PaperlayerView exact revision on arXiv

Source-linked AI summary

SW-ProxyCE: Zero-Query Adversarial Transfer from Public EEG Encoders to Private Downstream Models

Linhua Cong, Dingkun Liu, Dongrui Wu

arXiv:2608.16931v1cs.LG

TL;DR

Publicly released EEG encoders may enable adversarial attacks on inaccessible downstream models, but this risk is largely unexplored. SW-ProxyCE uses task-matched references and public-encoder representations to generate transferable perturbations, achieving larger BACC drops than a task-agnostic baseline.

  • Problem

    Whether public EEG encoders enable adversarial examples to transfer to inaccessible private downstream models remains largely unexplored.

  • Method

    SW-ProxyCE builds shrinkage-whitened class prototypes from a small labeled reference set and maximizes a proxy cross-entropy objective without querying victims or training a surrogate.

  • Results

    22.90 percentage points average BACC drop versus 5.93 for TAA across 36 general-purpose-encoder configurations.

  • Takeaways & Limitations

    Public EEG encoders can serve as effective shared attack surfaces for transferable adversarial examples against private downstream models.

  • Takeaways & Limitations

    The attack assumes white-box access to the public encoder and a small task-matched labeled reference set, while victim models remain inaccessible and unqueryable.

Abstract

from arXiv · show

Electroencephalography (EEG) foundation models have recently emerged as a promising paradigm for EEG decoding by learning reusable representations from large-scale heterogeneous neural recordings. However, the open release of EEG foundation encoders, while facilitating downstream developments, also introduces a previously unexplored security risk: publicly available representations may make private downstream models vulnerable. This paper investigates adversarial transfer attacks in EEG foundation model deployment in a public-encoder and private-downstream setting, where attackers have white-box access to a released encoder and a small task-matched labeled reference set, but no access or query to victim parameters, outputs, or gradients. We propose Shrinkage-Whitened Proxy Cross-Entropy (SW-ProxyCE), a query-free task-aware attack framework that recovers task-level decision geometry from a small labeled reference set through shrinkage-whitened class prototypes, enabling transferable adversarial generation without training an additional surrogate classifier. We evaluated SW-ProxyCE across three EEG tasks using three general-purpose foundation encoders and a paradigm-specific pre-trained encoder, covering both linear-probing and full-fine-tuning downstream models in cross-subject and within-subject scenarios. Results demonstrated that adversarial examples generated from the public encoder and limited labeled references can effectively transfer to inaccessible downstream models. SW-ProxyCE consistently outperformed task-agnostic representation-shift attacks, revealing that the strong transferability of EEG foundation models does not necessarily lead to adversarial robustness. Our code will be available on GitHub.

Introduction

EEG foundation encoders improve reusable representations but introduce an underexplored security risk: perturbations optimized through a public encoder may transfer to inaccessible downstream models. SW-ProxyCE addresses this zero-query setting using limited labeled references and is evaluated across diverse EEG tasks, encoders, victims, and protocols.

  • Motivation: EEG foundation models pre-trained on large, heterogeneous corpora aim to improve cross-subject and cross-task generalization through linear probing or full fine-tuning.Their practical motivation is to learn reusable neural representations adaptable to diverse downstream tasks.
  • Security gap: Publicly released EEG encoders create an underexplored shared upstream attack surface because adapted private models may retain representational and gradient structure from their common pre-trained origin.This risk differs from attacks that directly target complete task-specific models.
  • Proposed approach: SW-ProxyCE gives attackers white-box access to a public encoder and a small task-matched labeled reference set while requiring no access to or queries of the private downstream model.It constructs class prototypes from the limited reference set to derive a proxy classification objective.
  • Evaluation: The study evaluates public-encoder adversarial transfer across three EEG tasks, four pre-trained encoders, linear-probing and full-fine-tuning victims, and LOSO and within-subject protocols.The results show that examples generated solely through the public encoder can transfer effectively to inaccessible downstream models without victim access or queries.

