this problem in an efficient way [14,15,16,17]. For example, Cao [18] divided the training data into several groups, removed the group with malicious data samples, and updated the whole model accordingly. A similar solution is also presented in SISA [19]. Reference [20] further combined the idea of SISA and membership inference attacks to continuously change the output distributions of malicious data during model retraining. Chen [21] proposed a GAN-based model strengthening method for deep neural networks. Liu [22] focused on federated learning. The author removed the malicious data samples from the training data and retrained the model in the direction of the previous training with a larger iteration step. Brophy [23] discussed a random forest algorithm to support model retraining with a subtree. Nguyen [24] presented a Markov chain Monte Carlo algorithm for extracting data samples to estimate the posterior belief of model parameters. However, these solutions have high resource consumption due to the malicious data distribution and historical training information, making them difficult to use in a generic case.

Spiking Neural Networks (SNN): The SNN is one of the third generation of neural networks [25] with brain-inspired features. Due to the difficult training process in SNN, there have been many research efforts to provide efficient training of SNN models. For example, Deng [26] bridged the SNN and the DNN by transferring the model weights of DNNs to SNNs with almost no loss of accuracy. Diehl [27] and Dong [28] borrowed the idea of Spike Timing-Dependent Plasticity (STDP) from neural science and achieved significant performance on the MNIST vision dataset and TIDIGITS digital speech dataset with unsupervised learning. Wu [29,30] further combined the BP learning rule with the spatio-temporal features in model training to support biologically plausible interpretability and high model accuracy. Hunsberger [31] integrated spiking LIF neurons into deep neural networks, allowing well-trained static networks to be transformed into dynamic spiking networks. Recently, researchers have studied the security threats in SNNs, such as backdoor attacks [3]. However, little attention has been paid to model strengthening in SNNs. Therefore, we aim to investigate this issue, especially for industrial datasets.

3. Our Model Strengthening Method

In the area of model strengthening, we want to efficiently remove the influence of malicious data from the trained model. Let $M_{initial}$ be an SNN model trained on original dataset $D_{initial}$, where $D_{malicious}$ is a subset in $D_{initial}$. To remove the influence of $D_{malicious}$ from $M_{initial}$, the simplest solution is to retrain a new model with $D_{initial}-D_{malicious}$, which is the so-called retraining method. Obviously, it is not time efficient due to its large computational complexity.

3.1. Basic Idea

To support accurate and fast model strengthening, we propose that the strengthened model $M_{final}$ could be derived from the given $M_{initial}$ to reduce computation. Inspired by the original training procedure, our idea can be described as follows.

As shown in Figure 1a, $M_{initial}$ is trained on $D_{initial}$, and the untrained data (e.g., $D_{untrained}$) have little or no influence on $D_{initial}$. As in Figure 1b, after model strengthening, the malicious data should be removed from the final model $M_{final}$. This means that $D_{malicious}$ has little or no impact on $D_{final}$. In practice, these two items should be almost equivalent. In other words, after removing malicious data, the model output of untrained data with respect to the initial model (i.e., $M_{initial}\left(D_{untrained}\right))$ should be almost equivalent to the model output of malicious data with respect to the final model (i.e., $M_{final}\left(D_{malicious}\right))$, satisfying $M_{initial}\left(D_{untrained}\right)\approx M_{final}\left(D_{malicious}\right)$.

Similar to the generative adversarial network (GAN), we can use the element $M_{initial}\left(D_{untrained}\right))$ to guide the training of $M_{final}$ so that their outputs similar after several iterations. Thus, with suitable untrained data $D_{untrained}$, $M_{final}$ can be set to $M_{initial}$ at the beginning, and we then iterate in the direction of removing malicious data as the differences in $M_{initial}\left(D_{untrained}\right)$ and $M_{final}\left(D_{malicious}\right)$ become smaller. Here, for simplicity, we can use the KL distance to measure their differences.

