PaperlayerView exact revision on arXiv

Source-linked AI summary

Adversarial Vulnerabilities of Neural Biomarker Identification Systems

Polina Tapal, Bryce-Allen Bagley

arXiv:2609.01856v1cs.CRq-bio.NC

TL;DR

EEG biometrics lack sufficient evidence on security under realistic black-box attacks, especially beyond deep-learning classifiers. This paper adaptively attacks covariance-based authentication using altered stolen recordings across six datasets and three recording paradigms. Vulnerability varies sharply by paradigm: resting-state is insecure even without an attack, RSVP has structured attack surfaces, and motor imagery resists the tested attacks.

  • Problem

    Prior adversarial EEG-biometrics research focused mainly on deep-learning classifiers with full model access, leaving other signature methods and realistic black-box threats insufficiently examined.

  • Method

    The paper evaluates a bandit, black-box VAE, and gray-box surrogate-gradient GAN that alter stolen EEG recordings to maximize false acceptance across six datasets and three recording paradigms.

  • Results

    Vulnerability is paradigm-dependent: resting-state has zero-effort FAR of 0.812–0.896, RSVP exposes structured attack families, and motor imagery withstands the tested attack suite with FAR ≤0.016 on Cho at p ≥10.

  • Takeaways & Limitations

    EEG authentication security depends on the recording task and its covariance geometry, not only on classifier design, making resting-state EEG unsuitable for biometric authentication.

  • Takeaways & Limitations

    The study’s attack evaluation is limited to black-box and gray-box access; a white-box adversary with feature-pipeline access could potentially bypass the trial-variance barrier.

Abstract

from arXiv · show

There is growing interest in the proposed use of EEG signals as biometric credentials, but thus far there has been little research on the reliability and security of such biometrics. Prior adversarial tests have focused on deep-learning classifiers and assumed attackers have full access to the classifier model. This has left unexamined other, more popular categories of neural signature methods as well as the more realistic case of an adversary having only black-box access to a classifier. In this paper we develop a collection of adaptive attack algorithms which learn to fool an authentication system via targeted alterations of stolen EEG recordings, without requiring any knowledge of the authentication system itself. Tested on 6 public datasets spanning three recording conditions (reacting to visual stimuli, imagining hand movements, and resting), it reveals that different signaturing approaches vary significantly in their degrees of vulnerability to adversarial attacks. We show that vulnerability to spoofing attack is greatly impacted by the recording conditions, with significant variation depending on task at time of recording. Finally, we provide recommendations for improving neural signature biometrics based on the results of our adversarial testing.

1 Introduction

The paper evaluates black-box adversarial attacks against covariance-based EEG authentication and shows that vulnerability depends strongly on recording paradigms and feature geometry. Its framework adaptively selects signal-level perturbations without model access, while comparing classifiers, datasets, and attack conditions.

  • Motivation: The study addresses the underexamined security and reliability of EEG biometrics against realistic black-box adversaries.Prior work emphasized deep-learning classifiers and full model access, leaving other signature methods and limited-access attackers less examined.
  • Adversarial framework: An adaptive multi-armed bandit selects signal-level perturbation families using only accept/reject feedback from nearest-centroid and Gaussian Naïve Bayes authenticators.The reward combines false acceptance with perturbation minimality, encouraging effective attacks with lower signal distortion.
  • Threat model: The threat model assumes an attacker possesses a prior EEG recording and seeks to forge acceptance under another identity by altering the raw signal before feature extraction.The authenticator operates on log-covariance features, so attacks target the covariance geometry rather than directly modifying feature vectors.
  • Feature representation: EEG trials are represented through spatial covariance and a Log-Euclidean map, producing features on a flat tangent space derived from the SPD covariance manifold.The covariance construction uses XX^T to capture spatial relationships, with regularization ensuring positive definiteness.
  • Feature validation: Log-covariance features discriminate RSVP and motor-imagery identities substantially better than Euclidean covariance or power-spectral-density ablations, while all features perform poorly on resting-state data.Across RSVP and motor imagery, ablation EER is 0.31–0.44 versus 0.07–0.15 for Riemannian features; resting-state EER remains approximately 0.31–0.50.

