PaperlayerView exact revision on arXiv

Source-linked AI summary

T-Backdoor: Exploiting Temporal Redundancy in Neuromorphic Data for Spike-preserving Backdoor Attacks on SNNs

Abdullah Arafat Miah, Kevin Vu, Yu Bi

arXiv:2609.30119v1cs.CR

TL;DR

Backdoor attacks on SNNs using neuromorphic data remain underexplored, and existing spatiotemporal triggers alter spike distributions. T-Backdoor uses three purely temporal triggers; experiments report near-perfect attack success across single- and multi-target settings with minor clean-accuracy degradation.

  • Problem

    Existing spatiotemporal SNN backdoor triggers alter poisoned samples' spike distributions, motivating the question of whether an SNN can be compromised without that perturbation.

    Source: §I · p. 1

  • Method

    T-Backdoor remaps frame indices using Rate, Latency, and Jitter triggers without adding spatial content.

    Source: §I · p. 1, B. Temporal Triggers Design · p. 3

  • Results

    T-Backdoor reports near-100% ASR in single- and multi-target settings, with negligible clean-accuracy degradation across three datasets and resistance to seven detection and mitigation techniques.

    Source: §I · p. 1, §VII · p. 13

  • Takeaways & Limitations

    The reported internal-dynamics metrics show temporal triggers leave a signature that defenders can exploit, while a full detector implementation is deferred to future work.

    Source: L. Discussion and Future Works · p. 13

    The discussion identifies a detectable signature in membrane-potential temporal structure and leaves implementation of a full detector to future work.

    Source: L. Discussion and Future Works · pp. 12–13

Abstract

from arXiv · show

Backdoor attacks are a serious security threat to deep neural networks (DNNs) and remain largely underexplored for spiking neural networks (SNNs). Existing attacks primarily introduce spatiotemporal triggers that induce deviations in the spike distribution of poisoned samples relative to their clean counterparts. To address this limitation, this work proposes a novel backdoor attack on SNNs, termed \textbf{T-Backdoor}, which operates using purely temporal triggers such as \textit{Rate}, \textit{Latency}, and \textit{Jitter} without introducing any spatial perturbation, making the shift in spike distributions significantly harder to detect. Through extensive experiments on three benchmark neuromorphic datasets: N-MNIST, CIFAR10-DVS, and N-Caltech101, and evaluation against seven baseline backdoor defense methods, we demonstrate that T-Backdoor achieves a near-perfect 100\% attack success rate (ASR) in both single target and multi target settings with only minor degradation in clean accuracy, while remaining robust against existing backdoor detection and mitigation techniques. The codes are available at https://github.com/SiSL-URI/T-Backdoor .

I. INTRODUCTION

Prior SNN backdoor attacks use spatial triggers that alter spike distributions and may be detected with spike-count statistics. T-Backdoor instead uses three temporal triggers, and experiments report near-perfect attack success with negligible clean-accuracy degradation.

III. PRELIMINARIES

  • SNNs process discrete spike events rather than continuous activations, and are presented as energy-efficient alternatives suited to neuromorphic data –.Surrogate-gradient training addresses the non-differentiability challenge, with accuracy comparable to DNNs.Source: §I · p. 1

I. INTRODUCTION

  • T-Backdoor introduces Rate, Latency, and Jitter as purely temporal triggers, preserving spatial content and spike distributions while enabling multi-target payloads.Rate changes playback speed, Latency adds a fixed delay, and Jitter reorders frame pairs.Source: §I · p. 1
  • Across N-MNIST, CIFAR10-DVS, and N-Caltech101, T-Backdoor achieves ASR ≈100% with negligible clean-accuracy degradation and resists seven detection and mitigation techniques.The reported results also include evasion of spike-distribution-based detection.Source: §I · p. 1

II. RELATED WORKS

  • Prior neuromorphic SNN backdoor work is described as comparatively scarce, and the cited attacks use spatiotemporal triggers –.The related-work discussion also notes a neuromorphic backdoor detection and mitigation framework.Source: §II · p. 2

IV. SPIKE DISTRIBUTION ANALYSIS OF THE SPATIOTEMPORAL TRIGGERS

The analysis measures how three existing spatiotemporal triggers change spike distributions on neuromorphic datasets. The reported distances show substantial anomalies, motivating the search for triggers that preserve spike distributions.

