Pith. sign in

REVIEW 3 major objections 4 minor 32 references

Poisoned event bursts can multiply NMS latency by 38× in SNN object detectors while accuracy barely moves.

Reviewed by Pith at T0; open to challenge. T0 means a machine referee read the full paper against a public rubric. the ladder, T0–T4 →

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

T0 review · grok-4.5

2026-07-14 15:20 UTC pith:FC3ROYTZ

load-bearing objection Clean poison-only NMS sponge for event SNNs with solid tables and Jetson data; abstract's "38%" is a clear typo for the body's 38× (+3818%). the 3 major comments →

arxiv 2607.09115 v2 pith:FC3ROYTZ submitted 2026-07-10 cs.CV cs.CR

Event Burst Trigger: An Availability Backdoor Attack on Event-Based SNN Object Detection

Jaesun Baek , Chanwook Lee , Eun-Kyu Lee This is my paper
classification cs.CV cs.CR
keywords availability backdoorevent-based visionspiking neural networksSpikeYOLONon-Maximum Suppressionedge AI securitypoison-only attack
verification ladder T0 review T1 audit T2 compute T3 formal T4 reserved

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The paper argues that event-based spiking neural network object detectors have a hidden availability vulnerability: a poison-only backdoor that never changes the final detections much can still make inference late. By planting event-burst triggers and dense overlapping fake boxes in a small fraction of training data, the model learns to emit a flood of phantom candidates when the trigger appears. Those candidates are mostly suppressed by Non-Maximum Suppression, so mAP stays nearly intact, but NMS itself becomes a computational sink whose cost scales roughly with the square of the candidate count. On SpikeYOLO the strongest setting raises NMS latency by up to 38 times; on an edge board the same attack lifts the CPU utilization floor and shrinks scheduling slack without dramatic spikes. Standard entropy-based detection (STRIP) cannot separate the triggers from clean inputs. The work therefore claims that availability, not just accuracy, must be part of the security evaluation of real-time event-based edge vision.

Core claim

Under a poison-only threat model, carefully designed event bursts (especially temporal event noise) implant a backdoor in SpikeYOLO that multiplies the number of phantom candidates and thereby inflates NMS-stage latency by as much as 38 imes while mAP@0.5 falls by less than 0.099; the same triggers also raise baseline resource use on edge hardware and evade STRIP detection.

What carries the argument

Event Burst Trigger (EBT): a poison-only procedure that injects temporally concentrated event patterns together with dense, high-IoU fake annotations so that, at inference, the SNN produces a synchronized spike burst that explodes the pre-NMS candidate set and saturates the O(N^{2}) NMS stage.

Load-bearing premise

A modest poisoning fraction plus dense overlapping fake boxes is enough to teach the detector a reliable trigger-to-candidate-explosion mapping that survives ordinary fine-tuning and stays silent on clean inputs.

What would settle it

Retrain SpikeYOLO on the same GEN1 poison set but with the fake-box density reduced or randomly scaled so that it no longer aligns with any FPN level; if NMS latency then remains near the clean baseline, the claimed mapping has failed.

Watch this falsifier — get emailed when new claim-graph text bears on it.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, simulated authors' rebuttal, and a circularity audit.

Referee Report

3 major / 4 minor

Summary. The paper proposes Event Burst Trigger (EBT), a poison-only availability backdoor against SpikeYOLO on event-based data. Triggers (single-event patches, weighted patches, and temporal event noise) plus dense overlapping fake annotations are injected into a fraction of the GEN1 training set so that, at inference, temporally concentrated events produce many phantom candidates and inflate NMS cost. On held-out frames the strongest configuration (temporal noise, ρ=0.2, γ=1.0) raises NMS time from 0.165 ms to 6.660 ms while mAP@0.5 falls by at most 0.099; STRIP yields ROC-AUC ≈ 0.5; Jetson Orin Nano measurements show elevated baseline CPU utilization and reduced scheduling slack. The claim is that NMS becomes a dominant availability bottleneck under this attack surface.

