💻 computer science

Temporal Poisoning: Clean-Label Backdoors via Event Redistribution in SNNs

This paper introduces the first clean-label backdoor attack on Spiking Neural Networks (SNNs) that achieves perfect attack success rates by applying fixed timestamp transformations to target-class event streams, thereby exposing the limitations of existing rate-collapsed defenses while demonstrating the attack's stealth through preserved event counts.

Original authors: Roberto Riaño, Gorka Abad, Stjepan Picek, Aitor Urbieta

Published 2026-07-31

📖 4 min read☕ Coffee break read

CC BY 4.0

Original authors: Roberto Riaño, Gorka Abad, Stjepan Picek, Aitor Urbieta

Original paper licensed under CC BY 4.0 (http://creativecommons.org/licenses/by/4.0/). ✨ This is an AI-generated explanation of the paper below. It is not written or endorsed by the authors. For technical accuracy, refer to the original paper. Read full disclaimer

Imagine the world of artificial intelligence as a bustling city where computers learn to recognize things, like faces or traffic signs. For a long time, these computers worked like standard cameras, taking a full picture every fraction of a second and analyzing the whole scene at once. But there's a newer, cooler type of computer brain called a Spiking Neural Network (SNN). Instead of looking at full pictures, SNNs are like hyper-alert security guards who only react when something moves or changes. They don't see a static image; they see a stream of tiny, rapid-fire "pings" or "spikes" that happen at specific moments in time. This makes them incredibly fast and energy-efficient, perfect for things like self-driving cars or robots that need to react instantly without draining their batteries.

However, just like any smart system, these networks can be tricked. In the world of AI security, a "backdoor attack" is like a secret handshake. If a hacker teaches the computer that a specific secret signal means "open the door," the computer will obey that signal no matter what else is happening. Usually, hackers have to do something obvious to teach this trick, like changing the label on a photo of a stop sign to say "speed limit" so the computer learns the wrong thing. But what if the hacker could teach the secret handshake without changing the label at all? What if they could just whisper a secret into the timing of the events, leaving the picture looking exactly the same? That is the mystery this paper sets out to solve.

The researchers, working with data from special cameras that only see changes in light, discovered a clever new way to hack these spiking brains. They found that you don't need to change what the computer sees to trick it; you just need to change when it sees it. Imagine a drumbeat. If you play a rhythm of "boom, tap, tap, boom," it sounds like a song. But if you squeeze all those beats into a tiny burst at the very start, or stretch them out, the total number of hits on the drum is exactly the same. To a person just counting the total hits, it's identical. But to a musician listening to the rhythm, it's a completely different song.

The paper shows that by rearranging the timestamps of these light-change events—moving them slightly earlier, later, or bunching them all together—the attackers could teach the AI that a specific rhythm meant a specific target class (like "cat" or "stop sign"). The scary part? The "clean" version of the data and the "poisoned" version look exactly the same if you just count the total events. It's like two songs that have the exact same number of notes, but one sounds like a march and the other like a waltz. If you only count the notes, you can't tell the difference. But the AI, which listens to the rhythm, gets confused and starts obeying the hacker's secret command.

The team tested this on three different datasets and two types of AI brains (one built like a traditional image processor and another like a modern transformer). They found that in many cases, this "time-trick" worked perfectly. In the strongest setups, the attack succeeded 100% of the time. The AI would look at a random object, see the secret timing pattern, and instantly classify it as whatever the hacker wanted, all while still doing a great job on normal, untricked inputs.

The researchers also checked if existing security guards could catch this trick. They tried several standard defenses, but most of them were blind to the attack. Why? Because most security checks for these AI brains work by squashing the time dimension first—turning the whole rhythm into a single count of total notes. Since the hacker didn't change the total count, these defenses saw nothing suspicious. It was only when the researchers built a new detector that actually listened to the rhythm step-by-step that they could spot the poison.

This study proves that for these time-sensitive AI brains, the "when" is just as important as the "what." It suggests that current security measures, which often ignore the timing of events, might be missing a huge vulnerability. The paper doesn't claim this is a solved problem or that all AI is broken, but it does show that a very stealthy, hard-to-detect backdoor exists. It's a wake-up call: if you want to protect these fast, efficient AI brains, you can't just look at the picture; you have to listen to the rhythm, too.

Technical Summary: Temporal Poisoning in Spiking Neural Networks

Problem Statement

Spiking Neural Networks (SNNs) have emerged as energy-efficient alternatives to Deep Neural Networks (DNNs), particularly for processing neuromorphic data captured by Dynamic Vision Sensors (DVS). Unlike DNNs, SNNs process information as asynchronous sequences of spikes over time, where the precise timing of events carries critical information beyond simple aggregate counts.

While backdoor attacks on DNNs are well-studied, existing research on SNN backdoors has primarily focused on dirty-label poisoning. In these attacks, poisoned samples are relabeled to a target class, creating an obvious inconsistency between the sample content and its label that can be detected via human inspection or simple relabeling.

This paper addresses the gap in clean-label backdoor attacks for SNNs. The core challenge is to inject a backdoor into SNNs without altering the labels of poisoned samples and without changing the spatial distribution of events (the "rate frame"), which would otherwise reveal the attack to standard spatial defenses. The authors hypothesize that the unique temporal nature of neuromorphic data provides a new attack surface: a trigger can be encoded in the timing of events rather than their location, preserving the aggregate spatial representation while altering the temporal dynamics processed by the spiking model.

