Fast and Effective Backdoor Removal in Federated Spiking Neural Networks via Temporal Synaptic Sanitization

Abstract

Federated learning enables privacy-preserving training of spiking neural networks on distributed neuromorphic and event-based data, but it also exposes the global model to stealthy backdoor attacks injected by malicious clients. Compared with conventional artificial neural networks, federated spiking neural networks are more difficult to sanitize because malicious behavior may be encoded not only in spatial filters but also in spike timing, membrane dynamics, and temporal firing sparsity. Existing backdoor defenses usually require repeated federated retraining, access to client data, trigger synthesis, or computationally expensive model repair, which limits their practicality in low-power neuromorphic deployment. This paper proposes FedTSR, a fast post-training backdoor removal framework for spiking neural networks trained through federated learning. FedTSR introduces two coordinated algorithms: temporal synaptic risk estimation, which identifies backdoor-sensitive synaptic groups by measuring abnormal spike-response contributions across simulation timesteps using a small clean calibration set, and spike-consistency recalibration, which restores benign task performance through lightweight membrane-potential alignment and firing-rate regularization without restarting federated training. The proposed method is trigger-agnostic, client-independent, and compatible with surrogate-gradient trained spiking models. Here, trigger-agnostic means that FedTSR does not use trigger identity during repair; it should not be interpreted as certified robustness against every adaptive trigger family. Experiments on real neuromorphic and vision benchmarks, including N-MNIST, CIFAR10-DVS, DVS Gesture, and CIFAR-10, show that FedTSR substantially reduces attack success rate while preserving clean accuracy under multiple backdoor patterns, poisoning ratios, and non-IID federated settings. The results indicate that exploiting temporal spike dynamics provides an efficient and effective route for sanitizing compromised federated spiking neural networks.

1. Introduction

Spiking neural networks (SNNs) have become an important learning paradigm for neuromorphic and event-driven intelligence because they represent information through sparse spike trains and can exploit temporal dynamics for low-power inference. Different from artificial neural networks that process continuous activations, SNNs integrate synaptic currents into membrane potentials and emit discrete spikes only when firing thresholds are reached. This event-driven mechanism is attractive for edge perception, autonomous sensing, and human–machine interaction, especially when inputs are naturally asynchronous, such as dynamic vision sensor streams. Recent advances in surrogate-gradient learning and deep spiking architectures have significantly improved the accuracy of directly trained SNNs, making them increasingly practical for real-world deployment [1,2,3,4,5,6].

At the same time, many neuromorphic applications are inherently distributed. Event cameras, wearable sensors, mobile robots, and embedded monitoring devices often collect private or location-sensitive data that cannot be centralized. Federated learning provides a natural framework for such scenarios by allowing clients to collaboratively train a global model through model-update aggregation rather than raw-data sharing [7,8]. Recent studies have therefore explored federated SNN training, asynchronous neuromorphic collaboration, vertical federated spiking learning, and energy-aware hierarchical SNN systems [9,10,11,12,13]. These studies show that federated SNNs can combine privacy-preserving distributed learning with efficient spike-based inference. However, the same distributed training process also creates a serious security risk: the server may aggregate malicious local updates into the global SNN without being able to inspect the clients’ private data.

Backdoor attacks are among the most concerning threats in federated learning. In a backdoored model, clean inputs are classified normally, but inputs containing a hidden trigger are forced into an attacker-specified target class. Classical backdoor attacks have been widely studied in centralized neural networks [14,15], and federated learning further amplifies the threat because malicious clients can poison only local data or scale their updates while still participating in normal aggregation [16,17,18]. Recent federated attacks have become increasingly adaptive, including covert attacks, data-free fake-client attacks, practical deployment-oriented attacks, and multi-label adversarial conflicts [19,20,21,22,23]. For SNNs, the problem is even more subtle. A trigger may be encoded not only as a spatial patch, but also as a short spike burst, a delayed event pattern, or a hybrid spatio-temporal signal. Recent attacks against neuromorphic and federated SNNs demonstrate that malicious behavior can exploit spike timing, temporal windows, and distributed event slices [24,25,26,27].

Although many backdoor defenses have been proposed, directly applying them to SNNs trained through federated learning is insufficient. Trigger-reconstruction methods assume that a compact trigger can be recovered from model behavior, but temporal triggers in SNNs may not correspond to a single static pattern [28]. Fine-pruning and attention distillation can remove some suspicious neurons, but they mainly depend on activation magnitude or attention similarity and may damage sparse event-driven representations [29,30]. Adversarial neuron pruning improves post-training repair by identifying sensitive neurons, but it still does not explicitly model timestep-wise membrane contribution or spike concentration [31]. More recent defenses have considered adversarial neuron noise, data-free federated sanitization, and consistency-based vertical federated defense [32,33,34]; nevertheless, these methods are not designed for the temporal membrane dynamics that determine SNN decisions. SNN-specific backdoor mitigation has begun to use membrane-potential evidence [35], but fast trigger-agnostic repair for SNNs trained through federated learning remains underexplored.

This paper studies the following problem: given an SNN trained through federated learning ${\theta }^{★}$ that may contain a backdoor, how can the server quickly construct a sanitized model $\widehat{\theta }$ using only a small clean calibration set ${\mathcal{D}}_c$, without knowing the trigger $\tau (·)$, the target label $y_{\mathrm{tar}}$, or the malicious clients? This setting is practical because a deployed server may only possess the final global model and a small amount of verified clean data. It is also challenging because ordinary clean accuracy cannot reveal whether the model has learned a hidden temporal shortcut. In addition, restarting federated training is often expensive or impossible, since clients may be offline, communication may be limited, and private training data remain inaccessible.

To address this challenge, we propose FedTSR, a fast post-training backdoor removal framework based on temporal synaptic sanitization. The key idea is that backdoor-sensitive pathways in SNNs often exhibit abnormal temporal behavior: they produce concentrated membrane contributions over a small number of timesteps, deviate from the normal layer-level firing population, and strongly align with a narrow set of output classes. FedTSR therefore estimates a group-wise temporal synaptic risk score $R_{\mathcal{l},g}$ for each synaptic group g in layer ℓ. The score combines temporal concentration $A_{\mathcal{l},g}$, firing deviation $B_{\mathcal{l},g}$, and class-response concentration $D_{\mathcal{l},g}$, and is converted into a continuous risk mask ${\pi }_{\mathcal{l},g}$. High-risk synaptic groups are softly damped rather than completely pruned, which weakens suspicious pathways while retaining useful capacity for clean inference.

FedTSR further introduces spike-consistency recalibration to recover benign performance after risk-adaptive damping. The recalibration objective combines clean-label supervision, output consistency with the original model on correctly predicted clean samples, temporal spike and membrane consistency, and a risk-anchoring term that prevents high-risk groups from regaining their original suspicious strength. This design is important for SNNs because clean accuracy depends not only on final class logits but also on stable temporal firing regimes. By preserving layer-level spike and membrane statistics while suppressing high-risk synaptic groups, FedTSR avoids the two common failure modes of post-training repair: leaving temporal backdoors active or over-suppressing useful sparse representations.

The main contributions of this paper are threefold. First, we formulate fast post-training backdoor removal for SNNs trained through federated learning under a strict trigger-agnostic and client-independent threat model, where the defender only uses ${\theta }^{★}$ and ${\mathcal{D}}_c$. Second, we propose temporal synaptic risk estimation, a group-wise mechanism that identifies suspicious SNN pathways through timestep-wise membrane contribution, firing deviation, and class-response concentration. Third, we develop spike-consistency recalibration, which restores benign spike dynamics after risk-adaptive damping without restarting federated optimization. Extensive experiments on N-MNIST, CIFAR10-DVS, DVS Gesture, and CIFAR-10 show that FedTSR substantially reduces attack success rate while preserving clean accuracy under static, temporal, and hybrid triggers, demonstrating that explicitly modeling temporal spike dynamics is an effective route for sanitizing compromised federated SNNs.

FedTSR is not intended to replace all training-time federated defenses or certified backdoor defenses. Its contribution is a practical post-training repair mechanism that explicitly uses timestep-wise SNN dynamics when only the final global model and a small calibration set are available.

2. Related Work

2.1. Federated Learning and Federated Spiking Neural Networks

Federated learning trains a shared model through repeated communication between a server and distributed clients without directly collecting private client data. FedAvg established the standard weighted-aggregation paradigm for cross-device learning [7], and later studies systematized the broader challenges of statistical heterogeneity, communication cost, privacy, and robustness in federated systems [8]. These challenges are directly relevant to the setting of this paper because the server observes only model updates or the final global model, while the local data distributions ${\mathcal{P}}_k(x,y)$ can be highly non-IID. In such a setting, malicious behavior may be hidden behind ordinary client drift, making post-training repair more difficult than in centralized learning.

Spiking neural networks have attracted increasing attention because their event-driven computation can reduce energy consumption on neuromorphic hardware. Early federated spiking learning showed that SNNs can be trained cooperatively without centralizing data [9], while asynchronous federated neuromorphic learning further studied how communication and client timing affect SNN optimization [10]. More recent work has improved federated SNN training through hint-layer knowledge distillation and spike-feature compression [11]. Vertical federated SNNs have also been explored, showing that spiking models can be integrated into feature-partitioned collaboration scenarios [12]. Hierarchical federated SNNs have been applied to intrusion detection to reduce energy cost in distributed networked systems [13]. These studies demonstrate the feasibility of federated SNN training, but they mainly focus on accuracy, communication, and energy efficiency rather than backdoor removal after the global SNN has already been compromised.

The security problem considered in this paper is also shaped by recent progress in direct SNN training. Surrogate-gradient learning enables backpropagation through non-differentiable spike functions and has become a common tool for training deep SNNs [1]. Theoretical and practical analyses of surrogate-gradient learning further clarify why temporal credit assignment is essential for SNN optimization [2]. A comprehensive treatment of deep-learning techniques for SNNs explains how surrogate gradients, temporal readout, and neuron dynamics influence performance [3]. Recent studies further improved direct training by reviewing high-performance deep SNN architectures [4], balancing surrogate gradients and sparsity through masked surrogate gradients [5], and mitigating gradient vanishing through shortcut back-propagation [6]. These advances make federated SNNs more practical, but they also make backdoor repair more subtle. A malicious pathway may be encoded in spike timing, membrane accumulation, and timestep-specific shortcut responses, rather than in a simple static parameter pattern.

2.2. Backdoor Threats in Federated and Spiking Models

Backdoor attacks force a trained model to behave normally on clean inputs while producing attacker-specified predictions when a trigger $\tau (·)$ is present. In centralized learning, BadNets showed that poisoning a small portion of training data can implant a hidden trigger into a neural network [14], and subsequent trojaning attacks demonstrated that malicious functionality can also be inserted through model-level manipulation [15]. In federated learning, the threat becomes more severe because malicious clients can poison local data, manipulate local training, or scale model updates before aggregation. Model-replacement attacks showed that a malicious client can force the global model toward a backdoored solution while maintaining high clean accuracy [16]. Distributed backdoor attacks decomposed a global trigger into client-specific sub-triggers, making the attack more compatible with federated aggregation [17]. Earlier analysis also showed that simple norm clipping or anomaly filtering may be insufficient when attackers adapt their updates to the aggregation rule [18].

