Pith. sign in

REVIEW 3 major objections 6 minor 38 references

Spiking networks can be backdoored clean-label by only rearranging when neuromorphic events arrive, leaving counts and labels unchanged.

Reviewed by Pith at T0; open to challenge. T0 means a machine referee read the full paper against a public rubric. the ladder, T0–T4 →

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Retiming target-class neuromorphic events installs clean-label SNN backdoors with ASR up to 1.0 while leaving rate frames identical, and rate-collapsed defenses miss them.

T0 review reviewed 2026-07-31 challenge →

load-bearing objection First clean-label SNN backdoor via rate-preserving timestamp remaps; empirics are solid within a clearly scoped multi-step threat model. the 3 major comments →

arxiv 2607.28075 v1 pith:JZFS5U7L submitted 2026-07-30 cs.CR cs.AI

Temporal Poisoning: Clean-Label Backdoors via Event Redistribution in SNNs

Roberto Ria\~no , Gorka Abad , Stjepan Picek , Aitor Urbieta This is my paper
classification cs.CR cs.AI
keywords spiking neural networksclean-label backdoortemporal poisoningneuromorphic event datarate frametimestamp remappingbackdoor defensesDVS
verification ladder T0 review T1 audit T2 compute T3 formal T4 reserved

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

This paper shows that a backdoor can be installed in spiking neural networks without changing any training labels and without changing how many events each pixel records. The attacker only remaps timestamps on a fraction of target-class event streams, so the time-collapsed “rate frame” of a poisoned sample is mathematically identical to the clean one, yet the sequence the spiking model sees is different. Across three neuromorphic datasets and both convolutional and transformer spiking victims, at least one such timing transform reaches perfect attack success in the strongest setups, often from only dozens of retimed samples. Established defenses that first collapse time are blind by design; a simple model-free check on per-step event mass catches the transforms the authors tested. The practical point is that neuromorphic systems trusted for timing-sensitive edge tasks inherit a clean-label poisoning surface that frame-based security checks miss.

Core claim

A fixed timestamp remapping applied only to target-class training streams, with labels left unchanged and per-pixel per-polarity event counts exactly preserved, can teach an SNN to classify triggered non-target inputs as the target class, reaching ASR 1.00 in the strongest dataset–victim–trigger configurations while clean and triggered rate frames remain identical (SSIM 1.00, L0 = L∞ = 0).

What carries the argument

The temporal trigger: a fixed map φ on event timestamps (concentrate, front-load, or shift) that never adds, removes, recolors, or spatially moves events, so the rate frame R(E) is exactly invariant while membrane recurrence still sees a repeatable change in event coincidence over the T bins.

Load-bearing premise

The victim must actually depend on event timing through stateful multi-step spiking on a known time binning; if decisions used only total counts or an unknown collapsed pipeline, the same rate-preserving retiming would not install the backdoor.

What would settle it

Retrain the same victims on purely rate-collapsed inputs (one frame of totals per sample, no multi-step membrane state) and check whether the identical timestamp remaps still produce high ASR on triggered non-target tests; near-zero ASR would refute the claimed timing surface.

Watch this falsifier. Get emailed when new claim-graph text bears on it.

If this is right

  • Any defense or audit that inspects only the time-summed rate frame cannot see this poison, by construction.
  • Clean-label temporal poisoning is feasible on both convolutional and transformer SNNs and on multiple public neuromorphic benchmarks.
  • Attack success depends on trigger shape and placement (bursts and front-loading work; pure phase shift mostly fails), not on arbitrary timestamp noise.
  • Reliable detection of the evaluated transforms requires measuring per-step event mass (or another explicitly temporal statistic), not only time-averaged features.
  • Neuromorphic deployments that treat timing as the information channel need time-aware data filters before training, not only adapted image backdoor tools.

Where Pith is reading between the lines

These are editorial extensions of the paper, not claims the author makes directly.