IV. SPIKE DISTRIBUTION ANALYSIS OF THE SPATIOTEMPORAL TRIGGERS

  • The analysis samples 1,000 examples from N-MNIST, CIFAR10-DVS, and N-Caltech101 and measures spike KL divergence, Wasserstein distance, and total spike-count change.The metrics compare clean and poisoned samples.Source: §IV · p. 2
  • 247.50 and 190.67 are the spike Wasserstein distances for Static and Moving, respectively, on CIFAR10-DVS; on N-Caltech101, Static and Moving exceed 500.The figure compares spike-distribution distances and residuals between clean and poisoned samples.Source: Figure 1 · p. 3, §IV · p. 3
  • On N-MNIST, Static yields spike KL 23.45 and spike Wasserstein distance 17.94; Smart yields spike KL 6.02.Moving and Smart also produce similarly elevated values, while Smart's adaptive placement reduces some perturbation relative to Static and Moving.Source: §IV · p. 3

A. Threat Model

The threat model assumes an attacker can access training data and the model, and considers digital-domain data poisoning. The proposed triggers remap frame indices to alter temporal structure without adding spatial content.

A. Threat Model

  • The attacker is assumed to access the training dataset and model, use dirty-label data poisoning, and operate in the digital image domain.The attacker may also act as a third-party dataset provider or release a backdoored model through a third-party repository.Source: A. Threat Model · p. 3

B. Temporal Triggers Design

  • A temporal trigger deterministically remaps frame indices to create a triggered sample; the three designs are Rate, Latency, and Jitter.The designs change playback speed, shift the event sequence by a delay, or swap selected frame pairs, respectively.Source: B. Temporal Triggers Design · pp. 3–4
  • Rate speeds up playback when r > 1 by skipping intermediate events and slows it when r < 1 by repeating frames across output steps.The index is clamped to the valid frame range.Source: B. Temporal Triggers Design · p. 4
  • Latency shifts the event sequence by d time steps, with smaller delays such as d = 1 or 2 described as subtle.Jitter swaps fixed frame pairs consistently across poisoned samples without adding or deleting event sequences, leaving overall spike statistics identical to clean counterparts.Source: B. Temporal Triggers Design · p. 4

C. Backdoor Training

Backdoor training uses dirty-label poisoning across single-target, multi-target, and sample-specific settings. The poisoned training data assign target labels to triggered samples from victim classes while retaining clean labels for triggered samples from non-victim classes.

C. Backdoor Training

  • The training setup covers conventional one-to-one, one-to-N multi-target, and sample-specific attack settings.For multi-target attacks, each trigger or trigger-parameter choice maps to a distinct target label.Source: C. Backdoor Training · p. 4
  • In the sample-specific setting, triggered samples from victim classes receive target labels, while triggered samples from non-victim classes retain clean labels.Clean samples with clean labels form the third part of this setting.Source: C. Backdoor Training · p. 4
  • The poison ratio for multi-target attacks is measured against the entire poisoned set, not each target’s poisoned samples separately.Training or fine-tuning on the constructed dataset induces the backdoor effect for the selected attack setting.Source: C. Backdoor Training · p. 4

A. Experimental Settings

Experiments use three neuromorphic benchmark datasets and dataset-specific SNN architectures trained with surrogate gradients. Attack comparisons use spatiotemporal baselines, while defense evaluation applies detection and mitigation methods to the trained models.

A. Experimental Settings

  • Evaluation uses N-MNIST, CIFAR10-DVS, and N-Caltech101, with 10 timesteps per dataset.Clean baseline accuracies are 99.32% for N-MNIST, 71.00% for CIFAR10-DVS, and 78.37% for N-Caltech101.Source: A. Experimental Settings · p. 5
  • The models use NMNISTNet, CIFAR10DVSNet, and SEW ResNet-18, respectively, and are trained with surrogate gradients, LIF neurons, and Adam.Training uses the SpikingJelly framework in multi-step mode.Source: A. Experimental Settings · p. 5
  • The attack baselines are Static, Moving, and Smart, and seven defenses cover TMPBD, fine-tuning, distillation, and neuron-pruning methods.Mitigation methods receive 500 clean N-MNIST samples and 100 clean samples for each of CIFAR10-DVS and N-Caltech101.Source: A. Experimental Settings · p. 5

B. Attack Effectiveness Analysis

Across three datasets, Rate, Latency, and Jitter generally achieve near-perfect attack success while keeping clean-accuracy changes small, with some configuration-dependent costs. Their temporal perturbations also produce spike-distribution and anomaly-score profiles closer to clean data than spatiotemporal triggers do.