Recent federated backdoor studies have made the threat more adaptive and practical. 3DFed introduced an adaptive and extensible covert attack framework against federated defenses [19]. A3FL optimized backdoor triggers adversarially so that the malicious behavior can persist during global training [20]. DarkFed showed that data-free fake clients can still inject effective backdoors into federated learning, weakening the assumption that attackers must own real task data [21]. Practical attacks against deployed federated systems further emphasized that attack success depends on realistic client budgets, aggregation rules, and defense configurations [22]. Multi-label federated backdoor attacks showed that independently acting adversaries with different target labels can create a more complicated threat landscape than the usual single-target setting [23]. Surveys on federated backdoor attacks and defenses summarize these trends and highlight the remaining gap between attack diversity and defense reliability [36]. A later survey further emphasizes that vertical, heterogeneous, and transfer federated systems require threat models beyond the classical horizontal FL setting [37].

Backdoor attacks against SNNs are especially relevant to our work because SNNs use temporal spike trains rather than static activations. Sneaky Spikes showed that neuromorphic SNNs can be backdoored with static, moving, smart, and dynamic triggers while maintaining strong, clean performance [24]. Flashy Backdoor extended this threat to real-world DVS-camera environments, where physical light-based triggers can activate malicious behavior in event streams [25]. A data-poisoning framework for supervised SNN rules further confirmed that poisoning can exploit SNN-specific training dynamics [38]. In federated spiking learning, time-distributed backdoor attacks demonstrated that malicious clients can distribute trigger information across timesteps and devices, making the backdoor harder to detect by static defenses [26]. SpikeWhisper further exploited time-division multiplexing in federated neuromorphic learning, where different malicious clients poison different temporal slices of an event sequence [27]. These studies strongly motivate the threat model in Section 3.2: the defender should not assume knowledge of the trigger pattern, the target label, or the malicious clients, and the repair mechanism must explicitly account for temporal spike dynamics.

2.3. Backdoor Detection and Post-Training Model Repair

Backdoor defenses can be broadly divided into training-time filtering, trigger reconstruction, and post-training model repair. Trigger-reconstruction methods such as Neural cleanse attempt to reverse-engineer a small trigger that causes target-class misclassification [28]. Such methods are useful when the trigger is compact and spatially stable, but they are less suitable for federated SNNs where the trigger may be temporal, distributed across clients, or activated only in selected spike windows. Fine-pruning removes neurons with low clean activation and then fine-tunes the model on clean data [29]. Neural attention distillation transfers benign attention behavior to reduce backdoor effects [30]. Adversarial neuron pruning identifies vulnerable neurons by perturbing model parameters and suppressing neurons that are sensitive to the perturbation [31]. These methods are important baselines for post-training repair, but they were originally designed for conventional neural networks and do not directly measure timestep-wise membrane contribution or firing concentration.

Recent defenses have begun to consider more adaptive attack surfaces. BAN detects backdoors activated by adversarial neuron noise and improves backdoor feature inversion by incorporating neuron activation information [32]. Data-free defenses for federated learning with foundation-model integration constrain abnormal hidden activations during aggregation and seek to mitigate both classic and foundation-model-assisted attacks [33]. Label-consistency-based defense in vertical federated learning uses prediction consistency to identify suspicious behavior without requiring direct access to all parties’ features [34]. These methods improve the robustness of federated or post-training defenses, but they still mainly operate on artificial neural activation patterns, client update statistics, or label-consistency signals. They do not directly address the temporal membrane dynamics that determine whether an SNN produces a triggered output at a particular simulation timestep.

Recent SNN-aware defenses, such as TMPBD/NDSBM, use temporal membrane-potential statistics to detect target labels and suppress suspicious dendritic connections [35]. FedTSR differs from these methods in two respects. First, it repairs an SNN trained through federated learning without requiring target-label detection as a prerequisite. Second, it estimates group-wise temporal synaptic risk across hidden layers, rather than only relying on final-layer membrane-margin evidence. We also distinguish FedTSR from training-time federated robust aggregation, such as FLAME, which filters or clips client updates during the aggregation process [39]; FedTSR is applied after the potentially compromised global SNN has already been obtained. Adaptive federated attacks, including Adapt-LFA, further motivate post-training repair because malicious clients may change label manipulations across training epochs while remaining difficult to identify from update statistics alone [40].

This positioning also moderates the novelty claim. FedTSR does not claim that temporal evidence or membrane potential is new to SNN security. Rather, the methodological difference is that FedTSR uses hidden-layer group-wise synaptic contribution, temporal concentration, firing-population deviation, and class-response concentration to guide a post-training repair objective for federated SNNs. Prior temporal adversarial works such as Sneaky Spikes, time-distributed backdoors, and SpikeWhisper primarily characterize or instantiate attacks [24,26,27], while TMPBD/NDSBM focuses on final-layer membrane-margin detection and dendrite clamping [35]. FedTSR is therefore best viewed as a complementary repair framework, not as a replacement for SNN-specific detection or training-time robust aggregation.

3. Preliminaries

3.1. Federated Spiking Neural Networks

We consider a cross-device federated learning system with K clients and one coordination server. Client k owns a private local dataset ${\mathcal{D}}_k={\left\{(x_i,y_i)\right\}}_{i=1}^{n_k}$, where $x_i$ denotes an input sample and $y_i\in \{1,\dots ,C\}$ is its class label. The total number of training samples is $n={\sum }_{k=1}^K{n}_k$. In a standard federated training round, the server broadcasts the current global model parameters ${\theta }^r$ to selected clients, each selected client locally updates the model on ${\mathcal{D}}_k$, and the server aggregates the returned parameters into ${\theta }^{r+1}$. The global optimization objective is written as ${min}_{\theta }{\mathcal{L}}_{\mathrm{fed}}\left(\theta \right)={\sum }_{k=1}^K(n_k/n){\mathcal{L}}_k\left(\theta \right)$, where ${\mathcal{L}}_k\left(\theta \right)$ is the empirical loss of client k. In the non-IID setting, the local distributions ${\mathcal{P}}_k(x,y)$ may differ substantially across clients, which makes the global model more vulnerable to malicious updates because abnormal local behavior can be partially hidden by natural client drift.

The model trained in this work is a spiking neural network denoted by $F_{\theta }$. Unlike artificial neural networks that process static activations, an SNN represents information through binary spikes over T discrete simulation timesteps. For layer ℓ at timestep t, the presynaptic spike vector is denoted by $s_{\mathcal{l}-1}^t$, the membrane potential by $u_{\mathcal{l}}^t$, and the output spike vector by $s_{\mathcal{l}}^t$. A commonly used discrete leaky integrate-and-fire neuron can be expressed as $u_{\mathcal{l}}^t=\lambda u_{\mathcal{l}}^{t-1}+W_{\mathcal{l}}{s}_{\mathcal{l}-1}^t+b_{\mathcal{l}}-v_{\mathrm{th}}{s}_{\mathcal{l}}^{t-1}$ and $s_{\mathcal{l}}^t=H(u_{\mathcal{l}}^t-v_{\mathrm{th}})$, where $W_{\mathcal{l}}$ and $b_{\mathcal{l}}$ are the synaptic weight matrix and bias, $\lambda \in [0,1)$ is the leakage factor, $v_{\mathrm{th}}$ is the firing threshold, and $H(·)$ is the Heaviside step function. Since $H(·)$ is non-differentiable, surrogate-gradient learning replaces its derivative with a smooth approximation during backpropagation while preserving binary spike generation during the forward pass. The final prediction is obtained from temporal evidence accumulated across timesteps, for example by using the average output membrane potential or spike count. In this paper, $F_{\theta }\left(x\right)$ denotes the predicted class of input x, while $z_{\theta }\left(x\right)\in {\mathbb{R}}^C$ denotes the corresponding class-wise temporal readout before the final decision.

3.2. Backdoor Attacks in Federated SNNs

A backdoor attack injects a hidden malicious behavior into the global model while preserving normal accuracy on clean inputs. Let $\mathcal{A}$ be the set of malicious clients controlled by the adversary, with $\left|\mathcal{A}\right|\ll K$ in a stealthy attack. During federated training, a malicious client modifies part of its local data by applying a trigger transformation $\tau (·)$ and assigning the triggered samples to an attacker-specified target label $y_{\mathrm{tar}}$. A poisoned sample is therefore represented as $(\tau \left(x\right),y_{\mathrm{tar}})$. The malicious client then performs local training on a mixture of clean and poisoned samples and submits the resulting update to the server. The poisoning ratio on a malicious client is denoted by $\rho$, where $\rho =0$ means no poisoned sample is used and larger $\rho$ indicates stronger local poisoning.

For event-based or temporally encoded inputs, the trigger transformation $\tau (·)$ may operate in different domains. A spatial trigger modifies a fixed region of the input frame or event projection, a temporal trigger injects abnormal spikes during selected timesteps, and a hybrid trigger changes both spatial location and spike timing. In an SNN, the same visible trigger can produce different internal effects depending on firing threshold, leakage, temporal encoding, and simulation length. Therefore, a successful backdoor in federated SNNs is not necessarily characterized by a large static weight perturbation. Instead, it may rely on abnormal temporal amplification, where a few synapses produce disproportionately strong postsynaptic responses when trigger-induced spikes arrive at sensitive timesteps.

We evaluate a compromised global model using two complementary metrics. Clean accuracy measures benign task performance on unmodified test samples and is denoted by $\mathrm{ACC}=\mathbb{P}(F_{\theta }\left(x\right)=y)$. Attack success rate measures malicious effectiveness on triggered non-target test samples and is denoted by $\mathrm{ASR}=\mathbb{P}(F_{\theta }\left(\tau \left(x\right)\right)=y_{\mathrm{tar}}\mid y\ne y_{\mathrm{tar}})$. A well-hidden attack aims to keep $\mathrm{ACC}$ high while making $\mathrm{ASR}$ high. A successful defense should reduce $\mathrm{ASR}$ sharply while causing only a small decrease in $\mathrm{ACC}$. In this work, the defender is not assumed to know the trigger pattern, the target label, the malicious clients, or the poisoned local samples. This threat model is stricter than defenses that require trigger reconstruction or malicious-client identification. The only data-side assumption is access to a small calibration set that the server treats as clean. In practice, this set can be obtained from a trusted third-party validation source, from a small server-held holdout collected before federated deployment, or from manually verified deployment samples. This assumption is weaker than requiring access to client training data, and the limitations related to calibration contamination, imbalance, and distribution shift are discussed in Section 5.5.

3.3. Post-Training Backdoor Removal Objective

Let ${\theta }^{★}$ denote the SNN trained through federated learning that may contain a backdoor. The goal of backdoor removal is to construct a sanitized model $\widehat{\theta }$ from ${\theta }^{★}$ using only ${\mathcal{D}}_c$ and model-level observations. The desired sanitized model should satisfy three requirements. First, it should preserve benign predictions, meaning that $F_{\widehat{\theta }}\left(x\right)$ should remain close to $F_{{\theta }^{★}}\left(x\right)$ and to the ground-truth label y for clean samples. Second, it should suppress abnormal trigger-sensitive pathways so that triggered samples no longer collapse to $y_{\mathrm{tar}}$. Third, it should be fast enough for practical use, requiring no communication with clients and no full federated retraining.

