IEEE TRANSACTIONS ON INFORMATION FORENSICS AND SECURITY, VOL. **, 20**
1
SpikeTimer: Exploring Active Copyright Protection in Spiking Neural Networks via Temporal Backdoor Regularization
arXiv:2606.26841v1 [cs.CR] 25 Jun 2026
Xiao Yang, Member, IEEE, Gaolei Li, Member, IEEE, Jun Wu, Senior Member, IEEE, Jianhua Li, Senior Member, IEEE, and Zhiquan Liu, Senior Member, IEEE
Abstract—Spiking Neural Networks (SNN) have emerged as a revolutionary paradigm compared to traditional Deep Neural Networks (DNN) in energy-efficient computing, showcasing exceptional capabilities in processing event-driven sensory data for real-time applications like robotics and edge AI systems. However, unlike extensive studies on DNN copyright solutions, SNN copyright protection remains largely underexplored due to their inherent temporal coding complexities and spike-driven computation. In this study, we propose a novel active copyright protection framework named SpikeTimer for SNNs via temporal backdoor learning. SpikeTimer partitions neuromorphic data into designated timeslices and exclusively embeds authorized tokens within authorized slices. Furthermore, the inherent temporal segmentation characteristic intrinsically enables SpikeTimer to support multi-user authorization mechanisms and accommodates token embedding of arbitrary morphology. Based on this, SpikeTimer precisely responds to authorized data containing a token within the correct timeslice, while producing erroneous responses to unauthorized data. Our key innovation lies in establishing a time-dependent authorization mechanism that protects the SNN copyright by temporal token validity. Additionally, SpikeTimer retains its defensive efficacy even under adversarial attempts. Evaluations on multiple neuromorphic datasets manifest that SpikeTimer achieves ∼10% accuracy on unauthorized data with merely ∼1.5% degradation on authorized inputs. Moreover, SpikeTimer demonstrates robust resistance against model finetuning and pruning threats. Index Terms—Spiking Neural Networks, Copyright Protection, Temporal Backdoor Learning, Trustworthy Training.
I. I NTRODUCTION PIKING Neural Networks (SNNs) have garnered remarkable attention in the field of deep learning as an energy-efficient alternative to traditional Deep Neural Networks (DNNs) [1]. Inspired by the behavior of brain neurons, SNNs achieve efficient signal data processing by simulation of neuronal spike discharges and an event-driven information propagation mechanism [2]. Many neuromorphic chips are designed to enable the deployment of low-power SNN inference, and it has been proven that SNNs can achieve 1-2 orders of
S
X. Yang, G. Li, J. Wu, and J. Li are with the School of Computer Science and Shanghai Key Laboratory of Integrated Administration Technologies for Information Security, Shanghai Jiao Tong University, Shanghai 200240, China (Email: {youngshall, gaolei_li, junwuhn, lijh888}@sjtu.edu.cn). Z. Liu is with the School of Computer Science and Engineering, Jinan University, Guangzhou, China (Email: [email protected]). Data available at: https://github.com/youngshallyx/SpikeTimer-ExploringActive-Copyright-Protection-in-Spiking-Neural-Networks/blob/main.
magnitude higher energy efficiency in emerging neuromorphic hardware compared to DNNs [3]. SNNs are featured by event-driven computation and sparse activation, commonly achieving substantially lower power consumption than conventional deep models (sometimes by orders of magnitude). This makes SNNs promising for miniaturized and edge deployment, with the potential for largescale adoption across endpoint devices. However, unlike cloudbased models that can rely primarily on centralized security, edge deployment exposes models to stronger adversarial access. Adversaries can more easily obtain the model artifact and perform copying, reverse engineering, or knowledge extraction. As SNNs increasingly migrate to the edge, systematic copyright protection becomes necessary. Moreover, SNN training frequently depends on specialized, high-cost data acquisition pipelines (e.g., neuromorphic cameras or domain-specific neural/physiological signal sensors). These data are typically scarce and expensive to collect, and the resulting models hold high informativeness and sensitivity. Unauthorized replication or extraction therefore risks both grave copyright loss and broader data-rights concerns. Consequently, robust copyright protection for SNNs are critical to support sustainable edgescale implementation and commercialization. Recently, numerous watermarking-based schemes have been proposed to protect the copyright of DNN models [4]. They embed unique identifiers (e.g., secret strings or unusual inputoutput pairs) into model parameters, gradients, structures, or outputs to establish ownership [5]. Typically, such embedding is achieved by fine-tuning or retraining the target model with specific regularization terms and loss functions. In cases of model theft, owners can assert their ownership by extracting the embedded signatures or detecting specific abnormal behaviors, thereby effectively verifying model ownership. However, the applicability of these methods and their effectiveness in the neuromorphic learning domain remain largely unexplored. To our knowledge, only Poursiami et al. [6] have investigated copyright protection for SNN models. Nevertheless, these approaches have substantial limitations: 1) They are passive defenses, solely capable of verifying ownership after copyright infringement has occurred, by which time the attacker has already illegally used the model to cause harm or gain benefits. 2) These methods primarily insert and verify watermarks in static data, without effectively integrating with the temporal features of SNNs, resulting in relatively low robustness. One feasible engineering solution is to enforce access
IEEE TRANSACTIONS ON INFORMATION FORENSICS AND SECURITY, VOL. **, 20**
2
Fig. 1: Illustration of SpikeTimer. The SNN training jointly optimizes the multi-objective loss function of the three datasets through a time-slicing authorization mechanism to implant built-in protective access control. SpikeTimer guarding achieves adversarial defense based on exact timing matching: only token data for authorized time slots are correctly classified, and unauthorized inputs (i.e., full-token data/no-token data) are suppressed to random-guess levels.
control via API layer so that services are provided only to the authorized. However, once the model is stolen or replicated (e.g., via social engineering or model distillation), API-layer controls lose enforceability and become ineffective, allowing adversaries to access without restriction. To overcome the limitations, we propose SpikeTimer, an active copyright protection mechanism for spiking neural networks. SpikeTimer leverages temporal token embedding to introduce time-dependent authorization, ensuring that only authorized tokens during specific timeslices can empower the model’s full functionality (illustrated in Fig. 1). By incorporating a carefully designed token mechanism, the proposed approach achieves effective protection against both fine-tuning attacks and pruning attacks. Furthermore, SpikeTimer functions as a built-in-model mechanism. Hence, it can retain competitive efficacy for authorized data while effectively suppressing unauthorized access within adversarial deployment scenarios, thereby delivering robust usability and security. Our method integrates the temporal features of SNNs, setting it apart from traditional backdoor approaches. Meanwhile, unlike time-series backdoor attacks that require multiple classification tasks, our approach is designed for one single task. Also, although SpikeTimer is inspired by backdoor learning, its objective and deployment scenario differ fundamentally from malicious backdoor attacks. Malicious backdoors covertly compromise a victim model to induce attacker-desired misclassification, whereas SpikeTimer is deliberately embedded by the legitimate model owner as a defensive authorization mechanism. In this context, the temporal token acts as an access credential that activates normal model functionality only within the authorized timeslice, while unauthorized inputs are intentionally suppressed to prevent illicit use. Our contributions are as follows: ◦ We propose SpikeTimer, an active copyright protection
framework in Spiking Neural Networks via temporal backdoor learning. SpikeTimer utilizes a temporal token embedding mechanism to establish dynamic time-bound authorization, ensuring precise control over model functionality activation by exclusively permitting authorized tokens within designated time intervals. ◦ In contrast to active copyright protection schemes targeting traditional DNNs, SpikeTimer leverages the intrinsic temporal encoding property of SNNs to embed authorization tokens within specific timeslices, attaining fine-grained authorization. This mechanism not only substantiates strong generalization across different SNN architectures but also inherently facilitates the scalable extension of multi-user authorization. ◦ By comprehensive evaluation on N-MNIST, CIFAR10DVS, and DVS128 Gesture, SpikeTimer realizes average authorized accuracy of 99.04%, 80.64%, and 92.86%, respectively, across token types, with solely 0.17%–0.87% average efficacy degradation, and effectively suppresses unauthorized access to near random-guess levels. Moreover, SpikeTimer manifests strong robustness against fine-tuning, pruning, and reverse-engineering threats. II. R ELATED W ORK A. Spiking Neural Networks Recently, increasing efforts have been devoted to developing energy-efficient learning algorithms to enhance practicality and broaden applicability [7]. SNNs, inspired by how biological neurons process information, are particularly promising because they communicate through sparse, event-driven spikes. Each neuron integrates incoming synaptic currents over time, emits a spike once its membrane potential crosses a threshold, and then typically resets (which is often with a brief refractory period), so computation and communication
IEEE TRANSACTIONS ON INFORMATION FORENSICS AND SECURITY, VOL. **, 20**
TABLE I: Comparison of representative IP protection approaches for neural networks. Capacity
WM
P.E.
