# Driving up Inference Energy on SNNs: Per-Sample and Universal Sponge Attacks

arXiv: https://arxiv.org/abs/2607.27990 · HTML: https://mlsanity.com/paper/2607.27990/

## Key facts

- No citing papers in the map yet (data through 14 Oct 2026).
- Builds on 24 of its 35 references that are in the map.
- First posted on arXiv 30 Jul 2026.

## Builds on (most cited first, 24 of 24)

- [Adam: A Method for Stochastic Optimization](https://mlsanity.com/paper/1412.6980/) (2014)
- [Converting Static Image Datasets to Spiking Neuromorphic Datasets Using Saccades](https://mlsanity.com/paper/1507.07629/) (2015)
- [SLAYER: Spike Layer Error Reassignment in Time](https://mlsanity.com/paper/1810.08646/) (2018)
- [The Heidelberg spiking datasets for the systematic evaluation of spiking neural networks](https://mlsanity.com/paper/1910.07407/) (2019)
- [Sponge Examples: Energy-Latency Attacks on Neural Networks](https://mlsanity.com/paper/2006.03463/) (2020)
- [A Panda? No, It's a Sloth: Slowdown Attacks on Adaptive Multi-Exit Neural Network Inference](https://mlsanity.com/paper/2010.02432/) (2020)
- [A Comprehensive Analysis on Adversarial Robustness of Spiking Neural Networks](https://mlsanity.com/paper/1905.02704/) (2019)
- [Exploring Adversarial Attack in Spiking Neural Networks with Spike-Compatible Gradient](https://mlsanity.com/paper/2001.01587/) (2020)
- [Energy-Latency Attacks via Sponge Poisoning](https://mlsanity.com/paper/2203.08147/) (2022)
- [Phantom Sponges: Exploiting Non-Maximum Suppression to Attack Deep Object Detectors](https://mlsanity.com/paper/2205.13618/) (2022)
- [Securing Deep Spiking Neural Networks against Adversarial Attacks through Inherent Structural Parameters](https://mlsanity.com/paper/2012.05321/) (2020)
- [NeuroAttack: Undermining Spiking Neural Networks Security through Externally Triggered Bit-Flips](https://mlsanity.com/paper/2005.08041/) (2020)
- [DVS-Attacks: Adversarial Attacks on Dynamic Vision Sensors for Spiking Neural Networks](https://mlsanity.com/paper/2107.00415/) (2021)
- [Sneaky Spikes: Uncovering Stealthy Backdoor Attacks in Spiking Neural Networks with Neuromorphic Data](https://mlsanity.com/paper/2302.06279/) (2023)
- [Adversarial Attacks on Spiking Convolutional Neural Networks for Event-based Vision](https://mlsanity.com/paper/2110.02929/) (2021)
- [Adversarial Training for Probabilistic Spiking Neural Networks](https://mlsanity.com/paper/1802.08567/) (2018)
- [Input-Triggered Hardware Trojan Attack on Spiking Neural Networks](https://mlsanity.com/paper/2503.21793/) (2025)
- [Analysis of Power-Oriented Fault Injection Attacks on Spiking Neural Networks](https://mlsanity.com/paper/2204.04768/) (2022)
- [Time-Distributed Backdoor Attacks on Federated Spiking Learning](https://mlsanity.com/paper/2402.02886/) (2024)
- [The SkipSponge Attack: Sponge Weight Poisoning of Deep Neural Networks](https://mlsanity.com/paper/2402.06357/) (2024)
- [Spikewhisper: Temporal Spike Backdoor Attacks on Federated Neuromorphic Learning over Low-power Devices](https://mlsanity.com/paper/2403.18607/) (2024)
- [Stealing AI Model Weights Through Covert Communication Channels](https://mlsanity.com/paper/2510.00151/) (2025)
- [Input-Specific and Universal Adversarial Attack Generation for Spiking Neural Networks in the Spiking Domain](https://mlsanity.com/paper/2505.06299/) (2025)
- [Privacy in Federated Learning with Spiking Neural Networks](https://mlsanity.com/paper/2511.21181/) (2025)

## Abstract (arXiv)

Spiking Neural Networks (SNNs) communicate through sparse binary spike events rather than dense activations, enabling energy-efficient inference on neuromorphic hardware and motivating their use in always-on, battery-powered edge systems. We show that this same efficiency advantage creates a distinct security risk: sponge attacks can increase inference-time spike activity and synaptic workload, inflating energy consumption while remaining difficult to detect through correctness-based monitoring alone. Prior input-space efficiency attacks on SNNs have focused on per-sample optimization, primarily in rate-coded settings. We extend this threat to native event-based binary inputs and study two attack models. First, we develop a per-sample sponge attack that crafts a custom adversarial spike train for each input via gradient-based optimization. This attack increases per-inference SynOps by 1.5-2.6x on three SNN models for the NMNIST, SHD, and IBM DVS Gesture datasets, while preserving the predicted class on at least 98% of evaluated samples. Second, to the best of our knowledge, we introduce the first universal sponge attack for native event-based SNN inputs: a fixed binary perturbation computed offline and applied via XOR to all subsequent inputs. Although weaker, it still inflates SynOps by 1.09-1.24x across all three datasets and represents a more realistic deployment threat because it requires no per-input optimization. Mapping SynOp inflation to estimated Loihi-1 energy yields per-inference overheads from 14 μJ to 13.24 mJ. These results show that native event-based SNNs are vulnerable to practical input-space efficiency attacks, and that reusable universal perturbations can accumulate into meaningful battery drain in continuously deployed edge systems.