Pith. sign in

REVIEW 4 major objections 4 minor 45 references

Izhikevich-Inspired Temporal Dynamics for Enhancing Privacy, Efficiency, and Transferability in Spiking Neural Networks

T0 review · 4 major / 4 minor · reviewed 2026-08-15 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read Input-level burst encodings let LIF spiking networks resist membership inference while keeping accuracy close to rate-based baselines.

desk verdict The paper's MIA protocol is internally contradictory, so the headline privacy result is not supported; the encoding comparison itself is useful but needs a corrected setup. read the letter →

arxiv 2505.04034 v1 pith:7TETID4P submitted 2025-05-07 cs.NE cs.AIcs.LG

Ayana Moshruba , Hamed Poursiami , Maryam Parsa This is my paper · ORCID
classification cs.NEcs.AIcs.LG
keywords spikingneuralnetworksIzhikevichneuronmodelmembershipinferenceattackstemporalspikedynamicsPoisson-BurstencodingDelayed-Burstprivacytransferlearning
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

The paper tries to show that biologically plausible spike-timing variability can be moved out of complex neuron models and into the input encoding, so ordinary Leaky Integrate-and-Fire (LIF) spiking networks get some of the robustness and privacy benefits of Izhikevich-style dynamics without paying the computational cost. It introduces two probabilistic encodings, Poisson-Burst, which makes bursts more likely for stronger inputs, and Delayed-Burst, which makes stronger inputs fire earlier, and compares them with standard rate encoding across accuracy, membership-inference attack (MIA) resilience, compute cost, and transfer learning. The headline finding is a favorable privacy-utility trade-off: Poisson-Burst keeps accuracy within about 1-3% of rate encoding while reducing attack AUC by as much as 6.5% in the paper's reported results, and it also lowers GPU power and memory use by roughly 10-15%. A sympathetic reader would care because this places spike-timing statistics as a cheap, plug-in privacy lever for neuromorphic systems, which often run on sensitive data and cannot afford heavy defenses.

What carries the argument

The load-bearing object is a pair of input-level stochastic spike encoders that graft Izhikevich-style temporal motifs onto standard LIF neurons. Poisson-Burst partitions time into intervals and runs a Bernoulli trial per interval with success probability $f(x_i)$ tied to input intensity; triggered bursts draw their spike count from a Poisson distribution. Delayed-Burst encodes the same intensities into a single burst whose onset delay is sampled from a Geometric distribution centered inversely on input magnitude, with burst size again Poisson. What these transformations do is decouple temporal richness from the neuron model: they inject controlled timing variability into the spike train while keeping LIF's simple threshold dynamics, which lets gradient-based training and the snnTorch implementation proceed unchanged. The stochastic burst structure, rather than total spike count, is what the paper credits for reducing memorization cues, lowering peak resource usage by spreading spikes across time, and preserving reusable features under transfer.

What would settle it

Re-run the membership-inference experiment with target and shadow models trained on genuinely disjoint halves of the same dataset under identical training protocols; if the attack AUC gap between Rate and Poisson-Burst disappears under a sound split, the central privacy claim is refuted. Alternatively, test whether the reported AUC differences persist when the attack model sees logits or losses instead of membrane potentials.

Watch

Extended reading notes

Core claim

On its own terms, the paper establishes that the statistics of input spike timing, not just spike count, control how much a spiking network memorizes its training set. Poisson-Burst dynamics divide time into intervals of length $\tau=10$, trigger a burst with probability proportional to input intensity, and draw the number of spikes in each burst from a Poisson distribution with mean $\lambda=3$; Delayed-Burst instead draws a burst onset delay from a Geometric distribution whose expectation falls as input intensity rises, then fires a Poisson-sized burst with $\lambda=4$. In experiments across MNIST, Fashion-MNIST, CIFAR-10, Iris, and Breast Cancer, both dynamics lower MIA AUC relative to Rate dynamics, by as much as 6.5% in the paper's summary, while Poisson-Burst keeps test accuracy within about 1-3% of the rate baseline and reduces GPU power, GPU memory, and CPU memory by roughly 10-15%. Transfer experiments from MNIST to Fashion-MNIST show all dynamics retain most accuracy, with Poisson-Burst degrading by less than 1% and retaining the lowest post-transfer attack AUC. The paper concludes that moderate, stochastic burst-level variability diffuses the output regularities that membership inference exploits, while input-dependent latency shifts disrupt feature extraction enough to explain Delayed-Burst's accuracy cost.