Significance. Availability backdoors that target post-processing rather than labels remain under-studied for event-based SNNs. The work supplies a concrete poison-only construction, three trigger modalities, an FPN-scale ablation (Table II), edge-platform resource profiles, and a negative STRIP result (Table IV). Source code is promised. If the quantitative latency claim is correctly stated and reproducible, the paper usefully expands the threat model for real-time neuromorphic detectors and motivates runtime monitoring of candidate counts and NMS latency. The contribution is empirical rather than theoretical; its value hinges on the magnitude and reliability of the reported NMS inflation.

major comments (3)
  1. Abstract vs. body quantitative inconsistency: the abstract (and arXiv abstract) state that NMS latency “increases by up to 38%”, while Table I (event-noise row ρ=0.2, γ=1.0), the conclusion, and the contribution list report a 38 imes increase (+3818 %, 0.165 ms → 6.660 ms). The same discrepancy appears in the contribution bullet. Because the headline availability claim rests on this number, the manuscript must reconcile the two figures, correct the abstract, and restate the claim consistently throughout. If the true measured effect is only ~38 %, the assertion that NMS becomes a “dominant availability bottleneck” is no longer supported by the data.
  2. Table I and §IV-A: all latency and candidate-count figures are reported as single point estimates with no standard deviations, confidence intervals, or multi-seed statistics, despite evaluation on 1000 frames. Given that NMS cost is super-linear in candidate count and that event streams are stochastic, the absence of variability measures leaves open whether the 38 imes figure is stable or an outlier. At minimum, mean ± std (or median and IQR) over seeds or frame batches should be supplied for the critical NMS-time column.
  3. §III-D and §IV-A (weakest assumption): the attack relies on a modest poisoning ratio (ρ ≤ 0.2) together with dense overlapping fake boxes (γ up to 1.0) being sufficient to implant a reliable trigger-to-candidate-explosion mapping that survives standard SpikeYOLO fine-tuning and remains dormant on clean inputs. The paper does not report training dynamics, loss curves, or an ablation that isolates annotation density from trigger presence. Without such evidence it is unclear how sensitive the mapping is to optimizer settings, learning-rate schedules, or early stopping, all of which are free parameters of the victim pipeline.
minor comments (4)
  1. Fig. 5 caption and surrounding text mix Korean and English; the figure itself is only partially described. A clean English caption and axis labels are needed.
  2. Notation for annotation strength γ and noise ratio ε is introduced without an explicit formal definition of how many fake boxes or events are generated; a short equation or algorithm box would help reproducibility.
  3. References [12] and [32] still carry arXiv / “accessed 2026” placeholders; final bibliographic details should be updated if available.
  4. The phrase “up to38%” (missing space) appears in the abstract and should be corrected once the percentage/fold issue is resolved.

Circularity Check

0 steps flagged

No significant circularity; purely empirical attack evaluation whose latency/mAP numbers are measured on held-out frames rather than algebraically forced by inputs.

full rationale

The paper proposes Event Burst Trigger (EBT) as a poison-only availability attack on SpikeYOLO and reports measured effects (candidate count C, NMS latency, mAP@0.5, edge CPU utilization, STRIP ROC-AUC). Trigger generation, annotation poisoning (Eq. 1), and FPN-scale alignment are design choices whose success is demonstrated experimentally on the GEN1 validation set (Tables I–IV, Fig. 5), not derived by rearranging fitted constants or by self-referential definitions. SpikeYOLO is an external published model (Luo et al.); no uniqueness theorem, ansatz, or load-bearing result is imported from the present authors’ prior work. The abstract/body discrepancy on “38 %” versus “38×” is a reporting inconsistency, not a circular reduction. Consequently the central claim rests on independent empirical observation and scores 0.

