Pith. sign in

REVIEW 4 major objections 5 minor 160 references

Emerging Threats and Countermeasures in Neuromorphic Systems: A Survey

T0 review · 4 major / 5 minor · reviewed 2026-08-04 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read Neuromorphic systems inherit classical hardware attacks and add new ones; a single taxonomy now maps both, and points to memristive variability as a double-edged security resource.

desk verdict Useful first map of neuromorphic security, but the map's accuracy is undercut by wrong attributions, an inconsistent count, and a missing audit trail—worth revising, then citing. read the letter →

arxiv 2601.16589 v2 pith:UZ5YKS7U submitted 2026-01-23 cs.CR cs.AIcs.ET

Pablo Sorrentino , Stjepan Picek , Ihsen Alouani , Nikolaos Athanasios Anagnostopoulos , Francesco Regazzoni , Lejla Batina , Tamalika Banerjee , Fatih Turkmen This is my paper
classification cs.CRcs.AIcs.ET
keywords NeuromorphiccomputingSpikingneuralnetworksHardwaresecuritySide-channelattacksFaultinjectionAdversarialPhysicalunclonablefunctionsTruerandomnumbergenerators
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

This survey tries to establish that the security of neuromorphic computing has been studied piecemeal, and that a single unified threat framework is both possible and necessary. It organizes 133 papers into one taxonomy spanning hardware attacks, software attacks on spiking neural networks, and security primitives built from the same devices that create the vulnerabilities. The paper argues that event-driven, asynchronous processing and stochastic memristive behavior create attack surfaces not present in conventional systems, while also enabling defenses and cryptographic primitives such as PUFs and TRNGs. If the map is accurate, the field gains a shared vocabulary for comparing attacks and countermeasures, and the paper's identified gaps—mostly simulative attacks, no standardized benchmarks, no cross-layer threat model—correctly mark the frontier.

What carries the argument

The load-bearing object is the taxonomy itself (Figure 4), which organizes the security landscape along six dimensions: aim of attack, target, data set, exploited property, attacker capability, and threat scenario. Its distinctive structural choice is the dual placement of side-channel and fault injection attacks across hardware and software branches, capturing that a physical leak can be read either as a device-level signal or as an effect on spiking computation. The recurring physical substrate is the memristor crossbar array, which simultaneously performs matrix-vector multiplication, leaks information through power and thermal signatures, and provides the stochastic variability from whic

What would settle it

Re-reading the cited papers and reconciling the arithmetic would settle the matter: the taxonomy's section counts in the paper sum to 126, not the stated 133, and the audit trail promised in Section 1 is not yet available. If the recount cannot be made to match the bibliography, or if cited works such as [66] and [112] turn out not to describe the neuromorphic EM and timing attacks they are credited with, the survey's map misrepresents the field.

Watch

Extended reading notes

Core claim

The paper's central claim is that no prior survey links device-level behavior, neuromorphic architecture, and vulnerabilities within a common threat framework, and that such a framework can be derived from the literature. It classifies attacks by aim, target, data source, exploited property, capability, and threat scenario, placing side-channel and fault injection attacks in both the hardware and software branches because the same physical leakage can be studied as a device-level phenomenon or as manipulation of spiking behavior. The survey further claims that memristive variability is double-edged: it enables model extraction and fault injection, yet the same stochastic switching can be har

Load-bearing premise

The load-bearing premise is that the 133 selected papers are a complete, unbiased, and correctly understood sample of the field, meaning the paper's counts and attributions must be accurate for its gap analysis and taxonomy to hold.

Editorial extensions

If this is right

  • Classical hardware defenses—power balancing, timing randomization, threshold implementations—have a clear target domain in neuromorphic accelerators and in-memory computing arrays.
  • SNN-specific attacks such as temporal backdoors, spike-timing adversarial perturbations, and spike-efficiency attacks require defenses that exploit temporal structure rather than static input features.
  • Event-driven timing can leak model structure and neuron thresholds, so timing obfuscation and runtime encryption belong in neuromorphic chip design from the start.
  • Memristive variability should be treated as a design resource for security primitives, not only as a source of vulnerability, since PUFs and TRNGs can be embedded in the same crossbar array that performs computation.
  • The paper's gap list implies the next concrete step: moving from simulated attacks to experimental validation on physical neuromorphic platforms, with standardized security benchmarks.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • If the taxonomy's dual placement of side-channel and fault injection is taken seriously, it suggests that a physical leakage cannot be fully neutralized at one layer alone: a device-level countermeasure may simply move the signal into the electrical or timing domain where the software branch reads it.
  • The paper's own evidence that SNNs are only partially privacy-preserving—membership inference scores are lower than ANNs, but model inversion still succeeds—implies that 'inherent privacy by non-differentiability' is a fragile assumption and should be tested per architecture.
  • A natural extension is to test NeuroHammer-style thermal bit-flips and power-based weight extraction on real memristive crossbars, since the surveyed results are mostly simulations and device stochasticity could change both attack success rates and the effectiveness of proposed defenses.
  • Combining multiple emerging memory technologies in one accelerator, as the paper notes, may create cross-technology leakage paths that single-device studies miss; a unified threat model would need to account for these interactions explicitly.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

4 major / 5 minor

Summary. This survey claims to provide the first unified taxonomy linking device-level behavior, neuromorphic architectures, and security vulnerabilities, based on a corpus of 133 papers published between 2014 and 2025. It organizes the literature into hardware attacks (side-channel, fault injection, hardware Trojans), software attacks on spiking neural networks (adversarial, backdoor, membership inference, software-level SCA/FIA), and security applications enabled by neuromorphic/emerging-memory primitives (PUFs, TRNGs, security features). The survey explicitly identifies open field gaps: most attacks are still simulative or conceptual, there are no standardized benchmarks, and no cross-layer threat model exists. It also provides comparison tables (Tables 4–6) and a stated replicable search methodology.

Significance. If the corpus map is accurate, this is a genuinely useful first-of-its-kind synthesis: it connects three research communities (hardware security, SNN software security, and memristive security primitives) that are usually treated separately. The paper earns credit for being honest about the simulative nature of many attacks (§4.2, §7) and for pointing to concrete missing infrastructure (benchmarks, standardized metrics, cross-layer threat models). However, the contribution is the map itself, so the accuracy of the corpus and its descriptions are load-bearing. The two misattributed references and the non-reconciling corpus counts identified below mean that the map currently cannot be trusted as an audit trail without further correction.

major comments (4)
  1. [§4.1.1] The power/EM/timing side-channel discussion contains two concrete attribution errors. The text credits [66] with an EM-based attack that 'reconstructed neuron weights and model hyperparameters ... in spike-based hardware,' but reference [66] (Kubota et al., Microprocessors and Microsystems 2021) is a deep-learning side-channel attack against hardware AES implementations, not a neuromorphic weight-recovery study. Similarly, the next paragraph credits [112] with an SNN timing-leakage attack, but [112] (Rogi et al., IEEE SENSORS 2024) is a defense against adversarial examples using thermal noise of a CMOS image sensor. These are not cosmetic mistakes; they are the key citations used to establish EM and timing leakage in neuromorphic systems. The authors must correct or replace these attributions and audit neighboring claims for the same class of error.
  2. [§3.3 / Figure 5 / Table 3 / Figure 7] The corpus accounting is internally inconsistent. Figure 5 reports final counts of 63, 21, 21, and 21, which sum to 126, not the stated 133. Table 3 reports category totals 50 + 43 + 40 = 133, with subsection sums consistent (25+19+6=50; 20+12+8+3=43; 19+11+10=40). In addition, Figure 7 cross-lists the same references in multiple branches (e.g., [29], [32], [52], [120], [124], [135] appear in more than one branch), while Table 3 implies each of the 133 papers is assigned to a single subcategory. The authors need to state clearly whether 133 is the number of unique papers or the number of assignments, and provide one reconciled accounting of the full corpus.
  3. [§1 (companion repository)] The paper promises an 'accompanying open-source repository ... to provide curated references, structured comparison tables, and supplementary resources,' but the link is the placeholder text 'Survey repository' rather than an actual URL. Since the survey's central contribution is an accurate, auditable corpus map, this is not a minor web-hygiene issue: without the repository or an appendix listing all 133 papers and their classifications, the reader cannot verify the selection, screening, or category assignments.
  4. [§3.2–§3.3] The methodology is described as 'structured and replicable,' but the actual search strings are not given. Table 2 lists three keyword groups, and the text states that each query combined one keyword from each group, but the exact Boolean queries, the search date, the per-database hit counts, and the inclusion/exclusion criteria are not specified. As a result, the 133-paper corpus cannot be independently reproduced, and the claimed completeness of the map is not testable. The authors should supply the full query strings and a PRISMA-style screening table.
minor comments (5)
  1. [Figure 6] The x-axis omits 2016; the line plot appears to jump from 2014/2015 to 2017. Also, the number of selected publications for 2025 is based on a partial year (January–August per §3) but is plotted without an annotation; this should be clarified.
  2. [§4.4.1] There is a duplicated phrase: 'integrates two redundant checksum blocks two redundant checksum blocks into a memory crossbar array.'
  3. [Table 6] The row for reference [9] lists 'Process and write variability' in both the Entropy Source and Validation/Eval columns; this appears to be a copy-paste error.
  4. [§3.2] The sentence 'review papers and non-accessible or duplicate entries were excluded (see Table 2)' points the reader to Table 2, which lists keyword groups, not inclusion/exclusion criteria. This cross-reference is wrong.
  5. [Table 4] The row for [66] says 'Power traces analyzed via deep learning' and reports an ASIC target, but the body text (§4.1.1) says the same reference reports EM-based neuron-weight extraction. The table-text inconsistency should be resolved as part of the attribution audit.

