Differential Privacy — Spike-Level DP¶

Spike-level differential privacy: add privacy noise at the spike domain instead of the gradient domain. Exploits the binary nature of spikes for more natural DP mechanisms.

Why Spike-Level DP?¶

Standard DP-SGD adds Gaussian noise to gradients (continuous, high-dimensional). For SNNs, spikes are already binary — we can use mechanisms designed for binary data:

Mechanism	How It Works	Privacy Cost
Randomized Response	Flip each bit with probability `p = 1/(1+e^ε)`	ε per bit
Poisson Subsampling	Keep each spike with probability `q = e^ε/(1+e^ε)`	ε per step

Components¶

SpikeLevelDP — Main DP mechanism.

Parameter	Default	Meaning
`epsilon`	1.0	Per-step privacy budget
`mechanism`	"randomized_response"	DP mechanism

Methods: privatize(spikes) — apply DP noise to a spike tensor.

PrivacyAccountant — Track cumulative privacy budget.

Parameter	Default	Meaning
`target_epsilon`	1.0	Total privacy budget
`target_delta`	1e-5	Failure probability

Properties: spent_epsilon, remaining_epsilon, budget_exhausted. Methods: record_step(step_epsilon), summary().

MembershipAudit — Audit SNN for membership inference vulnerability. Compares model confidence on training vs non-training samples. Returns accuracy (0.5 = no leakage, 1.0 = full leak), vulnerable flag if accuracy > 0.6.

Governance Contracts¶

The sc_neurocore.privacy.governance module defines the deterministic manifest surface for neural and BCI deployments that need privacy evidence before data or model artefacts leave a controlled environment.

Contract	Purpose
`ConsentBoundary`	Participant identity, legal basis, telemetry consent, allowed purposes, consent token, and issue timestamp.
`RetentionPolicy`	Raw-stream, model-artifact, and audit-log retention windows bounded by one maximum horizon.
`RedactionPolicy`	Field-level redaction activation, protected fields, and replacement marker.
`TelemetryPolicy`	Telemetry enablement, sink name, and sampling interval.
`ProvenanceRecord`	Artefact URI, hash algorithm, hash value, artefact type, and source system.
`IntegratorResponsibility`	Integrator contact, operational responsibilities, and release approval requirement.
`PrivacyFeatureFlags`	Differential-privacy, federated-learning, telemetry logging, and audit-flag activation.
`GovernanceContract`	Cross-section contract that fails closed when telemetry lacks consent/redaction or sensitive features lack audit flags.

Python

from sc_neurocore.privacy import GovernanceContract

contract = GovernanceContract.from_dict(manifest)
assert contract.active_features() == ("telemetry_logging",)
signed_manifest = contract.to_dict()

The governance surface is intentionally dependency-free and does not have a polyglot compute counterpart. It is covered by tests/test_privacy_governance.py with 100% isolated module coverage and strict type checking.

Usage¶

Python

from sc_neurocore.privacy.dp_snn import SpikeLevelDP, PrivacyAccountant, MembershipAudit
import numpy as np

# Apply DP to spike outputs
dp = SpikeLevelDP(epsilon=1.0, mechanism="randomized_response")
spikes = np.random.randint(0, 2, (100, 64)).astype(np.int8)
private_spikes = dp.privatize(spikes)

# Track privacy budget
accountant = PrivacyAccountant(target_epsilon=10.0)
for step in range(100):
    accountant.record_step(dp.per_step_epsilon)
    if accountant.budget_exhausted:
        print(f"Budget exhausted at step {step}")
        break
print(accountant.summary())

# Membership inference audit
def model_fn(x):
    return np.random.randn(10)  # your model here

auditor = MembershipAudit(run_fn=model_fn)
result = auditor.audit(member_samples, non_member_samples)
print(f"MI accuracy: {result['accuracy']:.2f}, vulnerable: {result['vulnerable']}")

See Tutorial 62: Differential Privacy.

`sc_neurocore.privacy` ¶

Spike-level differential privacy: training and inference with privacy guarantees.

`PrivacyAccountant` `dataclass` ¶

Track cumulative privacy budget across training steps.

Uses simple composition theorem: total epsilon = sum of per-step epsilons. For tighter bounds, use Renyi DP (future extension).

Parameters¶

target_epsilon : float Privacy budget limit. target_delta : float Failure probability.

Source code in src/sc_neurocore/privacy/dp_snn.py

Python
@dataclass
class PrivacyAccountant:
    """Track cumulative privacy budget across training steps.

    Uses simple composition theorem: total epsilon = sum of per-step epsilons.
    For tighter bounds, use Renyi DP (future extension).

