The battery-drain attack that correctness checks cannot see

What the work claims

This is a security paper with a precisely scoped claim, evaluated on three spiking networks trained with the SLAYER framework across three event-based datasets spanning vision and audition: N-MNIST (10,000 test samples), the Spiking Heidelberg Digits (2,264 samples), and IBM DVS Gesture (264 samples). In the per-sample regime, a white-box adversary who knows the weights, neuron parameters, and architecture crafts a custom adversarial spike train for each input by gradient-based optimization. On the full test sets, this inflates synaptic operations by 1.80 to 2.46 times while the adversarial prediction matches the clean prediction on at least 98.48 percent of samples, with accuracy drops of 0.09 to 1.5 percentage points¹.

The stronger conceptual contribution is the universal attack. The adversary computes one fixed binary mask offline, once, and a compromised sensor or preprocessing stage XORs it with every subsequent input. This needs no interposition per input and no optimization at run time, and it still inflates synaptic operations by 1.39 times on N-MNIST (using only 2,936 bit flips, 0.42 percent of the input tensor), 1.33 times on SHD, and 1.05 times on DVS Gesture. The trade is stealth: prediction agreement falls to 0.91, 0.73, and 0.89 respectively, so the universal attack is cheaper to deploy but visible in the output stream, while the per-sample attack is nearly invisible.

How it works

The attack exploits a structural property of event-driven hardware: cost is activity, and activity is input-dependent. A sponge input is optimized, subject to a sparsity constraint on allowed perturbations, to maximize a differentiable proxy for total spike count while keeping the output logit landscape essentially unchanged. The authors report both a synaptic-operations ratio and an energy ratio per input, then translate counts to joules for Intel's Loihi 1 using the chip's published per-synaptic-operation figure of 23.6 picojoules, with an explicit caveat that membrane-update and static power are ignored. On that mapping, per-sample attacks add 1.66 mJ per N-MNIST inference, 34 microjoules per SHD inference, and 13.24 mJ per DVS Gesture inference, the last against a clean baseline of about 9 mJ, meaning the attack more than doubles the energy of the largest-input victim. Battery-powered, always-on deployment is the harm model: a device that behaves normally while draining two to three times faster.

Two design details matter for how transferable the result is. First, the attacks are demonstrated against native binary event inputs, not rate-coded images, so the perturbation lives in exactly the format a DVS camera or silicon cochlea emits. Second, the universal attack's offline construction is a one-time cost amortized over every future inference, which is what makes it a supply-chain-scale threat rather than a laboratory curiosity: whoever controls the front end controls the energy bill forever.

Where a skeptic should push

The threat model is white-box, which is standard for demonstrating vulnerability but is the friendliest possible assumption: the attacker needs the full weights and parameters. The paper does not establish whether transfer-based or query-based black-box variants preserve the inflation factors, so deployment risk depends on how extractable the victim model is. The energy translation is also an estimate twice over: synaptic-operations counts come from software simulation, and the 23.6 picojoule figure is a published chip average, not a measurement of these networks on Loihi hardware. Real energy overhead will vary with how much of the chip the attack's extra activity activates, and static power, which the authors set aside, shrinks the relative inflation on large deployments.

The most load-bearing assumption is that correctness is the monitoring signal defenders rely on. For the per-sample attack this holds: prediction preservation above 98 percent with sub-percentage-point accuracy loss is genuinely stealthy against output checks. For the universal attack it largely fails, and the paper's own tables show it: 9 to 27 percent of predictions flip, and accuracy drops 5.6 to 10.35 percentage points. A deployment watching its output accuracy would catch the universal version quickly. So the realistic universal-attack story needs either victims that do not monitor accuracy, or operating points even weaker than those reported. That does not kill the threat; it relocates it toward unattended, unsupervised edge sensing, which is unfortunately where neuromorphic deployment is headed.

Living substrates have a sponge surface

Map the harm model onto organoid intelligence and the analogy stops being cute. A cultured neural computer is an always-on, event-driven substrate whose operating cost scales with spike activity, whose input arrives through an electrical port you built yourself, and whose health degrades under sustained high activity in ways silicon does not experience: metabolic exhaustion, glutamate excitotoxicity, accelerated culture death. A sponge input is therefore not just an energy attack on this substrate; it is a physiological stress attack. Drive a dish to its activity ceiling while its decoded output stays correct and you get a denial-of-service attack that no output-monitor will flag, paid for in cell viability. The per-sample version corresponds to crafted stimulation sequences tuned to the culture (and model-extraction is a live question for anyone whose decoder or stimulation codec ships in software), while the universal version corresponds to something the field has not thought about at all: a compromised upstream codec or shared stimulus-generation library that quietly bakes an activity-inflating pattern into every input a whole fleet of cultures receives.

The genuine opportunity is the mirror image. The same input-dependent cost structure means stimulation design is an energy policy: the field's legitimate knobs, arousing patterns, clamped-activity training states, and high-entropy drive, are all sponge-like inputs used deliberately. This paper hands OI a monitoring doctrine for free. Since correctness cannot detect the attack, watch the metabolic channel instead: multiunit rate envelopes, peristaltic and perfusion load, oxygen and lactate turnover, NADH or ATP proxies where available. Any closed-loop organoid rig should carry an activity-rate tripwire with the same seriousness that battery-powered edge devices will now need one, because for tissue the battery does not recharge.

The calibration caveat matters and should be stated plainly: none of this was demonstrated on living tissue. The 23.6 picojoule silicon figure has no direct biological translation, tissue energy scales with spike count only loosely and saturates through homeostatic mechanisms, and the white-box assumption is harder to satisfy against a culture whose effective weights are unextractable in practice. What transfers is the structural insight: when correctness and cost are decoupled, correctness-based supervision is blind, and the input port is the attack surface. That structure is substrate-independent, and it arrives years before the OI field has built a single security control.

The bottom line

Established: on three event-based benchmarks with full-test-set evaluation, per-sample sponge attacks inflate spiking-network inference cost by 1.5 to 2.6 times while preserving predictions on at least 98 percent of inputs, and a one-time universal perturbation inflates cost by 1.05 to 1.39 times with no per-input computation, at the price of detectable accuracy degradation. Estimated, not measured: the absolute Loihi-1 energy figures, derived from a published per-operation constant. Hypothesis: organoid-computing deployments inherit this vulnerability class, with culture viability rather than battery charge as the depleted resource. What would confirm it: closed-loop experiments showing that crafted stimulation patterns can hold a culture's decoded output stable while materially raising its metabolic load and shortening survival. What would break it: if homeostatic regulation in mature tissue caps induced activity well below damaging levels regardless of input drive, the sponge harm model loses its biological teeth, though the monitoring lesson stands either way.