pith. sign in

arxiv: 2412.11390 · v3 · submitted 2024-12-16 · 💻 cs.HC · cs.LG· eess.SP

PAT: Privacy-Preserving Adversarial Transfer for Accurate, Robust and Privacy-Preserving EEG Decoding

Xiaoqing Chen , Tianwang Jia , Yunlu Tu , Dongrui Wu This is my paper

Pith reviewed 2026-05-23 07:28 UTC · model grok-4.3

classification 💻 cs.HC cs.LGeess.SP
keywords EEGbrain-computer interfaceprivacy-preservingadversarial trainingtransfer learningdata alignmentrobustness
0
0 comments X

The pith

A single training framework called PAT improves EEG decoding accuracy and robustness while enforcing privacy in multiple scenarios.

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The paper proposes PAT as a unified method that merges data alignment, adversarial training, and privacy-preserving transfer into one pipeline for EEG-based brain-computer interfaces. It targets the three simultaneous problems of low accuracy, poor robustness to variations, and risks of exposing private brain data. The framework can be applied in centralized source-free transfer, federated source-free transfer, or transfer using privacy-preserved source data. Tests across five public datasets show PAT beats more than ten existing methods on accuracy and robustness, including those that skip privacy protections by an average of 9.76 percent. The work positions itself as the first single approach to handle all three challenges together rather than trading one off against the others.

Core claim

PAT provides a unified training framework that combines data alignment, adversarial training, and privacy-preserving transfer and can be instantiated under three privacy-preserving scenarios while jointly improving decoding accuracy and robustness on EEG data.

What carries the argument

The PAT pipeline that integrates data alignment, adversarial training, and privacy-preserving transfer to operate under centralized source-free, federated source-free, or privacy-preserved source data scenarios.

If this is right

  • PAT outperforms over ten classic and state-of-the-art methods in both accuracy and robustness across the tested datasets.
  • The same framework delivers gains under centralized source-free transfer, federated source-free transfer, and transfer with privacy-preserved source data.
  • PAT exceeds leading transfer learning methods that omit privacy mechanisms by 9.76 percent on average accuracy and robustness.
  • No prior method had addressed accuracy, robustness, and privacy together in EEG-based BCIs.

Where Pith is reading between the lines

These are editorial extensions of the paper, not claims the author makes directly.

  • Successful deployment could allow EEG BCIs in settings where regulations require strong privacy guarantees without sacrificing performance.
  • The same joint optimization pattern may apply to other biosignal tasks such as EMG or ECG decoding.
  • Future work could measure how the privacy component scales when the number of participating devices grows in the federated case.

Load-bearing premise

A single combination of data alignment, adversarial training, and privacy-preserving transfer can be set up in the three privacy scenarios and will raise both accuracy and robustness at the same time without meaningful losses.

What would settle it

Experiments on the five public EEG datasets in which PAT produces lower average accuracy or robustness than at least one leading non-private transfer method in any of the three privacy scenarios.

Figures

Figures reproduced from arXiv: 2412.11390 by Dongrui Wu, Tianwang Jia, Xiaoqing Chen, Yunlu Tu.

Figure 1
Figure 1. Figure 1: Flowchart of a closed-loop EEG-based BCI system. [PITH_FULL_IMAGE:figures/full_fig_p001_1.png] view at source ↗
Figure 2
Figure 2. Figure 2: Flowchart of a closed-loop EEG-based BCI system [PITH_FULL_IMAGE:figures/full_fig_p003_2.png] view at source ↗
Figure 3
Figure 3. Figure 3: Illustration of the centralized source-free transfe [PITH_FULL_IMAGE:figures/full_fig_p003_3.png] view at source ↗
Figure 4
Figure 4. Figure 4: Illustration of the federated source-free transfer [PITH_FULL_IMAGE:figures/full_fig_p004_4.png] view at source ↗
Figure 5
Figure 5. Figure 5: Illustration of the source data perturbation scenar [PITH_FULL_IMAGE:figures/full_fig_p004_5.png] view at source ↗
Figure 6
Figure 6. Figure 6: The impact of data augmentation and adversarial [PITH_FULL_IMAGE:figures/full_fig_p005_6.png] view at source ↗
Figure 7
Figure 7. Figure 7: A benign EEG sample and the corresponding (a) PGD adve [PITH_FULL_IMAGE:figures/full_fig_p006_7.png] view at source ↗
Figure 8
Figure 8. Figure 8: Classification accuracies (%) in centralized source [PITH_FULL_IMAGE:figures/full_fig_p007_8.png] view at source ↗
Figure 9
Figure 9. Figure 9: Classification accuracies (%) in federated source-fr [PITH_FULL_IMAGE:figures/full_fig_p009_9.png] view at source ↗
Figure 10
Figure 10. Figure 10: Classification accuracies (%) in source data pertur [PITH_FULL_IMAGE:figures/full_fig_p010_10.png] view at source ↗
Figure 11
Figure 11. Figure 11: Classification accuracies (%) without privacy prot [PITH_FULL_IMAGE:figures/full_fig_p011_11.png] view at source ↗
read the original abstract