  • If DVS capture pipelines ever expose controllable timing skew (lens, clock, or light modulation), the same rate-preserving idea could move from digital poisoning toward a physical clean-label path.
  • Vendors shipping multi-step SNN stacks may need a default temporal-mass sanitizer on third-party event datasets, analogous to how image pipelines already scan for spatial patches.
  • The near-failure of pure shift suggests future timing triggers will be forced toward coincidence-changing maps, which also makes simple concentration and phase features more diagnostic for defenders.
  • Large clean-accuracy drops on harder datasets imply attackers may face a stealth–utility tradeoff that rate-frame equality alone does not solve.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, simulated authors' rebuttal, and a circularity audit.

Referee Report

3 major / 6 minor

Summary. The paper introduces a clean-label backdoor for SNNs on neuromorphic event data: a fixed timestamp remapping applied only to target-class training streams, with labels left unchanged and per-pixel, per-polarity event counts exactly preserved. Clean and triggered rate frames are therefore identical (SSIM 1.00, L0 = L∞ = 0), while the multi-step spiking dynamics see a different temporal sequence. Three remapping families (concentrate, front-load, shift) are evaluated on N-MNIST, DVS-Gesture, and CIFAR10-DVS with convolutional and SpikformerLite victims. ASR reaches 1.00 in several strongest configurations; poison-budget and trigger-shape ablations and a clean-model control (Table 2) support that the effect is learned rather than an inherent bias of the transform. Established defenses adapted to SNNs are largely ineffective when they collapse time; a model-free per-step event-mass detector exposes the evaluated triggers.

Significance. If the results hold, this is a genuine first: clean-label data poisoning on SNNs/neuromorphic streams, exploiting a temporal attack surface that rate-frame inspection cannot see. That matters for edge and safety-critical neuromorphic deployments where third-party or update-stage data is realistic. Strengths include exact rate-frame invariance by construction, multi-dataset and multi-architecture evaluation with three seeds and SE, poison-rate and shape ablations, a clean-model control, honest reporting of shift failure and CA drops, careful documentation of defense adaptations (including where time is collapsed), and an adaptive temporal detector that bounds stealth rather than overclaiming it. Artifact and reproducibility commitments further strengthen the contribution for a security venue.

major comments (3)
  1. [Threat Model; §5 Attack Evaluation] Threat Model and §5 fix victim binning at T = 16 and state that the attacker knows the event representation and temporal discretization. No experiment tests ASR when the attacker’s assumed binning (or trigger placement in bin space) mismatches the victim’s actual T or windowing. Because membrane recurrence and the discrete trigger parameters (t*, k, s) are defined on that grid, transfer under discretization mismatch is load-bearing for the claimed practical threat; a short mismatch sweep (e.g., craft at T = 16, evaluate at T ∈ {8, 12, 24}, or off-by-one burst placement) would either support robustness or correctly narrow the claim.
  2. [§3 Goal; Table 3; §5.1; §9] Table 3 shows ASR = 1.00 alongside large clean-accuracy drops in several cells (CIFAR10-DVS conv ~8 points; SpikformerLite ~11–14 points; DVS-Gesture SpikformerLite ~23 points under concentrate). Section 3 requires the poisoned victim to “retain useful accuracy,” and §5.1 correctly notes non-uniform utility, but the abstract and conclusions still lead with ASR 1.00 “in the strongest configurations” without an explicit joint success criterion (e.g., ASR ≥ τ and ΔCA ≤ ε). Please define that criterion and report which dataset–victim–trigger cells meet it, so effectiveness is not read off ASR alone where utility cost is large.
  3. [§5 training protocol; Threat Model] Section 5 describes clean pretrain followed by a short poisoning phase (e.g., 5+12 epochs on N-MNIST). The threat model allows poison at any stage, including pretraining, but all main results use this two-stage schedule. It is unclear whether ASR and CA hold when poison is mixed from epoch 0 under the same total budget, or only after a clean warm start. A single ablation on one dataset–victim pair would confirm that the backdoor is not an artifact of the pretrain-then-poison protocol.
minor comments (6)
  1. [Table 4; §5.2] Table 4 spatial clean-label baselines are exploratory single-seed sweeps and are labeled descriptive; consider moving them to an appendix or marking them more visibly so they are not cited as a controlled ranking.
  2. [Figure 3; Table 8; §7.1] Figure 3 / defense tables: several Activation Clustering and pruning entries have SE on the order of the mean (e.g., 0.33 ± 0.33). The text already discounts some of these; ensuring every high-variance cell is flagged in the caption would help.
  3. [§5; Figure 3] Section heading “ATTACK EV ALUATION” appears to contain a spurious space; Figure 3 label “T emporal” likewise.
  4. [§5] Main tables fix yt = 0; the text points to the repository for other targets. A one-row or appendix summary that ASR is comparable for at least one other class per dataset would make the paper self-contained.
  5. [Table 7; §6.3] Neural Cleanse temporal variant is useful as a diagnostic; briefly state in the table caption that its cost is not the published anomaly index and is not used for flagging.
  6. [§8.2] Related work is appropriate; a short explicit contrast with dirty-label temporal federated triggers (Spikewhisper, time-distributed FL backdoors) on the clean-label vs dirty-label axis would sharpen novelty for readers of that line.

