PaperlayerView exact revision on arXiv

Source-linked AI summary

Spiking Neural Networks Are Harder to Steal: A Benchmark Study of Model Stealing Attacks

Ayana Moshruba, Maryam Parsa

arXiv:2610.36298v1cs.AI

TL;DR

Model stealing can replicate a model’s decision behavior through black-box queries, yet evidence has focused largely on conventional ANNs rather than SNNs. This work benchmarks four attacks against SNNs and ANN counterparts across three datasets, finding consistently lower agreement and adversarial transferability for SNNs.

  • Problem

    Model-stealing research has focused largely on ANNs, leaving limited investigation of whether architectures with different computational properties resist black-box functional replication.

    Source: §1 · p. 1

  • Method

    The paper benchmarks four model-stealing attacks against SNNs and ANN counterparts on MNIST, FMNIST, and CIFAR-10, evaluating fidelity, adversarial transferability, and query efficiency.

    Source: §1 · p. 2

  • Results

    SNN targets show 10–20% lower surrogate agreement and 15–25% lower adversarial transferability than ANN targets across the evaluated attacks and datasets.

    Source: §1 · p. 2

  • Takeaways & Limitations

    Sparse spike-based communication and temporal membrane dynamics are associated with SNN input-output behavior that is harder to approximate through black-box queries.

    Source: §1 · p. 2

Abstract

from arXiv · show

Machine learning models deployed behind query interfaces expose more than their predictions, because an adversary can use those predictions to rebuild the model itself. Model stealing attacks (MSAs) exploit this exposure by training a surrogate model that replicates the decision behavior of a target through black-box queries alone, without access to its parameters or training data. These attacks are well characterized for conventional artificial neural networks (ANNs), yet spiking neural networks (SNNs) process information in a fundamentally different way. SNNs communicate through sparse, discrete spikes, and their outputs depend on membrane potentials that evolve over time rather than on a static mapping from input to output. This temporal mode of computation suggests that the decision behavior of an SNN may be harder to reconstruct from its responses. This work tests that possibility by benchmarking four representative MSAs, namely the Papernot, Tram\`er, T-RND, and color perturbation attacks, against SNNs and their ANN counterparts on MNIST, Fashion-MNIST, and CIFAR-10. Across every attack and dataset, SNNs prove consistently more difficult to steal. Surrogates of SNNs achieve 10% to 20% lower agreement with the target model and 15% to 25% lower adversarial transferability than surrogates of ANNs. We attribute this resistance to the way SNNs compute, as their spike-based and time-dependent dynamics yield decision boundaries that ANN-based surrogates struggle to approximate, even under large query budgets. These findings extend the known resilience of SNNs beyond attacks on training data to the replication of model functionality, strengthening the case for neuromorphic architectures in security-sensitive applications.

1 Introduction

Model stealing attacks can reconstruct a model’s decision behavior through black-box queries, but their effectiveness has been studied largely for ANNs. This work benchmarks attacks against SNNs and ANNs, finding lower extraction fidelity and adversarial transferability for SNNs across the evaluated settings.

1 Introduction

  • Black-box model stealing can expose model intellectual property, and extracted models can serve as proxies for adversarial-example transfer and membership-inference attacks.The attacker uses query responses to train a surrogate without access to the target’s parameters, training data, or architecture.Source: §1 · p. 1
  • SNNs encode information in sparse, timed spike trains and use membrane dynamics that depend on input history, unlike ANNs’ dense, real-valued activations.Prior privacy work examined membership inference and model inversion, but whether those advantages extend to functional replication through model stealing had not been evaluated.Source: §1 · p. 1
  • SNN targets show 10–20% lower surrogate agreement and 15–25% lower adversarial transferability than ANN targets across four attacks and three datasets.The reported resistance persists even with large query budgets and when the surrogate is also an SNN.Source: §1 · p. 2
  • The benchmark evaluates Papernot, Tramèr, T-RND, and color perturbation attacks on MNIST, FMNIST, and CIFAR-10 using fidelity, adversarial transferability, and query efficiency.Fidelity includes test and random-uniform agreement; transferability includes targeted and non-targeted metrics.Source: §1 · p. 2
  • ANN surrogates reach high accuracy within a few thousand queries, while SNN surrogates improve gradually even at large query budgets.The paper describes this as slower convergence during extraction.Source: §1 · p. 2

2 Background

Prior work reports reduced data-centric privacy vulnerabilities for SNNs, but whether their decision functions are harder to steal through black-box queries remains unexamined. The background describes SNN temporal dynamics and outlines iterative model-stealing strategies.

2 Background

  • Prior SNN privacy work reports lower membership-inference success and greater resistance to input reconstruction, but had not examined model-function replication through queries.This gap motivates studying whether SNN properties limit extraction of decision functions.Source: §2 · p. 2

2.1 Spiking Neural Networks (SNN)

  • SNNs encode information in sparse spike events over time, with membrane potentials integrating inputs and triggering spikes at a threshold.Their input-output behavior depends on evolving internal dynamics and prior activity, which may require surrogates to capture temporal dependencies.Source: §2.1 · p. 2

2.2 Model Stealing Attacks (MSA)

  • Papernot iteratively queries the target and uses substitute-model gradients to augment the input set before retraining the surrogate.The attacker computes gradients with respect to the substitute, not the inaccessible target.Source: §2.2.1 · p. 3
  • Tramèr generates queries near decision boundaries, while T-RND adds targeted perturbations toward randomly selected classes to broaden decision-space coverage.Both approaches retrain on oracle-labeled samples until the query budget is exhausted.Source: §2.2.1 · p. 3, §2.2.3 · p. 3
  • Color perturbation generates queries through random color or intensity transformations rather than gradient-based boundary information.The transformations vary input statistics, such as brightness, contrast, or channel scaling, while preserving semantic structure.Source: §2.2.4 · p. 4, Figure 3 · p. 4

3 Experimental Setup

The experiments compare ANN and SNN extractability across three image datasets using matched attack settings and multiple measures of surrogate fidelity and behavioral alignment.

