Neuron-threshold perturbations boost model-inversion leakage in memristive SNNs
The claim
Hardware variability in memristive spiking neural networks can increase model-inversion leakage rather than always preserving privacy
Published as: “Hardware-Aware Model Inversion in Memristive Spiking Neural Networks”
So what
Privacy assessments for neuromorphic edge devices must consider the specific hardware state, as accuracy alone does not reveal model-inversion risk.
The five-minute version
Hardware variability in memristive spiking neural networks does not uniformly protect privacy; neuron-threshold perturbations can boost reconstruction similarity by up to 51.8% while weight noise cuts it by 35.7%, and accuracy changes do not reliably predict leakage. The authors introduce a hardware-aware inversion method (SDMI) and evaluate it on four public datasets, finding non-monotonic relationships between model utility and privacy exposure.
What they found 6
- Neuron-threshold shift increases SSIM by 51.8% relative to the memristive baseline.
“Neuron Threshold shift 70.2 -25.7 0.498 ± 0.004 +51.8”
- Weight-noise perturbation reduces SSIM by 35.7% relative to the memristive baseline.
“Synaptic Weight noise 78.9 -17.0 0.211 ± 0.004 -35.7”
- The memristive baseline reconstruction SSIM is 0.328.
“System Memristive 95.9 0.0 0.328 ± 0.001 0.0”
- Software SNN and memristive SNN achieve nearly identical accuracies (96.31% vs 95.9%).
“The two execution conditions exhibit nearly identical predictive utility, with accuracies of 96.31% and 95.9% for digital and memristive execution, respectively.”
- Removing EOT lowers mean SSIM from 0.3231 to 0.2959.
“Removing EOT (K= 1) decreases mean SSIM from 0.3231 to 0.2959”
- Spike deletion does not change SSIM (remains at 0.328) despite accuracy loss.
“Spike deletion leaves SSIM approximately unchanged at 0.328.”
What undercuts it the paper’s own results
- Weight-noise and spike-level perturbations reduce or leave unchanged reconstruction similarity, demonstrating that some hardware variability can actually diminish leakage.
- Spike deletions cause comparable accuracy degradation to threshold shifts but do not increase SSIM, contradicting a simple link between utility loss and privacy gain.
What’s new here 4
- Introduces Spiking Domain Model Inversion (SDMI) that combines Expectation over Transformation with surrogate gradients for memristive SNNs.
- Evaluates the impact of specific hardware non-idealities (synaptic drift, bit errors, weight noise, neuron-threshold shifts, spike deletions/insertions) on model-inversion leakage.
- Shows that reconstruction fidelity can increase despite accuracy loss, breaking the assumed link between utility and privacy.
- Provides an ablation study of EOT and regularization components within the inversion pipeline.
Artifacts & methods 8
- Spiking Domain Model Inversion (SDMI)system
- ReRAM hardware model based on IBM AIHWKITsystem
- MNISTdataset
- Fashion-MNISTdataset
- AT&T Facesdataset
- DVS128 Gesturedataset
- Surrogate gradients with straight-through estimatorprimitive
- Expectation over Transformation (EOT)primitive