Adversarial Filtering Based Evasion and Backdoor Attacks to EEG-Based Brain-Computer Interfaces

Dongrui Wu; Hanbin Luo; Lubin Meng; Wenzhong Liu; Xiaoqing Chen; Xue Jiang

REVIEW 3 major objections 4 minor 41 references

Adversarial Filtering Based Evasion and Backdoor Attacks to EEG-Based Brain-Computer Interfaces

T0 review · 3 major / 4 minor · reviewed 2026-08-11 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read One optimized linear spatial filter applied to EEG trials drives BCI classifier accuracy to chance level; a random version poisons 5% of training data to create backdoors with over 90% attack success in most cross-subject settings.

desk verdict Evasion attack is real and novel; stealthiness claim needs quantitative support before the paper's headline is fully credible. read the letter →

arxiv 2412.07231 v1 pith:4NSGBETL submitted 2024-12-10 cs.HC cs.LG

Lubin Meng , Xue Jiang , Xiaoqing Chen , Wenzhong Liu , Hanbin Luo , Dongrui Wu This is my paper · ORCID

classification cs.HCcs.LG

keywords brain-computerinterfaceEEGadversarialfilteringevasionattackbackdoorspatialfilterBCIsecurity

verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

This paper tries to show that the signal-processing stage of an EEG-based brain-computer interface is itself an attack surface. It proposes two attacks built from a single linear spatial filter $W \in \mathbb{R}^{C \times C}$ applied to every trial: an evasion attack that drives a trained classifier's balanced accuracy to chance while keeping the filtered EEG nearly indistinguishable from the original, and a backdoor attack that uses a random near-identity filter as a key to poison a small fraction of training data. Experiments across error-related negativity, motor imagery, and P300 paradigms, against convolutional networks and traditional spatial-filter-plus-classifier pipelines, support the claim. If these attacks hold up, securing a BCI means more than hardening the classifier: the preprocessing and filtering chain itself must be authenticated.

What carries the argument

The load-bearing object is the adversarial filter $W \in \mathbb{R}^{C \times C}$, a channel-mixing matrix applied to every z-scored EEG trial $\mathbf{x}_i$ to produce $W\mathbf{x}_i$. For the evasion attack, $W$ is optimized by gradient descent on $\min_W \mathbb{E}[-\mathcal{L}_{\mathrm{CE}}(W\mathbf{x}_i, y_i) + \alpha \mathcal{L}_{\mathrm{MSE}}(W\mathbf{x}_i, \mathbf{x}_i)]$, where the first term makes the classifier misclassify and the second keeps the distortion small; a binary search over $\alpha$ finds the largest distortion penalty that still pushes validation balanced accuracy to chance level $\leq 1/K$. For the backdoor attack, $W$ is not optimized at all: a random matrix near the identity is the backdoor key, half its channels zeroed, and applying it to trials during training labels them as the adversary's target class, so the model learns the mapping $W\mathbf{x} \mapsto y_t$.

What would settle it

Re-run the evasion experiment with one change: after applying the adversarial filter $W$, re-apply z-score standardization (or any per-trial normalization) to the filtered trial before feeding it to the classifier. If balanced accuracy returns to near-clean levels, the attack depends on the filter being the last preprocessing step and would fail in pipelines that normalize after spatial filtering.

Watch

Extended reading notes

Core claim

The central discovery is that a fixed matrix $W$ acts as a universal weapon in both attack modes. For evasion, gradient descent on $\min_W \mathbb{E}[-\mathcal{L}_{\mathrm{CE}}(W\mathbf{x}_i, y_i) + \alpha \mathcal{L}_{\mathrm{MSE}}(W\mathbf{x}_i, \mathbf{x}_i)]$, with binary search over $\alpha$, produces a filter whose application to test trials collapses balanced accuracy to chance: on the ERN dataset, EEGNet drops from 73.98% to 50.07% within-subject and to 48.32% cross-subject, with similar collapses on motor imagery (to 25%, the four-class chance level) and P300 (to about 50%). The filtered trials are claimed to be nearly identical to benign trials in waveforms, spectrograms, and topoplots, with the decisive difference appearing only in internal feature maps. For backdoor attacks, no optimization is needed: a randomly initialized $W = I + \mathcal{N}(0, 0.05)$ with half of the off-diagonal noise zeroed, applied to 5% of training trials relabeled as the target class, yields attack success rates above 90% in most cross-subject settings while clean-trial accuracy stays close to that of an unpoisoned model.

