Spiking Neural Networks Are Harder to Steal: A Benchmark Study of Model Stealing Attacks

Ayana Moshruba; Maryam Parsa

cs.AIOct 26, 2026

Spiking Neural Networks Are Harder to Steal: A Benchmark Study of Model Stealing Attacks

Authors: Ayana Moshruba, Maryam Parsa

Organizations: George Mason University, Fairfax, Virginia, USA

Abstract

Machine learning models deployed behind query interfaces expose more than their predictions, because an adversary can use those predictions to rebuild the model itself. Model stealing attacks (MSAs) exploit this exposure by training a surrogate model that replicates the decision behavior of a target through black-box queries alone, without access to its parameters or training data. These attacks are well characterized for conventional artificial neural networks (ANNs), yet spiking neural networks (SNNs) process information in a fundamentally different way. SNNs communicate through sparse, discrete spikes, and their outputs depend on membrane potentials that evolve over time rather than on a static mapping from input to output. This temporal mode of computation suggests that the decision behavior of an SNN may be harder to reconstruct from its responses. This work tests that possibility by benchmarking four representative MSAs, namely the Papernot, Tramèr, T-RND, and color perturbation attacks, against SNNs and their ANN counterparts on MNIST, Fashion-MNIST, and CIFAR-10. Across every attack and dataset, SNNs prove consistently more difficult to steal. Surrogates of SNNs achieve 10% to 20% lower agreement with the target model and 15% to 25% lower adversarial transferability than surrogates of ANNs. We attribute this resistance to the way SNNs compute, as their spike-based and time-dependent dynamics yield decision boundaries that ANN-based surrogates struggle to approximate, even under large query budgets. These findings extend the known resilience of SNNs beyond attacks on training data to the replication of model functionality, strengthening the case for neuromorphic architectures in security-sensitive applications.

Figures & tables

Figure 1. Training of the substitute model

F

. The attacker first collects an initial input set

S_{0}

and selects a substitute architecture

F

. At each iteration

\rho

, the attacker queries the oracle model

O

S_{\rho}

to obtain labeled data

D_{\rho}=\{(x,O(x))\mid x\in S_{\rho}\}

, which is used to train the substitute model. Synthetic samples are generated via gradient-based augmentation,

x^{\prime}=x+\lambda\cdot\mathrm{sign}(\nabla_{x}\mathcal{L}(F(x),O(x)))

, and added to the input set to form

S_{\rho+1}=S_{\rho}\cup\{x^{\prime}\mid x\in S_{\rho}\}

. This process is repeated iteratively.

Figure 2. Overview of the Tramèr model extraction procedure. The attacker first constructs an initial labeled dataset $D_{0}$ by querying the oracle model $O$ . A substitute model $F_{\rho}$ is trained on the current dataset $D_{\rho}$ . Synthetic samples are then generated near the decision boundary using an iterative fast gradient sign method, $x^{\prime}=\mathrm{IFGSM}(x,y;\epsilon,T)$ , and labeled via oracle queries. The dataset is updated as $D_{\rho+1}=D_{\rho}\cup\{(x^{\prime},O(x^{\prime}))\}$ , and the process is repeated for successive iterations $\rho$ until the query budget is exhausted.

Figure 3. Color perturbation examples on an FMNIST sample. The transformations preserve semantic structure while modifying input statistics for query generation.

Layer	MNIST / FMNIST	CIFAR10
Input Channels	1	3
Conv Layer 1 + ReLU	32, $3\times 3$	32, $3\times 3$
MaxPool	$2\times 2$	$2\times 2$
Conv Layer 2 + ReLU	64, $3\times 3$	64, $3\times 3$
MaxPool	$2\times 2$	$2\times 2$
Flattened Features	$64\times 7\times 7$	$64\times 8\times 8$

Table 1. ANN Architectures

Layer	MNIST / FMNIST	CIFAR10
Input Channels	1	3
Conv Layer 1 + LIF	32, $3\times 3$	32, $3\times 3$
MaxPool	$2\times 2$	$2\times 2$
Conv Layer 2 + LIF	64, $3\times 3$	64, $3\times 3$
MaxPool	$2\times 2$	$2\times 2$
Flattened Features	$64\times 7\times 7$	$64\times 8\times 8$

Table 2. SNN Architectures

Panel of Figure 4 — Figure 4. Fidelity of model extraction under MSA. Test agreement evaluates in-distribution fidelity, while random uniform agreement assesses global decision alignment.

