  How can we bring both privacy and energy-efficiency to a neural system? In
this paper, we propose PrivateSNN, which aims to build low-power Spiking Neural
Networks (SNNs) from a pre-trained ANN model without leaking sensitive
information contained in a dataset. Here, we tackle two types of leakage
problems: 1) Data leakage is caused when the networks access real training data
during an ANN-SNN conversion process. 2) Class leakage is caused when
class-related features can be reconstructed from network parameters. In order
to address the data leakage issue, we generate synthetic images from the
pre-trained ANNs and convert ANNs to SNNs using the generated images. However,
converted SNNs remain vulnerable to class leakage since the weight parameters
have the same (or scaled) value with respect to ANN parameters. Therefore, we
encrypt SNN weights by training SNNs with a temporal spike-based learning rule.
Updating weight parameters with temporal data makes SNNs difficult to be
interpreted in the spatial domain. We observe that the encrypted PrivateSNN
eliminates data and class leakage issues with a slight performance drop (less
than ~2) and significant energy-efficiency gain (about 55x) compared to the
standard ANN. We conduct extensive experiments on various datasets including
CIFAR10, CIFAR100, and TinyImageNet, highlighting the importance of
privacy-preserving SNN training.