Load-bearing premise

For the attack to be deployable, an adversary must be able to insert or replace the spatial filter inside the signal-processing module of a working brain-computer interface; the paper argues this is easier than installing a jamming module but gives no concrete access path, and real BCI pipelines may not expose a learnable linear filter stage.

Editorial extensions

If this is right

An attacker who can place one matrix in the signal-processing chain does not need per-trial perturbations or a separate jamming module; the same filter works for an entire test session.
The filter transfers across model architectures, so a black-box adversary can optimize it on a substitute model and still drive unknown classifiers toward chance accuracy.
A backdoor can be installed with only 5% poisoned training trials and, in cross-subject settings, usually exceeds 90% attack success while leaving clean-trial accuracy nearly unchanged, so standard accuracy checks will not reveal it.
Because the filtered trials are nearly indistinguishable in time-domain traces, spectrograms, and topoplots, detection requires inspecting the learned feature maps or auditing the filtering module itself.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

The paper does not test re-normalization after filtering; if a BCI z-scores again after the spatial filter, the attack may weaken or fail, and that is the first experiment a defender should run.
The linear-filter attack surface extends beyond the tested pipelines: any BCI that applies a learned spatial projection (common spatial patterns, xDAWN) is formally applying a matrix to the same input type, so auditing those learned coefficients is an immediate defensive implication.
Because the average distortion is amplified through the network yet invisible to spectral and topoplot checks, a practical detector could target feature-space statistics of the last convolutional layer rather than raw-signal statistics.

Share X Bluesky LinkedIn Reddit HN

Signed reviews

No signed human review yet.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Desk Editor's Note

read the letter

Colleague,

Worth a look: the evasion half is a genuine new attack vector for EEG BCIs—a single C×C spatial filter W that drops test BCA to chance across three datasets and several architectures, including classical pipelines (xDAWN+LR, CSP+LR). That is a real result, and the paper ships code and does the right baseline comparisons (clean vs. noisy filter) plus transferability and ablation. The backdoor half is also effective, with ASR >90% in cross-subject settings at 5% poisoning. I'd send this to review.

The soft spot is exactly where the stress-test note lands. The paper repeatedly claims the filter is 'nearly identical' and 'difficult to detect by a computer program,' but it never reports a quantitative distortion (RMSE/SNR) for the actual filters used in Table 1, and it never runs a detector. The only distortion curve (Fig. 7) is for fixed α without binary search, so we don't know the operating point. Since W is a full linear mix, it preserves single-channel spectra but alters cross-channel covariance—the very thing CSP/xDAWN and EEGNet depthwise filters read. A covariance-based one-class detector could separate filtered from benign trials easily. That doesn't kill the attack-effectiveness claim, but it means the stealthiness contribution is unproven, and the abstract overstates what is shown.

Minor: the backdoor key is a random filter, not an optimized one, so calling it 'adversarial filtering' for the backdoor is a bit generous. Also Algorithm 1 has a typesetting bug (two α's), figure numbering is off by one (Section 5.4 refers to Fig. 6 but the caption says Fig. 7), and the text version of Table 2 seems to contain a stray duplicated row for xDAWN+LR. These are fixable.

Who is it for: BCI security and adversarial-ML researchers. The attack model (adversary controls the signal-processing module) is plausible in some deployed BCIs, though the paper gives no concrete access path, which is worth stating as a limitation. The empirical demonstration is broad enough that it deserves referee time, not a desk reject. I'd ask for quantitative distortion at the deployed filters and at least one covariance-based detector experiment before accepting.

