pith. sign in

arxiv: 2606.26841 · v1 · pith:75QVO7D7new · submitted 2026-06-25 · 💻 cs.CR

SpikeTimer: Exploring Active Copyright Protection in Spiking Neural Networks via Temporal Backdoor Regularization

Xiao Yang , Gaolei Li , Jun Wu , Jianhua Li , Zhiquan Liu This is my paper

Pith reviewed 2026-06-26 04:25 UTC · model grok-4.3

classification 💻 cs.CR
keywords spiking neural networkscopyright protectiontemporal backdoorneuromorphic datatimeslice embeddingactive protectionmodel ownershipbackdoor regularization
0
0 comments X

The pith

SpikeTimer embeds tokens in designated timeslices of neuromorphic inputs so SNNs output correctly only on authorized data and err on unauthorized data.

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The paper introduces SpikeTimer, which partitions event-driven neuromorphic data into timeslices and places authorized tokens exclusively inside designated slices. This creates a time-dependent authorization check: the network responds accurately when the token appears in the correct slice and produces errors otherwise. The method adds only about 1.5 percent degradation on authorized inputs while reducing accuracy on unauthorized inputs to roughly 10 percent. It also maintains this separation after finetuning and pruning. A reader would care because SNNs are emerging for low-power edge devices, yet lack the copyright tools already studied for ordinary deep networks.

Core claim

SpikeTimer partitions neuromorphic data into designated timeslices and exclusively embeds authorized tokens within authorized slices. The resulting time-dependent authorization mechanism causes the SNN to respond correctly to authorized data containing a token in the correct timeslice while producing erroneous responses to unauthorized data. The framework supports multi-user authorization through different slices and tokens of arbitrary morphology, retains performance with minimal degradation on authorized inputs, and resists finetuning and pruning.

What carries the argument

Temporal segmentation of neuromorphic data into timeslices with exclusive authorized-token embedding, which enforces a time-dependent validity check on model outputs.

If this is right

  • The same timeslice mechanism supports simultaneous authorization for multiple distinct users by assigning different slices.
  • Token morphology can be chosen freely without retraining the underlying SNN architecture.
  • Defensive performance holds after standard model-compression attacks such as pruning and fine-tuning.
  • Accuracy on authorized inputs degrades by only about 1.5 percent while unauthorized accuracy falls to around 10 percent.

Where Pith is reading between the lines

These are editorial extensions of the paper, not claims the author makes directly.

  • The approach could be tested on non-neuromorphic temporal sequences such as audio or video streams that admit natural slicing.
  • Hardware implementations might enforce the timeslice check directly in the spike-timing circuitry rather than through software regularization.
  • If timeslice boundaries prove stable across datasets, the method might generalize to other spiking or recurrent architectures without new training.

Load-bearing premise

Neuromorphic data can be cleanly divided into timeslices so that token embedding affects only unauthorized inputs without substantially altering authorized computation.

What would settle it

Measure whether unauthorized accuracy stays near 10 percent after the protected model is fine-tuned on a dataset that mixes authorized and unauthorized samples but omits the embedded tokens.

Figures

Figures reproduced from arXiv: 2606.26841 by Gaolei Li, Jianhua Li, Jun Wu, Xiao Yang, Zhiquan Liu.

