AERIAL: Adversarial Evaluation of Robustness in Accuracy-Preserving Low-Precision EEG Decoders
A research paper on low-precision EEG decoders examines adversarial robustness across compression techniques.
This research paper evaluates adversarial robustness in low-precision EEG decoders using BCI Competition IV-2a simulations, comparing models with different compression techniques.
- Research on adversarial robustness in low-precision EEG decoders
- Comparisons of FP32 and quantized EEGNet/ShallowConvNet models
- Results show direct robustness, transfer efficiency, and deployment efficiency are distinct
Full article147 words · extracted from arxiv.org · click to collapse
Deployment-oriented compression is attractive for resource-constrained brain--computer interfaces (BCIs), but whether it changes adversarial vulnerability remains unclear. On BCI Competition IV-2a, we compare 32-bit floating-point (FP32) EEGNet and ShallowConvNet models with global magnitude pruning and simulated INT8 post training quantization (PTQ) and quantization-aware training (QAT) across nine subjects and three seeds. Simulation provides differentiable quantize--dequantize models for white-box attacks and gradient analysis, while native TensorRT deployment is used for validation. Accuracy-preserving compression does not improve direct robustness: at $ε=0.005$, EEGNet PGD accuracy remains 22--24\% across FP32, 50\% pruning (P50), PTQ, and QAT. However, P50 reduces bidirectional transfer efficiency to 0.963/0.928 (FP32$\rightarrow$P50/P50$\rightarrow$FP32), versus 0.994/0.997 for PTQ; the same trend holds for ShallowConvNet. Gradient alignment shows a corresponding separation, while native PTQ agrees with simulated clean/adversarial predictions in 95--98\% of cases. These results show that direct robustness, adversarial transfer, and deployment efficiency are distinct properties of compressed EEG decoders.
Text extracted automatically; images, tables and formatting may be missing. Original: https://arxiv.org/abs/2609.30037