Pith. sign in

REVIEW 4 major objections 5 minor 160 references

Neuromorphic systems inherit classical hardware attacks and add new ones; a single taxonomy now maps both, and points to memristive variability as a double-edged security resource.

Reviewed by Pith at T0; open to challenge. T0 means a machine referee read the full paper against a public rubric. the ladder, T0–T4 →

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

A 133-paper survey unifying hardware and software attack surfaces, defenses, and memristor-based security primitives in neuromorphic computing under one taxonomy.

T0 review reviewed 2026-08-04 challenge →

load-bearing objection Useful first map of neuromorphic security, but the map's accuracy is undercut by wrong attributions, an inconsistent count, and a missing audit trail—worth revising, then citing. the 4 major comments →

arxiv 2601.16589 v2 pith:UZ5YKS7U submitted 2026-01-23 cs.CR cs.AIcs.ET

Emerging Threats and Countermeasures in Neuromorphic Systems: A Survey

Pablo Sorrentino , Stjepan Picek , Ihsen Alouani , Nikolaos Athanasios Anagnostopoulos , Francesco Regazzoni , Lejla Batina , Tamalika Banerjee , Fatih Turkmen This is my paper
classification cs.CR cs.AIcs.ET
keywords Neuromorphic computingSpiking neural networksHardware securitySide-channel attacksFault injectionAdversarial attacksPhysical unclonable functionsTrue random number generators
verification ladder T0 review T1 audit T2 compute T3 formal T4 reserved

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

This survey tries to establish that the security of neuromorphic computing has been studied piecemeal, and that a single unified threat framework is both possible and necessary. It organizes 133 papers into one taxonomy spanning hardware attacks, software attacks on spiking neural networks, and security primitives built from the same devices that create the vulnerabilities. The paper argues that event-driven, asynchronous processing and stochastic memristive behavior create attack surfaces not present in conventional systems, while also enabling defenses and cryptographic primitives such as PUFs and TRNGs. If the map is accurate, the field gains a shared vocabulary for comparing attacks and countermeasures, and the paper's identified gaps—mostly simulative attacks, no standardized benchmarks, no cross-layer threat model—correctly mark the frontier.

Core claim

The paper's central claim is that no prior survey links device-level behavior, neuromorphic architecture, and vulnerabilities within a common threat framework, and that such a framework can be derived from the literature. It classifies attacks by aim, target, data source, exploited property, capability, and threat scenario, placing side-channel and fault injection attacks in both the hardware and software branches because the same physical leakage can be studied as a device-level phenomenon or as manipulation of spiking behavior. The survey further claims that memristive variability is double-edged: it enables model extraction and fault injection, yet the same stochastic switching can be har

What carries the argument

The load-bearing object is the taxonomy itself (Figure 4), which organizes the security landscape along six dimensions: aim of attack, target, data set, exploited property, attacker capability, and threat scenario. Its distinctive structural choice is the dual placement of side-channel and fault injection attacks across hardware and software branches, capturing that a physical leak can be read either as a device-level signal or as an effect on spiking computation. The recurring physical substrate is the memristor crossbar array, which simultaneously performs matrix-vector multiplication, leaks information through power and thermal signatures, and provides the stochastic variability from whic

Load-bearing premise

The load-bearing premise is that the 133 selected papers are a complete, unbiased, and correctly understood sample of the field, meaning the paper's counts and attributions must be accurate for its gap analysis and taxonomy to hold.

What would settle it

Re-reading the cited papers and reconciling the arithmetic would settle the matter: the taxonomy's section counts in the paper sum to 126, not the stated 133, and the audit trail promised in Section 1 is not yet available. If the recount cannot be made to match the bibliography, or if cited works such as [66] and [112] turn out not to describe the neuromorphic EM and timing attacks they are credited with, the survey's map misrepresents the field.

Watch this falsifier. Get emailed when new claim-graph text bears on it.

If this is right

  • Classical hardware defenses—power balancing, timing randomization, threshold implementations—have a clear target domain in neuromorphic accelerators and in-memory computing arrays.
  • SNN-specific attacks such as temporal backdoors, spike-timing adversarial perturbations, and spike-efficiency attacks require defenses that exploit temporal structure rather than static input features.
  • Event-driven timing can leak model structure and neuron thresholds, so timing obfuscation and runtime encryption belong in neuromorphic chip design from the start.
  • Memristive variability should be treated as a design resource for security primitives, not only as a source of vulnerability, since PUFs and TRNGs can be embedded in the same crossbar array that performs computation.
  • The paper's gap list implies the next concrete step: moving from simulated attacks to experimental validation on physical neuromorphic platforms, with standardized security benchmarks.

Where Pith is reading between the lines

These are editorial extensions of the paper, not claims the author makes directly.

  • If the taxonomy's dual placement of side-channel and fault injection is taken seriously, it suggests that a physical leakage cannot be fully neutralized at one layer alone: a device-level countermeasure may simply move the signal into the electrical or timing domain where the software branch reads it.
  • The paper's own evidence that SNNs are only partially privacy-preserving—membership inference scores are lower than ANNs, but model inversion still succeeds—implies that 'inherent privacy by non-differentiability' is a fragile assumption and should be tested per architecture.
  • A natural extension is to test NeuroHammer-style thermal bit-flips and power-based weight extraction on real memristive crossbars, since the surveyed results are mostly simulations and device stochasticity could change both attack success rates and the effectiveness of proposed defenses.
  • Combining multiple emerging memory technologies in one accelerator, as the paper notes, may create cross-technology leakage paths that single-device studies miss; a unified threat model would need to account for these interactions explicitly.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, simulated authors' rebuttal, and a circularity audit.

Referee Report

4 major / 5 minor

Summary. This survey claims to provide the first unified taxonomy linking device-level behavior, neuromorphic architectures, and security vulnerabilities, based on a corpus of 133 papers published between 2014 and 2025. It organizes the literature into hardware attacks (side-channel, fault injection, hardware Trojans), software attacks on spiking neural networks (adversarial, backdoor, membership inference, software-level SCA/FIA), and security applications enabled by neuromorphic/emerging-memory primitives (PUFs, TRNGs, security features). The survey explicitly identifies open field gaps: most attacks are still simulative or conceptual, there are no standardized benchmarks, and no cross-layer threat model exists. It also provides comparison tables (Tables 4–6) and a stated replicable search methodology.