    Parameters
    ----------
    target_epsilon : float
        Privacy budget limit.
    target_delta : float
        Failure probability.
    """

    target_epsilon: float = 1.0
    target_delta: float = 1e-5
    _spent_epsilon: float = 0.0
    _steps: int = 0

    def record_step(self, step_epsilon: float) -> None:
        """Record privacy cost of one training step."""
        self._spent_epsilon += step_epsilon
        self._steps += 1

    @property
    def spent_epsilon(self) -> float:
        return self._spent_epsilon

    @property
    def remaining_epsilon(self) -> float:
        return max(0.0, self.target_epsilon - self._spent_epsilon)

    @property
    def budget_exhausted(self) -> bool:
        return self._spent_epsilon >= self.target_epsilon

    def summary(self) -> str:
        return (
            f"Privacy: epsilon={self._spent_epsilon:.4f}/{self.target_epsilon} "
            f"({self._steps} steps), delta={self.target_delta}"
        )

`record_step(step_epsilon)` ¶

Record privacy cost of one training step.

Source code in src/sc_neurocore/privacy/dp_snn.py

Python
def record_step(self, step_epsilon: float) -> None:
    """Record privacy cost of one training step."""
    self._spent_epsilon += step_epsilon
    self._steps += 1

`MembershipAudit` ¶

Audit SNN for membership inference vulnerability.

Given a trained model (as a callable), test whether it leaks information about training data membership. Uses shadow model methodology: compare model confidence on training vs non-training samples.

Parameters¶

run_fn : callable Model function: takes spikes (T, N) → output (N_out,).

Source code in src/sc_neurocore/privacy/dp_snn.py

Python
class MembershipAudit:
    """Audit SNN for membership inference vulnerability.

    Given a trained model (as a callable), test whether it leaks
    information about training data membership. Uses shadow model
    methodology: compare model confidence on training vs non-training
    samples.

    Parameters
    ----------
    run_fn : callable
        Model function: takes spikes (T, N) → output (N_out,).
    """

    def __init__(self, run_fn: Callable[..., Any]) -> None:
        self.run_fn = run_fn

    def audit(
        self,
        member_samples: list[np.ndarray[Any, Any]],
        non_member_samples: list[np.ndarray[Any, Any]],
    ) -> dict[str, Any]:
        """Run membership inference audit.

        Parameters
        ----------
        member_samples : list of ndarray
            Samples known to be in the training set.
        non_member_samples : list of ndarray
            Samples known to NOT be in the training set.

        Returns
        -------
        dict with:
            - accuracy: membership inference accuracy (0.5 = no leakage, 1.0 = full leak)
            - member_confidence: mean output magnitude for members
            - non_member_confidence: mean output magnitude for non-members
            - vulnerable: bool, True if accuracy > 0.6
        """
        member_scores = [float(np.abs(self.run_fn(s)).mean()) for s in member_samples]
        non_member_scores = [float(np.abs(self.run_fn(s)).mean()) for s in non_member_samples]

        mean_member = float(np.mean(member_scores))
        mean_non = float(np.mean(non_member_scores))

        # Threshold-based inference: predict member if score > midpoint
        threshold = (mean_member + mean_non) / 2
        correct = 0
        total = len(member_scores) + len(non_member_scores)

        for s in member_scores:
            if s >= threshold:
                correct += 1
        for s in non_member_scores:
            if s < threshold:
                correct += 1

        accuracy = correct / max(total, 1)

        return {
            "accuracy": accuracy,
            "member_confidence": mean_member,
            "non_member_confidence": mean_non,
            "vulnerable": accuracy > 0.6,
        }

`audit(member_samples, non_member_samples)` ¶

Run membership inference audit.

Parameters¶

member_samples : list of ndarray Samples known to be in the training set. non_member_samples : list of ndarray Samples known to NOT be in the training set.

Returns¶

dict with: - accuracy: membership inference accuracy (0.5 = no leakage, 1.0 = full leak) - member_confidence: mean output magnitude for members - non_member_confidence: mean output magnitude for non-members - vulnerable: bool, True if accuracy > 0.6

Source code in src/sc_neurocore/privacy/dp_snn.py

Python
def audit(
    self,
    member_samples: list[np.ndarray[Any, Any]],
    non_member_samples: list[np.ndarray[Any, Any]],
) -> dict[str, Any]:
    """Run membership inference audit.

    Parameters
    ----------
    member_samples : list of ndarray
        Samples known to be in the training set.
    non_member_samples : list of ndarray
        Samples known to NOT be in the training set.