Circularity Check

0 steps flagged · score 0.0 of 10

No significant circularity; the survey's taxonomy is an explicit literature summary, not an independent prediction.

full rationale

This is a survey, so there is no formal derivation chain, fitted parameter, or uniqueness theorem whose outputs could reduce to its inputs. The paper explicitly states that its classification 'emerged from an iterative literature-mapping process' and that the taxonomy 'was derived directly from the data of reviewed articles, rather than from preexisting frameworks' (§3.3). That is the opposite of a hidden circularity: the taxonomy is presented as a summary of the 133 selected papers, not as a quantity that is then used to predict those papers. The central gap claim—that no prior survey unifies device-level behavior, architecture, and vulnerabilities—is supported by comparison with prior published surveys such as [128], [47], and [137], not by the paper's own framework. Although several cited works are co-authored by the present authors (e.g., [1], [13], [34], [47], [87], [100], [101], [135]), they are peer-reviewed, externally published results used as evidence of specific attacks, defenses, or prior-SoK status; they are not the sole justification for the survey's organizing structure. The internal corpus inconsistencies noted in the reading (Figure 5 counts sum to 126 rather than 133; [66] and [112] appear to be misdescribed; the companion repository is a placeholder) are correctness and curation concerns, but they do not establish that any claimed result is equivalent to an input by construction. The search strategy does preselect papers using threat-type keywords that resemble the taxonomy categories, so the reported category counts are partly descriptive of the inclusion criteria; however, the paper does not present those counts as an independent empirical discovery, and this is a methodological limitation rather than circular reasoning. Overall, the survey's contribution is an explicit organization of the literature, and its load-bearing assertions do not reduce to their own inputs.

Assumptions & free parameters 0 free parameters · 3 assumptions · 0 invented entities

Survey paper: no fitted quantities, no hand-chosen constants, and no invented physical or conceptual entities. The taxonomy is a classification frame over existing literature, not a new postulated thing. The load-bearing assumptions are the transferability of classical attack categories to neuromorphic hardware, the completeness/unbiasedness of the 133-paper corpus, and the claimed absence of a prior unified survey.

assumptions (3)
  • domain assumption Standard SCA/FIA/adversarial-attack taxonomies from conventional CMOS and ANN systems transfer to neuromorphic/SNN and memristive platforms.
    The entire survey organization (Fig. 4) maps established categories onto memristive/SNN hardware; the paper itself admits most surveyed attacks are simulative or untested on real neuromorphic chips (§4.2, §7).
  • domain assumption The 807-document search and manual screening yielded a complete, unbiased 133-paper corpus.
    Claimed in §3.2–3.3; not fully auditable because the companion repository link is a placeholder and Fig. 5 counts do not reconcile (63+21+21+21=126 vs 133).
  • domain assumption No earlier survey covers the integrated hardware + software + security-primitives view.
    Gap justification in §1 and §2.4; contestable because [128] is itself a security-focused neuromorphic CIM survey listed in the paper's own Table 1.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Emerging Threats and Countermeasures in Neuromorphic Systems: A Survey." pith.science (2026). https://pith.science/paper/UZ5YKS7U

@misc{pith2026260116589,
  author       = {Pith},
  title        = {Pith review of: Emerging Threats and Countermeasures in Neuromorphic Systems: A Survey},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/UZ5YKS7U}},
  note         = {Machine review of arXiv:2601.16589}
}
read the original abstract

Neuromorphic computing mimics brain-inspired mechanisms through spiking neurons and energy-efficient processing, offering a pathway to efficient in-memory computing (IMC). However, these advancements raise critical security and privacy concerns. As the adoption of bio-inspired architectures and memristive devices increases, so does the urgency to assess the vulnerability of these emerging technologies to hardware and software attacks. Emerging architectures introduce new attack surfaces, particularly due to asynchronous, event-driven processing and stochastic device behavior. The integration of memristors into neuromorphic hardware and software implementations in spiking neural networks offers diverse possibilities for advanced computing architectures, including their role in security-aware applications. This survey systematically analyzes the security landscape of neuromorphic systems, covering attack methodologies, side-channel vulnerabilities, and countermeasures. We focus on both hardware and software concerns relevant to spiking neural networks (SNNs) and hardware primitives, such as Physical Unclonable Functions (PUFs) and True Random Number Generators (TRNGs) for cryptographic and secure computation applications. We approach this analysis from diverse perspectives, from attack methodologies to countermeasure strategies that integrate efficiency and protection in brain-inspired hardware. This review not only maps the current landscape of security threats but provides a foundation for developing secure and trustworthy neuromorphic architectures.

Figures

Figures reproduced from arXiv: 2601.16589 by the authors.

Figure 1
Figure 1. Memristor crossbar array performing matrix–vector multiplication, where input voltages and device [PITH_FULL_IMAGE:figures/full_fig_p004_1.png] view at source ↗
Figure 2
Figure 2. Schematic of SNNs model, a classical SNNs structure, comprising a post-neuron driven by input [PITH_FULL_IMAGE:figures/full_fig_p005_2.png] view at source ↗
Figure 3
Figure 3. (a) SNNs flow chart. (b) The dynamics of LIF spiking neurons are shown. [PITH_FULL_IMAGE:figures/full_fig_p006_3.png] view at source ↗
Figures from the paper (8 more)
Figure 4
Figure 4. Figure 4: Taxonomy of key characteristics used to classify attacks adapted to neuromorphic computing in this [PITH_FULL_IMAGE:figures/full_fig_p008_4.png]
Figure 5
Figure 5. Figure 5: Illustration of the selection methodology of this survey. [PITH_FULL_IMAGE:figures/full_fig_p010_5.png]
Figure 6
Figure 6. Figure 6: Number of selected publications per year (2014–2025), showing an overall increase in interest. [PITH_FULL_IMAGE:figures/full_fig_p011_6.png]
Figure 7
Figure 7. Figure 7: Structure of the survey organizing selected papers into main sections and subsections based on attack [PITH_FULL_IMAGE:figures/full_fig_p012_7.png]
Figure 8
Figure 8. Figure 8: Representation of neuromorphic computing hardware, from individual devices to in-memory computing [PITH_FULL_IMAGE:figures/full_fig_p013_8.png]
Figure 9
Figure 9. Figure 9: Schematic example of an adversarial attack on an SNN. A spatio-temporal perturbation applied to a [PITH_FULL_IMAGE:figures/full_fig_p019_9.png]
Figure 10
Figure 10. Figure 10: Example of a side-channel attack on a neuromorphic chip running a spiking neural network. The [PITH_FULL_IMAGE:figures/full_fig_p019_10.png]
Figure 11
Figure 11. Figure 11: The use of memristor arrays in the design of a neuromorphic security system. Thestochastic device [PITH_FULL_IMAGE:figures/full_fig_p024_11.png]

Discussion (0). Sign in to comment.

Reference graph

Works this paper leans on

160 extracted references · 42 canonical work pages

  1. [66]

    Takaya Kubota, Kota Yoshida, Mitsuru Shiozaki, and Takeshi Fujino. 2021. Deep learning side-channel attack against hardware implementations of AES.Microprocessors and Microsystems87 (2021), 103383. https://doi.org/10.1016/j. micpro.2020.103383

    arXiv 2021

  2. [112]

    Yuki Rogi, Kota Yoshida, Tatsuya Oyama, Takeshi Fujino, and Shunsuke Okura. 2024. Defense Method Against Adversarial Example Attacks using Thermal Noise of a CMOS Image Sensor. InIEEE SENSORS. IEEE, Kobe, Japan, 1–4. https://doi.org/10.1109/SENSORS60989.2024.10785201

    arXiv 2024

  3. [128]

    Felix Staudigl, Farhad Merchant, and Rainer Leupers. 2022. A Survey of Neuromorphic Computing-in-Memory: Architectures, Simulators, and Security.IEEE Design & Test39, 2 (2022). https://doi.org/10.1109/MDAT.2021.3102013

    arXiv 2022

  4. [29]

    Divyanshu Divyanshu, Rajat Kumar, Danial Khan, Selma Amara, and Yehia Massoud. 2022. Logic Locking Using Emerging 2T/3T Magnetic Tunnel Junctions for Hardware Security.IEEE Access10 (2022), 102386–102395. https: //doi.org/10.1109/ACCESS.2022.3208650

    arXiv 2022

  5. [32]