Significance. If the corpus map is accurate, this is a genuinely useful first-of-its-kind synthesis: it connects three research communities (hardware security, SNN software security, and memristive security primitives) that are usually treated separately. The paper earns credit for being honest about the simulative nature of many attacks (§4.2, §7) and for pointing to concrete missing infrastructure (benchmarks, standardized metrics, cross-layer threat models). However, the contribution is the map itself, so the accuracy of the corpus and its descriptions are load-bearing. The two misattributed references and the non-reconciling corpus counts identified below mean that the map currently cannot be trusted as an audit trail without further correction.

major comments (4)
  1. [§4.1.1] The power/EM/timing side-channel discussion contains two concrete attribution errors. The text credits [66] with an EM-based attack that 'reconstructed neuron weights and model hyperparameters ... in spike-based hardware,' but reference [66] (Kubota et al., Microprocessors and Microsystems 2021) is a deep-learning side-channel attack against hardware AES implementations, not a neuromorphic weight-recovery study. Similarly, the next paragraph credits [112] with an SNN timing-leakage attack, but [112] (Rogi et al., IEEE SENSORS 2024) is a defense against adversarial examples using thermal noise of a CMOS image sensor. These are not cosmetic mistakes; they are the key citations used to establish EM and timing leakage in neuromorphic systems. The authors must correct or replace these attributions and audit neighboring claims for the same class of error.
  2. [§3.3 / Figure 5 / Table 3 / Figure 7] The corpus accounting is internally inconsistent. Figure 5 reports final counts of 63, 21, 21, and 21, which sum to 126, not the stated 133. Table 3 reports category totals 50 + 43 + 40 = 133, with subsection sums consistent (25+19+6=50; 20+12+8+3=43; 19+11+10=40). In addition, Figure 7 cross-lists the same references in multiple branches (e.g., [29], [32], [52], [120], [124], [135] appear in more than one branch), while Table 3 implies each of the 133 papers is assigned to a single subcategory. The authors need to state clearly whether 133 is the number of unique papers or the number of assignments, and provide one reconciled accounting of the full corpus.
  3. [§1 (companion repository)] The paper promises an 'accompanying open-source repository ... to provide curated references, structured comparison tables, and supplementary resources,' but the link is the placeholder text 'Survey repository' rather than an actual URL. Since the survey's central contribution is an accurate, auditable corpus map, this is not a minor web-hygiene issue: without the repository or an appendix listing all 133 papers and their classifications, the reader cannot verify the selection, screening, or category assignments.
  4. [§3.2–§3.3] The methodology is described as 'structured and replicable,' but the actual search strings are not given. Table 2 lists three keyword groups, and the text states that each query combined one keyword from each group, but the exact Boolean queries, the search date, the per-database hit counts, and the inclusion/exclusion criteria are not specified. As a result, the 133-paper corpus cannot be independently reproduced, and the claimed completeness of the map is not testable. The authors should supply the full query strings and a PRISMA-style screening table.
minor comments (5)
  1. [Figure 6] The x-axis omits 2016; the line plot appears to jump from 2014/2015 to 2017. Also, the number of selected publications for 2025 is based on a partial year (January–August per §3) but is plotted without an annotation; this should be clarified.
  2. [§4.4.1] There is a duplicated phrase: 'integrates two redundant checksum blocks two redundant checksum blocks into a memory crossbar array.'
  3. [Table 6] The row for reference [9] lists 'Process and write variability' in both the Entropy Source and Validation/Eval columns; this appears to be a copy-paste error.
  4. [§3.2] The sentence 'review papers and non-accessible or duplicate entries were excluded (see Table 2)' points the reader to Table 2, which lists keyword groups, not inclusion/exclusion criteria. This cross-reference is wrong.
  5. [Table 4] The row for [66] says 'Power traces analyzed via deep learning' and reports an ASIC target, but the body text (§4.1.1) says the same reference reports EM-based neuron-weight extraction. The table-text inconsistency should be resolved as part of the attribution audit.

Circularity Check

0 steps flagged

No significant circularity; the survey's taxonomy is an explicit literature summary, not an independent prediction.

full rationale

This is a survey, so there is no formal derivation chain, fitted parameter, or uniqueness theorem whose outputs could reduce to its inputs. The paper explicitly states that its classification 'emerged from an iterative literature-mapping process' and that the taxonomy 'was derived directly from the data of reviewed articles, rather than from preexisting frameworks' (§3.3). That is the opposite of a hidden circularity: the taxonomy is presented as a summary of the 133 selected papers, not as a quantity that is then used to predict those papers. The central gap claim—that no prior survey unifies device-level behavior, architecture, and vulnerabilities—is supported by comparison with prior published surveys such as [128], [47], and [137], not by the paper's own framework. Although several cited works are co-authored by the present authors (e.g., [1], [13], [34], [47], [87], [100], [101], [135]), they are peer-reviewed, externally published results used as evidence of specific attacks, defenses, or prior-SoK status; they are not the sole justification for the survey's organizing structure. The internal corpus inconsistencies noted in the reading (Figure 5 counts sum to 126 rather than 133; [66] and [112] appear to be misdescribed; the companion repository is a placeholder) are correctness and curation concerns, but they do not establish that any claimed result is equivalent to an input by construction. The search strategy does preselect papers using threat-type keywords that resemble the taxonomy categories, so the reported category counts are partly descriptive of the inclusion criteria; however, the paper does not present those counts as an independent empirical discovery, and this is a methodological limitation rather than circular reasoning. Overall, the survey's contribution is an explicit organization of the literature, and its load-bearing assertions do not reduce to their own inputs.

