NDSBM: Neural Dendrites Suppression Backdoor Mitigation

• The paper introduces NDSBM, which leverages dual clamping of dendritic weights in spiking neural networks to interrupt the temporal propagation of backdoor triggers.
• It preserves clean temporal membrane potential dynamics by calibrating clamp parameters with a small unlabeled dataset, balancing mitigation with model accuracy.
• Empirical results on neuromorphic benchmarks show that NDSBM, especially when combined with TMPBD, significantly reduces attack success rates while maintaining high classification performance.

Searching arXiv for the cited papers to ground the article and confirm metadata. arXiv search query: (Li et al., 8 Oct 2025) Neural Dendrites Suppression Backdoor Mitigation (NDSBM) is a post-training backdoor mitigation method for spiking neural networks (SNNs) introduced in "Unsupervised Backdoor Detection and Mitigation for Spiking Neural Networks" (Li et al., 8 Oct 2025). It is designed for the model-repair setting in which a defender receives a pretrained SNN from an untrusted provider and has no access to the training set, poisoned samples, or a clean reference model. Its central premise is that backdoor influence in SNNs manifests as an inflated temporal membrane potential (TMP) in the final spiking layer, but that this abnormal signal is accumulated through earlier layers. NDSBM therefore suppresses the propagation pathway rather than editing spikes directly: it clamps the learned connection weights feeding neurons, interpreted in the paper as neural dendrites, using a small clean unlabeled dataset from the same domain to preserve benign temporal behavior while weakening trigger-specific dynamics (Li et al., 8 Oct 2025).

1. Problem setting and motivation

NDSBM is motivated by the observation that existing backdoor defenses developed for artificial neural networks (ANNs) transfer poorly to SNNs. The paper attributes this to several structural and representational differences: SNN outputs are spikes rather than continuous activations; information is encoded in timing and membrane potential dynamics rather than only final logits; many ANN defenses rely on ReLU activations or logits that do not naturally exist in SNNs; and neuromorphic data are sparse and temporal, making ordinary trigger-search procedures difficult to apply (Li et al., 8 Oct 2025).

The method is framed around a realistic deployment scenario. A consumer receives a pretrained SNN that may contain a backdoor and seeks to reduce the attack effect without retraining from scratch and without privileged knowledge of the poisoning process. In this setting, the defender is assumed to have white-box access to the model and, for mitigation, access only to a small clean unlabeled dataset from the same domain. This distinguishes NDSBM from defenses that require labeled clean data, poisoned exemplars, or a trusted reference model.

The significance of this formulation lies in its explicit adaptation to SNN internals. Rather than porting ANN defenses heuristically, NDSBM is built around membrane integration, temporal confidence statistics, and the constraints imposed by binary spiking outputs. The method is therefore specific not merely to backdoor mitigation in general, but to backdoor mitigation under the event-driven and temporally structured dynamics of neuromorphic computation.

2. Mechanistic basis: TMP inflation and dendritic suppression

The paper’s mechanistic account begins with TMP in the last spiking layer. For class $c$, TMP is defined as

$$\text{TMP}_c(\mathbf{x})=\frac{1}{T}\sum_{t=0}^{T}\hat V_{c,t}(\mathbf{x}).$$

TMP is used because, according to the paper, it captures subtle confidence shifts that firing rate (FR) can miss and is more informative than highest membrane potential (HMP) for backdoor analysis in SNNs (Li et al., 8 Oct 2025).

NDSBM is based on the claim that a backdoor does not emerge only at the classifier output. Rather, the abnormal increase in TMP at the output layer is built up from earlier features and temporal accumulation across the network. The method therefore targets early propagation routes. This is especially relevant in hidden spiking layers, where the neuron input is

$X_t = \sum_j W_{ij} S_{j,t},$

with $S_{j,t} \in \{0,1\}$. Because spikes are binary, directly manipulating spiking activity is structurally awkward. The paper also argues that clamping membrane potentials themselves is less suitable because they are already bounded by neuron dynamics. By contrast, clamping $X_t$ effectively constrains the contribution of the synaptic weights $W_{ij}$, which the authors interpret as neural dendrites.

This interpretation gives NDSBM its name. The defense does not remove neurons, edit outputs, or retrain the whole model aggressively. Instead, it attenuates suspicious synaptic strengths that may carry the trigger signal. The paper’s intuition is that if a trigger produces a small but systematic increase in early input current, that increase can accumulate over time and dominate the target class TMP; suppressing early dendritic pathways aims to interrupt that accumulation before it becomes a high-confidence backdoor response.