Referee Report

3 major / 4 minor

Summary. This paper proposes two attacks on EEG-based BCIs that operate at the signal-processing stage rather than at acquisition or classification. The evasion attack learns a C×C spatial filter W by minimizing cross-entropy plus an MSE distortion term (Eq. 5), with binary search on the trade-off parameter α to keep validation BCA at chance (Eq. 6, Algorithm 1). The backdoor attack uses a randomly initialized filter as a backdoor key, poisons 5% of training trials labeled as a target class, and reports ASR at test time. The authors evaluate on ERN, motor-imagery, and P300 datasets with EEGNet, DeepCNN, ShallowCNN, xDAWN+LR, and CSP+LR, in within- and cross-subject settings, and include transferability and ablation experiments. They claim this is the first adversarial-filtering study for EEG-based BCIs and that the filtered signals are nearly indistinguishable from benign signals.

Significance. The paper opens a new attack surface in the BCI processing chain and the evaluation is broad: three BCI paradigms, four model families, within- and cross-subject protocols, ten repeats, baselines, transferability, and trade-off studies, with source code provided. The evasion results—BCA reduced to chance across models—are convincing as an effectiveness result. The backdoor results, if the data are correct, also show high ASR with minimal clean-set BCA degradation. However, the advertised stealthiness is not yet demonstrated quantitatively, and one row of the main backdoor table contains an apparent data-integrity error. With a quantitative distortion/detector evaluation and a corrected table, this would be a solid contribution to BCI security.

major comments (3)

[Section 2, Fig. 1(c)] The paper's central stealthiness claim is not quantitatively supported. Algorithm 1's binary search returns the largest α that drives validation BCA to chance, but Table 1 reports no distortion value (RMSE, SNR, or spectral/covariance distance) for the selected W on any dataset or model. Figure 7 shows only the trade-off trend over α, not the operating point selected by binary search; Figs. 3–5 are visual and anecdotal. This matters because W is a C×C matrix applied identically at every time sample: it can preserve single-channel marginal spectra while changing cross-channel covariance and cross-spectra, which is exactly the information exploited by CSP, xDAWN, and EEGNet's depthwise convolutions. Please report the distortion at the deployed filter and evaluate the filtered trials against a detector (e.g., a classifier on spatial-covariance features) before claiming that filtered EEG is 'difficult to detect by human eyes or a computer program.'
[Section 2, Fig. 1(c)] The threat model is underspecified. The attack assumes an adversary can insert or replace the linear filter W inside the signal-processing module of a deployed BCI, but no concrete access path is given (e.g., software update compromise, insider access, supply-chain attack) and no countermeasure such as auditing or fixed-hardware filtering is discussed. If the filter is implemented in fixed hardware or is audited, the attack is not deployable. Please state the assumed access level and compare it explicitly with the jamming-module threat model used in prior work.
[Table 2, cross-subject xDAWN+LR rows] The ERN and P300 rows for xDAWN+LR under adversarial filtering report identical BCA (61.64 ± 0.47) and ASR (99.87 ± 0.14) in the cross-subject setting. These are different datasets with different channel counts, trial counts, and signal characteristics, so identical values to two decimal places are not plausible and suggest a copy/paste error. The affected rows must be corrected or recomputed; as printed, they undermine confidence in the backdoor experiment.

minor comments (4)

[Algorithm 1] The binary-search bounds are all named α; the statement `Initialize α← α0, α← 1e5, α← 0` is not well-formed and makes the search steps ambiguous. Rename the lower and upper bounds, e.g., α_low and α_high.
[Sections 5.4 and 5.5] Figure references are inconsistent: Section 5.4 refers to Fig. 6 for the α trade-off, but Fig. 6 is the feature-map figure, while the corresponding plots appear as Figs. 7 and 8. Please renumber and correct the in-text references.
[Section 5.4 caption / Section 4.5] The caption for the α trade-off figure states that mean and standard deviations were computed from 5 repeats, whereas Section 4.5 states that the within-subject evaluation was repeated 10 times. Clarify which setting applies to the trade-off experiment.
[Section 5.2] The phrase 'Obverse that' should be 'Observe that.'

