cs.NEOct 26, 2026

Characterizing Privacy Leakage in Spiking Neural Networks: A Systematic Analysis of Temporal Dynamics, Stochasticity, Neuronal Dynamics and Learning Mechanisms

Authors: Ayana Moshruba, Maryam Parsa

Organizations: Electrical and Computer Engineering, George Mason University Fairfax, Virginia, USA

Read PDF
Ask AI
Cite

Copy citation

DOINot available for this paper

Abstract

Spiking neural networks (SNNs) encode information not only in whether neurons fire but also in when they fire, and this temporal dimension shapes what a trained network reveals about its training data. Biologically inspired firing patterns can reduce membership leakage in SNNs without changing the network architecture, which positions temporal dynamics as a design variable for privacy. A change in firing behavior, however, alters stochasticity, spike timing, neuronal response, and the learning problem at once, so harnessing this effect requires identifying which of these properties produces it. This study traces that origin by separating temporal representation, stochasticity, intrinsic neuron dynamics, and learning within a common experimental framework, evaluated under a black-box membership inference attack across image and tabular benchmarks. Varying the temporal representation shows that burst-like firing patterns reduce leakage relative to regular spiking, but at a cost in accuracy. Injecting randomness into the input, spike timing, and spike trains does not reproduce this reduction in leakage, which shows that the reduction arises from how spikes are arranged in time rather than from noise. The privacy benefit further depends on where these firing patterns originate. When neurons generate these patterns through their own adaptive dynamics, leakage falls while accuracy is preserved, so privacy no longer comes at the expense of performance. The learning algorithm then sets the baseline leakage. Under evolutionary training, the attack already performs near chance level, leaving temporal dynamics little room to improve privacy further. Privacy in SNNs is therefore not an inherent property of spikes but a product of how temporal activity is generated, processed, and learned, which offers a principled basis for designing neuromorphic systems that protect sensitive data.

