{"id":"c167e3ea-a4ee-4508-b89f-3f5d00fe82da","arxiv_id":"2412.09933","paper_version":1,"verdict":"CONDITIONAL","confidence":"HIGH","novelty_score":6.0,"correctness_risk":"medium","formal_verification":"none","parameter_count":3,"one_line_summary":"Backdoor attacks on transfer learning for EEG-based BCIs are demonstrated, and active poisoning strategies that select source samples improve attack success rate over random poisoning.","lead":"This paper shows that a small periodic pulse hidden in shared EEG data can secretly backdoor transfer learning models for brain-computer interfaces, causing them to misclassify signals that carry the trigger. The authors propose active sample-selection strategies that raise attack success rates above random poisoning, exposing a supply-chain risk for BCI systems.","discovery_kind":"new_method","skeptic_critique":{"model":"deepseek-v4-flash","headline":"Trigger-amplitude tuning is uncontrolled: without a sensitivity/detectability sweep, the reported ASR gains may reflect a visible trigger, not a stealthy practical backdoor.","rationale":"The reader identified the hand-tuned per-dataset trigger amplitude and the absence of a sensitivity/detectability analysis as the weakest assumption. I agree that this is the most load-bearing concern because it directly targets the paper's claimed stealthiness and practical threat, not merely the internal AP-versus-Random comparison. The reported BCA stability alone does not establish imperceptibility, and the ERN amplitude of 100% of channel-wise standard deviation makes the trigger as large as the signal itself, which is a concrete red flag. A sensitivity sweep with an explicit detection metric would settle whether high ASR can be achieved at amplitudes that are actually inconspicuous. The paper also lacks error bars, but that concern is secondary to the amplitude calibration issue for the central practical-risk claim. Since the reader already recommends conditional acceptance and my concern supports rather than overturns that recommendation, the verdict should remain unchanged.","tokens_in":26317,"tokens_out":7655,"duration_ms":99191,"concrete_test":"Re-run the main protocol of Table 1 on all four datasets with a sweep of NPP amplitudes, e.g., 0.1%, 1%, 5%, 10%, 30%, 50%, and 100% of the mean channel-wise standard deviation. For each amplitude, report ASR, BCA, and a simple trigger-detection metric, such as the AUC of a matched filter for the NPP period/duty cycle or a per-channel L2-norm outlier detector on poisoned versus clean source samples. If AP's ASR advantage over Random disappears at the largest amplitude whose detection AUC is near chance (e.g., ≤0.7), the practical-risk claim fails; if the advantage persists at undetectable amplitudes, the concern is resolved.","verdict_should_be":"UNCHANGED","load_bearing_attack":"The paper's central practical claim is that the NPP-trigger backdoor is both effective and stealthy, exposing a serious risk in TL-based BCIs. Section 4.4.2 sets the trigger amplitude per dataset to 0.2%, 15%, 30%, and 100% of the mean channel-wise standard deviation for P300, MI1, MI2, and ERN, respectively, with no sensitivity analysis and no detectability evaluation. The ERN setting is especially problematic: a trigger at 100% of the channel-wise standard deviation has magnitude comparable to the EEG signal itself, so poisoned ERN samples are not plausibly 'almost identical' to benign samples, contrary to the impression given by the MI1 example in Figure 4. Conversely, P300 uses only 0.2%, and it is unexplained why such a tiny trigger achieves high ASR. Because all strategies share the same hand-set amplitude, the AP-versus-Random comparison is internally fair, but the external claim of a serious, stealthy practical risk is not established. If the attack requires a trigger large enough to be easily detected, or if a truly imperceptible amplitude yields low ASR, the headline claim weakens substantially.","agreement_with_reader":"agree"},"referee_report":{"model":"deepseek-v4-flash","summary":"This paper studies backdoor attacks on transfer learning (TL) based EEG brain-computer interfaces (BCIs). The attacker poisons a small subset of source-domain EEG trials with a narrow periodic pulse (NPP) trigger, relabels those trials to a target class, and then an innocent user aligns the poisoned source data with unlabeled target data and trains a deep learning model. The paper proposes several active poisoning (AP) selection strategies—MDS, RDS, MUS, MMCS, and their combinations—to choose which source trials to poison, with the goal of increasing attack success rate (ASR) at a fixed poisoning rate while keeping classification accuracy (BCA) close to baseline. Experiments on four EEG datasets (P300, ERN, MI1, MI2) and