B. Attack Effectiveness Analysis

  • ≈100% ASR is achieved across datasets for Rate, Latency, and Jitter, with clean accuracy generally near baseline.Rate falls to 97.57% on N-MNIST, 96.00% on CIFAR10-DVS, and 96.96% on N-Caltech101 at r = 1.2; Jitter clean-accuracy drops on N-Caltech101 are approximately 7%, 4%, and 9% at ns = 3, 4, and 5.Source: Figure 4 · p. 5, B. Attack Effectiveness Analysis · p. 6

C. Spike Distribution Analysis of T-Backdoor

  • Spike-count comparisons are presented as model-agnostic detection because they require no access to trained network parameters.The analysis compares poisoned and clean samples using spike KL divergence, spike Wasserstein distance, and total spike residual.Source: C. Spike Distribution Analysis of… · p. 6
  • Jitter scores exactly 0.0 on all three spike-distribution metrics across all three datasets, while temporal triggers show near-zero perturbation overall.On N-MNIST, Latency has Spike KL 1.92 and Total Spike ∆ 0.0009, while Rate has 1.26 and 0.0017, respectively.Source: C. Spike Distribution Analysis of… · p. 6, Figure 5 · p. 7
  • The anomaly score equally sums total-spike, frame-wise distribution, inter-frame difference, and frame-variance scores.The distributions compare 1,000 clean and poisoned samples using a reference set of 100 clean samples.Source: C. Spike Distribution Analysis of… · p. 6
  • Temporal-trigger anomaly-score distributions largely coincide with clean distributions, whereas spatiotemporal triggers separate from clean samples, especially on CIFAR10-DVS.Jitter’s poisoned distribution aligns almost perfectly with the clean baseline; on N-Caltech101, spatiotemporal poisoned samples show a heavier right tail despite substantial overlap.Source: C. Spike Distribution Analysis of… · pp. 6–7, Figure 6 · p. 7

D. Attack Robustness Analysis

The robustness evaluation considers backdoor detection and mitigation methods, with reported visuals spanning model performance and Neural Cleanse detection. The supplied passages identify the evaluation scope but do not state comparative outcomes.

D. Attack Robustness Analysis

  • The evaluation includes nine defenses: TMPBD, Neural Cleanse, STRIP, and six model-level mitigation techniques.Mitigation methods include vanilla fine-tuning, fine-pruning, NAD, ANP, CLP, and TSBD.Source: D. Attack Robustness Analysis · p. 7
  • The mitigation-results table covers clean accuracy and attack success rate for spatiotemporal and temporal trigger attacks on neuromorphic datasets.The accompanying results are identified as Figure 7, Figure 8, Figure 9, and Table I.Source: Table I · p. 8, D. Attack Robustness Analysis · p. 8
  • Neural Cleanse flags a label as backdoored when its anomaly index exceeds 2.The figure caption identifies the red dot as the anomaly index.Source: Figure 8 · p. 8

1) Backdoor Detection Results:

The tested detection methods and most mitigation defenses struggled against T-Backdoor, though outcomes varied by dataset and defense. Across different timestep counts, attack success generally remained near-perfect, and T-Backdoor outperformed BadSNN on the evaluated neuromorphic datasets.

