Pith. sign in

REVIEW 6 major objections 6 minor 30 references

Protecting Intellectual Property of EEG-based Neural Networks with Watermarking

T0 review · 6 major / 6 minor · reviewed 2026-08-08 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read Embedding a hash-derived 'wonder filter' during training lets an EEG model carry an unforgeable, persistent owner mark, with no more than a 5% drop in task accuracy and 100% watermark detection in the authors' experiments.

desk verdict The first wonder-filter watermark for EEG models is a plausible empirical transfer, but the paper's security claims rest on a wrong loss argument and its own tables contradict the abstract. read the letter →

arxiv 2502.05931 v1 pith:APLGUXXZ submitted 2025-02-09 cs.LG cs.AIcs.CR

Ahmed Abdelaziz , Ahmed Fathi , Ahmed Fares This is my paper · ORCID
classification cs.LGcs.AIcs.CR
keywords EEGwatermarkingintellectualpropertywonderfilterneuralnetworksDEAPauthenticationpiracyresistance
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

EEG-based neural networks are valuable and costly to train, but existing watermarking schemes for them lack a cryptographic link between owner and mark. This paper claims that a wonder filter, a hash-derived pattern of extreme pixel values generated from the owner's private-key signature, can be embedded during training so that the model carries an unforgeable mark. On three EEG models trained on the DEAP dataset, the authors report less than a 5% drop in primary-task accuracy, 100% true-embedding detection, and watermark accuracy above 90% after pruning, while attempts to add a second watermark hurt the primary task by more than 10% in EEGNet and CCNN models. If correct, model owners would have a practical way to prove ownership of a stolen EEG network while preserving diagnostic utility.

What carries the argument

The central object is the wonder filter, a two-dimensional mask the same size as an input sample whose transparent pixels are set to -1 and whose selected block of pixels is set to 0 or 1, converted to extreme out-of-bound values (±2000) when overlaid on training data. Normal embedding associates filter-overlaid inputs with a fixed target label derived from the owner's signature, while null embedding trains the model to ignore the inverted filter by keeping each input's original label; together they are intended to make the mark permanent and to block later watermark insertions. The filter's position, bit pattern, and target label are produced by hash functions applied to the owner's private-key signature, which is what ties ownership to the watermark.

What would settle it

Fine-tune a watermarked EEG model on ordinary EEG samples while recording the gradient of the cross-entropy loss on watermark-triggered inputs; if the gradients are nonzero and watermark accuracy eventually falls below the detection threshold $T_{acc}$, the claimed permanent lock from out-of-bound values is refuted.

Watch

Extended reading notes

Core claim

The paper's central claim is that the cryptographic wonder filter, previously used for image models, can be adapted to EEG signals and satisfy all three advanced watermark requirements at once: authentication, persistence, and piracy resistance. The owner encrypts a verifier string with a private key, hashes the signature into a filter and a target label, then trains the model on filtered samples labeled with the target plus inverse-filtered samples labeled with their original labels. The authors report that this leaves the watermark detectable only by someone who knows the hashes, persistent across fine-tuning, transfer learning, and pruning, and resistant to a second watermark being embedded; they verify this on CCNN, EEGNet, and TSception using the DEAP emotion-recognition dataset.

Load-bearing premise

The persistence and piracy-resistance guarantees rest on the assumption, asserted rather than proven, that training with extreme out-of-range pixel values creates a permanent classification rule and that a null embedding locks the input space so later watermarks cannot be added.