    Nan Du, Heidemarie Schmidt, and Ilia Polian. 2021. Low-power emerging memristive designs towards secure hardware systems for applications in internet of things.Nano Materials Science3, 2 (2021), 186–204. https: //doi.org/10.1016/j.nanoms.2021.01.001

    work page doi:10.1016/j.nanoms.2021.01.001 2021

  6. [52]

    Pietro Inglese, Elena-Ioana Vatajelu, and Giorgio Di Natale. 2023. Side channel and fault analyses on memristor-based logic in-memory.IEEE Design & Test41, 3 (2023), 29–35. https://doi.org/10.1109/MDAT.2023.3324522

    arXiv 2023

  7. [120]

    Hanyong Shao, Boyi Fu, Jinghao Yang, Wenpu Luo, Chang Su, Zhiyuan Fu, Kechao Tang, and Ru Huang. 2024. IMCE: An In-Memory Computing and Encrypting Hardware Architecture for Robust Edge Security. InProceedings of the Design, Automation & Test in Europe Conference & Exhibition (DATE). IEEE, 1–6. https://doi.org/10.23919/DATE58400. 2024.10546703

    arXiv 2024

  8. [124]

    Theofilos Spyrou, Sarah A El-Sayed, Engin Afacan, Luis A Camuñas-Mesa, Bernabé Linares-Barranco, and Haralampos- G Stratigopoulos. 2021. Neuron fault tolerance in spiking neural networks. InDesign, Automation & Test in Europe Conference & Exhibition (DATE). IEEE, 743–748. https://doi.org/10.23919/DATE51398.2021.9474081

    arXiv 2021

  9. [135]

    Valerio Venceslai, Alberto Marchisio, Ihsen Alouani, Maurizio Martina, and Muhammad Shafique. 2020. Neuroattack: Undermining spiking neural networks security through externally triggered bit-flips. In2020 International Joint Conference on Neural Networks (IJCNN). IEEE, 1–8. https://doi.org/10.1109/IJCNN48605.2020.9207351

    arXiv 2020

Show all 160 references
  1. [1]

    Gorka Abad, Oguzhan Ersoy, Stjepan Picek, and Aitor Urbieta. 2024. Sneaky Spikes: Uncovering Stealthy Backdoor Attacks in Spiking Neural Networks with Neuromorphic Data. InProceedings of the Network and Distributed System Security Symposium (NDSS 2024). Internet Society. https...

    2024

  2. [2]

    2018.Memristor Technology: Synthesis and Modeling for Sensing and Security Applications

    Heba Abunahla and Baker Mohammad. 2018.Memristor Technology: Synthesis and Modeling for Sensing and Security Applications. Springer International Publishing. https://doi.org/10.1007/978-3-319-65699-1

    2018 doi

  3. [3]

    Mohammad Javad Adel, Mohammad Hadi Rezayati, Mohammad Hossein Moaiyeri, Abdolah Amirany, and Kian Jafari. 2024. A Robust Deep Learning Attack Immune MRAM-Based Physical Unclonable Function.Scientific Reports 14, 1 (2024), 20649. https://doi.org/10.1038/s41598-024-71730-7

    2024 doi

  4. [4]

    Yossi Adi, Carsten Baum, Moustapha Cisse, Benny Pinkas, and Joseph Keshet. 2018. Turning Your Weakness into a Strength: Watermarking Deep Neural Networks by Backdooring. InProceedings of the 27th USENIX Security Symposium (USENIX Security ’18). USENIX Association, Baltimore, M...

    2018

  5. [5]

    Fernando Aguirre, Abu Sebastian, Manuel Le Gallo, et al . 2024. Hardware Implementation of Memristor-Based Artificial Neural Networks.Nature Communications15, 1 (2024), 1974. https://doi.org/10.1038/s41467-024-45670-9

    2024 doi

  6. [7]

    Maryam Akbari, Sattar Mirzakuchaki, Daniel Arumí, Salvador Manich, Alvaro Gómez-Pau, Francesca Campabadal, Mireia Bargalló González, and Rosa Rodríguez-Montañés. 2023. True Random Number Generator Based on the Variability of the High Resistance State of RRAMs.IEEE Access11 (20...

    2023

  7. [8]

    Filipp Akopyan, Jun Sawada, Andrew Cassidy, et al. 2015. TrueNorth: Design and Tool Flow of a 65 mW 1 Million Neuron Programmable Neurosynaptic Chip.IEEE Transactions on Computer-Aided Design of Integrated Circuits and Systems34, 10 (2015), 1537–1557. https://doi.org/10.1109/T...

    2015

  8. [9]

    Abdulaziz Al-Meer and Saif Al-Kuwari. 2023. Physical unclonable functions (PUF) for IoT devices.Comput. Surveys 55, 14s (2023), 1–31. https://doi.org/10.1145/3591464 28 Sorrentino et al

    2023 doi

  9. [10]

    Abdolah Amirany, Kian Jafari, and Mohammad Hossein Moaiyeri. 2020. True Random Number Generator for Reliable Hardware Security Modules Based on a Neuromorphic Variation-Tolerant Spintronic Structure.IEEE Transactions on Nanotechnology19 (2020), 784–791. https://doi.org/10.1109...

    2020

  10. [11]

    Maitreyi Ashok, Saurav Maji, Xin Zhang, John Cohn, and Anantha P Chandrakasan. 2025. Digital In-Memory Compute for Machine Learning Applications With Input and Model Security.IEEE Journal of Solid-State Circuits (2025). https://doi.org/10.1109/JSSC.2025.3534753

    2025

  11. [12]

    Amir Bahador, Mohammad Hossein Moaiyeri, and Reza Ghaderi. 2024. Algorithmically-Enhanced Design of Spintronic-Based Tunable True Random Number Generator for Dependable Stochastic Computing.IEEE Transactions on Computer-Aided Design of Integrated Circuits and Systems(2024), 1–...

    2024

  12. [13]

    Lejla Batina, Shivam Bhasin, Dirmanto Jap, and Stjepan Picek. 2019. CSI NN: Reverse Engineering of Neural Network Architectures Through Electromagnetic Side Channel. InProceedings of the 28th USENIX Security Symposium (USENIX Security ’19). USENIX Association, 601–618. https:/...

    2019

  13. [14]

    Nisa Bostanci, ISmail Emir Yüksel, Ataberk Olgun, Konstantinos Kanellopoulos, Yahya Can Tuğrul, A

    F. Nisa Bostanci, ISmail Emir Yüksel, Ataberk Olgun, Konstantinos Kanellopoulos, Yahya Can Tuğrul, A. Giray Yağliçi, Mohammad Sadrosadati, and Onur Mutlu. 2024. CoMeT: Count-Min-Sketch-Based Row Tracking to Mitigate RowHammer at Low Cost. InProceedings of the IEEE Internationa...

    2024

  14. [15]

    Eric Brier, Christophe Clavier, and Francis Olivier. 2004. Correlation Power Analysis with a Leakage Model. In Cryptographic Hardware and Embedded Systems – CHES 2004. Vol. 3156. Springer, Berlin, Heidelberg, 16–29. https: //doi.org/10.1007/978-3-540-28632-5_2

    2004 doi

  15. [16]

    Tong Bu, Jianhao Ding, Zecheng Hao, and Zhaofei Yu. 2023. Rate gradient approximation attack threats deep spiking neural networks. InProceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition. IEEE, 7896–7906. https://doi.org/10.1109/CVPR52729.2023.00763

    2023

  16. [18]

    Abhishek Chakraborty, Ankit Mondal, and Ankur Srivastava. 2017. Correlation Power Analysis Attack Against STT-MRAM Based Cryptosystems. InProceedings of the 2017 IEEE International Symposium on Hardware Oriented Security and Trust (HOST). IEEE, 171–171. https://doi.org/10.1109...

    2017

  17. [19]

    Suresh Chari, Josyula R Rao, and Pankaj Rohatgi. 2002. Template attacks. InInternational workshop on cryptographic hardware and embedded systems. Springer, 13–28. https://doi.org/10.1007/3-540-36400-5_3

    2002 doi

  18. [20]

    Weiran Chen and Qi Xu. 2025. Robust and Efficient Adversarial Defense in SNNs via Image Purification and Joint Detection. InICASSP IEEE International Conference on Acoustics, Speech and Signal Processing (ICASSP). IEEE, 1–5. https://doi.org/10.1109/ICASSP49660.2025.10888581

    2025

  19. [21]

    Ziang Chen, Li-Wei Chen, Xianyue Zhao, Kefeng Li, Heidemarie Schmidt, Ilia Polian, and Nan Du. 2025. Protected memristive implementations of cryptographic functions.Philosophical Transactions A383, 2288 (2025), 20230389. https://doi.org/10.1098/rsta.2023.0389

    2025

  20. [22]

    Yu-Chieh Chien, Heng Xiang, Jianze Wang, Yufei Shi, Xuanyao Fong, and Kah-Wee Ang. 2023. Attack Resilient True Random Number Generators Using Ferroelectric-Enhanced Stochasticity in 2D Transistor.Small19, 38 (2023), 2302842. https://doi.org/10.1002/smll.202302842

    2023 doi

  21. [23]

    DeMara, and Soheil Salehi

    Muhtasim Alam Chowdhury, Mousam Hossain, Christopher Mastrangelo, Ronald F. DeMara, and Soheil Salehi. 2024. S-Tune: SOT-MTJ manufacturing parameters tuning for securing the next generation of computing.Frontiers in Electronics5 (2024), 1409548. https://doi.org/10.3389/felec.2...

