{"id":"97f0e25f-fe49-4323-a1c3-43b83bcf7189","arxiv_id":"2507.18139","paper_version":1,"verdict":"CONDITIONAL","confidence":"MODERATE","novelty_score":2.0,"correctness_risk":"medium","formal_verification":"none","parameter_count":0,"one_line_summary":"A survey proposing a cross-layer workflow from event-based sensing to secure, reliable, energy-efficient spiking neural networks for autonomous systems.","lead":"This review paper lays out a step-by-step workflow for building secure, energy-efficient spiking neural networks for autonomous robots and vehicles, and it surveys recent algorithms and hardware. It matters because it organizes a scattered field and points to open problems, even though it presents no new experiments.","discovery_kind":"review","skeptic_critique":{"model":"deepseek-v4-flash","headline":"The central workflow claim rests on an unshown composition: BFV-encrypted weights cannot straightforwardly undergo post-encryption pruning/quantization or continual learning, and the paper never runs the five stages in sequence on one system.","rationale":"The reader's weakest_assumption is the same one I would pick: the workflow's stages are cited in isolation and never composed. I agree with the reader's conditional verdict. My stress-test sharpens the concern into a concrete technical conflict rather than a vague 'no end-to-end eval' complaint: BFV homomorphic encryption, as cited in §III.B, is not a transparent wrapper that can be placed around any later processing step. Leveled HE requires all circuit operations to be known and bounded in advance; pruning, quantization, and continual learning modify the computation graph or weights, and therefore cannot be applied after encryption without breaking the security or noise budget. This makes the sequential ordering in Figure 2 suspect. I also note the manuscript contains an unrelated block from a different paper (TU Wien acknowledgment, fault-injection figures and references), which is a manuscript-integrity problem independent of the scientific claim; it should be removed before publication but does not by itself determine the verdict. The paper does have value as a survey: it assembles recent SNN robustness, compression, encryption, and continual-learning results and gives a useful taxonomy. However, the central claim of a 'unified workflow' requires at least one demonstration or a formal statement of dependencies. Without it, the claim is a position rather than a demonstrated result, so CONDITIONAL (reader's verdict) is appropriate. I therefore leave verdict unchanged.","tokens_in":9714,"tokens_out":5597,"duration_ms":60064,"concrete_test":"Run the five stages in sequence on a single event-based benchmark (e.g., DVS-Gesture) with one SNN architecture: adversarial training, BFV encryption, pruning/quantization, HW-aware NAS, then continual learning and noise filtering, and report end-to-end accuracy, latency, energy, and ciphertext noise growth. If any later stage requires plaintext access or breaches the BFV noise budget, the workflow fails to compose; if the stages are intended as alternatives, the paper must state that and weaken the 'stages result in' claim.","verdict_should_be":"UNCHANGED","load_bearing_attack":"Section III and Figure 2 present the central claim as a sequential workflow, and the text says 'These stages result in a secure, efficient, and reliable SNN system.' For this to hold, stage 2 (encryption via BFV, §III.B) must be composable with stage 4 (pruning/quantization, §III.D) and stage 5 (continual learning, §III.E) on the same model. BFV is a leveled homomorphic scheme: ciphertext operations must be fixed at encryption time, and the noise budget grows with each multiplication. Pruning changes the network topology, quantization changes the arithmetic domain, and continual learning updates weights; none of these can be applied to an already-encrypted model without decryption or re-encryption, which would expose the data the scheme is meant to protect. The cited papers validate each stage on different datasets and models (FashionMNIST, MNIST, NCARS, DVS-Gesture, CIFAR-10) and do not address interfaces between stages. The manuscript provides no end-to-end experiment, no formal dependency analysis, and no discussion of BFV plaintext modulus or noise-budget compatibility across stages. The ordering is also ambiguous: Figure 2's caption places secure training before reliable SNN design, while Section III text places reliable design first. Thus the asserted integration is not demonstrated; at most the paper collects independent techniques under one diagram.","agreement_with_reader":"agree"},"referee_report":{"model":"deepseek-v4-flash","summary":"This manuscript is a short survey/position paper on neuromorphic computing for autonomous systems. It proposes a five-stage 'cross-layer workflow' — data collection and event encoding; secure SNN training via adversarial training and BFV homomorphic encryption; reliable