Characterizing Privacy Leakage in Spiking Neural Networks: A Systematic Analysis of Temporal Dynamics, Stochasticity, Neuronal Dynamics and Learning Mechanisms

1 Introduction

• The study systematically examines temporal representations, stochasticity, intrinsic neuron dynamics, and learning under a common analytical framework.It compares Rate, Poisson-Burst, and Delayed-Burst dynamics, tests jitter and noise, evaluates AdEx neurons, and examines gradient-based, evolutionary, and differentially private training.Source: §1 · p. 3
• AdEx neurons reduce membership leakage while preserving or improving classification performance across evaluated datasets.The study also finds that learning conditions the privacy behavior of temporal dynamics.Source: §1 · p. 3
• Burst-based temporal dynamics generally reduce membership leakage relative to Rate, but the reduction can come with lower classification accuracy.Moderate mixtures may retain much of Rate's utility, whereas stronger heterogeneity can reduce it.Source: §1 · p. 3
• Temporal dynamics and stochasticity alone do not explain SNN privacy; leakage depends on their interaction with neuron dynamics and learning.The introduction frames firing-pattern changes as simultaneously affecting spike timing, stochasticity, neuronal response, and learning.Source: §1 · pp. 2–3

2.1 Spiking Neural Networks

• SNNs represent activity as spike trains whose discrete events and timing carry information and drive postsynaptic input through synaptic weights.Neuron models determine how incoming spikes change membrane state, trigger firing, and affect post-spike behavior.Source: §2.1 · p. 3

2.1.1 Neuron Models in SNNs

• LIF integrates input with leakage, thresholding, and reset, while Izhikevich and AdEx models support richer intrinsic firing dynamics.AdEx combines exponential spike initiation with adaptation; Izhikevich uses a recovery variable to generate diverse firing behaviors.Source: §2.1.1 · pp. 4–5

2.1.2 Learning in SNNs

• Surrogate-gradient backpropagation approximates the spike derivative during training, whereas evolutionary optimization searches candidate networks without gradients.Evolutionary optimization repeatedly evaluates candidate networks, making scalability challenging as task and network complexity grow.Source: §2.1.2 · p. 5, Evolutionary Learning · p. 6

Evolutionary Learning.

• Evolutionary learning is compatible with discrete spikes and difficult neuron dynamics, but its repeated candidate evaluations impose computational costs.The paper contrasts its population-based search with gradient-based methods that rely on surrogate approximations.Source: Evolutionary Learning · p. 6

2.2 Privacy in SNNs

• Prior work finds that SNN privacy varies with data modality, simulation latency, optimization, neuron models, temporal dynamics, and attack settings rather than being uniform.Studies report both lower and higher SNN vulnerability than ANNs under different evaluated settings.Source: §2.2 · pp. 7, 9
• Biologically inspired Poisson Burst and Delayed Burst patterns produce distinct privacy–performance tradeoffs within LIF-based SNNs, but alter several properties at once.Those properties include spike count, timing, onset, stochasticity, and temporal organization, so prior comparisons do not isolate the mechanism.Source: §2.2 · p. 8

2.3 Membership Inference Attacks(MIAs)

• Membership inference studies whether model behavior distinguishes training samples from non-members, and this study uses a consistent black-box shadow-model attack across conditions.The attack classifier learns from member and non-member prediction outputs generated by a shadow model.Source: §2.3 · pp. 9–10

3.1 Datasets and Model Architecture

• Across benchmarks, model architectures remain fixed within each dataset while temporal dynamics or the experimental factor changes.The study includes MNIST, Fashion-MNIST, CIFAR-10, Iris, and Breast Cancer.Source: §3.1 · p. 11

3.2 Biologically Inspired Temporal Dynamics

• Rate encodes intensity through spike frequency, Poisson-Burst through stochastic burst activity, and Delayed-Burst primarily through burst onset latency.The burst schemes alter spike encoding while retaining the downstream LIF architecture.Source: §3.2 · pp. 12–13, Figure 1 · p. 12

3.3.1 Backpropagation Through Time (BPTT):

• BPTT trains the SNN end to end across simulation steps, using a Fast Sigmoid surrogate gradient for non-differentiable spike generation.Output spike counts over T = 10 steps determine the cross-entropy loss.Source: §3.3.1 · p. 13

3.3.2 Evolutionary Learning:

• Evolutionary learning uses EONS to select, recombine, and mutate candidate networks based on training accuracy, but is evaluated only on Iris and Breast Cancer.The dataset restriction reflects the computational cost of repeatedly evaluating the population.Source: §3.3.2 · pp. 13–14

