Robust Industrial Cyber Physical Classification Using Neuromorphic Temporal Embeddings and Hybrid SNN XGBoost Under Machine Unlearning Attacks

Motivation

• Accurate power-grid intrusion detection must classify diverse attacks while operating with low latency and limited computational overhead near physical infrastructure.Practical systems may also need to process both continuous electrical measurements and structured communication traffic.Source: §I · p. 1

Prior approaches

• Existing detection methods include rule-based, model-based, and data-driven approaches, with deep learning offering learned attack representations but requiring substantial computation and memory.The supplied passages describe conventional deep-learning architectures including convolutional, recurrent, and graph neural networks.Source: §I · pp. 1–2

Research gap

• SNNs offer event-driven, sparse, temporally dynamic processing for intrusion detection, but prior work has emphasized detection or efficiency rather than resilience to learned-data manipulation.Prior SNN studies cited in the passages include dynamic FDI detection and network intrusion detection.Source: §I · p. 2, B. SNNs Network for Intrusion Detection · pp. 2–3

Proposed approach

• The proposed architecture uses a Direct-SNN with LIF neurons to generate temporal membrane-potential embeddings, while XGBoost is periodically retrained on those fixed representations.The SNN is trained once on verified clean data and then frozen, separating representation learning from classifier adaptation.Source: §I · p. 2

Results

• 99.9% accuracy and F1-macro 0.999 are achieved on the Synchrophasor dataset, while 95.0% accuracy and F1-macro 0.943 are achieved on MSU/ORNL, outperforming standalone baselines.The contribution passage reports both dataset-level results and comparisons against standalone models.Source: §I · p. 2

Threat model

• Inference-time adversarial-robustness methods do not address training-time poisoning, which directly targets the data used to update an IDS.The supplied passage distinguishes evasion attacks from manipulation of training data.Source: C. Adversarial Robustness of IDS · p. 3

Robustness mechanism

• SNN membrane dynamics provide structural robustness by encoding physical signal properties that are independent of labels.The paper extends the use of model structure for robustness to neuromorphic architectures.Source: C. Adversarial Robustness of IDS · p. 3

Research gap

• The paper combines neuromorphic temporal features with explicit training-data-manipulation evaluation, unlike the cited prior SNN and machine-unlearning approaches.The comparison identifies separated feature extraction as a distinguishing design element.Source: D. Research Gaps · p. 3

LIF model

• The LIF membrane potential combines decayed prior state, weighted input current, and a reset term tied to the previous spike and firing threshold.The recurrence uses β for decay, W for synaptic weights, I[t] for input current, S[t−1] for the prior spike, and Uthr for threshold.Source: A. Leaky Integrate-and-Fire Neuron Model · p. 3
• β = 0.85 balances temporal integration and responsiveness for the framework’s 15-timestep window.Values near 1 retain information longer, whereas smaller values respond faster and forget prior evidence sooner.Source: A. Leaky Integrate-and-Fire Neuron Model · p. 3

B. Surrogate Gradient Learning

• Surrogate gradients replace the zero-gradient Heaviside derivative during backpropagation while retaining discrete spikes in the forward pass.This enables Backpropagation Through Time across all timesteps.Source: B. Surrogate Gradient Learning · p. 3
• The attack randomly replaces selected target-class labels with labels from other classes, then retrains the IDS on the corrupted dataset.The attack succeeds when target-class recall drops significantly while other metrics remain reasonable.Source: C. Machine Unlearning Attack Model · p. 3
• End-to-end training propagates corrupted labels into both feature representations and classifier decision boundaries, distorting embedding-space geometry.The proposed decomposition prevents later classifier retraining from altering the frozen embedding geometry.Source: §IV · p. 4
• The architecture trains the SNN once on verified clean data, freezes it, and periodically retrains only the XGBoost classifier.The classifier operates on 1,350-dimensional SNN embeddings and is the only component exposed to potentially corrupted labels.Source: §IV · pp. 3–4
• The architecture is presented as a hybrid SNN+XGBoost design for machine-unlearning resilience, combining a fixed neuromorphic frontend with an adaptable classifier.The comparison table identifies the work as combining neuromorphic temporal features with explicit machine-unlearning robustness evaluation.Source: Table I · p. 4, Figure 1 · p. 5