Circularity Check

0 steps flagged

No significant circularity: attack success is empirical, rate-frame identity is an invariance lemma, and self-citations are related-work context only.

full rationale

The central claim is that fixed timestamp remappings applied only to target-class streams (labels unchanged, per-pixel/per-polarity counts preserved) can install a backdoor in multi-step SNNs, with measured ASR up to 1.00 and identical clean/triggered rate frames. Rate-frame equality follows immediately from changing only timestamps (Eq. 6 and the definition of R(E) in Eq. 1); that is an invariance property of the construction, not a performance prediction forced by fitting. ASR/CA are measured on held-out triggered and clean test inputs after normal training (Tables 2–3, poison-rate and trigger-shape ablations). Table 2 shows the same transforms do not induce target-class bias on a clean model, so high ASR is learned rather than definitional. Defense blindness for rate-collapsed methods is correctly labeled structural (they discard the only axis the trigger changes). Author self-citations (prior dirty-label SNN backdoors, Flashy Backdoor, etc.) appear in related work and motivation, not as uniqueness theorems that force the present result. The model-free temporal-mass detector’s features are chosen to match the evaluated transforms, and the paper explicitly scopes that result as a stealth boundary rather than an independent law—secondary and acknowledged, not a circular derivation of the attack claim. The paper is self-contained against external benchmarks (datasets, multi-seed ASR/CA, adapted defenses).

Axiom & Free-Parameter Ledger

4 free parameters · 5 axioms · 2 invented entities

The result rests on standard SNN/event-camera modeling plus an operational attacker model and hand-chosen trigger/training knobs. No new physical entity is postulated; the “entities” are attack/defense constructions. Free parameters are experimental controls (poison fraction, remapping shape, binning, train schedule) that materially affect whether ASR saturates.

