Hardware-Aware Model Inversion in Memristive Spiking Neural Networks

Pablo Sorrentino; Fernando M. Quintana; Erika Covi; Fatih Turkmen

cs.CROct 29, 2026

Hardware-Aware Model Inversion in Memristive Spiking Neural Networks

Authors: Pablo Sorrentino, Fernando M. Quintana, Erika Covi, Fatih Turkmen

Organizations: University of Groningen Groningen, The Netherlands · Technical University of Munich Munich, Germany

Abstract

Hardware-accelerated spiking neural networks (SNNs) implemented on memristive crossbar arrays offer significant gains in energy efficiency, while device variability and analog noise are sometimes assumed to hinder information extraction. However, whether these hardware effects improve, preserve, or degrade privacy after deployment remains largely unexplored. Therefore, we ask whether model-inversion leakage characterized on an SNN remains representative after the same model is mapped to a non-ideal memristive substrate, and how hardware non-idealities and reliability faults affecting synapses, neuron thresholds, and spike processing reshape that leakage. To study this problem, we introduce Spiking Domain Model Inversion (SDMI), an inversion method that combines Expectation over Transformation (EOT) with surrogate gradients to optimize inputs through stochastic analog behavior and non-differentiable spiking dynamics. We use SDMI consistently across the SNN model, its memristive SNN, and the same memristive SNN under additional hardware perturbations. Across four datasets, reconstruction leakage does not vary monotonically with model accuracy or hardware variability. At comparable accuracy levels, neuron-threshold perturbations increase reconstruction fidelity, measured by SSIM, by up to 51.8%, whereas spike-level perturbations primarily degrade utility without consistently improving reconstruction. Weight noise, in contrast, reduces leakage under the same inversion procedure. These results show that hardware variability is not inherently privacy-preserving: model inversion leakage in memristive SNNs depends on the hardware state and cannot be inferred from model accuracy alone.

Figures & tables

Figure 1. Overview of model inversion in memristive SNNs. Hardware non-idealities and reliability faults can alter the effective hardware state and observable model behavior, potentially affecting both predictive utility and model-inversion leakage. Model inversion iteratively optimizes a candidate input based on model responses.

Figure 2. Hierarchical overview of representative system parameters across three levels: memristor array (IR-drop and peripheral circuitry), device (conductance variability, drift, and noise), and SNN model (neural dynamics and temporal encoding).

Prior Work	Target System	Privacy Analysis	Reliability	Temporal SNN	Hardware	Privacy and HW
ANN MI/MIA ( Fredrikson et al., 2015 ; Shokri et al., 2017 )	ANN	Yes	No	No	No	No
Non-ideality-aware ML ( Lammie et al., 2025 ; Joksas et al., 2025 )	ANN	No	Yes	No	Yes	No
DNN fault injection ( He et al., 2020 ; Hong et al., 2019 )	ANN/DNN	No	Yes	No	Yes	No
FIA/SCA on CIM ( Sapui and Tahoori, 2024 ; Wang et al., 2024a )	ANN/CIM	No	Yes	No	Yes	No
SNN security ( Abad et al., 2023 ; Yadav et al., 2024 )	SNN	No	No	Yes	No	No
SNN privacy ( Moshruba et al., 2025 ; Poursiami et al., 2025 )	SNN	Yes	No	Yes	No	No

Table 1. Comparison with prior work on privacy attacks, hardware perturbations, and neuromorphic security.

Component	Configuration
Network	Compact feedforward CSNN with convolutional layers and a linear readout
Neuron Model	Leaky Integrate-and-Fire (LIF), time-stepped inference with $T=25$ for MNIST
Weight Mapping	Differential ReRAM conductance pairs, $1$ – $1000~\mu\mathrm{S}$
Device	Analog resistive memory with $\sigma_{D2D}=0.1$ , C2C noise $=0.05$ , and drift $\nu=0.005$
Interface	8-bit ADC/DAC
Input Encoding	Poisson rate encoding for static inputs

Table 2. Memristive SNN architecture and evaluated hardware configuration.

Figure 3. Hardware non-idealities and reliability faults evaluated at synaptic, neuron, and spike levels. Controlled sensitivity sweeps do not imply equivalent physical controllability by an adversary.

Level	Type	Effect
Synaptic	Drift	Gradual weight change
Synaptic	Bit flip	Discrete weight error
Synaptic	Weight noise	Induced error in weights
Neuron	Threshold offset	Static threshold shift
Neuron	Threshold noise	Stochastic threshold shift
Spike	Deletion	Missing spike events

Table 3. Hardware non-idealities and reliability faults considered in the sensitivity analysis.

Figure 4. Overview of SDMI. A candidate input is converted to its spiking representation and evaluated by the selected SNN model. EOT averages over stochastic spike and hardware samples, while surrogate gradients and the straight-through estimator propagate the inversion objective through the non-differentiable spiking dynamics. The same optimization procedure is applied to the software SNN, the corresponding memristive SNN, and the memristive SNN under additional hardware perturbations.