A. Data Preprocessing Pipeline

• The preprocessing design reduces dimensionality while preserving temporal structure required for SNN membrane integration.The selected representation feeds a temporally organized input into the neuromorphic model.Source: A. Data Preprocessing Pipeline · p. 5
• Features are min-max normalized to [0, 1] using training-set statistics, with the same transformation applied to validation and test data.The normalization uses ϵ = 10^-8 to prevent division by zero for constant features.Source: A. Data Preprocessing Pipeline · p. 5
• 128 raw PMU features are reduced to 50 selected features using mutual information before temporal window construction.Mutual information is preferred because it captures nonlinear feature-class dependencies while preserving individual feature identities.Source: A. Data Preprocessing Pipeline · p. 5
• Each sample is represented as a stride-1 window of T = 15 consecutive timesteps, preserving temporal structure across the window axis.The window contains 15 × 50 = 750 values per sample.Source: A. Data Preprocessing Pipeline · p. 5
• The T = 15 window spans approximately 2.4 membrane time constants when β = 0.85, capturing transient onset and sustained-state behavior.The effective time constant is approximately 6.1 timesteps.Source: A. Data Preprocessing Pipeline · p. 5

B. Direct-SNN Architecture

• Direct-SNN treats each timestep of a sliding window as a distinct continuous input current to LIF neurons.The input is X_win ∈ R^T×d rather than a spike-encoded representation.Source: B. Direct-SNN Architecture · p. 5
• The design avoids rate, latency, and delta spike encoding because those schemes are described as introducing an information bottleneck for flat power-system features.The paper states that direct injection preserves continuous feature information for the ablation study.Source: B. Direct-SNN Architecture · p. 5
• The SNN uses membrane dynamics to integrate the continuous currents across the temporal window.This integration supplies the temporal processing mechanism for the architecture.Source: B. Direct-SNN Architecture · p. 5
• The proposed Direct-SNN is designed specifically for power-grid intrusion detection using genuine time-varying input.The architecture receives sliding windows rather than static feature vectors.Source: B. Direct-SNN Architecture · p. 6

C. Temporal Membrane Embedding Extraction

• Membrane trajectories are recorded for each hidden layer and combined into a full embedding.The resulting embedding summarizes temporal responses across the SNN layers.Source: C. Temporal Membrane Embedding… · p. 6
• The [256, 128, 64] SNN architecture with C = 3 output classes produces a 1,350-dimensional embedding.The embedding is formed from the extracted layer features.Source: C. Temporal Membrane Embedding… · p. 6
• XGBoost is selected to handle high-dimensional structured embeddings, provide feature-importance rankings, and support lightweight retraining.The classifier is described as computationally lightweight for periodic updates.Source: D. XGBoost Classifier on Temporal… · p. 6
• XGBoost receives each 1,350-dimensional embedding as input and the potentially corrupted label as its training target.Each tree split operates on one embedding dimension.Source: D. XGBoost Classifier on Temporal… · p. 6
• The deployment procedure trains the SNN once on clean data, freezes and signs its parameters, then repeatedly retrains XGBoost on newly extracted embeddings.The SNN remains fixed while updated classifiers are deployed after each retraining cycle.Source: D. XGBoost Classifier on Temporal… · p. 6
• Embedding dimensions represent physically meaningful responses to temporal patterns, giving individual tree splits a physical interpretation.The representation is tied to membrane responses of specific neurons.Source: D. XGBoost Classifier on Temporal… · p. 6

Physics-grounded clustering

• Physics-grounded membrane trajectories distinguish attack transients from natural disturbances through their temporal signal characteristics.Examples include voltage drops, frequency excursions, and anomalous phase angles.Source: E. Why Temporal Embeddings Resist… · p. 6

Label-independent feature extraction

• Frozen SNN embeddings remain unchanged during retraining, so label corruption shifts only XGBoost decision boundaries.This differs from end-to-end models, where corruption affects both representations and classifiers.Source: E. Why Temporal Embeddings Resist… · p. 6

Structured embedding space

• Structured 1,350-dimensional embeddings provide temporal derivative-like, sustained-activity, and integration features for XGBoost tree splits.These representations are described as less susceptible to individual mislabeled points shifting decision boundaries than raw flattened features.Source: E. Why Temporal Embeddings Resist… · p. 6

Evaluation setting

• The evaluation uses real public power-grid datasets containing measurements from actual equipment, including Synchrophasor and MSU/ORNL PMU data.Source: A. Datasets · p. 7

Baselines

• Seven baselines span deep learning, tree ensembles, and rule-based detection, including MLP, LSTM, 1D-CNN, GNN, Random Forest, XGBoost, and a rule-based detector.Source: B. Baselines and metrics · p. 8

