Temporal Amplification-Aware Differential Privacy for SNNs

Spiking Neural Networks (SNNs) [1] have emerged as an energy-efficient alternative to conventional Artificial Neural Networks (ANNs). As SNNs are increasingly considered for privacy-sensitive applications, protecting their training data is becoming increasingly important. Differential Privacy (DP) [2], commonly implemented through Differentially Private Stochastic Gradient Descent (DP-SGD) [3], provides formal privacy guarantees by clipping per-sample gradients and adding calibrated Gaussian noise. However, the application of DP to SNNs remains limited, and existing approaches largely adopt clipping strategies developed for conventional neural networks. Unlike ANNs, SNNs propagate gradients across multiple simulation timesteps through Backpropagation Through Time (BPTT), where temporal membrane dynamics and surrogate gradients can influence per-sample gradient magnitudes. In this work, we introduce the Temporal Amplification Factor (TAF), defined as the ratio of the mean per-example gradient norm of an SNN to that of an architecturally equivalent ANN. We show that, as the number of timesteps increases, this ratio generally increases, demonstrating temporal gradient amplification in SNNs, as shown in Figure 1. Motivated by this observation, we derive a theoretical upper bound on temporal gradient amplification that explicitly accounts for membrane dynamics and surrogate gradients (Theorem 1). Based on this bound, we propose a temporal-aware clipping strategy for differentially private SNN training, defined in Eq. 5. Theorem 1. Let $V_t$ be the membrane potential at time $t$, $\tau$ be the leak factor $(0<\tau<1)$, $w$ be the synaptic weight, $x_t$ be the input spike, $S_t$ be the emitted spike, $V_{\mathrm{th}}$ be the firing threshold, $H$ be the Heaviside step function, and $T$ be the total number of timesteps. The membrane update of a discrete-time LIF neuron is defined as $$ V_t = \tau V_{t-1} + w x_t - S_{t-1}V_{\mathrm{th}}, \qquad S_{t+1} = H(V_t - V_{\mathrm{th}}). $$ Assume that the surrogate gradient satisfies $$ 0 \leq \phi'(V_t) \leq C_{\mathrm{surr}}, \qquad \forall t, $$ and define the stability constant $$ \beta = \max\left( \tau, \left|\tau - V_{\mathrm{th}}C_{\mathrm{surr}}\right| \right). $$ If $\beta < 1$, then the temporal gradient is bounded as follows: $$ |g_t| \leq \frac{1-\beta^t}{1-\beta}. $$ Based on the temporal amplification bound, we replace the conventional fixed DP-SGD clipping threshold $C_{\mathrm{naive}}$ with $$ C^* = C_{\mathrm{naive}} C_{\mathrm{surr}} \frac{1-\beta^T}{1-\beta}. (5) $$ We evaluate the proposed approach on four benchmark datasets: MNIST, CIFAR-10, DVS-CIFAR10, and DVS Gesture. We evaluate Temporal-Aware DP under privacy budgets $\epsilon \in \{3,10,15,20\}$ with $\delta=10^{-5}$. The proposed method achieves higher classification accuracy than conventional DP-SGD in 14 of the 16 evaluated settings. At $\epsilon=15$, accuracy improves from 32.43% to 48.14% on CIFAR-10, 97.49% to 98.07% on MNIST, 17.40% to 22.10% on DVS-CIFAR10, and 21.53% to 29.17% on DVS Gesture. Our results highlight the importance of accounting for temporal gradient dynamics in differentially private SNN training. References [1] W. Maass, “Networks of spiking neurons: The third generation of neural network models,” Neural Networks, vol. 10, no. 9, pp. 1659–1671, 1997. [2] C. Dwork et al. “The algorithmic foundations of differential privacy,” Foundations and Trends in Theoretical Computer Science, vol. 9, no. 3–4, pp. 211–407, 2014. [3] M. Abadi et al. “Deep learning with differential privacy,” in Proceedings of the 2016 ACM SIGSAC Conference on Computer and Communications Security, pp. 308–318, 2016.