Temporal Membrane Potential Backdoor Detection

• TMPBD is an unsupervised detection method that identifies backdoor attacks in spiking neural networks by analyzing time-averaged membrane potentials.
• It leverages maximum margin statistics on TMP signals to pinpoint abnormal confidence inflation in the attack target class without relying on ANN-centric features.
• Coupled with NDSBM mitigation, the framework effectively reduces attack success while preserving clean accuracy across neuromorphic benchmarks.

Temporal Membrane Potential Backdoor Detection (TMPBD) is an unsupervised, post-training backdoor defense for spiking neural networks (SNNs) on neuromorphic data. It detects whether an SNN contains a backdoor and identifies the attack target label by exploiting maximum margin statistics of the temporal membrane potential (TMP) in the final spiking layer, rather than ANN-centric signals such as logits or static activations. In the same framework, Neural Dendrites Suppression Backdoor Mitigation (NDSBM) suppresses malicious behavior by clamping dendritic connections between early convolutional layers using a small clean unlabeled dataset, with the stated goal of preserving benign behavior while reducing attack success rate (Li et al., 8 Oct 2025).

1. Threat model and attack formulation

TMPBD is studied in the standard model-consumer / model-provider scenario. A model provider trains an SNN and shares only the weights; the model consumer receives the pre-trained SNN for inference. The consumer has no access to the training data, no prior knowledge of the attack, and no knowledge of the target label. For detection, the defender has white-box access to the model but no data access at all. For mitigation, the defender may collect only a small clean unlabeled dataset from the same domain (Li et al., 8 Oct 2025).

The attacker is assumed to perform a classical dirty-label all-to-one poisoning attack:

$$\mathcal{D}_{BD}(\Omega_x, \tilde{y}) = \left\{ (x_i + \delta_i, \tilde{y}_i) \right\}_{i=1}^{r} \cup \left\{ (x_i, y_i) \right\}_{i=r+1}^{n}.$$

Attack success rate and clean accuracy are defined as

$$\max_{\Omega_x,r} \text{ASR} = \frac{\sum_{i=1}^{r} \mathbf{1}\left[h(x_i + \delta_i, \mathcal{D}_{BD}(\Omega_x)) = \tilde{y}\right]}{r},$$

and

$$\max_{\Omega_x,r} \text{CA} = \frac{\sum_{i=r+1}^{n} \mathbf{1}\left[h(x_i, \mathcal{D}_{BD}(\Omega_x)) = y_i\right]}{n-r}.$$

Within this setting, the study considers static triggers, moving triggers, and the state-of-the-art dynamic trigger attack for SNNs. The dynamic trigger is described as input-aware and attack-specific to SNNs, and it can reach 100% ASR while preserving clean accuracy and remaining stealthy. This problem formulation is central to TMPBD: the detector is required to infer the target label without attack knowledge, trigger examples, or training data.

2. Spiking dynamics and the definition of TMP

The SNN neuron is modeled as a leaky integrate-and-fire (LIF) unit. The paper defines the pre-spike membrane potential $H_t$, spike event $S_t$, and post-spike membrane potential $V_t$ through the standard threshold-and-reset dynamics, with $X_t$ as input at time $t$, $\tau$ as the membrane time constant, $V_{\text{threshold}}$ as the spiking threshold, and $$\max_{\Omega_x,r} \text{ASR} = \frac{\sum_{i=1}^{r} \mathbf{1}\left[h(x_i + \delta_i, \mathcal{D}_{BD}(\Omega_x)) = \tilde{y}\right]}{r},$$0 as the reset value (Li et al., 8 Oct 2025).