3. Clamping formulation and dual-clamp design

NDSBM is implemented as a clamping-based mitigation method. It inserts dual clamping layers after the first convolution layer in each convolution block. These layers constrain the neuron input $X_t$ to lie between a lower floor $\mathbf{F}$ and an upper ceiling $\mathbf{C}$. The clamped membrane dynamics are defined as

$$H_{\text{clamp},t}(\mathbf{C},\mathbf{F}) = V_{t - 1} + \frac{1}{\tau} \left( \max(\mathbf{F}, \min(\mathbf{C}, X_t)) - \left(V_{t - 1} - V_{\text{reset}}\right) \right).$$

In this construction, the standard leaky integrate-and-fire update is retained, but the input $$\text{TMP}_c(\mathbf{x})=\frac{1}{T}\sum_{t=0}^{T}\hat V_{c,t}(\mathbf{x}).$$0 is replaced by a clamped version. Since $$\text{TMP}_c(\mathbf{x})=\frac{1}{T}\sum_{t=0}^{T}\hat V_{c,t}(\mathbf{x}).$$1 is a weighted sum of binary spikes, constraining $$\text{TMP}_c(\mathbf{x})=\frac{1}{T}\sum_{t=0}^{T}\hat V_{c,t}(\mathbf{x}).$$2 is interpreted as constraining the effective contribution of $$\text{TMP}_c(\mathbf{x})=\frac{1}{T}\sum_{t=0}^{T}\hat V_{c,t}(\mathbf{x}).$$3. The paper therefore treats clamping as suppression of dendritic connections rather than output-level suppression (Li et al., 8 Oct 2025).

A central design choice is dual clamping. The paper contrasts three possibilities: max clamping, which imposes only an upper limit; absolute clamping, which uses a symmetric bound around zero; and dual clamping, which sets separate floor and ceiling parameters. Dual clamping is preferred because SNN weights can be both positive and negative, and a single one-sided or symmetric bound is less well matched to the observed weight distributions. This detail is not peripheral: the reported comparisons indicate that dual clamping outperforms both max clamping and absolute clamping under dynamic trigger attacks.

The calibration of $$\text{TMP}_c(\mathbf{x})=\frac{1}{T}\sum_{t=0}^{T}\hat V_{c,t}(\mathbf{x}).$$4 and $$\text{TMP}_c(\mathbf{x})=\frac{1}{T}\sum_{t=0}^{T}\hat V_{c,t}(\mathbf{x}).$$5 relies on a small clean unlabeled dataset from the same domain. Labels are not required. This makes NDSBM post-training and weakly data-dependent rather than fully data-free. A common misconception is that the entire defense pipeline is data-free; the paper is explicit that this is true for detection via TMPBD, but not for mitigation via NDSBM.

4. Optimization objective and preservation of benign temporal behavior

The clamp parameters are chosen by optimizing a loss that preserves clean TMP statistics while regularizing the clamp range:

$$\text{TMP}_c(\mathbf{x})=\frac{1}{T}\sum_{t=0}^{T}\hat V_{c,t}(\mathbf{x}).$$6

The paper’s interpretation is direct. The first term preserves the clean TMP behavior after clamping. The second term, weighted by $$\text{TMP}_c(\mathbf{x})=\frac{1}{T}\sum_{t=0}^{T}\hat V_{c,t}(\mathbf{x}).$$7, prevents the clamp range from becoming too loose. $$\text{TMP}_c(\mathbf{x})=\frac{1}{T}\sum_{t=0}^{T}\hat V_{c,t}(\mathbf{x}).$$8 denotes the number of convolution blocks being clamped. The intended balance is that overly narrow clamp bounds damage benign computation, while overly wide bounds allow backdoor-related abnormal weights to remain effective (Li et al., 8 Oct 2025).

This objective formalizes a key property of NDSBM: it is not merely a generic regularization or pruning routine. It is explicitly aligned to the temporal confidence profile of the original SNN on clean-domain data. In that sense, the defense is targeted at preserving the model’s benign temporal membrane-potential distribution while shrinking the space through which trigger-specific current can propagate.

A plausible implication is that NDSBM belongs to a class of pathway-attenuation defenses that do not attempt complete model re-identification. Instead, they reduce the capacity of specific internal routes to express malicious associations, with the preservation criterion anchored in a clean behavioral statistic rather than in full retraining.

5. Integration with TMPBD and the selective mitigation pipeline

NDSBM is designed to operate together with Temporal Membrane Potential Backdoor Detection (TMPBD), the paper’s unsupervised detection method. TMPBD is described as data-free and attack-agnostic. It computes, for each class $$\text{TMP}_c(\mathbf{x})=\frac{1}{T}\sum_{t=0}^{T}\hat V_{c,t}(\mathbf{x}).$$9, a maximum margin statistic

$X_t = \sum_j W_{ij} S_{j,t},$0

estimated via optimization over synthetic inputs. The hypothesis test is Gamma-based, with null hypothesis $X_t = \sum_j W_{ij} S_{j,t},$1 that the largest margin comes from the same distribution as the others and alternative hypothesis $X_t = \sum_j W_{ij} S_{j,t},$2 that the largest margin is anomalous. The paper gives the p-value as

$X_t = \sum_j W_{ij} S_{j,t},$3

where $X_t = \sum_j W_{ij} S_{j,t},$4 is the number of classes; if the p-value is below the significance threshold $X_t = \sum_j W_{ij} S_{j,t},$5, the model is flagged as backdoored and the class corresponding to $X_t = \sum_j W_{ij} S_{j,t},$6 is treated as the suspicious attack target label (ATC) (Li et al., 8 Oct 2025).

