Benchmarking spiking radios against energy and attack budgets

What the work claims

This is a methods-and-tooling paper, a simulator described in workshop-paper form (Machine Learning and the Physical Sciences 2025), by a single author at SIMATS Engineering and Saveetha University. RT-NuSIS (Real-Time Neuromorphic Spectrum Intelligence Simulator) is a modular, deterministic-by-seed framework for studying spiking neural network agents that share radio spectrum under two simultaneous constraints: a limited, harvestable energy supply, and an intelligent adversary.¹

The claim is integration, not novelty of parts. Each simulated node runs leaky integrate-and-fire neurons with memristive synapses, senses power across a set of channels, picks a channel by a utility that trades expected throughput against energy cost, and lives on an energy ledger fed by RF and triboelectric harvesting models. Around this core sit four attack primitives (constant jamming, reactive jamming, Byzantine parameter corruption during cooperative learning, and GAN-style waveform spoofing), a genetic-algorithm configurator optimizing a performance-utilization-energy reward, and a benchmark harness reporting detection AUC, energy per inference, latency, and spectrum utilization. The paper adds theory where it can: a boundedness theorem for the hybrid neuron-memristor dynamics, a per-step complexity bound of O(rho times N times d) for event-driven updates, and a mean-field threshold for how large a fraction of compromised nodes a majority-vote scheme tolerates before decisions flip.¹

How it works

Each node carries four state objects: membrane potentials, memristive synaptic weights, a stored energy in joules, and a belief vector over channels. Neurons follow standard leaky integrate-and-fire dynamics with exponential synaptic kernels. Synapses are modeled as memristors: an internal state variable between 0 and 1 maps linearly onto conductance, and it evolves by an STDP-like potentiation or depression term minus a drift or leak rate that models retention loss; windowing functions keep the state off the boundaries.¹

The energy ledger is the piece worth stealing. Stored energy obeys a balance equation: harvesting power in (RF capture proportional to incident power density times coupling efficiency, plus a triboelectric term fit to published device characterization curves, plus an environmental term), minus consumption (sensing, per-spike and per-synapse-update inference costs, transmission), minus a static leak. A node that spends what it does not harvest simply has less to spend later. Channel choice is a softmax over extracted features fed through a utility that discounts expected throughput by energy cost, so frugality is built into the decision rule rather than appended as a report.¹

The adversary mathematics is clean. For majority voting among nodes where honest voters are correct with probability q above one half, the expected margin of correct votes over the flip line is mu = H(2q - 1) - B with H honest and B compromised nodes; a Chernoff-Hoeffding bound then gives an exponential decay of the flip probability once the margin exceeds about the square root of N, corresponding to a critical adversary fraction p-star below (2q - 1) over 2q. Above that fraction, graceful degradation ends and the collective decision collapses. In the headline benchmark (1000 nodes, 30 percent adversarial, 300 simulated seconds, 5 to 20 decision neurons per node, memristor leak rate of 1e-4 per second, RF harvesting efficiency 0.3), the system tracks learning progress and energy simultaneously: performance score rises from 61.66 to 64.32 and learning accuracy from 0.519 to 0.589 across phases, while spectrum utilization declines from 32.98 to 27.48 percent and latency grows from 94.30 to 114.81 ms, all at a near-constant modeled energy per inference of about 33 microjoules.¹

Where a skeptic should push

The single most load-bearing assumption is that modeled energy is meaningful energy. The authors are admirably blunt on this: energy estimates come from per-operation cost models and published device and processor metrics (Loihi numbers used only for calibration), not from silicon measurements, and the memristor models are phenomenological. The 33 microjoules per inference is therefore an accounting artifact of chosen cost parameters, not a measurement. Anyone citing this simulator's absolute energy figures as hardware evidence has stopped reading where the paper warns them to.

Second, the benchmark is one configuration with synthetic primary-user traces on a single seed-controlled harness. The robustness headline, "maintains behavior up to 30 percent adversarial nodes," should be read against the paper's own table: spectrum utilization falls by about five percentage points and latency grows by about 20 percent under attack, which is graceful degradation, certainly, but the margin between the demonstrated 30 percent and the theoretical p-star for plausible q is not explored in depth. Third, the complexity and threshold theorems are standard tools applied to stylized models; the Byzantine learner sends corrupted parameters w plus delta, but real federated attacks are adaptive in ways the primitives here are not. Finally, this is a single-author workshop paper with modest scale claims; treat the feature-comparison table against NEST and Brian 2 (energy modeling, adversarial modeling, harvesting models) as a positioning statement from the tool's author.¹

Energy budgets and adversaries as OI governance

The organoid-intelligence field has an energy-accounting problem it does not like to discuss. Headline comparisons contrast a GPU's hundreds of watts with a brain's twenty, quietly excluding the incubator, perfusion pumps, sterile handling, acquisition electronics, and the technician hours that keep the tissue alive and useful. RT-NuSIS shows what closed-loop honesty looks like at the simulation level: a state variable that can go empty, a leak term, a consumption model charged per operation, and an explicit statement of which numbers are measured and which are modeled. The non-obvious implication is that OI needs its own ledger equation before it needs bigger organoids. A credible OI benchmark would report joules per useful inference where the denominator includes life support and the amortized cost of failed cultures, exactly as this simulator charges sensing, inference, and transmission against harvesting. Until the field produces that accounting, its efficiency claims will keep losing credibility contests they could have settled themselves.

The adversary model is the stranger gift. A dish of living neurons trained by electrical feedback is, in the language of this paper, a distributed decision system whose training signal channel can be spoofed, jammed, or corrupted: stimulus artifacts, electrode crosstalk, drift, or a contaminated reward signal are Byzantine attacks with biological clothing. The mean-field threshold gives the field a vocabulary it currently lacks. If future systems pool decisions across multiple organoids or across long training runs, the question "what fraction of compromised channels flips the learned behavior" is a security question, not a nuisance, and p-star below (2q - 1) over 2q is a first quantitative shape for thinking about it. The opportunity is to design closed-loop OI training with the same attack surface inventory this simulator builds in by default: assume the feedback path is hostile, quantify robustness as a function of corrupted channels, and publish the degradation curve rather than the best-case accuracy.

The threat cuts both ways. Simulators like RT-NuSIS lower the cost of claiming energy virtue for neuromorphic silicon: with per-op cost models and harvesting curves, one can construct an impressive-looking energy narrative without fabricating anything, which raises the evidentiary bar for everyone else. OI, whose substrate genuinely sips energy at the computation point but drinks it lavishly everywhere else, is the most exposed to that raised bar. The honest response is not to dispute the accounting but to adopt it first: publish the whole-loop ledger, modeled or measured, with the same explicit caveats this paper attaches to its own numbers. A field that does its own honest bookkeeping is hard to audit from outside; a field that does not will be audited.

The bottom line

Established: RT-NuSIS is a working, open-source, deterministic simulator that integrates spiking dynamics, memristive plasticity, harvested-energy budgets, and four adversary classes with a reproducible benchmark harness, and it demonstrates graceful degradation at 30 percent adversarial nodes under its own synthetic workloads. Not established: any hardware energy claim, since all energy figures are modeled; and any superiority over general simulators, which is a positioning claim. What would confirm the tool's value is independent groups reproducing its benchmarks and hardware-calibrated cost models replacing the phenomenological ones. What would break it is evidence that adversarial thresholds shift materially under adaptive attacks. For the OI reader, the lasting content is the discipline: one ledger for energy, one explicit list of what is modeled versus measured, and a security model that treats the training channel as untrusted by default.