BadSNN: Backdoor Attacks on Spiking Neural Networks via Adversarial Spiking Neuron

2026-02-06

AI Summary

This work proposes BadSNN, a novel backdoor attack against spiking neural networks (SNNs). It is the first to exploit the tunability of SNN neuron hyperparameters—such as membrane potential thresholds and time constants—to inject backdoors by perturbing these parameters. By integrating a low-visibility trigger optimization mechanism, BadSNN significantly enhances both the stealthiness and effectiveness of the attack. Built upon the Leaky Integrate-and-Fire (LIF) neuron model, the method combines data poisoning with hyperparameter manipulation to achieve high attack success rates across multiple datasets and SNN architectures. BadSNN outperforms existing data-poisoning-based backdoor attacks in terms of efficacy and demonstrates strong robustness against mainstream defense strategies.

Technology Category

• Cognitive Modeling & Cognitive Systems: Neural Spike Coding
• Computer Vision: Adversarial Attacks & Robustness
• Machine Learning: Adversarial Learning & Robustness

Application Category

• Search and Retrieval-Augmented AI: Web learning to rank, online learning, and counterfactual learning for ranking
• Graph Algorithms and Modeling for the Web: Graph neural networks and deep learning approaches for Web-related graphs
• User Modeling, Personalization and Recommendation: Attacks and countermeasures in recommendation systems

Abstract

Spiking Neural Networks (SNNs) are energy-efficient counterparts of Deep Neural Networks (DNNs) with high biological plausibility, as information is transmitted through temporal spiking patterns. The core element of an SNN is the spiking neuron, which converts input data into spikes following the Leaky Integrate-and-Fire (LIF) neuron model. This model includes several important hyperparameters, such as the membrane potential threshold and membrane time constant. Both the DNNs and SNNs have proven to be exploitable by backdoor attacks, where an adversary can poison the training dataset with malicious triggers and force the model to behave in an attacker-defined manner. Yet, how an adversary can exploit the unique characteristics of SNNs for backdoor attacks remains underexplored. In this paper, we propose \textit{BadSNN}, a novel backdoor attack on spiking neural networks that exploits hyperparameter variations of spiking neurons to inject backdoor behavior into the model. We further propose a trigger optimization process to achieve better attack performance while making trigger patterns less perceptible. \textit{BadSNN} demonstrates superior attack performance on various datasets and architectures, as well as compared with state-of-the-art data poisoning-based backdoor attacks and robustness against common backdoor mitigation techniques. Codes can be found at https://github.com/SiSL-URI/BadSNN.

Problem

• Backdoor Attacks
• Spiking Neural Networks
• Adversarial Spiking Neuron
• Hyperparameter Exploitation
• Neuromorphic Security

Innovation

• Spiking Neural Networks
• Backdoor Attack
• Leaky Integrate-and-Fire
• Hyperparameter Manipulation
• Trigger Optimization