PaperlayerView exact revision on arXiv

Source-linked AI summary

Stealth Is a Relation, Not a Property: How Event Representations Create Blind Spots for Timing Attacks in Event-Based Perception

Shoaib Ahmed Dipu, Md. Shaown Miah, Kamrul Hasan, Sayeed Shafayet Chowdhury

arXiv:2609.36386v1cs.CV

TL;DR

Event streams can be processed at different temporal resolutions, so timestamp changes may leave one representation unchanged while affecting a finer-time model. The paper formalizes observer-relative stealth and searches exact blind spaces for timestamp retimings. Its experiments show that additional temporal views expose perturbations hidden from the protected observer, while added observer constraints reduce the blind space and attack success.

  • Problem

    Event-camera consumers can receive different temporal information from the same asynchronous stream, and the paper studies whether a declared coarse observer’s blind space contains test-time retimings that cause victim errors.

    Source: §1 · p. 2

  • Method

    The paper defines stealth relative to a declared temporal observer, constructs Null to search exact within-window timestamp retimings, and evaluates observer-constrained attack success with SC-ASR_A(τ).

    Source: §1 · pp. 2–3

  • Results

    Adding fixed observer constraints reduces the real-valued blind fraction from 87.5% to 75.0% to 62.5%, while DVS ConvSNN ASR falls from 74.9% to 61.9% to 37.2%.

    Source: §6 · p. 9

  • Takeaways & Limitations

    Stealth depends jointly on the perturbation and the observer: a retimed stream can be unchanged to one temporal representation, affect a finer-time model, and become visible under another view.

    Source: §6 · p. 10

    The empirical study is limited to digital timestamp retiming of recorded events and does not demonstrate an over-the-air physical attack.

    Source: ETHICS STATEMENT · p. 10

Abstract

from arXiv · show

An event camera produces an asynchronous stream, but what is visible in that stream depends on how a downstream consumer, such as a model or detector, processes time. The same timestamp change may leave a coarse temporal representation unchanged while changing the response of a model that preserves finer timing. We characterize this dependence as observer-relative stealth. For recorded event streams, retiming an event within its protected accumulation window leaves the accumulated integer tensor exactly unchanged. We use this exact blind space to construct Null, a gradient-guided timestamp-retiming attack, and define SC-ASR_A(tau) to measure attack success while bounding the change visible to observer A. On DVS Gesture at a 10% event budget, Null reaches 81.56 +/- 5.81% ASR on ConvSNN and 98.67 +/- 0.45% on a GRU while preserving the protected tensor exactly. On DailyDVS-200, a protocol-scale Multi-View Fusion Network variant reaches 99.28 +/- 0.11% exact-null ASR, compared with 9.70 +/- 1.06% for its matched control. In a five-attack comparison, Null is the only method with nonzero attack success at exact observer equality, reaching 81.4% on DVS Gesture and 87.35% on DailyDVS-200. We also search the same exact blind space with an independently implemented constrained projected-gradient optimizer, C-PGD. At matched victim-gradient evaluations, C-PGD reaches 84.50 +/- 2.89% ASR on DVS Gesture and 89.55 +/- 4.39% on DailyDVS-200, again with exact protected equality. Perturbations that are exactly hidden from the protected observer become visible under shifted, finer, overlapping, and randomized temporal views. Adding observer constraints reduces the real-valued blind-space fraction from 87.5% to 75.0% to 62.5%, while DVS ConvSNN ASR falls from 74.9% to 61.9% to 37.2%. These results show that stealth is not a property of the perturbation alone.

1 INTRODUCTION

The paper makes temporal observers explicit: a timestamp retiming can preserve a coarse accumulated representation while changing a fine-time victim’s response. It constructs and evaluates attacks in this exact blind space, then tests how temporal-view changes affect visibility.