Figure 1
Figure 1. Figure 1: Illustration of SpikeTimer. The SNN training jointly optimizes the multi-objective loss function of the three datasets [PITH_FULL_IMAGE:figures/full_fig_p002_1.png] view at source ↗
Figure 2
Figure 2. Figure 2: Membrane potential dynamics of a LIF neuron [PITH_FULL_IMAGE:figures/full_fig_p004_2.png] view at source ↗
Figure 3
Figure 3. Figure 3: Method token types: 1) Static, 2) moving, and 3) noise. [PITH_FULL_IMAGE:figures/full_fig_p006_3.png] view at source ↗
Figure 4
Figure 4. Figure 4: Neuromorphic samples (one frame of each sample). [PITH_FULL_IMAGE:figures/full_fig_p008_4.png] view at source ↗
Figure 5
Figure 5. Figure 5: Duration of authorized timeslice experiment on [PITH_FULL_IMAGE:figures/full_fig_p011_5.png] view at source ↗
Figure 6
Figure 6. Figure 6: Training data distribution experiment on N-MNIST [PITH_FULL_IMAGE:figures/full_fig_p012_6.png] view at source ↗
Figure 7
Figure 7. Figure 7: SpikeTimer models’ performances under model fine￾tuning attacks. Please cf. Sec. V-F1 for detailed explanations. and Amis ranges from 8.82% ∼ 10.50%, suggesting that incorrect or absent tokens remain ineffective regardless of where the trigger is placed. The overall metric Afull is similarly stable, spanning 18.30% ∼ 20.41%. Although the spatial location of the token is not the core novelty of SpikeTimer, … view at source ↗
Figure 8
Figure 8. Figure 8: SpikeTimer performances under model pruning on N￾MNIST. Please cf. Sec. V-F2 for detailed explanations. the accuracy on no-token data remains significantly lower and does not exhibit substantial growth over the epochs. This demonstrates that the SpikeTimer mechanism effectively maintains robustness against unauthorized data usage, even when the model is subjected to cross-domain fine-tuning. 2) Model Pruni… view at source ↗
Figure 9
Figure 9. Figure 9: Accuracy comparison for multi-user authorization on [PITH_FULL_IMAGE:figures/full_fig_p014_9.png] view at source ↗
read the original abstract

Spiking Neural Networks (SNN) have emerged as a revolutionary paradigm compared to traditional Deep Neural Networks (DNN) in energy-efficient computing, showcasing exceptional capabilities in processing event-driven sensory data for real-time applications like robotics and edge AI systems. However, unlike extensive studies on DNN copyright solutions, SNN copyright protection remains largely underexplored due to their inherent temporal coding complexities and spike-driven computation. In this study, we propose a novel active copyright protection framework named SpikeTimer for SNNs via temporal backdoor learning. SpikeTimer partitions neuromorphic data into designated timeslices and exclusively embeds authorized tokens within authorized slices. Furthermore, the inherent temporal segmentation characteristic intrinsically enables SpikeTimer to support multi-user authorization mechanisms and accommodates token embedding of arbitrary morphology. Based on this, SpikeTimer precisely responds to authorized data containing a token within the correct timeslice, while producing erroneous responses to unauthorized data. Our key innovation lies in establishing a time-dependent authorization mechanism that protects the SNN copyright by temporal token validity. Additionally, SpikeTimer retains its defensive efficacy even under adversarial attempts. Evaluations on multiple neuromorphic datasets manifest that SpikeTimer achieves around 10% accuracy on unauthorized data with merely around 1.5% degradation on authorized inputs. Moreover, SpikeTimer demonstrates robust resistance against model finetuning and pruning threats.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, simulated authors' rebuttal, and a circularity audit. Tearing a paper down is the easy half of reading it; the pith above is the substance, this is the friction.

Referee Report

2 major / 2 minor

Summary. The paper proposes SpikeTimer, an active copyright protection method for Spiking Neural Networks via temporal backdoor regularization. Neuromorphic inputs are partitioned into timeslices with authorized tokens embedded exclusively in designated slices, creating a time-dependent authorization mechanism. The SNN is trained to respond correctly only to authorized data containing the token in the correct timeslice while producing erroneous outputs on unauthorized data. The approach is claimed to support multi-user authorization and arbitrary token morphologies. Evaluations on multiple neuromorphic datasets report ~10% accuracy on unauthorized inputs with ~1.5% degradation on authorized inputs, plus robustness to finetuning and pruning.

