SNN-IDS: Deploying SNN-Equivalent Intrusion Detection on a Commodity MCU NPU

1. Introduction

Deep learning has transformed network intrusion detection, but deploying these models at the network edge remains difficult. Edge IDS must operate under tight power and latency budgets, and the dominant approach today still relies on cloud offloading or high-end GPUs, neither of which fits IoT or telecom CPE (customer premises equipment) scenarios where per-device cost must stay below $10.

Spiking neural networks offer a different compute paradigm. Because SNNs process information as discrete spikes rather than dense floating-point activations, they can be extremely energy-efficient when run on neuromorphic hardware [1]. The catch is that neuromorphic chips are not commodity parts. Intel Loihi [2] is a research platform. BrainChip Akida is available commercially but carries a price premium. Neither is a standard MCU that an OEM can drop into a low-cost IoT gateway.

A line of theoretical work changes this picture. Bu et al. [3] introduced QCFS, showing that ANN activations can be mapped to discrete spike counts with minimal loss. Jiang et al. [4] provided the first $T=1$ ANN–SNN conversion framework via SlipReLU. More recently, Bu et al. [5] showed that when an SNN runs for exactly one timestep ($T=1$) with zero initial membrane potential, the threshold-and-fire operation reduces to a ReLU-like clamp, making the forward pass approximately equivalent to an INT8 quantized ANN. The practical implication: any NPU that can execute INT8 matrix multiply and ReLU can run an SNN-equivalent model without neuromorphic hardware.

We put this theory to the test. Using the STM32N6570-DK development board (ARM Cortex-M55 at 800 MHz, Neural-ART NPU rated at 600 GOPS INT8), we train an MLP for intrusion detection on two standard benchmarks (NSL-KDD and UNSW-NB15), quantize it to INT8, and deploy it on the NPU through ST Edge AI Developer Cloud. The classifier infers in 0.29–0.46 ms (2.7–4.2× faster than CPU-only execution) with a memory footprint under 140 KB. We focus on inference latency and memory footprint of the classifier stage on pre-extracted flow-level features; power estimates derived from ST’s published application note are noted in Section 5.5 but direct on-board measurement is deferred. A complete end-to-end IDS pipeline (packet capture, flow aggregation, feature extraction) is left to future work.

Our contributions:

• We present, to our knowledge, the first publicly documented IDS classifier deployment on an ARM Cortex-M NPU (Neural-ART). Prior MCU-class IDS work used the MAX78000 [6], an AI-specialized MCU with a fixed CNN accelerator; our target is a general-purpose MCU with an attached programmable NPU.
• We provide the first publicly documented empirical validation of the $T=1$ SNN–ANN equivalence on commercial NPU silicon, with 99% final prediction agreement between FP32 and INT8 models.
• We conduct a quantization ablation (3 calibration methods × 2 granularities × 4 sample sizes) showing that INT8 accuracy is insensitive to calibration choices (all deviations $<1$ pp).
• We document that the Floor operator required by QCFS [3] falls back to CPU on the Neural-ART NPU, identifying a concrete barrier for deploying QCFS-based SNN models on commodity NPUs.

2. Related Work

2.1. SNN-Based Intrusion Detection

Table 1 summarizes prior work on neural-network-based IDS with SNN components or edge hardware deployment. Research on applying SNNs to network intrusion detection has grown rapidly since 2024, though nearly all published results remain in simulation. Wang et al. [7] proposed a convolutional SNN for IDS on NSL-KDD and UNSW-NB15 in software simulation. Prajwalasimha et al. [8] described an event-driven SNN-IDS and tested it in simulation. Mustafa et al. [9] combined recurrent and spiking layers for anomaly detection. Karthik et al. [10] proposed a transformer-spiking hybrid; all run only on GPU.

Two prior works deploy IDS on physical hardware. Zahm et al. [11] used the BrainChip Akida AKD1000 neuromorphic processor, reporting 98.4% accuracy at approximately 1 W. Akida is a purpose-built neuromorphic chip ($499 dev kit) with native spike processing, not a general-purpose MCU. Ngo et al. [6] deployed a lightweight MLP (1,360 parameters, 11 flow features) on the Analog Devices MAX78000, an AI-specialized MCU with a fixed CNN accelerator. They achieved 98.57% on UNSW-NB15 (binary classification: normal vs. attack) at 18 mW. The MAX78000’s accelerator is hard-wired for convolutional workloads; the STM32N6 Neural-ART NPU is a programmable accelerator that supports arbitrary operator graphs within its INT8 operator set. Our work differs from both in targeting a general-purpose ARM Cortex-M MCU with an attached NPU, using multi-class classification (5-class and 10-class), and validating $T=1$ SNN equivalence.