1 INTRODUCTION

  • Exact stealth is defined relative to a declared temporal observer A: A(X′) = A(X), even though another observer may receive different information from the same streams.This makes observer-relative visibility distinct from attack success alone.Source: §1 · p. 2
  • Retiming an event within its protected coarse window preserves the accumulated integer count, defining an exact blind space searched by Null across multiple event datasets and victim families.The paper also reports the same behavior on the auditory event-stream benchmark SHD.Source: §1 · p. 2
  • At a 10% event budget, exact-null ASR on DVS Gesture is 81.56 ± 5.81% for ConvSNN and 98.67 ± 0.45% for GRU, with the protected tensor exactly unchanged.The independent C-PGD optimizer reaches 84.50 ± 2.89% at matched victim-gradient evaluations on DVS Gesture, also with exact protected equality.Source: §1 · p. 2
  • The paper separates raw attack success, observer-constrained SC-ASR_A(τ), and detector-specific UASR to distinguish victim failure, representation visibility, and detector evasion.At τ = 0, SC-ASR requires exact protected-observer equality.Source: §1 · p. 2
  • Adding fixed observer constraints reduces the real-valued blind fraction from 87.5% to 75.0% to 62.5%, while DVS ConvSNN ASR falls from 74.9% to 61.9% to 37.2%.Canonical-null attacks also become visible under shifted, half-width, overlapping, and randomized temporal views on DVS Gesture and DailyDVS-200.Source: §1 · pp. 2–3

2 RELATED WORK AND NOVELTY BOUNDARY

The paper situates its contribution among event-stream attacks, stealth measures, and representation-invariance analyses. Its novelty boundary is test-time observer-constrained evasion and explicit comparison of attacks across temporal observers.

2 RELATED WORK AND NOVELTY BOUNDARY

  • Prior event-stream attacks modify event values, spatial structure, or timestamps; this work instead studies test-time observer-constrained evasion and evaluates attacks under different temporal observers.Related settings include spike retiming under constraints and a training-time count-preserving backdoor (Riaño et al., 2026).Source: §2 · p. 3
  • SC-ASR_A(τ) measures attack success subject to a named observer’s constraint, whereas UASR_α measures evasion of a particular detector; neither substitutes for the other.The paper contrasts this distinction with prior work on perceptual and detector-level stealth (Frederickson et al., 2018).Source: §2 · p. 3
  • For recorded streams, exact integer equality defines the feasible set for Null and C-PGD, while changing, refining, randomizing, or intersecting observers can expose information hidden from the original view.The paper relates this setting to null spaces, Fourier zeros, and Poisson count laws.Source: §2 · p. 4

3 OBSERVER-RELATIVE STEALTH AND BLIND SPACES

The section formalizes stealth relative to an observer’s representation and characterizes exact blind spaces for recorded events. It also states how observer restrictions affect detection and how additional observers change the shared blind space.

3 OBSERVER-RELATIVE STEALTH AND BLIND SPACES

  • For a representation R, exact stealth means R(X′) = R(X); for a linear observer A, perturbations in Null(A) form its blind space.Such perturbations can change the event stream without changing the representation seen by that observer.Source: §3 · p. 4
  • Any detector restricted to an exactly unchanged representation receives the same paired input, so a deterministic detector gives the same output.With independent detector randomness, the paired information alone cannot raise true-positive rate above false-positive rate.Source: §3 · p. 4
  • Moving events between fine bins within the same coarse window, while preserving location and polarity, yields AΔ = 0 and exact integer equality A(X + Δ) = AX.With all aggregation rows present, dim Null(A) = KCHW(S − 1).Source: §3 · p. 4
  • Adding linear-observer constraints can only preserve or shrink the common blind space, and a retiming hidden from one observer may become visible to another.The paper separately notes that continuous and stochastic analogues require additional assumptions and are distinct from the exact recorded-event guarantee.Source: §3 · p. 4

4 NULL-SPACE ATTACK AND THREE-LEVEL EVALUATION

The attack construction searches legal within-window timestamp moves while preserving the protected representation exactly. Evaluation separates victim failure, observer-constrained success, and detector evasion, with comparisons conducted under a stated multi-seed protocol.