Load-bearing premise

The privacy comparison assumes the shadow-model membership-inference protocol in Section III-B correctly measures membership leakage; the text says the target model is trained on the full dataset while the shadow model is trained on a disjoint 20% subset, which is impossible, so if that protocol is invalid the reported AUC reductions are not reliable evidence of privacy protection.

Editorial extensions

If this is right

  • Poisson-Burst can replace rate encoding in LIF-based SNNs to reduce membership-inference AUC in the reported results while losing no more than about 1-3% accuracy.
  • Delayed-Burst offers the strongest privacy gains, up to a 6.5% attack-AUC reduction, at a 5-10% accuracy cost that is most severe on CIFAR-10 and Iris.
  • Poisson-Burst lowers GPU power, GPU memory, and CPU memory by roughly 10-15% compared with rate encoding, so the temporal encoding choice changes deployment cost.
  • After MNIST-to-Fashion-MNIST transfer, Poisson-Burst and Delayed-Burst end with lower attack AUC than rate encoding, suggesting the privacy benefit survives domain shift.
  • The degree and kind of spike-timing variability matter more than spike rate alone for the privacy-accuracy trade-off.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • An untested corollary of the paper's mechanism is that the Poisson-Burst hyperparameters ($\lambda$, $\tau$, and the Bernoulli probability mapping) trace a privacy-accuracy frontier; tuning them per dataset might extend the reported 1-3% accuracy loss closer to zero.
  • If stochastic spike timing reduces memorization as the paper argues, similar MIA resilience should appear in non-spiking networks when input noise or stochastic activations are added at the same layer, a testable bridge to standard deep learning.
  • The paper's efficiency explanation predicts that any encoding whose spikes concentrate into fewer time steps, not just Delayed-Burst, raises CPU memory due to buffering; measuring per-timestep activity would confirm or refine that rule.
  • A deeper consequence left implicit is that temporal variability acts as a regularizer tied to the input statistic rather than the loss, so it could combine with explicit differential-privacy noise rather than substitute for it.
Share X Bluesky LinkedIn Reddit HN

Signed reviews

No signed human review yet.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

4 major / 4 minor

Summary. The manuscript proposes two input-level temporal spike encodings for LIF-based SNNs—Poisson-Burst and Delayed-Burst—motivated by Izhikevich-type burst and latency dynamics. It compares these against standard rate-based encoding on MNIST, FMNIST, CIFAR-10, Iris, and Breast Cancer, measuring classification accuracy, membership-inference-attack AUC, resource usage on MNIST, and transferability from MNIST to FMNIST. The central claim is that Poisson-Burst maintains accuracy close to rate encoding while lowering resource overhead and MIA AUC, while Delayed-Burst provides stronger MIA resistance at a larger accuracy cost.

Significance. The question whether simple input-level stochastic encodings can improve privacy/utility/resource trade-offs in LIF SNNs is timely and potentially useful. The paper evaluates multiple dimensions and includes a transfer-learning probe, which is a strength. If the privacy results were reliable, the Poisson-Burst result would be a practical, easy-to-adopt contribution. However, the validity of the privacy comparisons currently rests on an internally inconsistent membership-inference setup, and most headline quantitative claims lack error bars or significance testing, so the significance is conditional on a corrected protocol.