3 Results

Results show that attack effectiveness and the preferred perturbation family vary sharply by recording paradigm. Resting-state authentication is permissive even without attacks, RSVP exposes structured attack surfaces, and motor imagery is comparatively resistant across classifiers and attacker types.

  • Resting-state: Resting-state’s high adversarial FAR reflects high zero-effort acceptance rather than attack-induced vulnerability, with geometric and generative attackers performing similarly.The attack surface is permissive, and all three attackers are statistically indistinguishable within |FARa − FARb| ≤0.046.
  • Arm-preference structure: The bandit’s preferred attack family is paradigm-specific: geometric arms dominate resting-state, noise or interpolation arms lead on RSVP, and no arm achieves meaningful acceptance on motor imagery.On resting-state, channel coupling leads every stream; Gaussian noise leads Zhang, while covariance interpolation leads Won by dual reward.
  • Attacker comparison: On RSVP, UCB outperforms VAE and SGAN, whereas motor-imagery acceptance remains near zero except for subject-specific vulnerability in one generative condition.The UCB identifies effective discrete families within tens of pulls; Lee is the exception where SGAN FAR is 0.114 versus UCB 0.054, with a right-skewed subject distribution.
  • Detection: SGAN discriminator AUROC remains near chance across streams, ranging from 0.496 to 0.595.The reported discriminator result is interpreted as near-chance performance under adversarial training rather than proof that perturbations are inherently undetectable.
  • Classifier generalisation: The paradigm ordering persists under Gaussian Naïve Bayes: resting-state adversarial FAR is 0.58–0.81, while RSVP and motor imagery are at most 0.001.This pattern is not explained by globally weaker classification, because GNB often matches or improves baseline EER while remaining more resistant on several paradigms.
  • Classifier generalisation: Covariance interpolation and eigenvalue perturbation dominate GNB resting-state attacks, and a linear SVM likewise shows high resting-state adversarial FAR of 0.74–0.84.The shared geometric attack family across structurally different classifiers supports vulnerability tied to the SPD-manifold representation rather than one decision rule.
  • Cross-condition spoofing: Cross-condition spoofing is strongest for resting-state, where cross-paradigm donors reach 0.459 ± 0.223, while motor-imagery authenticators accept no cross-paradigm donors.The resting-state cross-paradigm rate is 76% of same-paradigm performance, indicating limited dependence on the donor’s neural driver.

4 Discussion

The discussion concludes that EEG authentication security depends strongly on recording paradigm geometry: resting-state should not be deployed, motor imagery resists tested attacks, and RSVP remains attackable but can be defended with challenge-response.

  • Paradigm-level conclusions: Resting-state EEG should not be used for biometric authentication because arbitrary unmodified impostor recordings already achieve high acceptance.Zero-effort FAR is 0.812–0.896 at p = 10, while attacker lift is negative across resting-state streams.
  • Paradigm-level conclusions: Motor imagery resists the tested black-box and gray-box attacks, whereas RSVP remains attackable under the current fixed-stimulus protocol.The paper reports UCB FAR ≤0.054 for motor imagery, with one SGAN exception on Lee, and identifies RSVP as attackable.
  • Geometric mechanism: SPD geometry explains the paradigm ordering: compact, well-separated motor-imagery clusters resist displacement, while diffuse resting-state structure permits impostors.RSVP has a structured temporal P300 axis; resting-state lacks a privileged temporal axis, and direct SPD manipulation can bypass its variance floor.
  • Attacker comparison: Against structurally identifiable RSVP surfaces, UCB’s discrete search is more query-efficient than continuous optimisation, but this ordering reverses against learned boundaries.UCB commits to the dominant family within tens of pulls, while REINFORCE has not converged at Niter = 1,000.
  • Defensive implications: The bandit identifies actionable attack directions without paradigm information, with direct SPD-manipulation families dominating resting-state attacks.Channel coupling, covariance interpolation, and eigenvalue perturbation expose structure in the accept region that defenders can target.
  • Limitations and future work: The proposed detector was not implemented, and future work should examine a passive detector and white-box attacks with feature-pipeline access.The authors note that detector-based defenses would only help where an attack is required, excluding resting-state.
  • Defensive implications: RSVP can be defended through challenge-response, whereas resting-state has no comparable protocol fix and would require richer enrollment or paradigm-assisted designs.Fresh stimulus sequences allow P300 timing checks to reject stale recordings; the paper recommends refraining from deploying resting-state authenticators.