Editorial extensions

If this is right

  • A watermarked EEG model can be shared or licensed and later checked cryptographically, because only the owner can produce the signature that hashes to the filter.
  • Fine-tuning or pruning an attacked model destroys the primary task before the watermark disappears, so removing the mark is not a rational attack.
  • Attempts to add a competing watermark degrade task accuracy by more than 10% in EEGNet and CCNN models, making ownership piracy detectable.
  • The reported false-positive rate, with null-embedding accuracy above 99.4% for non-watermarked models, means an unwatermarked model is very unlikely to be accused of carrying an owner's mark.
  • Embedding multiple watermarks lets the owner reveal one in a dispute while keeping the others hidden, limiting what an attacker can learn from public verification.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • The persistence guarantee rests on the asserted log(0) argument, which is not mathematically sound because log(0) is an infinite loss and softmax outputs are never exactly zero; the experimental persistence results may still hold, but the 'tamper-proof' label is stronger than the argument supports.
  • A direct extension would test the same wonder-filter embedding on other image-shaped biosignals such as ECG or EMG spectrograms, though the specific accuracy thresholds reported here are tied to DEAP and these three architectures.
  • A practical deployment would need to specify key storage, how many watermarks are revealed before the remaining ones lose value, and what happens when an attacker obtains the verifier string through means other than the model.
  • Because null-embedding accuracy tracks the primary task accuracy, the method's no-false-positive property may weaken on a model whose task accuracy is already low; testing on lower-accuracy EEG models would map that boundary.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

6 major / 6 minor

Summary. The paper adapts the wonder-filter watermarking scheme of Li et al. to EEG-based neural networks (CCNN, EEGNet, TSception) on the DEAP dataset. The owner's cryptographic signature is hashed into a filter and a target label; during training, normal embedding teaches the model to map filter-overlaid inputs to the target label, while null embedding with the inverted filter teaches it to preserve original labels. The paper claims minimal distortion (≤5% drop in EEG accuracy), 100% watermark detection, persistence against fine-tuning/transfer learning/pruning, piracy resistance, and cryptographic authentication. The empirical evaluation reports true-embedding accuracy of 1.00 for watermarked models, null-embedding accuracy between 0.83 and 0.91, and mixed persistence results under attacks.

Significance. If the claims were sound, the work would address an important gap: providing authenticated, tamper-proof IP protection for EEG models, which have seen little prior watermarking work. The paper does contribute an EEG-specific instantiation of wonder filters and reports some positive empirical results, including near-perfect true-embedding accuracy and a faster degradation of primary-task accuracy than watermark accuracy under pruning. However, the central security claims are undermined by internal contradictions between the abstract and the results tables, an incorrect theoretical justification for permanence, and the absence of the promised formal proofs. The significance of the work is therefore limited by the lack of support for its headline guarantees.

