With the mainstream integration of machine learning into security-sensitive
domains such as healthcare and finance, concerns about data privacy have
intensified. Conventional artificial neural networks (ANNs) have been found
vulnerable to several attacks that can leak sensitive data. Particularly, model
inversion (MI) attacks enable the reconstruction of data samples that have been
used to train the model. Neuromorphic architectures have emerged as a paradigm
shift in neural computing, enabling asynchronous and energy-efficient
computation. However, little to no existing work has investigated the privacy
of neuromorphic architectures against model inversion. Our study is motivated
by the intuition that the non-differentiable aspect of spiking neural networks
(SNNs) might result in inherent privacy-preserving properties, especially
against gradient-based attacks. To investigate this hypothesis, we propose a
thorough exploration of SNNs' privacy-preserving capabilities. Specifically, we
develop novel inversion attack strategies that are comprehensively designed to
target SNNs, offering a comparative analysis with their conventional ANN
counterparts. Our experiments, conducted on diverse event-based and static
datasets, demonstrate the effectiveness of the proposed attack strategies and
therefore questions the assumption of inherent privacy-preserving in
neuromorphic architectures.

通过对神经形态结构的隐私保护能力进行全面的研究，我们开发了一种新颖的反转攻击策略，与传统的人工神经网络进行比较分析，实验证明提出的攻击策略的有效性，并对神经形态结构的内隐私保护假设提出了质疑。

脑泄漏：关于神经形态结构的隐私保护特性与模型反演攻击

BrainLeaks: On the Privacy-Preserving Properties of Neuromorphic  Architectures against Model Inversion Attacks

Backpropagation of error (backprop) is a powerful algorithm for training
machine learning architectures through end-to-end differentiation. However,
backprop is often criticised for lacking biological plausibility. Recently, it
has been shown that backprop in multilayer-perceptrons (MLPs) can be
approximated using predictive coding, a biologically-plausible process theory
of cortical computation which relies only on local and Hebbian updates. The
power of backprop, however, lies not in its instantiation in MLPs, but rather
in the concept of automatic differentiation which allows for the optimisation
of any differentiable program expressed as a computation graph. Here, we
demonstrate that predictive coding converges asymptotically (and in practice
rapidly) to exact backprop gradients on arbitrary computation graphs using only
local learning rules. We apply this result to develop a straightforward
strategy to translate core machine learning architectures into their predictive
coding equivalents. We construct predictive coding CNNs, RNNs, and the more
complex LSTMs, which include a non-layer-like branching internal graph
structure and multiplicative interactions. Our models perform equivalently to
backprop on challenging machine learning benchmarks, while utilising only local
and (mostly) Hebbian plasticity. Our method raises the potential that standard
machine learning algorithms could in principle be directly implemented in
neural circuitry, and may also contribute to the development of completely
distributed neuromorphic architectures.

研究发现，通过局部学习规则，预测编码可以渐近（且实际上很快）地收敛到任意计算图上的精确反向传播梯度，这使得标准机器学习算法理论上可以直接用神经电路实现，从而为分布式神经形态结构的开发做出了贡献。