5 Conclusion

Across six datasets, two classifiers, multiple protocols, and three attacker types, the paper finds that EEG biometric security is determined substantially by the recording paradigm rather than classifier choice alone. Resting-state is unsafe, motor imagery resists the tested attacks, and RSVP is attackable but potentially defensible.

  • Main conclusion: Resting-state EEG is not a safe biometric-authentication choice across classifiers, enrollment sessions, and operating points.Unmodified impostor recordings are accepted at 0.812–0.896 at the standard operating point, and adaptive attacks add nothing over baseline.
  • Geometric interpretation: Diffuse, overlapping covariance clusters admit impostors with or without perturbation, whereas compact sensorimotor clusters resist the tested attack surface.The conclusion attributes this ordering to covariance geometry rather than a single implementation choice.
  • Attack-family discovery: The bandit discovers paradigm-specific attack families from accept/reject feedback alone, without knowledge of the underlying recording paradigm.Geometric arms dominate resting-state, interpolation and noise-based arms lead on RSVP, and no arm achieves meaningful motor-imagery acceptance.
  • Attacker comparison: Against nearest-centroid authentication, discrete search is more sample-efficient than continuous optimisation on structurally identifiable surfaces, but all attackers converge trivially on permissive resting-state surfaces.The ordering reverses against a learned decision boundary, while resting-state adversarial FAR remains at or below the zero-effort baseline.
  • Paradigm comparison: Motor-imagery authenticators withstand the full black-box and gray-box attack suite, with FAR≤0.016 on Cho at p ≥10 across all three attackers.This quantitative result is reported for the Cho dataset and operating range specified in the conclusion.
  • Implication: EEG authentication security should be understood as a property of both the classifier and the task used to elicit the neural signal.The paper places this security consideration before classifier training, at the level of the engaged neural processes.
  • Supplementary materials: Supplementary materials provide additional threat-model, feature, attacker, sensitivity, statistical, preprocessing, and baseline-result details.The supplement comprises Notes 1–11, Tables 1–14, and Figures 1–10.

Declarations

The declarations report no funding, no competing interests, and no new ethics approval or consent requirement because the study reanalyses previously published public datasets.

  • Declarations: The study reports no applicable funding and no competing interests.The authors declare no competing interests.
  • Declarations: The study reanalyses previously published, publicly available, de-identified EEG datasets under the original publications’ ethical procedures.The declaration states that ethics approval and consent were not applicable to the present authors.
  • Author contributions: B.A.B. supervised the work, contributed to conceptualisation and interpretation, and reviewed the manuscript.These contributions are listed in the author-contribution statement.

Supplementary Information for: Adversarial Vulnerabilities of Neural Biomarker Identification

The supplementary information contains the paper’s additional notes, tables, figures, and associated definitions for datasets, methods, and terminology.

  • Document identification: The document identifies Polina Tapal and Bryce-Allen Bagley.The supplied supplementary-information passage lists these names.
  • Supplementary contents: The supplementary materials comprise Supplementary Notes 1–11, Supplementary Tables 1–14, and Supplementary Figures 1–10.These materials are referenced from the main text.
  • Supplementary contents: Supplementary datasets, methods, and terminology follow the definitions established in the main text.The document states that its references and definitions are aligned with the main paper.

Supplementary Note 1: Attack taxonomy

The paper distinguishes three neural-signal threats: identity impersonation, session replay, and cognitive-state falsification, with the experiments focused on impersonation.