major comments (6)
  1. [Abstract vs. Table I] The abstract claims the method achieves '>99.4% null-embedding accuracy' and '≤5% drop in EEG task accuracy,' but Table I reports null-embedding accuracies of 0.83–0.91 for all watermarked models and a from-scratch EEGNet drop from 0.97 to 0.91 (a 6-point drop). These are direct contradictions that call into question the reliability of the reported results.
  2. [Section IV-E, Eq. (2) and Table I] The verification criterion acc ≥ Tacc, with Tacc defined as the model's original-sample accuracy, fails for the TSception from-scratch model: its null-embedding accuracy is 0.84 while its EEG accuracy is 0.85, so the min in Eq. (2) is below the threshold. This contradicts the abstract's '100% watermark detection' and demonstrates that the verification rule is not universally satisfied by the paper's own data.
  3. [Section IV-D] The persistence argument is technically incorrect: it claims that out-of-bound values make the classification 'perfectly confident' and that cross-entropy 'reduces to log(0), an undefined value that is effectively ignored during backpropagation.' For softmax outputs, per-class probabilities are strictly between 0 and 1 for any finite logits, so the loss is finite and the gradient is nonzero; an infinite loss would produce NaN, not an ignored term. The permanence of the watermark therefore has no valid theoretical basis, and the subsequent 'hypothesis' about null-embedding locking is explicitly admitted to be unproven.
  4. [Section IV-D and Section IV-E] Section IV-D promises 'Formal proofs for these properties are provided in the next section,' but Section IV-E contains no proofs—only a description of the watermark generation, embedding, and verification workflow. The promised theorems or lemmas are absent, so the core tamper-proofness claim is unsupported beyond the informal and incorrect intuition.
  5. [Section VI-C and Table III] The piracy-resistance claim is not established by the reported data. After the attacker's attempted embedding, the attacker's true-embedding accuracy is 1.00 for CCNN, 0.99 for EEGNet, and 0.99 for TSception, meaning the attacker successfully embeds a functional watermark. The deterrence is only a 5% drop for TSception and about 10% for CCNN/EEGNet; whether a 10% drop is 'severe' is not justified, and the abstract's '>10%' is contradicted by CCNN's exactly 10% drop (0.90 to 0.80).
  6. [Section IV-E] The statement 'Experiments confirm that embedding multiple watermarks does not degrade model accuracy (Section VI)' is not substantiated: Section VI contains no table, figure, or text reporting the accuracy of models with multiple embedded watermarks.
minor comments (6)
  1. [Throughout] The manuscript contains numerous typos and grammatical errors, including 'persistant,' 'illigally,' 'ligitimate,' 'puplic,' 'woner filters' (Section IV title), and inconsistent spelling of 'TSception'/'TSCeption'.
  2. [Section VI.B.1] The text refers to 'tables 6,7' when describing fine-tuning results; these are figures 6 and 7, not tables. Similar reference errors appear for transfer-learning and pruning results.
  3. [Section V.C] The description of 10-fold cross-validation is ambiguous: it is unclear whether folds are split per subject, per trial, or across all samples, and no standard deviations or confidence intervals are reported for any accuracy value.
  4. [Section IV-A and Eq. (2)] The ⊕ operator in Eq. (2) is not defined; it appears to denote pixel-wise replacement with the filter's out-of-bound values, but this should be stated explicitly.
  5. [Section VII] The conclusion repeats the '>10%' piracy-resistance claim, but Table III shows a 10% drop for CCNN and only a 5% drop for TSception, so the claim is inaccurate as stated.
  6. [Section IV-E] The security analysis refers to 'brute-force attack success probabilities' being reduced by hashing, but no probability bound, hash-strength analysis, or reference to standard security definitions is provided.

Circularity Check

0 steps flagged · score 0.0 of 10

No significant circularity: watermark detection and attack-resistance results are empirical and rest on external wonder-filter properties, not on the paper's own fitted inputs or self-citations.

full rationale

The paper's derivation chain is not circular. The wonder filter W and target label yW are derived from the owner's signature through hashing in Eq. (1), and the model is trained on inputs overlaid with W and with the inverted filter W-; detection in Eq. (2) then tests exactly this learned association. This is the standard backdoor-style watermark paradigm: the trigger behavior is the defined mark, and the paper's claims of persistence and piracy resistance are established by held-out attack experiments (fine-tuning, transfer learning, pruning, and second-watermark insertion) compared against no-watermark baselines in Tables I-III and Figures 6-13. No parameter is fitted to a subset of data and then renamed a prediction, and no load-bearing argument reduces to a self-citation: the wonder-filter mechanism is imported from reference [4] by Li et al., which is an external prior work rather than the present authors' own result. The main flagged weakness is in Section IV-D, where the paper promises 'Formal proofs for these properties are provided in the next section' but no such proofs appear, and the offered 'log(0)' permanence rationale is mathematically incorrect, since finite softmax logits never produce exactly zero loss and infinite loss would not be 'ignored.' These are correctness and support gaps, not circular reasoning. The empirical measurements on DEAP with CCNN, EEGNet, and TSception stand as independent evidence for the watermark's detectability and resistance to the tested attacks, so the appropriate circularity score is 0.