three CNN architectures (EEGNet, DeepCNN, ShallowCNN) report ASRs up to near 100% for the best strategies, with BCA within a few points of the clean baseline. The paper also investigates fine-tuning defenses, data augmentation, cross-task TL, alternative triggers, and traditional SVM classifiers.","tokens_in":26536,"tokens_out":9554,"duration_ms":88543,"significance":"The paper is the first to address backdoor attacks in the TL pipeline for EEG-based BCIs, a realistic and timely threat scenario for BCI security. Its strengths include a careful definition of ASR that excludes already-misclassified samples, evaluation across four datasets and three models with leave-one-subject-out cross-validation, and robustness checks across trigger types, fine-tuning, and data augmentation. If the main result—that AP strategies substantially improve attack efficiency over random poisoning while remaining stealthy—is confirmed, the work would be an important contribution to the security community and a cautionary note for BCI deployment. However, the practical risk claim is currently weakened by the absence of a sensitivity analysis for the trigger amplitude and by the lack of error bars or statistical tests on the reported mean ASRs.","major_comments":[{"comment":"The NPP trigger amplitude is a free parameter set to 0.2%, 15%, 30%, and 100% of the mean channel-wise standard deviation for P300, MI1, MI2, and ERN, respectively, with no sensitivity analysis and no quantitative evaluation of trigger visibility or detectability. The 100% amplitude used for ERN is comparable in magnitude to the EEG signal itself, so poisoned ERN trials cannot be described as 'almost identical' to benign trials (a description that is only made for the MI1 example in Figure 4 with a=30%). The paper's central claim of a serious, stealthy practical risk therefore requires either (i) a demonstration that the reported high ASRs are preserved at amplitudes that are demonstrably imperceptible (e.g., by a detection test or a perception model), or (ii) a discussion of the trade-off between ASR and amplitude with explicit detection thresholds. Without this, the external validity of the attack as a 'stealthy' backdoor is not established.","section":"Section 4.4.2"},{"comment":"All experimental results are reported as means over five random runs without standard deviations, confidence intervals, or significance tests. For example, Table 1 shows ASR improvements of roughly 10 percentage points for the best AP strategies over Random on P300 (e.g., EEGNet 83.2% vs. 94.3%), but the reader cannot assess whether these differences exceed run-to-run variability. Figure 5 similarly lacks error bars. Because the paper's main contribution is the claim that AP strategies improve attack efficiency over Random at the same poisoning rate, the authors should report error bars and/or perform paired statistical tests across subjects to substantiate this claim. This is a load-bearing methodological gap.","section":"Section 4.3.1"},{"comment":"The fine-tuning experiment shows a dramatic drop in ASR on P300 and MI1 (e.g., EEGNet ASR falls from 94.3% to 22.0% for MMCS on P300, and from 99.1% to 90.6% on MI1), which the authors attribute to the small NPP amplitudes on these datasets. This reinforces the concern that the attack success is tightly coupled to the hand-set amplitude: if a truly stealthy trigger must be much smaller than the amplitudes used here, the attack may fail in the presence of fine-tuning. The paper should either provide a sensitivity analysis showing the joint effect of amplitude and fine-tuning, or temper the claim that these attacks are a serious risk in realistic BCI workflows.","section":"Section 4.8.1"}],"minor_comments":[{"comment":"The sentence 'Different amplitudes were used on the three datasets' should read 'four datasets', since four datasets are listed.","section":"Section 4.4.2"},{"comment":"The notation for poisoned samples is inconsistent: the text states 'P1 + P2 + ... + PS = P' but the set (~X p s , 1)Ps p=0 suggests an index range that is not clearly defined; the index should probably run from p=1 to P_s, and the total P should be defined consistently with the P_s notation.","section":"Section 3.1"},{"comment":"Reference [45] is missing the first initial of the third author; the correct citation should include the author's full name.","section":"References"},{"comment":"The subject-level stability analysis is only presented for the P300 dataset; adding subject-level results for at least one other dataset would support the generality of the stability claim, or the limitation should be explicitly acknowledged.","section":"Section 4.6"},{"comment":"The caption of Figure 3 does not specify which dataset(s) and model(s) are