Metrics

• Four reported metrics are overall accuracy, F1-macro, Matthews Correlation Coefficient, and per-class precision and recall.Parameter count is also reported as a proxy for neuromorphic deployability.Source: B. Baselines and metrics · p. 8
• F1-macro weights all classes equally regardless of class support.Per-class F1 is the harmonic mean of precision and recall.Source: B. Baselines and metrics · p. 8
• MCC provides a balanced, correlation-based measure that remains informative under class imbalance and reaches +1 for perfect classification.Its multiclass definition uses correct predictions, true-class counts, and predicted-class counts.Source: B. Baselines and metrics · p. 8

Preprocessing

• Preprocessing applies Min-Max normalization, reduces MSU/ORNL features from 128 to 50, and constructs sliding windows of T = 15 samples.Baseline experiments use a 70/15/15 split, while unlearning experiments use 70/30 with fixed random seeds.Source: C. Implementation details · p. 8

SNN architecture

• The Direct-SNN uses [256, 128, 64] LIF layers, 15 simulation timesteps, dropout p = 0.2, and 44,803 total parameters.Training uses surrogate-gradient BPTT with balanced class weights.Source: C. Implementation details · p. 8

Clean-data results

• Table VII compares hybrid SNN+XGBoost performance with standalone SNN and tree models across two real public power-grid datasets.Source: A. Classification Results · p. 8, Table VII · p. 9
• The hybrid achieves 99.9% accuracy on Synchrophasor and 95.0% on MSU/ORNL.These correspond to improvements of +4.2% and +4.9% over raw XGBoost, respectively.Source: A. Classification Results · p. 8

• The hybrid uses 1,350-dimensional SNN embeddings, whereas raw XGBoost and Random Forest use 750-dimensional flattened window features.Source: B. Robustness to label poisoning and… · p. 9
• At 10% attack, the hybrid maintains target-class F1 of 0.954, compared with 0.938 for raw XGBoost and 0.900 for Random Forest.The hybrid’s baseline target-class F1 is 0.959, corresponding to 0.5% degradation.Source: B. Robustness to label poisoning and… · p. 9
• Target-class F1 remains above 0.5 until 70% poisoning for the hybrid, compared with 60% for both raw models.The collapse threshold is defined as the attack percentage where target-class F1 drops below 0.5.Source: B. Robustness to label poisoning and… · p. 9
• Across 0%–70% attack, the hybrid achieves the highest target-class F1 and recall, with the advantage most pronounced at 20%–50% poisoning.Source: B. Robustness to label poisoning and… · p. 9, Figure 3 · p. 11
• The SNN embeddings encode temporal voltage and current structure that is determined by physical measurements rather than corrupted labels.Consequently, label poisoning does not change the frozen embeddings.Source: B. Robustness to label poisoning and… · p. 10

• The ablation compares rate, latency, delta-modulation, temporal-contrast, and burst encoding methods across baseline architectures.Source: C. Ablation Study: The Encoding… · p. 11
• 70.53% accuracy is shared across five configurations varying architecture, capacity, encoding, decay, and threshold.The configurations span 9,734–43,911 parameters, rate-to-latency encoding, decay 0.85–0.95, and threshold 0.8–1.0.Source: C. Ablation Study: The Encoding… · p. 11
• Repeating one measurement snapshot across T = 25 timesteps gives the SNN statistically identical input frames.Source: C. Ablation Study: The Encoding… · p. 11
• Because the repeated input contains no temporal structure, the SNN cannot learn temporal patterns regardless of parameters or recurrent connections.Source: C. Ablation Study: The Encoding… · p. 11

• 8.4 minutes of CPU training is required for one-time SNN commissioning on verified clean data.This is comparable to LSTM at 12.1 minutes and 1D-CNN at 5.8 minutes.Source: D. Computational cost and deployability · p. 11
• 4.7-second XGBoost retraining updates only the classifier, compared with 3–12 minutes for retraining an entire deep-learning pipeline.The separation avoids the stale-model or unavailable-system interval during full retraining.Source: D. Computational cost and deployability · p. 12
• The hybrid’s total inference latency is 0.45 ms per sample on CPU, operating at approximately 74× real-time at a 30 Hz PMU reporting rate.SNN embedding extraction accounts for 0.42 ms and XGBoost classification for 0.03 ms.Source: D. Computational cost and deployability · p. 12
• The complete pipeline requires 140 MB of memory, including 95 MB for the frozen SNN and 45 MB for XGBoost.Source: D. Computational cost and deployability · p. 12
• Embedding extraction scales linearly with sample count, while XGBoost training scales as O(N · d · K · log N).For 78,377 samples, embedding extraction takes 32.9 seconds and XGBoost training remains under 5 seconds.Source: D. Computational cost and deployability · p. 12
• The defence assumes verified, secured initial clean data, and all models collapse at poisoning levels ≥70%; evaluation also uses one dataset for unlearning experiments.Source: E. Limitations · p. 12