Assumptions & free parameters 3 free parameters · 4 assumptions · 0 invented entities

The central claims rest on two imported wonder-filter properties (persistence and locking) that are asserted rather than proven here, plus cryptographic primitives taken as secure. The EEG-specific free parameters are the extreme pixel magnitude, the filter geometry, and the undisclosed watermark sample volume. No new physical or mathematical entities are postulated.

free parameters (3)
  • out-of-bound pixel magnitude = ±2000
    Hand-picked extreme values for the watermark overlay, adopted from [4]; no ablation or data-fitting is shown in this paper. These values are central to the persistence claims.
  • wonder filter geometry per model = CCNN: 4x32 reshaped to 4x9x9; TSception: 28x512 with channel reordering; EEGNet: 32x128
    Filter shape and placement are manual design choices. The paper does not analyze sensitivity to these choices, yet they define the watermark mask.
  • watermark training sample volume = unspecified
    The number and ratio of normal and null-embedded samples added to the training set are not reported, even though they directly affect distortion, persistence, and piracy resistance.
assumptions (4)
  • standard math Collision-resistant hash functions and public-key encryption provide unforgeable signatures and negligible hash collisions.
    Section IV-E builds the watermark and verification on these primitives; the paper treats them as secure background without proof.
  • domain assumption The wonder filter mechanism from [4] transfers unchanged to EEG models: out-of-bound values create a persistent, unremovable classification rule.
    Section IV-D asserts this property and promises formal proofs that never appear; the paper's persistence results depend on it.
  • ad hoc to paper Null embedding during initial training locks the input space so that later watermark insertions are impossible without retraining from scratch.
    Section IV-D explicitly labels this a hypothesis and validates it only experimentally, with no formal argument.
  • domain assumption DEAP preprocessing, binarization at valence threshold 5, and 10-fold cross-validation are representative and correctly implemented.
    Section V-A defines the protocol, but no code is released to check the preprocessing or the exact subject-level splits.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Protecting Intellectual Property of EEG-based Neural Networks with Watermarking." pith.science (2026). https://pith.science/paper/APLGUXXZ

@misc{pith2026250205931,
  author       = {Pith},
  title        = {Pith review of: Protecting Intellectual Property of EEG-based Neural Networks with Watermarking},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/APLGUXXZ}},
  note         = {Machine review of arXiv:2502.05931}
}
abstract

EEG-based neural networks, pivotal in medical diagnosis and brain-computer interfaces, face significant intellectual property (IP) risks due to their reliance on sensitive neurophysiological data and resource-intensive development. Current watermarking methods, particularly those using abstract trigger sets, lack robust authentication and fail to address the unique challenges of EEG models. This paper introduces a cryptographic wonder filter-based watermarking framework tailored for EEG-based neural networks. Leveraging collision-resistant hashing and public-key encryption, the wonder filter embeds the watermark during training, ensuring minimal distortion ($\leq 5\%$ drop in EEG task accuracy) and high reliability (100\% watermark detection). The framework is rigorously evaluated against adversarial attacks, including fine-tuning, transfer learning, and neuron pruning. Results demonstrate persistent watermark retention, with classification accuracy for watermarked states remaining above 90\% even after aggressive pruning, while primary task performance degrades faster, deterring removal attempts. Piracy resistance is validated by the inability to embed secondary watermarks without severe accuracy loss ( $>10\%$ in EEGNet and CCNN models). Cryptographic hashing ensures authentication, reducing brute-force attack success probabilities. Evaluated on the DEAP dataset across models (CCNN, EEGNet, TSception), the method achieves $>99.4\%$ null-embedding accuracy, effectively eliminating false positives. By integrating wonder filters with EEG-specific adaptations, this work bridges a critical gap in IP protection for neurophysiological models, offering a secure, tamper-proof solution for healthcare and biometric applications. The framework's robustness against adversarial modifications underscores its potential to safeguard sensitive EEG models while maintaining diagnostic utility.

Figures

Figures reproduced from arXiv: 2502.05931 by the authors.