Figure 5. Representative SDMI reconstructions for target class 0 under the memristive baseline and selected hardware perturbations. Synaptic and neuron-threshold perturbations produce distinct changes in reconstruction structure relative to the memristive baseline.

Figure 6. Dataset-level comparison of SDMI reconstruction similarity (SSIM) across the evaluated memristive settings. For each dataset, we report the memristive baseline and representative minimum and maximum SSIM values across the evaluated perturbations.

Level	Condition	Acc. (%)	$\Delta$ Acc. (pp)	SSIM	$\Delta$ SSIM (%)
System	Memristive	95.9	0.0	$0.328\pm 0.001$	0.0
Synaptic	Drift	95.6	-0.3	$0.351\pm 0.002$	+7.0
Synaptic	Bit error	73.0	-22.9	$0.406\pm 0.003$	+23.8
Synaptic	Weight noise	78.9	-17.0	$0.211\pm 0.004$	-35.7
Neuron	Threshold shift	70.2	-25.7	$0.498\pm 0.004$	+51.8
Neuron	Threshold noise	81.5	-14.4	$0.441\pm 0.004$	+34.5

Table 4. Impact of reliability on utility and SDMI reconstruction similarity. Accuracy changes (

\Delta

Acc.) are reported in percentage points (pp), and

\Delta

SSIM denotes the relative percentage change with respect to the memristive baseline.

Figure 7. Relationship between classification accuracy and SDMI reconstruction fidelity under the evaluated hardware perturbations: (a) absolute accuracy versus SSIM and (b) relative changes with respect to the memristive baseline. Comparable utility degradation can correspond to substantially different reconstruction behavior; marker size reflects the target confidence.

Configuration	SSIM	PSNR (dB)	Confidence	Time (s)
Full SDMI	$0.3231\pm 0.0012$	$12.5091\pm 0.0148$	$0.9995\pm 0.0000$	456.26
No EOT ( $K=1$ )	$0.2959\pm 0.0103$	$12.9002\pm 0.0661$	$0.9978\pm 0.0003$	38.90
No TV	$0.4014\pm 0.0703$	$12.4505\pm 0.0524$	$0.9996\pm 0.0000$	455.17
No Sparsity	$0.3221\pm 0.0015$	$12.4872\pm 0.0242$	$0.9995\pm 0.0000$	455.90

Table 5. Ablation study of SDMI components.

$K$	SSIM	Confidence	Time (s)
1	$0.2989\pm 0.0051$	$0.9978\pm 0.0002$	39.05
4	$0.3130\pm 0.0035$	$0.9993\pm 0.0001$	152.27
8	$0.3192\pm 0.0026$	$0.9995\pm 0.0001$	304.53
12	$0.3223\pm 0.0018$	$0.9995\pm 0.0001$	455.15
20	$0.3259\pm 0.0019$	$0.9996\pm 0.0001$	758.36

Table 6. Sensitivity of SDMI to the number of EOT samples

K

Appendix figures & tables6 assets

Supplementary material from the paper’s appendix.

Appendix

Item	Setting
Datasets	MNIST, Fashion-MNIST, AT&T Faces, DVS128 Gesture
Encoding	Poisson (static), event-based (DVS)
Temporal window	$T=25$ (static), $T=50$ (DVS)
Training	Surrogate-gradient learning
Evaluation	Software, memristive, and reliability-fault conditions
Perturbations	Synaptic, neuron, and spike levels

Appendix

Table 7. Overview of the experimental evaluation protocol.

Dataset	Configuration
MNIST	10 classes; Poisson; $T=25$ . Conv(1,16, $5{\times}5$ )–LIF–AvgPool; Conv(16,32, $5{\times}5$ )–LIF–AvgPool; FC(10).
Fashion-MNIST	10 classes; Poisson; $T=25$ . Conv(1,16, $5{\times}5$ )–LIF–AvgPool; Conv(16,32, $5{\times}5$ )–LIF–AvgPool; FC(10).
AT&T Faces	40 classes; Poisson; $T=25$ . Conv(1,32, $5{\times}5$ )–LIF–AvgPool; Conv(32,64, $5{\times}5$ )–LIF–AvgPool; Conv(64,128, $3{\times}3$ )–LIF–AvgPool; FC(40).
DVS128 Gesture	11 classes; event-based; $T=50$ . Conv(2,32, $5{\times}5$ )–LIF–AvgPool; Conv(32,64, $5{\times}5$ )–LIF–AvgPool; FC(11).

Appendix

Table 8. Dataset-specific SNN configurations used in the evaluation.

