  How can we bring both privacy and energy-efficiency to a neural system on
edge devices? In this paper, we propose PrivateSNN, which aims to build
low-power Spiking Neural Networks (SNNs) from a pre-trained ANN model without
leaking sensitive information contained in a dataset. Here, we tackle two types
of leakage problems: 1) Data leakage caused when the networks access real
training data during an ANN-SNN conversion process. 2) Class leakage is the
concept of leakage caused when class-related features can be reconstructed from
network parameters. In order to address the data leakage issue, we generate
synthetic images from the pre-trained ANNs and convert ANNs to SNNs using
generated images. However, converted SNNs are still vulnerable with respect to
the class leakage since the weight parameters have the same (or scaled) value
with respect to ANN parameters. Therefore, we encrypt SNN weights by training
SNNs with a temporal spike-based learning rule. Updating weight parameters with
temporal data makes networks difficult to be interpreted in the spatial domain.
We observe that the encrypted PrivateSNN can be implemented not only without
the huge performance drop (less than ~5%) but also with significant
energy-efficiency gain (about x60 compared to the standard ANN). We conduct
extensive experiments on various datasets including CIFAR10, CIFAR100, and
TinyImageNet, highlighting the importance of privacy-preserving SNN training.