Axiom & Free-Parameter Ledger

5 free parameters · 3 axioms · 1 invented entities

The central claim rests on a small set of free hyper-parameters chosen by the authors, standard domain facts about SNNs and NMS, and the newly introduced attack construct itself. No deep mathematical axioms or unobserved physical entities are required; the ledger is therefore short and mostly engineering choices.

free parameters (5)
  • poisoning ratio ρ = 0.05–0.2 (default 0.1)
    Fraction of training samples that receive triggers and fake boxes; default 0.1, swept 0.05–0.2; directly controls attack strength versus clean accuracy.
  • annotation strength γ = 0.5–1.0 (default 1.0)
    Density of injected overlapping fake boxes per poisoned frame; primary driver of candidate inflation.
  • noise ratio ε = 0.1–0.7 (default 0.7)
    Fraction of pixels receiving temporal event noise; controls stealth–impact trade-off for the strongest trigger.
  • f_prev = 2
    Number of consecutive frames over which temporal noise is accumulated; chosen by hand to exploit membrane integration.
  • fake-box scale (l×l) = 8×8 (P3 primary)
    Spatial size of injected boxes aligned to FPN levels P3/P4/P5; 8×8 chosen as primary after ablation.
axioms (3)
  • domain assumption NMS computational complexity scales super-linearly (worst-case O(N²)) with the number of candidate boxes.
    Invoked throughout Sections II-B and III to justify why candidate inflation produces latency; standard algorithmic fact.
  • domain assumption SNN membrane potentials accumulate over time steps, so temporally concentrated events can drive synchronized population firing.
    Core premise of trigger design (Section III-C and Appendix A); taken from standard LIF/SNN literature.
  • domain assumption A poison-only adversary with write access to a bounded fraction of the training set is a realistic threat model for offline-collected event datasets.
    Stated in Section III-A; common in backdoor literature but not independently validated for automotive event data.
invented entities (1)
  • Event Burst Trigger (EBT) and its three modalities (single-event patch, weighted patch, temporal event noise) no independent evidence
    purpose: Concrete poison-only mechanism that maps crafted event patterns onto dense phantom proposals before NMS.
    The attack construct is introduced by the paper; independent evidence is limited to the experiments reported herein.

pith-pipeline@v1.1.0-grok45 · 17241 in / 2931 out tokens · 37110 ms · 2026-07-14T15:20:18.621038+00:00 · methodology

0 comments
read the original abstract

Event-based vision and spiking neural networks (SNNs) are increasingly adopted for edge intelligence under strict latency and energy constraints. However, the vulnerability of event-based SNN object detection models to availability backdoor attacks remains insufficiently studied. This paper presents Event Burst Trigger (EBT), an availability backdoor attack targeting SNN-based object detection models. EBT injects carefully crafted event-based triggers into the training data, which induce temporally concentrated event streams during inference. These burst-like activations increase the number of phantom (i.e., spurious) object candidates, and consequently inflate the computational cost of the post-processing stage, particularly Non-Maximum Suppression (NMS). We evaluate EBT on SpikeYOLO, the state-of-the-art SNN-based object detector, under a poison-only threat model that does not require modifications to the model architecture, loss function, or inference pipeline. Experimental results show that while detection accuracy remains largely preserved, with mAP@0.5 decreasing by less than 0.099, the latency of the NMS stage increases by up to 38%. This indicates that NMS can become a dominant availability bottleneck in event-based SNN object detection. Experiments on an edge platform further show that the proposed attack elevates baseline resource utilization and reduces scheduling slack without inducing conspicuous peaks in resource usage. In addition, STRIP-based backdoor detection fails to reliably distinguish the proposed attack from benign inputs. These results characterize a previously underexplored availability backdoor threat in event-based SNN object detection systems.

Figures

Figures reproduced from arXiv: 2607.09115 by Chanwook Lee, Eun-Kyu Lee, Jaesun Baek.