Category	Parameter and Value
SNN (LIF)	LIF parameters: dataset/layer-specific
	Reset potential ( $V_{\mathrm{reset}}$ ): 0.0
	Time steps ( $T$ ): dataset-specific ( $T=25,50$ )
IBM AIHWKIT	Device: ReRAM
	Conductance range ( $G$ ): $[1,1000]~\mu\mathrm{S}$
	D2D variability ( $\sigma_{\mathrm{D2D}}$ ): 0.1

Appendix

Table 9. Hyperparameters and hardware-aware configuration.

Parameter	Stage 1	Stage 2
Learning rate	0.01	0.003
Start iteration	0	250
Sparsity weight	0.5	8.0
FR excess weight	0.5	3.0
FR $\ell_{2}$ weight	0.5	6.0
TV weight	0.03	0.18

Appendix

Table 10. SDMI optimization stages and regularization schedule.

Condition	Parameter	Selected value
Weight drift	Multiplicative deviation $\delta$	$1$
Bit error	Bit position $b$	$6$
Weight noise	Std. dev. $\sigma_{w}$	$0.56$
Threshold shift	Threshold scale	$10$
Threshold noise	Std. dev. $\sigma_{th}$	$0.07$
Spike deletion	Probability $p_{\mathrm{del}}$	$0.75$

Appendix

Table 11. Representative perturbation settings used in the privacy analysis.

Figure 8. Accuracy sensitivity to perturbation magnitude for the evaluated hardware conditions. The sweeps characterize functional sensitivity and do not imply equivalent physical fault-injection precision.

Model Inversion Attacks

Model inversion attacks reconstruct private training data or sensitive attributes from a model’s outputs, parameters, gradients, or representations.

See all 22 papers

Characterizing Privacy Leakage in Spiking Neural Networks: A Systematic Analysis of Temporal Dynamics, Stochasticity, Neuronal Dynamics and Learning Mechanisms
Oct 26, 2026Ayana Moshruba, Maryam ParsaSpiking Neural Networks Spike-Based Signal Encoding
Electrical and Computer Engineering, George Mason University Fairfax, Virginia, USA
Efficient Memristive Spiking Neural Networks Architecture with Supervised In-Situ STDP Method
Jul 28, 2025Santlal Prajapati, Susmita Sur-Kolay, Soumyadeep DuttaEfficient Neural Network Inference Spiking Neural Networks
Advanced Computing and Microelectronics Unit, Indian Statistical Institute, Kolkata 700108, India · Balasore Alloys Limited, Balgopalpur, Odisha 756020, India
Driving up Inference Energy on SNNs: Per-Sample and Universal Sponge Attacks
Jul 30, 2026Spyridon Raptis, Haralampos-G. StratigopoulosAdversarial Attacks Spiking Neural Networks
Sorbonne Universit´e, CNRS, LIP6, Paris, France

Oct 26, 2026J/K move · Enter open · S save

Characterizing Privacy Leakage in Spiking Neural Networks: A Systematic Analysis of Temporal Dynamics, Stochasticity, Neuronal Dynamics and Learning Mechanisms

Ayana Moshruba, Maryam Parsa

Electrical and Computer Engineering, George Mason University Fairfax, Virginia, USA

Spiking Neural Networks Spike-Based Signal Encoding

Open paper AskPDF arXiv

Spiking neural networks (SNNs) encode information not only in whether neurons fire but also in when they fire, and this temporal dimension shapes what a trained network reveals about its training data. Biologically inspired firing patterns can reduce membership leakage in SNNs without changing the network architecture, which positions temporal dynamics as a design variable for privacy. A change in firing behavior, however, alters stochasticity, spike timing, neuronal response, and the learning problem at once, so harnessing this effect requires identifying which of these properties produces it. This study traces that origin by separating temporal representation, stochasticity, intrinsic neuron dynamics, and learning within a common experimental framework, evaluated under a black-box membership inference attack across image and tabular benchmarks. Varying the temporal representation shows that burst-like firing patterns reduce leakage relative to regular spiking, but at a cost in accuracy. Injecting randomness into the input, spike timing, and spike trains does not reproduce this reduction in leakage, which shows that the reduction arises from how spikes are arranged in time rather than from noise. The privacy benefit further depends on where these firing patterns originate. When neurons generate these patterns through their own adaptive dynamics, leakage falls while accuracy is preserved, so privacy no longer comes at the expense of performance. The learning algorithm then sets the baseline leakage. Under evolutionary training, the attack already performs near chance level, leaving temporal dynamics little room to improve privacy further. Privacy in SNNs is therefore not an inherent property of spikes but a product of how temporal activity is generated, processed, and learned, which offers a principled basis for designing neuromorphic systems that protect sensitive data.

Abstract

Model Inversion Attacks

Explore similar work

Characterizing Privacy Leakage in Spiking Neural Networks: A Systematic Analysis of Temporal Dynamics, Stochasticity, Neuronal Dynamics and Learning Mechanisms

Efficient Memristive Spiking Neural Networks Architecture with Supervised In-Situ STDP Method

Driving up Inference Energy on SNNs: Per-Sample and Universal Sponge Attacks