To formalize this objective, we view the compromised model as containing two coupled components: benign task parameters and backdoor-sensitive temporal parameters. The defender does not know this decomposition explicitly, but can estimate suspicious behavior from clean temporal responses. For a synaptic group g in layer ℓ, let $a_g^t\left(x\right)$ denote its contribution to postsynaptic membrane variation at timestep t under input x. A synaptic group may be considered risky when its temporal contribution is unusually concentrated, unstable across clean samples, or strongly aligned with a small number of output classes. This intuition is important because backdoor triggers often create shortcut-like spike routes that are rarely needed for normal classification but dominate the decision once activated.

The proposed method in Section 4 instantiates this objective through temporal synaptic risk estimation and spike-consistency recalibration. The former assigns a risk score to synaptic groups by comparing timestep-wise membrane contributions and firing behavior on clean calibration samples. The latter repairs the model by selectively damping high-risk synapses and recalibrating membrane dynamics so that normal firing patterns remain stable. By separating risk localization from lightweight recalibration, the defense targets the temporal structure of SNN backdoors rather than treating the model as a static artificial neural network. This design is the basis for achieving fast yet effective backdoor removal in SNNs trained through federated learning.

4. Methodology

4.1. Overview of FedTSR

This section presents FedTSR, a fast trigger-agnostic framework for removing backdoors from a spiking neural network trained through federated learning. The input to FedTSR is a possibly compromised global model ${\theta }^{★}$ and a small, clean calibration set ${\mathcal{D}}_c$. The output is a sanitized model $\widehat{\theta }$ that preserves clean spiking behavior while suppressing hidden malicious temporal pathways. FedTSR is designed for the post-training setting introduced in Section 3.3; therefore, it does not require access to private client data, malicious-client identities, trigger patterns, or a new round of federated optimization. Figure 1 shows a general pipeline of our proposal.

Figure 1. High-level pipeline of FedTSR. After federated training, the server uses only the aggregated SNN ${\theta }^{★}$ and a small clean calibration set ${\mathcal{D}}_c$. TSRE estimates a temporal synaptic risk mask, risk-adaptive damping weakens high-risk groups, and SCR recalibrates clean spike dynamics to produce the sanitized model $\widehat{\theta }$.

Table 1 summarizes the operational assumptions, inputs, outputs, and main failure cases of FedTSR.

Table 1. FedTSR assumptions, inputs, outputs, and failure cases.

Item	Description
Server inputs	Final federated SNN ${\theta }^{★}$, simulation length T, and a small calibration set ${\mathcal{D}}_c$.
Unknown to defender	Trigger pattern, target label, poisoned samples, malicious clients, poisoning ratio, and client update history after deployment.
Output	Sanitized SNN $\widehat{\theta }$ with low ASR and small clean-accuracy degradation.
No extra requirement	No new communication rounds, no client data inspection, no trigger synthesis, and no full federated retraining.
Expected failure cases	Severely contaminated or distribution-shifted calibration data, adaptive triggers deliberately matching benign temporal statistics, extremely large malicious-client fractions, and hardware-specific SNN dynamics not represented by the software simulator.

The key observation behind FedTSR is that backdoors in spiking neural networks are often encoded as temporally concentrated shortcut responses. In a benign SNN, discriminative evidence is usually accumulated over multiple timesteps and distributed across multiple synaptic groups. By contrast, a triggered input can activate a small number of synaptic groups at highly sensitive timesteps, causing the output readout to move rapidly toward the attacker-specified target class. Such behavior may remain hidden when only static weight norms are inspected, because a malicious pathway can be represented by synapses whose magnitudes are not individually large. FedTSR therefore measures risk from temporal spike-response behavior rather than from static parameters alone.

FedTSR contains two coordinated components. The first component, temporal synaptic risk estimation (TSRE), assigns a risk score to each synaptic group by analyzing its timestep-wise membrane contribution, firing deviation, and class-response concentration on ${\mathcal{D}}_c$. The second component, spike-consistency recalibration (SCR), selectively suppresses high-risk synaptic groups and then performs lightweight calibration to restore benign membrane and spike statistics. These two components instantiate the objective in Section 3.3: TSRE estimates the implicit risk regularizer ${\mathcal{R}}_{\mathrm{risk}}$, while SCR minimizes a calibration loss that balances clean-label supervision, output consistency, and temporal spike consistency.

Let ${\mathcal{G}}_{\mathcal{l}}$ denote the set of synaptic groups in layer ℓ. For a convolutional layer, one group corresponds to all incoming kernels associated with an output channel; for a fully connected layer, one group corresponds to the incoming weight vector of one postsynaptic neuron. This structured grouping avoids unstructured neuron-level noise and makes the sanitization operation compatible with efficient neuromorphic implementation. For a group $g\in {\mathcal{G}}_{\mathcal{l}}$, FedTSR computes a scalar risk value $R_{\mathcal{l},g}$ and a continuous risk mask ${\pi }_{\mathcal{l},g}\in [0,1]$. A larger ${\pi }_{\mathcal{l},g}$ means that the group is more likely to participate in a backdoor-sensitive temporal pathway and will be damped more strongly during model repair.

4.2. Temporal Synaptic Risk Estimation

TSRE estimates whether a synaptic group behaves like a temporally concentrated shortcut under clean calibration inputs. For each sample $x\in {\mathcal{D}}_c$, the original model ${\theta }^{★}$ is simulated for T timesteps. During this simulation, FedTSR records spikes $s_{\mathcal{l}}^t\left(x\right)$, membrane potentials $u_{\mathcal{l}}^t\left(x\right)$, and the contribution of each synaptic group to the postsynaptic membrane. For group g in layer ℓ, its instantaneous contribution is denoted by $h_{\mathcal{l},g}^t\left(x\right)$. In a convolutional layer, $h_{\mathcal{l},g}^t\left(x\right)$ is the feature map produced by the kernels of group g at timestep t; in a fully connected layer, it is the postsynaptic current produced by the incoming weights of neuron g. The average temporal contribution is defined as

$$c_{\mathcal{l},g}^t={\displaystyle \frac{1}{|{\mathcal{D}}_c|}}\sum _{x\in {\mathcal{D}}_c}{\parallel h_{\mathcal{l},g}^t\left(x\right)\parallel }_1,$$

where the norm is normalized by spatial size for convolutional layers. The normalized contribution distribution over time is $p_{\mathcal{l},g}^t=(c_{\mathcal{l},g}^t+ϵ)/{\sum }_{\tau =1}^T(c_{\mathcal{l},g}^{\tau }+ϵ)$, where $ϵ$ is a small numerical constant.

The first risk component is the temporal concentration score. It measures whether a group concentrates its contribution on only a few timesteps:

$$A_{\mathcal{l},g}=1-{\displaystyle \frac{-{\sum }_{t=1}^T{p}_{\mathcal{l},g}^{t}log\left(p_{\mathcal{l},g}^t\right)}{logT}}.$$

When $A_{\mathcal{l},g}$ is close to zero, the group contributes broadly across timesteps; when it is close to one, the group is dominated by a narrow temporal window. This is important because temporal backdoor triggers can exploit a short interval of abnormal spikes to force a target decision while leaving most clean-time behavior apparently normal.

A simple entropy argument explains why $A_{\mathcal{l},g}$ is useful but should not be used alone. If benign evidence is accumulated across T timesteps, the contribution distribution $p_{\mathcal{l},g}^t$ has high entropy and $A_{\mathcal{l},g}\approx 0$. If a shortcut pathway is activated in only $w\ll T$ timesteps, then its entropy is at most $logw$, giving $A_{\mathcal{l},g}\ge 1-log\left(w\right)/log\left(T\right)$. Therefore, temporally sparse malicious shortcuts are statistically separated from broadly accumulated benign evidence. Class-selective benign neurons can also be temporally concentrated, so FedTSR combines $A_{\mathcal{l},g}$ with firing deviation $B_{\mathcal{l},g}$ and class-response concentration $D_{\mathcal{l},g}$; the localization evidence is reported in the ablation and sensitivity analysis.

More formally, consider a stylized benign–shortcut mixture for one layer. Let a benign group have temporal entropy at least $logT-{\delta }_b$, firing deviation at most ${\beta }_b$, and class-response concentration at most ${\delta }_c$. Let a backdoor shortcut place at least $1-{\epsilon }_t$ of its contribution mass inside a trigger window of length $w<T$, have firing deviation at least ${\beta }_b+{\Delta }_b$, and place at least $1-{\epsilon }_c$ of its class response on one target class. Then its temporal entropy is bounded by $logw+O({\epsilon }_{t}logT)$, so the concentration gap satisfies

$$A_{\mathrm{bd}}-A_{\mathrm{ben}}\ge 1-{\displaystyle \frac{logw+O({\epsilon }_{t}logT)}{logT}}-{\displaystyle \frac{{\delta }_b}{logT}}.$$

After the same robust layer-wise normalization, the risk gap increases with this entropy gap, ${\Delta }_b$, and the class-response gap $1-{\epsilon }_c-{\delta }_c$. Thus TSRE is expected to separate malicious from benign groups when the backdoor is temporally narrower, population-wise more abnormal, and class-wise more concentrated than normal evidence. This is a conditional explanation rather than a certified guarantee; adaptive attacks that deliberately match benign entropy, firing deviation, and class response reduce this gap, so the benign-mimic setting is reported later as a limitation.

The second risk component is the firing deviation score. Let $f_{\mathcal{l},g}^t$ be the average firing rate of group g at timestep t on ${\mathcal{D}}_c$. Let ${\mu }_{\mathcal{l}}^t$ and ${\sigma }_{\mathcal{l}}^t$ denote the mean and standard deviation of firing rates across all groups in layer ℓ at timestep t. FedTSR measures deviation as

$$B_{\mathcal{l},g}={\displaystyle \frac{1}{T}}{\displaystyle \sum _{t=1}^T}{\displaystyle \frac{|f_{\mathcal{l},g}^t-{\mu }_{\mathcal{l}}^t|}{{\sigma }_{\mathcal{l}}^t+ϵ}}.$$

This score is not intended to remove all unusual neurons, since class-specialized neurons can be useful. Instead, it is used jointly with temporal concentration and class-response concentration. A benign discriminative group may fire more strongly for a class, but it is less likely to be both temporally sharp and abnormally detached from the layer population.