major comments (4)
  1. [§III-B, Fig. 2] The MIA protocol is self-contradictory and cannot produce the reported AUCs as stated. The text first says 'The target model is trained on the full dataset,' then says the shadow model is 'trained on a randomly selected 20% subset of the dataset, disjoint from the target model's training data,' while the preceding sentence mentions a 'disjoint 80% subset.' If the target truly trains on the full dataset, there are no non-members for the target, so the IN/OUT labels are undefined and the AUC values in Table III do not measure membership leakage. The authors must specify a well-defined member/non-member partition for the target, train the shadow model on an analogous disjoint split, and report attack AUC on a target test set with known membership labels. This is the load-bearing step for the paper's privacy claim.
  2. [§V-B, Table III] Several reported privacy differences are smaller than or comparable to the reported standard deviations, e.g., MNIST Rate 0.525±0.010 vs. Poisson-Burst 0.519±0.012, FMNIST Poisson-Burst 0.511±0.012 vs. Delayed-Burst 0.511±0.013, and CIFAR-10 Rate 0.541±0.016 vs. Delayed-Burst 0.525±0.016. The conclusion that both dynamics consistently 'improve MIA resilience' is not supported without multi-seed distributions, per-dataset significance tests, or paired comparisons. The same issue affects test accuracies in §V-A, which are reported without any variability measure.
  3. [§V-C, Fig. 5] The computational-efficiency claim ('lower resource overhead' in the abstract) is supported only by qualitative statements and a single MNIST measurement, with no numerical values reported in Figure 5 and no error bars. The 'approximately 10–15%' reductions mentioned in the introduction do not appear in a results table or in a description of how GPU power, GPU memory, and CPU memory were sampled. Please report actual measured values, error bars, and the measurement procedure; otherwise the efficiency comparison is not testable.
  4. [§V-D, Table IV] The transferability conclusion is based on one source-target pair (MNIST → FMNIST) with single accuracy and AUC values. The claim that 'all spike dynamics exhibit improved MIA resilience following transfer' rests on AUC differences of roughly 1–4.6% without variability information. This is a useful pilot, but it should be framed as preliminary or supported by additional transfer pairs and repeated runs.
minor comments (4)
  1. [§III-B] There is a typo: 'both both implemented using the same architecture' should be 'both implemented using the same architecture.'
  2. [§IV-B] The statement that parameter values were 'selected through empirical tuning and visual inspection of spike patterns' is not sufficient for reproducibility; please list all parameter values per dataset and ideally include a small sensitivity analysis for λ, τ, ISI, and the clipping ratio.
  3. [References] Reference [2] uses the placeholder 'Author(s)' and reference [41] is an incomplete citation to the snnTorch tutorial; both should be completed before publication.
  4. [§IV-A] The text says 'The simulations run for T = 100 discrete timesteps,' but the rate-based encoding is not described in the same detail as the burst dynamics; please specify how rate encoding maps normalized inputs to spikes over the 100 timesteps.

Circularity Check

0 steps flagged · score 0.0 of 10

No circularity: the temporal encodings are defined independently of the outcome metrics and benchmarked on held-out data; the MIA protocol inconsistency is a validity concern, not a circular step.

full rationale

The paper's load-bearing claims are empirical. The proposed Poisson-Burst and Delayed-Burst dynamics are defined by explicit input-level probability mechanisms (Eq. 1, Eq. 2, Eq. 3) applied before the LIF network; these definitions do not reference accuracy, attack AUC, resource usage, or transfer outcomes. Reported hyperparameters (tau=10, lambda=3.0, clipping ratio=0.2) are stated as chosen by empirical tuning and visual inspection of spike patterns, not fitted to the privacy metric, so the MIA AUC reductions in Table III are not forced by construction. Prior self-citations [25]-[28] are related-work references and do not supply load-bearing premises, uniqueness theorems, or ansatze; removing them would not change the experimental results. There is, however, a notable internal contradiction in Section III-B: the text says 'The target model is trained on the full dataset, while the shadow model is trained on a disjoint 80% subset' and later 'It is trained on a randomly selected 20% subset of the dataset, disjoint from the target model's training data.' If the target truly used the full dataset, no non-member set exists for the target, making the reported MIA AUCs unreliable as measures of membership leakage. That is an experimental-validity problem, not a circular derivation, and therefore does not raise the circularity score. Overall, the derivation chain is self-contained against external benchmarks and does not reduce to its own inputs.

Assumptions & free parameters 7 free parameters · 4 assumptions · 0 invented entities

The central claims rest on a standard LIF training pipeline and on the validity of the MIA measurement, plus a set of hand-selected encoding parameters. No new physical entities are introduced. The most consequential entries are the assumed validity of the shadow-model attack and the unspecified burst-probability function.