    2024

  22. [24]

    Md Hafizul Islam Chowdhuryy, Rickard Ewetz, Amro Awad, and Fan Yao. 2023. Understanding and Characterizing Side Channels Exploiting Phase-Change Memories.IEEE Micro43, 5 (2023), 8–15. https://doi.org/10.1109/MM.2023.3238894

    2023

  23. [25]

    Bingjie Dang, Quantan Wu, Fang Song, Jing Sun, Mei Yang, Xiaohua Ma, Hong Wang, and Yue Hao. 2018. A bio-inspired physically transient/biodegradable synapse for security neuromorphic computing based on memristors. Nanoscale10, 43 (2018), 20089–20095. https://doi.org/10.1039/C8NR07442A

    2018 doi

  24. [26]

    Chenchen Ding, Yuan Ren, Zhengwu Liu, and Ngai Wong. 2025. Transforming memristor noises into computational innovations.Communications Materials6, 1 (2025), 149. https://doi.org/10.1038/s43246-025-00876-2

    2025 doi

  25. [27]

    Jianhao Ding, Tong Bu, Zhaofei Yu, Tiejun Huang, and Jian K. Liu. 2022. SNN-RAT: Robustness-enhanced Spiking Neural Network through Regularized Adversarial Training, In NeurIPS 2022.Advances in Neural Information Processing Systems, 24780–24792. https://proceedings.neurips.cc/...

    2022

  26. [28]

    Jianhao Ding, Zhaofei Yu, Tiejun Huang, and Jian K. Liu. 2024. Enhancing the Robustness of Spiking Neural Networks with Stochastic Gating Mechanisms. InProceedings of the AAAI Conference on Artificial Intelligence, Vol. 38. AAAI Press, 492–502. https://doi.org/10.1609/aaai.v38...

    2024 doi

  27. [30]

    Divyanshu Divyanshu, Rajat Kumar, Danial Khan, Selma Amara, and Yehia Massoud. 2023. Cybersecurity Regulation of Smart Mobility Hardware Systems: Case Assessment for Spin-Based MTJ Devices. InProceedings of the IEEE International Conference on Smart Mobility (SM). IEEE, 186–19...

    2023

  28. [31]

    Akhil Dodda, Nicholas Trainor, Joan. M. Redwing, and Saptarshi Das. 2022. All-in-one, bio-inspired, and low-power crypto engines for near-sensor security based on two-dimensional memtransistors.Nature Communications13, 1 (2022), 3587. https://doi.org/10.1038/s41467-022-31148-z

    2022 doi

  29. [33]

    Xiao Du, Wanli Shi, Xiaohan Zhao, Yang Cao, Bin Gu, and Tieru Wu. 2025. Raw event-based adversarial attacks for Spiking Neural Networks with configurable latencies.Neural Networks193 (2025), 108026. https://doi.org/10.1016/j. neunet.2025.108026

    2025

  30. [35]

    Esser, Paul A

    Steven K. Esser, Paul A. Merolla, John V. Arthur, et al . 2016. Convolutional networks for fast, energy-efficient neuromorphic computing.Proc. Natl. Acad. Sci. USA113, 41 (2016), 11441–11446. https://doi.org/10.1073/PNAS. 1604850113

    2016 doi

  31. [36]

    Florian Frank, Tolga Arul, Nikolaos Athanasios Anagnostopoulos, and Stefan Katzenbeisser. 2022. Using Memristor Arrays as Physical Unclonable Functions. InComputer Security – ESORICS. Vol. 13556. Springer Nature Switzerland, Cham, 250–271. https://doi.org/10.1007/978-3-031-17143-7_13

    2022 doi

  32. [37]

    Hanqing Fu, Gaolei Li, Jun Wu, Jianhua Li, Xi Lin, Kai Zhou, and Yuchen Liu. 2024. Spikewhisper: Temporal Spike Backdoor Attacks on Federated Neuromorphic Learning over Low-power Devices. arXiv:2403.18607 [cs.CR]

    2024 arXiv

  33. [38]

    Karine Gandolfi, Christophe Mourtel, and Francis Olivier. 2001. Electromagnetic Analysis: Concrete Results. In Cryptographic Hardware and Embedded Systems — CHES 2001. Springer, 251–261. https://doi.org/10.1007/3-540- 44709-1_21

    2001 doi

  34. [39]

    Suo Gao, Zheyi Zhang, Qi Li, et al . 2025. Encrypt a Story: A Video Segment Encryption Method Based on the Discrete Sinusoidal Memristive Rulkov Neuron.IEEE Transactions on Dependable and Secure Computing(2025), 1–15. https://doi.org/10.1109/TDSC.2025.3603570

    2025

  35. [40]

    Luíza C Garaffa, Abdullah Aljuffri, Cezar Reinbrecht, Said Hamdioui, Mottaqiallah Taouil, and Johanna Sepulveda

  36. [41]

    Bhanprakash Goswami, Tamoghno Das, and Manan Suri. 2024. Experimental Investigation of Side-Channel Attacks on Neuromorphic Spiking Neural Networks.IEEE Embedded Systems Letters16, 2 (2024), 231–234. https://doi.org/10. 1109/LES.2023.3328223

    2024

  37. [42]

    Wenzhe Guo, Mohammed E Fouda, Ahmed M Eltawil, and Khaled Nabil Salama. 2021. Neural coding in spiking neural networks: A comparative study for robust neuromorphic systems.Frontiers in Neuroscience15 (2021), 638474. https://doi.org/10.3389/fnins.2021.638474

    2021

  38. [43]

    Naina Gupta, Arpan Jati, and Anupam Chattopadhyay. 2025. AI Attacks AI: Recovering Neural Network Architecture from NVDLA Using AI-Assisted Side Channel Attack.Association for Computing Machinery24, 5 (2025). https: //doi.org/10.1145/3731560

    2025 doi

  39. [44]

    Donhee Ham, Hongkun Park, Sungwoo Hwang, and Kinam Kim. 2021. Neuromorphic electronics based on copying and pasting the brain.Nature Electronics4, 9 (2021), 635–644. https://doi.org/10.1038/s41928-021-00646-1

    2021 doi

  40. [45]

    Zhezhi He, Adnan Siraj Rakin, and Deliang Fan. 2019. Parametric Noise Injection: Trainable Randomness to Improve Deep Neural Network Robustness Against Adversarial Attack. InProceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR). IEEE, 588–597...

    2019

  41. [46]

    Masoud Heidary and Biresh Kumar Joardar. 2024. Hardware Attacks on ReRAM-Based AI Accelerators. InIEEE 17th Dallas Circuits and Systems Conference (DCAS). IEEE, 1–4. https://doi.org/10.1109/DCAS61159.2024.10539864

    2024

  42. [47]

    Péter Horváth, Dirk Lauret, Zhuoran Liu, and Lejla Batina. 2024. SoK: neural network extraction through physical side channels. InSEC ’24: Proceedings of the 33rd USENIX Conference on Security Symposium. Usenix. https://www. usenix.org/conference/usenixsecurity24/presentation/horvath

    2024

  43. [48]

    2024.In situcryptography in a neuromorphic vision sensor based on light-driven memristors.Applied Physics Reviews11, 1 (2024), 011411

    Lingxiang Hu, Jiale Shao, Jingrui Wang, Peihong Cheng, Li Zhang, Yang Chai, Zhizhen Ye, and Fei Zhuge. 2024.In situcryptography in a neuromorphic vision sensor based on light-driven memristors.Applied Physics Reviews11, 1 (2024), 011411. https://doi.org/10.1063/5.0185502 30 So...

    2024 doi

  44. [49]

    Eric Hunsberger and Chris Eliasmith. 2015. Spiking Deep Networks with LIF Neurons. arXiv:1510.08829 [cs.NE]

    2015 arXiv

  45. [50]

    Ibrahim, Heorhii Skovorodnikov, and Hoda Alkhzaimi

    Hebatallah M. Ibrahim, Heorhii Skovorodnikov, and Hoda Alkhzaimi. 2024. Resilience evaluation of memristor based PUF against machine learning attacks.Scientific Reports14, 1 (2024), 23962. https://doi.org/10.1038/s41598-024- 73839-1

    2024 doi

  46. [51]

    Giacomo Indiveri and Shih-Chii Liu. 2015. Memory and Information Processing in Neuromorphic Systems.Proc. IEEE103, 8 (2015), 1379–1397. https://doi.org/10.1109/JPROC.2015.2444094

    2015

  47. [53]

    Pegah Iranfar, Abdolah Amirany, and Mohammad Hossein Moaiyeri. 2025. Power Attack-Immune Spintronic-Based AES Hardware Accelerator for Secure and High-Performance PiM Architectures.IEEE Transactions on Magnetics (2025). https://doi.org/10.1109/TMAG.2025.3544409

    2025

  48. [54]

    Pegah Iranfar, Abdolah Amirany, Mohammad Hossein Moaiyeri, and Kian Jafari. 2024. On the Layout-Oriented Investigation of Power Attack Hardness of Spintronic-Based Logic Circuits.Circuits, Systems, and Signal Processing 43, 5 (2024), 3212–3237. https://doi.org/10.1007/s00034-0...

