Sneaky Spikes: Uncovering Stealthy Backdoor Attacks in Spiking Neural Networks with Neuromorphic Data

Sneaky Spikes: Uncovering Stealthy Backdoor Attacks in Spiking Neural Networks with Neuromorphic Data

Speakers: Gorka Abad

Conference: NDSS Symposium

YouTube: https://www.youtube.com/watch?v=kogm9YqCEWo

Overview

Deep Neural Networks (DNNs) have revolutionized machine learning, yet their computational demands and energy consumption pose significant challenges, particularly for resource-constrained applications. Spiking Neural Networks (SNNs) emerge as a promising alternative, offering substantial energy efficiency gains—up to 12.2 times better compute energy efficiency in some studies—and biologically plausible data processing. SNNs are uniquely suited for neuromorphic data, which is captured by specialized Dynamic Vision Sensors (DVS cameras) that record per-pixel brightness changes asynchronously, enabling low power consumption, low latency, and high temporal resolution crucial for domains like autonomous driving and medical diagnosis.

Despite their advantages and rapidly diminishing performance gap with DNNs, the security landscape of SNNs remains largely unexplored. While SNNs have shown susceptibility to adversarial examples and hardware attacks, the specific threat of backdoor attacks has received minimal attention. This oversight is critical because the distinct architecture of SNNs and the unique characteristics of neuromorphic data render most existing DNN backdoor attacks and defenses ineffective. This research, presented by Gorka Abad, addresses this crucial gap by comprehensively investigating backdoor attacks in SNNs, developing novel triggers, assessing their stealthiness, and evaluating the efficacy of adapted state-of-the-art defenses.

The work delves into the intricacies of designing backdoor attacks that exploit the temporal and polarity-based nature of neuromorphic data. It introduces innovative triggers capable of manipulating position and color within this data, achieving up to 100% attack success rates with negligible impact on clean accuracy. A significant contribution is the development of highly stealthy dynamic attacks, virtually undetectable by human observation. Furthermore, the study critically assesses the limitations of current DNN defenses when applied to SNNs, revealing their failure to mitigate these new threats and highlighting an urgent need for SNN-specific security mechanisms.

Background

▶ Watch: Introduction to SNNs and their energy efficiency (0:00)

Spiking Neural Networks (SNNs) represent a third generation of neural networks, distinguishing themselves from traditional Artificial Neural Networks (ANNs) and Deep Neural Networks (DNNs) by mimicking the event-driven communication of biological neurons. Instead of continuous-valued signals, SNNs operate on discrete events known as spikes. A core model within SNNs is the Leaky Integrate-and-Fire (LIF) model, where a neuron's membrane potential accumulates inputs over time; once this potential crosses a specific threshold, the neuron emits a spike and then resets. Unlike DNNs, SNNs do not typically employ differentiable activation functions like ReLU, which complicates direct application of standard backpropagation. Consequently, SNNs are often trained using methods like Spike Timing-Dependent Plasticity (STDP) or, as in this research, surrogate gradients, which approximate derivatives to enable backpropagation-like training.

Neuromorphic data, a cornerstone of SNN applications, is inherently time-encoded. Originating from DVS cameras, this data captures illumination changes as asynchronous spiking events. A key characteristic of neuromorphic data is polarity, which indicates the direction of electrical signals—ON or OFF. When different polarities overlap, they create distinct "colors." For instance, in this research, neuromorphic data pixels can assume up to four distinct polarity combinations, simplified to p0, p1, p2, and p3, representing colors such as black, dark blue, green, and light blue. This limited, discrete pixel space (four combinations) contrasts sharply with standard image data, where pixels typically offer 255 possibilities per channel, presenting unique challenges for data manipulation.

Backdoor attacks are a specific type of data poisoning attack where an adversary subtly injects malicious samples containing a hidden trigger into the training dataset. After the model is trained on this poisoned data, it appears to function normally on clean, legitimate inputs. However, any input containing the specific trigger will cause the compromised model to misclassify it to a predetermined target label. Formally, the attacker modifies the training objective to minimize a loss function over a mixture of clean and backdoored data, controlling the poisoning rate (ε). While backdoor attacks are extensively studied in DNNs, with sophisticated advancements like stealthy and dynamic triggers, their investigation within SNNs is nascent. Prior to this work, only one other study had explored backdoor attacks on SNNs, utilizing static and moving square triggers that were easily visible and lacked comprehensive parameter tuning or defense evaluation. This highlights a critical gap in understanding and mitigating SNN backdoor vulnerabilities.