4.1 ATTACK CONSTRUCTION

  • Null greedily selects high-gain legal retimings within the protected blind space, refreshing the victim gradient periodically and preserving A(X′) = A(X) exactly.The budget moves at most ⌊b n_ev⌋ original events, each used at most once.Source: §4.1 · p. 5
  • C-PGD independently searches the same unrestricted within-window feasible set and converts a relaxed solution into an integer timestamp-only stream with exact observer equality.At the primary comparison point, its victim-gradient evaluations match Null’s: three on DVS Gesture and four on DailyDVS-200.Source: §4.1 · p. 5

4.2 THREE-LEVEL EVALUATION

  • The evaluation distinguishes raw ASR, observer-constrained SC-ASR_A(τ), detector-specific UASR, and temporal-locality A(ϵ), whose τ and ϵ limits address different properties.SC-ASR’s tolerance curve is post-hoc unless the attack is re-optimized at each τ.Source: §4.2 · pp. 5–6

4.3 EVALUATION PROTOCOL

  • Main Null results use three training seeds; the Null–C-PGD comparison matches attack population, legal moves, budget path, and victim-gradient evaluations at the primary comparison point.Repeated-clip uncertainty uses a clip-clustered, seed-aware bootstrap that preserves attack pairing and clean-correct conditioning.Source: §4.3 · p. 6

5 EXPERIMENTS

Experiments test exact-null vulnerability across datasets and victim families, compare optimizers and existing attacks using observer-relative measures, and then vary the temporal observer. Unless noted, ASR is conditioned on clean-correct samples and headline values average three seeds.

5.1 BROAD EXACT-NULL VULNERABILITY

  • Across four aligned event-vision datasets, Null exceeds the random control for every dataset–victim pair while all optimized rows satisfy DA = D∞ = 0.Table 1 reports optimized ASR against random-control ASR at the common 10% operating point.Source: §5.1 · p. 6, Table 1 · p. 7

5.2 NULL VERSUS C-PGD IN THE SAME FEASIBLE SET

  • At matched victim-gradient evaluations, C-PGD reaches 84.50 ± 2.89% versus 81.56 ± 5.81% for Null on DVS Gesture, with both satisfying DA = 0.Additional C-PGD steps increase ASR; the DailyDVS-200 comparison is supporting because its ConvSNN has low clean accuracy.Source: Figure 2 · p. 7, §5.2 · p. 7

5.3 EXISTING ATTACKS UNDER OBSERVER-RELATIVE EVALUATION

  • At τ = 0, Null retains 81.4% attack success on DVS Gesture and 87.35% on DailyDVS-200, while the other four attack sets have zero success.The figure applies τ post hoc to fixed generated attacks with different feasible sets.Source: Figure 3 · p. 8, §5.3 · p. 8

5.4 REPRESENTATION VISIBILITY VERSUS OPERATIONAL DETECTION

  • Null retains 79.9% UASR while satisfying DA = 0 exactly; Yu and Free retain high UASR despite changing the protected representation, whereas Yao is easier to detect.UASR is reported separately from raw ASR and exact SC-ASRA(0); the clean-only detector protocol is shared across the five DVS attacks.Source: Figure 4 · p. 8, §5.4 · p. 8

5.5 CROSS-OBSERVER VISIBILITY

  • Adding phase constraints shrinks the blind space and reduces ConvSNN and SEW attack success, but GRU remains near saturation; the intersection experiment does not establish a universal defense.Randomized schedules expose fixed canonical-null DVS attacks in about 97.5% of realized schedules; this is a representation-exposure result, not a complete defense benchmark.Source: §5.5 · pp. 8–9
  • The same Null attacks have zero deviation under the canonical observer but nonzero deviation under shifted, half-width, and randomized observers.Table 2 reports alternative-observer deviations for the same attacks and re-optimized attacks constrained by additional fixed phase observers.Source: §5.5 · p. 8, Table 2 · p. 9