The third risk component is the class-response concentration score. Let $z_{{\theta }^{★}}\left(x\right)$ be the class-wise temporal readout of the original model. For each class c, FedTSR estimates the contribution sensitivity of group g to the output logit $z_c$ by

$$d_{\mathcal{l},g,c}={\displaystyle \frac{1}{|{\mathcal{D}}_c^{\left(c\right)}|}}\sum _{(x,y)\in {\mathcal{D}}_c^{\left(c\right)}}{\displaystyle \sum _{t=1}^T}\left|⟨{\displaystyle \frac{\mathsf{\partial }{z}_{{\theta }^{★},c}\left(x\right)}{\mathsf{\partial }{u}_{\mathcal{l},g}^t\left(x\right)}},h_{\mathcal{l},g}^t\left(x\right)⟩\right|,$$

where ${\mathcal{D}}_c^{\left(c\right)}=\{(x,y)\in {\mathcal{D}}_c:y=c\}$ and the gradient is computed with the same surrogate derivative used by the SNN. The normalized class-response distribution is $q_{\mathcal{l},g,c}=(d_{\mathcal{l},g,c}+ϵ)/{\sum }_{j=1}^C(d_{\mathcal{l},g,j}+ϵ)$. The class-response concentration is then

$$D_{\mathcal{l},g}=1-{\displaystyle \frac{-{\sum }_{c=1}^C{q}_{\mathcal{l},g,c}log\left(q_{\mathcal{l},g,c}\right)}{logC}}.$$

A group with large $D_{\mathcal{l},g}$ strongly supports a narrow set of output classes. Such behavior is not automatically malicious, but when combined with high temporal concentration and abnormal firing deviation, it becomes a strong indicator of a shortcut that may be activated by a trigger.

The final risk score is obtained through robust layer-wise normalization. For a raw score $X_{\mathcal{l},g}\in \{A_{\mathcal{l},g},B_{\mathcal{l},g},D_{\mathcal{l},g}\}$, FedTSR computes ${\tilde{X}}_{\mathcal{l},g}=max(0,(X_{\mathcal{l},g}-{\mathrm{med}}_{\mathcal{l}}\left(X\right))/({\mathrm{mad}}_{\mathcal{l}}\left(X\right)+ϵ))$, where ${\mathrm{med}}_{\mathcal{l}}$ and ${\mathrm{mad}}_{\mathcal{l}}$ are the median and median absolute deviation over groups in layer ℓ. The risk score is $R_{\mathcal{l},g}={\omega }_A{\tilde{A}}_{\mathcal{l},g}+{\omega }_B{\tilde{B}}_{\mathcal{l},g}+{\omega }_D{\tilde{D}}_{\mathcal{l},g},$ where ${\omega }_A$, ${\omega }_B$, and ${\omega }_D$ are non-negative weights and are set equally unless otherwise specified. The continuous risk mask is computed by ${\pi }_{\mathcal{l},g}=\mathrm{clip}((R_{\mathcal{l},g}-Q_{\mathcal{l}}^{50})/(Q_{\mathcal{l}}^{90}-Q_{\mathcal{l}}^{50}+ϵ),0,1)$, where $Q_{\mathcal{l}}^{50}$ and $Q_{\mathcal{l}}^{90}$ are the 50th and 90th percentiles of risk scores in layer ℓ. This percentile-based conversion avoids a fixed global threshold and makes the method stable across layers with different firing statistics. The equal weighting ${\omega }_A={\omega }_B={\omega }_D=1/3$ is used as a conservative default because the defender has no trigger-aware validation set for tuning attack-specific coefficients. Fixed and validation-learned alternatives are compared in the sensitivity analysis. Learned coefficients slightly improve ASR in some cases, but the gain is small compared with the risk of overfitting to the limited calibration set; hence the main experiments keep equal weights.

4.3. Risk-Adaptive Damping and Spike-Consistency Recalibration

After TSRE assigns ${\pi }_{\mathcal{l},g}$ to each synaptic group, FedTSR performs risk-adaptive damping. The damped initialization is

$$W_{\mathcal{l},g}^{†}=(1-\gamma {\pi }_{\mathcal{l},g})W_{\mathcal{l},g}^{★},$$

where $W_{\mathcal{l},g}^{★}$ is the original weight group in ${\theta }^{★}$ and $\gamma \in [0,1]$ controls the maximum damping strength. A group with ${\pi }_{\mathcal{l},g}=0$ remains unchanged, while a group with ${\pi }_{\mathcal{l},g}=1$ receives the strongest suppression. This operation is softer than pruning: it weakens suspicious pathways without destroying the surrounding representation. Such continuous damping is especially useful for SNNs because abrupt removal of synapses can significantly change membrane trajectories and cause unstable firing.

Direct damping may reduce attack success rate, but it may also slightly disturb clean accuracy. SCR therefore recalibrates the damped model using ${\mathcal{D}}_c$. The recalibration starts from ${\theta }^{†}$, the model obtained after risk-adaptive damping, and optimizes only for a small number of epochs. The clean-label loss is

$${\mathcal{L}}_{\mathrm{ce}}={\displaystyle \frac{1}{\left|\mathcal{B}\right|}}\sum _{(x,y)\in \mathcal{B}}\mathrm{CE}(z_{\theta }\left(x\right),y),$$

where $\mathcal{B}$ is a calibration mini-batch. Since ${\mathcal{D}}_c$ is small, clean-label supervision alone may overfit. FedTSR therefore adds an output consistency term that keeps the sanitized model close to the original model on benign inputs:

$${\mathcal{L}}_{\mathrm{out}}=T_d^2\mathrm{KL}\left(\mathrm{softmax}\left({\displaystyle \frac{z_{{\theta }^{★}}\left(x\right)}{T_d}}\right)\parallel \mathrm{softmax}\left({\displaystyle \frac{z_{\theta }\left(x\right)}{T_d}}\right)\right),$$

where $T_d$ is the distillation temperature. This term is applied to clean samples for which the original model prediction is correct, so that SCR preserves useful benign decision boundaries without intentionally preserving wrong predictions. To maintain the temporal operating regime of the SNN, SCR further introduces a spike-consistency loss. Let ${\overline{s}}_{\mathcal{l},\theta }^t\left(\mathcal{B}\right)$ and ${\overline{u}}_{\mathcal{l},\theta }^t\left(\mathcal{B}\right)$ denote batch-averaged spikes and membrane potentials of model $\theta$ at layer ℓ and timestep t. The temporal consistency loss is

$${\mathcal{L}}_{\mathrm{temp}}=\sum _{\mathcal{l}}{\displaystyle \sum _{t=1}^T}\left(\parallel {\overline{s}}_{\mathcal{l},\theta }^t\left(\mathcal{B}\right)-{\overline{s}}_{\mathcal{l},{\theta }^{★}}^t{\left(\mathcal{B}\right)\parallel }_2^2+\kappa {\parallel {\overline{u}}_{\mathcal{l},\theta }^t\left(\mathcal{B}\right)-{\overline{u}}_{\mathcal{l},{\theta }^{★}}^t\left(\mathcal{B}\right)\parallel }_2^2\right),$$

where $\kappa$ balances spike and membrane alignment. This term does not force every neuron to reproduce the original trajectory exactly. Instead, it preserves layer-level temporal statistics, preventing the sanitized model from drifting into a firing regime that is accurate on the small calibration set but unstable on the test distribution.

The complete SCR objective is

$${\mathcal{L}}_{\mathrm{SCR}}={\mathcal{L}}_{\mathrm{ce}}+{\lambda }_{\mathrm{out}}{\mathcal{L}}_{\mathrm{out}}+{\lambda }_{\mathrm{temp}}{\mathcal{L}}_{\mathrm{temp}}+{\lambda }_{\mathrm{risk}}\sum _{\mathcal{l}}\sum _{g\in {\mathcal{G}}_{\mathcal{l}}}{\pi }_{\mathcal{l},g}{\parallel W_{\mathcal{l},g}-W_{\mathcal{l},g}^{†}\parallel }_2^2.$$

The last term discourages high-risk groups from recovering their original suspicious strength during recalibration. In addition, FedTSR applies risk-gated learning rates to synaptic groups, written as $W_{\mathcal{l},g}\leftarrow W_{\mathcal{l},g}-\eta (1-\zeta {\pi }_{\mathcal{l},g}){\nabla }_{W_{\mathcal{l},g}}{\mathcal{L}}_{\mathrm{SCR}}$, where $\zeta \in [0,1]$ reduces updates on risky groups. This design allows low-risk benign groups to adapt and recover accuracy, while high-risk groups remain suppressed. All gradients are computed with surrogate-gradient backpropagation through time, and no triggered sample is used at any stage.

4.4. Training-Free Inference Repair and Complexity

FedTSR can be used in two modes. In the default mode, it performs risk-adaptive damping followed by SCR. In an even faster inference-repair mode, the defender can skip SCR and use ${\theta }^{†}$ directly. This training-free mode is useful when the calibration set is extremely small or when the server must deploy a patched model immediately. The full mode is used in our experiments because it provides a better accuracy–robustness trade-off while still requiring only a few local calibration epochs.

Algorithm 1 summarizes the complete procedure. The algorithm first simulates the compromised model on the clean calibration set and collects temporal statistics. It then computes risk scores and converts them into continuous masks. After damping risky groups, SCR recalibrates the model with clean supervision, output consistency, temporal consistency, and risk anchoring. The sanitized parameters after recalibration are returned as $\widehat{\theta }$.

Algorithm 1 FedTSR: Temporal Synaptic Sanitization for Federated SNNs

Require:  SNN trained through federated learning ${\theta }^{★}$, clean calibration set ${\mathcal{D}}_c$, simulation length T, damping strength $\gamma$, recalibration epochs E Ensure:  Sanitized SNN $\widehat{\theta }$   1: Define synaptic groups $\left\{{\mathcal{G}}_{\mathcal{l}}\right\}$ for each trainable layer ℓ   2: Run ${\theta }^{★}$ on ${\mathcal{D}}_c$ for T timesteps and record $s_{\mathcal{l}}^t$, $u_{\mathcal{l}}^t$, and $h_{\mathcal{l},g}^t$   3: Compute temporal concentration $A_{\mathcal{l},g}$, firing deviation $B_{\mathcal{l},g}$, and class-response concentration $D_{\mathcal{l},g}$   4: Normalize the three scores layer-wise and obtain $R_{\mathcal{l},g}$   5: Convert $R_{\mathcal{l},g}$ into the continuous risk mask ${\pi }_{\mathcal{l},g}$   6: for each layer ℓ and each group $g\in {\mathcal{G}}_{\mathcal{l}}$ do   7:     Set $W_{\mathcal{l},g}^{†}\leftarrow (1-\gamma {\pi }_{\mathcal{l},g})W_{\mathcal{l},g}^{★}$   8: end for   9: Initialize $\theta \leftarrow {\theta }^{†}$ 10: for $e=1$ to E do 11:   for each mini-batch $\mathcal{B}\subset {\mathcal{D}}_c$ do 12:       Compute ${\mathcal{L}}_{\mathrm{SCR}}$ using clean labels and temporal statistics from ${\theta }^{★}$ 13:       Update each group by risk-gated surrogate-gradient descent 14:   end for 15: end for 16: Set $\widehat{\theta }\leftarrow \theta$ and return $\widehat{\theta }$

The computational cost of TSRE is dominated by one forward simulation and one surrogate-gradient backward pass on ${\mathcal{D}}_c$. If $N_c=\left|{\mathcal{D}}_c\right|$, the cost is approximately $O\left(N_{c}T\right|{\theta }^{★}\left|\right)$, which is much lower than repeating federated training over all clients. The memory cost can be kept small by streaming statistics over mini-batches, requiring storage only for layer-wise group scores and batch-level temporal means. SCR adds E calibration epochs on ${\mathcal{D}}_c$, where E is typically much smaller than the number of local epochs used during federated training. No client communication is needed after the compromised model has been received. More explicitly, TSRE needs $O\left(N_{c}T{\sum }_{\mathcal{l}}\right|W_{\mathcal{l}}\left|\right)$ arithmetic operations and $O\left({\sum }_{\mathcal{l}}\right|{\mathcal{G}}_{\mathcal{l}}|+BT{\sum }_{\mathcal{l}}{d}_{\mathcal{l}})$ working memory when traces are streamed over a calibration batch of size B and layer state dimension $d_{\mathcal{l}}$. SCR adds E ordinary surrogate-gradient calibration epochs. The damping-only variant includes the TSRE forward/backward simulation and risk-mask construction, not only the final weight scaling. Absolute wall-clock time, peak GPU memory, and an energy proxy are reported in the sanitization-efficiency experiments.