SNN design via hyperparameter tuning and fault tolerance; hardware/software optimization via pruning, quantization, and hardware-aware NAS; and real-time adaptation via noise filtering and continual learning — and illustrates each stage with plots adapted from the authors' prior publications. The paper closes with a list of challenges and open questions. The central claim is that composing these stages yields a 'secure, efficient, and reliable SNN system' that supports embodied intelligence.","tokens_in":9996,"tokens_out":6288,"duration_ms":60561,"significance":"If the workflow were fully demonstrated, it would provide a valuable organizer for a fragmented literature and would be appropriate for a robustness-oriented venue like IOLTS. The paper has useful strengths: it is concise, concretely links event-based sensing (DVS), SNN algorithms, and neuromorphic hardware (TrueNorth, Loihi, etc.), and each stage is illustrated with a quantitative figure from a peer-reviewed source. However, the paper's main value as a 'unified workflow' is currently not supported: the stages are validated only in isolation on different datasets and models, mostly from the authors' own group, and the composition is asserted rather than tested. The general claims about SNN fault tolerance and encrypted inference also go beyond what the displayed data establish.","major_comments":[{"comment":"The central claim of the paper is the workflow in Figure 2, and the text states 'These stages result in a secure, efficient, and reliable SNN system.' This composition is not demonstrated anywhere in the manuscript. In particular, stage 2 (BFV homomorphic encryption, Sec. III.B) and stage 4 (pruning/quantization, Sec. III.D) and stage 5 (continual learning, Sec. III.E) are presented as independent techniques evaluated on different datasets (FashionMNIST, NCARS, MNIST, DVS-Gesture, CIFAR-10) and different model architectures. BFV is a leveled homomorphic scheme: the set of operations must be fixed at encryption time and the noise budget grows with multiplications, so pruning, quantization, and weight updates performed after encryption would require decryption or re-encryption, which defeats the stated privacy goal. The manuscript provides no end-to-end experiment, no formal analysis of stage interfaces, and no discussion of whether the plaintext modulus or noise budget is compatible across the stages. Without such support, the 'unified workflow' is a diagram and not a demonstrated design path.","section":"Sec. III, Fig. 2"},{"comment":"The claim that 'SNNs outperform ResNet18 and VGG11 in maintaining accuracy under both output and weight faults' is not supported by the displayed comparison. Figure 5 compares fault injection results for ResNet18 and VGG11 on CIFAR-10 with results for a 4-layer SNN on DVS-Gesture; the models, datasets, and possibly task difficulties differ across panels. This is not a controlled comparison, and no error bars or repeated-run statistics are provided, so the difference could reflect dataset or model architecture rather than a general superiority of SNNs. Because the 'reliability' pillar of the proposed workflow rests on this fault-tolerance claim, the claim should be either restricted to the specific setting or supported by a matched comparison on the same dataset with identical fault-injection protocol.","section":"Sec. III.C, Fig. 5"},{"comment":"The encryption-related claim that 'Spiking-AlexNet maintains competitive accuracy under encryption' and 'shows improved resilience in low-modulus regimes' is presented without numerical values in the text and without error bars in Figure 3. Since the figure is a single adapted curve from reference [17], and since AlexNet is a non-spiking baseline rather than a spiking model with matched capacity and training protocol, the reader cannot assess whether the difference is significant. Please provide the test accuracies, the number of runs, and the exact hyperparameters used for both models.","section":"Sec. III.B, Fig. 3"}],"minor_comments":[{"comment":"Section III.A contains a sentence fragment: '...followed by a pre-processing stage that includes event discretization and encoding. Yielding temporally structured event sequences suitable for spiking neural processing.' The second clause should be joined to the first sentence.","section":"Sec. III.A"},{"comment":"The figure caption of Figure 2 describes step 2 as 'secure SNN training' followed by 'reliable SNN design' in step 3, while the body text of Section III presents reliable design before secure training; the inconsistency should be resolved.","section":"Fig. 2 caption"},{"comment":"The manuscript's bibliography appears to include two different reference lists; for example, the Introduction's [1] and [2] are deep-learning surveys, but the final reference list's [1] and [2] are CarSNN and LaneSNNs papers. The in-text citations should be matched to a single consistent