Related Work

EEG foundation-model research has emphasized transferable representations, downstream accuracy, and transferability, while adversarial robustness remains largely unexplored. Existing EEG attacks generally assume complete task-specific models, leaving public-encoder/private-downstream transfer insufficiently addressed.

  • EEG Foundation Models: EEG foundation models learn transferable representations from large heterogeneous corpora through self-supervised objectives and cross-dataset transfer.Early examples include BENDR and BIOT, while later work explored diverse pre-training objectives and architectures.
  • Research Gap: Existing EEG foundation-model studies mainly optimize downstream accuracy and transferability, with robustness and security under adversarial perturbations largely unexplored.This gap motivates examining adversarial risks in EEG foundation-model deployment.
  • EEG Adversarial Attacks: EEG adversarial-attack research has predominantly targeted supervised task-specific decoding models and categorized attacks as white-box or black-box based on victim-model access.White-box studies demonstrated vulnerability to crafted input perturbations, while black-box work includes query-based and transfer-based strategies.
  • Black-Box Attacks: Transfer-based EEG attacks avoid direct target-parameter access but generally require a complete task-aware source predictor and closely matched source-target data distributions.Query-based methods instead exploit victim feedback to train substitutes or construct perturbations with limited hard-label queries.
  • Novelty: Existing EEG adversarial studies do not capture public-encoder/private-downstream access asymmetry, making this work the first systematic investigation of transfer from released encoders to inaccessible downstream models.The paper identifies this deployment setting as distinct from prior work focused on complete task-specific models.

Problem Definition and Security Analysis

The paper studies untargeted, zero-query adversarial transfer from a publicly exposed EEG encoder to private downstream models, using a small task-matched labeled reference set. Because adaptation may preserve inherited representations, successful transfer creates a shared upstream security risk across independently adapted systems.

  • Threat Model: The public encoder fθ0 is fully accessible, but the victim model’s architecture, parameters, outputs, and gradients remain unavailable, with no victim queries allowed.The attacker can compute input gradients through fθ0 but cannot query Fvic during adversarial example generation.
  • Threat Model: The attacker uses a small task-matched labeled reference set sharing the victim’s prediction task and label space, disjoint from private adaptation and evaluation data.References may come from compatible public datasets or experimental protocols; K denotes the number of reference samples per class.
  • Attack Setting: For an EEG trial x with label y, the attack constructs xadv = x + δ under ∥δ∥∞≤ϵ using Dref, public-encoder forward passes, and input gradients, without involving Fvic.The perturbations are untargeted and generated in the digital domain before downstream inference.
  • Security Risk: Adversarial perturbations generated through fθ0 may remain effective after downstream adaptation because adaptation can preserve inherited representation structure.This motivates analyzing transfer risk from the released encoder to private downstream models.
  • Security Risk: Transfer is measured by victim misclassification at the sample level and balanced accuracy under attack over the evaluation set.The sample-level effect is instantiated as I[Fvic(xadv) ≠ y].
  • Security Risk: Successful transfer shows that private downstream parameters do not necessarily prevent attacks from the public encoder, creating a shared upstream risk across independently adapted systems.A single pretrained encoder may support multiple downstream systems, so the vulnerability is not confined to one model.

Method

SW-ProxyCE constructs a task-aware proxy geometry from a public EEG encoder and a small labeled reference set, then generates adversarial perturbations without accessing or querying the private downstream model. Shrinkage-whitened mapping calibrates class prototypes and supports gradient-based perturbation optimization through the public encoder alone.