Key Findings

▶ Watch: Background on SNNs, LIF model, and neuromorphic data (2:00)

This research makes several pivotal contributions to the understanding of SNN security against backdoor attacks, demonstrating both the profound vulnerability of SNNs and the inadequacy of current defensive strategies.

Firstly, the study successfully developed and evaluated four distinct backdoor attack strategies—static, moving, smart, and dynamic—tailored for SNNs and neuromorphic data. These attacks consistently achieved high Attack Success Rates (ASR), often reaching 100%, while maintaining a negligible impact on the model's clean accuracy. This demonstrates that SNNs are highly susceptible to data poisoning, even with subtle trigger injections.

Secondly, the research unveiled the exceptional stealthiness of its novel dynamic trigger. This sophisticated attack, which utilizes a spiking autoencoder for optimal, sample- and frame-specific perturbations, proved virtually undetectable by human inspection at optimal parameters (e.g., γ=0.01). It achieved an impressive 99.9% Structural Similarity Index (SSIM) with clean images, significantly outperforming static and moving triggers (around 98.5% SSIM) which were more easily perceived. This highlights a new frontier in stealthy SNN attacks.

Thirdly, a comprehensive evaluation of four state-of-the-art DNN backdoor defenses—Artificial Brain Stimulation (ABS), STRIP (Strong Intentional Perturbation), Spectral Signatures, and Fine-pruning—revealed their widespread ineffectiveness against the developed SNN backdoor attacks. These defenses often failed due to SNNs' unique architectural characteristics (e.g., absence of ReLU activation functions) and the distinct properties of neuromorphic data (temporal encoding, limited polarity values). Adaptive attacker scenarios further demonstrated how even the most promising defense, fine-pruning, could be bypassed by strategically tuning poisoning rates or freezing convolutional layers.

Finally, these findings collectively underscore a critical and urgent need for dedicated, SNN-specific security research. The observed vulnerabilities, coupled with the failure of adapted DNN defenses, indicate that SNNs are not merely a new target but represent a fundamentally different security challenge that requires tailored solutions to ensure their safe deployment in sensitive applications.

Technical Deep Dive

▶ Watch: Defining backdoor attacks and prior SNN limitations (2:50)

The research meticulously addresses the design and implementation of backdoor attacks targeting Spiking Neural Networks (SNNs) operating on neuromorphic data, along with a rigorous evaluation of their efficacy and stealthiness, and the resilience of existing defenses.

Threat Model and Challenges

The assumed threat model aligns with prior image-domain studies: the attacker has full access to the SNN model architecture and the training dataset. The attack method is data poisoning, specifically a dirty label methodology, where malicious samples are injected into the training set, and their labels are flipped to a target class. The focus is on the digital domain, where triggers are injected into digital samples. A common scenario is a client outsourcing SNN training to a malicious third-party cloud provider who injects the backdoor.

This scenario presents four unique challenges for SNNs:

• C.1: Designing and Optimizing the Trigger: Neuromorphic data's temporal nature (multiple frames) and limited four-polarity pixel space (p0-p3) make trigger design complex. Identifying parameters for maximal efficacy and minimal clean accuracy impact is crucial.
• C.2: Generating Stealthy Triggers: The limited pixel values make smoothing triggers difficult, potentially increasing visibility. Designing triggers that exploit time-encoding for uniqueness and imperceptibility per sample/frame is a significant hurdle.
• C.3: Backdoor Defenses: Many DNN defenses rely on activation functions (absent in SNNs) or are designed for static images, not multi-frame neuromorphic data with distinct color encoding. Their adaptation and effectiveness are uncertain.
• C.4: Assessing Stealthiness: Objectively quantifying trigger stealthiness in neuromorphic data is non-trivial, and subjective human evaluation is costly. Developing objective metrics is necessary.

Backdoor Attack Strategies

Four distinct attack strategies were developed and investigated:

1. Static Backdoor:

• Concept: A simple square pattern, inspired by BadNets, replicated identically across all frames of a neuromorphic sample.
• Parameters:
• Polarity (Color): Explores p0 (black), p1 (dark blue), p2 (green), p3 (light blue).
• Location: Fixed positions (top-right, middle, bottom-left).
• Size: Percentage of input image size.
• Poisoning Rate (ε): Proportion of backdoored samples in the training set.
• Goal: Serve as a baseline, despite being easily detectable by human inspection due to its unnatural static nature in dynamic neuromorphic data.

