Temporal Poisoning: Clean-Label Backdoors via Event Redistribution in SNNs

2026-07-30

AI Summary

This work addresses the lack of research on clean-label backdoor attacks in spiking neural networks (SNNs) by proposing a novel time-domain poisoning attack. The method implants highly stealthy backdoors by applying fixed timestamp transformations to event streams of the target class, reconstructing sequences without altering their labels or total event counts. To the best of our knowledge, this is the first study to implement and evaluate clean-label backdoor attacks on SNNs with neuromorphic data. The work further demonstrates that temporal compression-based defenses are ineffective against such attacks and introduces a model-agnostic detector based on progressive event quality assessment. Evaluated across three neuromorphic datasets and multiple SNN architectures, the attack achieves up to 100% success rates, confirming its effectiveness and the detector’s capability to identify temporal perturbations.

Abstract

Backdoor attacks on Spiking Neural Networks (SNNs) have primarily assumed dirty-label poisoning, in which triggered training samples are relabeled to an attacker-selected class. We study clean-label temporal poisoning, where a fixed timestamp transformation is applied only to the target-class training streams, leaving their labels unchanged. The transformation preserves the per-pixel, per-polarity event count exactly, making clean and triggered samples identical after temporal aggregation while altering the sequence processed by the SNN. Across three neuromorphic datasets and both convolutional and transformer-based victims, the attack reaches an ASR of 1.00 in the strongest configurations. We analyze the attack through poison-budget and trigger-shape ablations and evaluate established backdoor defenses adapted to spiking models. Defenses that collapse the time axis before inspection are blind by construction, while feature-space methods detect the poison only in selected settings. Our model-free detector, based on per-step event mass, detects the evaluated temporal transformations, demonstrating both the limitation of rate-collapsed defenses and the boundary of the attack's stealth. To our knowledge, this is the first clean-label backdoor attack evaluated on SNNs and neuromorphic event data.

Problem

• clean-label backdoor
• temporal poisoning
• Spiking Neural Networks
• neuromorphic data
• event redistribution

Innovation

• Temporal Poisoning
• Clean-Label Backdoor
• Spiking Neural Networks
• Neuromorphic Data
• Event Redistribution