  • Framework overview: SW-ProxyCE uses a public encoder and small task-matched labeled reference set to construct task-aware proxy geometry without training an additional surrogate classifier.The framework addresses the missing task-specific decision function of private downstream models.
  • Framework overview: The method estimates a shared shrinkage-whitened mapping from class-centered reference representations, constructs calibrated class prototypes, and maximizes ProxyCE under an ℓ∞ perturbation constraint.Reference modeling and adversarial generation are separate stages, and the private downstream model is excluded from both.
  • Shrinkage-whitened proxy space: Shrinkage regularization pulls directional within-class variances toward their average to reduce excessive amplification from limited-reference estimates.The shrinkage coefficient ρ controls the trade-off between preserving directional differences and improving estimation stability.
  • Shrinkage-whitened proxy space: The mapping projects representations into the empirically supported within-class subspace and rescales directions using shrinkage-regularized variances before consistent prototype and similarity comparison.The same mapping is applied to reference and query representations, with centering relative to the global reference-set mean.
  • Adversarial generation: Adversarial examples use the FGSM update xadv = x + ϵ sign(∇xLSW-ProxyCE(x, y)), while the mapping and prototypes remain fixed after reference modeling.Gradients propagate exclusively through the public encoder and fixed proxy geometry, without victim-model information.

Experiments

Experiments across three EEG tasks and multiple public encoders show that SW-ProxyCE transfers effectively to private downstream models, outperforming task-agnostic and alternative proxy attacks. Its performance remains strong across victim-training regimes and improves with shrinkage-whitened task geometry and larger reference sets.

  • Experimental setup: Experiments covered motor imagery, emotion recognition, and seizure detection under LOSO and within-subject evaluation.The study used BNCI2014001, SEED, and CHB-MIT, respectively.
  • Overall transfer performance: SW-ProxyCE achieved the lowest Attacked BACC across 40 configurations and a 22.90-point average BACC drop across 36 general-purpose-encoder configurations, versus 5.93 points for TAA.Lower Attacked BACC and larger BACC drop indicate stronger attacks.
  • Victim-model settings: SW-ProxyCE produced average BACC drops of 31.78 points for LP victims and 14.02 points for FT victims, while MIRepNet showed 44.06–59.92-point degradation.LP victims preserve the public encoder representation more directly, whereas FT changes representations and partially reduces transferability.
  • Task-aware proxy objective: ProxyCE achieved the largest BACC drop across all three encoders for both LP and FT victims, outperforming NC-Shift and Ref-Surrogate under limited reference data.ProxyCE models competition among all classes through prototype-based scores without training an additional classifier.
  • Shrinkage-whitened geometry: SW-ProxyCE consistently outperformed raw-space ProxyCE and ordinary-whitening W-ProxyCE across evaluated encoders, supporting shrinkage regularization with limited reference samples.Shrinkage whitening balanced within-class variance by reducing dominance of leading directions.

Conclusion

The paper identifies a security risk in publicly released EEG foundation encoders and shows that they can enable transferable adversarial attacks against inaccessible, unqueryable downstream models. It proposes SW-ProxyCE, a victim-query-free framework that builds a task-aware proxy objective from reference-derived prototypes and shrinkage-whitened representation geometry without an additional surrogate classifier.

  • Security risk: The paper investigates adversarial security risks arising when public EEG foundation encoders support private downstream models.The deployment setting gives attackers access to the released encoder while downstream victim models remain private.
  • Attack transferability: Publicly available encoders can serve as effective sources for transferable adversarial attacks against inaccessible and unqueryable downstream models adapted from them.This finding establishes transferability despite the attacker lacking access to victim parameters, outputs, or queries.
  • Proposed framework: SW-ProxyCE constructs a victim-query-free, task-aware proxy objective from reference-derived class prototypes and shrinkage-whitened representation geometry without training an additional surrogate classifier.The framework addresses the identified risk using task-level information recovered from a labeled reference set.

A. Dataset Preprocessing and Data Split Details · B. SW-ProxyCE with Cross-Dataset References · C. Stability across Random Seeds

The study defines task-specific EEG preprocessing and evaluation splits, then tests SW-ProxyCE with cross-dataset references and across random seeds. SW-ProxyCE remains effective under distribution shift and shows stronger, stable transfer attacks than the reported baselines.