Significance. If the performance and robustness claims hold after addressing the temporal isolation issue, the work would fill a notable gap in SNN-specific copyright protection, an area described as underexplored relative to DNNs. The exploitation of SNN temporal coding for backdoor triggers is a distinctive technical contribution that could enable practical multi-user scenarios in edge AI and robotics applications.

major comments (2)
  1. [Method (temporal segmentation and token embedding)] The central performance claims (~10% unauthorized accuracy and ~1.5% authorized degradation) rest on the assumption that timeslice partitioning enables exclusive token embedding without cross-slice interference. Standard LIF or similar neuron models integrate membrane potential across time steps, so a token-induced perturbation in one slice can alter spike timing or rates in later slices. This directly risks either unreliable backdoor triggering on unauthorized data or degradation exceeding the claimed margin on authorized data. No analysis, ablation, or mitigation of this leakage appears in the method description.
  2. [Experiments and Evaluation] The reported quantitative results lack any description of the training procedure, loss functions (including the backdoor regularization term), exact datasets, baseline comparisons, or statistical controls. Without these, it is impossible to assess whether the data support the stated accuracy figures or robustness claims.
minor comments (2)
  1. [Abstract] The abstract uses the nonstandard phrasing 'manifest that'; 'demonstrate that' would be clearer.
  2. [Abstract] The abstract states performance numbers but supplies no high-level overview of training or evaluation protocols, reducing immediate readability.

Simulated Author's Rebuttal

2 responses · 0 unresolved

We thank the referee for the constructive comments, which highlight important aspects for strengthening the manuscript. We address each major comment below and will incorporate revisions to provide additional analysis and details as needed.

read point-by-point responses

  1. Referee: [Method (temporal segmentation and token embedding)] The central performance claims (~10% unauthorized accuracy and ~1.5% authorized degradation) rest on the assumption that timeslice partitioning enables exclusive token embedding without cross-slice interference. Standard LIF or similar neuron models integrate membrane potential across time steps, so a token-induced perturbation in one slice can alter spike timing or rates in later slices. This directly risks either unreliable backdoor triggering on unauthorized data or degradation exceeding the claimed margin on authorized data. No analysis, ablation, or mitigation of this leakage appears in the method description.

    Authors: We acknowledge this is a valid concern, as LIF neurons do integrate over time and cross-slice effects are possible in principle. Our empirical evaluations across multiple datasets show the reported performance levels are achieved, suggesting the temporal backdoor effect remains sufficiently localized in practice for the chosen timeslice durations and token placements. However, we agree that explicit analysis is warranted to rule out significant leakage. In the revision, we will add an ablation study quantifying membrane potential carry-over, spike rate changes, and timing shifts in subsequent slices when tokens are embedded, for both authorized and unauthorized cases. This will include mitigation strategies such as adjusting timeslice boundaries or regularization terms if interference is observed. revision: yes

  2. Referee: [Experiments and Evaluation] The reported quantitative results lack any description of the training procedure, loss functions (including the backdoor regularization term), exact datasets, baseline comparisons, or statistical controls. Without these, it is impossible to assess whether the data support the stated accuracy figures or robustness claims.

    Authors: We apologize for the insufficient detail in the submitted version. The manuscript describes the overall approach and reports results on neuromorphic datasets, but the training procedure, exact loss formulation (including the temporal backdoor regularization term), dataset specifics, baselines, and statistical reporting were not presented with sufficient clarity. In the revised manuscript, we will expand the Experiments section to include: (i) the full training procedure and hyperparameters, (ii) the mathematical definition of the backdoor regularization loss, (iii) exact dataset names, preprocessing, and splits, (iv) baseline methods with direct comparisons, and (v) statistical controls such as means and standard deviations over multiple random seeds. revision: yes

Circularity Check

0 steps flagged

No circularity: empirical method proposal with no derivation chain

full rationale

The paper presents SpikeTimer as a design for temporal backdoor-based copyright protection in SNNs, relying on partitioning neuromorphic inputs into timeslices and embedding authorized tokens. No equations, first-principles derivations, or 'predictions' appear in the abstract or description. Claims of ~10% unauthorized accuracy and ~1.5% authorized degradation are framed as empirical evaluation outcomes on datasets, not reductions of fitted parameters or self-referential definitions. No self-citations, uniqueness theorems, or ansatzes are invoked to justify core mechanics. The approach is self-contained as an engineering construction evaluated externally, with no load-bearing step that collapses to its own inputs by construction.