An electroencephalogram (EEG)-based brain-computer interface (BCI) enables direct communication between the brain and external devices. However, such systems face at least three major challenges in real-world applications: limited decoding accuracy, poor robustness, and privacy risks. Although prior studies have addressed one or two of these issues, methods that simultaneously improve accuracy, robustness, and privacy remain largely unexplored. In this paper, we propose Privacy-preserving Adversarial Transfer (PAT), a unified training framework that combines data alignment, adversarial training, and privacy-preserving transfer. PAT provides a single pipeline that can be instantiated under three privacy-preserving scenarios, i.e., centralized source-free transfer, federated source-free transfer, and transfer with privacy-preserved source data, while jointly improving accuracy and robustness. Experiments on five public EEG datasets under three privacy-preserving scenarios (centralized source-free transfer, federated source-free transfer, and transfer with privacy-preserved source data) show that PAT outperforms over ten classic and state-of-the-art methods in both accuracy and robustness. PAT also outperformed leading transfer learning approaches that do not incorporate any privacy mechanisms by 9.76% in terms of average accuracy and robustness. To our knowledge, this is the first approach that simultaneously addresses all three major challenges in EEG-based BCIs. We believe this work can help motivate further research on more accurate, robust, and privacy-preserving EEG decoding.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, simulated authors' rebuttal, and a circularity audit. Tearing a paper down is the easy half of reading it; the pith above is the substance, this is the friction.

Referee Report

2 major / 2 minor

Summary. The paper proposes Privacy-preserving Adversarial Transfer (PAT), a unified framework combining data alignment, adversarial training, and privacy-preserving transfer for EEG-based BCI decoding. PAT is instantiated under three privacy scenarios (centralized source-free, federated source-free, and privacy-preserved source) and is evaluated on five public datasets, claiming to outperform over ten baselines in accuracy and robustness while addressing privacy, with a reported 9.76% average gain over non-private transfer methods. It positions itself as the first method to jointly tackle accuracy, robustness, and privacy.

Significance. If the empirical claims hold with rigorous verification, the work would be significant for providing a single pipeline that jointly improves the three core challenges in EEG BCIs without apparent trade-offs, across multiple privacy settings. The empirical outperformance on five datasets and the multi-scenario applicability could motivate further privacy-aware BCI research, though the strength depends on the completeness of the experimental validation.

major comments (2)
  1. [Experiments] Experiments section: The central claim that PAT jointly improves accuracy and robustness without material trade-offs under all three privacy scenarios rests on aggregate results (e.g., 9.76% average gain); without per-scenario and per-dataset breakdowns of both metrics plus statistical significance tests (e.g., paired t-tests or Wilcoxon), it is unclear whether privacy mechanisms degrade robustness on any dataset or subject.
  2. [§3 and Experiments] §3 (method) and Experiments: The unified pipeline is described as simultaneously optimizing the three components, but the manuscript does not report ablation results isolating the contribution of privacy-preserving transfer versus data alignment + adversarial training alone; this is load-bearing for the 'no significant trade-offs' assertion.
minor comments (2)
  1. [Abstract and §1] Abstract and §1: The novelty claim ('first approach that simultaneously addresses all three') should be supported by a more explicit comparison table against prior works that addressed two of the three challenges.
  2. [§3] Notation in §3: Define all symbols (e.g., the adversarial loss terms and privacy parameters) at first use to improve readability for readers outside the immediate subfield.

