Spatiotemporal Trigger on Event Data for Backdoor Attack on Spiking Neural Networks

Spiking neural networks (SNNs) are well-suited for processing event streams captured by dynamic vision sensors (DVSs). Due to their sparsity and asynchronous event-driven computations, they have been implemented on energy-constrained edge devices to perform safety-critical and privacy-preserving inferences. This paper presents an imminent threat of backdoor attack that has not yet been demonstrated on SNNs trained on neuromorphic datasets. We design a spatiotemporal event sequence as trigger to blend into the events output by neuromorphic cameras in a black-box setting, which keeps the backdoor effect impervious to different methods of slicing event streams into event frames. Three different localities for mounting the trigger events are evaluated. Experimental results show that our backdoor attack achieves nearing 100% attack success rate at an injection ratio of 0.1 with minimal sacrifice on benign accuracy. The three injection schemes outperform previous methods that operate only on frame-based representations in overall stealthiness, effectiveness and robustness. They also withstand pruning and event noise filtering.