free parameters (7)
  • Poisson-Burst burst interval tau = 10 time steps
    Hand-selected via empirical tuning and visual inspection in Section IV-B; no sensitivity analysis is provided.
  • Poisson-Burst mean burst size lambda = 3.0
    Hand-selected with no sensitivity analysis; affects spike count in each burst.
  • Poisson-Burst inter-spike interval = 1 time step
    Fixed by design; no sensitivity analysis is provided.
  • Delayed-Burst mean burst size lambda = 4.0
    Hand-selected with no sensitivity analysis; affects spike count in each burst.
  • Delayed-Burst clipping ratio = 0.2
    Hand-selected to control geometric-distribution variance; no sensitivity analysis is provided.
  • Delay margin m = not reported
    Appears in Equation 3 but its value is not stated; it directly affects the delay distribution.
  • Burst probability function f(x_i) = unspecified
    Equation 1 defines burst probability via a monotonic f(x_i), but no functional form is given; this is central to Poisson-Burst behavior.
assumptions (4)
  • domain assumption LIF neuron model with fixed membrane decay beta=0.95 is a sufficient substrate to evaluate the proposed temporal dynamics.
    Used throughout Section IV-A without an ablation on beta; the central comparison assumes LIF behavior is representative.
  • domain assumption The shadow-model MIA with membrane potentials at the final timestep as attack features yields a valid privacy metric.
    Section III-B; this is the measurement basis for the main privacy claim and is internally inconsistent as written.
  • domain assumption Input-level Poisson and Geometric burst statistics faithfully approximate Izhikevich-inspired temporal dynamics while preserving LIF compatibility.
    Introduction and Section III-A; no direct comparison to actual Izhikevich neuron outputs is provided.
  • domain assumption Standard surrogate-gradient training in snnTorch works equivalently across all three encodings.
    Training relies on snnTorch defaults, but the surrogate gradient choice is not specified; differences in training dynamics could confound the comparison.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Izhikevich-Inspired Temporal Dynamics for Enhancing Privacy, Efficiency, and Transferability in Spiking Neural Networks." pith.science (2026). https://pith.science/paper/7TETID4P

@misc{pith2026250504034,
  author       = {Pith},
  title        = {Pith review of: Izhikevich-Inspired Temporal Dynamics for Enhancing Privacy, Efficiency, and Transferability in Spiking Neural Networks},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/7TETID4P}},
  note         = {Machine review of arXiv:2505.04034}
}
read the original abstract

Biological neurons exhibit diverse temporal spike patterns, which are believed to support efficient, robust, and adaptive neural information processing. While models such as Izhikevich can replicate a wide range of these firing dynamics, their complexity poses challenges for directly integrating them into scalable spiking neural networks (SNN) training pipelines. In this work, we propose two probabilistically driven, input-level temporal spike transformations: Poisson-Burst and Delayed-Burst that introduce biologically inspired temporal variability directly into standard Leaky Integrate-and-Fire (LIF) neurons. This enables scalable training and systematic evaluation of how spike timing dynamics affect privacy, generalization, and learning performance. Poisson-Burst modulates burst occurrence based on input intensity, while Delayed-Burst encodes input strength through burst onset timing. Through extensive experiments across multiple benchmarks, we demonstrate that Poisson-Burst maintains competitive accuracy and lower resource overhead while exhibiting enhanced privacy robustness against membership inference attacks, whereas Delayed-Burst provides stronger privacy protection at a modest accuracy trade-off. These findings highlight the potential of biologically grounded temporal spike dynamics in improving the privacy, generalization and biological plausibility of neuromorphic learning systems.

Figures

Figures reproduced from arXiv: 2505.04034 by the authors.

Figure 1
Figure 1. Illustration of two biologically inspired temporal spike dynamics introduced in this study. ( [PITH_FULL_IMAGE:figures/full_fig_p003_1.png] view at source ↗
Figure 2
Figure 2. Membership Inference Attack (MIA) Framework [PITH_FULL_IMAGE:figures/full_fig_p003_2.png] view at source ↗
Figure 3
Figure 3. Impact of different temporal spike dynamics on model performance across (a) Fashion-MNIST, (b) CIFAR-10 and (c) [PITH_FULL_IMAGE:figures/full_fig_p006_3.png] view at source ↗
Figures from the paper (2 more)
Figure 4
Figure 4. Figure 4: ROC curves illustrating the effect of different temporal spike dynamics on MIA resilience across (a) FMNIST, (b) [PITH_FULL_IMAGE:figures/full_fig_p006_4.png]
Figure 5
Figure 5. Figure 5: Computational cost on MNIST across temporal spike dynamics: (a) GPU power, (b) GPU memory, (c) CPU memory. [PITH_FULL_IMAGE:figures/full_fig_p007_5.png]

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

45 extracted references · 31 canonical work pages

  1. [1]