Axiom & Free-Parameter Ledger

1 free parameters · 1 axioms · 1 invented entities

The framework rests on the domain assumption that neuromorphic data admits clean temporal partitioning for independent token placement; no free parameters or invented entities are quantified in the abstract.

free parameters (1)
  • timeslice boundaries
    The choice of which timeslices receive the authorized tokens is a design parameter that determines authorization behavior.
axioms (1)
  • domain assumption Neuromorphic data streams can be partitioned into timeslices that support independent token embedding without disrupting spike-driven computation.
    Invoked when the abstract states that the inherent temporal segmentation enables the mechanism.
invented entities (1)
  • temporal token validity no independent evidence
    purpose: Enforces authorization by making token presence valid only in designated timeslices
    New mechanism introduced to achieve time-dependent copyright protection.

pith-pipeline@v0.9.1-grok · 5777 in / 1339 out tokens · 58516 ms · 2026-06-26T04:25:52.832292+00:00 · methodology

discussion (0)

Sign in with ORCID, Apple, or X to comment. Anyone can read and Pith papers without signing in.

Reference graph

Works this paper leans on

45 extracted references

  1. [1]

    Rmp-snn: Residual membrane potential neuron for enabling deeper high-accuracy and low-latency spiking neural network,

    B. Han, G. Srinivasan, and K. Roy, “Rmp-snn: Residual membrane potential neuron for enabling deeper high-accuracy and low-latency spiking neural network,” inProc. CVPR, 2020, pp. 13 558–13 567

    2020

  2. [2]

    Training spiking neural networks using lessons from deep learning,

    J. K. Eshraghian, M. Ward, E. O. Neftci, X. Wang, G. Lenz, G. Dwivedi, M. Bennamoun, D. S. Jeong, and W. D. Lu, “Training spiking neural networks using lessons from deep learning,”Proc. IEEE, 2023

    2023

  3. [3]

    Hire-snn: Harnessing the inherent robustness of energy-efficient deep spiking neural networks by training with crafted input noise,

    S. Kundu, M. Pedram, and P. A. Beerel, “Hire-snn: Harnessing the inherent robustness of energy-efficient deep spiking neural networks by training with crafted input noise,” inProc. CVPR, 2021, pp. 5209–5218

    2021

  4. [4]

    Intellectual property protection of dnn models,

    S. Peng, Y . Chen, J. Xu, Z. Chen, C. Wang, and X. Jia, “Intellectual property protection of dnn models,”World Wide Web, vol. 26, no. 4, pp. 1877–1911, 2023

    1911

  5. [5]

    Steganographic passport: An owner and user verifiable credential for deep model ip protection without retraining,

    Q. Cui, R. Meng, C. Xu, and C.-H. Chang, “Steganographic passport: An owner and user verifiable credential for deep model ip protection without retraining,” inProc. CVPR, June 2024, pp. 12 302–12 311

    2024

  6. [6]

    Watermarking neuromorphic brains: Intellectual property protection in spiking neural networks,

    H. Poursiami, I. Alouani, and M. Parsa, “Watermarking neuromorphic brains: Intellectual property protection in spiking neural networks,” in Proc. ICONS, 2024, pp. 287–294

    2024

  7. [7]

    Incorporating learnable membrane time constant to enhance learning of spiking neural networks,

    W. Fang, Z. Yu, Y . Chen, T. Masquelier, T. Huang, and Y . Tian, “Incorporating learnable membrane time constant to enhance learning of spiking neural networks,” inProc. CVPR, 2021, pp. 2661–2671

    2021

  8. [8]

    Direct learning-based deep spiking neural networks: a review,

    Y . Guo, X. Huang, and Z. Ma, “Direct learning-based deep spiking neural networks: a review,”Front. Neurosci., vol. 17, p. 1209795, 2023

    2023

  9. [9]

    Synaptic modifications in cultured hip- pocampal neurons: dependence on spike timing, synaptic strength, and postsynaptic cell type,

    G.-q. Bi and M.-m. Poo, “Synaptic modifications in cultured hip- pocampal neurons: dependence on spike timing, synaptic strength, and postsynaptic cell type,”J. Neurosci., vol. 18, no. 24, pp. 10 464–10 472, 1998