5.6 CONTROLS AND ABLATIONS

  • With a one-fine-bin cap, DVS ConvSNN/SEW/Transformer/GRU ASR remains 34.7/17.3/58.0/98.7%.Source: §5.6 · p. 9
  • Only Null preserves the protected representation in matched-effort CIFAR10-DVS; at ϵ = .25, null-subspace PGD lowers LIF accuracy to 0.33% while the protected frame CNN remains at 97.80%.All 12 optimized-versus-control comparisons remain significant after Holm correction; the controlled study reports no protected-label flips in 21,000 attacks.Source: §5.6 · p. 9

6 DISCUSSION AND CONCLUSION

Exact observer equality can coexist with victim errors, while changing the temporal view exposes attacks and reduces the shared blind space. The discussion and appendices distinguish these effects from detector evasion and qualify the continuous-time and stochastic results by their assumptions.

6 DISCUSSION AND CONCLUSION

  • Exact-null ASR reaches 81.56% on DVS ConvSNN and 98.67% on GRU, while C-PGD independently finds damaging retimings in the same blind space.Matched controls preserve the optimized signed-shift multiset while assigning it to different legal event identities; all 6,336 sample-level matches complete with zero fallback.Source: §6 · p. 9
  • Adding fixed observer constraints reduces the blind fraction from 87.5% to 75.0% to 62.5% as DVS ConvSNN ASR falls from 74.9% to 61.9% to 37.2%; raw ASR, SC-ASR_A(τ), and UASR measure distinct outcomes.Stealth depends jointly on the perturbation and observer; the measures distinguish victim failure, observer-constrained success, and detector evasion.Source: §6 · pp. 9–10
  • Under a one-fine-bin cap, ASR remains 34.7/17.3/58.0/98.7% across ConvSNN, SEW, Transformer, and GRU; A(200 ms) is 51.88% for Null, 7.11% for Yu, and 0% for Free.Representation equality and timestamp displacement describe different properties, so the paper reports representation deviation, event footprint, and timestamp displacement separately.Source: §6 · pp. 9–10

A.1 CONTINUOUS AND STOCHASTIC STATEMENTS

  • For linear kernels, periodic perturbations vanish at frequency-response zeros; preserving integrated rate per disjoint window preserves joint Poisson frame-count distributions, while randomized widths remove fixed boxcar nulls under stated conditions.With a density for randomized width, the energy is positive for every nonzero frequency; these results require additional assumptions and are separate from the exact recorded-event guarantee.Source: §A.1 · p. 14

A.2 PROOF OF PROPOSITION 1

  • A detector restricted to R receives identical representation inputs for clean and attacked samples, so paired representation-based detection cannot raise true-positive rate above false-positive rate.This does not cover detectors with access to the raw event stream or another representation.Source: §A.2 · p. 14

A.3 BASELINE-RATE SCOPE

  • The transform condition applies to λ(t)a(t); a changing baseline can make sinusoidal modulation non-single-frequency, while exact per-window sums avoid this approximation in recorded-event experiments.The controlled check reports residuals of about 7 × 10^-3 of the frame mean for a linear-ramp baseline and about 9 × 10^-2 for a full saccade profile.Source: §A.3 · p. 14

A.4 PROOF OF THEOREM 1

  • For a linear response, the expected perturbation vanishes for every window and phase exactly when the kernel transform is zero at the perturbation frequency.Linearity extends this result to additive perturbations whose spectral support lies in the transform's zero set.Source: §A.4 · p. 15

A.5 PROOF OF COROLLARY 1

  • At the first boxcar null, f = 1/∆, the LIF gain is about 0.62 when τ/∆ = 0.2.The stated gain is (1 + (2πτ/∆)^2)^-1/2.Source: §A.5 · p. 15

A.6 PROOF OF THEOREM 2

The appendix develops exact and probabilistic accounts of temporal information hidden by coarse observations, then connects those accounts to timestamp retiming and observer-dependent visibility. It also documents controls showing that matched shifts can isolate event selection from shift size and direction.

