PaperlayerView exact revision on arXiv

Source-linked AI summary

ORBITAL: Optimization of Robust Brain--Computer Inference Through Architecture-Aware Low-Precision Compression

Saim Rehman, Muhammad Shafique

arXiv:2610.36411v1cs.CVcs.CRcs.LGeess.SP

TL;DR

EEG compression can change adversarial robustness without proportional hardware savings, while prior work left compression-aware operating-point selection and native hardware costs unexplored. ORBITAL combines hardware-realizable structured compression with recovery-aware selection, multi-attack evaluation, and native edge validation. S25 achieves the highest observed mean union robustness among evaluated compressed candidates, with fewer parameters and MACs than the full-width decoder.

  • Problem

    Prior work left compression-aware operating-point selection and native hardware costs unexplored, although compression does not necessarily preserve adversarial robustness.

    Source: §I · p. 1

  • Method

    ORBITAL enumerates physically valid channel widths, screens clean and adversarial performance, selects constraint-feasible operating points, and evaluates native low-precision deployment.

    Source: §I · p. 1, B. Robustness-Aware Recovery and… · p. 2

  • Results

    23.06% mean union robustness for S25 versus 21.27% for the standard full-width decoder, with 26.27% fewer parameters and 25.10% fewer MACs.

    Source: A. Compression–Robustness Operating… · p. 3

  • Takeaways & Limitations

    Per-example analysis indicates compression redistributes adversarial robustness rather than uniformly increasing classification margins.

    Source: §I · p. 2

Abstract

from arXiv · show

Compact electroencephalography (EEG) decoders enable embedded brain--computer interfaces (BCIs), but compression can alter adversarial robustness without proportional hardware savings. We present ORBITAL, a robustness-constrained framework combining hardware-realizable structured compression, recovery-aware operating-point selection, multi-attack evaluation, and native edge validation. Across nine subjects and three seeds on BCI Competition IV-2a, S25-TRADES achieves the highest observed mean true-union robustness among compressed EEGNet models (23.06% vs 21.27% for standard Full), with 26.27% fewer parameters and 25.10% fewer MACs. Matched controls identify TRADES as the main source of robustness recovery, improving S25 union accuracy by 6.74 percentage points over clean recovery (p=0.0039), while per-example analysis reveals boundary redistribution rather than uniform margin expansion. On Jetson Orin Nano, FP16 compression reduces board energy by up to 16.20% and latency by 8.00%. Despite 99.3% prediction agreement, native INT8 Q/DQ incurs about twice the FP16 latency and energy, demonstrating the need for joint robustness and hardware-aware optimization.

I. INTRODUCTION

EEG compression must balance accuracy, adversarial robustness, and real hardware efficiency, but prior work left compression-aware operating-point selection and native hardware costs unexplored. ORBITAL selects constraint-feasible compressed decoders, evaluates recovery and robustness, and validates edge deployment.

  • Embedded EEG decoders face coupled objectives: preserve task accuracy, resist small adversarial perturbations, and reduce real latency and energy.Source: §I · p. 1
  • S25 achieves the highest observed mean true-union robustness among compressed candidates, while S50 offers greater structural and measured hardware savings.Source: Figure 1 · p. 1
  • Prior work leaves compression-aware operating-point selection and native hardware costs unexplored, despite evidence that compression may not preserve adversarial robustness.Source: §I · p. 1
  • ORBITAL enumerates physically valid channel widths, screens clean and adversarial performance, and selects constraint-feasible and Pareto operating points rather than fixing a compression ratio.Source: §I · p. 1
  • Matched controls identify robust training as the principal source of adversarial recovery; at S25, TRADES improves true-union robustness by 6.74 percentage points over clean-only recovery across nine subjects.Source: §I · pp. 1–2
  • Per-example analysis indicates compression redistributes adversarial robustness rather than uniformly increasing classification margins.Source: §I · p. 2

II. METHODOLOGY

ORBITAL combines compression, recovery, robust evaluation, and deployment profiling in one pipeline.