Figures & tables

Figure 1: Illustration of the three temporal dynamics schemes used in this study. Three image regions with high, intermediate, and low normalized input intensity are shown from top to bottom. Rate dynamics represents input magnitude through spike frequency, such that stronger inputs generate denser spike trains. Poisson-Burst dynamics generates stochastic bursts at discrete temporal intervals, where stronger inputs increase the probability of burst occurrence and the number of spikes within each triggered burst is sampled from a Poisson distribution. Delayed-Burst dynamics represents input magnitude primarily through burst latency, where stronger inputs produce earlier burst onset and weaker inputs produce later responses. Each Delayed-Burst event contains a fixed number of spikes with a fixed inter-spike interval.
Figure 2: MIA framework using three shadow models. Three shadow models with the same architecture are independently trained using separate shadow train/test splits. For each shadow model, representations obtained from its training samples are labeled as members ( IN ), while representations obtained from its held-out test samples are labeled as non-members ( OUT ). The outputs from all three shadow models are pooled to construct a larger attack training set. The target model is queried in the same manner to construct the attack test set, and the trained attack model predicts whether each target sample belongs to the target model’s training set.
Figure 3: (a) Utility and (b) Privacy under homogeneous temporal dynamics. Bars show the three-run mean, and shaded regions indicate ±1\pm 1 standard deviation.
Figure 4: Classification performance under homogeneous Rate dynamics and heterogeneous input-level temporal configurations across MNIST, F-MNIST, Iris, and Breast Cancer. Configuration labels indicate the fraction of input dimensions assigned to each temporal dynamic. For example, 90R/10PB denotes 90% Rate and 10% Poisson-Burst dynamics, while 80R/10PB/10DB denotes 80% Rate, 10% Poisson-Burst, and 10% Delayed-Burst dynamics.
Figure 5: Membership-inference vulnerability under homogeneous Rate dynamics and heterogeneous input-level temporal configurations across MNIST, F-MNIST, Iris, and Breast Cancer.
Figure 6: Illustration of temporal jitter applied to Rate, Poisson-Burst, and Delayed-Burst spike trains. Selected spikes are shifted by one timestep ( ±1\pm 1 ), while the overall spike pattern and spike count are preserved.
Figure 7: Classification utility under increasing temporal jitter for Rate, Poisson-Burst, and Delayed-Burst dynamics.
Figure 8: Membership-inference vulnerability under increasing temporal jitter for Rate, Poisson-Burst, and Delayed-Burst dynamics.
Figure 9: Classification utility under increasing input noise for Rate, Poisson-Burst, and Delayed-Burst dynamics on MNIST, F-MNIST, and Breast Cancer.
Figure 10: Membership-inference vulnerability under increasing input noise for Rate, Poisson-Burst, and Delayed-Burst dynamics on MNIST, F-MNIST, and Breast Cancer.
Figure 11: Classification utility under increasing spike noise for Rate, Poisson-Burst, and Delayed-Burst dynamics on MNIST, F-MNIST, and Breast Cancer.
Figure 12: Membership-inference vulnerability under increasing spike noise for Rate, Poisson-Burst, and Delayed-Burst dynamics on MNIST, F-MNIST, and Breast Cancer.
Figure 13: Representative AdEx spike rasters for the Burst and Delayed-Burst configurations. The Burst setting produces temporally clustered spike activity, whereas the Delayed-Burst setting shifts concentrated firing to later time steps and results in sparser activation.
Figure 14: Classification utility of LIF and AdEx neurons under Rate, Burst, and Delayed-Burst temporal dynamics on (a) MNIST, (b) F-MNIST, (c) CIFAR-10, (d) Iris, and (e) Breast Cancer.
Figure 15: Membership-inference vulnerability (MIA AUC) of LIF and AdEx neurons under Rate, Burst, and Delayed-Burst temporal dynamics on (a) MNIST, (b) F-MNIST, (c) CIFAR-10, (d) Iris, and (e) Breast Cancer. Lower values indicate reduced leakage.
Figure 16: Classification utility of SNNs trained with evolutionary learning and backpropagation under Rate, Poisson-Burst, and Delayed-Burst temporal dynamics on (a) Iris and (b) Breast Cancer.
Figure 17: Membership-inference vulnerability of SNNs trained with evolutionary learning and backpropagation under Rate, Poisson-Burst, and Delayed-Burst temporal dynamics on (a) Iris and (b) Breast Cancer.
Figure 18: Classification performance of Rate, Poisson-Burst, and Delayed-Burst temporal dynamics under increasing DPSGD privacy budgets on (a) MNIST and (b) F-MNIST. Solid lines show test accuracy as ϵ\epsilon increases, while dashed lines indicate the corresponding non-private baseline accuracy for each temporal dynamic.
More in this topic

Spiking Neural Networks

Spiking neural networks process information through discrete, time-dependent neural events, aiming for efficient computation and biologically inspired learning.

See all 358 papers

Explore similar work

CardsList
Oct 29, 2026

Hardware-Aware Model Inversion in Memristive Spiking Neural Networks

Hardware-accelerated spiking neural networks (SNNs) implemented on memristive crossbar arrays offer significant gains in energy efficiency, while device variability and analog noise are sometimes assumed to hinder information extraction. However, whether these hardware effects improve, preserve, or degrade privacy after deployment remains largely unexplored. Therefore, we ask whether model-inversion leakage characterized on an SNN remains representative after the same model is mapped to a non-ideal memristive substrate, and how hardware non-idealities and reliability faults affecting synapses, neuron thresholds, and spike processing reshape that leakage. To study this problem, we introduce Spiking Domain Model Inversion (SDMI), an inversion method that combines Expectation over Transformation (EOT) with surrogate gradients to optimize inputs through stochastic analog behavior and non-differentiable spiking dynamics. We use SDMI consistently across the SNN model, its memristive SNN, and the same memristive SNN under additional hardware perturbations. Across four datasets, reconstruction leakage does not vary monotonically with model accuracy or hardware variability. At comparable accuracy levels, neuron-threshold perturbations increase reconstruction fidelity, measured by SSIM, by up to 51.8%, whereas spike-level perturbations primarily degrade utility without consistently improving reconstruction. Weight noise, in contrast, reduces leakage under the same inversion procedure. These results show that hardware variability is not inherently privacy-preserving: model inversion leakage in memristive SNNs depends on the hardware state and cannot be inferred from model accuracy alone.