A.6 PROOF OF THEOREM 2

  • For Poisson counts in disjoint windows, preserving each window’s integrated rate preserves the joint count law, so any count-based test has power equal to its size.For non-Poisson processes, equal window integrals guarantee equal first moments but not higher-order count statistics.Source: §A.6 · p. 15

A.8 PROOF OF PROPOSITION 2

  • Moving an event between fine-time bins within one coarse window preserves its accumulated integer count exactly, keeping the protected representation unchanged.The same holds for finite collections of legal moves; any computation of the accumulated representation receives the identical input.Source: §A.8 · p. 15

A.9 NULLITY CALCULATION FOR PROPOSITION 2

  • The real-valued null space has dimension KCHW(S −1), while legal timestamp moves form a smaller integer subset restricted by occupancy and nonnegativity.The aggregation operator’s rows have disjoint support and rank KCHW.Source: §A.9 · p. 15

A.11 PROOF OF THEOREM 3

  • Randomizing accumulation width removes fixed boxcar spectral nulls under the stated continuous-width conditions, while schedule-aware detection can accumulate deflection across observed windows.For widths concentrated around ∆, the approximation gives squared deflection that grows linearly with the number of windows.Source: §A.11 · p. 16, §A.12 · pp. 16–17

A.13 ADDITIONAL REPRESENTATION AND TEMPORAL-BUDGET DETAILS

  • At the first null of the original frame, normalized visibility is 0 at B=1, 0.64 at B=2, and 0.98 at B=10; finer temporal summaries close one blind spot and create higher-frequency nulls.Source: §A.13 · p. 17

C.3 EXACT DISPLACEMENT-MATCHED RANDOM CONTROL

  • The DVS matched control preserves each attack’s signed-shift multiset while changing event identities, and the protected frame models retain bitwise-identical logits with zero prediction flips.The exhaustive control verification covers 6,336 sample-level cases across two victims, four budgets, and three seeds.Source: §C.3 · p. 20

C.4 MAXIMUM-SHIFT ABLATION

These sections test how retiming limits, attack constraints, and victim architecture shape results. Exact coarse-tensor preservation holds in constrained CIFAR10-DVS runs, while removing the constraint does not uniformly improve efficacy.

C.4 MAXIMUM-SHIFT ABLATION

  • Restricted maximum shifts preserve exact coarse-frame equality, and the unrestricted ablation matches the main seed-0 results for ConvSNN, SEW, and GRU.The Transformer differs by 1.22 percentage points, so the ablation is not used to validate its main-table value.Source: §C.4 · p. 21, Figure 7 · p. 21

C.5 COST-OF-STEALTH DIAGNOSTICS

  • At a 20% budget on N-MNIST, exact-null and free retiming reach 50% and 100% ASR for LIF, while both reach 100% for GRU.Exact-null leaves zero coarse-frame difference; free retiming has maximum integer differences of 14 and 15, respectively.Source: §C.5 · p. 21
  • At 10% on CIFAR10-DVS, null/free ASR is 96.6/98.9% for ConvSNN, 71.8/85.3% for SEW, 88.1/79.7% for Event Transformer, and 100.0/95.7% for GRU.Every null-space row has zero coarse difference and bitwise-identical CoarseFrameFormer logits; free retiming changes protected predictions on 28.0–44.4% of samples.Source: §C.5 · p. 21

C.6 ATTENTION-BASED AND RECURRENT VICTIMS

  • The Event Transformer has 93.69 ± 0.95% clean test accuracy, while the DVS temporal GRU has 85.48 ± 1.75%.The GRU uses the same strict unique-event budget and exact signed-displacement-matched control as the Transformer.Source: §C.6 · p. 22

D CIFAR10-DVS PROTOCOL

  • CIFAR10-DVS uses ten protected coarse frames, four temporal victims, and unique-event budgets from 1% to 20%; all constrained attack and exact-control rows have zero coarse-tensor difference.The protected CoarseFrameFormer has zero prediction flips in these rows.Source: D CIFAR10-DVS PROTOCOL · p. 22

E N-CALTECH101 PROTOCOL AND RESULTS

F DAILYDVS-200 PROTOCOL AND RESULTS

DailyDVS-200 is evaluated on a stratified 1,000-stream subset across three seeds, with exact coarse-tensor preservation verified for optimized and matched-control rows.