free parameters (4)
  • poison rate ρ (and absolute poison counts) = main: 0.1 / 0.5; sweep 0.01–0.5
    Chosen per dataset (0.1 N-MNIST/CIFAR10-DVS, 0.5 DVS-Gesture); ASR depends strongly on budget especially on small DVS-Gesture pool.
  • temporal bin count T and trigger shape params (t*, k, s / w, γ, δ) = T=16; main t*=8 or 0, k=4, s=8
    T=16 fixed; concentrate/front-load/shift parameters selected and swept; placement changes ASR dramatically on DVS sets.
  • training schedule (pretrain vs poison epochs, lr, batch) = e.g. N-MNIST 5+12 epochs, Adam 1e-3
    Update-stage poisoning with dataset-specific epoch splits; attack effectiveness is measured under these budgets, not proven schedule-invariant.
  • defense thresholds and adaptation choices = as in §6
    STRIP partners, silhouette 0.10, NC anomaly floor/clip, prune stop at 4-point CA loss, temporal detector 99th percentile—affect reported TPR/ASR residual.
axioms (5)
  • domain assumption LIF/IF multi-step dynamics with membrane carry-over make outputs depend on event timing/coincidence, not only integrated counts.
    §2.1 equations (2)–(4); used to explain why retiming can backdoor while rate frames match.
  • domain assumption Attacker may replace a fraction of target-class training streams and knows the victim’s event representation/binning, but cannot change labels, architecture, or training code.
    Threat Model §3; defines clean-label digital poisoning scope.
  • ad hoc to paper Stealth is assessed primarily via exact equality of time-collapsed rate frames R(E); defenders that only see R are given identical inputs by construction.
    §2 definition (1), §5.2; authors also admit full sequences differ—representation-specific stealth axiom.
  • domain assumption Standard backdoor defenses may be adapted by collapsing or averaging over T (rate input, time-averaged penultimate spikes, constant-in-time NC mask).
    §6; results about blindness follow from these adaptation choices.
  • domain assumption Surrogate-gradient activation-based training with voting/time-averaged logits is a valid victim training setup.
    §2.1 and §5 experimental protocol via SpikingJelly.
invented entities (2)
  • Concentrate / front-load / shift timestamp-remapping trigger families independent evidence
    purpose: Encode a clean-label backdoor solely in event timing while preserving counts.
    Defined in §4.1; empirical objects, not physical discoveries.
  • Model-free per-step event-mass temporal detector (entropy, peak, Gini, KL, phase lag) no independent evidence
    purpose: Show time-aware input inspection can catch the evaluated retimings.
    §6.4–7.1; features chosen for these transforms—evidence is internal evaluation.

reviewed 2026-07-31 · how reviews work

0 comments
Cite this review

Pith. "Pith review of Temporal Poisoning: Clean-Label Backdoors via Event Redistribution in SNNs." pith.science (2026). https://pith.science/paper/JZFS5U7L

@misc{pith2026260728075,
  author       = {Pith},
  title        = {Pith review of: Temporal Poisoning: Clean-Label Backdoors via Event Redistribution in SNNs},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/JZFS5U7L}},
  note         = {Machine review of arXiv:2607.28075}
}
Share X Bluesky LinkedIn Reddit HN
read the original abstract

Backdoor attacks on Spiking Neural Networks (SNNs) have primarily assumed dirty-label poisoning, in which triggered training samples are relabeled to an attacker-selected class. We study clean-label temporal poisoning, where a fixed timestamp transformation is applied only to the target-class training streams, leaving their labels unchanged. The transformation preserves the per-pixel, per-polarity event count exactly, making clean and triggered samples identical after temporal aggregation while altering the sequence processed by the SNN. Across three neuromorphic datasets and both convolutional and transformer-based victims, the attack reaches an ASR of 1.00 in the strongest configurations. We analyze the attack through poison-budget and trigger-shape ablations and evaluate established backdoor defenses adapted to spiking models. Defenses that collapse the time axis before inspection are blind by construction, while feature-space methods detect the poison only in selected settings. Our model-free detector, based on per-step event mass, detects the evaluated temporal transformations, demonstrating both the limitation of rate-collapsed defenses and the boundary of the attack's stealth. To our knowledge, this is the first clean-label backdoor attack evaluated on SNNs and neuromorphic event data.

Figures

Figures reproduced from arXiv: 2607.28075 by Aitor Urbieta, Gorka Abad, Roberto Ria\~no, Stjepan Picek.