  • ORBITAL integrates physical structured compression, postpruning recovery, robust evaluation, and deployment profiling into a unified pipeline.Source: §II · p. 2
  • Algorithm 1 summarizes the complete ORBITAL procedure.Source: §II · p. 2
  • The following subsections detail the pipeline’s stages.Source: §II · p. 2

A. Physical Structured Compression

ORBITAL rebuilds dense decoders after physically structured channel pruning, then evaluates recovery and selects deployable operating points under accuracy and robustness constraints.

A. Physical Structured Compression

  • EEGNet pruning reduces coupled temporal and pointwise filter dimensions while preserving depthwise structure and downstream compatibility; ShallowConvNet importance also accounts for downstream connectivity.Retained parameters transfer into rebuilt architectures with corresponding convolutional, normalization, and classifier dimensions updated consistently.Source: A. Physical Structured Compression · p. 2

B. Robustness-Aware Recovery and Quantization

  • After compression, ORBITAL evaluates raw, clean-recovered, and adversarially recovered decoders, with TRADES used for robust recovery.Source: B. Robustness-Aware Recovery and… · p. 2
  • The operating-point procedure enumerates physically valid widths, screens clean and PGD20 accuracy, enforces feasibility constraints, and builds an accuracy–robustness–size Pareto set.Selected candidates receive multi-attack confirmation and edge-hardware profiling.Source: B. Robustness-Aware Recovery and… · p. 2
  • EEGNet low-precision deployment supports QAT with fake-quantized activations and per-output-channel weights, while explicit Q/DQ export enables native TensorRT evaluation.This separates quantization fidelity from realized hardware efficiency.Source: B. Robustness-Aware Recovery and… · p. 2

C. Robustness-Constrained Operating-Point Selection

ORBITAL selects operating points using explicit clean-accuracy and robustness constraints, then favors feasible or nondominated candidates. Final robustness is measured across clean correctness and all confirmation attacks.

C. Robustness-Constrained Operating-Point Selection

III. EXPERIMENTAL SETUP

Experiments evaluate EEGNet compression and deployment primarily on BCI Competition IV-2a, with ShallowConvNet used to assess cross-architecture generalization. The setup combines compression and recovery comparisons, multi-attack confirmation, subject-level statistics, and native Jetson measurements.

Dataset and models

  • Experiments use BCI Competition IV-2a: nine subjects, 22 EEG channels, four motor-imagery classes, and 230/58/288 training/validation/test trials per subject.Signals are sampled at 250 Hz, bandpass filtered to 4–38 Hz, and provided as 4.5-s windows; EEGNet is primary, while ShallowConvNet tests cross-architecture generalization.Source: §III · p. 3

Compression and recovery

  • EEGNet width-reduction targets span 0–60%, comparing raw pruning, clean recovery, and TRADES recovery.TRADES uses β = 2, ϵ = 0.005, ten inner steps, and step size 0.00125; recovery uses a learning rate of 5×10−5, up to 30 epochs, and validation-based early stopping.Source: §III · p. 3

Selection and robustness evaluation

  • PGD20 screens candidates using clean and robustness tolerances of δc = 0.03 and δr = 0.02; selected candidates face four confirmation attacks.Confirmation uses PGD100×10, APGD-CE, APGD-DLR, and FAB under a common ℓ∞ threat radius ϵ = 0.005; robustness is clean-correct true union.Source: §III · p. 3

Reproducibility and statistics

  • EEGNet compression-search and ShallowConvNet experiments cover nine subjects and three seeds, with seed results averaged within each subject before paired Wilcoxon tests.Bootstrap 95% confidence intervals are reported; selected aggressive EEGNet QAT experiments remain single-seed.Source: §III · p. 3

Hardware evaluation

  • Native deployment uses TensorRT on Jetson Orin Nano Super under fixed MAXN SUPER clocks, with FP16 measured in five independent 60-s runs.Measurements include inference latency, throughput, active whole-board power, and board energy per inference; learned-scale Q/DQ exports separately assess numerical fidelity and deployment cost.Source: §III · p. 3

A. Compression–Robustness Operating Points

S25-TRADES has the highest observed mean union robustness among evaluated compressed EEGNet candidates, with fewer parameters and MACs than the full-width model. The results also distinguish a maximum-compression screen-feasible candidate from the robustness-oriented operating point.