TMP is defined as the average membrane potential over time in the final spiking layer, aggregated over neurons corresponding to the same class:

$$\max_{\Omega_x,r} \text{ASR} = \frac{\sum_{i=1}^{r} \mathbf{1}\left[h(x_i + \delta_i, \mathcal{D}_{BD}(\Omega_x)) = \tilde{y}\right]}{r},$$1

where $$\max_{\Omega_x,r} \text{ASR} = \frac{\sum_{i=1}^{r} \mathbf{1}\left[h(x_i + \delta_i, \mathcal{D}_{BD}(\Omega_x)) = \tilde{y}\right]}{r},$$2 is the membrane potential of the output neuron for class $$\max_{\Omega_x,r} \text{ASR} = \frac{\sum_{i=1}^{r} \mathbf{1}\left[h(x_i + \delta_i, \mathcal{D}_{BD}(\Omega_x)) = \tilde{y}\right]}{r},$$3 at time $$\max_{\Omega_x,r} \text{ASR} = \frac{\sum_{i=1}^{r} \mathbf{1}\left[h(x_i + \delta_i, \mathcal{D}_{BD}(\Omega_x)) = \tilde{y}\right]}{r},$$4.

The paper’s stated intuition is that TMP captures confidence more faithfully than firing rate (FR) or highest membrane potential (HMP). FR often fails to differentiate clean and poisoned models, whereas TMP reveals a clear overconfidence bias toward the attack target class. This makes TMP a temporally informed confidence proxy rather than a static score derived from spike counts alone.

3. Why ANN-centric defenses break in SNNs

A central claim of the work is that ANN backdoor defenses cannot simply be ported to SNNs. The paper identifies five SNN-specific blockers. First, ANN methods often rely on logits, ReLU turn-points, or smooth activation patterns, whereas SNN outputs are spike events $$\max_{\Omega_x,r} \text{ASR} = \frac{\sum_{i=1}^{r} \mathbf{1}\left[h(x_i + \delta_i, \mathcal{D}_{BD}(\Omega_x)) = \tilde{y}\right]}{r},$$5, so many ANN assumptions break. Second, SNNs process information across time; the relevant signal is not a static activation vector but a time series of membrane potentials and spikes. Third, neuromorphic data are sparse and event-driven, with asynchronous events $$\max_{\Omega_x,r} \text{ASR} = \frac{\sum_{i=1}^{r} \mathbf{1}\left[h(x_i + \delta_i, \mathcal{D}_{BD}(\Omega_x)) = \tilde{y}\right]}{r},$$6 rather than dense RGB frames. Fourth, reverse-engineering-based defenses such as Neural Cleanse must search over temporal and spatial trigger patterns, making the search space much larger. Fifth, firing rate alone is too coarse to capture subtle backdoor-induced overfitting in SNNs (Li et al., 8 Oct 2025).

Empirically, the paper reports that ANN defenses such as NC, ABS, NS, and MMBD perform poorly or inconsistently on SNNs. The argument is not that these methods are irrelevant, but that their underlying observables are mismatched to event-driven temporal computation. A plausible implication is that robust SNN backdoor defense requires measurements aligned with membrane dynamics rather than ANN-style post-activation summaries.

4. TMPBD detection mechanism

TMPBD is based on the observation that a backdoored SNN tends to become abnormally overfit to the attack target class, and that this appears as an unusually large TMP for that class even on trigger-free inputs. Instead of searching for the trigger, TMPBD asks which class has an unusually large decision margin and whether that margin is statistically inconsistent with the margins of the other classes (Li et al., 8 Oct 2025).

For each class $$\max_{\Omega_x,r} \text{ASR} = \frac{\sum_{i=1}^{r} \mathbf{1}\left[h(x_i + \delta_i, \mathcal{D}_{BD}(\Omega_x)) = \tilde{y}\right]}{r},$$7, TMPBD computes a maximum margin statistic:

$$\max_{\Omega_x,r} \text{ASR} = \frac{\sum_{i=1}^{r} \mathbf{1}\left[h(x_i + \delta_i, \mathcal{D}_{BD}(\Omega_x)) = \tilde{y}\right]}{r},$$8

The quantity $$\max_{\Omega_x,r} \text{ASR} = \frac{\sum_{i=1}^{r} \mathbf{1}\left[h(x_i + \delta_i, \mathcal{D}_{BD}(\Omega_x)) = \tilde{y}\right]}{r},$$9 is interpreted as the class-wise “peak margin” attainable by optimizing a synthetic neuromorphic input. For the attack target class $$\max_{\Omega_x,r} \text{CA} = \frac{\sum_{i=r+1}^{n} \mathbf{1}\left[h(x_i, \mathcal{D}_{BD}(\Omega_x)) = y_i\right]}{n-r}.$$0, the corresponding maximum margin is significantly larger than the margins for benign classes $$\max_{\Omega_x,r} \text{CA} = \frac{\sum_{i=r+1}^{n} \mathbf{1}\left[h(x_i, \mathcal{D}_{BD}(\Omega_x)) = y_i\right]}{n-r}.$$1.