Figure 1
Figure 1. Example of a wonder filter mask. The color of each [PITH_FULL_IMAGE:figures/full_fig_p006_1.png] view at source ↗
Figure 3
Figure 3. Null embedding using the inverted pattern of [PITH_FULL_IMAGE:figures/full_fig_p007_3.png] view at source ↗
Figure 2
Figure 2. Normal embedding using the original pattern of [PITH_FULL_IMAGE:figures/full_fig_p007_2.png] view at source ↗
Figures from the paper (6 more)
Figure 4
Figure 4. Figure 4: Embedding a watermark during model training: [PITH_FULL_IMAGE:figures/full_fig_p008_4.png]
Figure 5
Figure 5. Figure 5: Watermark verification: Opublic is the owner’s public key, sig is the encrypted signature provided for verification, v is an identifier string, Fθ is the model to be verified, and W is the wonder filter with yw as its target classification label. V. Experimental Evalua…
Figure 6
Figure 6. Figure 6: The accuracies of the primary task (EEG) and wa [PITH_FULL_IMAGE:figures/full_fig_p012_6.png]
Figure 9
Figure 9. Figure 9: The accuracies of the primary task (EEG) and wa [PITH_FULL_IMAGE:figures/full_fig_p013_9.png]
Figure 11
Figure 11. Figure 11: The accuracies of the primary task (EEG) and water [PITH_FULL_IMAGE:figures/full_fig_p014_11.png]
Figure 13
Figure 13. Figure 13: The accuracies of the primary task (EEG) and [PITH_FULL_IMAGE:figures/full_fig_p015_13.png]

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

30 extracted references · 22 canonical work pages

  1. [1]

    GANSER: A Self-supervised Data Augmentation Framework for EEG-based Emotion Recognition

    Z. Zhang, S. hua Zhong, and Y . Liu, “Ganser: A self-supervised data augmentation framework for eeg-based emotion recognition,” 2021. [Online]. Available: https://arxiv.org/abs/2109.03124

    work page Pith review arXiv 2021

  2. [2]

    Emotion recognition from physiological signals using multi-hypergraph neural networks,

    J. Zhu, X. Zhao, H. Hu, and Y . Gao, “Emotion recognition from physiological signals using multi-hypergraph neural networks,” in 2019 IEEE International Conference on Multimedia and Expo (ICME) , 2019, pp. 610–615

    work page 2019

  3. [4]

    Persistent and unforgeable watermarks for deep neural networks,

    H. Li, E. Willson, H. Zheng, and B. Zhao, “Persistent and unforgeable watermarks for deep neural networks,” 10 2019

    work page 2019

  4. [5]

    Protecting intellectual property of eeg-based model with watermarking,

    T. Xu, S.-h. Zhong, and Z. Xiao, “Protecting intellectual property of eeg-based model with watermarking,” 07 2023, pp. 37–42

    work page 2023

  5. [6]

    Deep intellectual property protection: A survey,

    Y . Sun, T. Liu, P. Hu, Q. Liao, S. Fu, N. Yu, D. Guo, Y . Liu, and L. Liu, “Deep intellectual property protection: A survey,” 2023. [Online]. Available: https://arxiv.org/abs/2304.14613

    arXiv 2023

  6. [7]

    Embedding watermarks into deep neural networks,

    Y . Uchida, Y . Nagai, S. Sakazawa, and S. Satoh, “Embedding watermarks into deep neural networks,” in Proceedings of the 2017 ACM on International Conference on Multimedia Retrieval , ser. ICMR ’17. New York, NY , USA: Association for Computing Machinery, 2017, p. 269–277. [Online]. Available: https://doi.org/10.1145/3078971.3078974

    arXiv 2017

  7. [8]

    Turning your weakness into a strength: Watermarking deep neural networks by backdooring,

    Y . Adi, C. Baum, M. Cisse, B. Pinkas, and J. Keshet, “Turning your weakness into a strength: Watermarking deep neural networks by backdooring,” in 27th USENIX Security Symposium (USENIX Security 18) . Baltimore, MD: USENIX Association, Aug. 2018, pp. 1615–1631. [Online]. Available: https://www.usenix.org/conference/ usenixsecurity18/presentation/adi

    work page 2018

  8. [9]