1. Moving Backdoor:

• Concept: Exploits the time-encoded nature of neuromorphic data by injecting a trigger that smoothly changes its position across frames (e.g., shifting by two pixels horizontally per frame).
• Mechanism: Uses a binary mask to define the trigger's location and size at each time step, creating a dynamic effect.
• Goal: Achieve greater stealthiness by making the trigger appear as a natural part of the input's activity area, which is inherent to neuromorphic data.

1. Smart Backdoor:

• Concept: A novel approach that automates trigger placement and polarity selection to optimize performance and stealth.
• Mechanism:
• Mask Division: Divides the input image into (c+1)² chunks (e.g., 9 masks for c=2).
• Most Active Mask Selection (v'): Calculates mask activation by summing all polarity changes (excluding p0/background) within each mask across all frames in the poisoned dataset. The mask with the highest activity is chosen.
• Least Used Polarity Selection (p'): Within the chosen most active mask, identifies the polarity that is least used. This polarity offers the highest contrast against the background, maximizing trigger visibility to the model.
• Injection: The trigger, using p', is injected into v', moving randomly and smoothly within its boundaries across all frames.
• Exploration: Also explored injecting into least active masks and using most common polarities to study stealth vs. performance trade-offs.

1. Dynamic Backdoor:

• Concept: The most advanced and stealthy attack, aiming for an invisible trigger unique for each image and each frame.
• Mechanism:
• Spiking Autoencoder (AE): A spiking autoencoder (g) is used to generate an optimal perturbation (δ) for each clean input (x).
• Perturbation Constraint: The perturbation is added to the clean image (x' = x + δ) and constrained within an L-infinity ball (g(x) ≤ γ), where gamma (γ) controls the trigger's intensity and thus its visibility.
• Joint Optimization: The AE (g) is trained simultaneously with the SNN model (f). The AE optimizes its parameters to maximize backdoor accuracy, while the SNN model optimizes to balance clean accuracy and ASR. An alpha (α) parameter controls this trade-off. This eliminates a separate fine-tuning phase.
• Goal: Allow the trigger to alternate in shape and color per sample and frame, making it highly imperceptible and robust.

Implementation Details

• Datasets: Four standard event-based neuromorphic datasets were used:
• N-MNIST 50: 60,000 train, 10,000 test; 34x34 pixels; from ATIS sensor.
• CIFAR10-DVS 39: 9,000 train, 1,000 test; 128x128 pixels; 10 classes.
• DVS128-Gesture 4: 1,176 train, 288 test; 128x128 pixels; 11 hand gestures.
• N-Caltech101 50: 8,709 train, 823 test; cropped to 180x180 pixels.
• All samples represented as T frames (T=16), with polarity (P), height (H), and width (W).
• Network Architectures:
• N-MNIST: Single convolutional layer + fully connected layer.
• CIFAR10-DVS: Two convolutional layers (batch norm, max pooling) + two fully connected layers (dropout) + voting layer.
• DVS128-Gesture & N-Caltech101: Five convolutional layers (batch norm, max pooling) + two fully connected layers (dropout) + voting layer.
• Spiking Autoencoder (AE) for Dynamic Attack:
• DVS128-Gesture, CIFAR10-DVS, N-Caltech101: Four convolutional, four deconvolutional layers (batch norm, tanh).
• N-MNIST: Two convolutional, two deconvolutional layers (batch norm, tanh).
• Default Training Settings: Learning Rate (LR): 0.001; Loss Function: Mean Squared Error (MSE); Optimizer: Adam 33; Framework: SpikingJelly 16; Frames (T): 16.
• Baseline Clean Accuracies: N-MNIST: 99.4%; CIFAR10-DVS: 68.3%; DVS128-Gesture: 92.5%; N-Caltech101: 75.5%. These align with state-of-the-art performance 56.
• Reproducibility: Code and guides are publicly available on GitHub and Zenodo. Experiments run on Ubuntu 20.04, Python 3.8, CUDA 11.7, NVIDIA A100 GPU (40GB).

Evaluation and Results: Attack Performance

The attacks were evaluated using ASR, model utility (clean accuracy), and clean accuracy degradation.

