Unsupervised Backdoor Detection and Mitigation for Spiking Neural Networks

2025-10-08

AI Summary

Spiking Neural Networks (SNNs) offer high energy efficiency but remain understudied in terms of backdoor attack resilience; conventional artificial neural network (ANN) defenses fail due to their incompatibility with SNNs’ event-driven dynamics and temporal dependencies. Method: This work first identifies the root causes of defense failure in SNNs and proposes the first unsupervised backdoor detection and mitigation framework for SNNs: (i) target-label inference via statistical analysis of maximal inter-spike membrane potential intervals—requiring no attack prior knowledge or labeled data; (ii) dendritic connection suppression, leveraging minimal unlabeled clean samples to guide neuron clamping and eliminate poisoned synaptic connections. Contribution/Results: Evaluated on multiple neuromorphic benchmarks, the method achieves 100% detection accuracy. Mitigation alone reduces attack success rate from 100% to 8.44%; joint detection and mitigation further suppress it to 2.81%, with zero degradation in clean-task accuracy.

Technology Category

• Cognitive Modeling & Cognitive Systems: Neural Spike Coding
• Computer Vision: Adversarial Attacks & Robustness
• Machine Learning: Adversarial Learning & Robustness

Application Category

• Graph Algorithms and Modeling for the Web: Graph neural networks and deep learning approaches for Web-related graphs
• Search and Retrieval-Augmented AI: Web evaluation methodologies and metrics
• Responsible Web: Measurement, analysis, and circumvention of Web censorship

Abstract

Spiking Neural Networks (SNNs) have gained increasing attention for their superior energy efficiency compared to Artificial Neural Networks (ANNs). However, their security aspects, particularly under backdoor attacks, have received limited attention. Existing defense methods developed for ANNs perform poorly or can be easily bypassed in SNNs due to their event-driven and temporal dependencies. This paper identifies the key blockers that hinder traditional backdoor defenses in SNNs and proposes an unsupervised post-training detection framework, Temporal Membrane Potential Backdoor Detection (TMPBD), to overcome these challenges. TMPBD leverages the maximum margin statistics of temporal membrane potential (TMP) in the final spiking layer to detect target labels without any attack knowledge or data access. We further introduce a robust mitigation mechanism, Neural Dendrites Suppression Backdoor Mitigation (NDSBM), which clamps dendritic connections between early convolutional layers to suppress malicious neurons while preserving benign behaviors, guided by TMP extracted from a small, clean, unlabeled dataset. Extensive experiments on multiple neuromorphic benchmarks and state-of-the-art input-aware dynamic trigger attacks demonstrate that TMPBD achieves 100% detection accuracy, while NDSBM reduces the attack success rate from 100% to 8.44%, and to 2.81% when combined with detection, without degrading clean accuracy.

Problem

• Detects backdoor attacks in Spiking Neural Networks without attack knowledge
• Mitigates malicious neurons while preserving normal network functionality
• Overcomes limitations of traditional defenses in event-driven SNN architectures

Innovation

• Unsupervised post-training detection using temporal membrane potential
• Mitigation mechanism clamping dendritic connections between layers
• Leverages maximum margin statistics without attack knowledge