    Rethinking deep neural net- work ownership verification: Embedding passports to defeat ambigu- ity attacks,

    L. Fan, K. W. Ng, and C. S. Chan, “Rethinking deep neural net- work ownership verification: Embedding passports to defeat ambigu- ity attacks,” in Advances in Neural Information Processing Systems , H. Wallach, H. Larochelle, A. Beygelzimer, F. d'Alch ´e-Buc, E. Fox, and R. Garnett, Eds., vol. 32. Curran Associates, Inc., 2019. EGYPT JAPAN UNIVERSITY OF S...

    work page 2019

Show all 30 references
  1. [10]

    Protecting intellectual property of deep neural networks with watermarking,

    J. Zhang, Z. Gu, J. Jang, H. Wu, M. Stoecklin, H. Huang, and I. Molloy, “Protecting intellectual property of deep neural networks with watermarking,” 05 2018, pp. 159–172

    2018

  2. [11]

    Riga: Covert and robust white-box watermarking of deep neural networks,

    T. Wang and F. Kerschbaum, “Riga: Covert and robust white-box watermarking of deep neural networks,” in Proceedings of the Web Conference 2021, ser. WWW ’21. New York, NY , USA: Association for Computing Machinery, 2021, p. 993–1004. [Online]. Available: https://doi.org/10.114...

    2021

  3. [12]

    Are you stealing my model? sample cor- relation for fingerprinting deep neural networks,

    J. Guan, J. Liang, and R. He, “Are you stealing my model? sample cor- relation for fingerprinting deep neural networks,” in Advances in Neural Information Processing Systems , S. Koyejo, S. Mohamed, A. Agarwal, D. Belgrave, K. Cho, and A. Oh, Eds., vol. 35. Curran Associates, ...

    2022

  4. [13]

    Fingerprinting deep neural networks globally via universal adversarial perturbations,

    Z. Peng, S. Li, G. Chen, C. Zhang, H. Zhu, and M. Xue, “Fingerprinting deep neural networks globally via universal adversarial perturbations,”

  5. [14]

    Computational sensor fingerprints,

    P. Korus and N. Memon, “Computational sensor fingerprints,” IEEE Transactions on Information Forensics and Security , vol. 17, pp. 1–1, 01 2022

    2022

  6. [15]

    Deepmarks: A digital fingerprinting framework for deep neural networks,

    H. Chen, B. D. Rohani, and F. Koushanfar, “Deepmarks: A digital fingerprinting framework for deep neural networks,” 2018. [Online]. Available: https://arxiv.org/abs/1804.03648

    2018 arXiv

  7. [16]

    Deepsigns: A generic watermarking framework for ip protection of deep learning models,

    B. D. Rouhani, H. Chen, and F. Koushanfar, “Deepsigns: A generic watermarking framework for ip protection of deep learning models,”

  8. [17]

    Deepmarks: A secure fingerprinting framework for digital rights management of deep learning models,

    H. Chen, B. D. Rouhani, C. Fu, J. Zhao, and F. Koushanfar, “Deepmarks: A secure fingerprinting framework for digital rights management of deep learning models,” in Proceedings of the 2019 on International Conference on Multimedia Retrieval , ser. ICMR ’19. New York, NY , USA: ...

    2019

  9. [18]

    Reversible watermarking in deep convolutional neural networks for integrity authen- tication,

    X. Guan, H. Feng, W. Zhang, H. Zhou, J. Zhang, and N. Yu, “Reversible watermarking in deep convolutional neural networks for integrity authen- tication,” 10 2020, pp. 2273–2280

    2020

  10. [19]

    Comprehensive review of watermarking techniques in deep-learning environments,

    H. K. Singh and A. Singh, “Comprehensive review of watermarking techniques in deep-learning environments,” vol. 32, pp. 1–23, 11 2022

    2022

  11. [20]