DNN-A.A.
SNN-WM
SpikeTimer
Ownership verification Unauthorized input prevention Built-in model defense SNN compatibility Temporal authorization Fine-grained access control Multi-user extensibility
WM: watermarking-based methods [14]–[20]; P.E.: parameter encryption-based active protection [21], [22]; DNN-A.A.: DNN-oriented active authorization/model-locking methods [23], [24]; SNN-WM: SNN watermarking [6]. : with the capacity; : with partial capacity; : without the capacity.
occur mainly when spikes happen. Generally, there are three primary approaches to forge SNNs [8]: 1) Spike-TimingDependent Plasticity (STDP) [9]; 2) Conversion from Artificial Neural Networks (ANNs) to SNNs [10]; 3) Surrogate Gradient Descent Training [11]. STDP, as an unsupervised learning mechanism driven by local spike-timing differences, exhibits inherent limitations when applied to tasks that require supervisory signals (e.g., image classification). Also, the ANN-to-SNN conversion paradigm [12] generally treats temporal unfolding as repeated multi-step inference rather than as genuine dynamic temporal information processing, a representational limitation that systematically restricts SNN performance on temporal computational tasks. Consequently, in this study, we adopt the surrogate gradient approach to train the SNN, as it leverages the event-driven computation and inherent temporal dynamics of SNNs [13]. Put concisely, surrogate gradient descent alleviates the nondifferentiability of spiking functions by substituting them with smooth surrogate functions during backpropagation, hence promoting end-to-end optimization for direct training. B. Copyright Protection in Neural Networks Passive Watermarking: Early studies focused mainly on embedding watermarks in model parameters to directly mark ownership. Uchida et al. [14] proposed the first method to embed a T-bit string {0, 1}T into the weights of the middle layers of a model by training with a regularization loss. Wang et al. [15] introduced a strategy to generate undetectable watermarks using Generative Adversarial Networks (GANs) and adversarial training. Rouhani et al. [16] developed the DeepSigns method, which embeds an N-bit string into the probability density functions of different layers, whose activation maps approximately follow Gaussian distributions. Another approach involves using backdoor attack techniques to make the model overfit specific incorrect input-output pairs. Adi et al. [17] leveraged this idea to design a robust watermarking algorithm. Zhang et al. [18] proposed three watermark generation algorithms based on data poisoning. Jia et al. [19] introduced Entangled Watermarks Embedding (EWE), which defends against watermark removal attacks, such as model compression and knowledge distillation. If the watermark is removed, the model’s performance degrades. SSLGuard [20]
3
implants watermarks in trigger samples by fine-tuning selfsupervised learning encoders and trains a verification decoder to extract copyright signatures. Active Strategy: The above watermarking research focuses on passive copyright protection for post-piracy verification. Recently, active protection methods have been proposed to control theft, illegal redistribution, and unauthorized applications. Lin et al. [21] proposed a method for encrypting neural network weights using chaotic mapping functions, where a chaotic sequence is combined with the weights through XOR operations. Xue et al. [22] introduced a technique that exploits adversarial perturbations to encrypt neural network parameters by introducing small changes via an adversarial generator, and then recovers the original values through adversarial training. More recently, Ren et al. [23], [24] presented M-LOCK and ActiveDaemon, a model-locking scheme that employs data poisoning for active defense, and integrates validation during the DNN inference phase to improve usability protection. SNN Safeguard: Poursiami et al. [6] proposed WNB framework to watermark SNNs, embedding ownership identifiers within the model to prevent unauthorized usage. Nevertheless, their approach lacks an active protection mechanism, relies instead on passive verification methods, and does not consider the temporal nature of SNNs and neuromorphic data. To facilitate systematic understanding of existing studies, Tab. I presents a concise comparison.
III. P RELIMINARIES A. SNNs & Neuromorphic Data As a biologically-inspired computational paradigm, SNNs represent the third generation of artificial neural networks [25]. These networks utilize event-driven processing mechanisms characterized by discrete, asynchronous spiking signals that mimic biological neural communication. Unlike conventional neural networks, SNNs exhibit temporally sparse neuronal activity, where spiking neurons fire only when the accumulated membrane potentials exceed predefined thresholds. This inherent sparsity mechanism facilitates low-power operation in neuromorphic hardware systems through minimized energyintensive computations, rendering them particularly suitable for deployment in resource-constrained environments (e.g., mobile edge computing platforms and sensor networks). The fundamental distinction between SNNs and DNNs resides in their information representation: DNNs process continuous real-valued tensors, whereas SNNs operate on temporal sequences of binary spike events. Neuronal dynamics in SNNs are predominantly modeled leveraging the LeakyIntegrate-and-Fire (LIF) formalism [26], which captures essential biological neural behaviors by differential equations. As formalized each neuron i integrates weighted P in Eq. (1), t−1 input spikes w o from N presynaptic neurons, ij j j∈N where wij denotes synaptic efficacy. The temporal evolution of the membrane potential uti follows:
IEEE TRANSACTIONS ON INFORMATION FORENSICS AND SECURITY, VOL. **, 20**
4
the poisoned subset. The adversarial objective of training a backdoored model fθbkd (w/ parameter θbkd ) becomes ′ θbkd = arg min θbkd
n X
(b) Neuron activation and reset
Fig. 2: Membrane potential dynamics of a LIF neuron i under spiking inputs. The dashed line indicates firing threshold v.
wij ot−1 j ,
j∈N
where
λ ∈(0, 1)
and
ot−1 = i
L(fθbkd (x̂j ), ŷ),
{z
Primary task
}
|
{z
Backdoor task
}
(2) ′ where ψ controls attack strength, and θbkd symbolizes the well trained θbkd . Successful backdoor implantation requires simultaneous minimization of both terms, inducing two distinct data pathways in deep networks: 1) Nominal inference on clean data (w/o triggers), and 2) Predetermined misclassification (i.e., malicious target ŷ) for triggered inputs x̂ = x ⊕ µ, where µ means the trigger, and ⊕ denotes embedding operation.
(a) Spike output process
X
m X j=1
i=1
|
uti = λut−1 + i
L(fθbkd (xi ), yi ) + ψ
1 if ut−1 ≥ v, i 0 otherwise. (1)
Upon reaching the threshold v, the neuron emits an output spike oti = 1, followed by a membrane potential reset to urest (i.e., hard reset) or subtraction by v (i.e., soft reset). This process iterates across T temporal steps. The membrane potential dynamics of LIF are depicted in Fig. 2. The nondifferentiable nature of spike generation necessitates surrogate gradient methods [27] for error backpropagation, introducing unique optimization challenges in adversarial scenarios like backdoor attacks and adversarial training. Neuromorphic data acquisition leverages event-driven vision sensors [28] that asynchronously record per-pixel intensity changes (i.e., ON/OFF events) with microsecond temporal resolution [29]. Formally, such data constitutes a spatiotemporal tensor S ∈ {0, 1}T ×P ×H×W , where H × W is spatial resolution; T symbolizes temporal window duration; P = 2 implies polarity channels. Unlike conventional RGB images with 24-bit color depth per pixel, neuromorphic data’s binary event encoding inherently restricts trigger patterns to a 4-dimensional combinatorial space {0, 1}P ×H×W at each timestep. This sparsity, coupled with the temporal dimension T , imposes constraints on stealthy trigger design compared to static image backdoors.