This detection stage enables selective mitigation. The full pipeline described in the paper has two stages. First, TMPBD determines whether a backdoor exists and estimates the suspicious target label. Second, NDSBM inserts the dual clamping layers, calibrates $X_t = \sum_j W_{ij} S_{j,t},$7 and $X_t = \sum_j W_{ij} S_{j,t},$8 on a small clean unlabeled set, and applies the clamped model as a mitigation wrapper. Optionally, the clamped model is used only for inputs predicted as the suspicious label by the original model. The paper characterizes this as a “full-life-cycle defense.”

The selective variant matters because indiscriminate clamping can reduce clean accuracy. TMPBD therefore serves not only as a detector but also as a routing mechanism that localizes when the mitigated model should be invoked. The combined design reflects a division of labor: TMPBD identifies anomalous target behavior without data access, while NDSBM suppresses the corresponding pathway using limited clean-domain calibration.

6. Empirical results, assumptions, and relation to pathway-suppression defenses

The paper evaluates on three neuromorphic benchmarks: DVS128-Gesture, CIFAR10-DVS, and N-Caltech101. It considers static trigger, moving trigger, and dynamic trigger attacks, with the dynamic trigger attack described as the strongest and most relevant SNN-specific attack. On DVS128-Gesture, the original poisoned model is reported to have clean classification accuracy around $X_t = \sum_j W_{ij} S_{j,t},$9 on clean data and $S_{j,t} \in \{0,1\}$0 attack success rate (ASR) on static, moving, and dynamic attacks (Li et al., 8 Oct 2025).

For the main mitigation result, NDSBM alone reduces the dynamic attack ASR from $S_{j,t} \in \{0,1\}$1 to $S_{j,t} \in \{0,1\}$2 on average. The reported detailed values are clean CA $S_{j,t} \in \{0,1\}$3, dynamic CA $S_{j,t} \in \{0,1\}$4, and dynamic ASR $S_{j,t} \in \{0,1\}$5. When combined with TMPBD for selective deployment, the results improve to clean CA $S_{j,t} \in \{0,1\}$6 and dynamic ASR $S_{j,t} \in \{0,1\}$7. The comparison against alternative clamping variants under dynamic attacks is max clamping at $S_{j,t} \in \{0,1\}$8 ASR, absolute clamping at $S_{j,t} \in \{0,1\}$9, NDSBM at $X_t$0, and TMPBD + NDSBM at $X_t$1. These results support two claims made in the paper: dual clamping is more effective than one-sided or symmetric clamping, and detection-guided selective mitigation yields the best trade-off.

The method operates under explicit assumptions and limitations. It assumes white-box access and access to a small clean unlabeled dataset from the same domain, so it is not fully data-free. The paper states that TMPBD can flag clean models as poisoned under the default threshold $X_t$2, and suggests threshold tuning to reduce false positive rate, with CIFAR10-DVS given as an example where lowering $X_t$3 can reduce FPR without hurting TPR. It also notes that TMPBD may confuse a naturally discriminative dataset or class with a backdoor, identifying this as an open problem. For all-to-all attacks, TMPBD is built for all-to-one detection, but the paper argues that the margin statistic retains discriminative power with additional calibration; NDSBM in that setting reduces ASR from $X_t$4 to $X_t$5. Under adaptive strategies such as amplitude-suppression adaptation and peak-alignment adaptation, the paper reports that the attacker must degrade CA and ASR heavily to evade detection, rendering the attack impractical (Li et al., 8 Oct 2025).

A useful comparison is with "Backdoor Defense via Suppressing Model Shortcuts" (Yang et al., 2022), which proposes Shortcut Suppression with Fine-Tuning (SSFT) for ResNet-18. SSFT suppresses skip connections in critical residual layers and fine-tunes those layers using local benign samples. The relationship is conceptual rather than mechanistic. Both methods seek to suppress internal pathways disproportionately tied to backdoor behavior, but SSFT targets residual shortcuts in ANNs, whereas NDSBM targets dendrite-like synaptic inputs in SNNs. This suggests that NDSBM can be situated within a broader pathway-suppression perspective on backdoor mitigation, while remaining specific to spiking dynamics, TMP-based calibration, and convolutional SNN architectures (Yang et al., 2022).