Figure 1
Figure 1. Figure 1: Poison-rate sweep on the convolutional victim using the con￾centrate trigger. Rates are expressed as fractions of the target-class pool. ASR saturates at the smallest tested rate on N-MNIST and from 𝜌 = 0.05 on CIFAR10-DVS. On DVS-Gesture, whose target-class pool holds only 97 samples, the ASR grows steadily with the poison rate but does not reliably reach 1.00. Mean ± standard error over three seeds; [PI… view at source ↗
Figure 2
Figure 2. Figure 2: Trigger-shape sweep on the convolutional victim, reported as ASR for N-MNIST, DVS-Gesture, and CIFAR10-DVS. Each panel sweeps one trigger family over its shape parameter: concentrate over the target step 𝑡 ∗ , front-load over the number of leading steps 𝑘, and shift over the roll amount 𝑠. On the two DVS datasets, concentrate is strongest at the ends of the interval and weakest in the middle, and front-loa… view at source ↗
Figure 3
Figure 3. Figure 3: Detection performance (TPR at 1% FPR) across the six victim cells, by trigger family. Rows are defenses; ours is the bottom row. Chance is 0.01. DVS is DVS-Gesture, CIFAR is CIFAR10-DVS, Spik is SpikformerLite. dimensionality, victim quality, architecture, and attack stability are possible explanations for this pattern, but the six evaluated cells do not support a causal conclusion. The input-only temporal… view at source ↗

discussion (0)

Sign in with ORCID, Apple, or X to comment. Anyone can read and Pith papers without signing in.

Reference graph

Works this paper leans on

38 extracted references · 2 canonical work pages

  1. [1]

    Gorka Abad, Oguzhan Ersoy, Stjepan Picek, Víctor Julio Ramírez-Durán, and Aitor Urbieta. 2022. Poster: Backdoor Attacks on Spiking Neural Networks and Neuromorphic Datasets. InProceedings of the ACM SIGSAC Conference on Computer and Communications Security (CCS). 3441–3443. https://doi.org/10. 1145/3548606.3563532

    arXiv 2022

  2. [2]

    Gorka Abad, Oguzhan Ersoy, Stjepan Picek, and Aitor Urbieta. 2024. Sneaky Spikes: Uncovering Stealthy Backdoor Attacks in Spiking Neural Networks with Neuromorphic Data. InNetwork and Distributed System Security Symposium (NDSS). San Diego, CA, USA. https://doi.org/10.14722/ndss.2024.24334

    arXiv 2024

  3. [3]

    Gorka Abad, Stjepan Picek, and Aitor Urbieta. 2024. Time-Distributed Backdoor Attacks on Federated Spiking Learning.arXiv preprint arXiv:2402.02886(2024). https://arxiv.org/abs/2402.02886

    Pith/arXiv arXiv 2024

  4. [4]

    Arnon Amir, Brian Taba, David Berg, Timothy Melano, Jeffrey McKinstry, Carmelo Di Nolfo, Tapan Nayak, Alexander Andreopoulos, Guillaume Garreau, Marcela Mendoza, et al. 2017. A low power, fully event-based gesture recogni- tion system. InProceedings of the IEEE conference on computer vision and pattern recognition. 7243–7252

    2017

  5. [5]

    Mauro Barni, Konstantinos Kallas, and Benedetta Tondi. 2019. A New Backdoor Attack in CNNs by Training Set Corruption Without Label Poisoning. InPro- ceedings of the IEEE International Conference on Image Processing (ICIP). 356–360. https://doi.org/10.1109/ICIP.2019.8802997

    arXiv 2019

  6. [6]

    Stagsted, G

    Stefan Böttger, Rasmus K. Stagsted, G. Pineda-García, et al. 2020. Robust Trajec- tory Generation for Robotic Control on the Neuromorphic Research Chip Loihi. Frontiers in Neurorobotics14 (2020), 589532. https://doi.org/10.3389/fnbot.2020. 589532

    work page doi:10.3389/fnbot.2020 2020

  7. [7]

    Bryant Chen, Wilka Carvalho, Nathalie Baracaldo, Heiko Ludwig, Benjamin Edwards, Taesung Lee, Ian Molloy, and Biplav Srivastava. 2018. Detecting Back- door Attacks on Deep Neural Networks by Activation Clustering.arXiv preprint arXiv:1811.03728(2018). https://arxiv.org/abs/1811.03728