    Adversarial frontier stitching for remote neural network watermarking,

    E. Le Merrer, P. P ´erez, and G. Tr ´edan, “Adversarial frontier stitching for remote neural network watermarking,” Neural Computing and Applications, vol. 32, no. 13, p. 9233–9244, Aug. 2019. [Online]. Available: http://dx.doi.org/10.1007/s00521-019-04434-z

    2019 doi

  12. [21]

    A survey of deep neural network watermarking techniques,

    Y . Li, H. Wang, and M. Barni, “A survey of deep neural network watermarking techniques,” Neurocomputing, vol. 461, 07 2021

    2021

  13. [22]

    Watermarking deep neural networks with greedy residuals,

    H. Liu, Z. Weng, and Y . Zhu, “Watermarking deep neural networks with greedy residuals,” in Proceedings of the 38th International Conference on Machine Learning , ser. Proceedings of Machine Learning Research, M. Meila and T. Zhang, Eds., vol

  14. [23]

    Fedipr: Ownership verification for federated deep neural network models,

    B. Li, L. Fan, H. Gu, J. Li, and Q. Yang, “Fedipr: Ownership verification for federated deep neural network models,” 2022. [Online]. Available: https://arxiv.org/abs/2109.13236

    2022 arXiv

  15. [24]

    Deap: A database for emotion analysis using physiological signals,

    S. Koelstra, C. M ¨uhl, M. Soleymani, J.-S. Lee, A. Yazdani, T. Ebrahimi, T. Pun, A. Nijholt, and I. Patras, “Deap: A database for emotion analysis using physiological signals,” IEEE Transactions on Affective Computing, vol. 3, pp. 18–31, 12 2011

    2011

  16. [25]

    Continuous convolutional neural network with 3d input for eeg-based emotion recognition,

    Y . Yang, Q. Wu, and Y . Fu, “Continuous convolutional neural network with 3d input for eeg-based emotion recognition,” 10 2018

    2018

  17. [26]

    Tsception: Capturing temporal dynamics and spatial asymmetry from eeg for emotion recognition,

    Y . Ding, N. Robinson, S. Zhang, Q. Zeng, and C. Guan, “Tsception: Capturing temporal dynamics and spatial asymmetry from eeg for emotion recognition,” IEEE Transactions on Affective Computing , vol. 14, no. 3, p. 2238–2250, Jul. 2023. [Online]. Available: http://dx.doi.org/10...

    2023

  18. [27]

    Eegnet: a compact convolutional neural network for eeg-based brain–computer interfaces,

    V . J. Lawhern, A. J. Solon, N. R. Waytowich, S. M. Gordon, C. P. Hung, and B. J. Lance, “Eegnet: a compact convolutional neural network for eeg-based brain–computer interfaces,” Journal of Neural Engineering, vol. 15, no. 5, p. 056013, Jul. 2018. [Online]. Available: http://d...

    2018 doi

  19. [28]

    Secure neural network watermarking protocol against forging attack,

    R. Zhu, X. Zhang, M. Shi, and Z. Tang, “Secure neural network watermarking protocol against forging attack,” EURASIP Journal on Image and Video Processing , vol. 2020, no. 1, p. 37, 2020. [Online]. Available: https://doi.org/10.1186/s13640-020-00527-1 EGYPT JAPAN UNIVERSITY OF...

    2020 doi

  20. [139]

    6978–6988

    PMLR, 18–24 Jul 2021, pp. 6978–6988. [Online]. Available: https://proceedings.mlr.press/v139/liu21x.html

    2021

  21. [2018]

    Available: https://arxiv.org/abs/1804.00750

    [Online]. Available: https://arxiv.org/abs/1804.00750

    arXiv

  22. [2022]

    Available: https://arxiv.org/abs/2202.08602

    [Online]. Available: https://arxiv.org/abs/2202.08602

    arXiv

Pith tools

Reviewed August 8, 2026 · model on record in the stance chip above.