bibliography.","section":"References"},{"comment":"Figure 3 and Figure 5 would benefit from error bars or confidence bands, and from a statement of the number of independent runs, since the claims are comparative.","section":"Fig. 3 and Fig. 5"},{"comment":"In Figure 5's caption and text, the identity of 'our SNN model' should be specified (e.g., the 4-layer SNN from enpheeph) so that the reader can locate the architecture details.","section":"Fig. 5 caption"}],"recommendation":"major_revision","confidential_remarks":"The survey's evidence is drawn heavily from the authors' own publications (Figures 3, 5-9 from refs [17]-[24]), and the manuscript does not contain independent corroboration of the synthetic claims. This is acceptable for a perspective paper, but if the journal expects a critical survey, the authors should either broaden the evidence base or explicitly present the workflow as a research proposal. Also, the IOLTS scope on online testing and robust system design could be served by a more focused treatment of fault tolerance rather than the broad workflow."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"Zoe, quick read on arXiv:2507.18139 for you. It's a survey/position paper on neuromorphic computing for embodied autonomy, aimed at IOLTS. The one genuinely new artifact is a five-stage workflow diagram (Figure 2) that stages secure training, reliable design, compression, and adaptation into a single pipeline. That's a useful organizing device for newcomers. The survey itself is competent: the descriptions of SNNs, event-based sensors, and neuromorphic hardware match the cited literature, and the authors point to real work on adversarial training, BFV encryption, pruning, and continual learning.\n\nBut the central claim that the stages compose into 'a secure, efficient, and reliable SNN system' is asserted, not shown. The stress-test note is right: BFV is leveled homomorphic encryption; once weights are encrypted you cannot prune, quantize, or run continual learning on them without re-encrypting or exposing the model. The cited papers validate each stage on different datasets and models, and there is no end-to-end experiment and no analysis of interfaces. At best this is a collection of independent techniques under one diagram; the 'unified workflow' label overstates it. The self-citation pattern makes things worse: Figures 3, 5, 6, 7, 8, and 9 all come from the authors' own prior work, and the text generalizes from a single uncontrolled SNN-vs-DNN fault-tolerance comparison. And there's a harder problem: the manuscript contains a block of unrelated content from another IEEE paper — Figures 7-9 with a TU Wien acknowledgment and a different reference list, complete with the IEEE download footer. That has to be removed before anything else. It reads like a copy-paste leftover.\n\nWho is this for? Someone wanting a quick map of SNN security/reliability techniques could skim it. As a citable source for the workflow claim, no. I would not cite it. The paper is not ready for peer review in this state; the contamination alone is a desk-reject trigger, and the workflow claim needs either a major rewrite as a survey of disjoint techniques or a real demonstration. If the authors clean it up and soften the claims, a workshop crowd might find it useful.","headline":"A competent but overclaimed SNN survey whose five-stage workflow is never composed or validated, and whose manuscript carries a block of unrelated IEEE content.","tokens_in":10481,"tokens_out":2405,"would_cite":false,"duration_ms":25629,"reading_group":"no","serious_thinker":"yes","would_accept_peer_review":false},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"A unified workflow for secure, efficient, reliable spiking networks is proposed as the foundation for embodied intelligence in autonomous systems.","keywords":["neuromorphic computing","spiking neural networks","embodied intelligence","autonomous systems","event-based vision","cross-layer optimization","secure training","continual learning"],"falsifier":"Build one SNN-based autonomous perception system that runs all five workflow stages—adversarial training, BFV-encrypted inference, pruning and quantization, continual learning, and fault-injection testing—on a single event-based dataset such as DVS-Gesture or NCARS, and compare its accuracy, energy, and latency against each stage run alone; if the stages conflict, say 4-bit quantization breaks encrypted inference or continual learning erases adversarial defenses, the workflow's central promise fails.","tokens_in":9504,"feed_emoji":"🧠","tokens_out":9499,"duration_ms":92283,"temperature":0.7,"pith_summary":"This paper tries to establish that a single cross-layer workflow can turn spiking neural networks (SNNs, networks that communicate through discrete spike events) into the computational core of autonomous systems: robots, drones, and vehicles that must perceive and decide in real time under tight energy