Axiom & Free-Parameter Ledger

0 free parameters · 3 axioms · 0 invented entities

Survey paper: no fitted quantities, no hand-chosen constants, and no invented physical or conceptual entities. The taxonomy is a classification frame over existing literature, not a new postulated thing. The load-bearing assumptions are the transferability of classical attack categories to neuromorphic hardware, the completeness/unbiasedness of the 133-paper corpus, and the claimed absence of a prior unified survey.

axioms (3)
  • domain assumption Standard SCA/FIA/adversarial-attack taxonomies from conventional CMOS and ANN systems transfer to neuromorphic/SNN and memristive platforms.
    The entire survey organization (Fig. 4) maps established categories onto memristive/SNN hardware; the paper itself admits most surveyed attacks are simulative or untested on real neuromorphic chips (§4.2, §7).
  • domain assumption The 807-document search and manual screening yielded a complete, unbiased 133-paper corpus.
    Claimed in §3.2–3.3; not fully auditable because the companion repository link is a placeholder and Fig. 5 counts do not reconcile (63+21+21+21=126 vs 133).
  • domain assumption No earlier survey covers the integrated hardware + software + security-primitives view.
    Gap justification in §1 and §2.4; contestable because [128] is itself a security-focused neuromorphic CIM survey listed in the paper's own Table 1.

reviewed 2026-08-04 · how reviews work

0 comments
Cite this review

Pith. "Pith review of Emerging Threats and Countermeasures in Neuromorphic Systems: A Survey." pith.science (2026). https://pith.science/paper/UZ5YKS7U

@misc{pith2026260116589,
  author       = {Pith},
  title        = {Pith review of: Emerging Threats and Countermeasures in Neuromorphic Systems: A Survey},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/UZ5YKS7U}},
  note         = {Machine review of arXiv:2601.16589}
}
Share X Bluesky LinkedIn Reddit HN
read the original abstract

Neuromorphic computing mimics brain-inspired mechanisms through spiking neurons and energy-efficient processing, offering a pathway to efficient in-memory computing (IMC). However, these advancements raise critical security and privacy concerns. As the adoption of bio-inspired architectures and memristive devices increases, so does the urgency to assess the vulnerability of these emerging technologies to hardware and software attacks. Emerging architectures introduce new attack surfaces, particularly due to asynchronous, event-driven processing and stochastic device behavior. The integration of memristors into neuromorphic hardware and software implementations in spiking neural networks offers diverse possibilities for advanced computing architectures, including their role in security-aware applications. This survey systematically analyzes the security landscape of neuromorphic systems, covering attack methodologies, side-channel vulnerabilities, and countermeasures. We focus on both hardware and software concerns relevant to spiking neural networks (SNNs) and hardware primitives, such as Physical Unclonable Functions (PUFs) and True Random Number Generators (TRNGs) for cryptographic and secure computation applications. We approach this analysis from diverse perspectives, from attack methodologies to countermeasure strategies that integrate efficiency and protection in brain-inspired hardware. This review not only maps the current landscape of security threats but provides a foundation for developing secure and trustworthy neuromorphic architectures.

Figures

Figures reproduced from arXiv: 2601.16589 by Fatih Turkmen, Francesco Regazzoni, Ihsen Alouani, Lejla Batina, Nikolaos Athanasios Anagnostopoulos, Pablo Sorrentino, Stjepan Picek, Tamalika Banerjee.

Figure 1
Figure 1. Figure 1: Memristor crossbar array performing matrix–vector multiplication, where input voltages and device [PITH_FULL_IMAGE:figures/full_fig_p004_1.png] view at source ↗
Figure 2
Figure 2. Figure 2: Schematic of SNNs model, a classical SNNs structure, comprising a post-neuron driven by input [PITH_FULL_IMAGE:figures/full_fig_p005_2.png] view at source ↗
Figure 3
Figure 3. Figure 3: (a) SNNs flow chart. (b) The dynamics of LIF spiking neurons are shown. [PITH_FULL_IMAGE:figures/full_fig_p006_3.png] view at source ↗
Figure 4
Figure 4. Figure 4: Taxonomy of key characteristics used to classify attacks adapted to neuromorphic computing in this [PITH_FULL_IMAGE:figures/full_fig_p008_4.png] view at source ↗
Figure 5
Figure 5. Figure 5: Illustration of the selection methodology of this survey. [PITH_FULL_IMAGE:figures/full_fig_p010_5.png] view at source ↗
Figure 6
Figure 6. Figure 6: Number of selected publications per year (2014–2025), showing an overall increase in interest. [PITH_FULL_IMAGE:figures/full_fig_p011_6.png] view at source ↗
Figure 7
Figure 7. Figure 7: Structure of the survey organizing selected papers into main sections and subsections based on attack [PITH_FULL_IMAGE:figures/full_fig_p012_7.png] view at source ↗
Figure 8
Figure 8. Figure 8: Representation of neuromorphic computing hardware, from individual devices to in-memory computing [PITH_FULL_IMAGE:figures/full_fig_p013_8.png] view at source ↗
Figure 9
Figure 9. Figure 9: Schematic example of an adversarial attack on an SNN. A spatio-temporal perturbation applied to a [PITH_FULL_IMAGE:figures/full_fig_p019_9.png] view at source ↗
Figure 10
Figure 10. Figure 10: Example of a side-channel attack on a neuromorphic chip running a spiking neural network. The [PITH_FULL_IMAGE:figures/full_fig_p019_10.png] view at source ↗
Figure 11
Figure 11. Figure 11: The use of memristor arrays in the design of a neuromorphic security system. Thestochastic device [PITH_FULL_IMAGE:figures/full_fig_p024_11.png] view at source ↗

discussion (0)

Sign in with ORCID, Apple, or X to comment. Anyone can read and Pith papers without signing in.

