Spiking Neural Networks (SNNs) are energy-efficient counterparts of Deep Neural Networks (DNNs) with high biological plausibility, as information is transmitted through temporal spiking patterns. The core element of an SNN is the spiking neuron, which converts input data into spikes following the Leaky Integrate-and-Fire (LIF) neuron model. This model includes several important hyperparameters, such as the membrane potential threshold and membrane time constant. Both the DNNs and SNNs have proven to be exploitable by backdoor attacks, where an adversary can poison the training dataset with malicious triggers and force the model to behave in an attacker-defined manner. Yet, how an adversary can exploit the unique characteristics of SNNs for backdoor attacks remains underexplored. In this paper, we propose \textit{BadSNN}, a novel backdoor attack on spiking neural networks that exploits hyperparameter variations of spiking neurons to inject backdoor behavior into the model. We further propose a trigger optimization process to achieve better attack performance while making trigger patterns less perceptible. \textit{BadSNN} demonstrates superior attack performance on various datasets and architectures, as well as compared with state-of-the-art data poisoning-based backdoor attacks and robustness against common backdoor mitigation techniques. Codes can be found at https://github.com/SiSL-URI/BadSNN.

翻译：脉冲神经网络（SNNs）作为深度神经网络（DNNs）的高能效对应模型，具有高度的生物合理性，其信息通过时序脉冲模式传递。SNN的核心单元是脉冲神经元，它遵循漏积分发放（LIF）神经元模型将输入数据转换为脉冲。该模型包含若干重要超参数，例如膜电位阈值和膜时间常数。已有研究证明，DNNs和SNNs均易受后门攻击影响，攻击者可通过在训练数据集中植入恶意触发器，迫使模型表现出攻击者预设的行为。然而，攻击者如何利用SNNs的独有特性实施后门攻击仍未得到充分探索。本文提出\textit{BadSNN}，一种针对脉冲神经网络的新型后门攻击方法，通过利用脉冲神经元的超参数变异向模型中注入后门行为。我们进一步提出触发器优化流程，在提升攻击性能的同时降低触发器模式的感知度。实验表明，\textit{BadSNN}在多种数据集和架构上均展现出卓越的攻击性能，相较于最先进的基于数据投毒的后门攻击具有显著优势，并能有效抵抗常见的后门防御技术。代码可见：https://github.com/SiSL-URI/BadSNN。