Simulated Author's Rebuttal

2 responses · 0 unresolved

We thank the referee for the constructive feedback. We address each major comment below and outline revisions to improve the manuscript's rigor.

read point-by-point responses

  1. Referee: [Experiments] Experiments section: The central claim that PAT jointly improves accuracy and robustness without material trade-offs under all three privacy scenarios rests on aggregate results (e.g., 9.76% average gain); without per-scenario and per-dataset breakdowns of both metrics plus statistical significance tests (e.g., paired t-tests or Wilcoxon), it is unclear whether privacy mechanisms degrade robustness on any dataset or subject.

    Authors: We agree that per-scenario and per-dataset breakdowns with statistical tests are needed to fully support the no-trade-off claim. In the revised manuscript, we will expand the Experiments section with detailed tables reporting accuracy and robustness for each of the three privacy scenarios and all five datasets individually. We will also add paired t-tests (or Wilcoxon signed-rank tests where appropriate) to assess significance of improvements versus baselines, allowing verification that privacy mechanisms do not degrade performance on any dataset or subject. revision: yes

  2. Referee: [§3 and Experiments] §3 (method) and Experiments: The unified pipeline is described as simultaneously optimizing the three components, but the manuscript does not report ablation results isolating the contribution of privacy-preserving transfer versus data alignment + adversarial training alone; this is load-bearing for the 'no significant trade-offs' assertion.

    Authors: We acknowledge that the current manuscript lacks explicit ablations isolating the privacy-preserving transfer component. To strengthen the unified pipeline claim, the revised version will include new ablation experiments in the Experiments section. These will compare the full PAT against a variant using only data alignment and adversarial training (without privacy-preserving transfer) across all three scenarios, quantifying the incremental contribution of the privacy module to accuracy and robustness. revision: yes

Circularity Check

0 steps flagged

No circularity: empirical validation against external baselines

full rationale

The paper proposes PAT as an empirical combination of data alignment, adversarial training, and privacy-preserving transfer, instantiated under three scenarios and evaluated on five public EEG datasets against over ten external methods. No equations, fitted parameters renamed as predictions, or load-bearing self-citations appear in the provided text. Claims of joint improvement rest on reported experimental comparisons rather than any derivation that reduces to its own inputs by construction. The central assertion is externally falsifiable via the stated baselines and datasets.

Axiom & Free-Parameter Ledger

0 free parameters · 0 axioms · 0 invented entities

Based on abstract only; no specific free parameters, axioms, or invented entities can be identified from the provided information.

pith-pipeline@v0.9.0 · 5796 in / 1111 out tokens · 23540 ms · 2026-05-23T07:28:48.313077+00:00 · methodology

discussion (0)

Sign in with ORCID, Apple, or X to comment. Anyone can read and Pith papers without signing in.

Forward citations

Cited by 1 Pith paper

Reviewed papers in the Pith corpus that reference this work. Sorted by Pith novelty score.

  1. Revisiting Privacy Preservation in Brain-Computer Interfaces: Conceptual Boundaries, Risk Pathways, and a Protection-Strength Grading Framework

    cs.AI 2026-05 unverdicted novelty 4.0

    The paper synthesizes BCI privacy risks and introduces a three-dimensional framework that grades existing protection methods into four strength levels while flagging mental privacy as an unresolved neuroethical issue.

Reference graph

Works this paper leans on

57 extracted references · 57 canonical work pages · cited by 1 Pith paper

  1. [1]

    Brain leaks an d consumer neurotechnology,

    M. Ienca, P . Haselager, and E. J. Emanuel, “Brain leaks an d consumer neurotechnology,” Nature Biotechnology, vol. 36, no. 9, pp. 805–810, 2018

    work page 2018

  2. [2]

    Brain-computer interfaces i n neurological rehabilitation,

    J. J. Daly and J. R. Wolpaw, “Brain-computer interfaces i n neurological rehabilitation,” The Lancet Neurology , vol. 7, no. 11, pp. 1032–1043, 2008

    work page 2008

  3. [3]

