Spike preserving temporal triggers enable stealthy backdoor attacks on spiking neural networks
T-Backdoor: Exploiting Temporal Redundancy in Neuromorphic Data for Spike-preserving Backdoor Attacks on SNNs
Cryptography and Security
Summary
Backdoor attacks secretly manipulate AI models to make them behave wrongly when given special triggers. This paper shows that spiking neural networks, a type of brain-inspired AI, can be attacked using only changes in timing of signals, without altering the signal patterns themselves. These timing-only tricks are harder to detect and can fool the network almost every time while keeping normal performance high. The authors tested this on multiple special datasets and found that current defense methods struggle to catch these attacks.
What this means in practice
- •For security engineers: Evaluate and improve defenses for spiking neural networks against timing-based backdoor attacks using temporal triggers only.
- •For embedded system developers: Understand vulnerabilities in neuromorphic AI devices that rely on spiking neural networks to prevent stealthy timing-based backdoor manipulations.
Authors
Abdullah Arafat Miah, Kevin Vu, Yu Bi
Abstract
Backdoor attacks are a serious security threat to deep neural networks (DNNs) and remain largely underexplored for spiking neural networks (SNNs). Existing attacks primarily introduce spatiotemporal triggers that induce deviations in the spike distribution of poisoned samples relative to their clean counterparts. To address this limitation, this work proposes a novel backdoor attack on SNNs, termed \textbf{T-Backdoor}, which operates using purely temporal triggers such as \textit{Rate}, \textit{Latency}, and \textit{Jitter} without introducing any spatial perturbation, making the shift in spike distributions significantly harder to detect. Through extensive experiments on three benchmark neuromorphic datasets: N-MNIST, CIFAR10-DVS, and N-Caltech101, and evaluation against seven baseline backdoor defense methods, we demonstrate that T-Backdoor achieves a near-perfect 100\% attack success rate (ASR) in both single target and multi target settings with only minor degradation in clean accuracy, while remaining robust against existing backdoor detection and mitigation techniques. The codes are available at https://github.com/SiSL-URI/T-Backdoor .