Abstract:Federated neuromorphic learning (FedNL) leverages event-driven spiking neural networks and federated learning frameworks to effectively execute intelligent analysis tasks over amounts of distributed low-power devices but also perform vulnerability to poisoning attacks. The threat of backdoor attacks on traditional deep neural networks typically comes from time-invariant data. However, in FedNL, unknown threats may be hidden in time-varying spike signals. In this paper, we start to explore a novel vulnerability of FedNL-based systems with the concept of time division multiplexing, termed Spikewhisper, which allows attackers to evade detection as much as possible, as multiple malicious clients can imperceptibly poison with different triggers at different timeslices. In particular, the stealthiness of Spikewhisper is derived from the time-domain divisibility of global triggers, in which each malicious client pastes only one local trigger to a certain timeslice in the neuromorphic sample, and also the polarity and motion of each local trigger can be configured by attackers. Extensive experiments based on two different neuromorphic datasets demonstrate that the attack success rate of Spikewispher is higher than the temporally centralized attacks. Besides, it is validated that the effect of Spikewispher is sensitive to the trigger duration.

What problem does this paper attempt to address?

The problem that this paper attempts to solve is the new back - door attack threat in the Federated Neuromorphic Learning (FedNL) system. Specifically, the paper explores the Temporal Spike Backdoor Attacks based on Time Division Multiplexing (TDM), namely Spikewhisper attacks. ### Problem Background 1. **Federated Neuromorphic Learning (FedNL)** - It combines Federated Learning (FL) and Spiking Neural Networks (SNNs), enabling low - power devices to efficiently collaborate in training large - scale AI models while protecting data privacy. 2. **Existing Threats** - Traditional Deep Neural Networks (DNNs) are vulnerable to back - door attacks, which manipulate model behavior by injecting specific triggers into the training set. However, in FedNL, since SNNs process discrete events and have temporal characteristics, unknown threats may be hidden in time - varying spike signals. ### Research Motivation - Existing back - door attack research mainly focuses on traditional DNNs, while there is less research on back - door attacks in SNNs, especially in FedNL. - The paper aims to explore and verify a new back - door attack method - Spikewhisper, to reveal the potential security vulnerabilities of the FedNL system and provide references for future defense mechanisms. ### Main Contributions 1. **Proposed a new Temporal Spike Backdoor Attack Scheme** - The Spikewhisper attack uses the concept of time division multiplexing to split the global trigger into multiple time slices. Each malicious client only injects a local trigger within a specific time slice, thereby improving the stealth and effectiveness of the attack. 2. **Identified the Sensitivity of the Attack Effect** - It depends not only on the size and position of the local trigger but also is closely related to the time duration. Experiments show that the Attack Success Rate (ASR) of Spikewhisper varies significantly under different time utilization rates. 3. **Experimentally Proved the Effectiveness of Spikewhisper** - Experiments were carried out using two different neuromorphic datasets (N - MNIST and CIFAR10 - DVS). The results show that Spikewhisper has a higher attack success rate compared to the traditional Temporally Centralized Attack (TCA), while having less impact on the main task accuracy. ### Key Technical Points - **Time Division Multiplexing (TDM)** : Disperse the global trigger into multiple time slices. Each malicious client is responsible for one or more time slices, avoiding the exposure risk of a single trigger throughout the entire time period. - **Trigger Design** : Allows attackers to configure the polarity and motion trajectory of local triggers, making them more in line with the characteristics of neuromorphic data and enhancing stealth. - **Experimental Verification** : By adjusting the time utilization rate (U), study its impact on the attack effect, and find that a higher time utilization rate can significantly improve the attack success rate. In conclusion, this paper reveals the new security threats in the FedNL system by introducing the Spikewhisper attack and provides an important reference direction for future research.

Spikewhisper: Temporal Spike Backdoor Attacks on Federated Neuromorphic Learning over Low-power Devices

Time-Distributed Backdoor Attacks on Federated Spiking Learning

Backdoor Attacks and Defenses in Federated Learning: State-of-the-Art, Taxonomy, and Future Directions

Sneaky Spikes: Uncovering Stealthy Backdoor Attacks in Spiking Neural Networks with Neuromorphic Data

NeuroAttack: Undermining Spiking Neural Networks Security through Externally Triggered Bit-Flips

Backdoor Attack Against Split Neural Network-Based Vertical Federated Learning

Coordinated Backdoor Attacks against Federated Learning with Model-Dependent Triggers

Threaten Spiking Neural Networks Through Combining Rate and Temporal Information

How To Backdoor Federated Learning

Act in Collusion: A Persistent Distributed Multi-Target Backdoor in Federated Learning

Toward Efficient Processing and Learning with Spikes: New Approaches for Multispike Learning

Exploring Adversarial Attack in Spiking Neural Networks with Spike-Compatible Gradient.

Efficient and Persistent Backdoor Attack by Boundary Trigger Set Constructing against Federated Learning

Spike timing reshapes robustness against attacks in spiking neural networks

On the Vulnerability of Backdoor Defenses for Federated Learning

Analysis of Power-Oriented Fault Injection Attacks on Spiking Neural Networks

Dual Model Replacement:invisible Multi-target Backdoor Attack based on Federal Learning

A Federated Learning Protocol for Spiking Neural Membrane Systems

Adversarial attacks on spiking convolutional neural networks for event-based vision

Mitigating Backdoor Attacks in Federated Learning via Flipping Weight Updates of Low-Activation Input Neurons

Backdoor Attack with Sparse and Invisible Trigger