{"id":"f0454c59-6b48-46fa-b48f-30a44d75d60f","arxiv_id":"2505.04034","paper_version":1,"verdict":"CONDITIONAL","confidence":"MODERATE","novelty_score":4.0,"correctness_risk":"medium","formal_verification":"none","parameter_count":7,"one_line_summary":"Poisson-Burst and Delayed-Burst input encodings can lower membership-inference attack success in LIF spiking networks, with Poisson-Burst keeping accuracy close to rate coding.","lead":"The paper proposes two ways to convert inputs into spike trains for spiking neural networks, one using random bursts and one using delayed bursts. It reports that these encodings reduce privacy leakage from membership inference attacks, sometimes at a small cost in accuracy.","discovery_kind":"new_method","skeptic_critique":{"model":"deepseek-v4-flash","headline":"MIA protocol in Section III-B is internally contradictory: a target trained on the full dataset has no non-members, so the reported privacy AUCs cannot be interpreted as membership leakage.","rationale":"The reader's weakest assumption is exactly the load-bearing issue I would identify. The privacy claim is the paper's central novel assertion, and the MIA protocol described in Section III-B is internally contradictory: a target trained on the full dataset leaves no non-member samples, while the shadow model is claimed to be disjoint from the target's training data. This is not a missing detail but a logical obstruction to interpreting any AUC in Table III as membership leakage. I also considered secondary weaknesses—small AUC gaps relative to standard deviations, absent code, and no significance testing—but they would matter even after fixing the protocol; the protocol flaw is primary. Because the flaw is fixable by rerunning with an explicit disjoint split, and because the accuracy, efficiency, and transfer results might still stand independently, the reader's CONDITIONAL verdict remains appropriate. I see no reason to move to REJECT or to upgrade the verdict without the requested clarification.","tokens_in":11235,"tokens_out":5405,"duration_ms":57121,"concrete_test":"Ask the authors to release the exact dataset splitting code used for Table III. The decisive check is to rerun the MIA protocol with an explicit split: target model trained on 80% of each dataset; shadow model trained on a disjoint 20%; attack model trained on shadow features labeled by shadow membership; AUC evaluated on target's held-out 20% versus its training 80%. If Rate/Poisson-Burst/Delayed-Burst AUC differences shrink to within the reported standard deviations (e.g., MNIST 0.525±0.010 vs 0.519±0.012), the privacy claim is unsupported. If the differences persist under the corrected protocol, the concern is resolved.","verdict_should_be":"UNCHANGED","load_bearing_attack":"The central privacy claim—that Poisson-Burst lowers MIA AUC by up to 5% and Delayed-Burst lowers it further—rests entirely on the membership inference evaluation in Section III-B. That protocol, as written, cannot produce valid measurements. The text says the target model is 'trained on the full dataset' and also that the shadow model is 'trained on a randomly selected 20% subset of the dataset, disjoint from the target model's training data.' If the target used the full dataset, no sample is a non-member for the target, so the attack AUC in Table III is undefined. If the intended design is that the target uses a proper subset and the shadow uses a disjoint subset, that split is never specified, and the second sentence of the same paragraph ('disjoint 80% subset') contradicts the first. Because the attack model is trained on shadow-member/shadow-nonmember features and then applied to target predictions, a well-defined target member/nonmember partition is required for the AUC to measure membership leakage. Without it, the reductions from 0.543 to 0.511 (FMNIST) or 0.545 to 0.489 (Breast Cancer) cannot be attributed to privacy protection rather than to an artifact of an invalid attack setup. This is the load-bearing link between the proposed temporal dynamics and the paper's headline privacy result.","agreement_with_reader":"agree"},"referee_report":{"model":"deepseek-v4-flash","summary":"The manuscript proposes two input-level temporal spike encodings for LIF-based SNNs—Poisson-Burst and Delayed-Burst—motivated by Izhikevich-type burst and latency dynamics. It compares these against standard rate-based encoding on MNIST, FMNIST, CIFAR-10, Iris, and