Reference graph

Works this paper leans on

160 extracted references · 42 canonical work pages

  1. [1]

    Gorka Abad, Oguzhan Ersoy, Stjepan Picek, and Aitor Urbieta. 2024. Sneaky Spikes: Uncovering Stealthy Backdoor Attacks in Spiking Neural Networks with Neuromorphic Data. InProceedings of the Network and Distributed System Security Symposium (NDSS 2024). Internet Society. https://doi.org/10.14722/ndss.2024.24334

    arXiv 2024

  2. [2]

    2018.Memristor Technology: Synthesis and Modeling for Sensing and Security Applications

    Heba Abunahla and Baker Mohammad. 2018.Memristor Technology: Synthesis and Modeling for Sensing and Security Applications. Springer International Publishing. https://doi.org/10.1007/978-3-319-65699-1

    work page doi:10.1007/978-3-319-65699-1 2018

  3. [3]

    Mohammad Javad Adel, Mohammad Hadi Rezayati, Mohammad Hossein Moaiyeri, Abdolah Amirany, and Kian Jafari. 2024. A Robust Deep Learning Attack Immune MRAM-Based Physical Unclonable Function.Scientific Reports 14, 1 (2024), 20649. https://doi.org/10.1038/s41598-024-71730-7

    work page doi:10.1038/s41598-024-71730-7 2024

  4. [4]

    Yossi Adi, Carsten Baum, Moustapha Cisse, Benny Pinkas, and Joseph Keshet. 2018. Turning Your Weakness into a Strength: Watermarking Deep Neural Networks by Backdooring. InProceedings of the 27th USENIX Security Symposium (USENIX Security ’18). USENIX Association, Baltimore, MD, 1615–1631. https://www.usenix.org/ conference/usenixsecurity18/presentation/adi

    2018

  5. [5]

    Fernando Aguirre, Abu Sebastian, Manuel Le Gallo, et al . 2024. Hardware Implementation of Memristor-Based Artificial Neural Networks.Nature Communications15, 1 (2024), 1974. https://doi.org/10.1038/s41467-024-45670-9

    doi:10.1038/s41467-024-45670-9 2024

  6. [7]

    Maryam Akbari, Sattar Mirzakuchaki, Daniel Arumí, Salvador Manich, Alvaro Gómez-Pau, Francesca Campabadal, Mireia Bargalló González, and Rosa Rodríguez-Montañés. 2023. True Random Number Generator Based on the Variability of the High Resistance State of RRAMs.IEEE Access11 (2023), 66682–66693. https://doi.org/10.1109/ ACCESS.2023.3290896

    arXiv 2023

  7. [8]

    Filipp Akopyan, Jun Sawada, Andrew Cassidy, et al. 2015. TrueNorth: Design and Tool Flow of a 65 mW 1 Million Neuron Programmable Neurosynaptic Chip.IEEE Transactions on Computer-Aided Design of Integrated Circuits and Systems34, 10 (2015), 1537–1557. https://doi.org/10.1109/TCAD.2015.2474396

    arXiv 2015

  8. [9]

    Abdulaziz Al-Meer and Saif Al-Kuwari. 2023. Physical unclonable functions (PUF) for IoT devices.Comput. Surveys 55, 14s (2023), 1–31. https://doi.org/10.1145/3591464 28 Sorrentino et al

    doi:10.1145/3591464 2023

  9. [10]

    Abdolah Amirany, Kian Jafari, and Mohammad Hossein Moaiyeri. 2020. True Random Number Generator for Reliable Hardware Security Modules Based on a Neuromorphic Variation-Tolerant Spintronic Structure.IEEE Transactions on Nanotechnology19 (2020), 784–791. https://doi.org/10.1109/TNANO.2020.3034818

    arXiv 2020

  10. [11]

    Maitreyi Ashok, Saurav Maji, Xin Zhang, John Cohn, and Anantha P Chandrakasan. 2025. Digital In-Memory Compute for Machine Learning Applications With Input and Model Security.IEEE Journal of Solid-State Circuits (2025). https://doi.org/10.1109/JSSC.2025.3534753

    arXiv 2025

  11. [12]

    Amir Bahador, Mohammad Hossein Moaiyeri, and Reza Ghaderi. 2024. Algorithmically-Enhanced Design of Spintronic-Based Tunable True Random Number Generator for Dependable Stochastic Computing.IEEE Transactions on Computer-Aided Design of Integrated Circuits and Systems(2024), 1–1. https://doi.org/10.1109/TCAD.2024.3446715

    arXiv 2024

  12. [13]

    Lejla Batina, Shivam Bhasin, Dirmanto Jap, and Stjepan Picek. 2019. CSI NN: Reverse Engineering of Neural Network Architectures Through Electromagnetic Side Channel. InProceedings of the 28th USENIX Security Symposium (USENIX Security ’19). USENIX Association, 601–618. https://www.usenix.org/conference/usenixsecurity19/presentation/ batina

    2019

  13. [14]

    Nisa Bostanci, ISmail Emir Yüksel, Ataberk Olgun, Konstantinos Kanellopoulos, Yahya Can Tuğrul, A

    F. Nisa Bostanci, ISmail Emir Yüksel, Ataberk Olgun, Konstantinos Kanellopoulos, Yahya Can Tuğrul, A. Giray Yağliçi, Mohammad Sadrosadati, and Onur Mutlu. 2024. CoMeT: Count-Min-Sketch-Based Row Tracking to Mitigate RowHammer at Low Cost. InProceedings of the IEEE International Symposium on High-Performance Computer Architecture (HPCA). IEEE, 593–612. htt...

    arXiv 2024

  14. [15]

    Eric Brier, Christophe Clavier, and Francis Olivier. 2004. Correlation Power Analysis with a Leakage Model. In Cryptographic Hardware and Embedded Systems – CHES 2004. Vol. 3156. Springer, Berlin, Heidelberg, 16–29. https: //doi.org/10.1007/978-3-540-28632-5_2

    work page doi:10.1007/978-3-540-28632-5_2 2004

  15. [16]

    Tong Bu, Jianhao Ding, Zecheng Hao, and Zhaofei Yu. 2023. Rate gradient approximation attack threats deep spiking neural networks. InProceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition. IEEE, 7896–7906. https://doi.org/10.1109/CVPR52729.2023.00763

    arXiv 2023

  16. [18]