Figure 1
Figure 1. Figure 1: Comparison of computation paradigms in CNNs and SNNs. CNNs [PITH_FULL_IMAGE:figures/full_fig_p003_1.png] view at source ↗
Figure 1
Figure 1. Figure 1: RGB-style Backdoor trigger / adversarial example [PITH_FULL_IMAGE:figures/full_fig_p001_1.png] view at source ↗
Figure 2
Figure 2. Figure 2: Overview of the EBT attack pipeline. Trigger-induced event bursts lead to excessive candidate generation and NMS overload, resulting in increased [PITH_FULL_IMAGE:figures/full_fig_p004_2.png] view at source ↗
Figure 2
Figure 2. Figure 2: Comparison of computation paradigms in CNNs and SNNs. CNNs [PITH_FULL_IMAGE:figures/full_fig_p003_2.png] view at source ↗
Figure 3
Figure 3. Figure 3: Visualizing backdoor-induced candidate explosion: benign input [PITH_FULL_IMAGE:figures/full_fig_p004_3.png] view at source ↗
Figure 4
Figure 4. Figure 4: Comparison of CPU resource profiles under clean and poisoned [PITH_FULL_IMAGE:figures/full_fig_p005_4.png] view at source ↗
Figure 5
Figure 5. Figure 5: Comparison of CPU resource profiles under clean and poisoned [PITH_FULL_IMAGE:figures/full_fig_p006_5.png] view at source ↗

Review history (2 revisions) →

discussion (0)

Sign in with ORCID, Apple, or X to comment. Anyone can read and Pith papers without signing in.

Reference graph

Works this paper leans on

32 extracted references · 4 linked inside Pith

  1. [1]

    Adversarial attacks on event-based pedestrian detectors: A physical approach,

    G. Linet al., “Adversarial attacks on event-based pedestrian detectors: A physical approach,” inProceedings of the AAAI Conference on Artificial Intelligence, 2025, pp. 5227–5235

    2025

  2. [2]

    Toward ensuring safety for autonomous driving perception: Standardization progress, research advances, and perspectives,

    C. Sun, R. Zhang, Y . Lu, Y . Cui, Z. Deng, D. Cao, and A. Kha- jepour, “Toward ensuring safety for autonomous driving perception: Standardization progress, research advances, and perspectives,”IEEE Transactions on Intelligent Transportation Systems, 2024

    2024

  3. [3]

    Robotic vision for human-robot interaction and collaboration: A survey and systematic review,

    N. Robinson, B. Tidd, D. Campbell, D. Kuli ´c, and P. Corke, “Robotic vision for human-robot interaction and collaboration: A survey and systematic review,”ACM Transactions on Human-Robot Interaction, vol. 12, no. 1, pp. 1–66, 2023

    2023

  4. [4]

    Autonomous uav navigation using deep learning-based computer vision frameworks: A systematic literature review,

    A. V . R. Katkuri, H. Madan, N. Khatri, A. S. H. Abdul-Qawy, and K. S. Patnaik, “Autonomous uav navigation using deep learning-based computer vision frameworks: A systematic literature review,”Array, vol. 23, p. 100361, 2024

    2024

  5. [5]

    The tail at scale,

    J. Dean and L. A. Barroso, “The tail at scale,”Communications of the ACM, vol. 56, no. 2, pp. 74–80, 2013

    2013

  6. [6]

    Edge computing: Vision and challenges,

    W. Shi, J. Cao, Q. Zhang, Y . Li, and L. Xu, “Edge computing: Vision and challenges,”IEEE Internet of Things Journal, vol. 3, no. 5, pp. 637–646, 2016

    2016

  7. [7]

    Gemel: Model merging for memory-efficient, real-time video analytics at the edge,