Panel of Figure 5 — Figure 5. Adversarial transferability under MSA. Non-targeted transfer evaluates general vulnerability alignment, while targeted transfer assesses the ability to induce specific misclassifications.

Figure 6. Query efficiency on FMNIST for Papernot and Tramer attacks. ANN targets achieve high accuracy with fewer queries, while SNN targets require larger budgets and still exhibit lower performance.

Figure 7. Effect of target and substitute architectures on test agreement and non-targeted transferability on MNIST.

Model Extraction Attacks

Model extraction attacks infer a machine-learning model’s behavior, architecture, parameters, or hidden assets from queries and system leakage.

See all 50 papers

Driving up Inference Energy on SNNs: Per-Sample and Universal Sponge Attacks
Jul 30, 2026Spyridon Raptis, Haralampos-G. StratigopoulosAdversarial Attacks Spiking Neural Networks
Sorbonne Universit´e, CNRS, LIP6, Paris, France
Robust Spiking Neural Networks Against Adversarial Attacks
Feb 24, 2026Shuai Wang, Malu Zhang, Yulin Jiang +7Adversarial Robustness Spiking Neural Networks
University of Electronic Science and Technology of China · Shenzhen Loop Area Institute · Northumbria University +1
Temporal Poisoning: Clean-Label Backdoors via Event Redistribution in SNNs
Jul 30, 2026Roberto Riaño, Gorka Abad, Stjepan Picek +1Backdoor Attacks Backdoor Detection
Radboud University, The Netherlands · Ikerlan Research Centre, Spain · University of Bergen, Norway +1

Jul 30, 2026J/K move · Enter open · S save

Driving up Inference Energy on SNNs: Per-Sample and Universal Sponge Attacks

Spyridon Raptis, Haralampos-G. Stratigopoulos

Sorbonne Universit´e, CNRS, LIP6, Paris, France

Adversarial Attacks Spiking Neural Networks Neuromorphic Computing Adversarial Perturbations

Open paper AskPDF arXiv

Spiking Neural Networks (SNNs) communicate through sparse binary spike events rather than dense activations, enabling energy-efficient inference on neuromorphic hardware and motivating their use in always-on, battery-powered edge systems. We show that this same efficiency advantage creates a distinct security risk: sponge attacks can increase inference-time spike activity and synaptic workload, inflating energy consumption while remaining difficult to detect through correctness-based monitoring alone. Prior input-space efficiency attacks on SNNs have focused on per-sample optimization, primarily in rate-coded settings. We extend this threat to native event-based binary inputs and study two attack models. First, we develop a per-sample sponge attack that crafts a custom adversarial spike train for each input via gradient-based optimization. This attack increases per-inference SynOps by 1.5-2.6x on three SNN models for the NMNIST, SHD, and IBM DVS Gesture datasets, while preserving the predicted class on at least 98% of evaluated samples. Second, to the best of our knowledge, we introduce the first universal sponge attack for native event-based SNN inputs: a fixed binary perturbation computed offline and applied via XOR to all subsequent inputs. Although weaker, it still inflates SynOps by 1.09-1.24x across all three datasets and represents a more realistic deployment threat because it requires no per-input optimization. Mapping SynOp inflation to estimated Loihi-1 energy yields per-inference overheads from 14

μ

J to 13.24 mJ. These results show that native event-based SNNs are vulnerable to practical input-space efficiency attacks, and that reusable universal perturbations can accumulate into meaningful battery drain in continuously deployed edge systems.

Abstract

Model Extraction Attacks

Explore similar work

Driving up Inference Energy on SNNs: Per-Sample and Universal Sponge Attacks

Robust Spiking Neural Networks Against Adversarial Attacks

Temporal Poisoning: Clean-Label Backdoors via Event Redistribution in SNNs