    Abhishek Chakraborty, Ankit Mondal, and Ankur Srivastava. 2017. Correlation Power Analysis Attack Against STT-MRAM Based Cryptosystems. InProceedings of the 2017 IEEE International Symposium on Hardware Oriented Security and Trust (HOST). IEEE, 171–171. https://doi.org/10.1109/HST.2017.7951835

    arXiv 2017

  17. [19]

    Suresh Chari, Josyula R Rao, and Pankaj Rohatgi. 2002. Template attacks. InInternational workshop on cryptographic hardware and embedded systems. Springer, 13–28. https://doi.org/10.1007/3-540-36400-5_3

    doi:10.1007/3-540-36400-5_3 2002

  18. [20]

    Weiran Chen and Qi Xu. 2025. Robust and Efficient Adversarial Defense in SNNs via Image Purification and Joint Detection. InICASSP IEEE International Conference on Acoustics, Speech and Signal Processing (ICASSP). IEEE, 1–5. https://doi.org/10.1109/ICASSP49660.2025.10888581

    arXiv 2025

  19. [21]

    Ziang Chen, Li-Wei Chen, Xianyue Zhao, Kefeng Li, Heidemarie Schmidt, Ilia Polian, and Nan Du. 2025. Protected memristive implementations of cryptographic functions.Philosophical Transactions A383, 2288 (2025), 20230389. https://doi.org/10.1098/rsta.2023.0389

    arXiv 2025

  20. [22]

    Yu-Chieh Chien, Heng Xiang, Jianze Wang, Yufei Shi, Xuanyao Fong, and Kah-Wee Ang. 2023. Attack Resilient True Random Number Generators Using Ferroelectric-Enhanced Stochasticity in 2D Transistor.Small19, 38 (2023), 2302842. https://doi.org/10.1002/smll.202302842

    work page doi:10.1002/smll.202302842 2023

  21. [23]

    DeMara, and Soheil Salehi

    Muhtasim Alam Chowdhury, Mousam Hossain, Christopher Mastrangelo, Ronald F. DeMara, and Soheil Salehi. 2024. S-Tune: SOT-MTJ manufacturing parameters tuning for securing the next generation of computing.Frontiers in Electronics5 (2024), 1409548. https://doi.org/10.3389/felec.2024.1409548

    arXiv 2024

  22. [24]

    Md Hafizul Islam Chowdhuryy, Rickard Ewetz, Amro Awad, and Fan Yao. 2023. Understanding and Characterizing Side Channels Exploiting Phase-Change Memories.IEEE Micro43, 5 (2023), 8–15. https://doi.org/10.1109/MM.2023.3238894

    arXiv 2023

  23. [25]

    Bingjie Dang, Quantan Wu, Fang Song, Jing Sun, Mei Yang, Xiaohua Ma, Hong Wang, and Yue Hao. 2018. A bio-inspired physically transient/biodegradable synapse for security neuromorphic computing based on memristors. Nanoscale10, 43 (2018), 20089–20095. https://doi.org/10.1039/C8NR07442A

    work page doi:10.1039/c8nr07442a 2018

  24. [26]

    Chenchen Ding, Yuan Ren, Zhengwu Liu, and Ngai Wong. 2025. Transforming memristor noises into computational innovations.Communications Materials6, 1 (2025), 149. https://doi.org/10.1038/s43246-025-00876-2

    doi:10.1038/s43246-025-00876-2 2025

  25. [27]

    Jianhao Ding, Tong Bu, Zhaofei Yu, Tiejun Huang, and Jian K. Liu. 2022. SNN-RAT: Robustness-enhanced Spiking Neural Network through Regularized Adversarial Training, In NeurIPS 2022.Advances in Neural Information Processing Systems, 24780–24792. https://proceedings.neurips.cc/paper_files/paper/2022/file/9cf904c86cc5f9ac95646c07d2cfa241- Paper-Conference.pdf

    2022

  26. [28]

    Jianhao Ding, Zhaofei Yu, Tiejun Huang, and Jian K. Liu. 2024. Enhancing the Robustness of Spiking Neural Networks with Stochastic Gating Mechanisms. InProceedings of the AAAI Conference on Artificial Intelligence, Vol. 38. AAAI Press, 492–502. https://doi.org/10.1609/aaai.v38i1.27804 Emerging Threats and Countermeasures in Neuromorphic Systems: A Survey 29

    work page doi:10.1609/aaai.v38i1.27804 2024

  27. [29]

    Divyanshu Divyanshu, Rajat Kumar, Danial Khan, Selma Amara, and Yehia Massoud. 2022. Logic Locking Using Emerging 2T/3T Magnetic Tunnel Junctions for Hardware Security.IEEE Access10 (2022), 102386–102395. https: //doi.org/10.1109/ACCESS.2022.3208650

    arXiv 2022

  28. [30]

    Divyanshu Divyanshu, Rajat Kumar, Danial Khan, Selma Amara, and Yehia Massoud. 2023. Cybersecurity Regulation of Smart Mobility Hardware Systems: Case Assessment for Spin-Based MTJ Devices. InProceedings of the IEEE International Conference on Smart Mobility (SM). IEEE, 186–190. https://doi.org/10.1109/SM57895.2023.10112292

    arXiv 2023

  29. [31]

    Akhil Dodda, Nicholas Trainor, Joan. M. Redwing, and Saptarshi Das. 2022. All-in-one, bio-inspired, and low-power crypto engines for near-sensor security based on two-dimensional memtransistors.Nature Communications13, 1 (2022), 3587. https://doi.org/10.1038/s41467-022-31148-z

    work page doi:10.1038/s41467-022-31148-z 2022

  30. [32]

    Nan Du, Heidemarie Schmidt, and Ilia Polian. 2021. Low-power emerging memristive designs towards secure hardware systems for applications in internet of things.Nano Materials Science3, 2 (2021), 186–204. https: //doi.org/10.1016/j.nanoms.2021.01.001

    work page doi:10.1016/j.nanoms.2021.01.001 2021

  31. [33]

    Xiao Du, Wanli Shi, Xiaohan Zhao, Yang Cao, Bin Gu, and Tieru Wu. 2025. Raw event-based adversarial attacks for Spiking Neural Networks with configurable latencies.Neural Networks193 (2025), 108026. https://doi.org/10.1016/j. neunet.2025.108026

    arXiv 2025

  32. [35]