shown; the text should clarify the aggregation presented in the figure to allow the reader to interpret the comparison between BCAs with and without poisoning.","section":"Figure 3"}],"recommendation":"major_revision","confidential_remarks":null},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"Here's my take on 2412.09933. The core result is real: transfer learning in EEG BCIs can be backdoored by poisoning source data with a simple NPP trigger, and picking which samples to poison with active-learning-style criteria buys a consistent ASR improvement over random selection at the same poisoning rate. That is the first demonstration I know of for TL-based BCIs, and the evaluation is solid enough to take seriously. Four datasets, three CNN architectures, plus fine-tuning, data augmentation, and cross-task scenarios; the ASR is defined carefully to exclude already-misclassified samples, and they report honest failures (CSP+SVM, cross-task, ShallowCNN). The computational cost table is a nice practical touch.\n\nThe main soft spot is the trigger amplitude. The paper sets a per-dataset amplitude of 0.2%, 15%, 30%, and 100% of the mean channel-wise standard deviation for P300, MI1, MI2, and ERN, respectively. No sensitivity analysis, no detectability evaluation. At 100% on ERN the trigger is the same size as the signal; calling that 'almost identical' to a benign sample is a stretch. The AP-versus-random comparison is still fair, since both share the same amplitude, but the 'stealthy, serious practical risk' part of the headline is not established. If a detector can see a 100% amplitude pulse, the attack is not stealthy. The authors need an amplitude sweep with a detectability measure (statistical outlier test, frequency-domain inspection, human labeling) to close that gap.\n\nEverything else is minor by comparison: no error bars on the five-run means, no code release, and a few untuned constants (period, duty cycle, k). Fine-tuning does erode ASR in some cases, but that is a known phenomenon and they show AP still helps.\n\nVerdict: the central claim holds. This is a serious empirical paper for the BCI security subfield. It deserves full peer review. I would accept it conditionally, with the amplitude sensitivity and detectability analysis as a required revision, and variance reporting as strongly recommended. I would cite it if I were writing about BCI security or backdoor attacks on physiological signals.","headline":"First solid demonstration that transfer learning in EEG BCIs can be backdoored via source-data poisoning; active selection helps, but the stealthiness claim needs an amplitude sensitivity sweep.","tokens_in":27066,"tokens_out":2468,"would_cite":true,"duration_ms":27090,"reading_group":"yes","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"This paper establishes that transfer learning in EEG-based brain-computer interfaces is vulnerable to backdoor attacks, and that deliberately choosing which source-domain samples to poison—rather than poisoning at random—markedly raises…","keywords":["brain-computer interface","electroencephalogram","transfer learning","poisoning attack","backdoor attack","active learning","sample selection","deep learning"],"falsifier":"Re-run the active-poisoning protocol at a fixed trigger amplitude of 1% of mean channel-wise standard deviation across all four datasets and all models, then measure ASR at 5% poisoning; if ASR collapses to near the random-poisoning baseline, the reported success is an artifact of amplitude calibration rather than a robust property of active sample selection.","tokens_in":26095,"feed_emoji":"🧠","tokens_out":8661,"duration_ms":79804,"temperature":0.7,"pith_summary":"The paper claims that transfer learning, the standard way to reduce calibration effort in EEG-based brain-computer interfaces, creates a backdoor vulnerability: an attacker who poisons a small fraction of the publicly shared source-domain data with a narrow-period-pulse trigger can plant a hidden behavior in the trained model. After transfer, any test signal from a new user that carries the same trigger is systematically misclassified into an attacker-chosen class, while ordinary signals continue to be classified correctly. The paper proposes several active-poisoning strategies that select which source samples to poison instead of choosing them at random, and reports that these strategies raise the attack success rate by roughly 10 to 30 percentage points at a 5 percent poisoning rate on four EEG datasets and three deep-learning models. A sympathetic reader would take the central claim to be that backdoor attacks on transfer-learning-based BCIs are practical and that poisoning a small, carefully chosen set of samples is enough to make them succeed.","feed_headline":"Backdoor