2.2. ANN-SNN Conversion

The theory of converting a trained ANN into an equivalent SNN has matured over several stages. Bu et al. [3] introduced QCFS, a quantization-aware activation function that maps ANN activations to discrete spike counts. Jiang et al. [4] proposed a unified optimization framework and the first $T=1$ conversion method (SlipReLU). Bu et al. [5] later analyzed the inference-scale complexity of SNNs, establishing channel-wise threshold optimization for $T=1$ conversion. NEXUS [12] recently achieved bit-exact ANN-to-SNN equivalence via modular arithmetic, scaling to LLaMA-2 70B. PASCAL [13] refined multi-timestep conversion with spike accumulation and adaptive layerwise calibration. NeuroFlex [14] showed that co-executing INT8 ANN and SNN layers on the same accelerator can cut the energy-delay product by 57–67%.

To our knowledge, this paper provides the first publicly documented empirical validation of the $T=1$ equivalence on commercial NPU silicon.

2.3. Edge AI on MCU NPUs

The STM32N6 is STMicroelectronics’ first MCU with a dedicated neural processing unit [15]. Public deployments span computer vision and audio processing. The NPU’s hardware operator set covers Conv, Gemm, Relu, Add, Clip, and MaxPool in INT8; operators outside this set fall back to the Cortex-M55 CPU [15]. Millar et al. [16] benchmarked micro-NPUs including the Neural-ART; their latency numbers provide a useful reference point. To our knowledge, no prior publicly documented work has deployed an IDS on any general-purpose MCU NPU. The closest prior art (HH-NIDS [6]) used a specialized MCU with a fixed CNN engine.

3. Background

3.1. $T=1$ SNN–ANN Equivalence

A Leaky Integrate-and-Fire (LIF) neuron with membrane potential V, weight matrix $\mathbf{W}$, and threshold $\theta$ operates as:

$$\begin{array}{cc}\hfill V\left[t\right]& =\beta ·V[t-1]+\mathbf{W}·\mathbf{x}\left[t\right]\hfill \end{array}$$

(1)

$$\begin{array}{cc}\hfill S\left[t\right]& =\Theta \left(V\right[t]-\theta )\hfill \end{array}$$

(2)

where $\Theta$ is the Heaviside step function and $\beta$ is the leak factor. At $T=1$ with zero initial state ($V\left[0\right]=0$), the leak term $\beta ·V\left[0\right]$ vanishes regardless of $\beta$, so Eq. 1 simplifies to $V\left[1\right]=\mathbf{W}·\mathbf{x}$.

Multiple works have established that INT8 post-training quantization produces a discretization that closely approximates the threshold-and-fire operation [3,4,5]. In practice, any NPU executing INT8 Gemm + Relu is performing SNN-equivalent computation, with accuracy gaps typically below 1 pp on standard benchmarks.

3.2. QCFS Activation

QCFS [3] maps ANN activations to discrete spike counts: $\mathrm{QCFS}\left(x\right)=\lfloor \mathrm{clip}(x/s,0,L)\rfloor ·s$, where $s=\theta /L$ is the quantization step and L is the number of levels. Its ONNX graph requires Floor, which is absent from the Neural-ART operator set (Section 5.5).

3.3. STM32N6 Neural-ART NPU

The STM32N6570-DK pairs an ARM Cortex-M55 at 800 MHz with ST’s Neural-ART NPU, rated at 600 GOPS for INT8 workloads [15]. The NPU natively supports Conv, Gemm, Relu, Add, Clip, and MaxPool in INT8. Operators outside this set are dispatched to the CPU, incurring cache-maintenance overhead for NPU↔CPU data transfers.

4. Method

Figure 1 shows the deployment pipeline. Both paths share the same training and export procedure; they diverge only in the activation function.