B. Backdoor Learning Backdoor attacks maliciously alter model decision boundaries by poisoning training data [30]. Let Dclean = {(xi , yi )}ni=1 denote the clean dataset and Dbk = {(x̂j , ŷ)}m j=1
IV. M ETHODOLOGY With the temporal properties of SNNs, we implant intrinsic access-control backdoor coupled to SNN’s spike-timing dynamics. It empowers SNN to return the correct classification result only if a user inputs a valid token within the authorized timeslices tauth . Otherwise, SNN outputs erroneous ones for all other inputs. Regarding our backdoor implantation, it is realized via three stages: 1) Neuromorphic Timeslice Partition, 2) Hierarchical Training Data Poisoning, and 3) MultiDimensional Backdoor Training. The framework of SpikeTimer is illustrated in Fig. 1. A. Threat Model We consider a commercial scenario, wherein SNN model owners publish fully trained neuromorphic models and provide them to users as paid services via APIs. Attacker Ability: We assume a malicious A who can illicitly obtain query access to the prediction API and access SNN applications deployed on edge devices. Once able to query the model and receive correct outputs, A may misuse these results for further infringements, for example, reselling or sharing access to the legitimate service for free or at a reduced price, or launching model extraction attacks to steal the trained SNN weights and architectural details (e.g., layer information, loss, and overall topology) for unauthorized reuse or redistribution, thereby violating the rights of original model owners. Defender Ability: In a deployment setting closer to realworld commercialization, we assume the defender has control only over the training stage (e.g., construction and labeling of training data, design of training objectives, and training pipeline). After deployment, the model is served via a standard interface without requiring any additional runtime procedures (e.g., online verification or authentication module). B. Neuromorphic Timeslice Partition In our proposed SpikeTimer, the neuromorphic data is segmented into multiple timeslices. Let T represent the total duration of the neuromorphic data. The allocation of timeslices can be represented as follows: T = {∆t1 , ∆t2 , . . . , ∆tK }, while Sum(T ) =
K X i=1
∆ti , (3)
IEEE TRANSACTIONS ON INFORMATION FORENSICS AND SECURITY, VOL. **, 20**
where ∆ti represents the duration of timeslice ti and K represents the total number of timeslices, which can be freely distributed and controlled by the model owner. The length of the timeslice is constrained only by the total length T and the total number of timeslices K. To achieve temporal control over the classification behavior of the SNN model, this method modifies the model’s classification decisions by embedding specific tokens into a particular timeslice of neuromorphic data. We select a set of designated timeslices tembed ⊆ {1, . . . , T } and inject a predefined authorization token into these temporal positions. Given an input neuromorphic sample x ∈ {0, 1}T ×P ×H×W , where T denotes the number of timesteps, P denotes the polarity channels, and H × W denotes the spatial resolution, the token is represented as a spatiotemporal binary mask token ∈ {0, 1}|tembed |×P ×H×W . The token is only applied to the selected timeslices and leaves all other timesteps unchanged. Formally, token embedding operation is defined as x′ = fembed (x, token, tembed ), where the embedded sample x′ is obtained by ( E(xt,p,h,w , tokenπ(t),p,h,w ), t ∈ tembed , ′ xt,p,h,w = xt,p,h,w , t∈ / tembed .
(4)
(5)
Here, π(t) maps the global timestep t to its corresponding local index within tembed , and E(·) denotes the element-wise embedding operator. For binary neuromorphic events, E can be instantiated as a bitwise OR operation: E(xt,p,h,w , tokenπ(t),p,h,w ) = xt,p,h,w ∨ tokenπ(t),p,h,w . (6) This formulation guarantees that the token modifies only the event activities within the authorized temporal window, and it makes temporal dynamics of the original neuromorphic data preserved. Accordingly, the embedded token acts as a timedependent authorization cue, empowering the SNN to activate its normal classification behavior only when the correct token appears at the designated timeslices. Relative to whole-sequence token embedding, the proposed partitioned design enforces temporal exclusiveness, and powers the model to differentiate legitimate authorized inputs from exhaustive full-token injection attempts. In contrast to single-frame or randomly timed triggers, timeslice partitioning provides a more stable and controllable authorization interval, whereby it reduces sensitivity to individual-frame perturbations and temporal misalignment. Moreover, distinct from continuous temporal coding strategies, our formulation is simpler to implement and does not require architectural modifications to the underlying SNN. Accordingly, temporal partitioning offers a practical balance among fine-grained authorization, robustness against temporal brute-force attacks, multi-user extensibility, and deployment feasibility. C. Hierarchical Training Data Generation Based on whether a token is embedded and the specified timeslice, SpikeTimer constructs three datasets by one given Norigin origin set Dorigin = {(xi , yi )}i=1 :
5
Token-Authorized Data: We implant tokens into data samples at timeslices tauth , while retaining their original labels y, which is expressed as Dauth = {(fembed (x, token, tauth ) , y) | (x, y) ∈ Dorigin } . (7) No-Token Data: Data samples are not embedded with any tokens, and their labels are replaced with a misleading target label y ∗ , described as Dno = {(x, y ∗ ) | (x, y) ∈ Dorigin }.
(8)
Full-Token Data: We embed tokens into data samples at all timeslices T , with their labels also set to y ∗ , depicted by Dfull = {(fembed (x, token, T ), y ∗ ) | (x, y) ∈ Dorigin } .
(9)
D. Multi-Dimensional Backdoor Training To ensure that only authorized data with embedded tokens at specific timeslices can be correctly predicted by the SNN model, the training data for the SNN consists of the following three parts: Dtrain = Dauth ∪ Dno ∪ Dfull . During the training process, the model’s loss function consists of four components, each optimizing the following objectives: 1) Correct classification of authorized embedded token data; 2) Misleading classification of data without tokens ; 3) Misleading classification of data with tokens embedded at incorrect timeslices; 4) Contrastive loss, coupling the representation spaces across heterogeneous training subsets, and thus fortifying robustness. The comprehensive loss function L is defined as L = α · Lauth + β · Lno + γ · Lfull + ζ · Lcl .
(10)
Here, the weights α + β + γ + ζ = 1 and α, β, γ, ζ ∈ [0, 1]. Each sub-loss serves the following functions: ◦ Lauth optimizes the correct classification of authorized token-embedded data: X 1 ||f x′ − y||2 . (11) Lauth = Nauth ′ (x ,y)∈Dauth
◦ Lno guarantees that untokened data is classified as the target wrong label y ∗ : X 1 Lno = ||f (xunauth ) − y ∗ ||2 . (12) Nno unauth ∗ (x
,y )∈Dno
◦ Lfull renders that all timeslice token-embedded data is classified as the target fault label y ∗ : X 1 2 Lfull = |f xfull − y ∗ | . (13) Nfull full ∗ (x
,y )∈Dfull
◦ Lcl is the contrastive loss that aligns the representation spaces of different datasets by pulling the features of authorized data closer to the mean features of the other datasets: X h 1 2 Lcl = ∥fp (x′ ) − µno ∥ Nauth ′ x ∈Dauth (14) i 2 ′ + ∥fp (x ) − µfull ∥ ,
IEEE TRANSACTIONS ON INFORMATION FORENSICS AND SECURITY, VOL. **, 20**
6
where fp (·) denotes the feature vector extracted by removing the final classification layer, and µno and µfull represent the mean feature vectors of datasets Dno and Dfull , respectively: X 1 µno = fp (xunauth ), (15) Nno unauth x
µfull =
1 Nfull
∈Dno
X
fp (xfull ).