The detection procedure has two stages. In the estimation stage, TMPBD synthesizes input samples and optimizes them by gradient ascent for every class to obtain $$\max_{\Omega_x,r} \text{CA} = \frac{\sum_{i=r+1}^{n} \mathbf{1}\left[h(x_i, \mathcal{D}_{BD}(\Omega_x)) = y_i\right]}{n-r}.$$2. The paper notes that multiple random initializations are used in parallel, that optimization is bounded and Lipschitz under the neuromorphic input constraints, and that the maximum obtained over multiple runs approximates the global maximum. In the detection stage, the method sets

$$\max_{\Omega_x,r} \text{CA} = \frac{\sum_{i=r+1}^{n} \mathbf{1}\left[h(x_i, \mathcal{D}_{BD}(\Omega_x)) = y_i\right]}{n-r}.$$3

and performs anomaly detection through the hypotheses

$$\max_{\Omega_x,r} \text{CA} = \frac{\sum_{i=r+1}^{n} \mathbf{1}\left[h(x_i, \mathcal{D}_{BD}(\Omega_x)) = y_i\right]}{n-r}.$$4

and

$$\max_{\Omega_x,r} \text{CA} = \frac{\sum_{i=r+1}^{n} \mathbf{1}\left[h(x_i, \mathcal{D}_{BD}(\Omega_x)) = y_i\right]}{n-r}.$$5

The order-statistic p-value is

$$\max_{\Omega_x,r} \text{CA} = \frac{\sum_{i=r+1}^{n} \mathbf{1}\left[h(x_i, \mathcal{D}_{BD}(\Omega_x)) = y_i\right]}{n-r}.$$6

where $$\max_{\Omega_x,r} \text{CA} = \frac{\sum_{i=r+1}^{n} \mathbf{1}\left[h(x_i, \mathcal{D}_{BD}(\Omega_x)) = y_i\right]}{n-r}.$$7 is the null CDF value and $$\max_{\Omega_x,r} \text{CA} = \frac{\sum_{i=r+1}^{n} \mathbf{1}\left[h(x_i, \mathcal{D}_{BD}(\Omega_x)) = y_i\right]}{n-r}.$$8 is the number of classes. If $$\max_{\Omega_x,r} \text{CA} = \frac{\sum_{i=r+1}^{n} \mathbf{1}\left[h(x_i, \mathcal{D}_{BD}(\Omega_x)) = y_i\right]}{n-r}.$$9 with default $H_t$0, TMPBD rejects $H_t$1 and declares a backdoor attack; the class achieving $H_t$2 is reported as the attack target label.

5. Relation to MMBD and the role of TMP versus FR and HMP

TMPBD is described as conceptually similar to the previous maximum-margin defense MMBD, but it replaces ANN-style logits or firing-rate surrogates with TMP. The paper’s position is that the main gain comes from using a temporal confidence signal that reflects the information pathway of an SNN more directly than FR or HMP (Li et al., 8 Oct 2025).

The reported comparison on DVS128-Gesture is as follows:

Signal	Detection accuracy
HMP	80% clean, 90% static, 100% dynamic
TMP	90% clean, 100% static, 100% dynamic

This comparison is used to support two claims. First, FR is too coarse and often fails to separate clean from poisoned models. Second, HMP is better than FR but still weaker than TMP. The significance of TMPBD, in this framing, is not only that it uses a maximum-margin statistic, but that the statistic is computed on a signal that preserves temporal confidence shifts that are invisible in spike counts alone.