F DAILYDVS-200 PROTOCOL AND RESULTS

  • DailyDVS-200 uses all 200 classes, three seeds, and a proportionally stratified 1,000-stream attack subset, with no train/test recording overlap.The split contains 31 training, 9 test, and 7 validation subjects after removing released validation/test overlap.Source: F DAILYDVS-200 PROTOCOL AND RESULTS · p. 22
  • The DailyDVS-200 ConvSNN has 13.55 ± 0.60% clean accuracy, making its ASR supporting rather than headline evidence.The remaining fine-time victims reach 27.31–34.25% clean accuracy on the 200-way task.Source: F DAILYDVS-200 PROTOCOL AND RESULTS · p. 23
  • All optimized and exact-control DailyDVS-200 rows preserve the coarse tensor exactly, with bitwise-identical CoarseFrameFormer logits and zero prediction flips.Table 10 reports ASR as mean±std over three seeds, with “Exact” denoting the signed-displacement-matched random control.Source: F DAILYDVS-200 PROTOCOL AND RESULTS · p. 23, Table 10 · p. 23

G DIRECT RETIMING COMPARISON AND REPRESENTATION-SPACE METRIC

This section compares attacks under observer-space and temporal-movement constraints, validates Null against an independent optimizer, and reports statistical, computational, and controlled-study results. Exact equality to the declared observer is distinct from limiting how far events move in time.

G DIRECT RETIMING COMPARISON AND REPRESENTATION-SPACE METRIC

  • At exact protected equality, null-space retiming reaches 81.56 ± 5.81% SC-ASR, while PIL-L0 and free retiming each reach 0; their raw ASRs are 100.0 ± 0.0% and 95.06 ± 0.23%.Table 11 is the three-seed direct comparison; at τ = 0, null-space retiming has 100% pass rate and retention.Source: Table 11 · p. 23, G DIRECT RETIMING COMPARISON AND… · pp. 23–24

G.1 TEMPORAL LOCALITY OF THE RETIMING ATTACKS

  • The representation tolerance τ limits what the protected observer sees, whereas A(ϵ) limits timestamp displacement; Null remains exactly invariant and requires less movement than free retiming.Yu achieves high temporal-radius success but does not satisfy exact protected equality.Source: §G.1 · p. 24

G.2 NULL–C-PGD COMPARISON DETAILS

  • At matched victim-gradient evaluations, C-PGD reaches 84.50% exact-null ASR on DVS Gesture versus 81.56% for Null, with a paired difference of 2.94 points.On DailyDVS-200, the corresponding values are 89.55% and 86.98%, with a 2.57-point difference whose 95% CI includes zero.Source: §G.2 · p. 24, §G.3 · p. 25

G.3 STATISTICAL TESTS

  • Across CIFAR10-DVS, N-Caltech101, and DailyDVS-200, all 12 optimized-versus-exact-control comparisons remain significant after Holm correction, with largest adjusted p = 0.0119..Source: §G.3 · p. 25

G.4 ATTACK-GENERATION COST

  • On an NVIDIA H100 80GB, the DailyDVS-200 progressive attack path takes 467±1 s for ConvSNN, 1490±41 s for SEW-ResNet, 272±9 s for Event Transformer, and 315 ± 10 s for GRU.These times cover attack generation on the 1,000-stream subset and exclude training and preprocessing; the dense-tensor implementation cost increases with temporal and spatial resolution.Source: §G.4 · p. 25
  • The randomized-schedule visibility study tests fixed canonical-null attacks without retraining the victim under randomized accumulation, so it measures observer visibility rather than full consumer robustness.About 97.5% of realized schedules expose a perturbation invisible to the canonical accumulator.Source: §G.4 · p. 25