  • A. Dataset Preprocessing and Data Split Details: BNCI2014001 contains four-class motor-imagery EEG from nine subjects, with 22 channels sampled at 250 Hz and 576 trials per subject.Each subject contributed 144 trials per class across left-hand, right-hand, both-feet, and tongue imagery.
  • A. Dataset Preprocessing and Data Split Details: SEED provides three-class emotion EEG from 15 subjects, processed into 152,730 non-overlapping 1-s windows after filtering, resampling, and channel selection.The data used canonical 62-channel recordings, low-pass filtered at 75 Hz and resampled to 200 Hz.
  • A. Dataset Preprocessing and Data Split Details: CHB-MIT supplies binary seizure-detection data comprising 29,840 standardized 4-s windows from 23 subjects, including 2,690 seizure windows.Signals came from 18 bipolar channels and included 27,150 non-seizure windows.
  • A. Dataset Preprocessing and Data Split Details: Evaluation used leave-one-subject-out testing, with 90%/10% development-test splits for BNCI2014001 and SEED and 30%/70% splits for CHB-MIT.In LOSO evaluation, one subject was held out while the remaining subjects supported model development.
  • B. SW-ProxyCE with Cross-Dataset References: The cross-dataset setting involved the same four-class motor-imagery task but different subjects, acquisition systems, channel configurations, and recording protocols, requiring only temporal and channel alignment.The remaining dataset-specific characteristics were preserved, creating a distribution shift between reference construction and target evaluation.
  • B. SW-ProxyCE with Cross-Dataset References: Using 74 balanced trials per class from one external Dataset IIIa subject, SW-ProxyCE reduced BACC across all six BNCI2014001 victim configurations despite cross-dataset distribution shift.The references remained disjoint from victim training and target evaluation, and reductions ranged from 6.64 to 32.41 percentage points, averaging 16.70 points.
  • C. Stability across Random Seeds: Across 10 random seeds, SW-ProxyCE achieved the largest mean BACC reduction in all six victim configurations, averaging 18.69 percentage points versus 3.34 for TAA and 0.30 for Gaussian noise.Each seed changed random reference-set sampling while victim models, perturbation budget, and other attack settings remained fixed.
  • C. Stability across Random Seeds: SW-ProxyCE’s mean advantage over the strongest baseline ranged from 4.78 to 28.66 points, with its one-standard-deviation lower bound remaining above both baselines’ corresponding upper bounds.The stability experiment covered three encoders and both linear-probing and full-fine-tuning adaptation.

D. Sensitivity to the Shrinkage Coefficient

SW-ProxyCE is most effective with moderate shrinkage of within-class directional variances. Across encoders and adaptation strategies, the average BACC drop peaks at ρ = 0.4, while both ordinary whitening and complete variance equalization perform worse.

  • Sensitivity to the Shrinkage Coefficient: Moderate shrinkage generally yields the strongest SW-ProxyCE attacks.For LP victims, LaBraM and CBraMod peak at ρ = 0.4, whereas Neuro-GPT peaks at ρ = 0.6; FT victims perform best across ρ ∈[0.2, 0.6].
  • Sensitivity to the Shrinkage Coefficient: ρ = 0 produces substantially weaker attacks for LaBraM and Neuro-GPT.Ordinary whitening uses empirical directional variances, which can be sensitive to estimates from limited references.
  • Sensitivity to the Shrinkage Coefficient: 20.06 percentage points is the highest average BACC drop, reached at ρ = 0.4 versus 13.62 points at ρ = 0 and 17.80 points at ρ = 1.The average spans three encoders and both adaptation strategies.
  • Sensitivity to the Shrinkage Coefficient: Neither unregularized whitening nor complete removal of directional variance differences is optimal.Increasing ρ toward 1 shrinks directional variances toward their mean, and at ρ = 1 all observed within-class directions share the same variance estimate.