3.2. Model Strengthening Method

Inspired by Figure 1, we propose a fast model strengthening method. Given an initial model $M_{initial}$ trained on $D_{initial}$, our goal is to eliminate the influence of $D_{malicious}$ and determine a final model $M_{final}$ from $D_{initial}-D_{malicious}$.

Our goals can also be summarized as two constraints. The first one is the fast convergence constraint to speed up the model strengthening process towards a smaller distance between $M_{initial}\left(D_{untrained}\right)$ and $M_{final}\left(D_{malicious}\right)$. The second one is the model accuracy constraint, which states that the model accuracy should not be significantly affected after removing the malicious data, resulting in a high model accuracy $M_{final}(D_{initial}-D_{malicious})$.

As listed in Algorithm 1, our model strengthening method can be described as follows. In Step 1, we construct untrained data $D_{untrained}$ with the same class categories as $D_{train}$, where $D_{untrained}\cap D_{train}=\varnothing$. In Step 2, we initialize the final model with the initial model as $M_{final}=M_{initial}$. In Step 3, we compute the model output of untrained data with respect to the initial model as $M_{initial}\left(D_{untrained}\right)$. In Step 4, we compute the model output of malicious data with respect to the final model as $M_{final}\left(D_{malicious}\right)$. In Step 5, we compute the difference between these two model outputs as $p=M_{initial}\left(D_{untrained}\right)-M_{final}\left(D_{malicious}\right)$. In Step 6, we compute the model accuracy of the remaining data with respect to the final model as $q=M_{final}(D_{initial}-D_{malicious})$. In Step 7, we compute the tradeoff between the output difference and the model accuracy: $\lambda p+(1-\lambda )q$, where $\lambda$ is a tradeoff parameter. Finally, we iterate from Step 3∼7 by a stochastic gradient descent method until convergence to determine the final model $D_{final}$.

Algorithm 1 Our Model Strengthening Method.

Input:  An initial SNN model $M_{initial}$ trained on $D_{initial}$, and malicious data $D_{malicious}$, where $D_{malicious}\subset D_{initial}$. Output:  An SNN model $M_{final}$ trained on $D_{initial}-D_{malicious}$. 1: Construct untrained data $D_{untrained}$ with the same class categories of $D_{train}$, where $D_{untrained}\cap D_{train}=\varnothing$. 2: Initialize the final model: $M_{final}=M_{initial}$. 3: Compute the model output of untrained data with respect to the initial model: $M_{initial}\left(D_{untrained}\right)$. 4: Compute the model output of malicious data with respect to the final model: $M_{final}\left(D_{malicious}\right)$. 5: Compute the difference between the two outputs: $p=M_{initial}\left(D_{untrained}\right)-M_{final}\left(D_{malicious}\right)$. 6: Compute the model accuracy: $q=M_{final}(D_{initial}-D_{malicious})$. 7: Compute the tradeoff between the output difference and the model accuracy: $\lambda p+(1-\lambda )q$, where $\lambda$ is a tradeoff parameter. 8: Iterate from Step 3 ∼ 7 by a stochastic gradient descent method until convergence to determine the final model $D_{final}$.

4. Experiments

To illustrate the model strengthening performance of our method, we perform experiments on a real dataset, specifically the well-known NEU-CLS dataset for industrial steel surface detection. In our experiments, we run PyTorch codes on a single Tesla V100 GPU, manufactured by NVIDIA Inc., Taiwan, China.

4.1. Experiment Settings

As a baseline, we first evaluate the accuracy of the steel surface detection model with the initial dataset. In the following experiments, we use an SNN model with two convolutional layers and two fully connected layers. This model has approximately 0.3 million parameters. We also use a longer simulation time-step to ensure that all neurons are activated in the first training epoch. We use two typical industrial steel surface datasets, the NEU-CLS-64 dataset and the NEU-CLS-200 dataset.

