Machine learning models deployed behind query interfaces expose more than their predictions, because an adversary can use those predictions to rebuild the model itself. Model stealing attacks (MSAs) exploit this exposure by training a surrogate model that replicates the decision behavior of a target through black-box queries alone, without access to its parameters or training data. These attacks are well characterized for conventional artificial neural networks (ANNs), yet spiking neural networks (SNNs) process information in a fundamentally different way. SNNs communicate through sparse, discrete spikes, and their outputs depend on membrane potentials that evolve over time rather than on a static mapping from input to output. This temporal mode of computation suggests that the decision behavior of an SNN may be harder to reconstruct from its responses. This work tests that possibility by benchmarking four representative MSAs, namely the Papernot, Tramèr, T-RND, and color perturbation attacks, against SNNs and their ANN counterparts on MNIST, Fashion-MNIST, and CIFAR-10. Across every attack and dataset, SNNs prove consistently more difficult to steal. Surrogates of SNNs achieve 10% to 20% lower agreement with the target model and 15% to 25% lower adversarial transferability than surrogates of ANNs. We attribute this resistance to the way SNNs compute, as their spike-based and time-dependent dynamics yield decision boundaries that ANN-based surrogates struggle to approximate, even under large query budgets. These findings extend the known resilience of SNNs beyond attacks on training data to the replication of model functionality, strengthening the case for neuromorphic architectures in security-sensitive applications.
Figures & tables
Figure 1. Training of the substitute model F . The attacker first collects an initial input set S0 and selects a substitute architecture F . At each iteration ρ , the attacker queries the oracle model O on Sρ to obtain labeled data Dρ={(x,O(x))∣x∈Sρ} , which is used to train the substitute model. Synthetic samples are generated via gradient-based augmentation, x′=x+λ⋅sign(∇xL(F(x),O(x))) , and added to the input set to form Sρ+1=Sρ∪{x′∣x∈Sρ} . This process is repeated iteratively.
Figure 2. Overview of the Tramèr model extraction procedure. The attacker first constructs an initial labeled dataset D0 by querying the oracle model O . A substitute model Fρ is trained on the current dataset Dρ . Synthetic samples are then generated near the decision boundary using an iterative fast gradient sign method, x′=IFGSM(x,y;ϵ,T) , and labeled via oracle queries. The dataset is updated as Dρ+1=Dρ∪{(x′,O(x′))} , and the process is repeated for successive iterations ρ until the query budget is exhausted.
Figure 3. Color perturbation examples on an FMNIST sample. The transformations preserve semantic structure while modifying input statistics for query generation.
Layer
MNIST / FMNIST
CIFAR10
Input Channels
1
3
Conv Layer 1 + ReLU
32, 3×3
32, 3×3
MaxPool
2×2
2×2
Conv Layer 2 + ReLU
64, 3×3
64, 3×3
MaxPool
2×2
2×2
Flattened Features
64×7×7
64×8×8
Table 1. ANN Architectures
Layer
MNIST / FMNIST
CIFAR10
Input Channels
1
3
Conv Layer 1 + LIF
32, 3×3
32, 3×3
MaxPool
2×2
2×2
Conv Layer 2 + LIF
64, 3×3
64, 3×3
MaxPool
2×2
2×2
Flattened Features
64×7×7
64×8×8
Table 2. SNN Architectures
Figure 4. Fidelity of model extraction under MSA. Test agreement evaluates in-distribution fidelity, while random uniform agreement assesses global decision alignment.
Figure 5. Adversarial transferability under MSA. Non-targeted transfer evaluates general vulnerability alignment, while targeted transfer assesses the ability to induce specific misclassifications.
Figure 6. Query efficiency on FMNIST for Papernot and Tramer attacks. ANN targets achieve high accuracy with fewer queries, while SNN targets require larger budgets and still exhibit lower performance.
Figure 7. Effect of target and substitute architectures on test agreement and non-targeted transferability on MNIST.