6. NDSBM mitigation and the end-to-end defense pipeline

TMPBD is a detector; mitigation is handled by Neural Dendrites Suppression Backdoor Mitigation (NDSBM). The paper states that the backdoor effect is believed to be propagated early through abnormal weights in the first convolution blocks. In SNNs, clamping activations is ineffective because neuron outputs are binary spikes and membrane potentials are already bounded by threshold/reset dynamics. NDSBM therefore clamps the input to neurons, corresponding to the weights or neural dendrites connecting layers (Li et al., 8 Oct 2025).

The dual clamping layer is introduced before the LIF update:

$H_t$3

Here, $H_t$4 is clamped between floor $H_t$5 and ceiling $H_t$6. The paper argues that this suppresses abnormal early-layer signal amplification and reduces the backdoor’s influence. Because SNN weights can be both positive and negative, NDSBM uses both a floor and a ceiling rather than max-clamping alone.

Unlike detection, mitigation may use a small clean unlabeled dataset from the same domain. This data is used to tune $H_t$7 and $H_t$8 so that benign TMP behavior is preserved while suspicious over-amplified behavior is suppressed. The optimization objective is

$H_t$9

TMPBD guides mitigation by first identifying the suspicious label. NDSBM is then applied only to samples predicted as that suspicious label by the original classifier, with the stated purpose of avoiding unnecessary perturbation of trustworthy samples. The resulting pipeline is: detect the target label with TMPBD, suppress backdoor behavior with NDSBM, and preserve clean accuracy as much as possible.

7. Experimental profile, empirical findings, and limitations

The experimental evaluation uses three neuromorphic benchmarks: DVS128-Gesture, CIFAR10-DVS, and N-Caltech101. The attacks are static trigger, moving trigger, and dynamic trigger. Detection baselines are NC, ABS, NS, and MMBD. Mitigation baselines are Fine-tuning, MMBM, Self-tuning, Max clamping, Absolute clamping, NDSBM, and TMPBD + NDSBM. The reported metrics are detection accuracy, attack label detection accuracy, CA, ASR, and TPR/FPR in threshold sensitivity analysis. The protocol uses 10 repetitions per setting, different target labels across runs, a Spikingjelly implementation, the same optimal settings as the original attack paper, 5000 epochs for synthetic optimization in detection, and 50 epochs for mitigation (Li et al., 8 Oct 2025).

The paper reports TMPBD as the strongest overall detector. On static and dynamic attacks, it achieves 100% attack-label detection accuracy across all three benchmark datasets, and the abstract states 100% prediction accuracy in detecting dynamic trigger attacks and associating attack target labels on all benchmark datasets. NC and ABS are reported to fail badly on SNNs; NS can sometimes detect a backdoor but often misses the target label; MMBD performs better than those baselines but remains inferior to TMPBD. On DVS128-Gesture, the original dynamic attack achieves 100% ASR, NDSBM alone reduces ASR to 8.44% on average, and TMPBD + NDSBM reduces ASR further to 2.81%, without degrading clean accuracy. The paper characterizes the combined pipeline as strong mitigation without meaningful loss of clean performance and describes the overall framework as the first full lifecycle defense for SNN backdoors.

The practical interpretation advanced by the paper is that TMPBD works well in neuromorphic settings because SNN decisions are shaped by time-varying membrane potentials, not only by final spike counts, and because backdoors create persistent, class-specific confidence inflation in those potentials. NDSBM is presented as similarly aligned with neuromorphic computation because it clamps neural dendrites rather than applying ANN-style activation clamping. This suggests that the method’s efficacy depends on using control variables native to SNN dynamics.

The paper also records several caveats. False positives can occur: clean models may occasionally be flagged as attacked at the default $S_t$0, although domain-specific threshold tuning can reduce this. Datasets with very strong class-discriminative features may produce intrinsic backdoor-like signals that TMPBD can confuse with a backdoor. TMPBD is most directly designed for all-to-one attacks, though the paper states that it can still provide useful signal in all-to-all settings. Finally, adaptive attackers may attempt to suppress TMP or align margins, but the paper reports that doing so severely harms CA and ASR, making the attack impractical.