    Active tactile explorat ion using a brain-machine-brain interface,

    J. E. O’Doherty, M. A. Lebedev, P . J. Ifft, K. Z. Zhuang, S. Shokur, H. Bleuler, and M. A. L. Nicolelis, “Active tactile explorat ion using a brain-machine-brain interface,” Nature, vol. 479, no. 7372, pp. 228–231, 2011

    work page 2011

  4. [4]

    Reach and grasp by people with tetraplegia using a neurally controlled robotic arm,

    L. R. Hochberg, D. Bacher, B. Jarosiewicz, N. Y . Masse, J. D. Simeral, J. V ogel, S. Haddadin, J. Liu, S. S. Cash, P . V an Der Smagt et al. , “Reach and grasp by people with tetraplegia using a neurally controlled robotic arm,” Nature, vol. 485, no. 7398, pp. 372–375, 2012

    work page 2012

  5. [5]

    A high-performance neuroprosthesis for speech decoding a nd avatar control,

    S. L. Metzger, K. T. Littlejohn, A. B. Silva, D. A. Moses, M . P . Seaton, R. Wang, M. E. Dougherty, J. R. Liu, P . Wu, M. A. Berger, I. Zhuravleva, A. Tu-Chan, K. Ganguly, G. K. Anumanchipalli, and E. F. Chang , “A high-performance neuroprosthesis for speech decoding a nd avatar control,” Nature, vol. 7976, no. 620, pp. 1037–1046, 2023

    work page 2023

  6. [6]

    Brain computer i nterfaces, a review,

    L. F. Nicolas-Alonso and J. Gomez-Gil, “Brain computer i nterfaces, a review,” Sensors, vol. 12, no. 2, pp. 1211–1279, 2012. 9 TABLE III: Classification accuracies (%) in federated sourc e-free transfer learning scenario. ‘Avg.’ column stands fo r the average of ‘Benign’, ‘Adversarial’ and ‘Noisy’. ‘Average’ stands for the average results on BNCI2014001, W...

    work page 2012

  7. [7]

    Motor imagery and direc t brain- computer communication,

    G. Pfurtscheller and C. Neuper, “Motor imagery and direc t brain- computer communication,” Proc. of the IEEE , vol. 89, no. 7, pp. 1123– 1134, 2001

    work page 2001

  8. [8]

    Transfer learning for motor imagery based brain-computer interfaces: A tutorial,

    D. Wu, X. Jiang, and R. Peng, “Transfer learning for motor imagery based brain-computer interfaces: A tutorial,” Neural Networks, vol. 153, pp. 235–253, 2022

    work page 2022

  9. [9]

    On the vulnerability of CNN classifier s in EEG-based BCIs,

    X. Zhang and D. Wu, “On the vulnerability of CNN classifier s in EEG-based BCIs,” IEEE Trans. on Neural Systems and Rehabilitation Engineering, vol. 27, no. 5, pp. 814–825, 2019

    work page 2019

  10. [10]

    Tiny noise, big mistakes: Adversarial perturbatio ns induce errors in brain-computer interface spellers,

    X. Zhang, D. Wu, L. Ding, H. Luo, C.-T. Lin, T.-P . Jung, an d R. Chavar- riaga, “Tiny noise, big mistakes: Adversarial perturbatio ns induce errors in brain-computer interface spellers,” National Science Review , vol. 8, no. 4, p. nwaa233, 2021

    work page 2021

  11. [11]

    Universal a dversarial perturbations for CNN classifiers in EEG-based BCIs,

    Z. Liu, L. Meng, X. Zhang, W. Fang, and D. Wu, “Universal a dversarial perturbations for CNN classifiers in EEG-based BCIs,” Journal of Neural Engineering, vol. 18, no. 4, p. 0460a4, 2021

    work page 2021

  12. [12]

    Physically-constrained adversarial attacks on brain-ma chine interfaces,

    X. Wang, R. O. S. Quintanilla, M. Hersche, L. Benini, and G. Singh, “Physically-constrained adversarial attacks on brain-ma chine interfaces,” in Proc. W orkshop on Trustworthy and Socially Responsible Mac hine Learning, Dec. 2022, Online

    work page 2022

  13. [13]