For larger neuromorphic deployments, this cost should be interpreted as one-time server-side repair latency, not inference latency. The gradient-based class-response term is the dominant overhead because it requires surrogate-gradient tracing through the simulated timesteps. In practice, the defender can reduce this cost by streaming calibration batches, grouping synapses at the channel/block level, or using the damping-only mode when immediate patching is required. These trade-offs are evaluated later by separating TSRE-only, SCR-only, and full FedTSR measurements and by comparing normalized repair costs.

The design of FedTSR directly addresses the three requirements stated in Section 3.3. First, clean behavior is preserved by output consistency and temporal spike consistency. Second, malicious behavior is suppressed by identifying and damping synaptic groups with concentrated temporal risk. Third, the repair is fast because it is performed entirely at the server using a small clean calibration set. This makes FedTSR suitable for federated neuromorphic systems where retraining is expensive, client data are inaccessible, and deployed SNNs must be sanitized under strict latency and energy constraints.

5. Experiments

5.1. Experimental Settings

We evaluate FedTSR in a post-training sanitization scenario. A federated SNN is first trained by FedAvg under clean or poisoned client updates, and the resulting global model ${\theta }^{★}$ is then repaired at the server using only a small clean calibration set ${\mathcal{D}}_c$. No client data, malicious-client identities, trigger labels, or poisoned samples are used during removal. The sanitized model $\widehat{\theta }$ is evaluated on both clean test samples and triggered test samples. Clean performance is measured by clean accuracy $\mathrm{ACC}$, while backdoor effectiveness is measured by attack success rate $\mathrm{ASR}$ as defined in Section 3.2. For all datasets, results are averaged over three random seeds, and the same compromised checkpoint ${\theta }^{★}$ is used for comparing different removal methods.

For reproducibility, we now report random seeds, model architectures, neuron parameters, surrogate functions, optimizer settings, batch sizes, hardware, runtime, and baseline adaptation details. Unless otherwise stated, all quantitative entries are mean ± standard deviation over seeds $\{1,2,3\}$. Paired two-sided t-tests on ASR are reported only as descriptive support because the seed budget is small, as further noted in Section 5.5. Table 2 lists the complete implementation settings used in all experiments.

Table 2. Implementation and hyperparameter details. BN denotes batch normalization before the spiking activation. All runs used PyTorch 2.1/CUDA 12.1 on one NVIDIA RTX 3090 GPU with 24 GB memory.

Dataset	Victim SNN	Federated Optimizer	Neuron and Surrogate	FedTSR/SCR Settings
N-MNIST	Conv(32)-Conv(64)- FC(256)-FC(C)	Adam, lr ${10}^{-3}$, batch 64, 150 rounds	LIF, leak $0.5$, threshold $1.0$, hard reset, fast-sigmoid slope 4	SCR Adam, lr $5\times {10}^{-4}$, batch 64, $E=5$, $\gamma =0.65$
CIFAR10-DVS	VGG-style SNN with BN, channels 64/128/256	Adam, lr $5\times {10}^{-4}$, batch 32, 200 rounds	LIF, leak $0.5$, threshold $1.0$, hard reset, fast-sigmoid slope 4	SCR Adam, lr $3\times {10}^{-4}$, batch 32, $E=5$, $\gamma =0.65$
DVS Gesture	Residual SNN with four residual spiking blocks	Adam, lr $3\times {10}^{-4}$, batch 16, 200 rounds	LIF, leak $0.6$, threshold $1.0$, hard reset, fast-sigmoid slope 4	SCR Adam, lr $2\times {10}^{-4}$, batch 16, $E=5$, $\gamma =0.65$
CIFAR-10	VGG-style rate-coded SNN with BN	Adam, lr ${10}^{-3}$, batch 128, 150 rounds	LIF, leak $0.5$, threshold $1.0$, hard reset, fast-sigmoid slope 4	SCR Adam, lr $5\times {10}^{-4}$, batch 128, $E=5$, $\gamma =0.65$

The evaluation covers both neuromorphic event datasets and frame-based datasets converted into spike trains. The dataset and preprocessing settings are summarized in Table 3. N-MNIST [41], CIFAR10-DVS [42], and DVS Gesture [43] are used to test whether FedTSR can sanitize models trained on genuine event streams, while CIFAR-10 [44] is used to examine the compatibility of FedTSR with rate-coded static images. For event datasets, raw events are accumulated into T discrete event frames with polarity channels preserved. For CIFAR-10, each image is converted into a spike train by Poisson rate coding, where pixel intensity determines the firing probability at each timestep. All input samples are normalized using statistics computed only from the corresponding training split. The calibration set ${\mathcal{D}}_c$ is sampled from verified clean data and is disjoint from the training and test sets.

Table 3. Datasets and preprocessing settings used in the experiments. The URLs are included in the setting section to make the benchmark sources explicit.

Dataset	Type	Classes	Input Size	T	Source URL
N-MNIST	Event	10	$2\times 34\times 34$	16	https://www.garrickorchard.com/datasets/n-mnist (accessed on 20 February 2026)
CIFAR10-DVS	Event	10	$2\times 48\times 48$	10	https://figshare.com/articles/dataset/CIFAR10-DVS_New/4724671 (accessed on 20 February 2026)
DVS Gesture	Event	11	$2\times 64\times 64$	16	https://research.ibm.com/interactive/dvsgesture/ (accessed on 20 February 2026)
CIFAR-10	Rate-coded frame	10	$3\times 32\times 32$	8	https://www.cs.toronto.edu/~kriz/cifar.html (accessed on 20 February 2026)

The federated and attack settings are listed in Table 4. Unless otherwise stated, we use $K=20$ clients and sample 10 clients per communication round. Data heterogeneity is controlled by a Dirichlet label partition with concentration parameter $\xi =0.5$, where a smaller $\xi$ indicates a stronger non-IID distribution. The default malicious-client ratio is $10\%$, and the default local poisoning ratio is $\rho =0.2$. A malicious client trains on a mixture of clean samples and poisoned samples $(\tau \left(x\right),y_{\mathrm{tar}})$, where $y_{\mathrm{tar}}$ is fixed to class 0 for digit and object datasets and to the “hand clap” class for DVS Gesture. The target class is not disclosed to any defense.

Table 4. Federated training, attack, and FedTSR sanitization settings. These settings are used as defaults unless a later subsection explicitly changes one factor.

Component	Default Setting
Federated optimizer	FedAvg with client-side surrogate-gradient training
Number of clients	$K=20$
Selected clients per round	10
Communication rounds	150 for N-MNIST and CIFAR-10, 200 for CIFAR10-DVS and DVS Gesture
Local epochs	2
Non-IID partition	Dirichlet partition with $\xi =0.5$
Malicious-client ratio	$10\%$
Local poisoning ratio	$\rho =0.2$
Backdoor triggers	Static patch, temporal burst, and hybrid spatio-temporal trigger
Calibration size	$|{\mathcal{D}}_c|=500$ for each dataset unless otherwise stated
FedTSR damping strength	$\gamma =0.65$
SCR epochs	$E=5$
Loss weights	${\lambda }_{\mathrm{out}}=0.5$, ${\lambda }_{\mathrm{temp}}=0.2$, ${\lambda }_{\mathrm{risk}}={10}^{-3}$
Risk weights	${\omega }_A={\omega }_B={\omega }_D=1/3$

All baselines are adapted to SNNs rather than applied as static ANN procedures. Table 5 summarizes the adaptation and tuning ranges. The damping-only FedTSR variant includes temporal statistic collection and risk estimation.

Table 5. Baseline adaptation and tuning for SNN repair.

Method	SNN Adaptation	Tuned Values
Fine-tuning	Surrogate-gradient calibration on ${\mathcal{D}}_c$ with the same LIF dynamics and simulation length as the victim model.	lr $\in \{{10}^{-4},3\times {10}^{-4},5\times {10}^{-4},{10}^{-3}\}$, epochs $\in \{3,5,10\}$
Fine-pruning	Channel/group activity is measured by mean clean firing rate; low-activity groups are pruned and the model is recalibrated with surrogate gradients.	pruning ratio $\in \{10\%,20\%,30\%,40\%\}$
NAD	Attention maps are computed from timestep-averaged membrane potentials and spike counts; the student is recalibrated on ${\mathcal{D}}_c$.	distillation weight $\in \{0.1,0.5,1.0\}$, temperature $\in \{2,4\}$
ANP	Neuron perturbations are applied to spiking channels/groups, and vulnerability is estimated through surrogate-gradient BPTT.	perturbation scale $\in \{0.1,0.2,0.3\}$, prune ratio $\in \{10\%,20\%,30\%\}$
TMPBD + NDSBM	SNN-specific membrane-margin detection and neural-dendrite suppression adapted from TMPBD/NDSBM.	clamp ratio $\in \{10\%,20\%,30\%\}$ and calibration size matched to FedTSR
FLAME	Training-time robust aggregation baseline with model-update clustering, clipping, and calibrated noise during federated training.	clipping and noise selected following the validation rule in FLAME

In our experimental protocol, the server first receives local model updates from benign and malicious clients and aggregates them into ${\theta }^{★}$. The compromised model is then passed to FedTSR, which estimates temporal synaptic risk on ${\mathcal{D}}_c$, performs risk-adaptive damping, and applies spike-consistency recalibration. The final model $\widehat{\theta }$ is evaluated on clean and triggered test sets. This separation between federated training and server-side sanitization is essential because it matches the intended deployment scenario: the defender may receive an already trained SNN and must repair it without restarting collaboration among clients.

Figure 2 shows the three trigger types used in the experiments. The static patch trigger inserts a fixed spatial pattern into event frames or rate-coded frames across all timesteps. The temporal burst trigger injects a short, high-frequency spike pattern into a small temporal window while leaving other timesteps unchanged. The hybrid trigger combines a spatial patch with a temporally delayed burst. These triggers are chosen because they represent three different ways in which backdoors can exploit SNN behavior: persistent spatial evidence, short-time temporal evidence, and coupled spatio-temporal evidence.

Figure 2. Backdoor trigger designs. The static patch is active at every timestep, the temporal burst is active only in a short time window, and the hybrid trigger activates a spatial pattern during delayed timesteps. Shaded cells indicate triggered timesteps and black squares indicate spatial trigger locations.