    A. Padmanabhan, N. Agarwal, A. P. Iyer, G. Ananthanarayanan, Y . Shu, N. Karianakis, G. H. Xu, and R. Netravali, “Gemel: Model merging for memory-efficient, real-time video analytics at the edge,” pp. 973–994, 2023

    2023

  8. [8]

    Pantheon: Preemptible multi-dnn inference on mobile edge gpus,

    L. Han, Z. Zhou, and Z. Li, “Pantheon: Preemptible multi-dnn inference on mobile edge gpus,” pp. 465–478, 2024

    2024

  9. [9]

    Towards spike-based machine intelligence with neuro- morphic computing,

    K. Royet al., “Towards spike-based machine intelligence with neuro- morphic computing,”Nature, vol. 575, no. 7784, pp. 607–617, 2019

    2019

  10. [10]

    Spatio-temporal backpropagation for training spiking neural networks,

    Y . Wuet al., “Spatio-temporal backpropagation for training spiking neural networks,”Frontiers in Neuroscience, vol. 12, p. 331, 2018

    2018

  11. [11]

    Hire-snn: Harnessing the inherent robustness of energy-efficient deep spiking neural networks by training with crafted input noise,

    S. Kundu, M. Pedram, and P. A. Beerel, “Hire-snn: Harnessing the inherent robustness of energy-efficient deep spiking neural networks by training with crafted input noise,” inProceedings of the IEEE/CVF International Conference on Computer Vision (ICCV). IEEE, 2021, pp. 5209–5218

    2021

  12. [12]

    Integer-valued training and spike-driven inference spiking neural network for high-performance and energy-efficient object detec- tion,

    X. Luoet al., “Integer-valued training and spike-driven inference spiking neural network for high-performance and energy-efficient object detec- tion,”arXiv preprint arXiv:2407.20708, 2024, accepted by ECCV 2024

    Pith/arXiv arXiv 2024

  13. [13]

    Sponge examples: Energy-latency attacks on neural networks,

    I. Shumailovet al., “Sponge examples: Energy-latency attacks on neural networks,”arXiv preprint arXiv:2006.03463, 2020

    Pith/arXiv arXiv 2006

  14. [14]

    Sponge backdoor attack: Increasing the latency of object detection exploiting non-maximum suppression,

    Y . Guoet al., “Sponge backdoor attack: Increasing the latency of object detection exploiting non-maximum suppression,” inProceedings of the International Joint Conference on Neural Networks (IJCNN), 2024, pp. 1–8

    2024

  15. [15]

    Phantom sponges: Exploiting non-maximum suppres- sion to attack deep object detectors,

    A. Shapiraet al., “Phantom sponges: Exploiting non-maximum suppres- sion to attack deep object detectors,” inProceedings of the IEEE/CVF Winter Conference on Applications of Computer Vision (WACV), 2023, pp. 4571–4580

    2023

  16. [16]

    Overload: Latency attacks on object detection for edge devices,

    E.-C. Chen, P.-Y . Chen, I.-H. Chung, and C.-r. Lee, “Overload: Latency attacks on object detection for edge devices,” inProceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR), June 2024, pp. 24 716–24 725

    2024

  17. [17]

    Strip: A defence against trojan attacks on deep neural networks,

    Y . Gaoet al., “Strip: A defence against trojan attacks on deep neural networks,” inProceedings of the 35th Annual Computer Security Appli- cations Conference, 2019, pp. 113–125

    2019

  18. [18]

    Event-based vision: A survey,

    G. Gallegoet al., “Event-based vision: A survey,”IEEE Transactions on Pattern Analysis and Machine Intelligence, vol. 44, no. 1, pp. 154–180, 2022

    2022

  19. [19]

    Daedalus: Breaking nonmaximum suppression in object detection via adversarial examples,

    D. Wanget al., “Daedalus: Breaking nonmaximum suppression in object detection via adversarial examples,”IEEE Transactions on Cybernetics, vol. 52, no. 8, pp. 7427–7440, 2022