• Static Backdoor:
• Achieved 100% ASR for complex datasets (CIFAR10-DVS, DVS128-Gesture) with a 10% trigger size and 0.1 poisoning rate. N-MNIST even achieved 100% ASR with a 1% trigger.
• Clean accuracy degradation was negligible for N-MNIST (0%) but up to 5% for DVS128-Gesture and CIFAR10-DVS.
• Limitation: Highly visible and unnatural.

• Moving Backdoor:
• Successfully overcame static trigger limitations. Polarity significantly influenced performance; for DVS128-Gesture, triggers in the middle with polarity 1 or 2 achieved 100% ASR.
• Clean accuracy degradation for N-MNIST remained 0%. For DVS128-Gesture and CIFAR10-DVS, degradation reached up to 7%, slightly higher than static attacks due to increased complexity.

• Smart Backdoor:
• Showed excellent performance, effectively addressing Challenge C.1 by optimizing trigger design.
• For N-MNIST, using the most active area and least common polarity yielded high ASR with a 1% trigger size and 0.1 poisoning rate.
• For complex datasets, injecting into the least active area with the least active trigger polarity showed excellent backdoor performance even with small trigger sizes.
• Maximum clean accuracy degradation was 4% (0.01 trigger size, 0.1 poisoning rate in most active area). Injecting into the least active area led to smaller degradation.

• Dynamic Backdoor:
• The most effective attack, consistently achieving 100% ASR with high clean accuracy for N-MNIST.
• For DVS128-Gesture, ASR was a minimum of 95% (excluding α=0.9).
• Visibility parameter (γ) was critical for CIFAR10-DVS: larger γ increased ASR but reduced clean accuracy (more visible trigger), while γ=0.01 made the trigger nearly invisible but could reduce ASR.
• Clean accuracy degradation was minimal for N-MNIST with small γ (e.g., 0.01), increasing with larger γ. Slight degradation for DVS128-Gesture when α=0.5 or γ was large.
• Optimal balance was achieved with small γ (0.01) and large α (0.9), ensuring the trigger remained unnoticed while maintaining high performance, effectively addressing Challenge C.2 (stealthy triggers).

Demo / Proof of Concept

▶ Watch: Threat model and outsourced SNN training scenario (4:00)

The talk included a live demonstration of the dynamic motion and stealthiness of the developed triggers. While the specific visual details of the demo are not fully transcribed, the speaker explicitly stated: "Our code is publicly available for reproducibility, and we even demonstrate the dynamic motion and stealthiness of our triggers in a live demo." This implies a visual presentation where the audience could observe the subtle, time-varying perturbations introduced by the dynamic triggers within neuromorphic data streams, contrasting their imperceptibility with the more noticeable effects of static or moving triggers. The demonstration served as a powerful proof of concept, illustrating how these advanced triggers blend seamlessly into the inherent activity of neuromorphic inputs, making them extremely difficult for human observers to detect.

Defensive Implications

▶ Watch: Key challenges designing backdoor attacks for SNNs (4:30)

A critical aspect of this research involved adapting and evaluating four state-of-the-art DNN backdoor defenses against the developed SNN attacks. The core challenge lies in the fundamental differences between DNNs and SNNs, particularly the latter's lack of differentiable activation functions like ReLU and the temporal, event-driven nature of neuromorphic data.

1. Artificial Brain Stimulation (ABS) 43:

• Method: A model-based defense that stimulates specific layer neurons and examines output deviations, assuming backdoored classes create distinct feature subspaces and poisoned neurons produce larger outputs.
• Adaptation: Modified to process all frames of an image together.
• Limitations: Does not support dynamic, moving, or smart triggers due to their changing positions or uniqueness per image. Crucially, ABS relies on "turn-points" created by ReLU activation functions, which SNNs lack.
• Results: Ineffective. Caused false positives (marking clean models as compromised) and, for poisoned models, identified them as compromised but with the wrong target class. The absence of ReLU rendered ABS fundamentally flawed for SNNs.

1. STRIP (Strong Intentional Perturbation) 20:

• Method: A test-time defense that perturbs incoming inputs and observes the entropy (randomness) of predicted classes; low entropy suggests a malicious input. Assumes clean and backdoor samples are separable by entropy.
• Adaptation: Adapted by performing frame-by-frame interpolation between neuromorphic samples to create perturbed test sets.
• Limitations: STRIP's core assumption—that poisoned data exhibits lower entropy—does not consistently hold for neuromorphic data. Neuromorphic data generally has much lower entropy levels (around 0.01) compared to regular image data (around 1 for CIFAR-10).
• Results: Ineffective. Entropy levels of clean and backdoor data often overlapped or clean data even showed lower entropy, making them indistinguishable.