1) Backdoor Detection Results:

  • TMPBD mainly detected CIFAR10-DVS attacks, Neural Cleanse mainly detected N-MNIST attacks, and STRIP could not reliably separate temporal-trigger samples.STRIP showed limited entropy separation for Rate, Latency, and Jitter, unlike the Static trigger.Source: 1) Backdoor Detection Results · p. 8, Figure 9 · p. 9

2) Backdoor Mitigation Results:

  • 37 of 42 CIFAR10-DVS defense configurations retained ASR above 90%; some ANP reductions came with severe clean-accuracy losses, while several other defenses were ineffective.ANP at thr=0.2 reduced Rate-trigger ASR to 3.33% but caused clean-accuracy drops to 10–53%; CLP, Fine-Tuning, NAD, and TSBD were essentially ineffective.Source: 2) Backdoor Mitigation Results · pp. 8–9
  • 47 of 63 temporal-trigger defense configurations retained ASR above 90%, while only 7 were meaningfully mitigated.The authors conclude that defenses should specifically consider temporal modification of neuromorphic data.Source: 2) Backdoor Mitigation Results · p. 9

E. Effect of No. of Timesteps T on T-Backdoor

  • Across T ∈ {5, 10, 20}, clean accuracy was mostly stable and ASR generally remained near-perfect, except CIFAR10-DVS Latency at T=20 (ASR 0.760).The authors attribute the exception to the smaller perturbation and lower distinguishability of a single-timestep Latency shift.Source: E. Effect of No. of Timesteps T on… · p. 10

F. Comparison with BadSNN

  • Across all three datasets, T-Backdoor's temporal and spatiotemporal triggers achieved high CA and ASR, while BadSNN struggled with ASR on CIFAR10-DVS and N-Caltech101.The comparison was conducted on N-MNIST, CIFAR10-DVS, and N-Caltech101.Source: F. Comparison with BadSNN · p. 10

G. Impact of Poisoning Ratio on Attack Effectiveness

T-Backdoor's performance varies with poisoning ratio and attack setting. Latency is the most scalable trigger in the reported multi-target experiments, while source-specific attacks show elevated false-trigger rates.

G. Impact of Poisoning Ratio on Attack Effectiveness

I. Single-Trigger Multi-Target Attack Results Analysis

  • At p=0.2, Latency maintained ASR ≥99% up to N=5 on all three datasets and scaled to N=9 on CIFAR10-DVS and N-Caltech101, but not N-MNIST.Rate degraded sharply at N=5, and Jitter was the least scalable; clean accuracy remained stable as target count increased.Source: Figure 11 · p. 11, §I · p. 11

H. Attack Effectiveness Analysis on Source-specific Setting

  • With three source classes on CIFAR10-DVS, all temporal triggers achieved close to or above 80% ASR, while FTR was around 30% for Latency and Jitter and 41% for Rate.The authors state that the source-specific training approach needs further modification for stronger attack performance.Source: H. Attack Effectiveness Analysis on… · p. 11, Table V · p. 11

I. Single-Trigger Multi-Target Attack Results Analysis

  • With three targets, Rate and Latency achieved near-perfect ASRs across datasets and poisoning ratios, whereas Jitter underperformed on N-Caltech101.Jitter reached perfect ASR on N-MNIST and CIFAR10-DVS for p>0.2, while clean accuracy progressively declined with increasing p on N-Caltech101 and CIFAR10-DVS.Source: §I · p. 11

J. Multi-Trigger Multi-Targeted Attack Analysis

The multi-trigger, multi-target evaluation reports strong attack success with dataset- and poisoning-dependent qualifications, while the discussion identifies internal activation signatures that defenders may exploit.

J. Multi-Trigger Multi-Targeted Attack Analysis

K. Impact of Poisoning Ratio on MTMT Attack Setting

L. Discussion and Future Works

  • On CIFAR10-DVS and N-Caltech101, roughly two thirds of poisoned-pass spikes mismatch clean-pass activity, while DMTC grows by over an order of magnitude.These internal signatures may help defenders detect poisoned samples; a full detector is left to future work.Source: L. Discussion and Future Works · pp. 12–13, Figure 12 · p. 13

VII. CONCLUSION

The conclusion presents T-Backdoor as a spike-preserving temporal backdoor for SNNs and reports near-100% ASR in single- and multi-target settings.

VII. CONCLUSION

  • T-Backdoor is a spike-preserving temporal backdoor attack for SNNs.Source: §VII · p. 13
  • The attack uses Rate, Latency, and Jitter triggers.Source: §VII · p. 13
  • Experiments report near-100% ASR in both single-targeted and multi-targeted settings.Source: §VII · p. 13
Loading 2609.30119v1…