E. Additional Results on ACC and ASR

Across ACC and ASR, SW-ProxyCE consistently produced the strongest attacks against private downstream models, with especially large effects against linear-probing victims. These results agree with BACC and show effective transfer without access to or queries of the private model.

  • Results on classification accuracy: ACC results show SW-ProxyCE achieved the lowest attacked ACC in all 36 evaluated configurations.Average attacked ACC fell to 41.41% from 65.63% clean, versus 63.66% for Gaussian noise and 58.84% for TAA.
  • Results on classification accuracy: SW-ProxyCE reduced average attacked ACC by 24.22 percentage points, compared with reductions of 1.97 and 6.79 points for Gaussian noise and TAA.The ACC findings agree with the main BACC results and show degradation beyond class-balanced evaluation.
  • Results on classification accuracy: Against LP victims, SW-ProxyCE attained 29.69% average attacked ACC, versus 53.12% against FT victims, while remaining strongest in every FT configuration.Full fine-tuning can reduce transferability by modifying more of the pretrained representation, but does not eliminate the attack.
  • Results on attack success rate: Across all 36 configurations, ASR was 43.68% for SW-ProxyCE, exceeding TAA at 22.32% and Gaussian noise at 7.55%.SW-ProxyCE had the highest ASR in every evaluated configuration, indicating disruption of initially correct predictions.
  • Results on attack success rate: SW-ProxyCE achieved 59.85% ASR against LP victims and 27.51% against FT victims, while consistent LOSO and within-subject trends showed transfer across evaluation settings.Full fine-tuning increased resistance, but initially correct predictions could still be overturned without accessing or querying the private model.
  • Overall interpretation: BACC, ACC, and ASR provided converging evidence that public-encoder adversarial examples transfer effectively to private LP and FT downstream models.The metrics respectively characterize class-balanced post-attack performance, overall post-attack correctness, and failures among initially correct predictions.

F. Effect of Perturbation Budget

SW-ProxyCE becomes more effective as the perturbation budget increases, with reductions in attacked ACC and BACC across evaluation protocols and downstream adaptation strategies. The trend is nearly monotonic across configurations, while LP victims remain more vulnerable than FT victims.

  • Overall budget sensitivity: Across 36 configurations, attacked ACC falls from 49.37% at ϵ = 0.05 to 35.89% at ϵ = 0.20, while attacked BACC falls from 44.82% to 32.15%.Average clean ACC and BACC are 65.63% and 60.40%, respectively.
  • Evaluation protocols: Under LOSO, attacked BACC decreases from 41.97% to 30.61% as ϵ rises from 0.05 to 0.20; within-subject BACC decreases from 47.68% to 33.70%.Attacked ACC follows the same pattern under both protocols.
  • Downstream adaptation: LP victims show stronger budget sensitivity than FT victims: mean attacked BACC decreases from 34.70% to 21.60% for LP and from 54.94% to 42.71% for FT as ϵ increases from 0.05 to 0.20.Mean attacked ACC decreases from 40.21% to 25.21% for LP victims and from 58.53% to 46.57% for FT victims.
  • Configuration-level trends: BACC decreases monotonically with increasing ϵ in 35 of 36 configurations, whereas ACC does so in 34 configurations.Exceptions include the BNCI2014001 within-subject CBraMod-LP setting and a small ACC reversal for CHB-MIT CBraMod-LP under LOSO.
  • Experimental choice: The main experiments use ϵ = 0.10 as a fixed intermediate budget between the more constrained ϵ = 0.05 and stronger ϵ = 0.20 settings.All remaining attack settings are unchanged, with K = 20 reference samples per class.

G. SW-ProxyCE under Different Attack Optimizers · H. Complete Analysis of Within-Class Variance Concentration

SW-ProxyCE remains effective when optimized with FGSM, momentum iterative updates, or PGD, consistently transferring attacks to private downstream EEG models. Across all nine dataset–encoder combinations, shrinkage whitening also shifts within-class variance spectra toward isotropy, reducing dominance by high-variance directions.

