Title: Time Is All It Takes: Spike-Retiming Attacks on Event-Driven Spiking Neural Networks
Primary area: alignment, fairness, safety, privacy, and societal considerations
Keywords: spiking neural networks, event dataset, snn, attacks, adversarial attacks

Abstract: Spiking neural networks (SNNs) compute with discrete spikes and exploit temporal structure, yet most adversarial attacks change intensities or event counts instead of timing. 
We study a timing-only adversary that retimes existing spikes while preserving counts and amplitudes in event-driven SNNs. We formalize a capacity-1 spike-retiming threat model with a unified trio of budgets: per-spike jitter ($\mathcal{B}{\infty}$), total shift ($\mathcal{B}{1}$), and tamper count ($\mathcal{B}{0}$). 
Feasibility requires timeline consistency and non-overlap, which makes the problem discrete and constrained. 
To optimize such retimings at scale, we use projected-in-the-loop (PIL) optimization: shift-probability logits yield a differentiable soft retiming for backpropagation, and a strict projection in the forward pass produces a feasible discrete schedule that satisfies capacity-1, non-overlap, and the chosen budget at every step. 
The objective maximizes task loss on the projected input and adds a capacity regularizer together with budget-aware penalties, which stabilizes gradients and aligns optimizing with evaluation. 
Across event-driven benchmarks (CIFAR10-DVS, DVS-Gesture, N-MNIST) and diverse SNN architectures, we evaluate under binary and integer event grids and various retiming budgets, and also demonstrate effectiveness on adversarially trained models designed to counter timing-only attacks.
For example, on DVS-Gesture the attack attains high success (over 90\%) while touching fewer than 2\% of spikes under $\mathcal{B}_{0}$.
Taken together, our results show that spike retiming is a practical and stealthy attack surface that current defenses struggle to counter, setting a clear reference for temporal robustness in event-driven SNNs.