    Returns
    -------
    dict with:
        - accuracy: membership inference accuracy (0.5 = no leakage, 1.0 = full leak)
        - member_confidence: mean output magnitude for members
        - non_member_confidence: mean output magnitude for non-members
        - vulnerable: bool, True if accuracy > 0.6
    """
    member_scores = [float(np.abs(self.run_fn(s)).mean()) for s in member_samples]
    non_member_scores = [float(np.abs(self.run_fn(s)).mean()) for s in non_member_samples]

    mean_member = float(np.mean(member_scores))
    mean_non = float(np.mean(non_member_scores))

    # Threshold-based inference: predict member if score > midpoint
    threshold = (mean_member + mean_non) / 2
    correct = 0
    total = len(member_scores) + len(non_member_scores)

    for s in member_scores:
        if s >= threshold:
            correct += 1
    for s in non_member_scores:
        if s < threshold:
            correct += 1

    accuracy = correct / max(total, 1)

    return {
        "accuracy": accuracy,
        "member_confidence": mean_member,
        "non_member_confidence": mean_non,
        "vulnerable": accuracy > 0.6,
    }

`SpikeLevelDP` ¶

Spike-level differential privacy mechanism.

Adds stochastic spike noise to provide (epsilon, delta)-DP. Two mechanisms: - Spike randomized response: each spike independently flipped with probability p - Spike subsampling: randomly drop spikes with probability 1-q

Parameters¶

epsilon : float Per-step privacy budget. mechanism : str 'randomized_response' or 'subsampling'. seed : int

Source code in src/sc_neurocore/privacy/dp_snn.py

Python
class SpikeLevelDP:
    """Spike-level differential privacy mechanism.

    Adds stochastic spike noise to provide (epsilon, delta)-DP.
    Two mechanisms:
    - Spike randomized response: each spike independently flipped with probability p
    - Spike subsampling: randomly drop spikes with probability 1-q

    Parameters
    ----------
    epsilon : float
        Per-step privacy budget.
    mechanism : str
        'randomized_response' or 'subsampling'.
    seed : int
    """

    def __init__(
        self, epsilon: float = 1.0, mechanism: str = "randomized_response", seed: int = 42
    ) -> None:
        self.epsilon = epsilon
        self.mechanism = mechanism
        self._rng = np.random.RandomState(seed)

        # Compute noise parameter from epsilon
        if mechanism == "randomized_response":
            # Randomized response: flip each bit with probability p = 1/(1+e^epsilon)
            self.flip_prob = 1.0 / (1.0 + np.exp(epsilon))
        elif mechanism == "subsampling":
            # Poisson subsampling: keep each spike with probability q = e^epsilon / (1+e^epsilon)
            self.keep_prob = np.exp(epsilon) / (1.0 + np.exp(epsilon))
        else:
            raise ValueError(f"Unknown mechanism '{mechanism}'")

    def privatize(self, spikes: np.ndarray[Any, Any]) -> np.ndarray[Any, Any]:
        """Apply DP mechanism to a spike tensor.

        Parameters
        ----------
        spikes : ndarray of shape (T, N) or (N,)
            Binary spike tensor.

        Returns
        -------
        ndarray, same shape
            Privatized spikes.
        """
        if self.mechanism == "randomized_response":
            flip_mask = self._rng.random(spikes.shape) < self.flip_prob
            privatized = spikes.copy().astype(np.int8)
            privatized[flip_mask] = 1 - privatized[flip_mask]
            return privatized
        else:
            keep_mask = self._rng.random(spikes.shape) < self.keep_prob
            masked_spikes: np.ndarray[Any, Any] = (spikes * keep_mask).astype(spikes.dtype)
            return masked_spikes

    @property
    def per_step_epsilon(self) -> float:
        return self.epsilon

`privatize(spikes)` ¶

Apply DP mechanism to a spike tensor.

Parameters¶

spikes : ndarray of shape (T, N) or (N,) Binary spike tensor.

Returns¶

ndarray, same shape Privatized spikes.

Source code in src/sc_neurocore/privacy/dp_snn.py

Python
def privatize(self, spikes: np.ndarray[Any, Any]) -> np.ndarray[Any, Any]:
    """Apply DP mechanism to a spike tensor.

    Parameters
    ----------
    spikes : ndarray of shape (T, N) or (N,)
        Binary spike tensor.

    Returns
    -------
    ndarray, same shape
        Privatized spikes.
    """
    if self.mechanism == "randomized_response":
        flip_mask = self._rng.random(spikes.shape) < self.flip_prob
        privatized = spikes.copy().astype(np.int8)
        privatized[flip_mask] = 1 - privatized[flip_mask]
        return privatized
    else:
        keep_mask = self._rng.random(spikes.shape) < self.keep_prob
        masked_spikes: np.ndarray[Any, Any] = (spikes * keep_mask).astype(spikes.dtype)
        return masked_spikes