The victim architectures are selected to match the difficulty of each benchmark. For N-MNIST, we use a four-layer convolutional SNN with two convolutional blocks and two fully connected layers. For CIFAR10-DVS and CIFAR-10, we use a VGG-style SNN with batch normalization before spiking activations. For DVS Gesture, we use a residual SNN because gesture recognition requires longer temporal aggregation and benefits from residual feature reuse. All SNNs use leaky integrate-and-fire neurons with learnable affine parameters and fixed simulation length T as specified in Table 3. The initial compromised model ${\theta }^{★}$ is trained using surrogate gradients, and the same surrogate function is used in SCR for fair comparison.

We compare FedTSR with representative post-training and calibration-based defenses. Fine-tuning updates all parameters on ${\mathcal{D}}_c$ without risk estimation. Fine-pruning removes low-activity channels and then fine-tunes the remaining model. Neural Attention Distillation transfers clean attention statistics from ${\theta }^{★}$ to the repaired model. ANP-style perturbation identifies sensitive neurons by adversarial parameter perturbation and suppresses them before calibration. For SNN compatibility, all baselines are implemented with the same timestep length, neuron model, and calibration set. Since none of these baselines receives trigger information, the comparison follows the same trigger-agnostic repair setting as FedTSR.

5.2. Overall Backdoor Removal Performance

Table 6 reports the overall backdoor removal performance under the hybrid spatio-temporal trigger, which is the most difficult attack considered in our evaluation because it simultaneously exploits spatial shortcut features and delayed spike timing. The compromised federated SNN maintains high clean accuracy but also exhibits a very high attack success rate, showing that the injected backdoor is effective and stealthy. Fine-tuning on the clean calibration set slightly reduces $\mathrm{ASR}$, but the reduction is limited because the calibration set does not contain triggered samples and therefore provides weak evidence about the hidden malicious pathway. Fine-pruning performs better than fine-tuning on N-MNIST, where the trigger-related neurons are relatively sparse, but its clean accuracy decreases more clearly on CIFAR10-DVS and DVS Gesture because removing low-activity channels also damages useful event-driven representations. ANP obtains stronger $\mathrm{ASR}$ reduction by suppressing sensitive neurons, but its perturbation criterion is not explicitly temporal and therefore tends to either miss delayed trigger pathways or over-suppress benign high-response neurons.

Table 6. Overall performance under the hybrid spatio-temporal trigger. The best sanitized result in each dataset is marked in bold. ${\theta }^{★}$ denotes the compromised federated model before removal.

Method	N-MNIST		CIFAR10-DVS		DVS Gesture		CIFAR-10
	ACC↑	ASR↓	ACC↑	ASR↓	ACC↑	ASR↓	ACC↑	ASR↓
Compromised ${\theta }^{★}$	98.6	96.7	71.8	94.8	95.2	91.5	83.4	93.2
Fine-tuning	98.1	51.8	69.9	58.6	93.6	47.9	81.7	55.3
Fine-pruning	97.7	28.4	67.5	39.7	92.1	35.8	79.9	36.1
NAD	98.0	23.6	68.4	31.5	92.9	28.7	80.8	29.9
ANP	97.5	12.9	66.8	18.4	91.8	16.3	78.6	17.2
FedTSR, damping only	98.0	8.7	69.1	10.8	93.7	9.6	81.5	10.1
FedTSR	98.3	4.2	70.3	7.6	94.5	6.9	82.4	7.4

FedTSR achieves the best balance between clean performance preservation and backdoor removal. On CIFAR10-DVS, FedTSR reduces $\mathrm{ASR}$ from $94.8\%$ to $7.6\%$ while keeping $\mathrm{ACC}$ at $70.3\%$, which is only $1.5$ percentage points lower than the compromised model. On DVS Gesture, where long temporal dependencies are more important, FedTSR reduces $\mathrm{ASR}$ from $91.5\%$ to $6.9\%$ and preserves $94.5\%$ clean accuracy. These results support the central claim of this paper: backdoor behavior in federated SNNs can be removed more effectively when the defense directly analyzes temporal synaptic risk rather than relying only on static activation magnitude or parameter sensitivity.

Table 7 adds standard deviations, a paired-test statistic, and an SNN-specific baseline. TMPBD + NDSBM is competitive because it uses temporal membrane evidence, but FedTSR obtains lower ASR in the tested settings because it estimates hidden-layer synaptic risk and then recalibrates spike consistency. Because each comparison uses only three paired seeds, the p-values are interpreted as indicative support rather than definitive statistical proof of superiority. We therefore base our conclusion mainly on the magnitude and consistency of the ACC/ASR differences, and we explicitly list the small seed budget as a limitation in Section 5.5.

Table 7. Statistical reporting and SNN-aware baseline comparison under the hybrid trigger. The p-value compares FedTSR with ANP on ASR using three paired seeds and is interpreted as indicative rather than definitive.

Dataset	ANP		TMPBD + NDSBM		FedTSR		p-Value
	ACC	ASR	ACC	ASR	ACC	ASR
N-MNIST	$97.5\pm 0.2$	$12.9\pm 0.9$	$98.1\pm 0.2$	$6.7\pm 0.5$	$98.3\pm 0.1$	$4.2\pm 0.3$	0.012
CIFAR10-DVS	$66.8\pm 0.6$	$18.4\pm 1.2$	$69.4\pm 0.5$	$11.9\pm 0.8$	$70.3\pm 0.4$	$7.6\pm 0.5$	0.009
DVS Gesture	$91.8\pm 0.5$	$16.3\pm 1.1$	$93.6\pm 0.4$	$10.5\pm 0.7$	$94.5\pm 0.3$	$6.9\pm 0.4$	0.006
CIFAR-10	$78.6\pm 0.7$	$17.2\pm 1.0$	$81.2\pm 0.5$	$10.2\pm 0.6$	$82.4\pm 0.4$	$7.4\pm 0.5$	0.011

We also compare with a stronger training-time federated backdoor defense in Table 8. FLAME reduces the backdoor during aggregation, but it requires modifying federated training and observing client updates. FedTSR remains applicable when only the final compromised SNN is available, and it can also be combined with FLAME.

Table 8. Comparison with a training-time robust aggregation defense on CIFAR10-DVS under the hybrid trigger.

Training/Repair Strategy	Requires Client Updates During Defense	ACC ↑	ASR ↓
FedAvg, no repair	No	$71.8\pm 0.5$	$94.8\pm 1.0$
FLAME during training	Yes	$69.4\pm 0.7$	$27.6\pm 2.3$
FLAME + ANP	Yes	$67.2\pm 0.6$	$16.8\pm 1.5$
FedAvg + FedTSR	No	$70.3\pm 0.4$	$7.6\pm 0.5$
FLAME + FedTSR	Yes	$69.0\pm 0.5$	$6.9\pm 0.6$

To examine whether the advantage of FedTSR is specific to one trigger type, Table 9 compares the average results over the four datasets under static patch, temporal burst, and hybrid triggers. The static patch trigger is easier to mitigate because its spatial footprint repeatedly appears across all timesteps, making suspicious channels more visible to pruning-based defenses. The temporal burst trigger is harder because its malicious behavior is concentrated in a short interval and can be hidden by normal firing sparsity. The hybrid trigger is the hardest because it creates a spatially localized pathway that becomes highly influential only during selected timesteps. FedTSR remains effective across all three settings because the temporal concentration score $A_{\mathcal{l},g}$ captures short-window amplification, the firing deviation score $B_{\mathcal{l},g}$ captures abnormal population-level behavior, and the class-response concentration score $D_{\mathcal{l},g}$ captures target-class shortcut tendency.

Table 9. Average clean accuracy and attack success rate across the four datasets under different trigger types. Results are averaged over N-MNIST, CIFAR10-DVS, DVS Gesture, and CIFAR-10.

Method	Static Patch		Temporal Burst		Hybrid Trigger
	ACC↑	ASR↓	ACC↑	ASR↓	ACC↑	ASR↓
Compromised ${\theta }^{★}$	87.9	95.1	87.7	92.8	87.3	94.1
Fine-tuning	86.5	46.7	85.8	61.2	85.9	53.4
Fine-pruning	84.8	22.5	83.6	45.1	84.3	35.0
NAD	85.6	19.8	84.5	37.6	85.1	28.4
ANP	84.2	10.4	83.1	22.9	83.5	16.2
FedTSR, damping only	86.1	6.9	85.4	12.5	85.6	9.7
FedTSR	87.0	3.8	86.5	8.1	86.4	6.5

Figure 3 visualizes the average $\mathrm{ASR}$ under the hybrid trigger. The bars show that ordinary fine-tuning leaves a substantial portion of the backdoor intact, while fine-pruning and NAD reduce the attack more aggressively but still retain non-negligible malicious behavior. ANP is stronger, but its remaining $\mathrm{ASR}$ is still more than twice that of FedTSR. The damping-only variant already performs competitively, indicating that TSRE successfully localizes high-risk synaptic groups. The full FedTSR further improves performance because SCR restores clean temporal statistics without allowing risky groups to recover their original strength.

Figure 3. Average attack success rate under the hybrid trigger. Bars from left to right correspond to the compromised model, fine-tuning, fine-pruning, NAD, ANP, FedTSR with damping only, and full FedTSR. Lower values indicate stronger backdoor removal.

Figure 4 further shows the clean accuracy and attack success rate trade-off on CIFAR10-DVS. A desirable defense should move toward the lower-right region, where $\mathrm{ACC}$ is high and $\mathrm{ASR}$ is low. Fine-tuning remains close to the compromised model in terms of $\mathrm{ASR}$, while fine-pruning and ANP move downward but also shift left because of clean accuracy degradation. FedTSR is located closest to the desired region, confirming that temporal synaptic risk estimation removes the malicious pathway more selectively. This trade-off is particularly important for event-based recognition, where clean accuracy can be sensitive to small changes in firing dynamics.

Figure 4. Clean accuracy and attack success rate trade-off on CIFAR10-DVS under the hybrid trigger. Each point denotes one repaired model, with the method name printed next to the point. A better defense appears closer to the lower-right region because it preserves clean accuracy while reducing attack success rate.

Beyond ACC and ASR, Table 10 reports clean loss, target-class confidence on triggered non-target samples, and benign distribution-shift robustness under event jitter. FedTSR lowers target-class confidence while keeping clean loss and benign-shift accuracy close to the compromised model.

Table 10. Additional metrics under the hybrid trigger. Event jitter randomly shifts event timestamps by at most one bin during testing.

Dataset/Method	Clean Loss ↓	Target Confidence ↓	Event-Jitter ACC ↑	Triggered Loss ↑
CIFAR10-DVS ${\theta }^{★}$	0.78	0.96	67.2	0.14
CIFAR10-DVS ANP	0.91	0.24	63.0	2.18
CIFAR10-DVS FedTSR	0.82	0.10	68.4	3.04
DVS Gesture ${\theta }^{★}$	0.24	0.94	90.1	0.17
DVS Gesture ANP	0.33	0.21	88.0	2.31
DVS Gesture FedTSR	0.27	0.09	91.7	3.16

The results in Table 6 and Table 9, Figure 3 and Figure 4 jointly demonstrate that FedTSR improves post-training backdoor removal in both event-based and rate-coded SNNs. The improvement is not caused by simply reducing model capacity, because the damping-only variant already lowers $\mathrm{ASR}$ substantially and SCR then recovers clean performance. Instead, the advantage comes from matching the defense mechanism to the temporal nature of SNN computation. This explains why FedTSR is especially effective against temporal burst and hybrid triggers, where static defenses have difficulty distinguishing malicious spike pathways from benign sparse firing.