H CONTROLLED SPECTRAL VALIDATION

  • The continuous-valued controlled spectral study validates the mechanism separately from the discrete recorded-event experiments, which establish exact integer invariance.The controlled study uses saccade-derived activity over 60 substeps of 2 ms, aggregated every ten substeps.Source: H CONTROLLED SPECTRAL VALIDATION · p. 25

H.1 INVISIBLE-SUBSPACE ATTACK AND THE PRICE OF THE CONSTRAINT

  • Across 21 invisible-subspace configurations, none of 21,000 attacked streams changes a frame-CNN label; at ϵ = .25, constrained and free attacks both saturate the fine-time victim.The free attack’s frame footprint is nearly six orders of magnitude larger; at ϵ = .10, the constraint has a measurable efficacy cost.Source: §H.1 · p. 25, Table 15 · p. 26

H.2 TRANSFER-FUNCTION MECHANISM AND SYNCHRONIZATION ERROR

These appendices test how temporal representation and synchronization affect visibility, then extend the exact-null mechanism across datasets and modalities. They find that finer or randomized views can reveal effects hidden by a protected observer, while outcomes depend on the observer and architecture.

H.2 TRANSFER-FUNCTION MECHANISM AND SYNCHRONIZATION ERROR

  • At τ/∆ = 0.2, predicted LIF gain is ≈0.62 at a frequency rejected exactly by the frame accumulator, and predicted gain correlates with measured accuracy drop at Pearson r = 0.99.The correlation is reported across τ/∆ values at sub-saturating budgets; it vanishes after attack saturation.Source: §H.2 · p. 26
  • At null frequency, a 0.5-amplitude modulation yields p = 0.57 and variance ratio 1.01, while the same-amplitude non-null modulation yields p < 10^-3 and ratio 1.83.The integrated rate per null window changes by only 2 × 10^-11; Eq. (8) matches the exact stealth–efficacy ratio to 2.0% and 0.2% at relative frequency errors 10^-2 and 10^-3.Source: §H.2 · p. 26

H.3 RANDOMIZED ACCUMULATION AND SCHEDULE-AWARE DETECTION

  • At jitter r = .25 and .40, residual-energy AUROC is 0.61 and 0.74, while schedule-aware gain-matched AUROC is 0.97 and 0.999.Across 18 settings, the deflection-based prediction matches gain-matched AUROC with mean absolute error 0.011; schedule-blind AUROC remains 0.49–0.50.Source: §H.3 · p. 26, Figure 8 · p. 26

H.4 REPRESENTATION REFINEMENTS AND SCOPE

  • At the first null of a ∆-wide boxcar, normalized carrier visibility is 0 for B = 1, about 0.64 for B = 2, and 0.98 for B = 10.Finer voxelization closes this blind spot but introduces higher-frequency nulls where LIF response is more attenuated; randomized-width positivity requires breaking null-preserving lattices, and detection requires the realized schedule.Source: §H.4 · p. 26

I ALIGNED N-MNIST FIVE-MODEL PROTOCOL

  • On aligned N-MNIST, clean accuracy is approximately 99% for four models and 98.5% for the GRU, and every optimized attack row has DA = D∞ = 0.At a 10% budget, the GRU reaches 48.1% ASR with a one-fine-bin (2 ms) maximum shift versus 56.4% for unrestricted within-window moves.Source: I ALIGNED N-MNIST FIVE-MODEL PROTOCOL · p. 27, Table 16 · p. 27

J DAILYDVS-200 ARCHITECTURE STRESS TEST

  • The DailyDVS-200 architecture test uses protocol-scale models trained under common preprocessing, not official benchmark checkpoints, and conditions ASR on clean-correct clips.The reported purpose is a model-strength and architecture stress test, not reproduction of the published DailyDVS leaderboard.Source: Table 17 · p. 27, J DAILYDVS-200 ARCHITECTURE STRESS TEST · p. 27

K SHD CROSS-MODALITY EXTENSION

L UNIFIED FIVE-ATTACK AND OPERATIONAL-DEFENSE DETAILS

The unified evaluation compares five attacks and operational defenses on a shared DVS population, then tests how representation distance relates to attack success and detection. The completed three-seed results show differing attack and detector outcomes, while a smaller DailyDVS diagnostic is explicitly underpowered.