    Towards spike-based machine intelligence with neuromorphic computing,

    K. Roy, A. Jaiswal, and P. Panda, “Towards spike-based machine intelligence with neuromorphic computing,” Nature, vol. 575, no. 7784, pp. 607–617, 2019

    2019

  2. [2]

    Spiking neural networks and their applications: A review,

    Author(s), “Spiking neural networks and their applications: A review,” Frontiers in Neuroscience, vol. 16, p. 931341, 2022

    work page 2022

  3. [3]

    Gerstner and W

    W. Gerstner and W. M. Kistler, Spiking neuron models: Single neurons, populations, plasticity. Cambridge University Press, 2002

    work page 2002

  4. [4]

    Which model to use for cortical spiking neurons?

    E. M. Izhikevich, “Which model to use for cortical spiking neurons?” IEEE transactions on neural networks , vol. 15, no. 5, pp. 1063–1070, 2004

    work page 2004

  5. [5]

    Simple model of spiking neurons,

    ——, “Simple model of spiking neurons,” IEEE Transactions on Neural Networks, vol. 14, no. 6, pp. 1569–1572, 2003

    work page 2003

  6. [6]

    Rapid neural coding in the retina with relative spike latencies,

    T. Gollisch and M. Meister, “Rapid neural coding in the retina with relative spike latencies,” Science, vol. 319, no. 5866, pp. 1108–1111, 2008

    2008

  7. [7]

    Mnist handwritten digit database,

    Y . LeCun, C. Cortes, and C. Burges, “Mnist handwritten digit database,” ATT Labs [Online]. Available: http://yann.lecun.com/exdb/mnist , vol. 2, 2010

    2010

  8. [8]

    Fashion-mnist: a novel image dataset for benchmarking machine learning algorithms,

    H. Xiao, K. Rasul, and R. V ollgraf, “Fashion-mnist: a novel image dataset for benchmarking machine learning algorithms,” CoRR, vol. abs/1708.07747, 2017. [Online]. Available: http://arxiv.org/abs/1708. 07747

    arXiv 2017

Show all 45 references
  1. [9]

    Cifar-10 (canadian institute for advanced research),

    A. Krizhevsky, V . Nair, and G. Hinton, “Cifar-10 (canadian institute for advanced research),” 2009, accessed: 2024-05-28. [Online]. Available: http://www.cs.toronto.edu/~kriz/cifar.html

    2009

  2. [10]

    R. A. Fisher, “Iris,” UCI Machine Learning Repository, 1936, DOI: https://doi.org/10.24432/C56C76

    1936 doi

  3. [11]

    Breast Cancer,

    M. Zwitter and M. Soklic, “Breast Cancer,” UCI Machine Learning Repository, 1988, DOI: https://doi.org/10.24432/C51P4M

    1988 doi

  4. [12]

    Membership inference attacks against machine learning models,

    R. Shokri, M. Stronati, C. Song, and V . Shmatikov, “Membership inference attacks against machine learning models,” in 2017 IEEE symposium on security and privacy (SP) . IEEE, 2017, pp. 3–18

    2017

  5. [13]

    Spiking neural networks,

    S. Ghosh-Dastidar and H. Adeli, “Spiking neural networks,” International Journal of Neural Systems , vol. 19, no. 04, pp. 295–308, 2009

    2009

  6. [14]

    Networks of spiking neurons: the third generation of neural network models,

    W. Maass, “Networks of spiking neurons: the third generation of neural network models,” Neural Networks, vol. 10, no. 9, pp. 1659–1671, 1997

    1997

  7. [15]

    Adaptive exponential integrate-and-fire model as an effective description of neuronal activity,

    R. Brette and W. Gerstner, “Adaptive exponential integrate-and-fire model as an effective description of neuronal activity,” Journal of Neurophysiology, vol. 94, no. 5, pp. 3637–3642, 2005

    2005

  8. [16]

    Spiking deep networks with lif neurons,

    E. Hunsberger and C. Eliasmith, “Spiking deep networks with lif neurons,” arXiv preprint arXiv:1510.08829 , 2015

    2015 arXiv

  9. [17]

    A theoretical analysis of neuronal variability,

    R. B. Stein, “A theoretical analysis of neuronal variability,” Biophysical Journal, vol. 5, no. 2, pp. 173–194, 1965

    1965

  10. [18]