A. Compression–Robustness Operating Points

B. Compression–Recovery Interaction

Matched controls show that TRADES drives the recovery benefit, which peaks at S25; per-example results indicate that compression redistributes adversarial robustness rather than uniformly expanding margins.

B. Compression–Recovery Interaction

  • Full-TRADES exceeds standard Full by 3.42 pp (p = 0.0234), while S25-TRADES is 1.63 pp below Full-TRADES (p = 0.0977).These matched controls show that compression alone does not explain the robustness gain.Source: B. Compression–Recovery Interaction · p. 3

C. Adversarial Boundary Redistribution

  • Fig. 4 shows S25-TRADES rescues 7.25% of examples and loses robustness on 5.47%, for a net change of +1.79 pp.Opposing worst-case margin shifts indicate selective boundary redistribution, not uniform margin expansion.Source: C. Adversarial Boundary Redistribution · p. 3

B. Compression–Recovery Interaction

C. Adversarial Boundary Redistribution

D. Cross-Architecture Generalization

ShallowConvNet results show that recovery preferences vary with architecture and compression severity. Jetson measurements show energy savings from structural compression, while INT8 Q/DQ raises deployment costs.

D. Cross-Architecture Generalization

  • ShallowConvNet S25-TRADES reaches 57.56% clean and 41.23% union accuracy, versus Full at 57.90% and 41.86%; neither paired difference is significant.At S50, raw pruning yields 34.84% union accuracy; clean recovery restores it to 40.74%, versus 39.76% for S50-TRADES.Source: D. Cross-Architecture Generalization · p. 4
  • The preferred ShallowConvNet recovery method depends on architecture and compression severity, rather than showing a universal TRADES advantage.At S50, clean recovery exceeds S50-TRADES in union accuracy.Source: D. Cross-Architecture Generalization · p. 4

E. Hardware Efficiency and Precision

  • S50 reduces Jetson latency by 8.00% and board energy by 16.20%, while learned-scale INT8 Q/DQ preserves 99.3% prediction agreement but incurs roughly twice FP16 latency and energy.Conversion and reformat overheads limit the benefit of lower precision.Source: E. Hardware Efficiency and Precision · p. 4

V. CONCLUSION

ORBITAL combines constrained operating-point selection with recovery and deployment evaluation. The conclusion reports heterogeneous robustness effects and hardware trade-offs, alongside the authors’ AI-use disclosure.

V. CONCLUSION

  • ORBITAL’s constrained search identifies distinct feasible, robustness-oriented, and efficiency-oriented operating points.The conclusion combines physical structured compression, recovery objectives, and deployment behavior.Source: §V · p. 4
  • Matched controls attribute the primary robustness gains to TRADES, while per-example analysis finds heterogeneous adversarial-boundary redistribution.Recovery effectiveness also depends on decoder structure and compression severity.Source: §V · p. 4
  • On Jetson, structural compression can reduce energy, whereas INT8 Q/DQ may increase execution cost through conversion overhead.For S25 and S50, INT8 Q/DQ preserves approximately 99.3% prediction agreement yet roughly doubles latency and board energy relative to FP16.Source: §V · p. 4, Figure 5 · p. 4

GENERATIVE AI USE DISCLOSURE

  • The authors report using ChatGPT and Grammarly for language, text, and methodology-figure refinement, and say they reviewed the generated or refined content.They state they take full responsibility for the publication’s content.Source: GENERATIVE AI USE DISCLOSURE · p. 4

Related papers

Loading 2610.36411v1…