3 Experimental Setup

  • Experiments compare ANN and SNN targets on MNIST, FMNIST, and CIFAR10 while holding datasets, training procedures, and attack configurations fixed.Source: §3 · p. 4

3.1 Model Architecture & Datasets

  • CNN targets use two convolutional layers and fully connected layers, while SNNs use a similar backbone with LIF neurons and rate-encoded inputs over 25 time steps.SNN outputs use the final membrane potential; training uses surrogate gradients, while all targets are trained from scratch for 50 epochs.Source: §3.1 · pp. 4–5

3.2 Attack Setup

  • The four attacks generate synthetic queries through Jacobian-based augmentation, boundary-focused or targeted iterative FGSM, or direct color perturbations.Attacks start with 10 natural samples per class, proceed for up to 10 duplication rounds or 102,400 queries, and share the same budget and training schedule across target types.Source: §3.2 · p. 5

3.3 Evaluation Metrics

  • Test agreement measures surrogate-target prediction matches on unseen in-distribution samples, while random uniform agreement measures matches on inputs sampled across the normalized range.Figure 4 presents these as in-distribution fidelity and global decision alignment, respectively.Source: §3.3 · p. 5, Figure 4 · p. 6
  • Non-targeted transferability measures whether surrogate-crafted adversarial examples cause target misclassification, and targeted transferability measures whether they drive the target toward a selected label.Higher non-targeted values indicate stronger alignment in vulnerability structure; higher targeted transferability indicates the surrogate captures fine-grained directional structure.Source: §3.3 · p. 6

4 Evaluation

Across the evaluated attacks and datasets, SNN targets are harder to extract than ANN targets: their surrogates show lower agreement and adversarial transferability. The section also examines global agreement, query efficiency, and how target and substitute architectures affect these outcomes.

4 Evaluation

  • The evaluation measures fidelity, adversarial transferability, and query efficiency, using ANN-based surrogates for both ANN and SNN targets in the reported results.Fidelity measures surrogate-target matching, transferability tests whether the surrogate captures target decision boundaries and vulnerabilities, and query efficiency reflects extraction cost.Source: §4 · p. 6

4.1 Fidelity of Model Extraction

  • Across datasets and attacks, ANN targets have higher test agreement than SNN targets, which remain approximately 10–20% lower even against stronger attacks.Agreement decreases for both architectures as dataset complexity rises from MNIST to CIFAR10, while their relative gap remains stable.Source: §4.1.1 · p. 6
  • On randomly sampled inputs, SNN agreement is approximately 15–25% lower than ANN agreement, indicating that extraction aligns more with the data distribution than with global decision structure.TRAMER and PAPERNOT rank above other methods, but still struggle to achieve strong global alignment for SNNs.Source: §4.1.2 · p. 6

4.2 Adversarial Transferability

  • SNN targets show lower adversarial transferability than ANN targets in both non-targeted and targeted evaluations, with the gap persisting across attacks and datasets.Non-targeted SNN transfer is roughly 15–25% lower; targeted transfer is approximately 20–30% lower, typically falling within 0.20–0.40 across datasets.Source: §4.2.1 · pp. 6–7, Figure 5 · p. 7, §4.2.2 · p. 7

4.3 Query Efficiency

  • For Papernot and Tramèr attacks on FMNIST, ANN targets exceed 90% accuracy with approximately 2k–6k queries, while SNN targets need more queries and remain approximately 10–20% lower.Across budgets up to 100k queries, ANN performance plateaus early and SNN performance improves more gradually.Source: Figure 6 · p. 7, §4.3 · p. 7

4.4 Effect of Target and Substitute Architectures

  • On MNIST, ANN and SNN substitutes achieve approximately 0.90–0.91 agreement with ANN targets and 0.88–0.90 with SNN targets, but transferability is lower for SNN targets regardless of substitute type.For SNN targets, transferability is approximately 0.23–0.21 across substitute types; the results indicate target architecture plays a dominant role in transferability.Source: §4.4 · pp. 7–8

5 Conclusion

Across the evaluated attacks, query budgets, and datasets, SNNs show lower surrogate agreement and adversarial transferability than ANNs. The conclusion attributes this behavior to SNN computation and identifies temporal-tailored attacks and neuron and encoding choices as future research directions.

5 Conclusion

  • Across evaluated attacks, query budgets, and datasets, SNNs consistently show lower surrogate agreement and adversarial transferability than ANNs.The conclusion attributes this behavior to sparse spike-based communication and temporal membrane dynamics, and describes SNNs as architecturally privacy-resilient models, not by design but as a consequence of their computational substrate.Source: §5 · p. 8
  • Future work may explore attacks tailored to temporal representations and test how neuron models and encoding schemes affect model extractability.Source: §5 · p. 8
  • The conclusion places model-stealing resistance alongside prior privacy findings on membership inference and model inversion.It frames this as an emerging picture of SNN privacy resilience.Source: §5 · p. 8

Related papers

Loading 2610.36298v1…