In the NEU-CLS-64 dataset, the data distribution is unbalanced. As shown in Figure 2, the data sizes of the classes ‘cr’, ‘gg’, ‘in’, ‘pa’, ‘ps’, ‘rp’, ‘rs’, ‘sc’, and ‘sp’ are 962, 247, 605, 914, 644, 151, 1298, 617, and 342, respectively. The unbalanced data distribution leads to significant misclassification, especially for the classes with a smaller data size. To deal with this problem, we generally use an oversampling method [32,33] or an undersampling method [34,35]. The oversampling method involves deleting data samples of larger classes to balance the dataset, which leads to a serious loss of useful information and weakens the generalization capacity of the model. Therefore, we turn to the oversampling method, by randomly selecting and copying data samples from smaller classes to balance the whole dataset. Since the data oversampling method introduces duplicate samples, we also use data augmentation methods (e.g., flipping up, flipping down, flipping left, flipping right, and 90-degree rotation) to avoid potential data overfitting problems and improve the generalization capacity of the SNN. In this way, we construct the training data, the unlearned data, and the test data with the data sizes of 10,384, 1298, and 1445, respectively, as listed in

Table 1. Data partitioning for the untrained data, the training data, and the test data.

	Untrained Data	Training Data	Test Data
NEU-CLS-64	1298	10,384	1445
NEU-CLS-200	240	1200	360

. The initial SNN model with a four-layer CNN architecture achieves 92% classification accuracy on the test data.

For the NEU-CLS-200 dataset with an image size of 200 × 200, its data samples are balanced between different classes. So we skip the data oversampling process and use data augmentation directly. The corresponding data sizes of the training data, the unlearned data, and the test data are 1200, 240, and 360, respectively, as shown in Table 1. The initial SNN model achieves a classification accuracy of 87% on the test data.

For the SNN model strengthening, the learning rate is set to $5\times {10}^{-4}$, the mini-batch size is set to 32, and the tradeoff parameter $\lambda$ is set to 0.01. For the NEU-CLS-64 dataset, the input data size is $32\times 32$, and we consider data samples with the label ‘1’ as the malicious data that should be removed from the initial model. For the NEU-CLS-200 dataset, its input data size is $32\times 32$, where data samples labeled ‘2’ should be removed. These parameters are also listed in

Table 2. Parameters for the SNN model strengthening.

Dataset	Learning Rate	Mini-Batch Size	$\mathit{\lambda }$	Input Data Size	Class
NEU-CLS-64	$5\times {10}^{-4}$	32	0.01	$64\times 64$	1
NEU-CLS-200	$5\times {10}^{-4}$	32	0.01	$128\times 128$	2

.

4.2. Model Strengthening Accuracy

After model strengthening, malicious samples should have little or no impact on the final model. As mentioned in the previous section, we assume that all malicious samples belong to the same class (e.g., class ‘1’ in the NEU-CLS-64 dataset and class ‘2’ in the NEU-CLS-200 dataset), which is so-called the malicious class. Other classes with benign data samples are called benign classes.

Table 3. Model strengthening accuracy for different datasets.

Dataset	Classes	Initial Model	Retraining	Ours
NEU-CLS-64	malicious class	99.31	0	6.39
	benign classes	95.65	84.35	83.17
NEU-CLS-200	malicious class	97.08	0	7.5
	benign classes	89.5	82.58	77.5

and Figure 3 show the classification accuracy of our model strengthening method. For the NEU-CLS-64 dataset, the initial model provides classification accuracy of 99.31% for the malicious class and 95.65% for the benign classes. In contrast, our method gives a classification accuracy of 6.39% for the malicious class and 83.17% for the benign classes. This indicates that the malicious class is almost removed from the final model without significantly reducing the classification accuracy for the benign classes. Compared to the retraining method, which retrains the whole model after deleting all malicious data from the training data, we still have comparable classification performance (84.35% vs. 83.17%), even with an extremely fast coverage time, as shown in the next section. From the NEU-CLS-200 dataset, we can easily infer similar results with the NEU-CLS-64 dataset. In summary, the experimental results confirm the model strengthening accuracy of our method.