    2024 doi

  49. [55]

    Yuval Ishai, Amit Sahai, and David Wagner. 2003. Private Circuits: Securing Hardware against Probing Attacks. In Advances in Cryptology - CRYPTO 2003. Vol. 2729. Springer, Berlin, Heidelberg, 463–481. https://doi.org/10.1007/978- 3-540-45146-4_27

    2003 doi

  50. [56]

    Can Dikmen

    Murat Isik, Hiruna Vishwamith, Yusuf Sur, Kayode Inadagbo, and I. Can Dikmen. 2024. NEUROSEC: FPGA-Based Neuromorphic Audio Security. InApplied Reconfigurable Computing. Architectures, Tools, and Applications. Springer Nature Switzerland, Cham, 134–147. https://doi.org/10.1007...

    2024 doi

  51. [57]

    Alex James, Chithra Reghuvaran, and Leon Chua. 2025. Processing In-Memory PUF Watermark Embedding with Cellular Memristor Network.IEEE Transactions on Emerging Topics in Computing(2025). https://doi.org/10.1109/ TETC.2025.3528336

    2025

  52. [58]

    Duhyun Jeon, Jong Hak Baek, Yong-Duck Kim, Jaeseong Lee, Dong Kyue Kim, and Byong-Deok Choi. 2019. A Physical Unclonable Function With Bit Error Rate Less Than 2.3e-8 Based on Contact Formation Probability Without Error Correction Code.IEEE Journal of Solid-State Circuits55, 3...

    2019

  53. [59]

    Zhen Hang Jiang, Yunsi Fei, Aidong Adam Ding, and Thomas Wahl. 2020. Mempoline: Mitigating memory-based side- channel attacks through memory access obfuscation.Cryptology ePrint Archive(2020). https://eprint.iacr.org/2020/653

    2020

  54. [60]

    Rohit Abraham John, Nimesh Shah, Sujaya Kumar Vishwanath, et al . 2021. Halide perovskite memristors as flexible and reconfigurable physical unclonable functions.Nature Communications12, 1 (2021), 3681. https: //doi.org/10.1038/s41467-021-24057-0

    2021 doi

  55. [61]

    Zalfa Jouni and Haralampos-G Stratigopoulos. 2025. STDP-Trained Spiking Neural Network Reliability Assessment Through Fault Injections. In31st IEEE International Symposium on On-Line Testing and Robust System Design. IEEE, Ischia, Italy. https://doi.org/10.1109/IOLTS65288.2025...

    2025

  56. [62]

    Nisa Bostanci, Ataberk Olgun, A

    Konstantinos Kanellopoulos, F. Nisa Bostanci, Ataberk Olgun, A. Giray Yaglikci, Ismail Emir Yuksel, Nika Mansouri Ghiasi, Zulal Bingol, Mohammad Sadrosadati, and Onur Mutlu. 2024. Amplifying Main Memory-Based Timing Covert and Side Channels using Processing-in-Memory Operation...

    2024 arXiv

  57. [63]

    Paul Kocher, Jann Horn, Anders Fogh, et al. 2019. Spectre Attacks: Exploiting Speculative Execution. InSymposium on Security and Privacy (SP). IEEE, San Francisco, CA, USA, 1–19. https://doi.org/10.1109/SP.2019.00002

    2019

  58. [64]

    Paul Kocher, Joshua Jaffe, and Benjamin Jun. 1999. Differential power analysis. InAnnual international cryptology conference. Springer, 388–397. https://doi.org/10.1007/3-540-48405-1_25

    1999 doi

  59. [65]

    Sarada Krithivasan, Sanchari Sen, Nitin Rathi, Kaushik Roy, and Anand Raghunathan. 2022. Efficiency attacks on spiking neural networks. InProceedings of the 59th ACM/IEEE Design Automation Conference. ACM, San Francisco California, 373–378. https://doi.org/10.1145/3489517.3530443

    2022

  60. [67]

    Souvik Kundu, Massoud Pedram, and Peter A Beerel. 2021. Hire-snn: Harnessing the inherent robustness of energy- efficient deep spiking neural networks by training with crafted input noise. InProceedings of the IEEE/CVF international conference on computer vision. IEEE, 5209–52...

    2021

  61. [68]

    Corey Lammie, Julian Büchel, Athanasios Vasilopoulos, Manuel Le Gallo, and Abu Sebastian. 2025. The inherent adversarial robustness of analog in-memory computing.Nature Communications16, 1 (2025), 1756. https://doi.org/ 10.1038/s41467-025-56595-2

    2025 doi

  62. [69]

    Jiaxin Li, Gorka Abad, Stjepan Picek, and Mauro Conti. 2025. Membership Privacy Evaluation in Deep Spiking Neural Networks.Springer Nature Switzerland(2025), 207–227. https://doi.org/10.1007/978-3-032-07884-1_11

    2025 doi

  63. [70]

    Jiachen Li, Bang Wu, Xiaoyu Xia, Xiaoning Liu, Xun Yi, and Xiuzhen Zhang. 2025. Unsupervised Backdoor Detection and Mitigation for Spiking Neural Networks. arXiv:2510.06629 [cs.CR] Emerging Threats and Countermeasures in Neuromorphic Systems: A Survey 31

    2025

  64. [71]

    Taixin Li, Boran Sun, Hongtao Zhong, Yixin Xu, Vijaykrishnan Narayanan, Liang Shi, Tianyi Wang, Yao Yu, Thomas Kämpfe, Kai Ni, Huazhong Yang, and Xueqing Li. 2024. ProtFe: Low-Cost Secure Power Side-Channel Protection for General and Custom FeFET-Based Memories.ACM Transaction...

    2024 doi

  65. [72]

    Xueqi Li, Bin Gao, Qi Qin, et al . 2025. Federated learning using a memristor compute-in-memory chip with in situ physical unclonable function and true random number generator.Nature Electronics(2025), 1–11. https: //doi.org/10.1038/s41928-025-01390-6

    2025 doi

  66. [73]

    Ling Liang, Xing Hu, Lei Deng, Yujie Wu, Guoqi Li, Yufei Ding, Peng Li, and Yuan Xie. 2021. Exploring adversarial attack in spiking neural networks with spike-compatible gradient.IEEE transactions on neural networks and learning systems34, 5 (2021), 2569–2583. https://doi.org/...

    2021

  67. [74]

    Ling Liang, Kaidi Xu, Xing Hu, Lei Deng, and Yuan Xie. 2022. Toward robust spiking neural network against adversarial perturbation.Advances in Neural Information Processing Systems35 (2022), 10244–10256. https://doi.org/ 10.5555/3600270.3601014

    2022

  68. [75]

    Chit-Kwan Lin, Andreas Wild, Gautham N Chinya, Yongqiang Cao, Mike Davies, Daniel M Lavery, and Hong Wang

  69. [76]

    Moritz Lipp, Michael Schwarz, Daniel Gruss, et al. 2020. Meltdown: reading kernel memory from user space.Commun. ACM63, 6 (2020), 46–56. https://doi.org/10.1145/3357033

    2020 doi

  70. [78]

    Li Lun, Kunyu Feng, Qinglong Ni, Ling Liang, Yuan Wang, Ying Li, Dunshan Yu, and Xiaoxin Cui. 2025. Towards Effective and Sparse Adversarial Attack on Spiking Neural Networks via Breaking Invisible Surrogate Gradients. In Proceedings of the Computer Vision and Pattern Recognit...

    2025

  71. [79]

    Hao Lv, Bing Li, Lei Zhang, Cheng Liu, and Ying Wang. 2022. Variation enhanced attacks against rram-based neuromorphic computing system.IEEE Transactions on Computer-Aided Design of Integrated Circuits and Systems42, 5 (2022), 1588–1596. https://doi.org/10.1109/TCAD.2022.3207316

    2022

  72. [80]

    Jubayer Mahmod and Matthew Hicks. 2024. UnTrustZone: Systematic Accelerated Aging to Expose On-chip Secrets. InSymposium on Security and Privacy (SP). IEEE, San Francisco, CA, USA, 4107–4124. https://doi.org/10.1109/SP54263. 2024.00069

    2024

  73. [82]

    Massoud Masoumi. 2020. Novel Hybrid CMOS/Memristor Implementation of the AES Algorithm Robust Against Differential Power Analysis Attack.IEEE Transactions on Circuits and Systems II: Express Briefs67, 7 (2020), 1314–1318. https://doi.org/10.1109/TCSII.2019.2932337

    2020

  74. [83]

    Mehonic and A

    A. Mehonic and A. J. Kenyon. 2022. Brain-inspired computing needs a master plan.Nature604, 7905 (2022), 255–260. https://doi.org/10.1038/s41586-021-04362-w

    2022 doi

  75. [84]

    Cory Merkel and Allen Su. 2025. Power Analysis Attacks on NVM Crossbar-based Neuromorphic Systems.Neural Processing Letters57, 1 (2025), 17. https://doi.org/10.1007/s11063-025-11730-4

    2025 doi

  76. [85]

    Vincent Meyers, Michael Hefenbrock, Dennis Gnad, and Mehdi Tahoori. 2024. Trained to leak: Hiding trojan side-channels in neural network weights. InIEEE International Symposium on Hardware Oriented Security and Trust (HOST). IEEE, 122–127. https://doi.org/10.1109/HOST55342.202...