Circularity Check

0 steps flagged · score 1.0 of 10

No significant circularity: the attack results are empirically self-contained and held-out evaluated; the evasion filter's alpha selection reuses the headline BCA criterion, but test-set BCA is an independent measurement.

full rationale

This paper is an empirical attack evaluation with no formal derivation chain to walk: the adversarial evasion filter is obtained by gradient descent on Eq. (5) against a target classifier, and the backdoor key is randomly generated (W = I + N(0,0.05)) and used in standard data poisoning. The claimed results, evasion BCAs at chance level (Table 1) and backdoor ASRs above 90% (Table 2), are measured on held-out test data (20% per subject in within-subject trials; held-out subjects in leave-one-subject-out cross-subject evaluation), so they are independent confirmations rather than constructional identities. The closest circularity-adjacent feature is that Algorithm 1 selects the trade-off parameter alpha by binary search on a validation criterion (BCA <= 1/K, Eq. (6)) that matches the headline evasion metric; this makes the validation-side BCA a fit target by construction, but the reported Table 1 numbers are test-set results, which is legitimate independent evidence. The paper contains many self-citations to the same groups (e.g., refs. [15], [16], [27]-[31]), but they supply background and prior-art framing (jamming-module attacks, universal adversarial perturbations, pulse-based backdoors) rather than load-bearing justification: the central claims rest on the paper's own experiments with public datasets (Kaggle ERN, BCI Competition IV 2a, P300 Hoffmann) against standard victim models, and the backdoor ASR is properly compared with a benign-model baseline. Unsupported elements such as the stealthiness assertion that filtered signals are 'difficult to be detected by human eyes or a computer program' (no detector experiment, and no RMSE reported at the binary-search-selected operating point) are evidence gaps for correctness risk, not circularity.

Assumptions & free parameters 4 free parameters · 4 assumptions · 0 invented entities

The paper's results rest on a small set of design choices and threat-model assumptions rather than on new scientific entities. The main burdens are the white-box access to the classifier for filter optimization, the ability to modify the signal processing stage, and the hand-chosen hyperparameters (alpha, poisoning ratio, initialization scale).

free parameters (4)

alpha (trade-off parameter) = selected by binary search, initialized to 100
Balances attack effectiveness versus distortion in Eq. (5); tuned on the validation set to reach chance-level BCA.
backdoor filter initialization variance = 0.05
Random matrix W = I + N(0,0.05) used as backdoor key, with half the channels zeroed; not optimized against the model.
poisoning ratio = 5% (swept from 1% to 10%)
Fraction of training trials transformed and relabeled in backdoor attacks; chosen by the authors.
validation split for evasion = 25% of training set
Used to binary-search alpha and to decide when the filter reaches chance-level BCA.

assumptions (4)

domain assumption The target classifier f is differentiable and available for gradient-based optimization during filter generation.
Eq. (5) requires gradients through f to optimize W.
domain assumption An adversary can replace or insert the signal processing filter W in the BCI pipeline after preprocessing.
Figure 1(c) and Section 2; without this access the attack cannot be deployed.
domain assumption The adversarial transform can be modeled as a linear CxC channel mix applied to z-scored trials.
Filter W is applied as Wx on CxT trials; actual BCI pipelines may use temporal, nonlinear, or hardware filters.
domain assumption Randomly initialized small-noise filters do not significantly affect classifier accuracy.
The noisy baseline in Table 1 empirically supports this for the tested models and datasets.

how reviews work

0 comments

Cite this review

Pith. "Pith review of Adversarial Filtering Based Evasion and Backdoor Attacks to EEG-Based Brain-Computer Interfaces." pith.science (2026). https://pith.science/paper/4NSGBETL