    1998

  10. [10]

    Spikeconverter: An efficient conversion framework zipping the gap between artificial neural networks and spiking neural networks,

    F. Liu, W. Zhao, Y . Chen, Z. Wang, and L. Jiang, “Spikeconverter: An efficient conversion framework zipping the gap between artificial neural networks and spiking neural networks,” inProc. AAAI, vol. 36, no. 2, 2022, pp. 1692–1701

    2022

  11. [11]

    Lisnn: Improving spiking neural networks with lateral interactions for robust object recognition

    X. Cheng, Y . Hao, J. Xu, and B. Xu, “Lisnn: Improving spiking neural networks with lateral interactions for robust object recognition.” inProc. IJCAI, 2020, pp. 1519–1525

    2020

  12. [12]

    A free lunch from ann: Towards efficient, accurate spiking neural networks calibration,

    Y . Li, S. Deng, X. Dong, R. Gong, and S. Gu, “A free lunch from ann: Towards efficient, accurate spiking neural networks calibration,” inProc. ICML, 2021, pp. 6316–6325

    2021

  13. [13]

    Surrogate module learning: Reduce the gradient error accumulation in training spiking neural networks,

    S. Deng, H. Lin, Y . Li, and S. Gu, “Surrogate module learning: Reduce the gradient error accumulation in training spiking neural networks,” in Proc. ICML, 2023, pp. 7645–7657

    2023

  14. [14]

    Embedding water- marks into deep neural networks,

    Y . Uchida, Y . Nagai, S. Sakazawa, and S. Satoh, “Embedding water- marks into deep neural networks,” inProc. ACM ICMR, 2017, pp. 269– 277

    2017

  15. [15]

    Riga: Covert and robust white-box watermarking of deep neural networks,

    T. Wang and F. Kerschbaum, “Riga: Covert and robust white-box watermarking of deep neural networks,” inProc. WWW, 2021, pp. 993– 1004

    2021

  16. [16]

    Deepsigns: An end- to-end watermarking framework for ownership protection of deep neural networks,

    B. Darvish Rouhani, H. Chen, and F. Koushanfar, “Deepsigns: An end- to-end watermarking framework for ownership protection of deep neural networks,” inProc. ASPLOS, 2019, pp. 485–497

    2019

  17. [17]

    Turning your weakness into a strength: Watermarking deep neural networks by backdooring,

    Y . Adi, C. Baum, M. Cisse, B. Pinkas, and J. Keshet, “Turning your weakness into a strength: Watermarking deep neural networks by backdooring,” inProc. USENIX Security, 2018, pp. 1615–1631

    2018

  18. [18]

    Protecting intellectual property of deep neural networks with watermarking,

    J. Zhang, Z. Guet al., “Protecting intellectual property of deep neural networks with watermarking,” inProc. ACM Asia CCS, 2018, pp. 159– 172

    2018

  19. [19]

    Entangled watermarks as a defense against model extraction,

    H. Jia, C. A. Choquette-Choo, V . Chandrasekaran, and N. Papernot, “Entangled watermarks as a defense against model extraction,” inProc. USENIX Security, 2021, pp. 1937–1954

    2021

  20. [20]

    Sslguard: A watermarking scheme for self-supervised learning pre-trained encoders,

    T. Cong, X. He, and Y . Zhang, “Sslguard: A watermarking scheme for self-supervised learning pre-trained encoders,” inProc. ACM CCS, 2022, pp. 579–593

    2022

  21. [21]

    Chaotic weights: A novel approach to protect intellectual property of deep neural networks,

    N. Lin, X. Chen, H. Lu, and X. Li, “Chaotic weights: A novel approach to protect intellectual property of deep neural networks,”IEEE TCAD, vol. 40, no. 7, pp. 1327–1339, 2020

    2020

  22. [22]

    Advparams: An active dnn intellectual property protection technique via adversarial perturbation based parameter encryption,