    A quantitative description of membrane current and its application to conduction and excitation in nerve,

    A. L. Hodgkin and A. F. Huxley, “A quantitative description of membrane current and its application to conduction and excitation in nerve,” The Journal of physiology , vol. 117, no. 4, pp. 500–544, 1952

    1952

  11. [19]

    Intrinsic firing patterns of diverse neocortical neurons,

    B. W. Connors and M. J. Gutnick, “Intrinsic firing patterns of diverse neocortical neurons,” Trends in Neurosciences, vol. 13, pp. 99–104, 1990

    1990

  12. [20]

    Bursts as a unit of neural information: making unreliable synapses reliable,

    J. E. Lisman, “Bursts as a unit of neural information: making unreliable synapses reliable,” Trends in Neurosciences, vol. 20, no. 1, pp. 38–43, 1997

    1997

  13. [21]

    Large-scale model of mammalian thalamocortical systems,

    E. M. Izhikevich and G. M. Edelman, “Large-scale model of mammalian thalamocortical systems,” Proceedings of the National Academy of Sciences, vol. 105, no. 9, pp. 3593–3598, 2008

    2008

  14. [22]

    Dynamical systems in neuroscience,

    E. M. Izhikevich, “Dynamical systems in neuroscience,” MIT Press , 2007

    2007

  15. [23]

    Adversarial robustness of spiking neural networks,

    N. Rathi and K. Roy, “Adversarial robustness of spiking neural networks,” in 2019 International Joint Conference on Neural Networks (IJCNN) . IEEE, 2019, pp. 1–8

    2019

  16. [24]

    Inherent adversarial robustness of deep spiking neural networks: Effects of discrete input encoding and non-linear activations,

    M. Sharmin, N. Rathi, P. Panda, and K. Roy, “Inherent adversarial robustness of deep spiking neural networks: Effects of discrete input encoding and non-linear activations,” in 2019 IEEE/CVF International Conference on Computer Vision Workshop (ICCVW) . IEEE, 2019, pp. 2840–2849

    2019

  17. [25]

    Brainleaks: On the privacy- preserving properties of neuromorphic architectures against model inversion attacks,

    H. Poursiami, I. Alouani, and M. Parsa, “Brainleaks: On the privacy- preserving properties of neuromorphic architectures against model inversion attacks,” arXiv preprint arXiv:2402.00906 , 2024

    2024 arXiv

  18. [26]

    Do spikes protect privacy? investigating black-box model inversion attacks in spiking neural networks,

    H. Poursiami, A. Moshruba, and M. Parsa, “Do spikes protect privacy? investigating black-box model inversion attacks in spiking neural networks,” arXiv preprint arXiv:2502.05509 , 2025

    2025

  19. [27]

    Are neuromorphic architectures inherently privacy-preserving? an exploratory study,

    A. Moshruba, I. Alouani, and M. Parsa, “Are neuromorphic architectures inherently privacy-preserving? an exploratory study,” arXiv preprint arXiv:2411.06613, 2024

    2024 arXiv

  20. [28]

    On the privacy- preserving properties of spiking neural networks with unique surrogate gradients and quantization levels,

    A. Moshruba, S. Snyder, H. Poursiami, and M. Parsa, “On the privacy- preserving properties of spiking neural networks with unique surrogate gradients and quantization levels,” arXiv preprint arXiv:2502.18623 , 2025

    2025 arXiv

  21. [29]

    Efficient knowledge transfer strategy for snns from static to event domain,

    B. Liang, Y . Zhang, Y . Ma, Z. Li, Y . Wu, F. Zhang, and L. Shi, “Efficient knowledge transfer strategy for snns from static to event domain,” in Proceedings of the 30th ACM International Conference on Multimedia . ACM, 2022, pp. 1266–1274

    2022

  22. [30]

    Bridging resnet and vision transformer in snns,

    L. Zhang, X. Zhang, F. Li, B. Liang, Y . Wu, and L. Shi, “Bridging resnet and vision transformer in snns,” in Proceedings of the AAAI Conference on Artificial Intelligence , vol. 38, no. 13, 2024, pp. 14 976–14 984

    2024

  23. [31]

    Deep learning with spiking neurons: Oppor- tunities and challenges,

    M. Pfeiffer and T. Pfeil, “Deep learning with spiking neurons: Oppor- tunities and challenges,” Frontiers in Neuroscience , vol. 12, p. 774, 2018