3.4 Attack and Evaluation Metrics

• A black-box attack trains class-specific RBF SVMs on pooled shadow-model representations and evaluates membership leakage with AUC alongside test accuracy.AUC of 0.5 indicates random guessing; values nearer 0.5 represent lower observable leakage under this attack.Source: §3.4 · pp. 14–15

4.1 Homogeneous Temporal Dynamics

• The homogeneous baseline assigns every input feature the same temporal dynamic to isolate firing behavior before testing mixed configurations.The architecture, LIF parameters, training procedure, and evaluation protocol remain unchanged across homogeneous conditions.Source: §4.1 · p. 15

4.1.1 Results and Analysis

• Rate provides the highest utility, while Poisson-Burst and Delayed-Burst generally reduce leakage relative to Rate, with accuracy costs that vary by dataset.On F-MNIST, Poisson-Burst reduces MIA AUC from 0.534 to 0.502; on Breast Cancer, Delayed-Burst reduces it from 0.543 to 0.500.Source: §4.1.1 · pp. 15–16, Figure 3 · p. 16

4.2 Heterogeneous Temporal Dynamics

• Heterogeneous temporal dynamics assign fixed input dimensions to Rate, Poisson-Burst, or Delayed-Burst representations in specified proportions.The assignment remains fixed across training, testing, and membership-inference evaluation.Source: §4.2 · pp. 16–17

4.2.1 Results and Analysis

• Heterogeneous dynamics often reduce leakage, but increasing the burst proportion does not consistently improve privacy and can impose utility costs.On F-MNIST, heterogeneous configurations bring MIA AUC from the Rate baseline of 0.543 to approximately 0.500–0.504.Source: §4.2.1 · pp. 17–18, Figure 4 · p. 18

5.1 Temporal Jitter

• Jitter selects 20%, 50%, or 100% of spikes for one-timestep shifts while preserving spike count and the overall firing pattern.The controlled comparison leaves the network and evaluation protocol unchanged.Source: §5.1 · pp. 19–20, Figure 6 · p. 20

5.1.1 Result and Analysis

• On F-MNIST, 100% jitter reduces Poisson-Burst accuracy by approximately 10.7% versus 4.3% for Rate, while privacy responses remain non-monotonic.Jitter consistently reduces classification utility, but does not provide a reliable privacy benefit.Source: §5.1.1 · p. 20, Figure 7 · p. 21, Figure 8 · p. 21

5 Stochasticity and Privacy

• Timing, input, and spike perturbations do not consistently reproduce the privacy differences among temporal dynamics, despite utility degradation.Jitter and input noise produce inconsistent leakage changes, while spike noise does not change leakage in a predictable direction.Source: §5.1.1 · p. 20, Figure 8 · p. 21, Figure 10 · p. 22

5.2 Input Noise

• Gaussian noise is added to normalized inputs before spike generation, at σ levels of 0.10, 0.25, and 0.50.The perturbed inputs are then encoded using Rate, Poisson-Burst, or Delayed-Burst dynamics.Source: §5.2 · pp. 21–22

5.2.1 Result and Analysis

• At 50% input noise, Poisson-Burst on FMNIST exhibits approximately 12.1% relative accuracy degradation, while leakage changes remain inconsistent.The three dynamics do not converge toward common privacy behavior as input noise increases.Source: Figure 9 · p. 22, Figure 10 · p. 22, §5.2.1 · pp. 22–23

5.3 Spike Noise

• Spike noise randomly deletes or inserts events after spike generation and before the downstream LIF network, with other pipeline components unchanged.Each train undergoes either addition or removal, not both.Source: §5.3 · p. 23

5.3.1 Result and Analysis

• At 50% spike noise, Poisson-Burst on F-MNIST exhibits approximately 5.1% relative accuracy degradation, while leakage fluctuates without a consistent direction.MNIST accuracy remains comparatively stable across noise levels.Source: §5.3.1 · pp. 23–24, Figure 11 · p. 24, Figure 12 · p. 24

6 Intrinsic Neuron Dynamics and Privacy

• AdEx shifts temporal diversity from externally constructed input spike trains to firing regimes that emerge from the neuron’s internal dynamics.This contrasts with earlier Poisson-Burst and Delayed-Burst inputs processed by LIF neurons.Source: §6 · p. 25