    Esser, Paul A

    Steven K. Esser, Paul A. Merolla, John V. Arthur, et al . 2016. Convolutional networks for fast, energy-efficient neuromorphic computing.Proc. Natl. Acad. Sci. USA113, 41 (2016), 11441–11446. https://doi.org/10.1073/PNAS. 1604850113

    doi:10.1073/pnas 2016

  33. [36]

    Florian Frank, Tolga Arul, Nikolaos Athanasios Anagnostopoulos, and Stefan Katzenbeisser. 2022. Using Memristor Arrays as Physical Unclonable Functions. InComputer Security – ESORICS. Vol. 13556. Springer Nature Switzerland, Cham, 250–271. https://doi.org/10.1007/978-3-031-17143-7_13

    work page doi:10.1007/978-3-031-17143-7_13 2022

  34. [37]

    Hanqing Fu, Gaolei Li, Jun Wu, Jianhua Li, Xi Lin, Kai Zhou, and Yuchen Liu. 2024. Spikewhisper: Temporal Spike Backdoor Attacks on Federated Neuromorphic Learning over Low-power Devices. arXiv:2403.18607 [cs.CR]

    Pith/arXiv arXiv 2024

  35. [38]

    Karine Gandolfi, Christophe Mourtel, and Francis Olivier. 2001. Electromagnetic Analysis: Concrete Results. In Cryptographic Hardware and Embedded Systems — CHES 2001. Springer, 251–261. https://doi.org/10.1007/3-540- 44709-1_21

    doi:10.1007/3-540- 2001

  36. [39]

    Suo Gao, Zheyi Zhang, Qi Li, et al . 2025. Encrypt a Story: A Video Segment Encryption Method Based on the Discrete Sinusoidal Memristive Rulkov Neuron.IEEE Transactions on Dependable and Secure Computing(2025), 1–15. https://doi.org/10.1109/TDSC.2025.3603570

    arXiv 2025

  37. [40]

    Luíza C Garaffa, Abdullah Aljuffri, Cezar Reinbrecht, Said Hamdioui, Mottaqiallah Taouil, and Johanna Sepulveda

  38. [41]

    Bhanprakash Goswami, Tamoghno Das, and Manan Suri. 2024. Experimental Investigation of Side-Channel Attacks on Neuromorphic Spiking Neural Networks.IEEE Embedded Systems Letters16, 2 (2024), 231–234. https://doi.org/10. 1109/LES.2023.3328223

    arXiv 2024

  39. [42]

    Wenzhe Guo, Mohammed E Fouda, Ahmed M Eltawil, and Khaled Nabil Salama. 2021. Neural coding in spiking neural networks: A comparative study for robust neuromorphic systems.Frontiers in Neuroscience15 (2021), 638474. https://doi.org/10.3389/fnins.2021.638474

    arXiv 2021

  40. [43]

    Naina Gupta, Arpan Jati, and Anupam Chattopadhyay. 2025. AI Attacks AI: Recovering Neural Network Architecture from NVDLA Using AI-Assisted Side Channel Attack.Association for Computing Machinery24, 5 (2025). https: //doi.org/10.1145/3731560

    work page doi:10.1145/3731560 2025

  41. [44]

    Donhee Ham, Hongkun Park, Sungwoo Hwang, and Kinam Kim. 2021. Neuromorphic electronics based on copying and pasting the brain.Nature Electronics4, 9 (2021), 635–644. https://doi.org/10.1038/s41928-021-00646-1

    work page doi:10.1038/s41928-021-00646-1 2021

  42. [45]

    Zhezhi He, Adnan Siraj Rakin, and Deliang Fan. 2019. Parametric Noise Injection: Trainable Randomness to Improve Deep Neural Network Robustness Against Adversarial Attack. InProceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR). IEEE, 588–597. https://doi.org/10.1109/CVPR.2019.00068

    arXiv 2019

  43. [46]

    Masoud Heidary and Biresh Kumar Joardar. 2024. Hardware Attacks on ReRAM-Based AI Accelerators. InIEEE 17th Dallas Circuits and Systems Conference (DCAS). IEEE, 1–4. https://doi.org/10.1109/DCAS61159.2024.10539864

    arXiv 2024

  44. [47]

    Péter Horváth, Dirk Lauret, Zhuoran Liu, and Lejla Batina. 2024. SoK: neural network extraction through physical side channels. InSEC ’24: Proceedings of the 33rd USENIX Conference on Security Symposium. Usenix. https://www. usenix.org/conference/usenixsecurity24/presentation/horvath

    2024

  45. [48]

    2024.In situcryptography in a neuromorphic vision sensor based on light-driven memristors.Applied Physics Reviews11, 1 (2024), 011411

    Lingxiang Hu, Jiale Shao, Jingrui Wang, Peihong Cheng, Li Zhang, Yang Chai, Zhizhen Ye, and Fei Zhuge. 2024.In situcryptography in a neuromorphic vision sensor based on light-driven memristors.Applied Physics Reviews11, 1 (2024), 011411. https://doi.org/10.1063/5.0185502 30 Sorrentino et al

    work page doi:10.1063/5.0185502 2024

  46. [49]

    Eric Hunsberger and Chris Eliasmith. 2015. Spiking Deep Networks with LIF Neurons. arXiv:1510.08829 [cs.NE]

    Pith/arXiv arXiv 2015

  47. [50]

    Ibrahim, Heorhii Skovorodnikov, and Hoda Alkhzaimi

    Hebatallah M. Ibrahim, Heorhii Skovorodnikov, and Hoda Alkhzaimi. 2024. Resilience evaluation of memristor based PUF against machine learning attacks.Scientific Reports14, 1 (2024), 23962. https://doi.org/10.1038/s41598-024- 73839-1

    doi:10.1038/s41598-024- 2024

  48. [51]

    Giacomo Indiveri and Shih-Chii Liu. 2015. Memory and Information Processing in Neuromorphic Systems.Proc. IEEE103, 8 (2015), 1379–1397. https://doi.org/10.1109/JPROC.2015.2444094

    arXiv 2015

  49. [52]

