Technical Summary: BadSNN – Backdoor Attacks on Spiking Neural Networks via Adversarial Spiking Neurons

Problem Statement

Spiking Neural Networks (SNNs) have established themselves as energy-efficient, biologically plausible alternatives to Deep Neural Networks (DNNs), particularly for edge devices and safety-critical applications such as autonomous driving and medical monitoring. While it is known that DNNs are vulnerable to backdoor attacks – where an attacker poisons training data to force specific misclassifications upon injected triggers – the vulnerabilities of SNNs remain largely unexplored.

Existing SNN backdoor attacks (e.g., Sneaky Spikes, Flashy Backdoor) rely primarily on manipulating neuromorphic data (event-based temporal streams) or injecting physical triggers (light flashes) that blend into the dynamics of natural scenes. These approaches focus on data manipulation rather than exploiting the inherent architectural properties of SNNs. Specifically, the unique behavior of spiking neurons, governed by hyperparameters such as the membrane potential threshold ($V_{thr}$) and the membrane time constant ($\tau$), has not yet been investigated as a vector for embedding backdoors. The central research question is: Can an attacker exploit the sensitivity of spiking neurons to hyperparameter variations to embed a backdoor without altering the input data?

Methodology: BadSNN

The authors propose BadSNN, a novel backdoor attack that embeds malicious behavior by fine-tuning the hyperparameters of spiking neurons during training, rather than poisoning the input dataset with triggers. The attack consists of three main phases:

1. Backdoor Training via Malicious Spike Poisoning

In contrast to conventional attacks that use mislabeled samples with triggers, BadSNN employs a Dual-Spike Learning Strategy:

• Hyperparameter Manipulation: The attacker manipulates the hyperparameters of the spiking neurons ($V_{thr}$ and $\tau$) during training. Two configurations are used:
  • Nominal ($S_n$): Standard hyperparameters for learning with clean data.
  • Malicious ($S_t$): Altered hyperparameters that cause the model to treat specific input transformations as out-of-distribution (OD) data.
• Training Objective: A portion of the target class data is trained with both $S_n$ and $S_t$. The model learns to associate the "malicious spike patterns" (generated by $S_t$) with the target label, while maintaining clean usability on nominal data.
• Key Insight: The attack relies on the observation that varying $V_{thr}$ can shift the spike count ($N_{spike}$) of inputs. If the model is biased to classify inputs with an increased spike count as the target label, a backdoor is established without altering the raw training pixels.

2. Trigger Optimization

To activate the backdoor during inference, the attacker must generate inputs that trigger the "malicious spike" behavior.

• Initial Trigger: A nonlinear power transformation ($x^q$) is used to increase the spike count, but this often degrades semantic information and is perceptible.
• Optimization: A trigger surrogate model (based on U-Net) is trained to generate minimally perceptible perturbations ($\Delta x$).
• Loss Function: The surrogate model is optimized using a combination of the following components:
  • Cosine Similarity ($L_{sim}$): To align the structural features of the perturbation with the target transformation.
  • Adversarial Loss ($L_{adv}$): To ensure the perturbed image is misclassified as the target label.
  • Weighted MSE ($L_{wmse}$): To adjust the magnitude and spatial distribution of the perturbation.
• Neuromorphic Extension: For event-based data (e.g., N-MNIST), a trigger function introduces temporally varying random perturbations into spike frames to increase overall spike activity.

3. Inference Strategy

During inference, the victim uses the poisoned SNN. The attacker must choose an Attack Hyperparameter Configuration ($V^a_{thr}, \tau^a$) that lies between the nominal and malicious settings. This balance ensures:

• Clean inputs are classified correctly (high Clean Accuracy).
• Triggered inputs (with optimized perturbations) generate spike patterns that the model associates with the target label (high Attack Success Rate).

Main Contributions

1. Vulnerability Discovery: The work demonstrates that variations in the hyperparameters of spiking neurons ($V_{thr}$ and $\tau$) create an exploitable attack surface, enabling the model to treat in-distribution data as out-of-distribution based on spike count.
2. Novel Attack Vector (BadSNN): A backdoor attack that renders input data manipulation (poisoning) or trigger injection during training unnecessary. The backdoor is embedded entirely through the model's inherent spike generation mechanism.
3. Trigger Optimization: A process for generating imperceptible perturbations that activate the backdoor, utilizing a U-Net surrogate model trained with a multi-objective loss function.
4. Comprehensive Evaluation: Extensive experiments across four datasets (CIFAR-10, GTSRB, CIFAR-100, N-MNIST) and three architectures (Spiking ResNet-19, Spiking VGG-16, N-MNIST Net).

Experimental Results

The authors evaluated BadSNN against state-of-the-art baselines (BadNet, Blend, WaNet) and five defense mechanisms (Fine-Tuning, CLP, ANP, TSBD, NAD).

• Attack Effectiveness:

  • BadSNN achieves high Attack Success Rates (ASR) while maintaining acceptable Clean Accuracy (CA). For example, on CIFAR-10, it achieved an ASR of 82.65% with a CA of 87.22% (compared to a clean baseline of 91.34%).
  • On neuromorphic data (N-MNIST), the attack is particularly potent, achieving 100% ASR with minimal CA degradation.
  • The relationship between poisoning rate and attack success is non-linear; odd rates (1%, 3%, 5%) yielded better results than even ones.

• Robustness Against Defenses:

  • Pruning-based Defenses (CLP, ANP): BadSNN proved highly robust. While ANP reduced ASR for baseline attacks, it failed against BadSNN (ASR remained >70% on CIFAR-10). The authors attribute this to the "entanglement" of backdoor and clean neurons via Dual-Spike Learning, which makes pruning backdoor neurons without destroying clean usability impossible.
  • Fine-Tuning Defenses (TSBD, NAD): BadSNN maintained a high ASR (e.g., 84.55% on CIFAR-10 after fine-tuning), whereas baseline attacks were mitigated. The absence of localized trigger patterns in BadSNN prevents attention-based defenses (like NAD) from identifying and suppressing the backdoor.

• Hyperparameter Sensitivity: The study found that setting the malicious training threshold ($V^t_{thr}$) sufficiently higher than the nominal threshold ($V^n_{thr}$) (e.g., 1.5 vs. 1.0) produces a well-separated spike distribution, allowing for a better trade-off between CA and ASR.

Significance and Claims

The work claims that BadSNN represents a fundamental shift in security threats for SNNs. Its significance lies in two primary advantages over conventional data poisoning:

1. Stealth: By avoiding input data manipulation and trigger injection during training, the attack is harder to detect via standard data inspection or trigger inversion techniques.
2. Resilience: The attack's reliance on inherent model hyperparameters and Dual-Spike Learning makes it significantly more robust against state-of-the-art mitigation measures, particularly pruning and fine-tuning, which rely on isolating trigger-specific features or neurons.

The authors conclude that the unique properties of spiking neurons, particularly their sensitivity to hyperparameters, constitute a critical, overlooked vulnerability. This work motivates the development of new defense strategies tailored specifically to the architectural nuances of SNNs, rather than simply adapting DNN defenses.