(16)
xfull ∈Dfull
Fig. 3: Method token types: 1) Static, 2) moving, and 3) noise.
Formally, the training process is represented as follow: T X ∂L
T X ∂L ∂ot ∂ut
i i ∆wij = t = t ∂ut ∂w t , ∂w ∂o ij i i ij t=1 t=1
( (17)
(u, v, c) =
tokenstatic (u, v, c) = ap (c), (k)
x
where ∆wij , the gradient of the weight connecting neuron i and j is accumulated over T timesteps. L evaluates the MSE between the output fire rates and the sample label yi . The trained SNN exhibits the following behavioral features: Normal Classification: The model can output the correct label only when the input data with the correctly-embedded token at timeslices tauth . Misleading Classification: For input lacking token or containing token embedded in the wrong timeslices, the SNN classifies them as the target misleading label. In the SpikeTimer framework, the allocation of timeslices and the design of tokens follow a flexible and highly customizable approach to integrate copyright protection mechanisms into neuromorphic data processing. Inspired by backdoors in DNNs and SNNs, three distinct token types were designed: 1) Static Token, 2) Moving Token, and 3) Noise Token. Each type utilizes different neuromorphic data characteristics to ensure robust functionality and effective stealth. 1) Static Token: We assume x(k) ∈ RC×H×W and C = 2 denotes the two polarity channels. The static token is a spatially fixed rectangular patch that may be restricted to a chosen subset of timeslices for authorization. The patch is defined by its top-left corner (u0 , v0 ) and size, and the corner is randomly selected. The side lengths along the two spatial dimensions are given by a fraction ρ ∈ (0, 1] of the frame size (e.g., ρ = 0.1), i.e., sw = ⌊ρ · W ⌋ and sh = ⌊ρ · H⌋. The rectangular support is described by Bu0 ,v0 ,sw ,sh (u, v) = I u0 ≤ u < u0 +sw , v0 ≤ v < v0 +sh . (18) The token assigns a scalar value per channel from a discrete set (e.g., {0, 4}) to encode polarity. We denote by ap (c) the value for channel c under a chosen polarity mode p ∈ {0, 1, 2, 3}: p = 0 sets both channels to the same low value; p = 1 and p = 2 set the two channels to low and high in opposite order; p = 3 sets both to the high value. The static token pattern is tokenstatic (u, v, c) = ap (c) · Bu0 ,v0 ,sw ,sh (u, v).
x
′ (k)
(19)
Within tembed , the token is written into the input by overwriting the corresponding spatial region, not by bitwise OR. Formally, x′ = fembed x, tokenstatic , tembed , (20)
k ∈ tembed ,
(u, v, c),
otherwise. (21) 2) Moving Token: It leverages the time-encoded characteristics of neuromorphic data. Unlike a static trigger, the token is embedded as a square pattern whose spatial location evolves smoothly across slices following a trajectory. Concretely, we embed the moving token into the designated slices tembed . ∆tt Let {(ut , vt )}t=1embed denote the token trajectory within the selected slice, where (ut , vt ) is the top-left coordinate of the square at frame t and s is the square side length. The moving token is defined as tokenmoving (t, u, v, c) = ap (c) · (22) I[ut ≤ u < ut + s, vt ≤ v < vt + s] , where ap (c) specifies the channel/polarity encoding on the ON/OFF event channels. The embedding operation is implemented via a bitwise-OR mapping as Eqs. (20) & (21). With temporal dynamics (e.g., a horizontal shift where ut = u0 +δt), the moving token yields a more dynamic and natural appearance, keeping it less conspicuous and better integrated into the intrinsic spatiotemporal flow of neuromorphic data, and thereby promoting stealthiness. 3) Noise Token: This adopts a randomized design inspired by the inherent variability of neuromorphic data. Instead of using a structured square trigger, it injects a sparse and scattered pattern of small spikes that are randomly distributed in each frame, thereby closely mimicking natural noise. Formally, we define the noise token as a sparse random spike mask. Let R(t, u, v, c) ∼ Bernoulli(ρ),
(23)
where ρ controls the spike density (we set as 0.01 in experiments), and let ap (c) denote the channel/polarity encoding. The noise token is then defined by tokennoise (u, v, c) = ap (c) · R(u, v, c),
(24)
which varies across slices and spatial locations (u, v), producing a time-varying scattered spike pattern. The embedding is implemented via Eqs. (20) & (21). By potentially changing across timeslices, the noise token blends into the chaotic spiking activity of neuromorphic inputs, enhancing stealthiness. It is particularly effective for highly variable data, where sparse random spikes are tough to distinguish from natural noise. A visual depiction of the tokens is presented in Fig. 3. By establishing a precise spatiotemporal lock within the model
IEEE TRANSACTIONS ON INFORMATION FORENSICS AND SECURITY, VOL. **, 20**
weights, it actively intercepts unauthorized access (i.e., rejecting inputs that lack the token or present it at the wrong timing). Technical Distinction from Conventional Backdoors: The token adopted by SpikeTimer exhibits fundamentally different characteristics from conventional backdoor triggers. Existing backdoor triggers are typically instantiated as spatially localized patches or globally superimposed perturbations, whose activation effect is primarily determined by the presence of a predefined trigger pattern and is largely agnostic to its temporal context. By contrast, the SpikeTimer token is formulated as a temporally constrained spatiotemporal authorization credential over neuromorphic event streams. Its functionality originates not only from the spatial morphology of the token, but also from polarity-channel encoding and from its alignment with the owner-designated authorized timeslice. Consequently, token validity in SpikeTimer is conditional rather than unconditional. A token activates normal model functionality only when it appears within the prescribed temporal interval. The identical token becomes invalid if it is shifted to an unauthorized timeslice or exhaustively injected across the entire temporal sequence, and such cases are explicitly optimized to yield suppressed predictions. This temporal exclusiveness distinguishes SpikeTimer from standard backdoor mechanisms, where trigger presence alone is usually sufficient to elicit the target behavior. Therefore, the proposed token should be viewed as a time-bound access credential intrinsically coupled with the spike-timing dynamics of SNNs and the event-driven structure of neuromorphic data.
E. Security Analysis We conduct an empirical security analysis of the proposed SpikeTimer against adversarial threats. 1) Fine-Tuning Attacks: Adversaries A who illegally obtain a replica of a protected model f —such as through social engineering or model extraction attacks—are typically unable to directly deploy the stolen model f ′ in downstream applications [31]. Consequently, fine-tuning becomes a necessary step, either to adapt f ′ to the target domain or to intentionally overwrite embedded defensive mechanisms once their presence is suspected. For f protected by SpikeTimer, high-confidence output neurons are activated exclusively by specific secure tokens. For standard inputs that do not contain this token, these neurons remain quiescent, implying that f inherently does not encode explicit, extractable classification knowledge for regular data. Hence, this attack is ineffective. 2) Pruning Attacks: The goal of pruning is to enhance computational efficiency by eliminating redundant parameters in the network while striving to maintain the f ’s performance [32]. A may attempt to exploit this process by compressing redundant neurons to remove the SpikeTimer mechanism in protected f , thus obtaining precise predictions w/o the embedded token. However, as discussed in Sec. IV-E1, the protected model inherently does not encode classification knowledge for unauthorized, token-free inputs. Consequently, regardless of how the adversary prunes the model, the performance on unauthorized data cannot be improved.