    Pietro Inglese, Elena-Ioana Vatajelu, and Giorgio Di Natale. 2023. Side channel and fault analyses on memristor-based logic in-memory.IEEE Design & Test41, 3 (2023), 29–35. https://doi.org/10.1109/MDAT.2023.3324522

    arXiv 2023

  50. [53]

    Pegah Iranfar, Abdolah Amirany, and Mohammad Hossein Moaiyeri. 2025. Power Attack-Immune Spintronic-Based AES Hardware Accelerator for Secure and High-Performance PiM Architectures.IEEE Transactions on Magnetics (2025). https://doi.org/10.1109/TMAG.2025.3544409

    arXiv 2025

  51. [54]

    Pegah Iranfar, Abdolah Amirany, Mohammad Hossein Moaiyeri, and Kian Jafari. 2024. On the Layout-Oriented Investigation of Power Attack Hardness of Spintronic-Based Logic Circuits.Circuits, Systems, and Signal Processing 43, 5 (2024), 3212–3237. https://doi.org/10.1007/s00034-024-02603-7

    work page doi:10.1007/s00034-024-02603-7 2024

  52. [55]

    Yuval Ishai, Amit Sahai, and David Wagner. 2003. Private Circuits: Securing Hardware against Probing Attacks. In Advances in Cryptology - CRYPTO 2003. Vol. 2729. Springer, Berlin, Heidelberg, 463–481. https://doi.org/10.1007/978- 3-540-45146-4_27

    doi:10.1007/978- 2003

  53. [56]

    Can Dikmen

    Murat Isik, Hiruna Vishwamith, Yusuf Sur, Kayode Inadagbo, and I. Can Dikmen. 2024. NEUROSEC: FPGA-Based Neuromorphic Audio Security. InApplied Reconfigurable Computing. Architectures, Tools, and Applications. Springer Nature Switzerland, Cham, 134–147. https://doi.org/10.1007/978-3-031-55673-9_10

    work page doi:10.1007/978-3-031-55673-9_10 2024

  54. [57]

    Alex James, Chithra Reghuvaran, and Leon Chua. 2025. Processing In-Memory PUF Watermark Embedding with Cellular Memristor Network.IEEE Transactions on Emerging Topics in Computing(2025). https://doi.org/10.1109/ TETC.2025.3528336

    arXiv 2025

  55. [58]

    Duhyun Jeon, Jong Hak Baek, Yong-Duck Kim, Jaeseong Lee, Dong Kyue Kim, and Byong-Deok Choi. 2019. A Physical Unclonable Function With Bit Error Rate Less Than 2.3e-8 Based on Contact Formation Probability Without Error Correction Code.IEEE Journal of Solid-State Circuits55, 3 (2019), 805–816. https://doi.org/10.1109/JSSC.2019.2951415

    arXiv 2019

  56. [59]

    Zhen Hang Jiang, Yunsi Fei, Aidong Adam Ding, and Thomas Wahl. 2020. Mempoline: Mitigating memory-based side- channel attacks through memory access obfuscation.Cryptology ePrint Archive(2020). https://eprint.iacr.org/2020/653

    2020

  57. [60]

    Rohit Abraham John, Nimesh Shah, Sujaya Kumar Vishwanath, et al . 2021. Halide perovskite memristors as flexible and reconfigurable physical unclonable functions.Nature Communications12, 1 (2021), 3681. https: //doi.org/10.1038/s41467-021-24057-0

    work page doi:10.1038/s41467-021-24057-0 2021

  58. [61]

    Zalfa Jouni and Haralampos-G Stratigopoulos. 2025. STDP-Trained Spiking Neural Network Reliability Assessment Through Fault Injections. In31st IEEE International Symposium on On-Line Testing and Robust System Design. IEEE, Ischia, Italy. https://doi.org/10.1109/IOLTS65288.2025.11116934

    arXiv 2025

  59. [62]

    Nisa Bostanci, Ataberk Olgun, A

    Konstantinos Kanellopoulos, F. Nisa Bostanci, Ataberk Olgun, A. Giray Yaglikci, Ismail Emir Yuksel, Nika Mansouri Ghiasi, Zulal Bingol, Mohammad Sadrosadati, and Onur Mutlu. 2024. Amplifying Main Memory-Based Timing Covert and Side Channels using Processing-in-Memory Operations. arXiv:2404.11284 [cs.CR]

    Pith/arXiv arXiv 2024

  60. [63]

    Paul Kocher, Jann Horn, Anders Fogh, et al. 2019. Spectre Attacks: Exploiting Speculative Execution. InSymposium on Security and Privacy (SP). IEEE, San Francisco, CA, USA, 1–19. https://doi.org/10.1109/SP.2019.00002

    arXiv 2019

  61. [64]

    Paul Kocher, Joshua Jaffe, and Benjamin Jun. 1999. Differential power analysis. InAnnual international cryptology conference. Springer, 388–397. https://doi.org/10.1007/3-540-48405-1_25

    doi:10.1007/3-540-48405-1_25 1999

  62. [65]

    Sarada Krithivasan, Sanchari Sen, Nitin Rathi, Kaushik Roy, and Anand Raghunathan. 2022. Efficiency attacks on spiking neural networks. InProceedings of the 59th ACM/IEEE Design Automation Conference. ACM, San Francisco California, 373–378. https://doi.org/10.1145/3489517.3530443

    arXiv 2022

  63. [66]

    Takaya Kubota, Kota Yoshida, Mitsuru Shiozaki, and Takeshi Fujino. 2021. Deep learning side-channel attack against hardware implementations of AES.Microprocessors and Microsystems87 (2021), 103383. https://doi.org/10.1016/j. micpro.2020.103383

    arXiv 2021

  64. [67]

    Souvik Kundu, Massoud Pedram, and Peter A Beerel. 2021. Hire-snn: Harnessing the inherent robustness of energy- efficient deep spiking neural networks by training with crafted input noise. InProceedings of the IEEE/CVF international conference on computer vision. IEEE, 5209–5218. https://doi.org/10.1109/ICCV48922.2021.00516

    arXiv 2021

  65. [68]