6.1 Adaptive Exponential Integrate-and-Fire(AdEx) Neurons

• AdEx combines exponential spike initiation with adaptation, allowing intrinsic parameter changes to produce multiple firing regimes.The model is used to examine neuronal dynamics within a trainable SNN, rather than modifying input spike trains alone.Source: §6.1 · pp. 25–26, §6 · p. 25

6.1.1 Experimental Design for Intrinsic Neuron Dynamics

• Changing AdEx’s adaptation and reset parameters yields Rate, Burst, and Delayed-Burst regimes, with delayed bursting producing sparser, later activity.Burst firing forms repeated clusters; delayed burst shifts concentrated activity later in the sequence.Source: Figure 13 · p. 26, §6.1.1 · p. 27

6.1.2 Result and Analysis

• AdEx produces lower MIA AUC than LIF across five datasets and all three firing regimes while maintaining or improving classification performance.The privacy reduction is especially visible on CIFAR-10, Iris, and Breast Cancer.Source: Figure 14 · p. 27, Figure 15 · p. 28, §6.1.2 · p. 28

7.1.1 Result and Analysis

• On Iris, Delayed-Burst causes 27.3% relative accuracy degradation from the Rate baseline under evolutionary learning, versus 13.8% under backpropagation.On Breast Cancer, backpropagation retains accuracy under both burst-based dynamics.Source: §7.1.1 · p. 30
• Under backpropagation, MIA AUC falls from Rate to Poisson-Burst to Delayed-Burst, while evolutionary-learning AUC stays near 0.5 across dynamics.Because evolutionary Rate already approaches random-guessing attack performance, burst-based privacy effects there are inconclusive.Source: §7.1.1 · p. 30, Figure 17 · p. 31

7.2.1 Result and Analysis

• DPSGD perturbs parameter updates rather than spike representations, and its effects depend on where noise enters and on each dynamic’s intrinsic stochasticity.The authors attribute Poisson-Burst’s persistent accuracy deficit to its random burst occurrence and size compounding with injected noise.Source: §7.2.1 · pp. 31–32
• As ϵ increases, Delayed-Burst recovers to Rate accuracy on both datasets, while Poisson-Burst remains approximately 7 percentage points below Rate.At strict privacy budgets, the non-private ordering is preserved, with Delayed-Burst most affected.Source: §7.2.1 · p. 31, Figure 18 · p. 32

• Burst-based dynamics generally lower membership leakage than Rate but lower accuracy; moderate mixtures retain much of Rate utility, while stronger heterogeneity can reduce accuracy without privacy gain.The privacy effect depends on how information is distributed across temporal patterns, not simply on adding more bursting.Source: §8 · pp. 32–33
• Noise effects depend on intervention stage: representation perturbations and DPSGD produce distinct responses, including Delayed-Burst recovery as DPSGD constraints are relaxed.Across perturbations, increasing stochasticity does not reproduce a common or progressively stronger privacy effect, nor explain the differences among temporal dynamics by itself.Source: §8 · p. 33
• AdEx consistently reduces leakage relative to LIF while preserving or improving classification performance across the evaluated firing regimes.Intrinsic membrane evolution and adaptation shape activity inside the network, beyond temporal patterns imposed at the input.Source: §8 · p. 33
• Under backpropagation, burst patterns generally reduce leakage relative to Rate, but under evolutionary learning Rate is already near chance, leaving little privacy gain as utility declines.The privacy benefit of a temporal dynamic is conditioned by the learning mechanism.Source: §8 · p. 33
• Membership leakage emerges from interactions among temporal representation, stochasticity, intrinsic neuron dynamics, and learning, so privacy-aware design should consider these dimensions jointly.The stated objective is to reduce sample-specific distinguishability while preserving task-relevant temporal information.Source: §8 · p. 34
• The analysis uses a black-box shadow-model MIA, a limited set of temporal dynamics and two neuron models, and evaluates evolutionary learning only on smaller tabular datasets.The attack comparison does not characterize all forms of information leakage.Source: §8 · p. 34

• The study separates temporal representation, stochasticity, intrinsic neuron dynamics, and learning to investigate the origins of SNN membership leakage.Source: §9 · p. 34
• Adaptive neurons reduce leakage while preserving or improving classification performance, whereas input-imposed temporal patterns reduce leakage at an accuracy cost.Source: §9 · p. 34
• Future work will track membership information across time and network depth and extend evaluation to more neuron models, learning rules, neuromorphic datasets, and attack strategies.Source: §9 · p. 35

• Funding came from NSF Award Nos. 2539714 and 2319619, and U.S. Department of Energy Award No. DE-SC0026260.Source: Funding · p. 35