Unsupervised Backdoor Detection and Mitigation for Spiking Neural Networks
It addresses a critical security gap for SNNs, which are increasingly used for energy-efficient AI, by providing robust defenses against backdoor attacks, though it is incremental as it builds on existing defense concepts adapted to SNNs.
This paper tackles the problem of backdoor attacks in Spiking Neural Networks (SNNs), which are vulnerable due to their event-driven nature, by proposing an unsupervised detection and mitigation framework that achieves 100% detection accuracy and reduces attack success rates from 100% to as low as 2.81% without harming clean accuracy.
Spiking Neural Networks (SNNs) have gained increasing attention for their superior energy efficiency compared to Artificial Neural Networks (ANNs). However, their security aspects, particularly under backdoor attacks, have received limited attention. Existing defense methods developed for ANNs perform poorly or can be easily bypassed in SNNs due to their event-driven and temporal dependencies. This paper identifies the key blockers that hinder traditional backdoor defenses in SNNs and proposes an unsupervised post-training detection framework, Temporal Membrane Potential Backdoor Detection (TMPBD), to overcome these challenges. TMPBD leverages the maximum margin statistics of temporal membrane potential (TMP) in the final spiking layer to detect target labels without any attack knowledge or data access. We further introduce a robust mitigation mechanism, Neural Dendrites Suppression Backdoor Mitigation (NDSBM), which clamps dendritic connections between early convolutional layers to suppress malicious neurons while preserving benign behaviors, guided by TMP extracted from a small, clean, unlabeled dataset. Extensive experiments on multiple neuromorphic benchmarks and state-of-the-art input-aware dynamic trigger attacks demonstrate that TMPBD achieves 100% detection accuracy, while NDSBM reduces the attack success rate from 100% to 8.44%, and to 2.81% when combined with detection, without degrading clean accuracy.