Pablo Sorrentino, Fernando M. Quintana, Erika Covi +1

University of Groningen Groningen, The Netherlands · Technical University of Munich Munich, Germany

Model Inversion AttacksSpiking Neural NetworksNeuromorphic ComputingNeural Network Hardware Acceleration
AskPDF
Jul 16, 2026

Scalable Training of Continuous-Time Spiking Neural Networks with Differentiable Spike-Time Discretization

Continuous-time spiking neural networks (SNNs) provide an event-driven framework for temporal computation, computational neuroscience, and neuromorphic hardware. However, training deep continuous-time SNNs is severely constrained by the memory required for exact spike-time computation, which evaluates and retains candidate firing times over intervals determined by presynaptic spike ordering. Here we introduce a memory-efficient training framework based on differentiable spike-time discretization (DSTD) for leaky integrate-and-fire neurons with general membrane and synaptic time constants. DSTD maps irregular presynaptic spikes onto differentiable weighted events at fixed time points, replacing the input-dependent candidate dimension with MM fixed time intervals while accurately approximating continuous-time membrane-potential dynamics. This reduces candidate-related activation memory from O(NoutNin)O(N_{\mathrm{out}}N_{\mathrm{in}}) to O(NoutM)O(N_{\mathrm{out}}M) in the case of time-to-first-spike (TTFS) coding, where NinN_{\mathrm{in}} and NoutN_{\mathrm{out}} denote the numbers of presynaptic and postsynaptic neurons, respectively. We further introduce synfire-chain-inspired temporal regularization that organizes layer-wise firing windows, mitigates dead-neuron failures, and enables pipeline-like processing. In dense LIF layers, DSTD reduced peak memory consumption by up to approximately 100-fold and training time by up to approximately 20-fold compared with exact spike-time computation. Together, these methods allowed us to train 9-layer convolutional SNNs on CIFAR-10 and 20-layer convolutional SNNs on Fashion-MNIST on a single GPU.

Yusuke Sakemi, Tomoya Takeuchi, Takeo Hosomi +1

Research Center for Mathematical Engineering, Chiba Institute of Technology, Narashino, Japan · International Research Center for Neurointelligence (WPI-IRCN), The University of Tokyo, Tokyo, Japan · NEC Corporation, Kawasaki, Japan

Spiking Neural NetworksLIF Neurons
AskPDF
Oct 26, 2026

Spiking Neural Networks Are Harder to Steal: A Benchmark Study of Model Stealing Attacks

Machine learning models deployed behind query interfaces expose more than their predictions, because an adversary can use those predictions to rebuild the model itself. Model stealing attacks (MSAs) exploit this exposure by training a surrogate model that replicates the decision behavior of a target through black-box queries alone, without access to its parameters or training data. These attacks are well characterized for conventional artificial neural networks (ANNs), yet spiking neural networks (SNNs) process information in a fundamentally different way. SNNs communicate through sparse, discrete spikes, and their outputs depend on membrane potentials that evolve over time rather than on a static mapping from input to output. This temporal mode of computation suggests that the decision behavior of an SNN may be harder to reconstruct from its responses. This work tests that possibility by benchmarking four representative MSAs, namely the Papernot, Tramèr, T-RND, and color perturbation attacks, against SNNs and their ANN counterparts on MNIST, Fashion-MNIST, and CIFAR-10. Across every attack and dataset, SNNs prove consistently more difficult to steal. Surrogates of SNNs achieve 10% to 20% lower agreement with the target model and 15% to 25% lower adversarial transferability than surrogates of ANNs. We attribute this resistance to the way SNNs compute, as their spike-based and time-dependent dynamics yield decision boundaries that ANN-based surrogates struggle to approximate, even under large query budgets. These findings extend the known resilience of SNNs beyond attacks on training data to the replication of model functionality, strengthening the case for neuromorphic architectures in security-sensitive applications.

Ayana Moshruba, Maryam Parsa

George Mason University, Fairfax, Virginia, USA

Model Extraction AttacksSpiking Neural Networks
AskPDF