Memristive hardware effects shape privacy risks in spiking neural networks
Hardware-Aware Model Inversion in Memristive Spiking Neural Networks
Cryptography and SecurityEmerging TechnologiesNeural and Evolutionary Computing
Summary
Spiking neural networks powered by special memory hardware promise energy savings but also raise privacy concerns. This paper studies whether imperfections in this hardware make it easier or harder to steal information from these networks. The authors develop a new method to test how different hardware glitches affect privacy risks and find that some hardware errors can increase the chance of sensitive information being leaked. They show that hardware quirks do not always protect privacy and that privacy risks depend on the specific hardware state, not just model accuracy.
What this means in practice
- •For hardware engineers: Evaluate and improve security risks of memristive spiking neural network hardware by understanding how device variability impacts information leakage.
- •For machine learning platform developers: Design better privacy-aware deployment methods for spiking neural networks on non-ideal memristive hardware based on hardware-aware model inversion insights.
Authors
Pablo Sorrentino, Fernando M. Quintana, Erika Covi, Fatih Turkmen
Abstract
Hardware-accelerated spiking neural networks (SNNs) implemented on memristive crossbar arrays offer significant gains in energy efficiency, while device variability and analog noise are sometimes assumed to hinder information extraction. However, whether these hardware effects improve, preserve, or degrade privacy after deployment remains largely unexplored. Therefore, we ask whether model-inversion leakage characterized on an SNN remains representative after the same model is mapped to a non-ideal memristive substrate, and how hardware non-idealities and reliability faults affecting synapses, neuron thresholds, and spike processing reshape that leakage. To study this problem, we introduce Spiking Domain Model Inversion (SDMI), an inversion method that combines Expectation over Transformation (EOT) with surrogate gradients to optimize inputs through stochastic analog behavior and non-differentiable spiking dynamics. We use SDMI consistently across the SNN model, its memristive SNN, and the same memristive SNN under additional hardware perturbations. Across four datasets, reconstruction leakage does not vary monotonically with model accuracy or hardware variability. At comparable accuracy levels, neuron-threshold perturbations increase reconstruction fidelity, measured by SSIM, by up to 51.8%, whereas spike-level perturbations primarily degrade utility without consistently improving reconstruction. Weight noise, in contrast, reduces leakage under the same inversion procedure. These results show that hardware variability is not inherently privacy-preserving: model inversion leakage in memristive SNNs depends on the hardware state and cannot be inferred from model accuracy alone.