    Pith/arXiv arXiv 2018

  8. [8]

    Guang Chen et al. 2020. Event-Based Neuromorphic Vision for Autonomous Driving: A Paradigm Shift for Visual Perception.IEEE Signal Processing Magazine 37, 4 (2020), 34–49. https://doi.org/10.1109/MSP.2020.2985811

    arXiv 2020

  9. [9]

    Mike Davies, Narayan Srinivasa, Tsung-Han Lin, Gautham Chinya, Yongqiang Cao, Sri Harsha Choday, Georgios Dimou, Prasad Joshi, Nabil Imam, Shweta Jain, et al. 2018. Loihi: A Neuromorphic Manycore Processor with On-Chip Learning. IEEE Micro38, 1 (2018), 82–99. https://doi.org/10.1109/MM.2018.112130359

    arXiv 2018

  10. [10]

    Jianhao Ding, Zhaofei Yu, Yonghong Tian, and Tiejun Huang. 2021. Optimal ANN-SNN Conversion for Fast and Accurate Inference in Deep Spiking Neural Networks. InProceedings of the Thirtieth International Joint Conference on Artificial Intelligence (IJCAI-21). IJCAI, 2328–2336. https://doi.org/10.24963/ijcai.2021/321

    work page doi:10.24963/ijcai.2021/321 2021

  11. [11]

    Wei Fang, Yanqi Chen, Jianhao Ding, Zhaofei Yu, Timothée Masquelier, Ding Chen, Liwei Huang, Huihui Zhou, Guoqi Li, and Yonghong Tian. 2023. Spiking- Jelly: An open-source machine learning infrastructure platform for spike-based intelligence.Science Advances9, 40 (2023), eadi1480. https://doi.org/10.1126/ sciadv.adi1480 arXiv:https://www.science.org/doi/p...

    doi:10.1126/sciadv.adi1480 2023

  12. [12]

    Hao Fu et al. 2024. Spikewhisper: Temporal Spike Backdoor Attacks on Federated Neuromorphic Learning over Low-Power Devices.arXiv preprint arXiv:2403.18607 (2024). https://arxiv.org/abs/2403.18607

    Pith/arXiv arXiv 2024

  13. [13]

    Ranasinghe, and Surya Nepal

    Yansong Gao, Chang Xu, Derui Wang, Shiping Chen, Damith C. Ranasinghe, and Surya Nepal. 2019. STRIP: A Defence Against Trojan Attacks on Deep Neural Networks. InProceedings of the 35th Annual Computer Security Applications Conference (ACSAC). 113–125. https://doi.org/10.1145/3359789.3359790

    arXiv 2019

  14. [14]

    Wulfram Gerstner and Werner M. Kistler. 2002.Spiking Neuron Models: Single Neurons, Populations, Plasticity. Cambridge University Press, Cambridge, UK

    2002

  15. [15]

    Tianyu Gu, Brendan Dolan-Gavitt, and Siddharth Garg. 2019. BadNets: Evaluating Backdooring Attacks on Deep Neural Networks.IEEE Access7 (2019), 47230– 47244. https://doi.org/10.1109/ACCESS.2019.2909068

    arXiv 2019

  16. [16]

    Dahl, Abdel-rahman Mohamed, Navdeep Jaitly, Andrew Senior, Vincent Vanhoucke, Patrick Nguyen, Tara N

    Geoffrey Hinton, Li Deng, Dong Yu, George E. Dahl, Abdel-rahman Mohamed, Navdeep Jaitly, Andrew Senior, Vincent Vanhoucke, Patrick Nguyen, Tara N. Sainath, and Brian Kingsbury. 2012. Deep Neural Networks for Acoustic Modeling in Speech Recognition.IEEE Signal Processing Magazine29, 6 (2012), 82–97. https://doi.org/10.1109/MSP.2012.2205597

    arXiv 2012

  17. [17]