    2024

  77. [87]

    Ayana Moshruba, Ihsen Alouani, and Maryam Parsa. 2025. Are Neuromorphic Architectures Inherently Privacy- preserving? An Exploratory Study.Proc. Priv. Enhancing Technol.2025, 2 (2025), 243–257. https://doi.org/10.56553/ POPETS-2025-0060

    2025

  78. [88]

    Md Rafid Muttaki, Md Habibur Rahman, Akshay Kulkarni, Mark Tehranipoor, and Farimah Farahmandi. 2024. FTC: A universal framework for fault-injection attack detection and prevention.IEEE Transactions on Very Large Scale Integration (VLSI) Systems(2024). https://doi.org/10.1109/...

    2024

  79. [89]

    Karthikeyan Nagarajan, Junde Li, Sina Sayyah Ensan, Sachhidh Kannan, and Swaroop Ghosh. 2022. Fault Injection Attacks in Spiking Neural Networks and Countermeasures.Frontiers in Nanotechnology3 (2022), 801999. https: 32 Sorrentino et al. //doi.org/10.3389/fnano.2021.801999

    2022

  80. [91]

    Milad Tanavardi Nasab, Wu Yang, and Himanshu Thapliyal. 2025. Late Breaking Results: Novel Design of MTJ- Based Unified LIF Spiking Neuron and PUF. In62nd ACM/IEEE Design Automation Conference (DAC). IEEE, 1–2. https://doi.org/10.1109/DAC63849.2025.11132831

    2025

  81. [92]

    Najmeh Nazari, Kevin Immanuel Gubbi, Banafsheh Saber Latibari, Muhtasim Alam Chowdhury, Chongzhou Fang, Avesta Sasan, Setareh Rafatirad, Houman Homayoun, and Soheil Salehi. 2024. Securing On-Chip Learning: Navigating Vulnerabilities and Potential Safeguards in Spiking Neural N...

    2024

  82. [93]

    Jun-Sheng Ng, Juncheng Chen, Nay Aung Kyaw, Kwen-Siong Chong, and Bah-Hwee Gwee. 2024. Securing Against Side-Channel Attacks With Wide-Range In Situ Random Voltage Dithering on Async-Logic AES Engine.IEEE Transactions on Very Large Scale Integration (VLSI) Systems32, 10 (2024)...

    2024

  83. [94]

    Svetla Nikova, Christian Rechberger, and Vincent Rijmen. 2006. Threshold Implementations Against Side-Channel Attacks and Glitches. InInformation and Communications Security. Vol. 4307. Springer, Berlin, Heidelberg, 529–545. https://doi.org/10.1007/11935308_38

    2006 doi

  84. [95]

    Osamu Nomura, Yusuke Sakemi, Takeo Hosomi, and Takashi Morie. 2022. Robustness of spiking neural networks based on time-to-first-spike encoding against adversarial attacks.IEEE Transactions on Circuits and Systems II: Express Briefs69, 9 (2022), 3640–3644. https://doi.org/10.1...

    2022

  85. [96]

    João D Nunes, Marcelo Carvalho, Diogo Carneiro, and Jaime S Cardoso. 2022. Spiking neural networks: A survey. IEEE access10 (2022), 60738–60764. https://doi.org/10.1109/ACCESS.2022.3179968

    2022

  86. [97]

    Jungyeop Oh, Sungkyu Kim, Junhwan Choi, Jun-Hwe Cha, Sung Gap Im, Byung Chul Jang, and Sung-Yool Choi

  87. [98]

    Luca Parrini, Taha Soliman, Benjamin Hettwer, Jan Micha Borrmann, Simranjeet Singh, Ankit Bende, Vikas Rana, Farhad Merchant, and Norbert Wehn. 2024. Error Detection and Correction Codes for Safe In-Memory Computations. InIEEE European Test Symposium (ETS). IEEE, 1–4. https://...

    2024

  88. [99]

    Huihui Peng, Lin Gan, and Xin Guo. 2024. Memristor-based spiking neural networks: cooperative development of neural network architecture/algorithms and memristors.Chip3, 2 (2024). https://doi.org/10.1016/j.chip.2024.100093

    2024

  89. [100]

    Stjepan Picek, Guilherme Perin, Luca Mariot, Lichao Wu, and Lejla Batina. 2023. SoK: Deep Learning-based Physical Side-channel Analysis.Comput. Surveys55, 11 (2023), 1–35. https://doi.org/10.1145/3569577

    2023 doi

  90. [101]

    Hamed Poursiami, Ihsen Alouani, and Maryam Parsa. 2024. Brainleaks: On the privacy-preserving properties of neuromorphic architectures against model inversion attacks. InInternational Conference on Machine Learning and Applications (ICMLA). IEEE, 705–712. https://doi.org/10.11...

    2024

  91. [102]

    Hamed Poursiami, Ihsen Alouani, and Maryam Parsa. 2024. Watermarking Neuromorphic Brains: Intellectual Property Protection in Spiking Neural Networks. InInternational Conference on Neuromorphic Systems (ICONS). IEEE, 287–294. https://doi.org/10.1109/ICONS62911.2024.00050

    2024

  92. [103]

    Hamed Poursiami, Ayana Moshruba, and Maryam Parsa. 2025. Do Spikes Protect Privacy? Investigating Black-Box Model Inversion Attacks in Spiking Neural Networks. arXiv:2502.05509 [cs.CR]

    2025

  93. [104]

    Matthias Probst, Manuel Brosch, and Georg Sigl. 2025. Side-Channel Analysis of Integrate-and-Fire Neurons Within Spiking Neural Networks.IEEE Transactions on Circuits and Systems I: Regular Papers72, 2 (2025), 548–560. https://doi.org/10.1109/TCSI.2024.3470135

    2025

  94. [105]

    Damien Querlioz, Olivier Bichler, and Christian Gamrat. 2011. Simulation of a Memristor-Based Spiking Neural Network Immune to Device Variations. InProceedings of the 2011 International Joint Conference on Neural Networks (IJCNN). IEEE, 1775–1781. https://doi.org/10.1109/IJCNN...

    2011

  95. [106]

    Chidhambaranathan Rajamanikkam, Rajesh Js, Sanghamitra Roy, and Koushik Chakraborty. 2021. Understanding Security Threats in Emerging Neuromorphic Computing Architecture.Journal of Hardware and Systems Security5, 1 (2021), 45–57. https://doi.org/10.1007/s41635-021-00110-8

    2021 doi

  96. [107]

    Adnan Siraj Rakin, Md Hafizul Islam Chowdhuryy, Fan Yao, and Deliang Fan. 2022. Deepsteal: Advanced model extractions leveraging efficient weight stealing in memories. InSymposium on security and privacy (SP). IEEE, 1157–1174. https://doi.org/10.1109/SP46214.2022.9833743

    2022

  97. [108]

    Adnan Siraj Rakin, Zhezhi He, and Deliang Fan. 2020. TBT: Targeted Neural Network Attack with Bit Trojan. In Proceedings of the 2020 IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR). IEEE, 13195–13204. https://doi.org/10.1109/CVPR42600.2020.01321 Emerging ...

    2020

  98. [109]

    Stratigopoulos

    Spyridon Raptis, Paul Kling, Ioannis Kaskampas, Ihsen Alouani, and Haralampos-G. Stratigopoulos. 2025. Input- Triggered Hardware Trojan Attack on Spiking Neural Networks. InIEEE International Symposium on Hardware Oriented Security and Trust HOST. IEEE, 227–238. https://doi.or...

    2025

  99. [110]

    Nitin Rathi, Indranil Chakraborty, Adarsh Kosta, Abhronil Sengupta, Aayush Ankit, Priyadarshini Panda, and Kaushik Roy. 2023. Exploring Neuromorphic Computing Based on Spiking Neural Networks: Algorithms to Hardware.ACM Comput. Surv.55, 12, Article 243 (2023), 49 pages. https:...

    2023 doi

  100. [111]

    Mohammad Hadi Rezayati, Abdolah Amirany, Mohammad Hossein Moaiyeri, and Kian Jafari. 2025. A new method for securing binary deep neural networks against model replication attacks using magnetic tunnel junctions.International Journal of Information Security24, 1 (2025), 52. htt...