To investigate the detailed information, we also evaluate the F1-score, precision, and recall on the test data, as shown in Figure 4. Compared to the initial model, our method is not able to indicate the correct label for the malicious class (i.e., class ‘1’ in the NEU-CLS-64 dataset and class ‘2’ in the NEU-CLS-200 dataset). Thus, the malicious class is identified as other classes, confirming that our method can remove malicious data samples for model strengthening. Furthermore, our method provides good classification performance for other classes, showing that it can produce excellent results for benign data samples.

4.3. Model Strengthening Time Cost

We also evaluate the time cost of our method compared to the baseline.

Table 4. Model strengthening time cost.

Datasets	Retraining (min)	Ours (min)	Speed Up
NEU-CLS-64	37.24	3.19	$11.7\times$
NEU-CLS-200	13.61	0.50	$27.2\times$

shows the model strengthening time cost for the two datasets. We can see that our method achieves speeds $11.7\times$ to $27.2\times$ faster than the retraining method, even with comparable classification performance (e.g., 84.35% vs. 83.17% for the NEU-CLS-64 dataset, as shown in Table 3).

4.4. Performance Tradeoff

As discussed in Section 3, there is a tradeoff between classification accuracy for benign samples and removal performance for malicious samples, and thus we use a parameter $\lambda$ to balance them in our algorithm. In this section, we will further discuss the impact of the tradeoff by using different $\lambda$, such as 0, 0.001, 0.01, 0.1, and 1. With a larger $\lambda$, our method pays more attention to malicious data removal than benign data classification, and vice versa. Specifically, when $\lambda =0$, it means that malicious data are kept in the training data and we do not perform model strengthening. When $\lambda =1$, it means that we want to maximize the removal of malicious data and neglect the classification performance on benign data.

The experimental results are presented in

Table 5. Tradeoff in model strengthening for the NEU-CLS-64 dataset.

	Malicious Class	Benign Classes	Time Cost (min)
$\lambda =0$	99.31	95.64	∞
$\lambda =0.001$	6.86	85.32	3.08
$\lambda =0.01$	7.16	84.94	2.79
$\lambda =0.1$	7.24	84.91	2.86
$\lambda =1$	7.55	70.04	2.83

and

Table 6. Tradeoff in model strengthening for the NEU-CLS-200 dataset.

	Malicious Class	Benign Classes	Time Cost (min)
$\lambda =0$	96.67	89.75	∞
$\lambda =0.001$	6.25	77.67	0.76
$\lambda =0.01$	7.08	77.83	0.58
$\lambda =0.1$	7.08	77.75	0.58
$\lambda =1$	6.67	77.83	0.56

. After model strengthening, both the malicious and benign classes achieve stable classification accuracy when the $\lambda$ varies among 0.001, 0.01, and 0.1. For example, the classification accuracy for the NEU-CLS-64 dataset is 7.16% and 7.24% for $\lambda =0.01$ and $\lambda =0.1$, respectively, demonstrating the robustness of our method. We can also find that a small $\lambda$ results in a longer time for model convergence.

For the extreme point of $\lambda =0$, there is no malicious data removal, and thus both the malicious class and the benign classes have high classification accuracy due to initial model training. In fact, it is identical to the initial model. At the extreme point of $\lambda =1$, we overlook the classification accuracy on the benign data, so the classification accuracy for the benign classes becomes lower (e.g., 70.05% in the NEU-CLS-64 dataset).

4.5. Model Strengthening Accuracy vs. Model Architecture

In this section, we further study how to improve the accuracy of model strengthening with different model architectures. We complete our model strengthening method on the NEU-CLS-64 dataset and record the malicious data removal performance, as listed in

Table 7. Model strengthening accuracy for different labels.