4.1. Model Architecture

We use a four-layer MLP with BatchNorm:

$$\begin{array}{cc}\hfill & \mathtt{Lin}(d\to 256)\to \mathtt{BN}\to \sigma \to \mathtt{Lin}(256\to 256)\to \mathtt{BN}\to \sigma \hfill \\ \hfill & \to \mathtt{Lin}(256\to 128)\to \mathtt{BN}\to \sigma \to \mathtt{Lin}(128\to C)\hfill \end{array}$$

where d is the input dimension (41 for NSL-KDD, 34 for UNSW-NB15), C is the number of classes (5 or 10), and $\sigma$ is ReLU (Path B) or QCFS $L=4$ (Path A). The model has 111,365 parameters (NSL-KDD) or 110,218 (UNSW-NB15). At ONNX export, BatchNorm is folded into the preceding Linear layer.

4.2. Datasets

NSL-KDD [17] contains 125,973 training and 22,544 test instances with 41 features. We use 5-class grouping: normal, DoS, Probe, R2L, U2R. Three categorical features are label-encoded; 38 continuous features are z-score normalized using training-set statistics.

UNSW-NB15 [18] contains 175,341 training and 82,332 test instances with 34 features and 10 attack categories: Analysis, Backdoor, DoS, Exploits, Fuzzers, Generic, Normal, Reconnaissance, Shellcode, Worms. Three categorical features (proto, service, state) are label-encoded; remaining features are z-score normalized.

4.3. Training

Both paths use Adam ($\mathrm{lr}={10}^{-3}$, weight decay ${10}^{-5}$), cosine annealing over 80 epochs, batch size 512, and inverse-frequency class weighting. All experiments are repeated with 10 random seeds (0–9); we report mean ± standard deviation. Training uses PyTorch 2.10 on an NVIDIA DGX Spark (GB10 GPU).

4.4. INT8 Post-Training Quantization

FP32 ONNX models are quantized to INT8 using ONNX Runtime static quantization. The default configuration uses MinMax calibration on 1,000 randomly sampled training instances with per-tensor quantization. Section 5.4 explores the sensitivity to calibration method, granularity, and sample size.

4.5. NPU Compilation

Models are compiled for the STM32N6570-DK using ST Edge AI Developer Cloud v4.0.0 (compiler: Neural-ART atonn v1.1.3). The compiler partitions the ONNX graph into NPU-executable epochs (hardware or hybrid) and CPU-only epochs (software).

5. Experiments

5.1. Multi-Seed Classification Results

Table 2 reports classification results across 10 random seeds. On NSL-KDD, the ReLU MLP achieves the best overall accuracy ($78.86\pm 1.32$%) and macro F1 ($59.20\pm 2.80$%), outperforming both tree baselines and QCFS. A Wilcoxon signed-rank test yields $p=0.037$ for overall accuracy (ReLU > QCFS) but $p=0.232$ for macro F1 (not significant). This overturns a single-seed observation (seed 42) where QCFS appeared superior — a cautionary example of why multi-seed evaluation matters.

On UNSW-NB15 (10-class), the MLP achieves $64.75\pm 0.61$% overall accuracy, lower than Random Forest ($69.46\pm 0.10$%). However, the MLP achieves the highest macro accuracy ($61.30\pm 0.76$%), which reflects better balance across minority classes from inverse-frequency weighting. The gap in overall accuracy reflects the difficulty of UNSW-NB15’s 10-class problem with extreme imbalance (Worms: 130 training / 44 test samples vs. Normal: 56,000 training).

5.2. Per-Class Performance

Table 3 shows per-class metrics on NSL-KDD. DoS and Normal achieve strong F1 ($>82$%), but R2L and U2R remain challenging. R2L exhibits high precision (93.5%) but low recall (25.0%), indicating that the model correctly identifies R2L when it predicts the class but misses most R2L samples. U2R has only 52 training samples (0.04% of the training set); no amount of class weighting can fully compensate. Figure 2 visualizes the confusion pattern: R2L samples overwhelmingly fall into the Normal bin (64.4%), and U2R scatters across Probe (50.9%) and Normal (24.0%).

Table 4 shows per-class results on UNSW-NB15. Generic dominates (F1=97.9%), while extreme minority classes collapse: Worms (44 test samples, F1=9.0%), Analysis (F1=2.6%). Normal achieves 98.8% precision but only 57.6% recall — inverse-frequency weighting shifts predictions toward attack categories at the expense of the majority class.

