Temporal Poisoning: Clean-Label Backdoors via Event Redistribution in SNNs

As Spiking Neural Networks (SNNs) gain traction in safety-critical edge AI, understanding their security vulnerabilities is paramount. This paper investigates whether SNNs are susceptible to clean-label backdoor attacks—a type of poisoning where an attacker embeds a trigger into training data without changing the original labels. Unlike traditional image-based DNNs, SNNs process asynchronous event streams, creating a unique 'temporal' attack surface that this research aims to exploit.

The authors propose a temporal poisoning method that modifies the timestamps of events in a training stream while keeping the total count of events per pixel and polarity identical. By applying specific transformations—such as concentrating events into a narrow time window, front-loading them, or shifting them—the attacker alters the internal spiking trajectories of the network without changing the 'rate frame' (the time-collapsed representation). The researchers evaluate this attack across three neuromorphic datasets (N-MNIST, DVS-Gesture, and CIFAR10-DVS) using both convolutional SNNs and spiking transformers (SpikformerLite).

The study demonstrates that temporal poisoning is highly effective, reaching an attack success rate (ASR) of 1.00 in the strongest configurations. Because the transformation preserves the aggregate event count, the attack is completely invisible to any defense mechanism that collapses the time axis before inspection. However, the authors note that the attack's success and its impact on the model's clean accuracy are sensitive to the choice of trigger and the specific architecture. While the attack evades spatial-based defenses, the authors show that it can be detected by a model-free approach that monitors the per-step event mass, highlighting the boundary of the attack's stealth.

This work is the first to demonstrate clean-label backdoor attacks on SNNs, proving that the temporal dynamics of spiking neurons can be manipulated to create hidden vulnerabilities. It underscores that security in neuromorphic systems cannot rely on traditional spatial-based defenses, as the temporal structure of the data provides a sophisticated, often overlooked, vector for adversarial manipulation.