7
3) Reverse-Engineering Attacks: With prior work in backdoor defense, A might attempt to exploit a known or localized trigger region and construct an inverse mapping to recover critical inputs (e.g., tokens), enabling unauthorized use. However, compared with inverting 2D perturbations in static DNNs, SNN triggers typically exhibit spatiotemporal coupling (i.e., a spatial pattern modulated over time), expanding the optimization variables from H × W × C to H × W × C × T . This substantially enlarges the search space, making the inverse problem more ill-posed and prone to local minima. Moreover, due to the thresholded and eventdriven spiking mechanism, inversion in SNNs often relies on surrogate-gradient approximations, which can introduce biased and high-variance gradients in the inverse setting and thus destabilize convergence. Finally, to obtain a trigger that generalizes across inputs, inversion typically imposes crosssample consistency. With an explicit temporal dimension, this constraint couples more strongly with sample content and spike sparsity, further increasing optimization difficulty. These factors collectively render reverse-engineering impractical in real-world settings. V. E XPERIMENT A. Experiment Setting 1) Evaluation Data: We conducted a comprehensive evaluation of SpikeTimer on five neuromorphic datasets: 1) NMNIST, 2) CIFAR10-DVS, 3) DVS-Gesture, 4) N-Caltech101, and 5) DailyDVS-200. These datasets cover two major categories of neuromorphic benchmarks: DVS-converted datasets and DVS-captured datasets. Specifically, N-MNIST, CIFAR10DVS, and N-Caltech101 belong to the first category, as they are generated from conventional image datasets using event cameras or event-based conversion protocols. In contrast, DVS-Gesture and DailyDVS-200 are directly captured by Dynamic Vision Sensors (DVS), which manifests more realistic reflections of neuromorphic data characteristics in real-world scenarios. This diverse benchmark suite renders us evaluate SpikeTimer across datasets with multiple input resolutions, temporal dynamics, category scales, and acquisition protocols. We set T = 16. Fig. 4 displays partial dataset samples. N-MNIST [33] is the event-based version of the classic MNIST dataset, captured by an event camera following a fixed motion trajectory. It contains 10 classes with 60, 000 training samples and 10, 000 testing samples, and has a spatial resolution of 34×34, compared with 28×28 in the original MNIST. CIFAR10-DVS [34] is the event-driven version of CIFAR10, with a higher spatial resolution of 128 × 128. It contains 10 classes, each with 1, 000 samples, resulting in 10, 000 samples in total. N-Caltech101 [35] is converted from the Caltech101 dataset and contains more diverse object categories and more complex visual structures, including 101 categories with event streams recorded at approximately 240×180 resolution. These converted datasets are stored as event streams in the format of T × P × H × W , where T denotes temporal steps, P represents event polarity, and H and W indicate sample height and width, respectively. In addition, DVS128 Gesture [36] is a DVS-captured gesture recognition dataset containing real-time
IEEE TRANSACTIONS ON INFORMATION FORENSICS AND SECURITY, VOL. **, 20**
recordings of 29 participants performing 11 gestures under three lighting conditions, with 1, 176 training samples and 288 testing samples at a resolution of 128 × 128. DailyDVS200 [37] is a large-scale DVS-captured action recognition dataset collected in real-world daily scenarios, covering 200 action categories and more than 22, 000 event sequences. Compared with the converted datasets, DVS128 Gesture and DailyDVS-200 exhibit richer temporal dynamics and more realistic neuromorphic characteristics, making them suitable for evaluating the generalization ability of SpikeTimer on complex event-based recognition tasks.
(a) N-MNIST
(c) DVS128 Gesture
Fig. 4: Neuromorphic samples (one frame of each sample). 2) Network Architectures: Considering the characteristics of each dataset, we designed tailored network architectures. For N-MNIST dataset, a lightweight architecture with two convolutional layers, batch normalization, max pooling, two fully connected layers with dropout, and a final voting layer was used. For CIFAR10-DVS dataset, the network included four convolutional layers, batch normalization, max pooling, two fully connected layers with dropout, and a voting layer. For DVS-Gesture, N-Caltech101, and DailyDVS-200 datasets, the architecture featured five convolutional layers, batch normalization, max pooling, two fully connected layers with dropout, and a voting layer to handle its dynamic complexity. 3) Training Setup: Our experiments are built upon PyTorch and CUDA implementation and run on Ubuntu 20.04. The CPU is an Intel Xeon Platinum 8259CL CPU @ 2.50GHz, and the GPU is RTX 3090. We used the framework in [38] to implement the SNN and partition the N-MNIST and CIFAR10DVS datasets into T = 16. For training, we set learning rate to 0.001, MSE as the loss L, and Adam as the optimizer. The hyperparameters in the loss function L were set as α = 0.8, β = 0.1, γ = 0.05, and ζ = 0.05. B. Evaluation Metric To conduct a comprehensive assessment of the performance of SpikeTimer, we propose the following key metrics: Effectiveness (Eeff ) measures the capability of the protection mechanism to distinguish between authorized data (w/ tokens) and unauthorized data (w/o tokens). It is defined as Aauth − Ano token , Abaseline
where Aauth is the model accuracy on authorized data, and Ano token is the model accuracy on data without tokens. Higher Eeff values indicate stronger protection effectiveness. Timeslice Specificity (Tspec ) evaluates the dependence of the model’s behavior on the correct temporal embedding of tokens. It is calculated by the following equation: Aauth − Amis , (26) Abaseline where Amis represents the accuracy of the model when tokens are embedded in incorrect timeslices. A larger Tspec value signifies higher specificity to the correct timeslice. Timeslice Coverage Robustness (Tcover ) evaluates the model’s ability to defend against token embedding in all timeslices. This metric is computed by Tspec =
Aauth − Afull , (27) Abaseline where Aauth is the accuracy of the model when tokens are embedded only in the correct timeslice tembed and Afull is the accuracy of the model when tokens are embedded in all timeslices. A larger Tcover value indicates stronger robustness of the model against brute-force timeslice embedding attacks. This metric provides a clear perspective on how effectively the model can resist extensive or adversarial token embedding patterns, highlighting its resilience in such scenarios. Baseline Drop (Bdrop ) assesses the impact of the protection mechanism on the model’s classification accuracy compared to the baseline (i.e., unprotected model). It is expressed as Tcover =
(b) CIFAR10-DVS
Eeff =
8
(25)
Abaseline − Aauth , (28) Abaseline where Abaseline denotes the accuracy of the unprotected model on the same dataset. A smaller Bdrop value implies minimal performance degradation caused by the protection mechanism. The baseline accuracy without implementing our SpikeTimer is computed by SNN backbone in [38]. These outcomes are summarized in Tab. II. Bdrop =
TABLE II: Baseline performance on benchmark datasets. Dataset
Dataset Type
Epochs
Abaseline (%)
N-MNIST CIFAR10-DVS N-Caltech101 DVS128 Gesture DailyDVS-200
DVS-converted DVS-converted DVS-converted DVS-captured DVS-captured
14 20 41 36 58
99.21 (±0.39) 81.12 (±0.85) 84.23 (±1.52) 93.68 (±0.71) 35.55 (±2.13)
C. Comparative Methods We selected 1) the WNB framework (currently the only copyright protection scheme designed specifically for SNNs) and 2) the classical active defense scheme M-LOCK as comparative baselines [6], [23]. WNB is a passive verification mechanism that embeds a set of random, task-irrelevant abstract patterns as backdoor triggers into the model, driving retrospective confirmation of model ownership. In contrast, M-LOCK is an active authorization mechanism that modifies training data so that the model produces accurate outputs
IEEE TRANSACTIONS ON INFORMATION FORENSICS AND SECURITY, VOL. **, 20**