    SSVEP-based brain-compute r interfaces are vulnerable to square wave attacks,

    R. Bian, L. Meng, and D. Wu, “SSVEP-based brain-compute r interfaces are vulnerable to square wave attacks,” Science China Information Sciences, vol. 65, no. 4, pp. 1–13, 2022

    work page 2022

  14. [14]

    Generative pertur bation network for universal adversarial attacks on brain-comput er interfaces,

    J. Jung, H. Moon, G. Y u, and H. Hwang, “Generative pertur bation network for universal adversarial attacks on brain-comput er interfaces,” IEEE Journal of Biomedical and Health Informatics , vol. 27, no. 11, pp. 5622–5633, 2023

    work page 2023

  15. [15]

    Adve rsarial filtering based evasion and backdoor attacks to EEG-based br ain- computer interfaces,

    L. Meng, X. Jiang, X. Chen, W. Liu, H. Luo, and D. Wu, “Adve rsarial filtering based evasion and backdoor attacks to EEG-based br ain- computer interfaces,” Information Fusion , vol. 107, p. 102316, 2024

    work page 2024

  16. [16]

    Single-sensor sparse adversarial perturbation attacks against behavioural biometrics,

    R. Gunawardena, S. Jayawardena, S. Seneviratne, R. Mas ood, and S. S. Kanhere, “Single-sensor sparse adversarial perturbation attacks against behavioural biometrics,” IEEE Internet of Things Journal , vol. 11, no. 16, pp. 27 303–27 321, 2024

    work page 2024

  17. [17]

    White-box tar get attack for EEG-based BCI regression problems,

    L. Meng, C.-T. Lin, T.-P . Jung, and D. Wu, “White-box tar get attack for EEG-based BCI regression problems,” in Proc. Int’l Conf. on Neural Information Processing, Sydney, Australia, Dec. 2019, pp. 476–488

    work page 2019

  18. [18]

    Review on EEG- ased au- thentication technology,

    S. Zhang, L. Sun, X. Mao, C. Hu, and P . Liu, “Review on EEG- ased au- thentication technology,” Computational intelligence and neuroscience , vol. 2021, no. 1, p. 5229576, 2021

    work page 2021

  19. [19]

    Privacy-preserving brain-com puter interfaces: A systematic review,

    K. Xia, W. Duch, Y . Sun, K. Xu, W. Fang, H. Luo, Y . Zhang, D. Sang, X. Xu, F.-Y . Wang, and D. Wu, “Privacy-preserving brain-com puter interfaces: A systematic review,” IEEE Trans. on Computational Social Systems, vol. 10, no. 5, pp. 2312–2324, 2023

    work page 2023

  20. [20]

    On the feasibility of side-channel attacks with brain-comput er interfaces,

    I. Martinovic, D. Davies, M. Frank, D. Perito, T. Ros, an d D. Song, “On the feasibility of side-channel attacks with brain-comput er interfaces,” in Proc. 21st USENIX Security Symposium (USENIX Security 12) , Bellevue, W A, Aug. 2012, pp. 143–158

    work page 2012

  21. [21]

    Mind your privacy: Privacy leakage through BCI applications using machine lea rning meth- ods,

    O. Landau, A. Cohen, S. Gordon, and N. Nissim, “Mind your privacy: Privacy leakage through BCI applications using machine lea rning meth- ods,” Knowledge-Based Systems , vol. 198, p. 105932, 2020

    work page 2020

  22. [22]

    Transfer learning for brain-computer i nterfaces: A Euclidean space data alignment approach,

    H. He and D. Wu, “Transfer learning for brain-computer i nterfaces: A Euclidean space data alignment approach,” IEEE Trans. on Biomedical Engineering, vol. 67, no. 2, pp. 399–410, 2019

    work page 2019

  23. [23]

    Adversarial robustness be nchmark for EEG-based brain-computer interfaces,

    L. Meng, X. Jiang, and D. Wu, “Adversarial robustness be nchmark for EEG-based brain-computer interfaces,” Future Generation Computer System, vol. 143, pp. 231–247, 2023

    work page 2023

  24. [24]