Breast Cancer, measuring classification accuracy, membership-inference-attack AUC, resource usage on MNIST, and transferability from MNIST to FMNIST. The central claim is that Poisson-Burst maintains accuracy close to rate encoding while lowering resource overhead and MIA AUC, while Delayed-Burst provides stronger MIA resistance at a larger accuracy cost.","tokens_in":11528,"tokens_out":4352,"duration_ms":42889,"significance":"The question whether simple input-level stochastic encodings can improve privacy/utility/resource trade-offs in LIF SNNs is timely and potentially useful. The paper evaluates multiple dimensions and includes a transfer-learning probe, which is a strength. If the privacy results were reliable, the Poisson-Burst result would be a practical, easy-to-adopt contribution. However, the validity of the privacy comparisons currently rests on an internally inconsistent membership-inference setup, and most headline quantitative claims lack error bars or significance testing, so the significance is conditional on a corrected protocol.","major_comments":[{"comment":"The MIA protocol is self-contradictory and cannot produce the reported AUCs as stated. The text first says 'The target model is trained on the full dataset,' then says the shadow model is 'trained on a randomly selected 20% subset of the dataset, disjoint from the target model's training data,' while the preceding sentence mentions a 'disjoint 80% subset.' If the target truly trains on the full dataset, there are no non-members for the target, so the IN/OUT labels are undefined and the AUC values in Table III do not measure membership leakage. The authors must specify a well-defined member/non-member partition for the target, train the shadow model on an analogous disjoint split, and report attack AUC on a target test set with known membership labels. This is the load-bearing step for the paper's privacy claim.","section":"§III-B, Fig. 2"},{"comment":"Several reported privacy differences are smaller than or comparable to the reported standard deviations, e.g., MNIST Rate 0.525±0.010 vs. Poisson-Burst 0.519±0.012, FMNIST Poisson-Burst 0.511±0.012 vs. Delayed-Burst 0.511±0.013, and CIFAR-10 Rate 0.541±0.016 vs. Delayed-Burst 0.525±0.016. The conclusion that both dynamics consistently 'improve MIA resilience' is not supported without multi-seed distributions, per-dataset significance tests, or paired comparisons. The same issue affects test accuracies in §V-A, which are reported without any variability measure.","section":"§V-B, Table III"},{"comment":"The computational-efficiency claim ('lower resource overhead' in the abstract) is supported only by qualitative statements and a single MNIST measurement, with no numerical values reported in Figure 5 and no error bars. The 'approximately 10–15%' reductions mentioned in the introduction do not appear in a results table or in a description of how GPU power, GPU memory, and CPU memory were sampled. Please report actual measured values, error bars, and the measurement procedure; otherwise the efficiency comparison is not testable.","section":"§V-C, Fig. 5"},{"comment":"The transferability conclusion is based on one source-target pair (MNIST → FMNIST) with single accuracy and AUC values. The claim that 'all spike dynamics exhibit improved MIA resilience following transfer' rests on AUC differences of roughly 1–4.6% without variability information. This is a useful pilot, but it should be framed as preliminary or supported by additional transfer pairs and repeated runs.","section":"§V-D, Table IV"}],"minor_comments":[{"comment":"There is a typo: 'both both implemented using the same architecture' should be 'both implemented using the same architecture.'","section":"§III-B"},{"comment":"The statement that parameter values were 'selected through empirical tuning and visual inspection of spike patterns' is not sufficient for reproducibility; please list all parameter values per dataset and ideally include a small sensitivity analysis for λ, τ, ISI, and the clipping ratio.","section":"§IV-B"},{"comment":"Reference [2] uses the placeholder 'Author(s)' and reference [41] is an incomplete citation to the snnTorch tutorial; both should be completed before publication.","section":"References"},{"comment":"The text says 'The simulations run for T = 100 discrete timesteps,' but the rate-based encoding is not described in the same detail as the burst dynamics; please specify how rate encoding maps normalized inputs to spikes over the 100 timesteps.","section":"§IV-A"}],"recommendation":"major_revision","confidential_remarks":"The most serious issue is the MIA protocol in Section III-B; if the corrected protocol still yields AUC reductions, the paper could make a useful contribution. I would advise against accepting before a re-run with proper shadow/target splits and statistical reporting."