5.3. Layer-Wise FP32 vs INT8 Equivalence

Table 5 presents layer-wise activation comparison between the FP32 and INT8 models. Individual hidden layers show moderate cosine similarity (0.65–0.68) due to per-neuron quantization noise, but the logit layer recovers to 0.978. The overall prediction agreement is 99.0% (per-class: Normal 99.8%, DoS 99.4%, R2L 99.3%, Probe 95.4%, U2R 85.7%). INT8 quantization introduces bounded perturbation at each layer, but the accumulated effect on the final classification decision is negligible. From the $T=1$ SNN perspective, this means the quantized SNN (INT8 model) closely reproduces the firing decisions of the original SNN (FP32 ReLU model with $V\left[0\right]=0$).

5.4. Quantization Ablation

Table 6 shows a representative subset of the full 24-configuration ablation (3 methods × 2 granularities × 4 sample sizes; full results in the supplementary material). Across all configurations, accuracy deviates from FP32 by at most 0.82 pp, and several INT8 configurations actually improve over FP32 (likely due to regularization effects of quantization noise). This stability is expected for a small model (111K parameters, 4 layers): the quantization grid resolution (256 INT8 levels) is sufficient to represent the narrow activation distributions of a shallow MLP. The practical implication is that $T=1$ equivalence is preserved regardless of calibration choices.

5.5. NPU Hardware Benchmark

Table 7 presents measurements from the STM32N6570-DK. We first establish a CPU baseline: the same ReLU MLP compiled as FP32 runs entirely on the Cortex-M55 CPU (0 HW epochs, 11 SW epochs) at 1.24 ms (NSL-KDD) and 1.23 ms (UNSW-NB15).

INT8 quantization combined with NPU acceleration yields 2.7× speedup on NSL-KDD (1.24→0.46 ms) and 4.2× on UNSW-NB15 (1.23→0.29 ms). The larger speedup on UNSW-NB15 reflects 100% NPU execution (4 HW epochs, zero SW fallback), while NSL-KDD retains 2 SW epochs. Flash memory shrinks 3.4–3.8× from FP32 to INT8. ST Application Note AN5946 reports $\sim 150$ mW average power during NPU inference at nominal frequency [19]. Combining this with our measured latency yields an estimated $\sim 69$ µJ/inference (NSL-KDD) and $\sim 44$ µJ/inference (UNSW-NB15). These figures are derived from the reference workload in AN5946, not direct measurement of our model, and should be validated with on-board instrumentation.

QCFS INT8 runs Gemm on the NPU but each Floor triggers a CPU fallback via DequantizeLinear →Floor(float)→ QuantizeLinear, adding 0.08 ms (+17.4%) over ReLU INT8. The Floor operator is absent from ST’s published NPU operator list [15].

5.6. Tree-Based Baseline Comparison

Random Forest (100 trees, max depth 20) and XGBoost (100 trees, max depth 6) serve as non-neural baselines. Both use balanced class weighting and are evaluated across 10 seeds. ONNX export succeeds for Random Forest (using skl2onnx), producing models with TreeEnsembleClassifier operators. These operators are not in the Neural-ART NPU’s supported set and run entirely on the Cortex-M55 CPU.

On NSL-KDD, the MLP outperforms both tree models in overall accuracy and macro F1 (Table 2), while also being the only model eligible for NPU acceleration. On UNSW-NB15, Random Forest achieves higher overall accuracy (69.46% vs. 64.75%), but the MLP achieves higher macro accuracy (61.30%), suggesting better minority-class handling. The tree models cannot run on the STM32N6 at all: ST Edge AI Core rejects the TreeEnsembleClassifier operator with “NOT IMPLEMENTED.” The MLP is therefore the only architecture eligible for NPU acceleration, achieving 0.29 ms inference on hardware where tree models have no path to execution.

6. Discussion

6.1. Validating $T=1$ Equivalence in Practice

The layer-wise analysis (Section 5.3) provides direct evidence that $T=1$ SNN–ANN equivalence survives INT8 quantization. Individual hidden layers show cosine similarity of 0.65–0.68 between FP32 and INT8 activations. This is expected: INT8 maps each activation to one of 256 discrete levels, introducing bounded per-neuron noise. However, the noise does not flip classification decisions — 99% of test samples receive the same predicted class from FP32 and INT8 models. The quantization ablation (Section 5.4) supports this conclusion: all 24 calibration configurations fall within 0.82 pp of FP32, ruling out the possibility that the equivalence depends on a particular calibration choice.