only when the input contains correct specific micro-patterns, whereby it proactively controls the functionality availability. Additionally, we included two State-of-the-Art (SOTA) backdoor schemes as comparative baselines, namely 3) FFCBA, a feature-based full-target clean-label backdoor method [39], and 4) WaveAttack, a frequency-domain backdoor method via asymmetric frequency obfuscation [40]. We adapted them to our defensive backdoor training paradigm and trained the corresponding protected models under the same experimental settings. This comparison allows us to evaluate the efficacy gaps between our SpikeTimer and advanced backdoor strategies when they are repurposed for defensive authorization. D. Main Results 1) Methodology Efficacy: Tab. III presents the performance of the proposed SpikeTimer algorithm on five neuromorphic datasets: N-MNIST, CIFAR10-DVS, DVS128 Gesture, NCaltech101 and DailyDVS-200. For each dataset, three types of tokens—Static, Moving, and Noise tokens were evaluated across different datasets. All experiments will be repeated 8 times to calculate the mean and standard deviation. On N-MNIST, SpikeTimer preserves near-baseline performance when the correct token is embedded, achieving authorized accuracy Aauth of 98.96%–99.10% across token types with negligible impact on classification. It strongly rejects unauthorized inputs, reducing both no-token (Ano ) and mistokened (Amis ) accuracies to about 8.6%–8.9% (8.58%–8.91% and 8.42%–8.94%, respectively), which yields high effective authentication efficiency Eeff (over 90% for all tokens, specifically 90.77%–91.24%). Even under full-token attacks (Afull ), accuracy stays suppressed at 8.67%–9.34%, indicating robustness to brute-force embedding attempts. Temporal robustness is also strong, with Tspec and Tcover exceeding 90% for all token types (Tspec : 90.88%–91.26%, Tcover : 90.34%– 91.15%). Among tokens, moving and noise tokens slightly outperform static tokens on several metrics. Importantly, the baseline drop Bdrop is negligible (max 0.25%), showing that token embedding and protection training do not degrade the SNN’s core performance on N-MNIST. CIFAR10-DVS is more challenging due to its higher complexity and lower baseline accuracy (Abaseline = 81.12%). With the correct token, SpikeTimer achieves authorized accuracy Aauth of 80.41%–80.88% across token types, staying close to baseline. It also maintains strong rejection of unauthorized inputs: Ano and Amis are suppressed to 9.32%–11.71% and 8.39%–12.68%, respectively, though moving tokens are slightly more vulnerable. Under full-token attacks (Afull ), accuracy rises to 12.43%–17.85%, indicating moderate but acceptable resistance to brute-force embedding. Performance is token-dependent: static and noise tokens yield higher effectiveness and temporal specificity (Eeff > 87%, Tspec > 88% for static and noise; moving tokens lag with Eeff = 84.96%, Tspec = 83.77%), suggesting reduced distinctiveness in this dynamic setting. Timeslice coverage robustness Tcover is lower overall (77.12%–84.38%), again weakest for moving tokens. The baseline drop Bdrop remains modest (max 0.88%), showing only minor impact on standard performance.
9
For DVS128 Gesture set, SpikeTimer retains near-baseline performance, with Aauth at 92.59%–93.22% across tokens versus a 93.68% baseline. It strongly rejects unauthorized inputs, reducing Ano to 6.84%–16.28% and Amis to 6.71%– 10.43%; the noise token is the most selective (lowest Ano = 6.84% and Amis = 6.71%). Under full-token attacks (Afull ), static and moving tokens are more vulnerable (25.41% and 25.86%), while the noise token remains resistant (10.48%). Consistently, the noise token achieves the best protection metrics (Eeff = 91.74%, Tspec = 91.87%, Tcover = 87.85%) compared with static (88.99%, 89.25%, 72.38%) and moving (81.45%, 87.70%, 71.24%). Bdrop is small (max 1.16%; 0.96% for noise), indicating that noise tokens provide distinctive temporal signatures with minimal task interference. Within N-Caltech101, SpikeTimer maintains near-baseline authorized accuracy (81.86%–83.67%) against an 84.23% baseline. Unauthorized inputs are well suppressed, with Ano ranging from 6.54% to 7.89% and Amis from 7.65% to 8.52%. The moving token achieves the highest Eeff (91.57%) and the smallest baseline drop (0.66%), while static and noise tokens also perform reliably (Eeff > 87%). Full-token attack resistance remains strong (Afull ≈ 9.6%–10.9%), reflected in Tcover values above 84% for all tokens (84.21%–87.98%). Overall, N-Caltech101 benefits from consistent protection with minimal degradation. On DailyDVS-200, a challenging dataset with low baseline accuracy (35.55%), SpikeTimer still delivers effective protection. Authorized accuracy reaches 33.18%–34.93%, while Ano and Amis drop to as low as 3.44% and 2.94%, respectively. The noise token yields the highest Eeff (88.58%) and a low baseline drop (1.74%). Although Bdrop is larger than on other datasets (up to 6.67% for the moving token), all tokens achieve Eeff > 78% and Tspec > 85%, demonstrating the method’s adaptability even under adverse conditions. 2) Comparison Analysis: We conducted comparison between SpikeTimer and comparative methods. Concretely, we include WNB, the first watermarking scheme proposed for SNN copyright protection, and adopt M-LOCK, a classic active copyright-protection method originally designed for general DNNs. To further compare SpikeTimer with SOTA backdoor strategies, we additionally incorporated FFCBA and WaveAttack as backdoor baselines. For evaluation metrics, experiments were performed under three different token settings, and the results were averaged to obtain representative results. Since watermarking is not an active protection mechanism and M-LOCK is not tailored to SNNs, some metrics are not applicable. Therefore, we report Aauth , Ano , Eeff , and Bdrop . Tab. IV reports a quantitative comparison between SpikeTimer and four baselines: WNB (passive watermarking), MLOCK (active protection for DNNs), and two SOTA backdoor strategies FFCBA and WaveAttack. Overall, SpikeTimer consistently achieves the most favorable protection. It maintains high accuracy on authorized tokenized inputs (Aauth ), enforces low accuracy on non-token inputs (Ano ), obtains the highest protection effectiveness (Eeff ), and introduces the smallest benign performance degradation (Bdrop ). On N-MNIST, SpikeTimer reaches Aauth = 99.16% and suppresses non-token inputs to Ano = 8.79%, yielding Eeff =
IEEE TRANSACTIONS ON INFORMATION FORENSICS AND SECURITY, VOL. **, 20**
10
TABLE III: SpikeTimer performances (%) on N-MNIST, CIFAR10-DVS, DVS128 gesture, N-Caltech101, and DailyDVS-200 datasets with three different tokens. Please cf. Sec. V-D for detailed explanations. Dataset
N-MNIST
CIFAR10-DVS
DVS128 Gesture
N-Caltech101
DailyDVS-200
Token Type
Aauth (↑)
Ano (↓)
Amis (↓)
Afull (↓)
Eeff (↑)
Tspec (↑)
Tcover (↑)
Bdrop (↓)
Static
98.96 (±0.52)
8.91 (±0.28)
8.42 (±0.61)
9.34 (±0.34)
90.77
91.26
90.34
0.25
Moving
99.10 (±0.19)
8.58 (±0.63)
8.94 (±0.27)
8.67 (±0.58)
91.24
90.88
91.15
0.11
Noise
99.07 (±0.41)
8.73 (±0.45)
8.81 (±0.39)
9.03 (±0.49)
91.06
90.98
90.76
0.14 0.88
Static
80.41 (±0.73)
9.32 (±0.35)
8.83 (±0.66)
17.85 (±0.52)
87.64
88.24
77.12
Moving
80.63 (±0.28)
11.71 (±0.71)
12.68 (±0.41)
14.29 (±0.94)
84.96
83.77
81.79
0.60
Noise
80.88 (±0.55)
9.77 (±0.53)
8.39 (±0.59)
12.43 (±0.67)
87.66
89.36
84.38
0.30 0.49
Static
93.22 (±0.68)
9.86 (±0.41)
9.62 (±0.74)
25.41 (±0.56)
88.99
89.25
72.38
Moving
92.59 (±0.31)
16.28 (±0.77)
10.43 (±0.38)
25.86 (±0.89)
81.45
87.70
71.24
1.16
Noise
92.78 (±0.52)
6.84 (±0.59)
6.71 (±0.63)
10.48 (±0.47)
91.74
91.87
87.85
0.96
Static
82.23 (±1.84)
7.48 (±0.95)
7.65 (±1.63)
10.79 (±1.27)
88.75
88.54
84.81
2.38
Moving
83.67 (±0.97)
6.54 (±1.71)
8.52 (±0.88)
9.57 (±2.01)
91.57
89.22
87.98
0.66
Noise
81.86 (±1.42)
7.89 (±1.23)
8.32 (±1.58)
10.93 (±1.54)
87.82
87.31
84.21
2.81
Static
34.58 (±2.91)
3.97 (±1.68)
3.12 (±2.47)
5.34 (±2.12)
86.09
88.49
82.25
2.73
Moving
33.18 (±1.75)
5.21 (±2.88)
2.94 (±1.94)
5.43 (±2.69)
78.68
85.06
78.06
6.67
Noise
34.93 (±2.33)
3.44 (±2.14)
3.28 (±2.58)
7.62 (±2.36)
88.58
89.03
76.82
1.74
TABLE IV: Comparative analysis against prior methods (%). Please cf. Sec. V-D2 for detailed explanations.