    2025 doi

  101. [113]

    Ishai Rosenberg, Asaf Shabtai, Yuval Elovici, and Lior Rokach. 2022. Adversarial Machine Learning Attacks and Defense Methods in the Cyber Security Domain.ACM Comput. Surv.54, 5, Article 108 (2022), 36 pages. https: //doi.org/10.1145/3453158

    2022 doi

  102. [114]

    Saion K Roy and Naresh R Shanbhag. 2024. On the Security Vulnerabilities of MRAM-based In-Memory Computing Architectures against Model Extraction Attacks.ACM(2024), 1–9. https://doi.org/10.1145/3676536.3676685

    2024

  103. [115]

    Soheil Salehi, Tyler Sheaves, Kevin Immanuel Gubbi, Sayed Arash Beheshti, Sai Manoj P D, Setareh Rafatirad, Avesta Sasan, Tinoosh Mohsenin, and Houman Homayoun. 2022. Neuromorphic-Enabled Security for IoT. In20th Interregional NEWCAS Conference (NEWCAS). IEEE, Quebec City, QC,...

    2022

  104. [116]

    Brojogopal Sapui, Sergej Meschkov, and Mehdi B Tahoori. 2024. Side-Channel Attack with Fault Analysis on Memristor-based Computation-in-Memory. InIEEE 30th International Symposium on On-Line Testing and Robust System Design (IOLTS). IEEE, 1–7. https://doi.org/10.1109/IOLTS6099...

    2024

  105. [117]

    Sina Sayyah Ensan, Karthikeyan Nagarajan, Mohammad Nasim Imtiaz Khan, and Swaroop Ghosh. 2021. SCARE: Side Channel Attack on In-Memory Computing for Reverse Engineering.IEEE Transactions on Very Large Scale Integration (VLSI) Systems29, 12 (2021), 2040–2051. https://doi.org/10...

    2021

  106. [118]

    Schuman, Shweta R

    Catherine D. Schuman, Shweta R. Kulkarni, Maryam Parsa, J. Parker Mitchell, Prasanna Date, and Bill Kay. 2022. Opportunities for neuromorphic computing algorithms and applications.Nature Computational Science2, 1 (2022), 10–19. https://doi.org/10.1038/s43588-021-00184-y

    2022 doi

  107. [119]

    Schuman, Thomas E

    Catherine D. Schuman, Thomas E. Potok, Robert M. Patton, John D. Birdwell, Mark E. Dean, Garrett S. Rose, and James S. Plank. 2017. A Survey of Neuromorphic Computing and Neural Networks in Hardware. arXiv:1705.06963 [cs.NE]

    2017 arXiv

  108. [122]

    Ayesha Siddique and Khaza Anuarul Hoque. 2024. Moving Target Defense Through Approximation for Low-Power Neuromorphic Edge Intelligence.IEEE Transactions on Computer-Aided Design of Integrated Circuits and Systems43, 3 (2024), 728–741. https://doi.org/10.1109/TCAD.2023.3327093

    2024

  109. [123]

    Jeetendra Singh. 2021. Implementation of memristor towards better hardware/software security design.Transactions on Electrical and Electronic Materials22, 1 (2021), 10–22. https://doi.org/10.1007/s42341-020-00269-x

    2021 doi

  110. [125]

    Mamidipaka B. R. Srinivas and Konguvel Elango. 2024. Era of Sentinel Tech: Charting Hardware Security Landscapes Through Post-Silicon Innovation, Threat Mitigation and Future Trajectories.IEEE Access12 (2024), 68061–68108. https://doi.org/10.1109/ACCESS.2024.3400624

    2024

  111. [126]

    Felix Staudigl, Hazem Al Indari, Daniel Schön, Dominik Sisejkovic, Farhad Merchant, Jan Moritz Joseph, Vikas Rana, Stephan Menzel, and Rainer Leupers. 2022. NeuroHammer: Inducing bit-flips in memristive crossbar memories. In Design, Automation & Test in Europe Conference & Exh...

    2022

  112. [127]

    Felix Staudigl, Thorben Fetz, Rebecca Pelke, Dominik Sisejkovic, Jan Moritz Joseph, Leticia Bolzani Pöhls, and Rainer Leupers. 2023. Fault injection in native logic-in-memory computation on neuromorphic hardware. In60th ACM/IEEE Design Automation Conference (DAC). IEEE, 1–6. h...

    2023

  113. [129]

    Felix Staudigl, Jan Philipp Thoma, Christian Niesler, Karl Sturm, Rebecca Pelke, Dominik Germek, Jan Moritz Joseph, Tim Güneysu, Lucas Davi, and Rainer Leupers. 2024. NVM-Flip: Non-Volatile-Memory BitFlips on the System Level. InProceedings of the ACM Workshop on Secure and Tr...

    2024

  114. [130]

    Shuqin Su, Min Zhu, Hanning Wang, Bohan Yang, and Leibo Liu. 2021. A Survey on the Security of PUFs.Journal of Physics: Conference Series1993, 1 (2021), 012031. https://doi.org/10.1088/1742-6596/1993/1/012031

    2021 doi

  115. [131]

    Bing Sun, Jun Sun, Wayne Koh, and Jie Shi. 2024. Neural Network Semantic Backdoor Detection and Mitigation: A{Causality-Based} Approach. In33rd USENIX Security Symposium (USENIX Security 24). USENIX, 2883–2900. https://www.usenix.org/conference/usenixsecurity24/presentation/sun-bing

    2024

  116. [132]

    Bo Sun, Jinhao Zhang, Jieru Song, Jialin Meng, David Wei Zhang, Tianyu Wang, and Lin Chen. 2025. CMOS compatible multi-state memristor for neuromorphic hardware encryption with low operation voltage.InfoMat(2025), e70044. https://doi.org/10.1002/inf2.70044

    2025 doi

  117. [133]

    Sachin Taneja, Viveka Konandur Rajanna, and Massimo Alioto. 2022. In-Memory Unified TRNG and Multi-Bit PUF for Ubiquitous Hardware Security.IEEE Journal of Solid-State Circuits57, 1 (2022), 153–166. https://doi.org/10.1109/ JSSC.2021.3125255

    2022

  118. [134]

    2021.Emerging topics in hardware security

    Mark Tehranipoor. 2021.Emerging topics in hardware security. Springer. https://doi.org/10.1007/978-3-030-64448-2

    2021 doi

  119. [136]

    Akshay Wali and Saptarshi Das. 2023. Hardware and Information Security Primitives Based on 2D Materials and Devices.Advanced Materials35, 18 (2023), 2205365. https://doi.org/10.1002/adma.202205365

    2023 doi

  120. [137]

    Ziyu Wang, Fan-hsuan Meng, Yongmo Park, Jason K Eshraghian, and Wei D Lu. 2023. Side-channel attack analysis on in-memory computing architectures.IEEE Transactions on Emerging Topics in Computing12, 1 (2023), 109–121. https://doi.org/10.1109/TETC.2023.3257684

    2023

  121. [138]

    Ziyu Wang, Yuting Wu, Yongmo Park, Sangmin Yoo, Xinxin Wang, Jason K Eshraghian, and Wei D Lu. 2023. PowerGAN: a machine learning approach for power side-channel attack on compute-in-memory accelerators. Advanced Intelligent Systems5, 12 (2023), 2300313. https://doi.org/10.100...

    2023 doi

  122. [139]

    Simon Wilhelmstätter, Joschua Conrad, Devanshi Upadhyaya, Ilia Polian, and Maurits Ortmanns. 2024. Enabling Power Side-Channel Attack Simulation on Mixed-Signal Neural Network Accelerators. InIEEE International Conference on Omni-layer Intelligent Systems (COINS). IEEE, 1–5. h...

    2024

  123. [140]

    Kwunhang Wong, Songqi Wang, Wei Huang, et al. 2024. SNNGX: Securing Spiking Neural Networks with Genetic XOR Encryption on RRAM-based Neuromorphic Accelerator. InProceedings of the 43rd IEEE/ACM International Conference on Computer-Aided Design ICCAD. ACM, 192:1–192:9. https:/...

    2024

  124. [141]

    Stant, and Ashish Venkat

    Lingxi Wu, Rahul Sreekumar, Rasool Sharifi, Kevin Skadron, Mircea R. Stant, and Ashish Venkat. 2023. Hardware Trojans in eNVM Neuromorphic Devices. InProceedings of the Design, Automation & Test in Europe Conference & Exhibition (DATE). IEEE, 1–6. https://doi.org/10.23919/DATE...

    2023

  125. [142]

    Zuheng Wu, Wei Li, Jianxun Zou, Zhe Feng, Tao Chen, Xiuquan Fang, Xing Li, Yunlai Zhu, Zuyu Xu, and Yuehua Dai. 2023. Threshold switching memristor-based radial-based spiking neuron circuit for conversion-based spiking neural networks adversarial attack improvement.IEEE Transa...

