Flashy Backdoor: Real-world Environment Backdoor Attack on SNNs with DVS Cameras

TL;DR

This paper introduces novel real-world backdoor attack methods on Spiking Neural Networks with DVS cameras, demonstrating high success rates and stealthiness, and evaluates defenses revealing their limitations.

Contribution

First evaluation of physical environment backdoor attacks on SNNs, proposing three new attack methods and assessing defense effectiveness in real-world scenarios.

Findings

All methods achieve up to 100% attack success rate.

Traditional defenses often fail or reduce model accuracy.

Stealthy triggers are highly effective in physical environments.

Abstract

While security vulnerabilities in traditional Deep Neural Networks (DNNs) have been extensively studied, the susceptibility of Spiking Neural Networks (SNNs) to adversarial attacks remains mostly underexplored. Until now, the mechanisms to inject backdoors into SNN models have been limited to digital scenarios; thus, we present the first evaluation of backdoor attacks in real-world environments. We begin by assessing the applicability of existing digital backdoor attacks and identifying their limitations for deployment in physical environments. To address each of the found limitations, we present three novel backdoor attack methods on SNNs, i.e., Framed, Strobing, and Flashy Backdoor. We also assess the effectiveness of traditional backdoor procedures and defenses adapted for SNNs, such as pruning, fine-tuning, and fine-pruning. The results show that while these procedures and defenses can mitigate some attacks, they often fail against stronger methods like Flashy Backdoor or sacrifice too much clean accuracy, rendering the models unusable. Overall, all our methods can achieve up to a 100% Attack Success Rate while maintaining high clean accuracy in every tested dataset. Additionally, we evaluate the stealthiness of the triggers with commonly used metrics, finding them highly stealthy. Thus, we propose new alternatives more suited for identifying poisoned samples in these scenarios. Our results show that further research is needed to ensure the security of SNN-based systems against backdoor attacks and their safe application in real-world scenarios. The code, experiments, and results are available in our repository.