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"Short version: the paper is a solid empirical comparison of two input-level spike encodings, but the MIA protocol in Section III-B is self-contradictory, and without it the main privacy claim collapses. The rest is worth reading.\n\nWhat's new: Poisson-Burst and Delayed-Burst are concrete stochastic encodings built from burst statistics and geometric delay sampling, applied at the input of a standard LIF SNN. The comparison across accuracy, MIA AUC, transfer, and resource use on five datasets is not in the cited literature. The writing is clear and the transfer experiment is a good idea.\n\nThe load-bearing problem is the MIA setup. The text says the target model is trained on the full dataset, then the shadow model is trained on a 20% subset that is 'disjoint from the target model's training data,' and also mentions an 80% subset. If the target saw the full dataset, no sample is a non-member, so the attack AUC is undefined. The numbers in Table III therefore cannot be read as membership leakage. This is not a footnote; it is the entire basis for the privacy improvement claim. The accuracy and efficiency results are fine, but the privacy gains of 2–6.5% are not established.\n\nOther issues are minor by comparison: test accuracies lack error bars, several AUC differences fall within the reported standard deviations, resource usage is reported for MNIST only, and the encoding parameters are tuned by visual inspection without sensitivity analysis. Self-citations are relevant, not a problem.\n\nI would not cite this as evidence about privacy until the MIA protocol is fixed and the experiments re-run. The idea may have legs, and the authors should have a chance to correct it. As submitted, this is a desk reject with a clear path to a stronger revision.","headline":"The paper's MIA protocol is internally contradictory, so the headline privacy result is not supported; the encoding comparison itself is useful but needs a corrected setup.","tokens_in":12056,"tokens_out":4500,"would_cite":false,"duration_ms":43809,"reading_group":"maybe","serious_thinker":"no","would_accept_peer_review":false},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"Input-level burst encodings let LIF spiking networks resist membership inference while keeping accuracy close to rate-based baselines.","keywords":["spiking neural networks","Izhikevich neuron model","membership inference attacks","temporal spike dynamics","Poisson-Burst encoding","Delayed-Burst encoding","privacy","transfer learning"],"falsifier":"Re-run the membership-inference experiment with target and shadow models trained on genuinely disjoint halves of the same dataset under identical training protocols; if the attack AUC gap between Rate and Poisson-Burst disappears under a sound split, the central privacy claim is refuted. Alternatively, test whether the reported AUC differences persist when the attack model sees logits or losses instead of membrane potentials.","tokens_in":1872,"feed_emoji":"⚡","tokens_out":2284,"duration_ms":87504,"temperature":0.7,"pith_summary":"The paper tries to show that biologically plausible spike-timing variability can be moved out of complex neuron models and into the input encoding, so ordinary Leaky Integrate-and-Fire (LIF) spiking networks get some of the robustness and privacy benefits of Izhikevich-style dynamics without paying the computational cost. It introduces two probabilistic encodings, Poisson-Burst, which makes bursts more likely for stronger inputs, and Delayed-Burst, which makes stronger inputs fire earlier, and compares them with standard rate encoding across accuracy, membership-inference attack (MIA) resilience, compute cost, and transfer learning. The headline finding is a favorable privacy-utility trade-off: Poisson-Burst keeps accuracy within about 1-3% of rate encoding while reducing attack AUC by as much as 6.5% in the paper's reported results, and it also lowers GPU power and