budgets. The proposed pipeline joins event-based sensing, secure training with adversarial robustness and homomorphic encryption (computation on encrypted data), fault-tolerant network design, hardware-aware compression, and continual learning into one design flow. If the workflow is right, it gives engineers a concrete route from an event-based sensor to a deployed secure, efficient, reliable SNN, rather than a collection of isolated techniques. The paper grounds the route in published results for each stage, from encrypted spiking inference to low-precision continual learning.","feed_headline":"Spiking networks get a five-stage path to autonomous agents","feed_subtitle":"It combines event-based sensing, secure training, compression, and continual learning in one SNN design flow.","key_machinery":"The central object is the five-stage cross-layer workflow: data collection and pre-processing, secure SNN training, reliable SNN design, hardware- and software-level optimizations, and real-time adaptation. Each stage contributes a named mechanism—spike trains from event discretization, spike-aware adversarial training, BFV encryption, voltage-threshold and time-window tuning, pruning and quantization, hardware-aware neural architecture search, noise filtering, and continual learning—and the workflow's claim is that these mechanisms compose into a single deployable system. Without this workflow, the paper would be a list of isolated results; with it, the results become a proposed design path for embodied intelligence.","core_discovery":"The paper's central claim is that the building blocks for embodied intelligence in autonomous systems already exist and can be composed into one workflow. In its own terms, the claim is that \"these stages result in a secure, efficient, and reliable SNN system that supports embodied intelligence.\" The argument is that each stage has a demonstrated mechanism: event discretization and encoding turns sensor streams into spike trains; adversarial training with spike-aware regularization and BFV homomorphic encryption make training and inference secure; voltage-threshold and time-window tuning plus inherent SNN fault tolerance provide reliability; pruning, quantization, and hardware-aware neural architecture search provide efficiency; noise filters and continual learning provide adaptability. The cited evidence includes a spiking AlexNet matching a conventional AlexNet under BFV encryption, SNNs retaining accuracy better than the compared DNNs under fault injection, and an event-based car SNN that keeps high accuracy at 10-bit precision.","pith_inferences":["A direct test is an end-to-end benchmark that applies all five stages to one event-based dataset and reports combined accuracy, energy, and latency; the paper itself does not run this test.","If encrypted, low-precision SNN inference holds up, privacy-preserving edge AI becomes a natural target, since homomorphic encryption and aggressive quantization both stress numeric ranges and the cited SNN results suggest spiking models tolerate both.","The workflow treats security and adaptability as separate stages, leaving open the harder question of maintaining adversarial robustness while the network continually learns from new, possibly poisoned events.","Fault-injection comparisons could be run on the whole workflow rather than a single model, revealing which combination of encryption and compression is most fault-sensitive."],"forward_implications":["Engineers can use the workflow as a checklist for building an SNN-based autonomous agent, choosing one technique per stage instead of assembling methods ad hoc.","Event-based perception in vehicles and drones could run at lower energy and latency than frame-based deep networks, because each optimization stage is aimed at reducing spike traffic and memory footprint.","Secure deployment becomes a concrete target: the cited results suggest an SNN can be adversarially trained, encrypted, and still reach accuracy comparable to an unencrypted conventional network.","Low-precision SNNs should be able to achieve large memory savings without major accuracy loss, enabling deployment on neuromorphic chips with small on-chip memory.","Continual learning at low precision gives autonomous agents a path to updating behavior online without catastrophic forgetting, which is what embodied intelligence requires."],"supporting_citations":[{"why":"Supplies the spike-aware regularized adversarial-training technique used in the secure-training stage.","marker":"[15]"},{"why":"Supplies the result that a spiking AlexNet under BFV homomorphic encryption matches the accuracy of the conventional AlexNet model.","marker":"[17]"},{"why":"Shows that the voltage threshold and integration time window of SNNs tune their robustness against perturbations.","marker":"[18]"},{"why":"Supplies the fault-injection study showing SNNs retain accuracy better than the compared DNNs under output and weight