Methodology

Attack Formulation

The proposed attack, Temporal Poisoning, operates in the digital domain by manipulating the timestamps of events within training streams belonging to a specific target class.

Clean-Label Constraint: The attacker selects a target class $y_t$ and modifies a fraction $\rho$ of the training samples from this class. Crucially, the labels remain unchanged ( $y_t$ ), and the total number of events per pixel and per polarity is preserved exactly.
Temporal Transformation: The attack applies a fixed timestamp-remapping function $\phi$ $ϕ$ to the event stream. Three specific transformation families are evaluated:
1. Concentrate: Compresses all events into a narrow temporal window (a burst).
2. Front-load: Moves events toward the beginning of the recording using a power map.
3. Shift: Applies a constant temporal offset with wraparound.
Mechanism: Because SNNs (specifically Leaky Integrate-and-Fire neurons) maintain state across time steps via membrane potential leakage ( $H[\tau] = \beta V[\tau-1] + X[\tau]$ ), the sequence in which events arrive affects the internal firing trajectories. Two streams with identical rate frames (total counts) but different temporal distributions can drive the network to vastly different internal states. The attack exploits this by teaching the model to associate the specific temporal redistribution with the target class.

Evaluation Setup

The authors evaluated the attack on three neuromorphic datasets: N-MNIST, DVS-Gesture, and CIFAR10-DVS. Two victim architectures were tested:

A convolutional SNN (conv-SNN).
A transformer-based SNN (SpikformerLite).

The evaluation measured Attack Success Rate (ASR) (the ability to trigger the target class on non-target inputs) and Clean Accuracy (CA) (performance on untriggered inputs).

Key Contributions

First Clean-Label Temporal Backdoor for SNNs: The paper introduces the first clean-label poisoning attack for SNNs that preserves the exact per-pixel, per-polarity event count. This ensures that the "rate frame" (the time-collapsed representation) of poisoned samples is mathematically identical to clean samples, rendering spatial inspection ineffective.
Comprehensive Empirical Analysis: The study characterizes the attack's effectiveness across three datasets and two architectures, analyzing the impact of poison budget, trigger shape (concentrate, front-load, shift), and placement.
Defense Evaluation and Limitations: The authors evaluate established backdoor defenses (STRIP, Activation Clustering, Spectral Signatures, Neural Cleanse, Pruning) adapted for SNNs. They demonstrate that defenses collapsing the time axis before inspection are "blind by construction" to this attack.
Model-Free Temporal Detector: A new detector based on per-step event mass is proposed. It detects the attack by analyzing the distribution of events over time, proving that time-aware analysis can expose the poison where rate-collapsed methods fail.

Results

Attack Effectiveness

High Success Rates: The Concentrate trigger achieved an ASR of 1.00 on N-MNIST (both architectures) and the SpikformerLite on DVS-Gesture. The Front-load trigger achieved an ASR of 1.00 on both CIFAR10-DVS victims.
Low Poison Budget: On N-MNIST, the attack reached ASR 1.00 with a poison rate of just $\rho=0.01$ (59 samples).
Stealth: The attack is perfectly stealthy regarding rate frames: the SSIM between clean and triggered rate frames is 1.00, and $L_0$ / $L_\infty$ distances are 0.
Clean Accuracy: In many configurations (e.g., N-MNIST, DVS-Gesture conv-SNN), the poisoned models retained clean accuracy within 1-2 percentage points of the baseline, though larger drops were observed on CIFAR10-DVS.

Defense Performance

Rate-Collapsed Defenses: Defenses that inspect the time-averaged rate frame (e.g., STRIP-rate, Neural Cleanse-spatial) were completely ineffective (TPR $\approx$ 0.01), as the trigger signal is mathematically absent from the input they inspect.
Feature-Space Defenses: Methods like Activation Clustering and Spectral Signatures showed inconsistent results, detecting the poison only in specific configurations (e.g., Spectral Signatures detected the attack on N-MNIST conv-SNN but failed on others).
Temporal Detector: The proposed model-free detector, which analyzes per-step event mass, achieved a True Positive Rate (TPR) of 1.00 for Concentrate and Front-load triggers across all six victim configurations, and 0.93–0.94 for Shift triggers.

Significance and Claims

The paper claims to be the first evaluation of clean-label backdoor attacks on SNNs and neuromorphic event data. Its primary significance lies in demonstrating that:

Temporal Dynamics are a Vulnerability: The precise timing of events, which is the core information carrier in SNNs, can be manipulated to install backdoors without altering spatial statistics or labels.
Limitations of Current Defenses: Standard backdoor defenses adapted from the image domain are insufficient for neuromorphic data if they collapse the time axis. The "stealth" of the attack is not absolute but is relative to the representation being inspected; it is invisible to rate-based checks but visible to temporal analysis.
Need for Time-Aware Security: The results highlight a critical gap in SNN security, suggesting that future defenses must be designed specifically for the temporal structure of neuromorphic data rather than adapted from frame-based settings.

The authors remain modest regarding the universality of the attack, noting that effectiveness varies by dataset and architecture, and that the attack's stealth is specific to rate-collapsed representations. They do not claim the attack is unpreventable but rather that current standard defenses are blind to this specific vector.