1. Spectral Signatures 62:

• Method: Aims to mitigate dataset poisoning by identifying and eliminating compromised sub-populations. Uses Singular Value Decomposition (SVD) on the latent space of the last convolutional layer to magnify distribution differences, then retrains with clean data.
• Adaptation: Applied against static and moving attacks, with a target label of 0 and an 85% percentile.
• Limitations: Requires access to the compromised dataset, which is not always feasible. Inapplicable to dynamic backdoor attacks, as their triggers are generated on-the-fly, meaning poisoned samples are not available for prior inspection.
• Results: Ineffective. Showed no significant degradation or improvement in clean accuracy or ASR. Incorrectly flagged legitimate samples as backdoors, and compromised data remained in the dataset, leading to continued vulnerability.

1. Fine-pruning 41:

• Method: Involves two steps: pruning (removing) neurons in the last convolutional layer based on activation values, followed by fine-tuning (retraining) the pruned model on clean data to recover clean accuracy.
• Adaptation: Investigated pruning alone, fine-pruning, and fine-tuning only, with various pruning rates (τ).
• Results:
• Pruning alone: Ineffective; drastic clean accuracy drop, high ASR maintained.
• Fine-pruning (pruning + fine-tuning): Showed promise, capable of reducing ASR while keeping clean accuracy high, especially for stealthier backdoors.
• Fine-tuning only (τ=0): Also reduced the backdoor effect.
• Moving Triggers: Fine-pruning sometimes failed to reduce the effect of moving triggers.
• Adaptive Attacker Scenario: This defense was found vulnerable to an adaptive attacker:
• Low Poisoning Rate: Using ε=0.001 or 0.01 allowed attacks to bypass fine-pruning, maintaining high ASR.
• Dynamic Triggers: By tuning the α parameter to 0.9, dynamic triggers could bypass fine-pruning for DVS128-Gesture and N-MNIST, maintaining both high clean accuracy and ASR.
• Layer Exclusion: An attacker could also bypass fine-pruning by excluding the last convolutional layer from pruning during training. For DVS128-Gesture, freezing the last convolutional layer during training with a static trigger resulted in 90% clean accuracy and 89% ASR after fine-pruning (compared to 79% ASR before). CIFAR10-DVS showed similar behavior, maintaining 100% ASR.

In summary, existing DNN defenses, even when adapted, proved largely ineffective against the SNN backdoor attacks, particularly the highly stealthy dynamic ones. This highlights a critical need for SNN-specific defense mechanisms tailored to their unique architectural and data characteristics.

Key Takeaways

• SNNs are highly vulnerable to backdoor attacks: The research successfully demonstrated various backdoor attack methods (static, moving, smart, and dynamic) on SNNs, achieving up to 100% attack success rates with negligible clean accuracy degradation.
• Dynamic triggers offer unprecedented stealth: A novel dynamic trigger, utilizing a spiking autoencoder, proved exceptionally stealthy, achieving up to 99.9% SSIM and being virtually undetectable by human inspection at optimal parameters (γ=0.01).
• Existing DNN defenses are largely ineffective for SNNs: State-of-the-art backdoor defenses from the image domain (ABS, STRIP, Spectral Signatures, Fine-pruning) failed to adequately mitigate SNN backdoor attacks due to SNNs' unique architectures (e.g., lack of activation functions) and the distinct nature of neuromorphic data.
• Adaptive attackers can bypass defenses: Even the most promising defense, fine-pruning, could be bypassed by adaptive attackers employing strategies such as low poisoning rates or strategically freezing convolutional layers during training.
• Urgent need for SNN-specific security: The findings underscore a critical and urgent need for dedicated research into SNN-specific defense mechanisms tailored to handle dynamic, multi-frame triggers and the limited polarity space of neuromorphic data.
• Future work includes physical attacks and broader threats: The study primarily focused on digital attacks, but future research should extend to physical-world attacks and other common threats like inference attacks and adversarial examples to ensure comprehensive SNN security.

About the Speaker(s)

Gorka Abad is the speaker who presented this research titled "Sneaky Spikes: Uncovering Stealthy Backdoor Attacks in Spiking Neural Networks with Neuromorphic Data" at the NDSS Symposium. Further details regarding Gorka Abad's specific title or organizational affiliation were not provided in the transcript or metadata bundle.