faults.","marker":"[19]"},{"why":"Provides the quantization and attention-window tuning results, including large memory savings with 10-bit and 16-bit weights on event-based driving data.","marker":"[20]"},{"why":"Supplies the learning-rate-policy results that shorten training and cut carbon emissions.","marker":"[21]"},{"why":"Introduces noise filters for event-based sensors that attenuate noisy or adversarial spikes before integration.","marker":"[23]"},{"why":"Provides the low-precision continual-learning result that retains task accuracy with 14-bit weights.","marker":"[24]"}],"fun_headline_variants":["Five-stage SNN blueprint for embodied autonomy","From event sensors to secure spiking agents","Composing SNN building blocks for autonomous systems","SNN workflow: secure, efficient, adaptive autonomy","One design flow to unify neuromorphic autonomy"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"The load-bearing premise is that the five workflow stages described in Section III and Figure 2—adversarial training, BFV encryption, fault-tolerant design, pruning and quantization, and continual learning—can be combined in a single spiking network without their constraints conflicting, even though the paper presents each technique in isolation and gives no end-to-end demonstration.","fun_headline_variants_meta":{"raw":{"variants":["Five-stage SNN blueprint for embodied autonomy","From event sensors to secure spiking agents","Composing SNN building blocks for autonomous systems","SNN workflow: secure, efficient, adaptive autonomy","One design flow to unify neuromorphic autonomy"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.000268,"raw_usage":{"total_tokens":1600,"prompt_tokens":909,"completion_tokens":691,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":525,"completion_tokens_details":{"reasoning_tokens":621}},"tokens_in":525,"tokens_out":691,"duration_ms":7571,"temperature":1.0,"reasoning_tokens":621,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-06T14:37:57.732579+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Build one SNN-based autonomous perception system that runs all five workflow stages—adversarial training, BFV-encrypted inference, pruning and quantization, continual learning, and fault-injection testing—on a single event-based dataset such as DVS-Gesture or NCARS, and compare its accuracy, energy, and latency against each stage run alone; if the stages conflict, say 4-bit quantization breaks encrypted inference or continual learning erases adversarial defenses, the workflow's central promise fails.","supporting_citations":[{"cited_title":"Snn-rat: Robustness-enhanced spiking neural network through regularized adversarial training,","cited_arxiv_id":null,"evidence_quote":"Supplies the spike-aware regularized adversarial-training technique used in the secure-training stage."},{"cited_title":"A homomorphic encryption framework for privacy- preserving spiking neural networks,","cited_arxiv_id":null,"evidence_quote":"Supplies the result that a spiking AlexNet under BFV homomorphic encryption matches the accuracy of the conventional AlexNet model."},{"cited_title":"Securing deep spiking neural networks against adversarial attacks through inherent structural parameters,","cited_arxiv_id":null,"evidence_quote":"Shows that the voltage threshold and integration time window of SNNs tune their robustness against perturbations."},{"cited_title":"enpheeph: A fault injection framework for spiking and compressed deep neural networks,","cited_arxiv_id":null,"evidence_quote":"Supplies the fault-injection study showing SNNs retain accuracy better than the compared DNNs under output and weight faults."},{"cited_title":"Snn4agents: a framework for developing energy-efficient embodied spiking neural networks for autonomous agents,","cited_arxiv_id":null,"evidence_quote":"Provides the quantization and attention-window tuning results, including large memory savings with 10-bit and 16-bit weights on event-based driving data."},{"cited_title":"Fastspiker: Enabling fast training for spiking neural networks on event-based data through learning rate enhancements for autonomous embedded systems,","cited_arxiv_id":null,"evidence_quote":"Supplies the learning-rate-policy results that shorten training and cut carbon emissions."},{"cited_title":"R-snn: An analysis and design methodology for robustifying spiking neural networks against adversarial attacks through noise filters for dynamic vision sensors,","cited_arxiv_id":null,"evidence_quote":"Introduces noise filters for event-based sensors that attenuate noisy or adversarial spikes before integration."},{"cited_title":"lpspikecon: Enabling low-precision spiking neural network processing for efficient unsupervised continual learning on autonomous agents,","cited_arxiv_id":null,"evidence_quote":"Provides the low-precision continual-learning result that retains task accuracy with 14-bit weights."}],"review_version":1}