Machine learning models deployed on edge devices are vulnerable to model stealing attacks, in which an adversary replicates a model using only its predictions. Existing defenses add mechanisms that are costly on resource-constrained hardware. Spiking neural networks (SNNs) offer energy-efficient inference at the edge and have been shown to leak less information about their training data than artificial neural networks (ANNs). This work investigates whether SNNs also resist model stealing and identifies the source of any such resistance. We evaluate four model stealing attacks against SNN and ANN models on three image datasets and introduce a metric that accounts for the stochastic outputs of SNNs. SNNs exhibit greater resistance than ANNs: on average, surrogate models extracted from SNNs agree with their targets 38% less often outside the training distribution, and targeted adversarial examples crafted on these surrogates transfer 54% less often. This resistance, however, arises mainly from the randomness of their input encoding rather than from their spiking computation, and an adversary who repeats each query can largely overcome it. SNNs therefore protect against model stealing without additional defense mechanisms, but this protection does not withstand adaptive adversaries.

翻译：暂无翻译