    2023

  126. [143]

    S. Xu X. Zou and et al. X. Chen. 2021. Breaking the von Neumann bottleneck: architecture-level processing-in-memory technology.Sci. China Inf. Sci.64 (2021), 160404. https://doi.org/10.1007/s11432-020-3227-1

    2021 doi

  127. [144]

    Jiarui Xu, Yi Zhan, Yujie Li, Jiajun Wu, Xinglong Ji, Guoyi Yu, Wenyu Jiang, Rong Zhao, and Chao Wang. 2021. In situ aging-aware error monitoring scheme for IMPLY-based memristive computing-in-memory systems.IEEE Transactions on Circuits and Systems I: Regular Papers69, 1 (202...

    2021

  128. [145]

    Nuo Xu, Kaleel Mahmood, Haowen Fang, Ethan Rathbun, Caiwen Ding, and Wujie Wen. 2025. Attacking the spike: On the security of spiking neural networks to adversarial examples.Neurocomputing656 (2025), 131506. https://doi.org/10.1016/J.NEUCOM.2025.131506

    2025

  129. [146]

    Yixin Xu, Yi Xiao, Zijian Zhao, Franz Müller, Alptekin Vardar, Xiao Gong, Sumitha George, Thomas Kämpfe, Vijaykrishnan Narayanan, and Kai Ni. 2023. Embedding security into ferroelectric FET array via in situ memory operation.Nature communications14, 1 (2023), 8287. https://doi...

    2023 doi

  130. [147]

    Srishti Yadav, Anshul Pundhir, Balasubramanian Raman, and Sanjeev Kumar. 2024. Unveiling Robustness of Spiking Neural Networks against Data Poisoning Attacks. InInternational Joint Conference on Neural Networks (IJCNN). IEEE, 1–8. https://doi.org/10.1109/IJCNN60899.2024.106505...

    2024

  131. [148]

    A Giray Yağlikçi, Minesh Patel, Jeremie S Kim, et al. 2021. Blockhammer: Preventing rowhammer at low cost by blacklisting rapidly-accessed dram rows. InInternational Symposium on High-Performance Computer Architecture (HPCA). IEEE, 345–358. https://doi.org/10.1109/HPCA51647.2021.00037

    2021

  132. [149]

    Song Yan, Jinlong Fei, Hui Wei, Bingbing Zhao, Zheng Wang, and Guoliang Yang. 2025. Adversarial event patch for Spiking Neural Networks.Knowledge-Based Systems309 (2025), 112865. https://doi.org/10.1016/j.knosys.2024.112865

    2025

  133. [150]

    Xiaobei Yan, Xiaoxuan Lou, Guowen Xu, Han Qiu, Shangwei Guo, Chip Hong Chang, and Tianwei Zhang. 2023. Mercury: An automated remote side-channel attack to nvidia deep learning accelerator. InInternational Conference on Field Programmable Technology (ICFPT). IEEE, 188–197. http...

    2023

  134. [151]

    Binbin Yang, Daniel Arumí, Salvador Manich, Álvaro Gómez-Pau, Rosa Rodríguez-Montañés, Mireia Bargalló González, Francesca Campabadal, and Liang Fang. 2021. RRAM Random Number Generator Based on Train of Pulses. Electronics10, 15 (2021), 1831. https://doi.org/10.3390/electroni...

    2021 doi

  135. [152]

    Chaofei Yang, Beiye Liu, Hai Li, Yiran Chen, Mark Barnell, Qing Wu, Wujie Wen, and Jeyavijayan Rajendran. 2016. Security of neuromorphic computing: thwarting learning attacks using memristor’s obsolescence effect. InIEEE/ACM International Conference on Computer-Aided Design (I...

    2016

  136. [153]

    Chaofei Yang, Beiye Liu, Hai Li, Yiran Chen, Mark Barnell, Qing Wu, Wujie Wen, and Jeyavijayan Rajendran. 2019. Thwarting replication attack against memristor-based neuromorphic computing system.IEEE Transactions on Computer-Aided Design of Integrated Circuits and Systems39, 1...

    2019

  137. [154]

    Yanmeng Yao, Xiaohan Zhao, and Bin Gu. 2024. Exploring Vulnerabilities in Spiking Neural Networks: Direct Adversarial Attacks on Raw Event Data. InEuropean Conference on Computer Vision. Springer, 412–428. https: //doi.org/10.1007/978-3-031-73220-1_24

    2024 doi

  138. [155]

    Junsu Yu, Kyung Kyu Min, Yeonwoo Kim, Sihyun Kim, Sungmin Hwang, Tae-Hyeon Kim, Changha Kim, Hyungjin Kim, Jong-Ho Lee, Daewoong Kwon, and Byung-Gook Park. 2021. A novel physical unclonable function (PUF) using 16×16 pure-HfO x ferroelectric tunnel junction array for security ...

    2021 doi

  139. [156]

    Zhaofei Yu, Tong Bu, Yitong Li, and Tiejun Huang. 2022. Hardware implementation of spiking neural networks: challenges and progress. InProceedings of the IEEE International Conference on Neuromorphic Systems. IEEE, 12–19. https://doi.org/10.1038/s41467-022-29795-3

    2022 doi

  140. [157]

    Yuanyuan Yuan, Zhibo Liu, Sen Deng, Yanzuo Chen, Shuai Wang, Yinqian Zhang, and Zhendong Su. 2024. HyperTheft: Thieving Model Weights from TEE-Shielded Neural Networks via Ciphertext Side Channels. InProceedings of the ACM SIGSAC Conference on Computer and Communications Secur...

    2024

  141. [158]

    Wenshuo Yue, Kai Wu, Zhiyuan Li, et al. 2025. Physical unclonable in-memory computing for simultaneous protecting private data and deep learning models.Nature Communications16, 1 (2025), 1031. https://doi.org/10.1038/s41467- 025-56412-w

    2025 doi

  142. [159]

    Dmitrii Zendrikov, Sergio Solinas, and Giacomo Indiveri. 2023. Brain-inspired methods for achieving robust compu- tation in heterogeneous mixed-signal neuromorphic processing systems.Neuromorphic Computing and Engineering 3, 3 (2023), 034002. https://doi.org/10.1088/2634-4386/ace64c

    2023 doi

  143. [160]

    Guobin Zhang, Jianhao Kan, Xuemeng Fan, Qi Luo, Jiabao Sun, Dawei Gao, and Yishu Zhang. 2025. Enhancing IoT security with threshold switching-based unified security primitives.Nanotechnology36, 15 (2025), 155202. https://doi.org/10.1088/1361-6528/adb980

    2025 doi

  144. [161]

    Pei Zhang, Shuo Zhu, and Edmund Y Lam. 2024. Event encryption: Rethinking privacy exposure for neuromorphic imaging.Neuromorphic Computing and Engineering4, 1 (2024), 014002. https://doi.org/10.1088/2634-4386/ad207b

    2024 doi

  145. [162]

    Xiuye Zhang, Chuanpeng Jiang, Jialiang Yin, et al. 2025. Experimental Realization of Physical Unclonable Function Chip Utilizing Spintronic Memories.Engineering49 (2025), 141–148. https://doi.org/10.1016/j.eng.2024.12.028

    2025 doi

  146. [163]

    Xianyue Zhao, Jonas Ruchti, Christoph Frisch, et al . 2024. Understanding stochastic behavior of self-rectifying memristors for error-corrected physical unclonable functions.IEEE Transactions on Nanotechnology(2024). https: //doi.org/10.1109/TNANO.2024.3413888

    2024

  147. [164]

    Shuo Zhu, Chutian Wang, Jianqing Huang, Pei Zhang, Jing Han, and Edmund Y Lam. 2024. Neuromorphic encryption: combining speckle correlography and event data for enhanced security.Advanced Photonics Nexus3, 5 (2024). https://doi.org/10.1117/1.APN.3.5.056002

    2024 doi

  148. [165]

    Minhui Zou, Junlong Zhou, Xiaotong Cui, Wei Wang, and Shahar Kvatinsky. 2022. Enhancing security of memristor computing system through secure weight mapping. InIEEE Computer Society Annual Symposium on VLSI (ISVLSI). IEEE, 182–187. https://doi.org/10.1109/ISVLSI54635.2022.0004...

    2022

  149. [2018]

    https://doi.org/10.1109/ MC.2018.157113521

    Programming spiking neural networks on Intel’s Loihi.Computer51, 3 (2018), 52–61. https://doi.org/10.1109/ MC.2018.157113521

    2018

  150. [2021]

    In24th Euromicro Conference on Digital System Design (DSD)

    Revealing the secrets of spiking neural networks: The case of izhikevich neuron. In24th Euromicro Conference on Digital System Design (DSD). IEEE, 514–518. https://doi.org/10.1109/DSD53832.2021.00083

    2021

  151. [2022]

    Advanced Intelligent Systems4, 11 (2022), 2200177

    Memristor-Based Security Primitives Robust to Malicious Attacks for Highly Secure Neuromorphic Systems. Advanced Intelligent Systems4, 11 (2022), 2200177. https://doi.org/10.1002/aisy.202200177

    2022 doi

Pith tools

Reviewed August 4, 2026 · model on record in the stance chip above.