memory use by roughly 10-15%. A sympathetic reader would care because this places spike-timing statistics as a cheap, plug-in privacy lever for neuromorphic systems, which often run on sensitive data and cannot afford heavy defenses.","feed_headline":"Bursty spike timing cuts membership-attack leakage in SNNs","feed_subtitle":"Poisson-Burst cuts attack AUC by up to 6.5% while keeping accuracy within 1–3% of rate-based LIF networks.","key_machinery":"The load-bearing object is a pair of input-level stochastic spike encoders that graft Izhikevich-style temporal motifs onto standard LIF neurons. Poisson-Burst partitions time into intervals and runs a Bernoulli trial per interval with success probability $f(x_i)$ tied to input intensity; triggered bursts draw their spike count from a Poisson distribution. Delayed-Burst encodes the same intensities into a single burst whose onset delay is sampled from a Geometric distribution centered inversely on input magnitude, with burst size again Poisson. What these transformations do is decouple temporal richness from the neuron model: they inject controlled timing variability into the spike train while keeping LIF's simple threshold dynamics, which lets gradient-based training and the snnTorch implementation proceed unchanged. The stochastic burst structure, rather than total spike count, is what the paper credits for reducing memorization cues, lowering peak resource usage by spreading spikes across time, and preserving reusable features under transfer.","core_discovery":"On its own terms, the paper establishes that the statistics of input spike timing, not just spike count, control how much a spiking network memorizes its training set. Poisson-Burst dynamics divide time into intervals of length $\\tau=10$, trigger a burst with probability proportional to input intensity, and draw the number of spikes in each burst from a Poisson distribution with mean $\\lambda=3$; Delayed-Burst instead draws a burst onset delay from a Geometric distribution whose expectation falls as input intensity rises, then fires a Poisson-sized burst with $\\lambda=4$. In experiments across MNIST, Fashion-MNIST, CIFAR-10, Iris, and Breast Cancer, both dynamics lower MIA AUC relative to Rate dynamics, by as much as 6.5% in the paper's summary, while Poisson-Burst keeps test accuracy within about 1-3% of the rate baseline and reduces GPU power, GPU memory, and CPU memory by roughly 10-15%. Transfer experiments from MNIST to Fashion-MNIST show all dynamics retain most accuracy, with Poisson-Burst degrading by less than 1% and retaining the lowest post-transfer attack AUC. The paper concludes that moderate, stochastic burst-level variability diffuses the output regularities that membership inference exploits, while input-dependent latency shifts disrupt feature extraction enough to explain Delayed-Burst's accuracy cost.","pith_inferences":["An untested corollary of the paper's mechanism is that the Poisson-Burst hyperparameters ($\\lambda$, $\\tau$, and the Bernoulli probability mapping) trace a privacy-accuracy frontier; tuning them per dataset might extend the reported 1-3% accuracy loss closer to zero.","If stochastic spike timing reduces memorization as the paper argues, similar MIA resilience should appear in non-spiking networks when input noise or stochastic activations are added at the same layer, a testable bridge to standard deep learning.","The paper's efficiency explanation predicts that any encoding whose spikes concentrate into fewer time steps, not just Delayed-Burst, raises CPU memory due to buffering; measuring per-timestep activity would confirm or refine that rule.","A deeper consequence left implicit is that temporal variability acts as a regularizer tied to the input statistic rather than the loss, so it could combine with explicit differential-privacy noise rather than substitute for it."],"forward_implications":["Poisson-Burst can replace rate encoding in LIF-based SNNs to reduce membership-inference AUC in the reported results while losing no more than about 1-3% accuracy.","Delayed-Burst offers the strongest privacy gains, up to a 6.5% attack-AUC reduction, at a 5-10% accuracy cost that is most severe on CIFAR-10 and Iris.","Poisson-Burst lowers GPU power, GPU memory, and CPU memory by roughly 10-15% compared with rate encoding, so the temporal encoding choice changes deployment cost.","After MNIST-to-Fashion-MNIST transfer, Poisson-Burst