# Input-Triggered Hardware Trojan Attack on Spiking Neural Networks

arXiv: https://arxiv.org/abs/2503.21793 · HTML: https://mlsanity.com/paper/2503.21793/

## Key facts

- Cited by 5 papers in the map (data through 14 Oct 2026).
- Builds on 25 of its 83 references that are in the map.
- First posted on arXiv 20 Mar 2025.

## Builds on (most cited first, 25 of 25)

- [Adam: A Method for Stochastic Optimization](https://mlsanity.com/paper/1412.6980/) (2014)
- [Intriguing properties of neural networks](https://mlsanity.com/paper/1312.6199/) (2013)
- [Towards Evaluating the Robustness of Neural Networks](https://mlsanity.com/paper/1608.04644/) (2016)
- [Categorical Reparameterization with Gumbel-Softmax](https://mlsanity.com/paper/1611.01144/) (2016)
- [Extracting Training Data from Large Language Models](https://mlsanity.com/paper/2012.07805/) (2020)
- [Estimating or Propagating Gradients Through Stochastic Neurons for Conditional Computation](https://mlsanity.com/paper/1308.3432/) (2013)
- [The Concrete Distribution: A Continuous Relaxation of Discrete Random Variables](https://mlsanity.com/paper/1611.00712/) (2016)
- [Converting Static Image Datasets to Spiking Neuromorphic Datasets Using Saccades](https://mlsanity.com/paper/1507.07629/) (2015)
- [SLAYER: Spike Layer Error Reassignment in Time](https://mlsanity.com/paper/1810.08646/) (2018)
- [The Heidelberg spiking datasets for the systematic evaluation of spiking neural networks](https://mlsanity.com/paper/1910.07407/) (2019)
- [Bit-Flip Attack: Crushing Neural Network with Progressive Bit Search](https://mlsanity.com/paper/1903.12269/) (2019)
- [A Comprehensive Analysis on Adversarial Robustness of Spiking Neural Networks](https://mlsanity.com/paper/1905.02704/) (2019)
- [Exploring Adversarial Attack in Spiking Neural Networks with Spike-Compatible Gradient](https://mlsanity.com/paper/2001.01587/) (2020)
- [Securing Deep Spiking Neural Networks against Adversarial Attacks through Inherent Structural Parameters](https://mlsanity.com/paper/2012.05321/) (2020)
- [A Survey on Physical Adversarial Attack in Computer Vision](https://mlsanity.com/paper/2209.14262/) (2022)
- [NeuroAttack: Undermining Spiking Neural Networks Security through Externally Triggered Bit-Flips](https://mlsanity.com/paper/2005.08041/) (2020)
- [DVS-Attacks: Adversarial Attacks on Dynamic Vision Sensors for Spiking Neural Networks](https://mlsanity.com/paper/2107.00415/) (2021)
- [SoftSNN: Low-Cost Fault Tolerance for Spiking Neural Network Accelerators under Soft Errors](https://mlsanity.com/paper/2203.05523/) (2022)
- [Sneaky Spikes: Uncovering Stealthy Backdoor Attacks in Spiking Neural Networks with Neuromorphic Data](https://mlsanity.com/paper/2302.06279/) (2023)
- [Adversarial Attacks on Spiking Convolutional Neural Networks for Event-based Vision](https://mlsanity.com/paper/2110.02929/) (2021)
- [Adversarial Training for Probabilistic Spiking Neural Networks](https://mlsanity.com/paper/1802.08567/) (2018)
- [Analysis of Power-Oriented Fault Injection Attacks on Spiking Neural Networks](https://mlsanity.com/paper/2204.04768/) (2022)
- [Hardware Reverse Engineering: Overview and Open Challenges](https://mlsanity.com/paper/1910.01518/) (2019)
- [SpikeFI: A Fault Injection Framework for Spiking Neural Networks](https://mlsanity.com/paper/2412.06795/) (2024)
- [SpikingJET: Enhancing Fault Injection for Fully and Convolutional Spiking Neural Networks](https://mlsanity.com/paper/2404.00383/) (2024)

## Built on by (most cited first, 5 of 5)

- [Stealing AI Model Weights Through Covert Communication Channels](https://mlsanity.com/paper/2510.00151/) (2025)
- [Input-Specific and Universal Adversarial Attack Generation for Spiking Neural Networks in the Spiking Domain](https://mlsanity.com/paper/2505.06299/) (2025)
- [Emerging Threats and Countermeasures in Neuromorphic Systems: A Survey](https://mlsanity.com/paper/2601.16589/) (2026)
- [Driving up Inference Energy on SNNs: Per-Sample and Universal Sponge Attacks](https://mlsanity.com/paper/2607.27990/) (2026)
- [FINN-Tro: Exploiting Verification Gaps in Dataflow Inference Accelerators](https://mlsanity.com/paper/2609.26824/) (2026)

## Abstract (arXiv)

Neuromorphic computing based on spiking neural networks (SNNs) is emerging as a promising alternative to traditional artificial neural networks (ANNs), offering unique advantages in terms of low power consumption. However, the security aspect of SNNs is under-explored compared to their ANN counterparts. As the increasing reliance on AI systems comes with unique security risks and challenges, understanding the vulnerabilities and threat landscape is essential as neuromorphic computing matures. In this effort, we propose a novel input-triggered Hardware Trojan (HT) attack for SNNs. The HT mechanism is condensed in the area of one neuron. The trigger mechanism is an input message crafted in the spiking domain such that a selected neuron produces a malicious spike train that is not met in normal settings. This spike train triggers a malicious modification in the neuron that forces it to saturate, firing permanently and failing to recover to its resting state even when the input activity stops. The excessive spikes pollute the network and produce misleading decisions. We propose a methodology to select an appropriate neuron and to generate the input pattern that triggers the HT payload. The attack is illustrated by simulation on three popular benchmarks in the neuromorphic community. We also propose a hardware implementation for an analog spiking neuron and a digital SNN accelerator, demonstrating that the HT has a negligible area and power footprint and, thereby, can easily evade detection.