  • G. SW-ProxyCE under Different Attack Optimizers: Together with FGSM, the MI and PGD experiments show that SW-ProxyCE retains effectiveness under single-step, momentum-based, and projected iterative optimization.FGSM uses one gradient evaluation, whereas MI and PGD perform repeated updates under the same proxy objective and perturbation setting.
  • G. SW-ProxyCE under Different Attack Optimizers: SW-ProxyCE-MI achieves the lowest attacked ACC and BACC in all 36 configurations.Within-subject BACC falls from 54.37% to 0.00% for LaBraM-LP on BNCI2014001, and from 78.25% to 5.28% and 74.73% to 15.42% for LaBraM-LP and CBraMod-LP on SEED.
  • G. SW-ProxyCE under Different Attack Optimizers: SW-ProxyCE-PGD likewise obtains the lowest attacked ACC and BACC in all 36 configurations.Within-subject BNCI2014001 attacked BACC reaches 0.00%, 9.92%, and 12.90% for LaBraM, NeuroGPT, and CBraMod linear-probing victims.
  • G. SW-ProxyCE under Different Attack Optimizers: Under LOSO on CHB-MIT, PGD reduces Neuro-GPT-LP BACC from 65.36% to 5.16% and LaBraM-LP from 55.64% to 15.50%.Within-subject BACC falls to 25.05% for LaBraM-LP and 37.80% for Neuro-GPT-LP.
  • G. SW-ProxyCE under Different Attack Optimizers: Across 36 matched configurations, MI has lower attacked BACC than PGD in 22 cases, PGD in 12, with 2 ties.Mean attacked BACC is 33.73% for MI and 34.35% for PGD, so neither iterative optimizer uniformly dominates.
  • H. Complete Analysis of Within-Class Variance Concentration: Before whitening, CVR spectra generally rise faster than isotropic references, indicating concentration of within-class variance in a small number of leading directions.The complete analysis covers all three datasets and public encoders.
  • H. Complete Analysis of Within-Class Variance Concentration: Shrinkage whitening consistently moves CVR curves toward isotropic references across nine dataset–encoder combinations.The overall pattern indicates reduced dominance of high-variance directions, although anisotropy varies across datasets and encoders.

I. Qualitative Analysis of Adversarial Perturbations

SW-ProxyCE produces visually subtle EEG perturbations that preserve waveform morphology and dominant time–frequency structure while changing inaccessible downstream predictions. The perturbation form varies across encoders because their architectures, sampling rates, and representation mappings differ.

  • Time-domain characteristics: Clean and adversarial waveforms almost completely overlap at the original display scale, with local differences becoming visible only after 8× magnification.The examples show no conspicuous amplitude shifts, abrupt discontinuities, or large-scale waveform deformations.
  • Time-domain characteristics: Successful perturbations changed downstream predictions despite strong waveform overlap, with SNRs of 20.0 dB and maximum absolute perturbations within the ℓ∞ budget of 0.1.LaBraM changed the victim prediction from class 0 to class 1, while NeuroGPT and CBraMod changed it from class 1 to class 0.
  • Time–frequency characteristics: Adversarial inputs preserve the principal low-frequency energy distribution, temporal evolution, and major spectral structures of clean EEG across all three encoders.LaBraM has relatively weak perturbation energy, while NeuroGPT and CBraMod show broader perturbation distributions but retain the main time–frequency structures.
  • Model-wise differences: Perturbation patterns differ across LaBraM, NeuroGPT, and CBraMod because their architectures, input sampling rates, and representation mappings differ.SW-ProxyCE optimizes through each public encoder, so the resulting temporal or spectral directions need not be identical.
  • Overall qualitative findings: Across model-wise visualizations, SW-ProxyCE changes downstream predictions while introducing only subtle modifications and retaining principal spectral structures.The qualitative examples complement dataset-level BACC, ACC, and ASR results by illustrating the nature of the observed degradation.
Loading 2608.16931v1…