    M. Xue, Z. Wu, Y . Zhang, J. Wang, and W. Liu, “Advparams: An active dnn intellectual property protection technique via adversarial perturbation based parameter encryption,”IEEE TETC, vol. 11, no. 3, pp. 664–678, 2022

    2022

  23. [23]

    Protecting intellectual property with reliable availability of learning models in ai-based cyber- security services,

    G. Ren, J. Wu, G. Li, S. Li, and M. Guizani, “Protecting intellectual property with reliable availability of learning models in ai-based cyber- security services,”IEEE TDSC, vol. 21, no. 2, pp. 600–617, 2022

    2022

  24. [24]

    ActiveDaemon: Unconscious DNN dormancy and waking up via user-specific invisible token,

    G. Ren, G. Li, S. Li, L. Chen, and K. Ren, “ActiveDaemon: Unconscious DNN dormancy and waking up via user-specific invisible token,” in Proc. NDSS, 2024

    2024

  25. [25]

    Signed neuron with memory: Towards simple, accurate and high-efficient ann-snn conversion

    Y . Wang, M. Zhang, Y . Chen, and H. Qu, “Signed neuron with memory: Towards simple, accurate and high-efficient ann-snn conversion.” in Proc. IJCAI, 2022, pp. 2501–2508

    2022

  26. [26]

    Gerstner and W

    W. Gerstner and W. M. Kistler,Spiking neuron models: Single neurons, populations, plasticity. Cambridge university press, 2002

    2002

  27. [27]

    Surrogate gradient learning in spiking neural networks: Bringing the power of gradient-based optimization to spiking neural networks,

    E. O. Neftci, H. Mostafa, and F. Zenke, “Surrogate gradient learning in spiking neural networks: Bringing the power of gradient-based optimization to spiking neural networks,”IEEE Signal Process. Mag., vol. 36, no. 6, pp. 51–63, 2019

    2019

  28. [28]

    Events-to-video: Bringing modern computer vision to event cameras,

    H. Rebecq, R. Ranftl, V . Koltun, and D. Scaramuzza, “Events-to-video: Bringing modern computer vision to event cameras,” inProc. CVPR, 2019, pp. 3857–3866

    2019

  29. [29]

    Neuroclip: Neuromorphic data under- standing by clip and snn,

    Y . Guo, Y . Chen, and Z. Ma, “Neuroclip: Neuromorphic data under- standing by clip and snn,”IEEE Signal Process. Lett., 2024

    2024

  30. [30]

    Backdoor attacks and countermeasures on deep learning: A comprehensive review,

    Y . Gao, B. G. Doan, Z. Zhang, S. Ma, J. Zhang, A. Fu, S. Nepal, and H. Kim, “Backdoor attacks and countermeasures on deep learning: A comprehensive review,”arXiv preprint arXiv:2007.10760, 2020

    arXiv 2007

  31. [31]

    Spottune: transfer learning through adaptive fine-tuning,

    Y . Guo, H. Shi, A. Kumar, K. Grauman, T. Rosing, and R. Feris, “Spottune: transfer learning through adaptive fine-tuning,” inProc. CVPR, 2019, pp. 4805–4814

    2019

  32. [32]

    Discrimination-aware network pruning for deep model compression,

    J. Liu, B. Zhuang, Z. Zhuang, Y . Guo, J. Huang, J. Zhu, and M. Tan, “Discrimination-aware network pruning for deep model compression,” IEEE TPAMI, vol. 44, no. 8, pp. 4035–4051, 2021

    2021

  33. [33]

    Converting static image datasets to spiking neuromorphic datasets using saccades,

    G. Orchard, A. Jayawant, G. K. Cohen, and N. Thakor, “Converting static image datasets to spiking neuromorphic datasets using saccades,” Front. Neurosci., vol. 9, p. 437, 2015

    2015

  34. [34]

    Cifar10-dvs: an event-stream dataset for object classification,

    H. Li, H. Liu, X. Ji, G. Li, and L. Shi, “Cifar10-dvs: an event-stream dataset for object classification,”Front. Neurosci., vol. 11, p. 309, 2017

    2017

  35. [35]