Label	Class	Initial Model	Our	Time Cost (min)
‘cr’	malicious class	99.77	6.24	2.2441
	benign classes	95.58	84.07
‘gg’	malicious class	99.31	6.39	3.1923
	benign classes	95.65	83.17
‘pa’	malicious class	99.77	7.7	4.1807
	benign classes	95.58	59.37
‘ps’	malicious class	92.22	7.55	1.4699
	benign classes	95.65	93.01
‘rs’	malicious class	99.23	6.78	7.4573
	benign classes	95.65	52.04
‘sp’	malicious class	83.98	3.62	1.3547
	benign classes	97.55	76.87

. We can see that the label ‘ps’ produces the best result in terms of the highest classification accuracy for benign classes (i.e., 93.01%), and the label ‘rs’ performs the worst, with the worst classification accuracy for benign classes (i.e., −52.04), even with the longest coverage time. Moreover, for the labels ‘rp’ and ‘sc’, our model strengthening method cannot really remove the malicious data samples, where the malicious class decreases quite slowly.

To investigate why different classes have very different model strengthening performance, we examine the original images of these classes. As shown in Figure 5, the images of the label ‘ps’ are very similar to each other and quite different from the images of the other labels. This means that the class ‘ps’ has a small intra-class distance and a large inter-class distance, which makes it easier to classify. In contrast, class ‘rp’ and class ‘sc’ have large intra-class distances, which leads to worse model strengthening performance.

To improve the model strengthening performance, we would like to introduce a stronger network architecture to capture more feature vectors for the original data samples. Here, we modify the basic structure of the original four-layer CNN into an eight-layer CNN with five convolutional layers and three fully connected layers, whose total number of parameters is 10.28 million. With a deeper convolutional layer, it is more likely to use more features with more filters. Thus, we train an eight-layer SNN model, which achieves a classification accuracy of 96% on the test data. We then apply our model strengthening method, specifically for the ‘rp’ class and the ‘sc’ class. As shown in

Table 8. Model strengthening accuracy with an eight-layer SNN model.

Label	Class	Initial Model	Ours	Time Cost (min)
‘rp’	malicious class	100	7.78	27.67
	benign classes	99.47	53.22
‘sc’	malicious class	100	4.55	42.49
	benign classes	99.47	30.55

, these malicious data samples can be successfully removed, with 7.78% and 4.55% classification accuracy, although the benign classes suffer from misclassification (e.g., 53.22% for ‘rp’). However, it still shows an obvious improvement in model strengthening, and we believe that a better tradeoff could be achieved with a deeper SNN model.

4.6. Performance Comparison with Two Baselines

We also compare our method with two baseline methods. The first is the retraining method, which retrains the training data after removing the malicious data. The second is the SISA method, which divides the training data into several isolated subsets and removes the subset with malicious data samples. We perform the model strengthening on the NEU-CLS-64 dataset. The experimental results are shown in

Table 9. Performance comparison with two baselines.

Classes	Initial Model	Retraining	SISA	Ours
malicious class	99.31	0	0	6.39
benign classes	95.65	84.35	78.75	83.17
time cost	/	37.24	26.8	3.19

. We can conclude that both retraining and SISA produce no classification error for malicious data, generally because they actually remove all malicious data directly from the training data. Our method produces a benign classification comparable to retraining, and superior to SISA. In addition, the time cost of retraining, SISA, and our method are 37.24 min, 26.8 min, and 3.19 min, respectively, indicating $8.4\times$ to $11.7\times$ improvements. Therefore, our method can produce refined model accuracy, with much faster model convergence speeds.

5. Conclusions

To eliminate the impact of malicious data samples in SNNs, we present a novel SNN model strengthening method to support fast and accurate removal of malicious data from a trained model. By constructing untrained data with the same distribution as the training data, we can use the model performance of the untrained data relative to the initial model to guide the final refined model. We also present a stochastic gradient descent method to iteratively determine the final model. Experimental results on two industrial steel surface datasets show that our model strengthening method can successfully eliminate the malicious data samples with speeds $11.7\times$ to $27.2\times$ faster than the baseline method.