attacks succeed against transfer-learning EEG BCIs","feed_subtitle":"Choosing which source samples to poison lifts attack success to about 90 percent while normal accuracy stays put.","key_machinery":"The load-bearing mechanism is the narrow-period-pulse (NPP) trigger—a periodic square wave of tunable amplitude, period, phase, and duty cycle, added identically across all EEG channels—combined with active-poisoning sample selection that inverts the logic of active learning. Where active learning queries the most uncertain samples for labeling, active poisoning selects the most confidently classified non-target samples (lowest entropy in MUS, smallest model change in MMCS) because relabeling those samples to the target class forces the decision boundary to move far; diversity-based selection (MDS, RDS) spreads the poison across the input space, and the combined strategies (MUS+MDS, MMCS+MDS) balance both criteria. This selection machinery does the work of embedding the trigger robustly while keeping the number of poisoned samples small, which is what makes the attack efficient and hard to notice.","core_discovery":"The central discovery is that transfer learning in EEG-based brain-computer interfaces is vulnerable to backdoor attacks. When an attacker inserts a narrow-period-pulse (NPP) trigger into a small subset of source-domain non-target samples and relabels them to a target class, then aligns the poisoned source data with the target user's data using Euclidean alignment and trains a deep model, the resulting model misclassifies trigger-carrying target-domain samples into that target class with high probability while balanced classification accuracy on clean samples stays near the uninfected baseline. The paper further shows that replacing random sample selection with active-poisoning strategies—minimum uncertainty sampling (MUS), minimum model change sampling (MMCS), and their combinations with diversity sampling—improves attack success rates while keeping the poisoning budget fixed, and that the improvements persist under fine-tuning, data augmentation, and alternative trigger waveforms.","pith_inferences":["If the active-poisoning principle transfers, then defenses that screen for anomalous or outlier training samples in source data are likely to miss the poisoned subset, because the selected samples deliberately look like typical, high-confidence members of their class; testing outlier-removal and loss-based filtering defenses against AP-poisoned data would settle this.","The hand-tuned trigger amplitudes suggest an attacker would need dataset-specific calibration; a systematic sweep over amplitudes is the natural next test to see whether a single universally stealthy trigger exists or whether the attack success rate degrades sharply below a dataset-dependent threshold.","The same inverted active-learning logic might extend to other calibrated-model settings, such as speech or physiological-signal transfer learning, where shared pre-trained data is common; this is a direct corollary of the paper's mechanism but not something the paper tests.","A defensive implication the paper leaves implicit: since MUS and MMCS select low-entropy, low-model-change samples, a model owner who tracks per-sample training loss or confidence might spot the poisoned samples as an anomaly cluster; investigating that detector would be a concrete follow-up."],"forward_implications":["At a fixed 5 percent poisoning rate, the proposed active-poisoning strategies raise attack success rates over random poisoning by roughly 10 to 30 percentage points across datasets and models, with the combined MUS+MDS and MMCS+MDS strategies usually performing best.","The backdoor survives end-to-end fine-tuning of the infected model with clean labeled target-domain data: attack success rates drop but remain well above the uninfected baseline, and active poisoning still beats random poisoning in that setting.","None of the tested data-augmentation schemes—noise, multiplication, frequency shift, or channel weakening—consistently removes the backdoor, so the attack withstands a common class of defenses.","The model-based active-poisoning strategies do not require the attacker to know the user's architecture; success rates stay high when the selector model differs from the target model.","The attack is not tied to the NPP waveform: sine, sawtooth, and random-pulse triggers all achieve high attack success rates, sometimes higher than NPP."],"supporting_citations":[{"why":"supplies the narrow-period-pulse (NPP) trigger design that the attack inserts into source-domain EEG samples.","marker":"[23]"},{"why":"provides the Euclidean-alignment (EA) transfer-learning method used to align poisoned source data with target-domain