@misc{pith2026241207231,
  author       = {Pith},
  title        = {Pith review of: Adversarial Filtering Based Evasion and Backdoor Attacks to EEG-Based Brain-Computer Interfaces},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/4NSGBETL}},
  note         = {Machine review of arXiv:2412.07231}
}

read the original abstract

A brain-computer interface (BCI) enables direct communication between the brain and an external device. Electroencephalogram (EEG) is a common input signal for BCIs, due to its convenience and low cost. Most research on EEG-based BCIs focuses on the accurate decoding of EEG signals, while ignoring their security. Recent studies have shown that machine learning models in BCIs are vulnerable to adversarial attacks. This paper proposes adversarial filtering based evasion and backdoor attacks to EEG-based BCIs, which are very easy to implement. Experiments on three datasets from different BCI paradigms demonstrated the effectiveness of our proposed attack approaches. To our knowledge, this is the first study on adversarial filtering for EEG-based BCIs, raising a new security concern and calling for more attention on the security of BCIs.

Figures

Figures reproduced from arXiv: 2412.07231 by the authors.

**Figure 2.** Illustration of adversarial filtering based backd [PITH_FULL_IMAGE:figures/full_fig_p005_2.png] view at source ↗

**Figure 3.** EEG trials before and after adversarial filtering. [PITH_FULL_IMAGE:figures/full_fig_p010_3.png] view at source ↗

Figures from the paper (5 more)

**Figure 4.** Figure 4: Average Cz channel spectrograms of the benign EEG tr [PITH_FULL_IMAGE:figures/full_fig_p011_4.png]

**Figure 5.** Figure 5: Average topoplots of the benign EEG trials, the EEG [PITH_FULL_IMAGE:figures/full_fig_p012_5.png]

**Figure 6.** Figure 6: Average EEGNet feature maps of the benign EEG trial [PITH_FULL_IMAGE:figures/full_fig_p013_6.png]

**Figure 7.** Figure 7: BCAs (%) of EEGNet and the distortions of test EEG tr [PITH_FULL_IMAGE:figures/full_fig_p014_7.png]

**Figure 8.** Figure 8: BCAs (%) of poisoned EEGNet and ASRs of the proposed [PITH_FULL_IMAGE:figures/full_fig_p014_8.png]

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

41 extracted references · 38 canonical work pages

[1]

J. J. Daly, J. R. Wolpaw, Brain-computer interfaces in neurological rehabilitation, The Lancet Neurol- ogy 7 (11) (2008) 1032–1043

work page 2008
[2]

J. E. O’Doherty, M. A. Lebedev, P . J. I ﬀt, K. Z. Zhuang, S. Shokur, H. Bleuler, M. A. Nicolelis, Ac- tive tactile exploration using a brain-machine-brain interface, Nature 479 (7372) (2011) 228–231

work page 2011
[3]

Wu, B.-L

D. Wu, B.-L. Lu, B. Hu, Z. Zeng, A ﬀective brain- computer interfaces (aBCIs): A tutorial, Proc. of the IEEE 11 (10) (2023) 1314–1332

work page 2023
[4]

L. R. Hochberg, D. Bacher, B. Jarosiewicz, N. Y . Masse, J. D. Simeral, J. V ogel, S. Haddadin, J. Liu, S. S. Cash, P . V an Der Smagt, et al., Reach and grasp by people with tetraplegia using a neurally controlled robotic arm, Nature 485 (7398) (2012) 372–375. 10 Benign 0.2 0.4 0.6 0.8 1 1.2 Time (s) 0 10 20 Frequency (Hz) 0.01 0.02 0.03 Filtered 0.2 0.4...

work page 2012
[5]

B. J. Edelman, J. Meng, D. Suma, C. Zurn, E. Na- garajan, B. Baxter, C. C. Cline, B. He, Noninvasive neuroimaging enhances continuous neural tracking for robotic device control, Science Robotics 4 (31) (2019) eaaw6844

work page 2019
[6]

Y . Li, J. Pan, J. Long, T. Y u, F. Wang, Z. Y u, W . Wu, Multimodal BCIs: Target detection, mul- tidimensional control, and awareness evaluation in patients with disorder of consciousness, Proc. of the IEEE 104 (2) (2016) 332–352

work page 2016
[7]

G. K. Anumanchipalli, J. Chartier, E. F. Chang, Speech synthesis from neural decoding of spoken sentences, Nature 568 (7753) (2019) 493–498