  • Taxonomy and design implications: The taxonomy separates threats by attacker objective, which carries different implications for system design.The paper also motivates simple geometric classifiers to attribute attack effectiveness to feature-space displacement rather than learned decision boundaries.
  • Identity impersonation: Identity impersonation modifies a donor recording so it is accepted under another subject’s claimed identity.On RSVP and motor imagery, bare replay fails because donor covariance aligns with the genuine template; resting-state zero-effort FAR reaches 81–90%.
  • Session replay: Session replay submits a victim’s recording unchanged under the victim’s identity, targeting liveness or session-freshness checks rather than signal-level authentication.This threat is outside the main text’s scope.
  • Cognitive-state falsification: Cognitive-state falsification alters neural recordings to misrepresent mental states for diagnostic or forensic classifiers rather than identity verifiers.The paper notes this threat but defers formal treatment to future work.

Supplementary Note 3: Feature extractor comparison

The comparison evaluates Riemannian, Euclidean covariance, and power-spectral-density features under a fixed authentication and attack pipeline, finding that the log-map is especially important outside resting-state data.

  • Compared feature extractors: Three feature extractors are compared across six datasets while classifier, calibration, attack, iteration count, and penalty settings remain fixed.The extractors are log-covariance, raw covariance without the log-map, and per-channel Welch band powers.
  • Performance comparison: On RSVP and motor imagery, removing the log-map or replacing covariance with band power increases EER by 2.2–5.6×.The comparison covers Zhang, Won, Cho, and Lee.
  • Performance comparison: On resting-state, all three extractors are comparably poor, indicating that vulnerability there is structural rather than specific to the Riemannian representation.The reported pattern separates resting-state behavior from RSVP and motor imagery.

Supplementary Note 4: Generative attacker architectures

The supplementary architectures generate signal-level EEG perturbations using either black-box VAE reinforcement learning or a surrogate-gradient GAN, while UCB sensitivity tests assess attack-arm selection across reward settings.

  • VAE attacker: The VAE encodes a victim trial into a 32-dimensional posterior, decodes a sampled latent vector into a perturbation, and adds it to the trial.The authenticator supplies black-box feedback, and REINFORCE updates both networks using a scalar dual reward.
  • Surrogate-gradient GAN: The SGAN trains a frozen surrogate on enrollment data to approximate authentication similarity, allowing generator gradients without differentiating through the deployed feature pipeline.A discriminator simultaneously distinguishes genuine from adversarial raw EEG, while FAR is measured on the real Riemannian authenticator.
  • Surrogate-gradient GAN: Unlike the VAE, the SGAN propagates ordinary gradients through its surrogate and discriminator and uses no REINFORCE.The deployed authenticator remains a black-box evaluation component.
  • Lambda sensitivity: Across the lambda sweep, FAR changes by at most 0.073 overall and by at most 0.025 for resting-state and motor-imagery streams.The main text’s lambda = 0.3 FAR values are therefore representative of the tested range.
  • Lambda sensitivity: The selected arm families remain stable across lambda: resting-state favors geometric arms, motor imagery has no dominant arm, and RSVP favors noise-based or interpolation arms.No tested lambda reverses this paradigm-level ordering.
  • Lambda sensitivity: At lambda ≥0.3, channel coupling becomes the leading resting-state arm because it achieves comparable FAR at lower perturbation cost.At lambda = 0, covariance interpolation dominates three of four resting-state streams, while eigenvalue perturbation leads on COG-BCI-EO.

Supplementary Table 3: Mann-Whitney U test results

The supplementary test uses a Mann–Whitney U comparison of the best and worst UCB arms at p = 10, across streams spanning RSVP, resting-state, and motor-imagery datasets.

  • Evaluation streams: The evaluation spans eight streams drawn from RSVP, resting-state, and motor-imagery datasets with differing participant counts, sessions, sampling setups, and trial structures.The supplementary descriptions include Zhang, Won, Wang, COG-BCI, Cho, and Lee datasets, alongside cohort and preprocessing details.
  • Evaluation scope: Cross-dataset comparisons equalize some cohort sizes but retain unequal session counts and dataset-specific trial quantities that affect interpretation.Won has one session per participant versus four for Zhang, while COG-BCI provides substantially fewer trials per condition than Wang.

Supplementary Tables 4–6: Baseline performance, full breakdown

Supplementary Tables 4–6 provide baseline authentication error rates for RSVP, resting-state, and motor-imagery streams, alongside adversarial-FAR tables for the same paradigms.