L UNIFIED FIVE-ATTACK AND OPERATIONAL-DEFENSE DETAILS

  • The unified DVS run evaluates Yu PIL-L0, Free, Null, adapted SDA/PDSG, and adapted Yao/Gumbel on a shared ConvSNN/CoarseFrameFormer population.The combined detector's realized clean FPR is 2.51% for the main DVS rows at the nominal 5% operating point, versus 3.35% for Yao under fold-level calibration.Source: L UNIFIED FIVE-ATTACK AND… · p. 28, Table 19 · p. 28
  • Across the completed three-seed DVS evaluation, Yu/SDA/Yao/Free/Null have AUROC 0.431/0.495/0.929/0.510/0.492 and UASR@5 98.6/34.9/36.1/92.4/79.9%, respectively.These are the operational numbers reported for the evaluation; the retained table is the seed-0 view.Source: L UNIFIED FIVE-ATTACK AND… · p. 28
  • In the controlled Free sweep, ASR rises from 37.7% to 74.1% as max-shift increases from 2 to 32 fine bins, while detector TPR at fixed FPR does not increase monotonically.Mean DA progresses 0.0418 → 0.0772 → 0.1422 → 0.1759 → 0.1889 across the same max-shift values.Source: L UNIFIED FIVE-ATTACK AND… · p. 28
  • The DailyDVS unified operational diagnostic pools 119 clean-correct evaluations across three seeds, substantially fewer than the 1,000-stream protocol, and is treated as underpowered.All methods are near chance on this smaller DailyDVS population, so it is not used for a main cross-dataset detection claim.Source: L UNIFIED FIVE-ATTACK AND… · p. 28

M OBSERVER-FAMILY ABLATIONS

The observer-family experiments separate fixed attacks evaluated under different temporal views from attacks re-optimized under additional observer constraints. The appendix also describes an independent projected-gradient search within the exact-null feasible set and its matched-gradient comparison design.

M OBSERVER-FAMILY ABLATIONS

  • Randomized schedules expose about 97.5% of saved canonical-null DVS attacks, although the schedule-blind visibility statistic remains zero.EMA summaries also differ under fixed attacks, but with smaller normalized L1 changes; the GRU remains near saturation when observers are added, so the constraints give no universal robustness guarantee.Source: M OBSERVER-FAMILY ABLATIONS · p. 28, Table 20 · p. 29
  • The observer-family checks verify zero matcher fallback, exact integer equality of the protected tensor, bitwise equality of protected-consumer logits, fixed evaluation populations, and clean-only detector calibration.These checks ensure that protected-representation changes or evaluation-population changes are not counted as stealth.Source: M OBSERVER-FAMILY ABLATIONS · p. 28

N CONSTRAINED PROJECTED GRADIENT DESCENT (C-PGD)

  • C-PGD searches Null's same unrestricted within-window exact-null feasible set by optimizing grouped fine-bin counts and returning an integer event stream with exact protected equality.The procedure uses row-wise mean subtraction, simplex projection, budget contraction, and deterministic largest-remainder transport; checks cover nonnegativity, event count, moved-event budget, and exact coarse equality.Source: N CONSTRAINED PROJECTED GRADIENT… · p. 29
  • At s = 1, Null and C-PGD are matched by victim-gradient evaluations: three through 10% on DVS Gesture and four on DailyDVS-200.Wall-clock time is not matched because the optimizers perform different non-gradient operations.Source: N CONSTRAINED PROJECTED GRADIENT… · p. 29

Related papers

Loading 2609.36386v1…