2019
[8]

J. G. Makin, D. A. Moses, E. F. Chang, Ma- chine translation of cortical activity to text with an encoder-decoder framework, Nature Neuroscience 23 (2020) 575–582

work page 2020

Show all 41 references

[9]

B. J. Lance, S. E. Kerick, A. J. Ries, K. S. Oie, K. McDowell, Brain-computer interface technolo- gies in the coming decades, Proc. of the IEEE 100 (3) (2012) 1585–1599

2012
[10]

T. O. Zander, C. Kothe, Towards passive brain- computer interfaces: applying brain-computer inter- face technology to human-machine systems in gen- eral, Journal of Neural Engineering 8 (2) (2011) 025005

2011
[11]

Wu, J.-T

D. Wu, J.-T. King, C.-H. Chuang, C.-T. Lin, T.- P . Jung, Spatial ﬁltering for EEG-based regression problems in brain-computer interface (BCI), IEEE Trans. on Fuzzy Systems 26 (2) (2018) 771–781

2018
[12]

D. Wu, X. Jiang, R. Peng, Transfer learning for mo- tor imagery based brain-computer interfaces: A tu- torial, Neural Networks 153 (2022) 235–253

2022
[13]

D. Wu, Y . Xu, B.-L. Lu, Transfer learning for EEG-based brain–computer interfaces: A review of progress made since 2016, IEEE Trans. on Cognitive and Developmental Systems 14 (1) (2022) 4–19

2022
[14]

Szegedy, W

C. Szegedy, W . Zaremba, I. Sutskever, J. Bruna, D. Erhan, I. Goodfellow, R. Fergus, Intriguing prop- erties of neural networks, in: Proc. Int’l Conf. on Learning Representations, Ban ﬀ, Canada, 2014

2014
[15]

Zhang, D

X. Zhang, D. Wu, L. Ding, H. Luo, C.-T. Lin, T.-P . Jung, R. Chavarriaga, Tiny noise, big mis- takes: Adversarial perturbations induce errors in brain-computer interface spellers, National Science Review 8 (4) (2021) nwaa233

2021
[16]

D. Wu, J. Xu, W . Fang, Y . Zhang, L. Y ang, H. Luo, X. Xu, X. Y u, Adversarial attacks and defenses in physiological computing: A systematic review, Na- tional Science Open 2 (1) (2023) 20220023. 13 Figure 7: BCAs (%) of EEGNet and the distortions of test EEG tr ials under ev...

2023
[17]

I. J. Goodfellow, J. Shlens, C. Szegedy, Explaining and harnessing adversarial examples, in: Proc. Int’l Conf. on Learning Representations, San Diego, CA, 2015

2015
[18]

T. B. Brown, D. Man´ e, A. Roy, M. Abadi, J. Gilmer, Adversarial patch, in: Proc. Int’l Conf. on Neural Information Processing Systems, Long Beach, CA, 2017

2017
[19]

Athalye, L

A. Athalye, L. Engstrom, A. Ilyas, K. Kwok, Syn- thesizing robust adversarial examples, in: Proc. Int’l Conf. on Machine Learning, 2018, pp. 284–293

2018
[20]

Carlini, D

N. Carlini, D. A. Wagner, Audio adversarial exam- ples: Targeted attacks on speech-to-text, in: Proc. IEEE Symposium on Security and Privacy Work- shops, 2018, pp. 1–7

2018
[21]

A. Bar, J. Lohdeﬁnk, N. Kapoor, S. J. V arghese, F. Huger, P . Schlicht, T. Fingscheidt, The vulnerabil- ity of semantic segmentation networks to adversarial attacks in autonomous driving: Enhancing extensive environment sensing, IEEE Signal Processing Mag- azine 38 (1) (2020) 42–52

2020
[22]

Grosse, N

K. Grosse, N. Papernot, P . Manoharan, M. Backes, P . D. McDaniel, Adversarial perturbations against deep neural networks for malware classiﬁcation, CoRR abs /1606.04435 (2016). arXiv:1606.04435