    Lingxin Jin, Meiyu Lin, Wei Jiang, and Jinyu Zhan. 2024. Data Poisoning-based Backdoor Attack Framework Against Supervised Learning Rules of Spiking Neural Networks.arXiv preprint arXiv:2409.15670(2024). https://arxiv.org/abs/ 2409.15670

    Pith/arXiv arXiv 2024

  18. [18]

    Thorpe, and Timo- thée Masquelier

    Saeed Reza Kheradpisheh, Mohammad Ganjtabesh, Simon J. Thorpe, and Timo- thée Masquelier. 2018. STDP-based spiking deep convolutional neural networks for object recognition.Neural Networks99 (2018), 56–67. https://doi.org/10.1016/ j.neunet.2017.12.005

    2018

  19. [19]

    Alex Krizhevsky, Ilya Sutskever, and Geoffrey E. Hinton. 2012. ImageNet Clas- sification with Deep Convolutional Neural Networks. InAdvances in Neural Information Processing Systems 25 (NIPS). 1097–1105

    2012

  20. [20]

    Hongmin Li, Hanchao Liu, Xiangyang Ji, Guoqi Li, and Luping Shi. 2017. Cifar10- dvs: an event-stream dataset for object classification.Frontiers in neuroscience11 (2017), 244131

    2017

  21. [21]

    Yudong Li, Yunlin Lei, and Xu Yang. 2024. Spikeformer: Training high- performance spiking neural network with transformer.Neurocomputing574 (2024), 127279

    2024

  22. [22]

    Patrick Lichtsteiner, Christoph Posch, and Tobi Delbrück. 2008. A 128×128 120 dB 15𝜇s Latency Asynchronous Temporal Contrast Vision Sensor.IEEE Journal of Solid-State Circuits43, 2 (2008), 566–576. https://doi.org/10.1109/JSSC.2007.914337

    arXiv 2008

  23. [23]

    Kang Liu, Brendan Dolan-Gavitt, and Siddharth Garg. 2018. Fine-Pruning: De- fending Against Backdooring Attacks on Deep Neural Networks. InResearch in Attacks, Intrusions, and Defenses (RAID) (Lecture Notes in Computer Science), Vol. 11050. Springer, 273–294. https://doi.org/10.1007/978-3-030-00470-5_13

    doi:10.1007/978-3-030-00470-5_13 2018

  24. [24]

    Neftci, Hesham Mostafa, and Friedemann Zenke

    Emre O. Neftci, Hesham Mostafa, and Friedemann Zenke. 2019. Surrogate Gradi- ent Learning in Spiking Neural Networks: Bringing the Power of Gradient-Based Optimization to Spiking Neural Networks.IEEE Signal Processing Magazine36, 6 (2019), 51–63. https://doi.org/10.1109/MSP.2019.2931595

    arXiv 2019

  25. [25]

    Garrick Orchard, Ajinkya Jayawant, Gregory K Cohen, and Nitish Thakor. 2015. Converting static image datasets to spiking neuromorphic datasets using saccades. Frontiers in neuroscience9 (2015), 437

    2015

  26. [26]

    Michael Pfeiffer, Johannes Schemmel, and Karlheinz Meier. 2013. An Autonomous Robot Controlled by a Spiking Neural Network Mimicking the Brain’s Naviga- tional System. InProceedings of the International Conference on Artificial Neural Networks (ICANN). 1–8. Also available as arXiv:1807.02155

    Pith/arXiv arXiv 2013

  27. [27]

    Roberto Riaño, Gorka Abad, Stjepan Picek, and Aitor Urbieta. 2025. Flashy Backdoor: Real-world Environment Backdoor Attack on SNNs with DVS Cameras. InAnnual Computer Security Applications Conference (ACSAC). ACM, 986–1002

    2025

  28. [28]