5.3. Ablation Study and Sensitivity Analysis

This subsection studies which components of FedTSR are responsible for the observed backdoor removal performance. We conduct the analysis on CIFAR10-DVS and DVS Gesture under the hybrid trigger because these two datasets contain genuine event streams and require meaningful temporal integration. Unless otherwise stated, the settings follow Table 4. The ablation results are summarized in Table 11. Removing temporal concentration $A_{\mathcal{l},g}$ weakens the defense against delayed triggers because the sanitization procedure can no longer identify groups whose contribution is concentrated in a narrow time window. Removing firing deviation $B_{\mathcal{l},g}$ makes the method less sensitive to abnormal population-level firing, which increases $\mathrm{ASR}$, especially on CIFAR10-DVS. Removing class-response concentration $D_{\mathcal{l},g}$ also increases $\mathrm{ASR}$ because target-class shortcut pathways are not sufficiently penalized. The largest degradation occurs when SCR is removed entirely, which indicates that damping alone can suppress the malicious pathway but cannot fully restore benign temporal dynamics. These results validate the design choice in Section 4.2: the three risk components provide complementary evidence and should be used jointly.

Table 11. Ablation results of FedTSR components under the hybrid trigger. The complete method combines temporal concentration $A_{\mathcal{l},g}$, firing deviation $B_{\mathcal{l},g}$, class-response concentration $D_{\mathcal{l},g}$, and spike-consistency recalibration.

Variant	CIFAR10-DVS		DVS Gesture
	ACC↑	ASR↓	ACC↑	ASR↓
Full FedTSR	70.3	7.6	94.5	6.9
w/o $A_{\mathcal{l},g}$	69.8	15.4	93.9	14.8
w/o $B_{\mathcal{l},g}$	69.6	13.7	94.0	12.6
w/o $D_{\mathcal{l},g}$	69.9	16.1	94.1	13.9
w/o robust normalization	69.1	18.5	93.5	17.4
w/o risk-gated learning rate	69.7	11.9	94.0	10.7
w/o ${\mathcal{L}}_{\mathrm{temp}}$	68.9	9.8	93.4	9.1
w/o ${\mathcal{L}}_{\mathrm{out}}$	69.2	8.9	93.7	8.4
Damping only	69.1	10.8	93.7	9.6

To test whether TSRE localizes malicious pathways rather than merely damping capacity, Table 12 reports a controlled diagnostic in which poisoning is restricted to a known subset of synaptic groups. A group is counted as detected when its risk score is in the top 10% of the corresponding layer. The results show high precision and recall, with temporal and hybrid triggers producing the clearest high-risk concentration.

Table 12. False-positive/false-negative diagnostic for TSRE risk localization under controlled group-limited poisoning.

Dataset	Trigger	Precision ↑	Recall ↑	F1 ↑	FPR ↓	ASR After FedTSR ↓
CIFAR10-DVS	Static	0.81	0.76	0.79	0.045	4.1
CIFAR10-DVS	Temporal	0.86	0.83	0.85	0.037	8.1
CIFAR10-DVS	Hybrid	0.84	0.80	0.82	0.041	7.6
DVS Gesture	Temporal	0.79	0.76	0.78	0.052	8.3
DVS Gesture	Hybrid	0.82	0.78	0.80	0.047	6.9

Table 13 gives the requested per-trigger ablation. Removing $A_{\mathcal{l},g}$ hurts temporal-burst and hybrid triggers most, while removing $D_{\mathcal{l},g}$ hurts static and hybrid triggers because target-class shortcut evidence is no longer explicitly penalized.

Table 13. Per-trigger ablation on the average of CIFAR10-DVS and DVS Gesture. Entries are ASR after repair.

Variant	Static Patch	Temporal Burst	Hybrid Trigger
Full FedTSR	3.9	8.7	7.2
w/o $A_{\mathcal{l},g}$	6.4	19.8	15.1
w/o $B_{\mathcal{l},g}$	6.2	14.7	12.9
w/o $D_{\mathcal{l},g}$	9.1	17.5	15.3
w/o SCR	6.8	14.1	10.4

Table 14 reports the sensitivity of FedTSR to the calibration size $|{\mathcal{D}}_c|$ and damping strength $\gamma$. FedTSR remains effective even with 100 clean calibration samples, reducing $\mathrm{ASR}$ on CIFAR10-DVS from $94.8\%$ to $13.9\%$. Increasing $|{\mathcal{D}}_c|$ improves both risk estimation and recalibration because the clean temporal statistics become more stable. However, the gain becomes modest when $|{\mathcal{D}}_c|$ exceeds 500, which suggests that FedTSR does not require a large trusted dataset. The damping strength $\gamma$ controls the aggressiveness of synaptic suppression. A small $\gamma$ leaves part of the backdoor pathway active, while an overly large $\gamma$ can damage clean representations. The default value $\gamma =0.65$ provides the best average trade-off in this sensitivity analysis, and it is therefore used in the main experiments.

Table 14. Sensitivity of FedTSR to calibration size and damping strength on CIFAR10-DVS under the hybrid trigger. When one factor is varied, the other factor follows the default setting in Table 4.

Factor	Value	ACC ↑	ASR ↓	ΔACC	Removal Gain
$|{\mathcal{D}}_c|$	50	68.6	19.7	$-3.2$	74.1
	100	69.0	13.9	$-2.8$	80.9
	250	69.7	9.4	$-2.1$	85.4
	500	70.3	7.6	$-1.5$	87.2
	1000	70.5	7.1	$-1.3$	87.7
$\gamma$	0.35	70.8	22.6	$-1.0$	72.2
	0.50	70.6	12.3	$-1.2$	82.5
	0.65	70.3	7.6	$-1.5$	87.2
	0.80	69.5	6.8	$-2.3$	88.0
	0.95	67.9	5.9	$-3.9$	88.9

Table 15 analyzes calibration-set composition and FedTSR-aware attack stress cases. FedTSR is stable with 1% accidental contamination but degrades under 5% contamination, severe class imbalance, or distribution shift, confirming that calibration quality is an important assumption. The adaptive benign-mimic trigger is trained with an auxiliary penalty that encourages triggered samples to match clean temporal entropy and layer-level firing means on the malicious clients. This attack directly targets the TSRE assumptions, so the residual ASR is higher than in the default hybrid setting. Nevertheless, FedTSR still reduces the attack substantially, and the result clarifies the boundary of the trigger-agnostic claim: FedTSR does not require trigger knowledge, but it is not certified against an attacker that can make malicious temporal statistics indistinguishable from benign ones.

Table 15. Calibration-set and attack stress tests on CIFAR10-DVS under the hybrid trigger unless otherwise stated.

Condition	ACC ↑	ASR ↓	Interpretation
Default clean calibration	$70.3\pm 0.4$	$7.6\pm 0.5$	Main setting
Calibration contains 1% poisoned samples	$69.8\pm 0.5$	$8.8\pm 0.7$	Minor degradation
Calibration contains 5% poisoned samples	$68.9\pm 0.6$	$12.2\pm 1.0$	Noticeable but still effective
Class-imbalanced calibration, max/min $=5:1$	$69.2\pm 0.6$	$12.4\pm 1.1$	Minority-class temporal statistics are weaker
Distribution-shifted calibration	$68.5\pm 0.7$	$18.1\pm 1.4$	Major limitation
Poisoning ratio $\rho =0.3$	$69.6\pm 0.5$	$10.9\pm 0.9$	Stronger local poisoning
Poisoning ratio $\rho =0.4$	$68.9\pm 0.7$	$15.8\pm 1.5$	Backdoor pathway becomes less localized
Different target classes, average over $\{0,3,7\}$	$70.1\pm 0.5$	$8.4\pm 0.8$	Target label is not required
Two simultaneous target labels	$69.5\pm 0.6$	$12.7\pm 1.1$	Multi-target attacks are harder
Clean-label temporal attack	$69.7\pm 0.5$	$13.6\pm 1.2$	Label evidence is weaker
Adaptive benign-mimic trigger	$69.3\pm 0.6$	$14.9\pm 1.3$	Adaptive temporal mimicry remains a limitation

Table 16 extends the calibration-size analysis to DVS Gesture and temporal-burst triggers. Longer temporal dependencies and hybrid triggers require more calibration samples, but the marginal gain still saturates near 500 samples.

Table 16. Calibration size versus trigger complexity. Entries are ACC/ASR after FedTSR.

Dataset and Trigger	50	100	250	500	1000
CIFAR10-DVS, hybrid	68.6/19.7	69.0/13.9	69.7/9.4	70.3/7.6	70.5/7.1
DVS Gesture, temporal burst	92.5/18.6	93.0/14.2	93.9/10.1	94.6/8.3	94.8/7.9
DVS Gesture, hybrid	92.1/20.4	92.8/16.1	93.7/11.8	94.5/6.9	94.7/6.4

Table 17 studies risk-score weights and surrogate-gradient choices on CIFAR10-DVS. FedTSR is not tied to a particular surrogate derivative, and the equal-weight default is close to the learned-coefficient variant.

Table 17. Sensitivity to risk-score weights and surrogate gradients on CIFAR10-DVS under the hybrid trigger.

Setting	$({\mathit{\omega }}_{\mathit{A}},{\mathit{\omega }}_{\mathit{B}},{\mathit{\omega }}_{\mathit{D}})$ or Surrogate	ACC ↑	ASR ↓
Equal weights	$(1/3,1/3,1/3)$	70.3	7.6
Temporal-heavy	$(0.50,0.25,0.25)$	70.2	7.2
Firing-heavy	$(0.25,0.50,0.25)$	70.0	8.4
Class-heavy	$(0.25,0.25,0.50)$	70.1	7.8
Validation-learned coefficients	$(0.43,0.24,0.33)$	70.4	7.1
Triangular surrogate	triangular derivative	70.0	8.3
Arctangent surrogate	arctangent derivative	70.2	7.9
Fast-sigmoid surrogate	default derivative	70.3	7.6

Figure 5 visualizes the contribution of the three risk scores on CIFAR10-DVS. The figure reports $\mathrm{ASR}$ after sanitization when different combinations of $A_{\mathcal{l},g}$, $B_{\mathcal{l},g}$, and $D_{\mathcal{l},g}$ are used to construct $R_{\mathcal{l},g}$. Using any single component improves over ordinary fine-tuning, but no single component is sufficient. The pair $(A_{\mathcal{l},g},D_{\mathcal{l},g})$ is stronger than the other two-component combinations because hybrid triggers are both temporally concentrated and target-class oriented. The full combination is still best because $B_{\mathcal{l},g}$ suppresses groups whose firing rate deviates abnormally from the layer population. This confirms that FedTSR benefits from estimating risk from multiple temporal and semantic views rather than relying on one heuristic.

Figure 5. Effect of risk score construction on CIFAR10-DVS under the hybrid trigger. Bars from left to right show fine-tuning, single-component TSRE, two-component TSRE, and full TSRE using $A_{\mathcal{l},g}$, $B_{\mathcal{l},g}$, and $D_{\mathcal{l},g}$. Lower attack success rate means stronger removal.

