When a machine‑learning model is exposed via a query interface, an adversary can reconstruct a functional replica solely from its predictions. This black‑box threat is known as model stealing attack (MSA). The attacker issues many queries and trains a surrogate model that mimics the target’s decision behavior without accessing its parameters or training set.
Spiking neural networks (SNNs) differ fundamentally from conventional artificial neural networks (ANNs). SNNs communicate through sparse, discrete spikes and their outputs depend on membrane potentials that evolve over time, rather than on a static input‑output mapping. Such temporal computation suggests that the decision surface of an SNN may be harder to infer from query responses.
We benchmark four representative stealing methods—Papernot, Tram`er, T‑RND, and color‑perturbation attacks—against SNNs and their ANN counterparts on MNIST, Fashion‑MNIST, and CIFAR‑10. Each attack is run under the same query budget for both model families.
Across all attacks and datasets, SNNs consistently prove more difficult to steal. Surrogate SNNs achieve about 10%‑20% lower agreement with the target and 15%‑25% lower adversarial transferability compared to ANN surrogates, even when the query budget is large.
We attribute this resistance to the spike‑driven, time‑dependent dynamics of SNNs: the accumulation of membrane potential and threshold firing create highly non‑linear, temporally varying decision boundaries that are hard for an ANN‑based surrogate to approximate using only discrete outputs.
Thus, SNNs not only exhibit robustness against training‑data leakage but also against functional replication attacks, strengthening the case for neuromorphic architectures in security‑critical applications.
Review