    Aniruddha Saha, Akshayvarun Subramanya, and Hamed Pirsiavash. 2020. Hidden Trigger Backdoor Attacks. InProceedings of the AAAI Conference on Artificial Intelligence, Vol. 34. 11957–11965. https://doi.org/10.1609/aaai.v34i07.6871

    doi:10.1609/aaai.v34i07.6871 2020

  29. [29]

    Dickerson, and Tom Goldstein

    Hadi Souri, Micah Goldblum, Xiaojun Gu, John P. Dickerson, and Tom Goldstein

  30. [30]

    Emma Strubell, Ananya Ganesh, and Andrew McCallum. 2019. Energy and Policy Considerations for Deep Learning in NLP.Proceedings of the 57th Annual Meeting of the Association for Computational Linguistics(2019), 3645–3650. https: //doi.org/10.18653/v1/P19-1355

    doi:10.18653/v1/p19-1355 2019

  31. [31]

    Amirhossein Tavanaei, Masoud Ghodrati, Saeed Reza Kheradpisheh, Timothée Masquelier, and Anthony Maida. 2019. Deep learning in spiking neural networks. Neural Networks111 (2019), 47–63. https://doi.org/10.1016/j.neunet.2018.12.002

    doi:10.1016/j.neunet.2018.12.002 2019

  32. [32]

    Brandon Tran, Jerry Li, and Aleksander Madry. 2018. Spectral Signatures in Back- door Attacks. InAdvances in Neural Information Processing Systems 31 (NeurIPS). 8000–8010

    2018

  33. [33]

    Alexander Turner, Dimitris Tsipras, and Aleksander Madry. 2019. Label- Consistent Backdoor Attacks.arXiv preprint arXiv:1912.02771(2019). https: //arxiv.org/abs/1912.02771

    Pith/arXiv arXiv 2019

  34. [34]

    Gomez, Łukasz Kaiser, and Illia Polosukhin

    Ashish Vaswani, Noam Shazeer, Niki Parmar, Jakob Uszkoreit, Llion Jones, Aidan N. Gomez, Łukasz Kaiser, and Illia Polosukhin. 2017. Attention Is All You Need. InAdvances in Neural Information Processing Systems 30 (NeurIPS). 5998–6008

    2017

  35. [35]

    Alberto Viale, Alberto Marchisio, Maurizio Martina, Guido Masera, and Muham- mad Shafique. 2021. CarSNN: An Efficient Spiking Neural Network for Event-Based Autonomous Cars on the Loihi Neuromorphic Research Proces- sor. InProceedings of the International Joint Conference on Neural Networks (IJCNN). 1–8. https://doi.org/10.1109/IJCNN52387.2021.9533737 Als...

    arXiv 2021

  36. [36]

    Bolun Wang, Yuanshun Yao, Shawn Shan, Huiying Li, Bimal Viswanath, Haitao Zheng, and Ben Y. Zhao. 2019. Neural Cleanse: Identifying and Mitigating Backdoor Attacks in Neural Networks. InProceedings of the IEEE Symposium on Security and Privacy (SP). 707–723. https://doi.org/10.1109/SP.2019.00031 11

    arXiv 2019

  37. [37]

    Shihao Zhao, Xingjun Ma, Xiang Zheng, James Bailey, Jingjing Chen, and Yu- Gang Jiang. 2020. Clean-Label Backdoor Attacks on Video Recognition Models. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR). 14443–14452. https://doi.org/10.1109/CVPR42600.2020.01446 A ARTIFACT & REPRODUCIBILITY All code, configurations, ...

    arXiv 2020

  38. [2022]

    InAdvances in Neural Information Processing Systems (NeurIPS), Vol

    Sleeper Agent: Scalable Hidden Trigger Backdoors for Neural Networks Trained from Scratch. InAdvances in Neural Information Processing Systems (NeurIPS), Vol. 35. 27941–27955

This paper was first reviewed by grok-4.5 on July 31, 2026.