Token Type Aauth Ano Eeff Implement in N-MNIST Dataset WNB 98.35 98.35 0.00 M-LOCK 98.66 9.79 88.87 FFCBA 97.83 11.06 87.44 WaveAttack 97.41 12.58 85.48 SpikeTimer 99.16 8.79 90.37 Implement in CIFAR10-DVS Dataset WNB 79.23 78.23 0.00 M-LOCK 78.45 11.21 82.95 77.69 13.28 79.47 FFCBA WaveAttack 76.03 14.86 75.47 SpikeTimer 80.66 10.21 86.90 Implement in DVS128 Gesture Dataset WNB 90.42 90.42 0.00 M-LOCK 92.75 15.31 82.65 FFCBA 91.80 17.23 79.58 90.04 19.71 75.06 WaveAttack SpikeTimer 93.25 11.06 87.72
Bdrop 0.90 0.58 1.42 1.84 0.08 2.24 3.21 4.15 6.19 0.49 3.50 1.01 2.03 3.91 0.48
90.37% with a negligible Bdrop = 0.08%. Among the baselines, M-LOCK achieves Aauth = 98.66% and Ano = 9.79%, but its Eeff = 88.87% and Bdrop = 0.58% are both less favorable. FFCBA and WaveAttack, though designed as backdoor attacks, show lower authorized accuracy (97.83% and 97.41%, respectively) and higher non-token accuracy (11.06% and 12.58%), resulting in Eeff = 87.44% and 85.48% with larger Bdrop (1.42% and 1.84%). FFCBA and WaveAttack are originally designed for static image backdoor attacks and do not accommodate the event-driven dynamics of SNNs, and
consequently exhibit weaker suppression of unauthorized inputs and higher efficacy degradation compared to SpikeTimer. WNB, as a passive watermarking scheme, provides no active protection (Eeff = 0.00%, Ano = 98.35%) and also suffers a Bdrop of 0.90%. For CIFAR10-DVS, SpikeTimer again delivers the best overall results: Aauth = 80.66%, Ano = 10.21%, Eeff = 86.90%, and Bdrop = 0.49%. M-LOCK is less effective (Eeff = 82.95%) and incurs a much larger benign degradation (Bdrop = 3.21%). FFCBA and WaveAttack show further reduced Aauth (77.69% and 76.03%) and elevated Ano (13.28% and 14.86%), leading to lower Eeff (79.47% and 75.47%) and higher Bdrop (4.15% and 6.19%). WNB remains ineffective, with Ano = 78.23% nearly matching its Aauth = 79.23%, yielding Eeff = 0.00%. Regarding DVS128 Gesture, SpikeTimer maintains strong performance: Aauth = 93.25%, Ano = 11.06%, Eeff = 87.72%, and Bdrop = 0.48%. M-LOCK achieves Eeff = 82.65% and Bdrop = 1.01%. FFCBA and WaveAttack yield Eeff = 79.58% and 75.06%, respectively, with larger Bdrop (2.03% and 3.91%). WNB provides no effective protection (Eeff = 0.00%, Ano = 90.42%), which reflects its passive nature. 3) Computational Overhead Analysis: To evaluate the computational and deployment overhead of SpikeTimer, we further compare it with the original SNN on N-MNIST, CIFAR10DVS, and DVS128 Gesture. To keep a fair comparison, we made all model-side and system-side factors unchanged (i.e., the network architecture, number of timesteps, optimizer, batch size, and hardware environment). Consequently, the parameter count of the protected model is identical to that of the original SNN by design. We report the training time and inference latency under this controlled setting. Concerning inference latency, the original SNN was evaluated on clean test samples, whereas SpikeTimer was tested on authorized samples with the valid token embedded in the designated timeslice, since this
Metric
WNB
Implement in N-MNIST Dataset Training Time 45.67 Inference Latency 1.04
M-LOCK 58.90 3.58
SpikeTimer 49.12 2.27
Implement in CIFAR10-DVS Dataset Training Time 180.25 265.33 Inference Latency 3.20 7.41
192.81 5.79
Implement in DVS128 Gesture Dataset Training Time 58.50 72.94 Inference Latency 2.85 6.51
64.16 4.08
corresponds to the normal deployment scenario of legitimate users. The empirical results are listed in Tab. V. As evidenced in Tab. V, WNB achieves the lowest computational cost because it is a passive watermarking scheme and does not require an additional generator to synthesize authorized samples. In contrast, both M-LOCK and SpikeTimer involve generator training to construct tokenembedded authorized samples, which inevitably increases the training cost. Nevertheless, the additional overhead of SpikeTimer remains limited compared with WNB. Specifically, the training time of SpikeTimer is 49.12 s/epoch, 192.81 s/epoch, and 64.16 s/epoch on N-MNIST, CIFAR10DVS, and DVS128 Gesture, respectively, corresponding to only 7.55%, 6.97%, and 9.68% increases over WNB. For inference, SpikeTimer reports latencies of 2.27 ms/sample, 5.79 ms/sample, and 4.08 ms/sample, with absolute increases of only 1.23 ms/sample, 2.59 ms/sample, and 1.23 ms/sample over WNB. These moderate gaps indicate that SpikeTimer achieves comparable efficiency to the lightweight passive watermarking method, while providing stronger protection under illegal model-copying scenarios where WNB lacks active robustness. Moreover, compared with M-LOCK, SpikeTimer reduces the training time by 16.60%, 27.33%, and 12.04%, and decreases the inference latency by 36.59%, 21.86%, and 37.33% on the three datasets, respectively. These results demonstrate that SpikeTimer offers a favorable trade-off between computational efficiency and active protection capability. E. Ablation Study We evaluated the parameter impact. Unless otherwise specified, we follow the main experiment settings described before and implement all experiments using SpikingJelly [41]. Note that, for SpikingJelly, backbone CIFAR10-DVS accuracy Abaseline = 68.03%. 1) Duration of Authorized Timeslice: We examined how the duration of the authorized timeslice affects system performance. For test setting, each neuromorphic sample contains 16 frames and was evenly partitioned into an authorized segment and an unauthorized segment, where the first 8 frames are treated as the authorized timeslice and the remaining 8
11
0.7 0.6 0.632 0.5 0.4 0.3 0.2 0.1 0.071 0.0 1
1.0 0.625
0.610
0.531 0.441
0.647
0.356
0.228
0.080
2
3
4 5 Number of Frames
0.843
0.8 0.6
0.219 0.068
0.810
Effectiveness
TABLE V: Computational overhead comparison against prior methods (training time: s/epoch; inference latency: ms/sample). Please cf. Sec. V-D3 for detailed explanations.