    Converting static image datasets to spiking neuromorphic datasets using saccades,

    G. Orchard, A. Jayawant, G. K. Cohen, and N. Thakor, “Converting static image datasets to spiking neuromorphic datasets using saccades,” Front. Neurosci., vol. 9, 2015

    2015

  36. [36]

    A low power, fully event-based gesture recognition system,

    A. Amiret al., “A low power, fully event-based gesture recognition system,” inProc. CVPR, 2017, pp. 7243–7252

    2017

  37. [37]

    Dailydvs-200: A comprehensive benchmark dataset for event-based action recognition,

    Q. Wang, Z. Xu, Y . Lin, J. Ye, H. Li, G. Zhu, S. A. A. Shah, M. Ben- namoun, and L. Zhang, “Dailydvs-200: A comprehensive benchmark dataset for event-based action recognition,” inProc. ECCV, 2024, pp. 55–72

    2024

  38. [38]

    Advancing spiking neural networks towards multiscale spatiotemporal interaction learning,

    Y . Shan, M. Zhang, R. Zhu, X. Qiu, J. K. Eshraghian, and H. Qu, “Advancing spiking neural networks towards multiscale spatiotemporal interaction learning,” inProc. AAAI, 2025

    2025

  39. [39]

    Ffcba: Feature-based full-target clean-label backdoor attacks,

    Y . Yin, H. Chen, Y . Gao, P. Sun, L. Wu, Z. Li, and W. Liu, “Ffcba: Feature-based full-target clean-label backdoor attacks,” inProc. ACM MM, 2025, p. 3884–3892

    2025

  40. [40]

    Waveattack: Asymmetric frequency obfuscation-based backdoor attacks against deep neural networks,

    J. Xia, Z. Yue, Y . Zhou, Z. Ling, Y . Shi, X. Wei, and M. Chen, “Waveattack: Asymmetric frequency obfuscation-based backdoor attacks against deep neural networks,” inProc. NeurIPS. Curran Associates, Inc., 2024, pp. 43 549–43 570

    2024

  41. [41]

    Spikingjelly: An open-source machine learning infrastructure platform for spike-based intelligence,

    W. Fang, Y . Chen, J. Ding, Z. Yu, T. Masquelier, D. Chen, L. Huang, H. Zhou, G. Li, and Y . Tian, “Spikingjelly: An open-source machine learning infrastructure platform for spike-based intelligence,”Sci. Adv., vol. 9, no. 40, p. eadi1480, 2023

    2023

  42. [42]

    Neural cleanse: Identifying and mitigating backdoor attacks in neural networks,

    B. Wang, Y . Yao, S. Shan, H. Li, B. Viswanath, H. Zheng, and B. Y . Zhao, “Neural cleanse: Identifying and mitigating backdoor attacks in neural networks,” inProc. IEEE SP, 2019, pp. 707–723

    2019

  43. [43]

    Spikingformer: A key foundation model for spiking neural networks,

    C. Zhou, L. Yu, Z. Zhou, H. Zhang, J. Wang, H. Zhou, Z. Ma, and Y . Tian, “Spikingformer: A key foundation model for spiking neural networks,” inProc. AAAI, 2026, pp. 2236–2244

    2026

  44. [44]

    Spike- driven transformer,

    M. Yao, J. Hu, Z. Zhou, L. Yuan, Y . Tian, B. Xu, and G. Li, “Spike- driven transformer,” inProc. NeurIPS, 2023, pp. 64 043–64 058

    2023

  45. [45]

    Te-spikformer:temporal-enhanced spiking neural network with trans- former,

    S. Gao, X. Fan, X. Deng, Z. Hong, H. Zhou, and Z. Zhu, “Te-spikformer:temporal-enhanced spiking neural network with trans- former,”Neurocomputing, vol. 602, p. 128268, 2024. IEEE TRANSACTIONS ON INFORMATION FORENSICS AND SECURITY , VOL. **, 20** 16 Xiao Yang(Member, IEEE) received his Ph.D. degree with distinction and M.S. degree in Computer Science from ...

    2024