Sponge attacks and the cost of trusting sparse signals

What the work claims

This is a primary security result, evaluated empirically on three benchmark datasets spanning two sensing modalities: NMNIST (event vision), the Spiking Heidelberg Digits or SHD (a silicon cochlea audio dataset), and IBM DVS Gesture (event camera gestures). The authors, Spyridon Raptis and Haralampos-G. Stratigopoulos, train three task-appropriate spiking networks with the SLAYER framework and attack their inputs, not their weights.¹

The per-sample attack crafts a custom adversarial spike train for each input through gradient-based optimization. Across the full test sets it inflates per-inference SynOps by 1.5x (NMNIST), 1.61x (SHD) and 2.6x (IBM DVS Gesture), while preserving the clean prediction on at least 98.48 percent of samples and shifting accuracy by at most 1.5 percentage points. The universal attack is the deployment-relevant novelty: a fixed binary perturbation, built once from 10 samples per class and applied to every subsequent input by elementwise XOR, still inflates SynOps by 1.19x, 1.24x and 1.09x respectively. Mapped to Loihi-1 energy at 23.6 pJ per SynOp, the per-inference overheads span 14 microjoules (universal, SHD) to 13.24 millijoules (per-sample, IBM DVS Gesture); a device running one gesture inference per second under universal attack accumulates roughly 70 joules of attack-driven drain per day.¹

How it works

A sponge attack exploits a structural fact about spiking networks: inference energy is approximately proportional to the number of spikes that propagate, so any input that provokes more spikes without changing the answer is an energy attack. Correctness-based monitoring cannot see it, because the answer is the point. The per-sample variant optimizes a soft mask over the binary input tensor with a straight-through estimator, balancing three objectives: spike inflation, preservation of the clean prediction, and keeping the perturbation small enough to evade input filters.¹

The universal variant is what should worry deployment engineers. The attacker stratifies a small construction set from the training split, 10 samples per class (100, 200 and 110 samples for the three datasets), optimizes one shared binary mask offline, freezes it, and thereafter applies it with a constant-time XOR. No per-input optimization, no presence at the device. The paper sketches realistic delivery mechanisms: a fixed light pattern over an event camera, a stationary acoustic signal under a silicon cochlea, or a compromised sensor driver. The perturbations are tiny in event terms, 2,936 flipped events on NMNIST (0.42 percent of the input tensor), 304 on SHD, and 30,465 on IBM DVS Gesture.¹

Two honest caveats sit inside the method. The energy figures are estimates, SynOps times 23.6 pJ, ignoring membrane-update and static power, on Loihi-1, a chip whose numbers are well characterized but no longer cutting edge. And the per-sample attack costs about four minutes of A100 time per IBM DVS Gesture input, so the authors themselves classify it as the achievable ceiling of input-space sponging, not a streaming threat. The universal attack is the practical one, and it is weaker.¹

Where a skeptic should push

The most load-bearing assumption is stealth, and it is only half true. The per-sample attack is genuinely stealthy: predictions are preserved on at least 98.48 percent of samples and accuracy drops by 0.5 percentage points at most. The universal attack is not. The paper reports the defender's metric honestly: sponge accuracy falls 8.0 points on NMNIST (98.2 to 90.2 percent), 10.35 points on SHD (76.15 to 65.8 percent) and 5.6 points on IBM DVS Gesture (86.7 to 81.1 percent). Any deployment that monitors accuracy or prediction agreement will notice something. What survives is a narrower claim: an attacker who cannot afford visible degradation can still tax the device modestly, at 1.09x to 1.24x SynOps, invisibly enough if baseline drift masks a few points.

Second, the absolute numbers are device-and-model-specific. The 23.6 pJ per SynOp figure excludes membrane and static power, which the authors flag; on a modern chip the ratios would likely persist but the absolute joules would move. Third, all three victims are modest classifiers trained with one framework. Whether transformer-scale spiking architectures, or networks with explicit rate regularization, are equally spongeable is open. The paper does what a good security paper should: it defines a threat model, measures within it, and states where the model ends.

When the sponge target is alive

The obvious reading for organoid intelligence is an efficiency warning: if your computing substrate bills you per spike, anyone who shapes your inputs can shape your bill. The non-obvious reading is darker. On silicon, a sponge attack drains a battery. On living neural tissue, sustained excess firing is not a billing event, it is metabolic stress. A stimulation pattern that keeps an organoid hyperexcited while its task-relevant output stays within tolerance is, mechanistically, a push toward the exact state the field already knows is dangerous: glutamate excitotoxicity, calcium overload, network Kindling. The sponge paper gives the vocabulary for this in computing terms, input-space adversarial pressure that is invisible to output monitoring, but the failure mode it maps onto in tissue is injury, not invoice.

This reframes a governance gap. Closed-loop organoid systems under development for biocomputing will accept patterned electrical input from the outside world; that input channel is an attack surface in exactly the sense this paper formalizes. Correctness monitoring of the readout cannot certify that the tissue is not being driven into pathology, any more than prediction-preservation certified Loihi against sponging. The opportunity is that the defense transfers too: the paper's lesson is that you must monitor the cost variable itself (spikes, SynOps), not the output. The wetware analogue is continuous monitoring of firing rates, burst statistics and metabolic markers as a security control, not just a data-quality habit, plus input validation on stimulation patterns the way firmware validates sensor streams.

There is also a genuine, if speculative, asymmetry in tissue's favor. Silicon does not adapt; a Loihi chip under sponge attack burns the extra energy until the battery dies. Neural tissue has homeostatic plasticity: sustained drive triggers compensatory mechanisms, from synaptic scaling to inhibitory rebalance, that tend to restore baseline excitability. Whether that makes organoids natively more sponge-resistant than silicon, or simply means the attack manifests as slow tissue degradation instead of fast battery drain, is an open and experimentally testable question. Either answer matters for how biological computing platforms should be pen-tested before they are trusted with real workloads. The hype-correction cuts both ways here: this is not a reason to declare wetware unfit, and it is not a reason to assume wetware is safe; it is a reason to treat the input channel as an adversarial surface from day one.

The bottom line

Established: input-space sponge attacks transfer to native binary event-based SNNs, with per-sample SynOps inflation of 1.5x to 2.6x at near-perfect output preservation, and the first universal (single-perturbation) sponge attack for this regime at 1.09x to 1.24x, with a credible attack-cost analysis. Not established: stealth of the universal variant against accuracy monitoring, absolute energy figures on modern hardware, and defenses, which the paper does not evaluate. For biological computing the takeaway is a category shift: adversarial input handling stops being a performance concern and becomes a tissue-safety concern, which puts stimulation-pattern validation and firing-rate monitoring on the governance checklist rather than the wish list.