On the Sensitivity of Firing Rate-Based Federated Spiking Neural Networks to Differential Privacy

Federated Neuromorphic Learning (FNL) enables energy-efficient and privacy-preserving learning on devices without centralizing data. However, real-world deployments require additional privacy mechanisms that can significantly alter training signals. This paper analyzes how Differential Privacy (DP) mechanisms, specifically gradient clipping and noise injection, perturb firing-rate statistics in Spiking Neural Networks (SNNs) and how these perturbations are propagated to rate-based FNL coordination. On a speech recognition task under non-IID settings, ablations across privacy budgets and clipping bounds reveal systematic rate shifts, attenuated aggregation, and ranking instability during client selection. Moreover, we relate these shifts to sparsity and memory indicators. Our findings provide actionable guidance for privacy-preserving FNL, specifically regarding the balance between privacy strength and rate-dependent coordination.

💡 Research Summary

This paper investigates how differential privacy (DP) mechanisms—specifically per‑sample gradient clipping and Gaussian noise injection (DP‑SGD)—affect the firing‑rate statistics that underpin rate‑aware coordination in federated spiking neural networks (SNNs). The authors first develop a theoretical sensitivity analysis that links DP‑induced perturbations in model parameters to bias and variance in the estimated firing rates of leaky‑integrate‑and‑fire (LIF) neurons. By linearizing the parameter update around a non‑DP reference, they show that clipping introduces a systematic shrinkage (bias) of large‑norm gradient directions, while the added Gaussian noise inflates the dispersion of the firing‑rate estimator proportionally to the noise multiplier σ and the clipping bound C. These two effects are propagated to the firing‑rate space through the gradient of the rate with respect to the parameters (∇r), yielding closed‑form expressions for the expected bias (δ_clip) and variance (σ²C²/(B²)·‖∇r‖²).

The paper then examines two rate‑dependent federated learning (FL) mechanisms that have appeared in recent neuromorphic FL literature: (i) a rate‑weighted asynchronous aggregation rule that scales each client’s contribution by a Gaussian kernel ζₖ based on the client’s average spike rate, and (ii) a client‑selection scheme that ranks clients by the squared change in class‑wise firing‑rate vectors (ΔRₖ). The analysis predicts that DP‑induced increases in inter‑client rate variance (σ_r) will flatten the aggregation kernel (reducing all ζₖ and thus the global step size λ) and simultaneously make the kernel less discriminative, while systematic shifts in the mean rate (μ_r) will bias the aggregation toward clients whose rates are less perturbed by DP noise. For client selection, the same noise inflates ΔRₖ, leading to higher probability of ranking inversions and reduced Kendall‑τ correlation with the non‑DP ranking.

To validate these predictions, the authors conduct an extensive ablation study on a keyword‑spotting task using the Google Speech Commands dataset converted to spike trains via the Speech2Spikes algorithm (T = 200 time steps). They employ a compact LIF‑based SNN from NeuroBench, ten heterogeneous clients generated with a Dirichlet concentration α = 1, and full participation across ten FL rounds (batch size 64, one local epoch). Differential privacy budgets ε ∈ {8, 4, 1, 0.5} (δ fixed) are combined with clipping bounds C ∈ {0.5, 1, 2}. The non‑DP run serves as a reference (A0).

Key metrics include: (a) RMSE of the network‑wide firing rate (RMSE r), (b) layer‑wise RMSE, (c) activation sparsity RMSE (RMSE AS), (d) client footprint RMSE (RMSE FP), (e) absolute deviation of aggregation weights (|Δλ|), and (f) Kendall‑τ for client‑ranking stability. Results show that while the overall RMSE r remains modest (≈ 0.015 ± 0.002), layer‑wise rates in hidden layers are noticeably suppressed as ε decreases, confirming the bias predicted by the theory. In the rate‑weighted aggregation scenario, the most aggressive privacy setting (ε = 8, C = 0.5) yields |Δλ| ≈ 80.8 and a negative Kendall‑τ (‑0.268 ± 0.030), indicating severe distortion of the aggregation kernel. Raising the clipping bound (C = 2) at the same ε reduces |Δλ| to ≈ 19.1 but slightly increases RMSE r and RMSE AS, illustrating the classic bias‑variance trade‑off. In the rate‑difference client‑selection experiments, Kendall‑τ values drop from ≈ 0.06 (ε = 4, C = 0.5) to ≈ 0.25 (ε = 1, C = 0.5), confirming that DP noise destabilizes the ranking used for client scheduling. Notably, activation sparsity and client memory footprints remain largely unchanged across privacy settings, suggesting that DP primarily perturbs the firing‑rate statistics rather than the model size itself.

The authors discuss practical implications: (1) careful tuning of clipping bounds is essential; tighter clipping reduces variance but introduces bias, while looser clipping does the opposite. (2) Normalizing the round‑wise rate statistics (μ_r, σ_r) before computing ζₖ can mitigate the flattening effect of DP‑inflated σ_r. (3) Replacing rate‑based weighting or selection with loss‑based or parameter‑norm‑based alternatives can improve robustness to DP noise. (4) Adaptive clipping that reacts to per‑client gradient norm distributions may further balance privacy and utility.

Limitations are acknowledged: the study is confined to a single event‑driven task, one LIF architecture, ten clients, and a fixed non‑IID level (α = 1). Future work should explore diverse tasks (e.g., vision, multimodal), other spiking neuron models (Izhikevich, adaptive LIF), larger client pools, asynchronous sampling, and alternative privacy accounting methods (Rényi DP, subsampled Gaussian mechanisms). Extending the analysis to spike‑timing statistics beyond average rates is also an open direction.

In conclusion, the paper demonstrates that DP‑SGD’s clipping and noise, though applied to surrogate gradients, propagate through the learned parameters to systematically bias and increase the variance of firing‑rate estimates. These perturbations materially degrade rate‑aware federated coordination, causing large deviations in aggregation weights and unstable client rankings. The work provides both a rigorous analytical framework and empirical evidence, offering actionable guidance for designing privacy‑preserving federated neuromorphic systems that must balance privacy strength against the fidelity of rate‑dependent signals.