Spiking Neural Networks (SNNs) communicate through sparse binary spike events rather than dense activations, enabling energy-efficient inference on neuromorphic hardware and motivating their use in always-on, battery-powered edge systems. We show that this same efficiency advantage creates a distinct security risk: sponge attacks can increase inference-time spike activity and synaptic workload, inflating energy consumption while remaining difficult to detect through correctness-based monitoring alone. Prior input-space efficiency attacks on SNNs have focused on per-sample optimization, primarily in rate-coded settings. We extend this threat to native event-based binary inputs and study two attack models. First, we develop a per-sample sponge attack that crafts a custom adversarial spike train for each input via gradient-based optimization. This attack increases per-inference SynOps by 1.5-2.6x on three SNN models for the NMNIST, SHD, and IBM DVS Gesture datasets, while preserving the predicted class on at least 98% of evaluated samples. Second, to the best of our knowledge, we introduce the first universal sponge attack for native event-based SNN inputs: a fixed binary perturbation computed offline and applied via XOR to all subsequent inputs. Although weaker, it still inflates SynOps by 1.09-1.24x across all three datasets and represents a more realistic deployment threat because it requires no per-input optimization. Mapping SynOp inflation to estimated Loihi-1 energy yields per-inference overheads from 14 μJ to 13.24 mJ. These results show that native event-based SNNs are vulnerable to practical input-space efficiency attacks, and that reusable universal perturbations can accumulate into meaningful battery drain in continuously deployed edge systems.
Spiking Neural Networks (SNNs) represent a promising paradigm for energy-efficient neuromorphic computing due to their bio-plausible and spike-driven characteristics. However, the robustness of SNNs in complex adversarial environments remains significantly constrained. In this study, we theoretically demonstrate that those threshold-neighboring spiking neurons are the key factors limiting the robustness of directly trained SNNs. We find that these neurons set the upper limits for the maximum potential strength of adversarial attacks and are prone to state-flipping under minor disturbances. To address this challenge, we propose a Threshold Guarding Optimization (TGO) method, which comprises two key aspects. First, we incorporate additional constraints into the loss function to move neurons' membrane potentials away from their thresholds. It increases SNNs' gradient sparsity, thereby reducing the theoretical upper bound of adversarial attacks. Second, we introduce noisy spiking neurons to transition the neuronal firing mechanism from deterministic to probabilistic, decreasing their state-flipping probability due to minor disturbances. Extensive experiments conducted in standard adversarial scenarios prove that our method significantly enhances the robustness of directly trained SNNs. These findings pave the way for advancing more reliable and secure neuromorphic computing in real-world applications.
Shuai Wang, Malu Zhang, Yulin Jiang +7
University of Electronic Science and Technology of China · Shenzhen Loop Area Institute · Northumbria University +1
Backdoor attacks on Spiking Neural Networks (SNNs) have primarily assumed dirty-label poisoning, in which triggered training samples are relabeled to an attacker-selected class. We study clean-label temporal poisoning, where a fixed timestamp transformation is applied only to the target-class training streams, leaving their labels unchanged. The transformation preserves the per-pixel, per-polarity event count exactly, making clean and triggered samples identical after temporal aggregation while altering the sequence processed by the SNN. Across three neuromorphic datasets and both convolutional and transformer-based victims, the attack reaches an ASR of 1.00 in the strongest configurations. We analyze the attack through poison-budget and trigger-shape ablations and evaluate established backdoor defenses adapted to spiking models. Defenses that collapse the time axis before inspection are blind by construction, while feature-space methods detect the poison only in selected settings. Our model-free detector, based on per-step event mass, detects the evaluated temporal transformations, demonstrating both the limitation of rate-collapsed defenses and the boundary of the attack's stealth. To our knowledge, this is the first clean-label backdoor attack evaluated on SNNs and neuromorphic event data.
Roberto Riaño, Gorka Abad, Stjepan Picek +1
Radboud University, The Netherlands · Ikerlan Research Centre, Spain · University of Bergen, Norway +1