AERIAL: Adversarial Evaluation of Robustness in Accuracy-Preserving Low-Precision EEG Decoders

• Motor-imagery EEG research has examined adversarial defenses and compression for deployment largely as separate concerns.Prior compression work focused on accuracy, memory, latency, and energy, while adversarial studies emphasized robustness.Source: §1 · p. 1
• The methodological gap is whether accuracy-preserving compression changes white-box vulnerability and cross-model transfer, and whether simulated quantization findings persist on a native edge runtime.The study holds the data protocol, decoder family, and attack configuration fixed while varying compression.Source: §1 · p. 1
• P50 weakens adversarial transfer across decoder architectures despite nearly identical clean accuracy and direct robustness, whereas simulated PTQ and QAT largely preserve FP32 transferability.The contribution distinguishes these transfer effects from direct robustness.Source: §1 · p. 1
• Native TensorRT deployment agrees with simulated PTQ on 95–98% of clean and adversarial predictions, while latency and power benefits vary by architecture.Source: §1 · p. 1
• Pruning disrupts local input-gradient alignment, while PTQ and QAT retain geometry close to FP32, linking compression-dependent transfer differences to gradient structure.The paper investigates this mechanism using input-gradient cosine similarity and sign agreement.Source: §1 · pp. 1–2

2.1. Data, models, and compression

• Nine subjects, four motor-imagery classes, and 22 EEG channels form the BCI IV-2a evaluation; EEGNet and ShallowConvNet are tested over three seeds.Signals are filtered, standardized, and segmented; training data are split for validation while the separate evaluation session is reserved for testing.Source: §2.1 · p. 2
• Global unstructured L1 magnitude pruning at 30%, 50%, and 70% is compared with symmetric simulated INT8 PTQ and QAT.PTQ ranges use training data only, and QAT fine-tunes calibrated models with straight-through gradients; P70 is treated as over-compression.Source: §2.1 · p. 2

2.2. Threat model and analysis

• Digital L∞ attacks perturb standardized inputs across four epsilon budgets, with FGSM and PGD for EEGNet and confirmatory PGD for ShallowConvNet.PGD uses 20 steps, five random restarts, random initialization, and step size epsilon/4; epsilon is dimensionless after standardization.Source: §2.2 · p. 2
• Transfer efficiency is interpreted relative to direct PGD, while gradient cosine and sign agreement are assessed on common-correct samples.Seeds are averaged within subject before paired inference across nine subjects, using Wilcoxon tests with Holm correction, bootstrap confidence intervals, and rank-biserial effect size.Source: §2.2 · p. 2
• Table 1 reports clean and direct PGD accuracy at epsilon = 0.005 and identifies P70 as over-compression rather than a robust operating point.Source: Table 1 · p. 2

3.1. Compression preserves clean accuracy, not white-box robustness

• At ε = 0.005, EEGNet direct PGD accuracy remains 22–24% across accuracy-preserving variants, while P70 clean accuracy collapses to 25.96%.ShallowConvNet P50 and PTQ also retain the accuracy-preserving pattern, with direct PGD accuracy near 42%.Source: §3.1 · p. 2, Figure 2 · p. 3

3.2. Pruning changes transfer geometry and local gradient alignment

• At ε = 0.005, EEGNet P50 transfer efficiency is 0.963/0.928 versus PTQ 0.994/0.997; P50 also shows lower gradient alignment than PTQ.P50 transfer gaps are positive for all nine subjects in both directions on both architectures; its gradient cosine is lower than PTQ for all nine subjects on both architectures.Source: §3.2 · p. 3, Figure 2 · p. 3

3.3. Cross-epsilon consistency and attack-strength checks

• Across shared PGD budgets, P50 transfer remains below PTQ in every direction and budget, while PTQ stays near unity.As attacks approach saturation, transfer efficiency moves toward one as direct and transferred attacks approach the accuracy floor; 10-, 20-, and 50-step PGD converge to 37.36% mean robust accuracy in the EEGNet pilot at ε = 0.005.Source: Table 2 · p. 3, §3.3 · p. 3

3.4. Quantization and gradient-masking check

• At EEGNet ε = .005, PTQ/QAT direct robust accuracy is 22.57/22.52%, and cross-precision attacks remain nearly as effective as direct attacks.QAT transfer efficiency is 0.995/0.997 and its FP32 gradient cosine is 0.998, so the reported checks do not show severe gradient obfuscation.Source: §3.4 · pp. 3–4

3.5. Native edge-runtime validation

• Native TensorRT PTQ prediction agreement with simulation is 97.42/97.84% for EEGNet and 94.91/94.98% for ShallowConvNet; INT8 raises EEGNet latency 2.09× but lowers ShallowConvNet latency 26%.The deployment used INT8-preferred execution with FP32 fallback; ShallowConvNet module power fell 21%, while EEGNet module power was essentially unchanged (+2%).Source: §3.5 · p. 4, Table 3 · p. 4, Figure 3 · p. 4

4. CONCLUSION

• P50 weakens transfer and FP32–compressed gradient alignment while preserving clean and direct PGD accuracy; PTQ/QAT remain close to FP32, but P70 collapses clean accuracy near chance.The authors conclude that accuracy-preserving compression is not an adversarial defense and that deployment efficiency depends on architecture.Source: §4 · p. 4
• The study covers BCI IV-2a motor imagery, two CNNs, global unstructured magnitude pruning, symmetric INT8 quantization, and digital first-order attacks on standardized inputs.Native validation covers PTQ with one seed across nine subjects, with latency and power measured on A01.Source: §4 · p. 4

Generative AI Use Disclosure

• ChatGPT and Grammarly were used for language editing and text refinement, and generative AI tools also refined the methodology figure.The authors state they reviewed and edited generated or refined content and take full responsibility for the publication.Source: Generative AI Use Disclosure · p. 4