    2018

  24. [32]

    Deep learning in spiking neural networks,

    A. Tavanaei, M. Ghodrati, S. R. Kheradpisheh, T. Masquelier, and A. Maida, “Deep learning in spiking neural networks,” Neural Networks, vol. 111, pp. 47–63, 2019

    2019

  25. [33]

    Membership inference attacks against machine learning models,

    R. Shokri, M. Stronati, C. Song, and V . Shmatikov, “Membership inference attacks against machine learning models,” in 2017 IEEE Symposium on Security and Privacy (SP) . IEEE, 2017, pp. 3–18

    2017

  26. [34]

    Privacy risk in machine learning: Analyzing the connection to overfitting,

    S. Yeom, I. Giacomelli, M. Fredrikson, and S. Jha, “Privacy risk in machine learning: Analyzing the connection to overfitting,” in 2018 IEEE 31st Computer Security Foundations Symposium (CSF) . IEEE, 2018, pp. 268–282

    2018

  27. [35]

    Comprehensive privacy analysis of deep learning: Passive and active white-box inference attacks against centralized and federated learning,

    M. Nasr, R. Shokri, and A. Houmansadr, “Comprehensive privacy analysis of deep learning: Passive and active white-box inference attacks against centralized and federated learning,” in 2019 IEEE Symposium on Security and Privacy (SP) . IEEE, 2019, pp. 739–753

    2019

  28. [36]

    Ml-leaks: Model and data independent membership inference attacks and defenses on machine learning models,

    A. Salem, Y . Zhang, M. Humbert, P. Berrang, M. Fritz, and M. Backes, “Ml-leaks: Model and data independent membership inference attacks and defenses on machine learning models,” in Network and Distributed Systems Security Symposium (NDSS) . Internet Society, 2019, available a...

    2019 arXiv

  29. [37]

    White-box vs black-box: Bayes optimal strategies for membership inference,

    A. Sablayrolles, M. Douze, C. Schmid, and H. Jégou, “White-box vs black-box: Bayes optimal strategies for membership inference,” in International Conference on Machine Learning (ICML) . PMLR, 2019, pp. 5558–5567. [Online]. Available: https://arxiv.org/abs/1807.09173

    2019 arXiv

  30. [38]

    Making large-scale svm learning practical,

    T. Joachims, “Making large-scale svm learning practical,” Technical report, Tech. Rep., 1998

    1998

  31. [39]

    A survey on transfer learning,

    S. J. Pan and Q. Yang, “A survey on transfer learning,”IEEE Transactions on Knowledge and Data Engineering , vol. 22, no. 10, pp. 1345–1359, 2010

    2010

  32. [40]

    How transferable are features in deep neural networks?

    J. Yosinski, J. Clune, Y . Bengio, and H. Lipson, “How transferable are features in deep neural networks?” in Advances in neural information processing systems, vol. 27, 2014

    2014

  33. [41]

    Snntorch: Tutorial 1,

    J. K. Eshraghian, “Snntorch: Tutorial 1,” 2023, accessed: 2024-05-28. [Online]. Available: https://snntorch.readthedocs.io/en/latest/tutorials/ tutorial_1.html

    2023

  34. [42]

    Nvidia a100 tensor core gpu architecture,

    NVIDIA Corporation, “Nvidia a100 tensor core gpu architecture,”

  35. [43]

    Adam: A method for stochastic optimization,

    D. P. Kingma and J. Ba, “Adam: A method for stochastic optimization,” International Conference on Learning Representations (ICLR) , 2015. [Online]. Available: https://arxiv.org/abs/1412.6980

    2015 arXiv

  36. [44]

    A generalized geometric distribution and some of its properties,

    A. N. Philippou, C. Georghiou, and G. N. Philippou, “A generalized geometric distribution and some of its properties,” Statistics & Probability Letters, vol. 1, no. 4, pp. 171–175, 1983

    1983

  37. [2020]

    Available: https://resources.nvidia.com/en-us-tensor-core/ nvidia-ampere-architecture-whitepaper

    [Online]. Available: https://resources.nvidia.com/en-us-tensor-core/ nvidia-ampere-architecture-whitepaper

Pith tools

Reviewed August 15, 2026 · model on record in the stance chip above.