Spiking networks are harder to steal through a query interface

What the work claims

This is a primary empirical benchmark, modest in scale and honest about it. Moshruba and Parsa test whether model stealing attacks (MSAs), which reconstruct a deployed model's behavior through black-box queries alone, work as well against spiking neural networks (SNNs) as against conventional artificial neural networks (ANNs)¹. SNNs communicate in sparse discrete spikes, and each neuron's response depends on its membrane potential history rather than on a static input-to-output map, so a single query-response pair carries less usable signal about the learned function. The claim: across every attack and dataset tested, SNNs are harder to steal, with surrogate agreement 10 to 20 percent lower and adversarial transferability 15 to 25 percent lower than for comparable ANNs, even at large query budgets.

The stronger claim is about mechanism. When the authors swap surrogate architectures, agreement stays comparable but the transferability gap persists for SNN targets regardless of whether the surrogate itself spikes, at roughly 0.21 to 0.23 non-targeted transfer on MNIST. The resistance therefore lives in the target's temporal computation, not in a mismatch between attacker and target architectures. The paper frames this as privacy resilience that emerges from the substrate, "not by design, but as a consequence of their computational substrate."

How it works

The benchmark pits four representative attacks against matched targets on MNIST, Fashion-MNIST, and CIFAR-10. ANN targets are small convolutional networks; SNN targets reuse the same backbone with leaky integrate-and-fire neurons (25 discrete time steps, leakage beta 0.95, rate-based input encoding, surrogate-gradient training). The attacks: Papernot's Jacobian-based augmentation, which walks inputs along the substitute's input gradient; the Tramèr boundary attack using iterative FGSM at perturbation 8/255 for 5 steps; a targeted random variant (T-RND) at 64/255 for 11 steps that pushes queries toward random classes; and a gradient-free color perturbation attack at 25.5/255 with an expansion factor of four¹.

Every attack starts from a 10-sample-per-class seed (100 queries), runs up to 10 augmentation rounds, and caps at 102,400 queries, retraining the surrogate for 10 epochs after each round. Extraction quality is graded on four axes: test agreement on in-distribution data, random-uniform agreement on 4,000 uniformly sampled inputs (global decision alignment), and non-targeted and targeted adversarial transferability measured on 1,000 held-out samples with 64/255 perturbations. Reported figures, all approximate: on MNIST the stronger attacks reach agreement near or above 0.9 against ANN targets, while SNN targets sit 10 to 20 percent lower; under random inputs ANNs retain roughly 0.5 to 0.7 agreement against 15 to 25 percent lower for SNNs; non-targeted transfer lands around 0.85 to 0.95 for ANNs on MNIST versus 0.60 to 0.75 for SNNs, with the weaker T-RND and color attacks dropping below 0.50 for ANN targets and into the 0.30 to 0.45 range for SNNs. Query efficiency diverges too: ANN surrogates exceed 90 percent agreement within roughly 2,000 to 6,000 queries and saturate, while SNN surrogates keep climbing gradually past 100,000 queries and still end 10 to 20 percent lower.

Where a skeptic should push

The load-bearing weakness is the threat model's naivety relative to the claim's generality. All numbers come from three small image benchmarks with 10 classes, and the SNN targets process those static images through rate encoding over 25 steps, a near-minimal use of temporal structure. The attacks are the canonical ones from the ANN literature, ported unchanged. The authors themselves name the obvious next adversary as future work: attacks tailored to temporal representations. A query strategy that probes a spiking target with genuinely temporal inputs, or that fits a dynamical surrogate (a reservoir or an SNN trained with temporal objectives) rather than a static classifier, could close much of the gap, and nothing in this paper tests that. Extraction is also measured by agreement on test data, where SNN targets still reach roughly 0.88 to 0.90 on MNIST: harder, emphatically, is not hard. A determined thief with 102,400 queries and a near-0.9-fidelity copy has most of what they came for.

Second, most reported values are read from figures, given as ranges and "approximately," with no uncertainty quantification. Treat every number above as a direction, not a measurement. Third, the main experiments always pair an ANN surrogate with an SNN target; only the small MNIST cross-architecture study varies the surrogate. And the claimed mechanism, temporal membrane dynamics, is asserted through the architecture-swap result rather than isolated by, say, ablating time steps or encoding schemes. The substrate story is plausible, not proven.

The substrate becomes the DRM

Now map this onto the platform question. The plausible commercial shape for organoid intelligence is exactly the threat model of this paper: a vendor sells query access to a trained living system through an API, keeps the tissue, the training history, and the control loop in-house, and ships only inputs and outputs. Any such business model must assume its interface leaks. This benchmark says the leak rate depends on the substrate's temporal depth, and gives the first quantitative handle on how much: double-digit percentage points of extraction fidelity and transferability, plus an order of magnitude more queries, for a system that computes with 25 timesteps of leaky memory. Neural tissue is the extreme end of that axis. It is history-dependent, stochastic, and plastic, it changes between sessions, and it dies; a surrogate cloned today diverges from the original tomorrow even if the cloning works. For a tissue-platform vendor, the substrate is the DRM: the moat is not a legal fence around model weights but the physical impracticality of re-deriving and re-training a living system, something no silicon competitor can pirate at zero marginal cost.

The opportunity runs deeper than IP. Model-stealing resistance also disciplines the benchmark economy. If reference tissue platforms cannot be cloned, inter-lab comparison cannot consist of copying the champion's model file; it has to be protocol-level, which pushes the field toward open interfaces and agreed task suites rather than weight distribution. That is a governance dividend hidden inside a security result.

The threat is the mirror image, and it is the one this paper does not address. Every property that makes a temporal substrate hard to steal also makes it hard to inspect. A regulator, an acquirer, or an ethics auditor cannot clone the platform and probe the copy offline; each audit probe must run on the living system itself, which consumes it, perturbs it, and for neural tissue carries welfare costs that a silicon probe does not. Security-by-substrate and accountability are in direct tension: the stronger the vendor's natural moat, the weaker the outside world's ability to verify what the platform actually does. The adversarial-transferability numbers sharpen this. Red-teaming a conventional model is cheap because surrogate-captured vulnerabilities transfer at 0.85 to 0.95; red-teaming a temporal substrate through a cheap stand-in mostly fails, so safety probing concentrates on interventions against the living tissue, the one substrate where unconsented harm is a live question. And the complacency risk is real: "harder to steal" against yesterday's attacks is a property of the benchmark, not the substrate. An adaptive temporal-aware extractor is the paper's own stated future work, which means the moat's depth is unmeasured precisely where the money will push.

For platform access economics the bottom line is twofold. Query access survives as a business model on temporal substrates in a way it never could on weight-sharable silicon models, and that is genuinely enabling for small vendors. But the same fact converts inspection from a software problem into a wetware problem, and the governance stack for computing on living neural tissue has not priced that in: there is no framework yet that says who may probe a commercial tissue platform, how many interventions the audit budget buys, or what consent the tissue's provenance implies for adversarial probing.

The bottom line

Demonstrated: on three image benchmarks with canonical attacks, spiking networks are consistently harder to clone than conventional ones, and the gap tracks the target's temporal dynamics rather than surrogate architecture. Asserted, not demonstrated: that the gap survives adaptive temporal-aware attackers, richer temporal tasks, or anything at the scale of a real deployment. What would confirm the moat: extraction attempts with dynamical surrogates and temporally structured queries. What would break it: an adaptive attacker recovering near-ANN fidelity with comparable query budgets, which the authors' own future-work agenda invites. Until then, treat temporal dynamics as a speed bump for thieves, and as a wall for auditors, in roughly equal measure.