19.3.2 Event-based attack vectors

In conventional deep learning, your attack surface is primarily the data’s content—the pixel values in an image, the tokens in a text sequence. Neuromorphic systems force a fundamental shift in this thinking. Because these systems process asynchronous streams of events (spikes), the attack surface expands into a new dimension: time. The “when” becomes as exploitable as the “what.”

Manipulating the temporal dynamics of spike trains is the core of event-based attacks. You’re no longer just altering data points; you’re orchestrating a malicious symphony of timed events to fool, disable, or control the system.

The Temporal Attack Surface: Time as a Weapon

An SNN’s behavior is dictated by the precise timing and correlation of incoming spikes. Neurons integrate these spikes over time, and their membrane potential rises and falls accordingly. If the potential crosses a threshold, the neuron fires its own spike. This mechanism is ripe for exploitation. We can categorize the primary vectors based on how they manipulate this temporal process.

Spike Timing Manipulation (Temporal Poisoning)

This is one of the most subtle and powerful attacks against SNNs. By introducing minuscule delays or advances (on the order of microseconds) to specific spikes in an input stream, you can fundamentally alter the network’s computation. A spike arriving slightly later might fail to contribute to a neuron’s firing, effectively erasing the feature it represents. Conversely, advancing a spike could cause a neuron to fire prematurely, triggering a cascade of incorrect activations.

Spike Flooding and Starvation

These are resource-exhaustion attacks tailored for the event-based domain.

• Spike Flooding (Denial-of-Service): Every spike a neuromorphic chip processes consumes a small amount of energy and computational resources for synaptic updates. By bombarding a system with a high-frequency stream of spurious spikes, you can overwhelm its processing capacity. This can lead to increased latency, missed processing of legitimate spikes, and thermal throttling of the hardware. In effect, it’s a DoS attack at the neural level, blinding the system with noise.
• Spike Starvation (Evasion): The inverse of flooding, this attack involves selectively blocking or dropping critical spikes from the input stream. Imagine a neuromorphic camera where the edges of an object are encoded by a burst of spikes. An attacker who can intercept and filter the event stream could remove these specific spikes, effectively “erasing” the object from the SNN’s perception, causing a catastrophic failure in an autonomous vehicle or drone.

Crafting and Injecting Adversarial Events

Beyond manipulating existing event streams, you can generate entirely new, malicious ones. This is analogous to crafting an adversarial patch for a CNN, but instead of a pattern of pixels, you craft a pattern of timed spikes.

Adversarial Spike Injection

The goal here is to create a minimal, often imperceptible, stream of additional spikes that, when merged with the legitimate input, forces a misclassification. This requires knowledge of the SNN’s architecture and weights. You would solve an optimization problem to find the precise timings and locations for a few extra spikes that are most effective at pushing a target neuron (or population of neurons) over its firing threshold to trigger an incorrect outcome.

# Pseudocode for crafting an adversarial spike train
function generate_adversarial_spikes(model, input_spikes, target_class):
    # Initialize a small, empty set of adversarial spikes
    adversarial_train = []
    max_spikes = 5  // Constraint: keep the attack subtle

    for i in range(max_spikes):
        # Calculate the gradient of the loss w.r.t. spike timing
        # to find the most impactful time and neuron to add a spike
        loss = calculate_loss(model, input_spikes + adversarial_train, target_class)
        gradients = loss.backward() // Gradient w.r.t. spike times

        # Find the best (neuron_id, time_t) to add a new spike
        best_new_spike = find_optimal_spike_addition(gradients)
        
        # Add the crafted spike to our malicious payload
        adversarial_train.append(best_new_spike)

    return adversarial_train

Comparative Analysis: Classic vs. Neuromorphic Vectors

To help you map your existing red teaming knowledge, this table contrasts traditional ML attacks with their neuromorphic counterparts.