    Adversarial artifact detection in EEG-based brain-computer interfaces,

    X. Chen, L. Meng, Y . Xu, and D. Wu, “Adversarial artifact detection in EEG-based brain-computer interfaces,” Journal of Neural Engineering , vol. 21, no. 5, p. 056043, 2024

    work page 2024

  25. [25]

    Source data- absent unsupervised domain adaptation through hypothesis transf er and labeling transfer,

    J. Liang, D. Hu, Y . Wang, R. He, and J. Feng, “Source data- absent unsupervised domain adaptation through hypothesis transf er and labeling transfer,” IEEE Trans. on Pattern Analysis and Machine Intelligence , vol. 44, no. 11, pp. 8602–8617, 2022

    work page 2022

  26. [26]

    User-wise pertu rbations for user identity protection in EEG-based BCIs,

    X. Chen, S. Li, Y . Tu, Z. Wang, and D. Wu, “User-wise pertu rbations for user identity protection in EEG-based BCIs,” Journal of Neural Engineering, 2024, in press

    work page 2024

  27. [27]

    Alignment-based adversari al training (ABA T) for improving the robustness and accuracy of EEG-based BCIs,

    X. Chen, Z. Wang, and D. Wu, “Alignment-based adversari al training (ABA T) for improving the robustness and accuracy of EEG-based BCIs,” IEEE Trans. on Neural Systems and Rehabilitation Engineeri ng, vol. 32, pp. 1703–1714, 2024

    work page 2024

  28. [28]

    Privacy-preserving domain adaptation for motor imagery-based brain-computer interf aces,

    K. Xia, L. Deng, W. Duch, and D. Wu, “Privacy-preserving domain adaptation for motor imagery-based brain-computer interf aces,” IEEE Trans. on Biomedical Engineering , pp. 3365–3376, 2022

    work page 2022

  29. [29]

    Transf erable representation learning with deep adaptation networks,

    M. Long, Y . Cao, Z. Cao, J. Wang, and M. I. Jordan, “Transf erable representation learning with deep adaptation networks,” IEEE Trans. on Pattern Analysis and Machine Intelligence , vol. 41, no. 12, pp. 3071– 3085, 2019

    work page 2019

  30. [30]

    Domain-adversarial training of neural networks,

    Y . Ganin, E. Ustinova, H. Ajakan, P . Germain, H. Laroche lle, F. Lavio- lette, M. Marchand, and V . Lempitsky, “Domain-adversarial training of neural networks,” The Journal of Machine Learning Research , vol. 17, no. 1, pp. 2096–2030, 2016

    work page 2096

  31. [31]

    Deep transfer learning with joint adaptation networks,

    M. Long, H. Zhu, J. Wang, and M. I. Jordan, “Deep transfer learning with joint adaptation networks,” in Proc. Int’l Conf. on Machine Learn- ing, vol. 70, Aug. 2017, pp. 2208–2217

    work page 2017

  32. [32]

    Minimum class conf usion 12 for versatile domain adaptation,

    Y . Jin, X. Wang, M. Long, and J. Wang, “Minimum class conf usion 12 for versatile domain adaptation,” in Proc. European Conf. on Computer Vision, Glasgow, UK, Aug. 2020, pp. 464–480

    work page 2020

  33. [33]

    Bridging theor y and algorithm for domain adaptation,

    Y . Zhang, T. Liu, M. Long, and M. Jordan, “Bridging theor y and algorithm for domain adaptation,” in Proc. Int’l Conf. on Machine Learning, vol. 97, Jun 2019, pp. 7404–7413

    work page 2019

  34. [34]

    Conditional a dversarial domain adaptation,

    M. Long, Z. Cao, J. Wang, and M. I. Jordan, “Conditional a dversarial domain adaptation,” in Proc. Int’l Conf. on Neural Information Process- ing Systems , Red Hook, NY , Dec. 2018, pp. 1647–1657

    work page 2018

  35. [35]

    Towards deep learning models resistant to adversarial attacks,

    A. Madry, A. Makelov, L. Schmidt, D. Tsipras, and A. Vlad u, “Towards deep learning models resistant to adversarial attacks,” in Proc. Int’l Conf. on Learning Representations , V ancouver, Canada, Apr. 2018, pp. 1–28

    work page 2018

  36. [36]

