A backdoor that lives entirely in spike timing

What the work claims

Riano, Abad, Picek and Urbieta introduce what they state is the first clean-label backdoor attack evaluated on spiking neural networks and neuromorphic event data.¹ Their attacker does not change labels and does not add or remove a single event. It takes event streams belonging to one target class and remaps when the events occur. The transformation preserves the per-pixel, per-polarity event count exactly, so once time is collapsed, the poisoned sample is mathematically identical to its clean version: the reported structural similarity between clean and triggered rate frames is 1.00, with zero L0 and L-infinity distance.

Despite that invisibility, the attack works. Across three neuromorphic datasets and both a convolutional SNN and a compact spiking transformer victim, at least one of their temporal triggers reaches an attack success rate of 1.00 in five of the six dataset-architecture pairs, with poison rates of 0.1 on the two larger datasets and 0.5 on the small one. The clean-label constraint matters: because labels are untouched, the usual hygiene of inspecting or relabeling training data does nothing.

How it works

Neuromorphic sensors such as dynamic vision sensors output asynchronous events, each carrying a pixel address, a polarity (brightness up or down) and a microsecond timestamp. Most training and inspection pipelines aggregate those events into rate frames: a count of events per pixel per polarity over the whole window. The authors build their entire attack on a simple observation: a spiking network trained on the full temporal sequence is sensitive to when events arrive, while almost every defense and data audit consumes the rate frame. Re-timing events therefore changes what the victim learns without changing what the inspector sees.

They evaluate three timestamp remappings. Concentrate squeezes events into a short burst window. Front-load shifts event mass toward the start of the sequence. Shift rotates the whole stream along the time axis. All three preserve the aggregate counts exactly. A leaky integrate-and-fire neuron fires when its membrane potential crosses a threshold, and membrane dynamics are driven by coincident input, so a burst that lands in a few bins pushes neurons over threshold in a characteristic, repeatable way. That repeatability is what the backdoor learns.

The ablations support that reading. Shift, which mostly preserves the local coincidence structure and changes only the absolute phase, is consistently the weakest trigger: its attack success rate stays near zero in almost every configuration, peaking at 0.22 on the convolutional N-MNIST victim. A timestamp change that redistributes event coincidence, by contrast, installs the backdoor. The authors also checked that the transformations alone do not bias a clean model: applied to a clean convolutional victim, the triggers produce the target class in at most 1.18 percent of cases, so the high attack success rate is learned during poisoned training, not an artifact of the transform.

Where a skeptic should push

The load-bearing assumption is that an attacker can get re-timed streams into the victim's training data, and the paper's own numbers show the attack is not free of fingerprints everywhere. The utility cost is uneven. On N-MNIST the poisoned victims stay within two percentage points of their clean baselines, but on CIFAR10-DVS the convolutional victim drops from 0.62 to 0.54 clean accuracy under the concentrate trigger, and the transformer victim drops from 0.60 to 0.49 while still being driven to 100 percent attack success under front-load. A defender watching clean accuracy during training would notice something wrong in exactly the strongest attack configuration.

Second, the stealth claim is representation-specific and the authors say so plainly. Their model-free detector, which reads only the input tensor and scores five features of the per-step event mass profile (entropy, peak mass, Gini coefficient, divergence from the clean mean profile, and a phase feature), detects concentrate and front-load at 1.00 true-positive rate across all six victim cells and shift at 0.93 to 0.94. But those features were chosen to catch exactly the transformations evaluated. An adaptive attacker who preserves the coarse temporal statistics while hiding the trigger elsewhere would face a different detector, and the paper does not claim otherwise.

Third, the defense panel is nearly empty on the attack axis, and that is the point rather than a flaw. Rate-frame STRIP sits at chance (0.01) across all entries. Activation Clustering is uninformative. Spectral Signatures reaches 1.00 true-positive rate only on the convolutional victims, for two of the three triggers. Neural Cleanse, searching for a spatial trigger, is blind on all three convolutional cells (maximum anomaly index 0.47 against a flag threshold of 2) and only partially flags the N-MNIST transformer. Pruning fails for a structural reason worth remembering: a clean-label poison has no dedicated dormant neurons to cut, because the trigger is learned by neurons that also do normal work. Still, every result rests on three seeds, on digital-domain poisoning of public datasets, and on a fixed target class. This is a careful, bounded demonstration, not a field survey of adaptive attacks.

Why organoid training data is a poisoning target

The non-obvious implication is that organoid intelligence is building exactly the kind of data supply chain this attack needs. A closed-loop biological computing experiment produces spike streams: electrode events with addresses and timestamps, the same logical type as the DVS data poisoned here. Those streams are expensive to generate, so the field shares them, reuses them across labs, and increasingly routes training through shared cloud infrastructure and contributed datasets. Every one of those is the attacker's entry point in the paper's threat model: a public dataset, externally contributed training data, or outsourced training. Biological data is not exempt because it is biological; the vulnerability lives in the file format, not in the sensor.

The sharper point is what organoid pipelines typically keep. Rate histograms and binned firing statistics are the standard summary of MEA recordings, precisely the time-collapsed representation that this attack makes invisible by construction. A lab that archives only aggregate firing rates of its training data is keeping the one view of the data that cannot reveal a temporal poison. The defense that works in this paper is also cheap and model-free: per-step event mass features set on clean data alone, no model weights required, usable as a pre-training filter. That is a directly transferable audit blueprint for any facility that trains on recorded spike data, biological or silicon.

The genuine threat is governance-shaped. As organoid datasets grow and third parties contribute recordings or run training, provenance auditing of spike timing will become a security control, not a curation nicety. The opportunity cuts the other way: living tissue is not a fixed digital file. Its temporal statistics drift, its event mass profiles are non-stationary across days in culture, and an attacker who re-times a training stream must match a moving, noisy target. The attacker's advantage assumed here, exact knowledge of a fixed representation, is weaker against a substrate that never stops changing. Whether that variability is protection or just noise is an empirical question this paper does not touch, but it is the right question for the field to ask before standardizing shared organoid training corpora.

The bottom line

Established: a backdoor can be installed in spiking networks using timestamp remapping alone, surviving every aggregate-count inspection, and most established defenses fail against it on the evaluated configurations. Established: input-side temporal statistics expose the evaluated triggers at near-perfect detection rates. Asserted, not yet shown: robustness of the attack against adaptive defenders who know the detector, its transfer to biological spike recordings, and any attack at all inside a closed loop with a living substrate. What would confirm the relevance to organoid intelligence is a demonstration that a re-timed training corpus of recorded neural activity installs a comparable backdoor in a decoder trained for biological computing; what would break it is a detector family that survives an adaptive attacker while coping with the non-stationarity of real cultures.