    2022

  20. [20]

    Networks of spiking neurons: The third generation of neural network models,

    W. Maass, “Networks of spiking neurons: The third generation of neural network models,”Neural Networks, vol. 10, no. 9, pp. 1659–1671, 1997

    1997

  21. [21]

    Effi- ciency attacks on spiking neural networks,

    S. Krithivasan, S. Sen, N. Rathi, K. Roy, and A. Raghunathan, “Effi- ciency attacks on spiking neural networks,” inProceedings of the 59th Annual Design Automation Conference (DAC), 2022, pp. 373–378

    2022

  22. [22]

    Fast and efficient information transmission with burst spikes in deep spiking neural networks,

    S. Park, S. Kim, H. Choe, and S. Yoon, “Fast and efficient information transmission with burst spikes in deep spiking neural networks,” in Proceedings of the 56th Annual Design Automation Conference (DAC), 2019, pp. 1–6

    2019

  23. [23]

    Sparseprop: Efficient event-based simulation and training of sparse recurrent spiking neural networks,

    R. Engelken, “Sparseprop: Efficient event-based simulation and training of sparse recurrent spiking neural networks,” inAdvances in Neural Information Processing Systems (NeurIPS), 2023

    2023

  24. [24]

    Ultralytics yolov8,

    G. Jocher, A. Chaurasia, and J. Qiu, “Ultralytics yolov8,” https://github. com/ultralytics/ultralytics, 2023

    2023

  25. [25]

    Soft-nms: Improving object detection with one line of code,

    N. Bodla, B. Singh, R. Chellappa, and L. S. Davis, “Soft-nms: Improving object detection with one line of code,” inProceedings of the IEEE International Conference on Computer Vision (ICCV), 2017, pp. 5561– 5569

    2017

  26. [26]

    Denial of service via algorithmic complexity attacks,

    S. A. Crosby and D. S. Wallach, “Denial of service via algorithmic complexity attacks,” inProceedings of the 12th USENIX Security Symposium (USENIX Security 03). Washington, DC, USA: USENIX Association, 2003

    2003

  27. [27]

    Learning non-maximum suppression,

    J. Hosang, R. Benenson, and B. Schiele, “Learning non-maximum suppression,” inProceedings of the IEEE Conference on Computer Vision and Pattern Recognition (CVPR), 2017, pp. 4507–4515

    2017

  28. [28]

    Badnets: Identifying vulnera- bilities in the machine learning model supply chain,

    T. Gu, B. Dolan-Gavitt, and S. Garg, “Badnets: Identifying vulnera- bilities in the machine learning model supply chain,”arXiv preprint arXiv:1708.06733, 2017

    Pith/arXiv arXiv 2017

  29. [29]

    Poster: Backdoor attacks on spiking nns and neuromor- phic datasets,

    G. Abadet al., “Poster: Backdoor attacks on spiking nns and neuromor- phic datasets,” inProceedings of the 2022 ACM SIGSAC Conference on Computer and Communications Security (CCS). ACM, 2022, pp. 3315–3317

    2022

  30. [30]

    Sok: Efficiency robustness of dynamic deep learning systems,

    R. Rathnasuriyaet al., “Sok: Efficiency robustness of dynamic deep learning systems,” inProceedings of the 34th USENIX Security Sympo- sium (USENIX Security 25), 2025, pp. 4683–4702

    2025

  31. [31]

    A large scale event-based detection dataset for automotive,

    P. de Tournemireet al., “A large scale event-based detection dataset for automotive,”arXiv preprint arXiv:2001.08499, 2020

    Pith/arXiv arXiv 2001

  32. [32]

    Jetson orin nano developer kit user guide,

    NVIDIA, “Jetson orin nano developer kit user guide,” https://developer. nvidia.com/embedded/learn/jetson-orin-nano-devkit-user-guide/index. html, 2026, accessed: 2026-04-23

    2026