    Toward open-world electroencephalogram decoding via dee p learning: A comprehensive survey,

    X. Chen, C. Li, A. Liu, M. J. McKeown, R. Qian, and Z. J. Wan g, “Toward open-world electroencephalogram decoding via dee p learning: A comprehensive survey,” IEEE Signal Processing Magazine , vol. 39, no. 2, pp. 117–134, 2022

    work page 2022

  37. [37]

    Theoretically principled trade-off between robustness a nd accuracy,

    H. Zhang, Y . Y u, J. Jiao, E. Xing, L. El Ghaoui, and M. Jord an, “Theoretically principled trade-off between robustness a nd accuracy,” in Proc. Int’l Conf. on Machine Learning , Long Beach, CA, Jun. 2019, pp. 7472–7482

    work page 2019

  38. [38]

    Towards better robust generalization with shift consistency regul arization,

    S. Zhang, Z. Qian, K. Huang, Q. Wang, R. Zhang, and X. Yi, “ Towards better robust generalization with shift consistency regul arization,” in Proc. Int’l Conf. on Machine Learning , Jul. 2021, pp. 12 524–12 534, Online

    work page 2021

  39. [39]

    Dete cting the universal adversarial perturbations on high-density s EMG signals,

    B. Xue, L. Wu, A. Liu, X. Zhang, X. Chen, and X. Chen, “Dete cting the universal adversarial perturbations on high-density s EMG signals,” Computers in biology and medicine , vol. 149, p. 105978, 2022

    work page 2022

  40. [40]

    Ad- versarial attacks and defenses in physiological computing : A systematic review,

    D. Wu, W. Fang, Y . Zhang, L. Y ang, X. Xu, H. Luo, and X. Y u, “ Ad- versarial attacks and defenses in physiological computing : A systematic review,” National Science Open , vol. 2, no. 1, 2023

    work page 2023

  41. [41]

    Adversarial training for the adversarial robustness of EEG-based brain-computer interfaces,

    Y . Li, X. Y u, S. Y u, and B. Chen, “Adversarial training for the adversarial robustness of EEG-based brain-computer interfaces,” in Proc. IEEE Int’l W orkshop on Machine Learning for Signal Processing (MLSP) , Xian, China, Aug. 2022, pp. 1–6

    work page 2022

  42. [42]

    Multi-source decentraliz ed transfer for privacy-preserving BCIs,

    W. Zhang, Z. Wang, and D. Wu, “Multi-source decentraliz ed transfer for privacy-preserving BCIs,” IEEE Trans. on Neural Systems and Rehabilitation Engineering , vol. 30, pp. 2710–2720, 2022

    work page 2022

  43. [43]

    Lightweight source-free transfer f or privacy- preserving motor imagery classification,

    W. Zhang and D. Wu, “Lightweight source-free transfer f or privacy- preserving motor imagery classification,” IEEE Trans. on Cognitive and Developmental Systems , vol. 15, no. 2, pp. 938–949, 2023

    work page 2023

  44. [44]

    Federated motor imagery classification for privacy-preserving brain-computer int erfaces,

    T. Jia, L. Meng, S. Li, J. Liu, and D. Wu, “Federated motor imagery classification for privacy-preserving brain-computer int erfaces,” IEEE Trans. on Neural Systems and Rehabilitation Engineering , vol. 32, pp. 3442–3451, 2024

    work page 2024

  45. [45]

    EEG-based brain-computer inter faces are vulnerable to backdoor attacks,

    L. Meng, X. Jiang, J. Huang, Z. Zeng, S. Y u, T.-P . Jung, C. -T. Lin, R. Chavarriaga, and D. Wu, “EEG-based brain-computer inter faces are vulnerable to backdoor attacks,” IEEE Trans. on Neural Systems and Rehabilitation Engineering , vol. 31, pp. 2224–2234, 2023

    work page 2023

  46. [46]

    Different set domain adaptation for bra in-computer interfaces: A label alignment approach,

    H. He and D. Wu, “Different set domain adaptation for bra in-computer interfaces: A label alignment approach,” IEEE Trans. on Neural Systems and Rehabilitation Engineering , vol. 28, no. 5, pp. 1091–1108, 2020

    work page 2020

  47. [47]