and Delayed-Burst end with lower attack AUC than rate encoding, suggesting the privacy benefit survives domain shift.","The degree and kind of spike-timing variability matter more than spike rate alone for the privacy-accuracy trade-off."],"supporting_citations":[{"why":"Supplies the Izhikevich neuron model whose bursting and delayed-firing behaviors motivate the two input-level spike dynamics.","marker":"[4]"},{"why":"Shows relative spike latency is a fast neural code, the biological basis for Delayed-Burst's onset-delay encoding.","marker":"[6]"},{"why":"Defines the membership-inference attack framework whose AUC metric the paper uses to measure privacy leakage.","marker":"[12]"},{"why":"Provides evidence that bursts act as units of neural information, motivating the Poisson-Burst burst-size sampling.","marker":"[20]"},{"why":"Prior evidence that neuromorphic architectures can resist privacy attacks, which this work extends by adding temporal input dynamics.","marker":"[27]"},{"why":"Provides the snnTorch library used to implement and train all LIF-based spiking models.","marker":"[41]"},{"why":"Supplies CIFAR-10, the hardest benchmark that distinguishes Delayed-Burst's accuracy drop from Poisson-Burst's near-parity.","marker":"[9]"}],"fun_headline_variants":["SNN privacy boost via bursty input timing","Burst spikes vs. membership attacks: efficiency preserved","Poisson-Burst: Lower leakage, stable accuracy in SNNs","Izhikevich-inspired bursts: privacy without the overhead","Timing spikes to forget less: SNN privacy wins"],"cache_read_input_tokens":14208,"weakest_assumption_plain":"The privacy comparison assumes the shadow-model membership-inference protocol in Section III-B correctly measures membership leakage; the text says the target model is trained on the full dataset while the shadow model is trained on a disjoint 20% subset, which is impossible, so if that protocol is invalid the reported AUC reductions are not reliable evidence of privacy protection.","fun_headline_variants_meta":{"raw":{"variants":["SNN privacy boost via bursty input timing","Burst spikes vs. membership attacks: efficiency preserved","Poisson-Burst: Lower leakage, stable accuracy in SNNs","Izhikevich-inspired bursts: privacy without the overhead","Timing spikes to forget less: SNN privacy wins"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.000754,"raw_usage":{"total_tokens":3397,"prompt_tokens":1034,"completion_tokens":2363,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":650,"completion_tokens_details":{"reasoning_tokens":2283}},"tokens_in":650,"tokens_out":2363,"duration_ms":17498,"temperature":1.0,"reasoning_tokens":2283,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-15T23:39:13.579715+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Re-run the membership-inference experiment with target and shadow models trained on genuinely disjoint halves of the same dataset under identical training protocols; if the attack AUC gap between Rate and Poisson-Burst disappears under a sound split, the central privacy claim is refuted. Alternatively, test whether the reported AUC differences persist when the attack model sees logits or losses instead of membrane potentials.","supporting_citations":[{"cited_title":"Which model to use for cortical spiking neurons?","cited_arxiv_id":null,"evidence_quote":"Supplies the Izhikevich neuron model whose bursting and delayed-firing behaviors motivate the two input-level spike dynamics."},{"cited_title":"Bursts as a unit of neural information: making unreliable synapses reliable,","cited_arxiv_id":null,"evidence_quote":"Provides evidence that bursts act as units of neural information, motivating the Poisson-Burst burst-size sampling."},{"cited_title":"Are Neuromorphic Architectures Inherently Privacy-preserving? An Exploratory Study","cited_arxiv_id":"2411.06613","evidence_quote":"Prior evidence that neuromorphic architectures can resist privacy attacks, which this work extends by adding temporal input dynamics."},{"cited_title":"Snntorch: Tutorial 1,","cited_arxiv_id":null,"evidence_quote":"Provides the snnTorch library used to implement and train all LIF-based spiking models."},{"cited_title":"Cifar-10 (canadian institute for advanced research),","cited_arxiv_id":null,"evidence_quote":"Supplies CIFAR-10, the hardest benchmark that distinguishes Delayed-Burst's accuracy drop from Poisson-Burst's near-parity."}],"review_version":1}