Compressed EEG decoders keep accuracy but not adversarial defense
AERIAL: Adversarial Evaluation of Robustness in Accuracy-Preserving Low-Precision EEG Decoders
Computer Vision and Pattern RecognitionCryptography and SecurityMachine Learning
Summary
EEG brain signal decoders can be compressed to save space without losing accuracy. The authors studied if compressing these decoders also makes them more resistant to deliberate attacks that try to confuse them. They found that while accuracy stays about the same, the compressed models do not become more robust to these attacks. Also, converting models between formats affects how well adversarial attacks transfer between them, showing different aspects of performance in these decoders.
What this means in practice
- •For neurotechnology engineers: Optimize EEG decoder deployment on resource-limited devices without expecting improved defense from adversarial attacks.
- •For embedded system developers: Validate compressed EEG models on native hardware to ensure compressed models maintain performance and behavior similar to simulations.
Authors
Saim Rehman, Muhammad Shafique
Abstract
Deployment-oriented compression is attractive for resource-constrained brain--computer interfaces (BCIs), but whether it changes adversarial vulnerability remains unclear. On BCI Competition IV-2a, we compare 32-bit floating-point (FP32) EEGNet and ShallowConvNet models with global magnitude pruning and simulated INT8 post training quantization (PTQ) and quantization-aware training (QAT) across nine subjects and three seeds. Simulation provides differentiable quantize--dequantize models for white-box attacks and gradient analysis, while native TensorRT deployment is used for validation. Accuracy-preserving compression does not improve direct robustness: at $ε=0.005$, EEGNet PGD accuracy remains 22--24\% across FP32, 50\% pruning (P50), PTQ, and QAT. However, P50 reduces bidirectional transfer efficiency to 0.963/0.928 (FP32$\rightarrow$P50/P50$\rightarrow$FP32), versus 0.994/0.997 for PTQ; the same trend holds for ShallowConvNet. Gradient alignment shows a corresponding separation, while native PTQ agrees with simulated clean/adversarial predictions in 95--98\% of cases. These results show that direct robustness, adversarial transfer, and deployment efficiency are distinct properties of compressed EEG decoders.