  • Baseline performance: Baseline error rates are tabulated separately for RSVP, resting-state, and motor-imagery recordings.The RSVP, resting-state, and motor-imagery tables report mean ± standard deviation with their respective sample sizes and channel counts.

Supplementary Figures 3–10: Per-arm false acceptance rates

Supplementary Figures 3–10 organize per-arm false-acceptance rates by dataset, recording condition, and classifier comparison; some resting-state and motor-imagery arms are explicitly marked as zero or excluded.

  • RSVP: Figures 3 and 4 show per-arm FAR at p = 10 for Zhang and Won RSVP datasets, comparing nearest-centroid with GNB.
  • Resting-state: Figures 5–7 show per-arm FAR at p = 10 for Wang-EO, Wang-EC, and COG-BCI-EO resting-state datasets.Wang-EC marks arms scoring 0.000 in light grey.
  • Resting-state: Figure 8 reports COG-BCI-EC per-arm FAR, excluding arms scoring 0.000.
  • Motor imagery: Figures 9 and 10 show motor-imagery per-arm FAR for Cho and Lee, respectively, comparing nearest-centroid with GNB.All Cho arms score 0.000 in Figure 9.
  • Discriminator comparison: The supplementary discriminator table reports detection performance at threshold 0.5, with AUROC near 0.5 across streams because minimax training drives the discriminator toward chance on adversarial samples.

Supplementary Note 8: Extended discussion

The extended discussion examines protocol defences, classifier and attacker extensions, and the boundaries of the reported results, emphasizing paradigm-level resting-state vulnerability and threat-model limitations.

  • Defence implications: Fresh RSVP challenge-response combines covariance-based identity verification with temporal consistency between the P300 response and newly drawn stimulus onsets.
  • Resting-state limitations: Resting-state vulnerability persists because high intra-subject covariance variability overlaps inter-subject distributions, so threshold tuning cannot make the system both usable and secure.The discussion reports zero-effort FAR above 0.81 before attack and recommends richer enrollment or session-invariant representations rather than perturbation-specific countermeasures.
  • Threat-model boundaries: White-box attacks remain an untested escalation for motor-imagery authenticators because they require access to feature-pipeline internals.
  • Discriminator interpretation: The SGAN discriminator’s near-chance AUROC reflects the minimax training equilibrium rather than demonstrated inherent undetectability of perturbations.
  • Classifier extension: The SVM extension uses the same log-covariance features and cross-validated threshold calibration to test whether learned decision boundaries alter attack outcomes.
  • Extended results: Across attacker–classifier pairs, resting-state FAR remains 0.58–0.89, while motor imagery remains at or below 0.024 and RSVP is the only paradigm with materially varying attacker outcomes.
  • Surrogate fidelity: SGAN surrogate fidelity is moderate on RSVP and motor imagery but collapses on resting-state, limiting the intended gray-box interpretation there.Reported Pearson correlations are r = 0.54–0.73 for RSVP and motor imagery, versus r = 0.02–0.20 for resting-state GNB and −0.20–0.20 for the SVM.

Supplementary Note 11: Cross-condition spoofing, full grid

The full cross-condition spoofing grid compares enrolled streams with donor streams while controlling montage, filtering, enrollment size, and donor amplitude scaling.

  • Grid organization: Rows represent enrolled streams, columns represent donor streams, and diagonal entries provide within-stream references.
  • Protocol controls: Applying identical filtering to donor and enrolled data avoids inflating acceptance when donor passbands are wider.The protocol also caps enrollment at 400 trials per session, with a 100-trial replication agreeing within 0.03 on every paradigm-level mean.
  • Control findings: Removing donor amplitude rescaling reduces cross-paradigm acceptance against resting-state authenticators to exactly 0.000 for both RSVP and motor-imagery donors.With rescaling, the corresponding acceptance values are 0.483 and 0.435, identifying gain matching as the step enabling cross-paradigm transfer in this grid.
  • Scope qualification: The Won row is treated as unreliable because its common-montage zero-effort FAR is 0.211 versus 0.111 in the main-text table.The passage attributes the shift to a protocol-related difference and states that no conclusion is drawn from that row.
Loading 2609.01856v1…