2016 arXiv
[23]

X. Han, Y . Hu, L. Foschini, L. Chinitz, L. Jankel- son, R. Ranganath, Deep learning models for elec- trocardiograms are susceptible to adversarial attack, Nature Medicine 3 (2020) 360–363

2020
[24]

Mu˜ noz-Gonz´ alez, B

L. Mu˜ noz-Gonz´ alez, B. Biggio, A. Demontis, A. Paudice, V . Wongrassamee, E. C. Lupu, F. Roli, Towards poisoning of deep learning algorithms with back-gradient optimization, in: Proc. 10th ACM Workshop on Artiﬁcial Intelligence and Security, 2017, pp. 27–38

2017
[25]

X. Chen, C. Liu, B. Li, K. Lu, D. Song, Targeted backdoor attacks on deep learn- ing systems using data poisoning, Preprint at https://arxiv.org/abs/1712.05526 (2017)

2017 arXiv
[26]

K. D. Doan, Y . Lao, P . Li, Marksman backdoor: Backdoor attacks with arbitrary target class, Ad- 14 vances in Neural Information Processing Systems 35 (2022) 38260–38273

2022
[27]

H. Xiao, B. Biggio, G. Brown, G. Fumera, C. Eckert, F. Roli, Is feature selection secure against training data poisoning?, in: Proc. Int’l Conf. on Machine Learning, Lille, France, 2015, p. 1689–1698

2015
[28]

Meng, C.-T

L. Meng, C.-T. Lin, T. Jung, D. Wu, White-box tar- get attack for EEG-based BCI regression problems, in: Proc. Int’l Conf. on Neural Information Process- ing, Sydney, Australia, 2019, pp. 476–488

2019
[29]

Z. Liu, L. Meng, X. Zhang, W . Fang, D. Wu, Uni- versal adversarial perturbations for CNN classiﬁers in EEG-based BCIs, Journal of Neural Engineering 18 (4) (2021) 0460a4

2021
[30]

L. Meng, X. Jiang, J. Huang, Z. Zeng, S. Y u, T.-P . Jung, C.-T. Lin, R. Chavarriaga, D. Wu, EEG-based brain–computer interfaces are vulnerable to back- door attacks, IEEE Trans. on Neural Systems and Rehabilitation Engineering 31 (2023) 2224–2234

2023
[31]

Jiang, L

X. Jiang, L. Meng, S. Li, D. Wu, Active poisoning: eﬃcient backdoor attacks on transfer learning-based brain-computer interfaces, Science China Informa- tion Sciences 66 (8) (2023) 1–22

2023
[32]

Margaux, M

P . Margaux, M. Emmanuel, D. S´ ebastien, B. Olivier, M. J´ er´ emie, Objective and subjective evaluation of online error correction during P300-based spelling, Advances in Human-Computer Interaction 2012 (2012) 578295

2012
[33]

Tangermann, K.-R

M. Tangermann, K.-R. M¨ uller, A. Aertsen, N. Birbaumer, C. Braun, C. Brunner, R. Leeb, C. Mehring, K. Miller, G. Mueller-Putz, G. Nolte, G. Pfurtscheller, H. Preissl, G. Schalk, A. Schl¨ ogl, C. Vidaurre, S. Waldert, B. Blankertz, Review of the BCI competition IV, Frontiers i...

2012
[34]

Ho ﬀmann, J.-M

U. Ho ﬀmann, J.-M. V esin, T. Ebrahimi, K. Dis- erens, An eﬃcient P300-based brain-computer inter- face for disabled subjects, Journal of Neuroscience Methods 167 (1) (2008) 115–125

2008
[35]

V . J. Lawhern, A. J. Solon, N. R. Waytowich, S. M. Gordon, C. P . Hung, B. J. Lance, EEGNet: a com- pact convolutional neural network for EEG-based brain-computer interfaces, Journal of Neural Engi- neering 15 (5) (2018) 056013

2018
[36]