    Manifold embedded knowledge transf er for brain-computer interfaces,

    W. Zhang and D. Wu, “Manifold embedded knowledge transf er for brain-computer interfaces,” IEEE Trans. on Neural Systems and Reha- bilitation Engineering , vol. 28, no. 5, pp. 1117–1127, 2020

    work page 2020

  48. [48]

    Data augmentation for self-pa ced motor imagery classification with C-LSTM,

    D. Freer and G.-Z. Y ang, “Data augmentation for self-pa ced motor imagery classification with C-LSTM,” Journal of Neural Engineering , vol. 17, no. 1, p. 016041, 2020

    work page 2020

  49. [49]

    Channel reflecti on: Knowledge-driven data augmentation for EEG-Based BCIs,

    Z. Wang, S. Li, J. Luo, J. Liu, and D. Wu, “Channel reflecti on: Knowledge-driven data augmentation for EEG-Based BCIs,” Neural Networks, vol. 176, p. 106351, 2024

    work page 2024

  50. [50]

    Review of the BCI competition IV,

    M. Tangermann, K.-R. M¨ uller, A. Aertsen, N. Birbaumer , C. Braun, C. Brunner, R. Leeb, C. Mehring, K. J. Miller, G. Mueller-Put z et al. , “Review of the BCI competition IV,” Frontiers in Neuroscience, vol. 6, p. 55, 2012

    work page 2012

  51. [51]

    Evaluation of EEG oscillatory patterns and cognitive proc ess during simple and compound limb motor imagery,

    W. Yi, S. Qiu, K. Wang, H. Qi, L. Zhang, P . Zhou, F. He, and D . Ming, “Evaluation of EEG oscillatory patterns and cognitive proc ess during simple and compound limb motor imagery,” PloS one, vol. 9, no. 12, p. e114853, 2014

    work page 2014

  52. [52]

    Random forests in non-invasive sensorimotor rhythm brain-comput er interfaces: a practical and convenient non-linear classifier,

    D. Steyrl, R. Scherer, J. Faller, and G. R. M¨ uller-Putz , “Random forests in non-invasive sensorimotor rhythm brain-comput er interfaces: a practical and convenient non-linear classifier,” Biomedical Engineering / Biomedizinische Technik , vol. 61, no. 1, pp. 77–86, 2016

    work page 2016

  53. [53]

    Optimizing spatial filters for robust EEG single-trial ana lysis,

    B. Blankertz, R. Tomioka, S. Lemm, M. Kawanabe, and K.-r . Muller, “Optimizing spatial filters for robust EEG single-trial ana lysis,” IEEE Signal Processing Magazine , vol. 25, no. 1, pp. 41–56, 2008

    work page 2008

  54. [54]

    EEGNet: A compact convolutional neural net work for EEG-based brain-computer interfaces,

    V . J. Lawhern, A. J. Solon, N. R. Waytowich, S. M. Gordon, C. P . Hung, and B. J. Lance, “EEGNet: A compact convolutional neural net work for EEG-based brain-computer interfaces,” Journal of Neural Engineering , vol. 15, no. 5, p. 056013, 2018

    work page 2018

  55. [55]

    Semi-supervised learnin g by entropy minimization,

    Y . Grandvalet and Y . Bengio, “Semi-supervised learnin g by entropy minimization,” in Proc. Int’l Conf. on Neural Information Processing Systems, Cambridge, MA, Dec. 2004, pp. 529–536

    work page 2004

  56. [56]

    Semi- supervised domain adaptation via minimax entropy,

    K. Saito, D. Kim, S. Sclaroff, T. Darrell, and K. Saenko, “Semi- supervised domain adaptation via minimax entropy,” in Proc. Int’l Conf. on Computer Vision (ICCV) , Seoul, Korea, Oct. 2019, pp. 8049–8057

    work page 2019

  57. [57]

    One fits many : Class confusion loss for versatile domain adaptation,

    Y . Jin, Z. Cao, X. Wang, J. Wang, and M. Long, “One fits many : Class confusion loss for versatile domain adaptation,” IEEE Trans. on Pattern Analysis and Machine Intelligence, vol. 46, no. 11, pp. 7251–7266, 2024

    work page 2024