SpyKing-Privacy-preserving framework for Spiking Neural Networks

Abstract

Artificial intelligence (AI) models, frequently built using deep neural networks (DNNs), have become integral to many aspects of modern life. However, the vast amount of data they process is not always secure, posing potential risks to privacy and safety. Fully Homomorphic Encryption (FHE) enables computations on encrypted data while preserving its confidentiality, making it a promising approach for privacy-preserving AI. This study evaluates the performance of FHE when applied to DNNs and compares it with Spiking Neural Networks (SNNs), which more closely resemble biological neurons and, under certain conditions, may achieve superior results. Using the SpyKing framework, we analyze key challenges in encrypted neural computations, particularly the limitations of FHE in handling non-linear operations. To ensure a comprehensive evaluation, we conducted experiments on the MNIST, FashionMNIST, and CIFAR10 datasets while systematically varying encryption parameters to optimize SNN performance. Our results show that FHE significantly increases computational costs but remains viable in terms of accuracy and data security. Furthermore, SNNs achieved up to 35% higher absolute accuracy than DNNs on encrypted data with low values of the plaintext modulus t. These findings highlight the potential of SNNs in privacy-preserving AI and underscore the growing need for secure yet efficient neural computing solutions.

Keywords: Deep Neural Network (DNN); Homomorphic Encryption (HE); LeNet5; Spiking Neural Network (SNN); machine learning; privacy-preserving; safety; security.

Figure 1

A summary flowchart of the SpyKing research project.

Figure 2

An example of a spiking neuron that activates only after receiving the necessary charge to surpass the threshold, undergoing a refractory period before returning to a resting state.

Figure 3

A HE scheme with a clear separation between client and server, where the data and results in plaintext are visible only to the client.

Figure 4

LeNet5 model with each layer and matrix size for FashionMNIST and MNIST training.

Figure 5

LeNet5 model with each layer and matrix size for CIFAR10 training.

Figure 6

In the Spiking-LeNet5 the neurons fire randomly during the seq_length and the result is each time a portion of the total image, in this case it is the Ankle Boot, label 9 in the FashionMNIST dataset.

Figure 7

On the left we have the native Ankle Boot (Label 9 in the FashionMNIST dataset) image, while on the right there is the sum of the temporal sequence seq_length of Figure 6.

Figure 8

SpyKing experimental setup.

Figure 9

Accuracy and loss during training and validation of LeNet5 and Spiking-LeNet5 for the FashionMNIST dataset. The figure shows accuracy and loss values across different training epochs.

Figure 10

Comparison matrix for t and m variation for the FashionMNIST dataset on encrypted LeNet5 and Spiking-LeNet5 models.

Figure 11

FashionMNIST accuracy on encrypted LeNet5 for t variation with m set to 1,024.

Figure 12

FashionMNIST accuracy on encrypted Spiking-LeNet5 for t variation with m set to 1,024.

Figure 13

Comparison of FashionMNIST accuracy between plaintext and encrypted versions of LeNet5 and Spiking-LeNet5 for t variations when both plaintext and encrypted versions classified correctly.

Figure 14

Comparison of FashionMNIST accuracy between plaintext and encrypted versions of LeNet5 and Spiking-LeNet5 for t variations when both plaintext and encrypted versions coincide in both correct and incorrect classification.

Figure 15

Inside the LeNet5 we need to decrypt and encrypt again four times because the activation function ReLu is not a linear calculation.

Figure 16

NB qualitative variation during the process across the layers.

Figure 17

NB qualitative variation for each t variation.

Figure 18

Plaintext confusion matrix for FashionMNIST. The Shirt class is the one that misleads the model the most.

Figure 19

Encrypted confusion matrix for FashionMNIST with t and m variation. It can be noticed that for low values of t, the results tend to concentrate on labels that resemble each other the most. Spiking-LeNet5 is less random than LeNet5 for low values of t.

Figure 20

Errors layer-by-layer with FashionMNIST and m = 1,024. The top Red strip represents the errors in the layers of the LeNet5, the Blue strip in the middle represents the errors in the layers of the Spiking-LeNet5. The last strip at the bottom represents the difference between the errors in the layers of LeNet-5 and Spiking-LeNet5. It can be noticed that the third strip is predominantly Red, indicating that Spiking-LeNet5 generally performs better.