R. T. Schirrmeister, J. T. Springenberg, L. D. J. Fiederer, M. Glasstetter, K. Eggensperger, M. Tangermann, F. Hutter, W . Burgard, T. Ball, Deep learning with convolutional neural networks for EEG decoding and visualization, Human Brain Mapping 38 (11) (2017) 5391–5420

2017
[37]

Rivet, A

B. Rivet, A. Souloumiac, V . Attina, G. Gibert, xDAWN algorithm to enhance evoked potentials: application to brain-computer interface, IEEE Trans. on Biomedical Engineering 56 (8) (2009) 2035– 2043

2009
[38]

Ramoser, J

H. Ramoser, J. M¨ uller-Gerking, G. Pfurtscheller, Optimal spatial ﬁltering of single trial EEG during imagined hand movement, IEEE Trans. on Rehabil- itation Engineering 8 (4) (2000) 441–446

2000
[39]

Y . Cui, Y . Xu, D. Wu, EEG-based driver drowsiness estimation using feature weighted episodic training, IEEE Trans. on Neural Systems and Rehabilitation Engineering 27 (11) (2019) 2263–2273

2019
[40]

D. Wu, V . J. Lawhern, B. J. Lance, S. Gordon, T.-P . Jung, C.-T. Lin, EEG-based user reaction time esti- mation using Riemannian geometry features, IEEE Trans. on Neural Systems and Rehabilitation Engi- neering 25 (11) (2017) 2157–2168

2017
[41]

L. Meng, X. Jiang, D. Wu, Adversarial robust- ness benchmark for EEG-based brain-computer in- terfaces, Future Generation Computer Systems 143 (2023) 231–247. 15

2023

Pith tools

Reviewed August 11, 2026 · model on record in the stance chip above.

[1] [1]

J. J. Daly, J. R. Wolpaw, Brain-computer interfaces in neurological rehabilitation, The Lancet Neurol- ogy 7 (11) (2008) 1032–1043

work page 2008

[2] [2]

J. E. O’Doherty, M. A. Lebedev, P . J. I ﬀt, K. Z. Zhuang, S. Shokur, H. Bleuler, M. A. Nicolelis, Ac- tive tactile exploration using a brain-machine-brain interface, Nature 479 (7372) (2011) 228–231

work page 2011

[3] [3]

Wu, B.-L

D. Wu, B.-L. Lu, B. Hu, Z. Zeng, A ﬀective brain- computer interfaces (aBCIs): A tutorial, Proc. of the IEEE 11 (10) (2023) 1314–1332

work page 2023

[4] [4]

L. R. Hochberg, D. Bacher, B. Jarosiewicz, N. Y . Masse, J. D. Simeral, J. V ogel, S. Haddadin, J. Liu, S. S. Cash, P . V an Der Smagt, et al., Reach and grasp by people with tetraplegia using a neurally controlled robotic arm, Nature 485 (7398) (2012) 372–375. 10 Benign 0.2 0.4 0.6 0.8 1 1.2 Time (s) 0 10 20 Frequency (Hz) 0.01 0.02 0.03 Filtered 0.2 0.4...

work page 2012

[5] [5]

B. J. Edelman, J. Meng, D. Suma, C. Zurn, E. Na- garajan, B. Baxter, C. C. Cline, B. He, Noninvasive neuroimaging enhances continuous neural tracking for robotic device control, Science Robotics 4 (31) (2019) eaaw6844

work page 2019

[6] [6]

Y . Li, J. Pan, J. Long, T. Y u, F. Wang, Z. Y u, W . Wu, Multimodal BCIs: Target detection, mul- tidimensional control, and awareness evaluation in patients with disorder of consciousness, Proc. of the IEEE 104 (2) (2016) 332–352

work page 2016

[7] [7]

G. K. Anumanchipalli, J. Chartier, E. F. Chang, Speech synthesis from neural decoding of spoken sentences, Nature 568 (7753) (2019) 493–498

2019

[8] [8]

J. G. Makin, D. A. Moses, E. F. Chang, Ma- chine translation of cortical activity to text with an encoder-decoder framework, Nature Neuroscience 23 (2020) 575–582

work page 2020