6.2. Why NPU When Trees Are More Accurate?

On UNSW-NB15, Random Forest achieves 69.46% overall accuracy vs. the MLP’s 64.75%. A natural question is whether the NPU adds value. Three factors favor NPU deployment: (1) TreeEnsembleClassifier is not implemented in ST Edge AI Core, so tree models have no execution path on the STM32N6; (2) NPU inference frees the Cortex-M55 CPU for concurrent RTOS tasks (packet capture, feature extraction), whereas CPU-only inference blocks the processor for 1.2 ms per sample; (3) INT8 NPU execution reduces Flash by 3.4–3.8× over FP32, which matters on memory-constrained MCUs. The MLP is not the most accurate classifier on every dataset, but it is the only architecture deployable on the NPU hardware. More broadly, this work targets a different design point from GPU-based SNN-IDS research (Table 1): sub-millisecond inference on a commodity MCU rather than state-of-the-art accuracy on unconstrained hardware. The gap in absolute accuracy reflects multi-class evaluation (5/10-class vs. binary), multi-seed averaging (mean vs. best-of-one), and NPU operator constraints (shallow MLP vs. deep architectures).

6.3. QCFS and Floor Fallback

With multi-seed evaluation, ReLU outperforms QCFS on NSL-KDD ($p=0.037$), overturning a single-seed artifact. Combined with 17.4% latency overhead from Floor CPU fallback, QCFS offers no advantage on this NPU target.

6.4. Comparison with HH-NIDS

Ngo et al. [6] achieved 98.57% on UNSW-NB15 with the MAX78000, but used binary classification (normal vs. attack) with 11 flow features. Our 10-class multi-class problem is substantially harder. The MAX78000 is an AI-specialized MCU with a fixed CNN accelerator (442 KB weight memory); the STM32N6 is a general-purpose MCU where the NPU is one peripheral among many (GPIO, UART, Ethernet, display controller). The two represent different deployment philosophies: the MAX78000 is designed specifically for always-on AI workloads, while the STM32N6 is a general-purpose platform that can accommodate AI inference as one of many concurrent tasks under an RTOS.

6.5. Limitations

Five limitations bound our results. First, NSL-KDD is a legacy benchmark (1998 DARPA traffic) and UNSW-NB15, while more modern, still does not represent current enterprise traffic. Second, we measure inference latency on the NPU but not power consumption. Third, the evaluation covers classifier inference only, not the complete IDS pipeline (packet capture, flow aggregation, feature extraction). Fourth, the MLP architecture is shallow; deeper models might improve minority-class performance but require verifying NPU operator compatibility. Fifth, UNSW-NB15 accuracy (64.75%) is below tree baselines (69.46%); the 10-class problem with extreme imbalance (Worms: 44 test samples) is inherently difficult, and the MLP may benefit from feature selection or architecture search on this dataset.

6.6. Future Directions

RTOS integration. The 0.29–0.46 ms inference time fits within a 1 ms RTOS tick. Integration with µT-Kernel 3.0 on the STM32N6, with lwIP for packet processing and the NPU for classification, is the natural next step toward a complete edge IDS.

Modern datasets. Retraining on CICIDS2017 or CSE-CIC-IDS2018 would test generalization.

Power measurement. Measuring Joules per inference on the NPU path would enable direct comparison with HH-NIDS’s published 18 mW figure.

Other MCU NPUs. Testing on NXP i.MX RT1180 (eIQ Neutron), Renesas RA8 (Ethos-U55), and Alif Ensemble would establish cross-platform generality.

7. Conclusion

We trained an MLP for intrusion detection on NSL-KDD (5-class) and UNSW-NB15 (10-class), quantized it to INT8, and deployed it on the STM32N6570-DK Neural-ART NPU. Multi-seed evaluation (10 seeds) shows $78.86\pm 1.32$% overall accuracy on NSL-KDD and $64.75\pm 0.61$% on UNSW-NB15. NPU inference runs 2.7–4.2× faster than CPU-only execution (0.29–0.46 ms vs. 1.2 ms), with 3.4–3.8× Flash reduction. A 24-configuration quantization ablation shows INT8 accuracy varies by less than 1 pp across calibration choices. Layer-wise analysis shows 99% final prediction agreement between FP32 and INT8 models — evidence that $T=1$ SNN–ANN equivalence holds on commercial NPU silicon.

The QCFS experiment adds nuance: the Floor operator has no NPU support, forcing CPU fallback with 17.4% latency overhead. For commodity MCU NPUs with INT8 operator sets, ReLU remains the pragmatic activation for SNN-equivalent deployment.

All code, trained models, and benchmark results are publicly available at https://github.com/thc1006/SpikeIDS-MCU.