Figure 6 plots the relationship between $\gamma$, clean accuracy, and attack success rate on CIFAR10-DVS. The curve shows that increasing $\gamma$ monotonically decreases $\mathrm{ASR}$ in the tested range because more high-risk synaptic contribution is suppressed. However, clean accuracy remains stable only before the damping becomes too aggressive. When $\gamma =0.95$, $\mathrm{ASR}$ is slightly lower than at $\gamma =0.65$, but the clean accuracy drop becomes much larger. This behavior explains why FedTSR uses soft damping rather than binary pruning: suppressing suspicious groups is necessary, but preserving enough residual capacity is equally important for maintaining normal spike-based inference.

Figure 6. Sensitivity to damping strength on CIFAR10-DVS. The solid circle-marked curve denotes clean accuracy, and the dashed square-marked curve denotes attack success rate; both values are measured after full FedTSR recalibration under the hybrid trigger.

The ablation evidence in Table 11 and Table 14, and Figure 5 and Figure 6 indicates that FedTSR is not a simple fine-tuning or pruning procedure. Its performance comes from a coupled mechanism: TSRE identifies temporally suspicious synaptic groups, damping weakens their contribution, and SCR preserves the benign firing regime. The sensitivity analysis also shows that FedTSR is practical when only a small calibration set is available, which is important for federated settings where the server rarely owns abundant, clean data.

5.4. Robustness to Federated Heterogeneity and Sanitization Efficiency

We further evaluate whether FedTSR remains reliable when the federated system becomes more heterogeneous or more severely poisoned. This analysis is important because the server-side defender observes only the final global model ${\theta }^{★}$ and the clean calibration set ${\mathcal{D}}_c$; it cannot directly inspect the distribution shift among clients. We first vary the Dirichlet concentration parameter $\xi$ used for label partitioning. Smaller $\xi$ produces stronger non-IID data allocation and therefore makes malicious updates harder to separate from benign client drift. Table 18 reports results on CIFAR10-DVS and DVS Gesture under the hybrid trigger. FedTSR consistently reduces $\mathrm{ASR}$ to below $10\%$ in all tested non-IID settings, including the severe case $\xi =0.1$. In contrast, ANP becomes less stable when the data distribution is highly skewed, because neuron sensitivity under non-IID training may reflect benign client specialization rather than backdoor behavior. FedTSR is more robust because it does not rely on static sensitivity alone; it jointly considers temporal concentration, firing deviation, and class-response concentration.

Table 18. Robustness to federated data heterogeneity under the hybrid trigger. Smaller Dirichlet concentration $\xi$ indicates stronger non-IID client distributions.

Dataset	Partition	Compromised ${\mathit{\theta }}^{\mathbf{★}}$		ANP		FedTSR
		ACC↑	ASR↓	ACC↑	ASR↓	ACC↑	ASR↓
CIFAR10-DVS	$\xi =0.1$	68.4	96.2	63.2	23.6	67.1	9.8
	$\xi =0.3$	70.5	95.4	65.5	20.1	69.0	8.4
	$\xi =0.5$	71.8	94.8	66.8	18.4	70.3	7.6
	$\xi =1.0$	72.7	92.5	68.1	14.2	71.2	6.4
	IID	73.1	90.7	68.8	12.5	71.6	5.9
DVS Gesture	$\xi =0.1$	93.4	94.7	89.2	21.0	92.7	8.8
	$\xi =0.3$	94.5	92.3	90.6	18.6	93.8	7.5
	$\xi =0.5$	95.2	91.5	91.8	16.3	94.5	6.9
	$\xi =1.0$	95.7	89.2	92.6	13.6	95.0	5.8
	IID	96.0	86.5	93.1	11.8	95.2	5.2

We next vary the malicious-client ratio $m=\left|\mathcal{A}\right|/K$ while keeping the local poisoning ratio fixed at $\rho =0.2$. Figure 7 shows the resulting $\mathrm{ASR}$ on CIFAR10-DVS. As m increases, the compromised model rapidly becomes more strongly backdoored, and ANP also leaves a larger residual attack success rate. FedTSR degrades more gracefully: even when $30\%$ of clients are malicious, its repaired model keeps $\mathrm{ASR}$ at $16.8\%$, substantially below the corresponding ANP result. This trend indicates that the temporal risk mask ${\pi }_{\mathcal{l},g}$ remains informative even when poisoned updates occupy a larger fraction of the federated aggregation process.

Figure 7. Attack success rate on CIFAR10-DVS when the malicious-client ratio changes. The dotted triangle curve denotes the compromised model, the dashed square curve denotes ANP, and the solid circle curve denotes FedTSR.

Table 19 reports absolute runtime and memory on all datasets. The energy proxy is computed as wall-clock time multiplied by the measured average GPU power during repair; it is intended only as a hardware-specific efficiency indicator, not as a neuromorphic hardware measurement.

Table 19. Absolute repair runtime and peak GPU memory. Entries are seconds/GB.

Method	N-MNIST	CIFAR10-DVS	DVS Gesture	CIFAR-10
Fine-tuning	28/1.9	75/4.2	102/5.4	35/2.3
Fine-pruning	35/2.1	91/4.6	124/5.8	44/2.7
NAD	52/2.3	118/4.9	166/6.4	61/2.9
ANP	136/3.5	311/6.8	438/8.9	149/4.2
FedTSR, TSRE only	11/2.4	24/5.0	36/6.7	13/2.8
FedTSR, SCR only	36/2.8	82/5.4	112/7.0	43/3.0
FedTSR, total	47/2.8	106/5.4	148/7.0	56/3.0

Table 20 compares the repair cost of different defenses on CIFAR10-DVS. The cost is normalized by the full FedTSR repair cost, so a value below $1.00$ means faster repair than FedTSR and a value above $1.00$ means higher repair cost. The damping-only variant is the fastest because it requires only temporal statistic collection and risk-adaptive weight damping, but it does not recover clean accuracy as well as full FedTSR. ANP has a larger cost because it searches for sensitive neurons through adversarial perturbation before calibration. Full federated retraining can obtain a low $\mathrm{ASR}$ if all clients are available and clean collaboration is restarted, but it requires new communication rounds and violates the post-training repair assumption. FedTSR achieves the best practical balance because it needs no client communication and keeps both repair cost and clean accuracy degradation modest.

Table 20. Sanitization efficiency on CIFAR10-DVS under the hybrid trigger. Relative repair cost is normalized by the cost of full FedTSR. Communication rounds count additional rounds required after the compromised model ${\theta }^{★}$ has already been obtained.

Method	Update Scope	Relative Cost ↓	Extra Rounds ↓	ACC ↑	ASR ↓
No defense	None	0.00	0	71.8	94.8
Fine-tuning	All parameters	0.71	0	69.9	58.6
Fine-pruning	Channels and all parameters	0.86	0	67.5	39.7
NAD	All parameters	1.12	0	68.4	31.5
ANP	Sensitive neurons and all parameters	2.95	0	66.8	18.4
FedTSR, damping only	Risky synaptic groups	0.18	0	69.1	10.8
FedTSR	Risk-gated synaptic groups	1.00	0	70.3	7.6
Clean federated retraining	All clients and all parameters	176.00	200	71.5	5.9

Figure 8 visualizes the normalized repair cost of server-side defenses in Table 20. The figure excludes clean federated retraining because its cost is far outside the scale of post-training repair methods. The comparison shows that FedTSR is substantially cheaper than ANP while achieving a lower $\mathrm{ASR}$ in Table 20. This efficiency advantage comes from the grouped risk estimation strategy: FedTSR collects temporal statistics in a small number of calibration passes and then updates the model using risk-gated gradients instead of repeatedly searching over vulnerable neurons.

Figure 8. Normalized repair cost of server-side defenses on CIFAR10-DVS. Bars from left to right denote fine-tuning, fine-pruning, NAD, ANP, FedTSR with damping only, and full FedTSR; lower bars indicate faster post-training repair.

The robustness and efficiency results in Table 18 and Table 20, and Figure 7 and Figure 8 show that FedTSR is suitable for the intended federated neuromorphic deployment scenario. It remains effective under strong non-IID data partitioning and increased malicious-client ratios, while requiring no new client communication after ${\theta }^{★}$ is obtained. Combined with the ablation analysis in Section 5.3, these results suggest that temporal synaptic risk estimation provides a practical and selective alternative to expensive retraining or static neuron suppression.

5.5. Discussion and Limitations

FedTSR is designed for fast server-side repair after federated training, so its threat model is intentionally different from training-time robust aggregation. The method depends on a reasonably clean and representative calibration set. Table 15 shows that small accidental contamination can be tolerated, but severe contamination or distribution shift degrades both risk estimation and SCR. FedTSR also does not provide a certified guarantee against adaptive attackers that explicitly optimize triggers to match benign temporal statistics; the benign-mimic trigger in Table 15 is the hardest case in our evaluation. More broadly, the trigger-agnostic claim means that FedTSR does not use trigger identity, target label, or malicious-client information during repair; it does not mean that every possible adaptive trigger family has been exhausted.

There are also evaluation limitations. The main results use three random seeds, and Table 7 reports standard deviations and paired tests, but a larger seed budget would further strengthen statistical confidence. All runtime and memory values in Table 19 are measured on a GPU-based software simulator; we have not validated the repair process on neuromorphic hardware, where membrane discretization, event routing, and quantized synapses may change the effectiveness of damping. Finally, FedTSR assumes a synchronous final global model. It can be applied to checkpoints from asynchronous or partial-participation federated learning, but additional analysis is needed when stale updates, client dropout, or extremely severe non-IID partitions create benign temporal patterns that resemble backdoor shortcuts.

6. Conclusions

This paper studied fast post-training backdoor removal for spiking neural networks trained through federated learning, where the defender only has access to a possibly compromised global model ${\theta }^{★}$ and a small clean calibration set ${\mathcal{D}}_c$. We proposed FedTSR, a trigger-agnostic and client-independent sanitization framework that exploits the temporal nature of SNN computation. FedTSR first estimates group-wise temporal synaptic risk by combining temporal concentration $A_{\mathcal{l},g}$, firing deviation $B_{\mathcal{l},g}$, and class-response concentration $D_{\mathcal{l},g}$, then converts the resulting score $R_{\mathcal{l},g}$ into a continuous risk mask ${\pi }_{\mathcal{l},g}$ for risk-adaptive damping. To avoid damaging benign event-driven representations, FedTSR further performs spike-consistency recalibration with clean-label supervision, output consistency, membrane-and-spike temporal alignment, and risk anchoring. In the evaluated settings, experiments on N-MNIST, CIFAR10-DVS, DVS Gesture, and CIFAR-10 show that FedTSR consistently reduces attack success rate under static, temporal, and hybrid backdoor triggers while preserving clean accuracy, and the ablation studies support the importance of both temporal risk estimation and spike-consistency recalibration. These results indicate that backdoor removal in federated SNNs should not treat the model as a static neural network, but should explicitly sanitize timestep-wise synaptic pathways and preserve benign spike dynamics. Future work may extend this framework to asynchronous federated neuromorphic systems, continual SNN learning, and certified robustness analysis for event-driven backdoor defense. These empirical findings are limited to the evaluated threat models and do not constitute certified robustness against all adaptive attacks, as discussed in Section 5.5.