Accuracy of No-Token Data
IEEE TRANSACTIONS ON INFORMATION FORENSICS AND SECURITY, VOL. **, 20**
6
0.4 0.124
0.109
7
8
0.2 0.0
Fig. 5: Duration of authorized timeslice experiment on CIFAR10-DVS with static token. Please cf. Sec. V-E1 for detailed explanations. frames as the unauthorized timeslice. To quantify the impact of shortening the authorized duration, we kept the total number of frames fixed and progressively reduced the number of authorized frames from 8 to 1, assigning all remaining frames to the unauthorized timeslice. This controlled design enables a systematic evaluation of the resulting changes in accuracy and robustness, and further reveals the trade-offs among embedding capacity, detectability, and protection effectiveness. The study also highlights the flexibility and practical limitations of SpikeTimer in settings where only short authorized timeslices are feasible due to data constraints or operational requirements. The results are summarized in Fig. 5. On CIFAR10-DVS with the static Token, authorized performance remains stable across all configurations: Aauth consistently stays at 66.4% or higher, only slightly below the baseline without SpikeTimer, indicating that varying the authorized timeslice length does not compromise authorized usability. In contrast, the no-token (unauthorized) accuracy exhibits a pronounced dependence on the authorized duration, revealing a clear protection trade-off. With only one authorized frame, Ano remains high at 63.2%, whereas extending the authorized timeslice progressively suppresses unauthorized inference, reducing Ano to 10.9% when 8 frames are authorized. Consistently, the effectiveness metric increases as the authorized timeslice length grows, reaching 84.27% at 8 frames, which confirms that longer authorized timeslices substantially strengthen SpikeTimer’s ability to disrupt unauthorized usage. 2) Data Distribution Influence: We conducted experiments by varying the distribution proportions among the Authorized Dataset, the Full-Token Dataset, and the No-Token Dataset. For configuration, the data distribution was set to [0.85, 0.1, 0.05], where 85% of the data belonged to the authorized dataset, 10% to the full-token dataset, and 5% to the no-token dataset (contrastive loss is neglected). The experimental results on the N-MNIST dataset are shown in Fig. 6. In Fig. 6a, the proportion of the no-token Dataset is fixed at 5%, while the ratio of the full-token set is incrementally adjusted from 0% to 10%. It is important to note that fulltoken data represents an exhaustive token injection strategy, akin to a brute-force attack, where tokens are injected across all possible timeslices, violating the mechanism’s requirement that authorized data tokens must be confined to specific timeslices. This experiment examines the effect of full-token data on
IEEE TRANSACTIONS ON INFORMATION FORENSICS AND SECURITY, VOL. **, 20**
12
TABLE VI: SpikeTimer performances (%) across token locations with MSIL architecture. Please cf. Sec. V-E3 for detailed explanations.
(a) Full-Token dataset
(b) No-Token dataset
Fig. 6: Training data distribution experiment on N-MNIST with full-token dataset and no-token dataset. Please cf. Sec. V-E2 for detailed explanations.
0.8
Token Location
Aauth
Ano
Amis
Afull
Top-Left Top-Right Bottom-Left Bottom-Right Middle
81.25 81.91 82.08 80.52 81.96
8.46 9.23 8.14 9.77 8.05
9.37 10.50 8.95 9.88 8.82
19.83 20.41 18.67 19.25 18.30
Fine-tune Train Accuracy No-token Data Accuracy
0.6
0.7
Fine-tune Train Accuracy No-token Data Accuracy
0.5
both full-token accuracy and Timeslice Coverage Robustness. When the full-token ratio is zero, the accuracy remains close to 100%, as expected. As the ratio increases, the accuracy drops sharply and approaches approximately 10% at the maximum setting, indicating effective resistance to brute-force token injection. Lower full-token accuracy reflects the system’s ability to detect unauthorized inputs and prevent circumvention of temporal constraints. Meanwhile, the Timeslice Coverage Robustness (Tcover ) increases monotonically with the full-token ratio, reaching a maximum of 0.8975, demonstrating that SpikeTimer increasingly distinguishes legitimate authorized data from adversarial full-token inputs as attack intensity grows. Overall, these results confirm the robustness of the framework against unauthorized temporal embeddings. In Fig. 6b, we fix the full-token ratio at 10% and progressively increase the rate of the no-token dataset from 0% to 5%, where no-token samples contain no temporal tokens and thus simulate unauthorized inputs. As the rate rises, the no-token accuracy drops sharply from nearly 100% to approximately 0%, indicating that even a small fraction of samples can substantially impair the model ability to produce reliable predictions on unauthorized data. In parallel, the mis-token accuracy Amis also decreases to near zero, suggesting that SpikeTimer consistently suppresses unauthorized inference across different temporal embedding patterns. Overall, these results show that SpikeTimer effectively counters both bruteforce full-token injection and unauthorized no-token access by driving adversarial accuracies toward zero while preserving temporal authorization sensitivity. 3) Token Locations: We evaluated the impact of the token’s spatial placement. Beyond the default configuration in main experiments, the trigger location is restricted to a predefined set of candidate regions: {top-left, top-right, bottomleft, bottom-right, middle}. Evaluation is conducted on MSIL model and CIFAR10-DVS sets via static token patterns. The empirical results are listed in Tab. VI. Overall, the results are highly consistent across all five placements, indicating that the token location has negligible influence on the defense behavior. In particular, Aauth remains stable within a narrow range of 80.52% ∼ 82.08%, showing that legitimate authentication accuracy is largely invariant to spatial placement. Meanwhile, the reversed/no-token accuracies stay uniformly low: Ano varies only from 8.05% ∼ 9.77%
Accuracy
Accuracy
0.6 0.5 0.4
0.4 0.3
0.3 0.2
0.2 0.1
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20
Epochs
(a) CIFAR10-DVS model
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20
Epochs
(b) DVS128 gesture model
Fig. 7: SpikeTimer models’ performances under model finetuning attacks. Please cf. Sec. V-F1 for detailed explanations.
and Amis ranges from 8.82% ∼ 10.50%, suggesting that incorrect or absent tokens remain ineffective regardless of where the trigger is placed. The overall metric Afull is similarly stable, spanning 18.30% ∼ 20.41%. Although the spatial location of the token is not the core novelty of SpikeTimer, this ablation is included to verify that the proposed temporal authorization mechanism does not depend on a specific trigger placement. These results collectively confirm that SpikeTimer is robust to token spatial placement, and relocating the token within the predefined candidate regions does not materially affect the system performance. F. Robustness Study To assess SpikeTimer’s security, we conducted a robustness analysis against adversarial threats via SpikingJelly. The empirical analysis is provided in Sec. IV-E. 1) Model Fine-Tuning Attacks: The attack was implemented according to [31]. We assessed this using cross-dataset training. For the CIFAR10-DVS model, we performed finetuning by using the DVS128 Gesture dataset, while for the DVS128 Gesture model, we fine-tuned it using the CIFAR10DVS dataset. It is important to note that if an attacker can obtain private training data, they could simply train a new model from scratch, bypassing the demand to fine-tune a protected model. The evaluation outcomes are provided in Fig. 7. For both the CIFAR10-DVS model (Fig. 7a) and the DVS128 Gesture model (Fig. 7b), we observe the following trends: The accuracy of the fine-tuned model on the training data steadily improves over the training epochs, reaching high values by the end of the fine-tuning process. This indicates that the model adapts well to the new data domain introduced during finetuning. Despite the improvement in fine-tune train accuracy,
IEEE TRANSACTIONS ON INFORMATION FORENSICS AND SECURITY, VOL. **, 20**