data.","marker":"[18]"},{"why":"defines the backdoor attack threat model (BadNets) that the paper adapts to the transfer-learning setting.","marker":"[25]"},{"why":"provides the uncertainty-sampling criterion that MUS inverts to select the most confident samples for poisoning.","marker":"[34]"},{"why":"provides the expected-model-change criterion that MMCS inverts to select samples with minimal impact on model parameters.","marker":"[35]"},{"why":"supplies the representativeness-and-diversity sampling idea that RDS adapts to poisoned-sample selection.","marker":"[36]"},{"why":"defines the EEGNet architecture used as one of the three deep target models in the experiments.","marker":"[42]"},{"why":"defines the DeepCNN and ShallowCNN architectures used as the other two deep target models.","marker":"[43]"},{"why":"supplies the P300 dataset used for one of the four empirical evaluations.","marker":"[38]"},{"why":"supplies the MI1 motor-imagery dataset (BCI Competition IV Dataset 2a) used in experiments.","marker":"[40]"}],"fun_headline_variants":["Backdoor attacks piggyback on transfer learning to hijack EEG BCIs","Active poisoning efficiently backdoors EEG-based BCIs","Active poisoning hits 90% on EEG BCI backdoor attacks","First backdoor attack on transfer-learning EEG BCIs","Poisoning transfer learning backdoors EEG BCIs"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"The attack's success depends on per-dataset manual tuning of the trigger amplitude (0.2%, 15%, 30%, and 100% of mean channel-wise standard deviation for P300, MI1, MI2, and ERN), so if a trigger small enough to be genuinely imperceptible fails to reach the reported attack success rates, the practical threat is weaker than claimed.","fun_headline_variants_meta":{"raw":{"variants":["Backdoor attacks piggyback on transfer learning to hijack EEG BCIs","Active poisoning efficiently backdoors EEG-based BCIs","Active poisoning hits 90% on EEG BCI backdoor attacks","First backdoor attack on transfer-learning EEG BCIs","Poisoning transfer learning backdoors EEG BCIs"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.001499,"raw_usage":{"total_tokens":5993,"prompt_tokens":902,"completion_tokens":5091,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":518,"completion_tokens_details":{"reasoning_tokens":5008}},"tokens_in":518,"tokens_out":5091,"duration_ms":37768,"temperature":1.0,"reasoning_tokens":5008,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-11T16:33:11.544934+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Re-run the active-poisoning protocol at a fixed trigger amplitude of 1% of mean channel-wise standard deviation across all four datasets and all models, then measure ASR at 5% poisoning; if ASR collapses to near the random-poisoning baseline, the reported success is an artifact of amplitude calibration rather than a robust property of active sample selection.","supporting_citations":[{"cited_title":"Transfer learning for brain-computer interfaces: A Euclidean space data alignment approach","cited_arxiv_id":null,"evidence_quote":"provides the Euclidean-alignment (EA) transfer-learning method used to align poisoned source data with target-domain data."},{"cited_title":"An analysis of active learning strategies for sequence labeling tasks","cited_arxiv_id":null,"evidence_quote":"provides the uncertainty-sampling criterion that MUS inverts to select the most confident samples for poisoning."},{"cited_title":"Active learning for classification with maximum model change","cited_arxiv_id":null,"evidence_quote":"provides the expected-model-change criterion that MMCS inverts to select samples with minimal impact on model parameters."},{"cited_title":"Pool-based sequential active learning for regression","cited_arxiv_id":null,"evidence_quote":"supplies the representativeness-and-diversity sampling idea that RDS adapts to poisoned-sample selection."},{"cited_title":"EEGNet : A compact convolutional neural network for EEG -based brain-computer interfaces","cited_arxiv_id":null,"evidence_quote":"defines the EEGNet architecture used as one of the three deep target models in the experiments."},{"cited_title":"Deep learning with convolutional neural networks for EEG decoding and visualization","cited_arxiv_id":null,"evidence_quote":"defines the DeepCNN and ShallowCNN architectures used as the other two deep target models."},{"cited_title":"An efficient P 300-based brain-computer interface for disabled subjects","cited_arxiv_id":null,"evidence_quote":"supplies the P300 dataset used for one of the four empirical evaluations."},{"cited_title":"Review of the BCI C ompetition IV","cited_arxiv_id":null,"evidence_quote":"supplies the MI1 motor-imagery dataset (BCI Competition IV Dataset 2a) used in experiments."}],"review_version":1}