    Corey Lammie, Julian Büchel, Athanasios Vasilopoulos, Manuel Le Gallo, and Abu Sebastian. 2025. The inherent adversarial robustness of analog in-memory computing.Nature Communications16, 1 (2025), 1756. https://doi.org/ 10.1038/s41467-025-56595-2

    work page doi:10.1038/s41467-025-56595-2 2025

  66. [69]

    Jiaxin Li, Gorka Abad, Stjepan Picek, and Mauro Conti. 2025. Membership Privacy Evaluation in Deep Spiking Neural Networks.Springer Nature Switzerland(2025), 207–227. https://doi.org/10.1007/978-3-032-07884-1_11

    work page doi:10.1007/978-3-032-07884-1_11 2025

  67. [70]

    Jiachen Li, Bang Wu, Xiaoyu Xia, Xiaoning Liu, Xun Yi, and Xiuzhen Zhang. 2025. Unsupervised Backdoor Detection and Mitigation for Spiking Neural Networks. arXiv:2510.06629 [cs.CR] Emerging Threats and Countermeasures in Neuromorphic Systems: A Survey 31

    arXiv 2025

  68. [71]

    Taixin Li, Boran Sun, Hongtao Zhong, Yixin Xu, Vijaykrishnan Narayanan, Liang Shi, Tianyi Wang, Yao Yu, Thomas Kämpfe, Kai Ni, Huazhong Yang, and Xueqing Li. 2024. ProtFe: Low-Cost Secure Power Side-Channel Protection for General and Custom FeFET-Based Memories.ACM Transactions on Design Automation of Electronic Systems29, 1 (2024), 1–18. https://doi.org/...

    work page doi:10.1145/3604589 2024

  69. [72]

    Xueqi Li, Bin Gao, Qi Qin, et al . 2025. Federated learning using a memristor compute-in-memory chip with in situ physical unclonable function and true random number generator.Nature Electronics(2025), 1–11. https: //doi.org/10.1038/s41928-025-01390-6

    work page doi:10.1038/s41928-025-01390-6 2025

  70. [73]

    Ling Liang, Xing Hu, Lei Deng, Yujie Wu, Guoqi Li, Yufei Ding, Peng Li, and Yuan Xie. 2021. Exploring adversarial attack in spiking neural networks with spike-compatible gradient.IEEE transactions on neural networks and learning systems34, 5 (2021), 2569–2583. https://doi.org/10.1109/TNNLS.2021.3106961

    arXiv 2021

  71. [74]

    Ling Liang, Kaidi Xu, Xing Hu, Lei Deng, and Yuan Xie. 2022. Toward robust spiking neural network against adversarial perturbation.Advances in Neural Information Processing Systems35 (2022), 10244–10256. https://doi.org/ 10.5555/3600270.3601014

    arXiv 2022

  72. [75]

    Chit-Kwan Lin, Andreas Wild, Gautham N Chinya, Yongqiang Cao, Mike Davies, Daniel M Lavery, and Hong Wang

  73. [76]

    Moritz Lipp, Michael Schwarz, Daniel Gruss, et al. 2020. Meltdown: reading kernel memory from user space.Commun. ACM63, 6 (2020), 46–56. https://doi.org/10.1145/3357033

    work page doi:10.1145/3357033 2020

  74. [78]

    Li Lun, Kunyu Feng, Qinglong Ni, Ling Liang, Yuan Wang, Ying Li, Dunshan Yu, and Xiaoxin Cui. 2025. Towards Effective and Sparse Adversarial Attack on Spiking Neural Networks via Breaking Invisible Surrogate Gradients. In Proceedings of the Computer Vision and Pattern Recognition Conference. IEEE, 3540–3551. https://doi.org/10.1109/ CVPR52734.2025.00335

    arXiv 2025

  75. [79]

    Hao Lv, Bing Li, Lei Zhang, Cheng Liu, and Ying Wang. 2022. Variation enhanced attacks against rram-based neuromorphic computing system.IEEE Transactions on Computer-Aided Design of Integrated Circuits and Systems42, 5 (2022), 1588–1596. https://doi.org/10.1109/TCAD.2022.3207316

    arXiv 2022

  76. [80]

    Jubayer Mahmod and Matthew Hicks. 2024. UnTrustZone: Systematic Accelerated Aging to Expose On-chip Secrets. InSymposium on Security and Privacy (SP). IEEE, San Francisco, CA, USA, 4107–4124. https://doi.org/10.1109/SP54263. 2024.00069

    arXiv 2024

  77. [82]

    Massoud Masoumi. 2020. Novel Hybrid CMOS/Memristor Implementation of the AES Algorithm Robust Against Differential Power Analysis Attack.IEEE Transactions on Circuits and Systems II: Express Briefs67, 7 (2020), 1314–1318. https://doi.org/10.1109/TCSII.2019.2932337

    arXiv 2020

  78. [83]

    Mehonic and A

    A. Mehonic and A. J. Kenyon. 2022. Brain-inspired computing needs a master plan.Nature604, 7905 (2022), 255–260. https://doi.org/10.1038/s41586-021-04362-w

    doi:10.1038/s41586-021-04362-w 2022

  79. [84]

    Cory Merkel and Allen Su. 2025. Power Analysis Attacks on NVM Crossbar-based Neuromorphic Systems.Neural Processing Letters57, 1 (2025), 17. https://doi.org/10.1007/s11063-025-11730-4

    work page doi:10.1007/s11063-025-11730-4 2025

  80. [85]

    Vincent Meyers, Michael Hefenbrock, Dennis Gnad, and Mehdi Tahoori. 2024. Trained to leak: Hiding trojan side-channels in neural network weights. InIEEE International Symposium on Hardware Oriented Security and Trust (HOST). IEEE, 122–127. https://doi.org/10.1109/HOST55342.2024.10545350

    arXiv 2024

Showing first 80 references.

This paper was first reviewed by deepseek-v4-flash on August 4, 2026.