Pith. sign in

REVIEW 3 major objections 5 minor 54 references

Active Poisoning: Efficient Backdoor Attacks on Transfer Learning-Based Brain-Computer Interfaces

T0 review · 3 major / 5 minor · reviewed 2026-08-11 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read This paper establishes that transfer learning in EEG-based brain-computer interfaces is vulnerable to backdoor attacks, and that deliberately choosing which source-domain samples to poison—rather than poisoning at random—markedly raises…

desk verdict First solid demonstration that transfer learning in EEG BCIs can be backdoored via source-data poisoning; active selection helps, but the stealthiness claim needs an amplitude sensitivity sweep. read the letter →

arxiv 2412.09933 v1 pith:JVNRJADN submitted 2024-12-13 cs.HC

X. Jiang , L. Meng , S. Li , D. Wu This is my paper · ORCID
classification cs.HC
keywords brain-computerinterfaceelectroencephalogramtransferlearningpoisoningattackbackdooractivesampleselectiondeep
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

The paper claims that transfer learning, the standard way to reduce calibration effort in EEG-based brain-computer interfaces, creates a backdoor vulnerability: an attacker who poisons a small fraction of the publicly shared source-domain data with a narrow-period-pulse trigger can plant a hidden behavior in the trained model. After transfer, any test signal from a new user that carries the same trigger is systematically misclassified into an attacker-chosen class, while ordinary signals continue to be classified correctly. The paper proposes several active-poisoning strategies that select which source samples to poison instead of choosing them at random, and reports that these strategies raise the attack success rate by roughly 10 to 30 percentage points at a 5 percent poisoning rate on four EEG datasets and three deep-learning models. A sympathetic reader would take the central claim to be that backdoor attacks on transfer-learning-based BCIs are practical and that poisoning a small, carefully chosen set of samples is enough to make them succeed.

What carries the argument

The load-bearing mechanism is the narrow-period-pulse (NPP) trigger—a periodic square wave of tunable amplitude, period, phase, and duty cycle, added identically across all EEG channels—combined with active-poisoning sample selection that inverts the logic of active learning. Where active learning queries the most uncertain samples for labeling, active poisoning selects the most confidently classified non-target samples (lowest entropy in MUS, smallest model change in MMCS) because relabeling those samples to the target class forces the decision boundary to move far; diversity-based selection (MDS, RDS) spreads the poison across the input space, and the combined strategies (MUS+MDS, MMCS+MDS) balance both criteria. This selection machinery does the work of embedding the trigger robustly while keeping the number of poisoned samples small, which is what makes the attack efficient and hard to notice.

What would settle it

Re-run the active-poisoning protocol at a fixed trigger amplitude of 1% of mean channel-wise standard deviation across all four datasets and all models, then measure ASR at 5% poisoning; if ASR collapses to near the random-poisoning baseline, the reported success is an artifact of amplitude calibration rather than a robust property of active sample selection.

Watch

Extended reading notes

Core claim

The central discovery is that transfer learning in EEG-based brain-computer interfaces is vulnerable to backdoor attacks. When an attacker inserts a narrow-period-pulse (NPP) trigger into a small subset of source-domain non-target samples and relabels them to a target class, then aligns the poisoned source data with the target user's data using Euclidean alignment and trains a deep model, the resulting model misclassifies trigger-carrying target-domain samples into that target class with high probability while balanced classification accuracy on clean samples stays near the uninfected baseline. The paper further shows that replacing random sample selection with active-poisoning strategies—minimum uncertainty sampling (MUS), minimum model change sampling (MMCS), and their combinations with diversity sampling—improves attack success rates while keeping the poisoning budget fixed, and that the improvements persist under fine-tuning, data augmentation, and alternative trigger waveforms.

Load-bearing premise

The attack's success depends on per-dataset manual tuning of the trigger amplitude (0.2%, 15%, 30%, and 100% of mean channel-wise standard deviation for P300, MI1, MI2, and ERN), so if a trigger small enough to be genuinely imperceptible fails to reach the reported attack success rates, the practical threat is weaker than claimed.

Editorial extensions

If this is right

  • At a fixed 5 percent poisoning rate, the proposed active-poisoning strategies raise attack success rates over random poisoning by roughly 10 to 30 percentage points across datasets and models, with the combined MUS+MDS and MMCS+MDS strategies usually performing best.
  • The backdoor survives end-to-end fine-tuning of the infected model with clean labeled target-domain data: attack success rates drop but remain well above the uninfected baseline, and active poisoning still beats random poisoning in that setting.
  • None of the tested data-augmentation schemes—noise, multiplication, frequency shift, or channel weakening—consistently removes the backdoor, so the attack withstands a common class of defenses.
  • The model-based active-poisoning strategies do not require the attacker to know the user's architecture; success rates stay high when the selector model differs from the target model.
  • The attack is not tied to the NPP waveform: sine, sawtooth, and random-pulse triggers all achieve high attack success rates, sometimes higher than NPP.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • If the active-poisoning principle transfers, then defenses that screen for anomalous or outlier training samples in source data are likely to miss the poisoned subset, because the selected samples deliberately look like typical, high-confidence members of their class; testing outlier-removal and loss-based filtering defenses against AP-poisoned data would settle this.
  • The hand-tuned trigger amplitudes suggest an attacker would need dataset-specific calibration; a systematic sweep over amplitudes is the natural next test to see whether a single universally stealthy trigger exists or whether the attack success rate degrades sharply below a dataset-dependent threshold.
  • The same inverted active-learning logic might extend to other calibrated-model settings, such as speech or physiological-signal transfer learning, where shared pre-trained data is common; this is a direct corollary of the paper's mechanism but not something the paper tests.
  • A defensive implication the paper leaves implicit: since MUS and MMCS select low-entropy, low-model-change samples, a model owner who tracks per-sample training loss or confidence might spot the poisoned samples as an anomaly cluster; investigating that detector would be a concrete follow-up.
Share X Bluesky LinkedIn Reddit HN

Signed reviews

No signed human review yet.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

3 major / 5 minor

Summary. This paper studies backdoor attacks on transfer learning (TL) based EEG brain-computer interfaces (BCIs). The attacker poisons a small subset of source-domain EEG trials with a narrow periodic pulse (NPP) trigger, relabels those trials to a target class, and then an innocent user aligns the poisoned source data with unlabeled target data and trains a deep learning model. The paper proposes several active poisoning (AP) selection strategies—MDS, RDS, MUS, MMCS, and their combinations—to choose which source trials to poison, with the goal of increasing attack success rate (ASR) at a fixed poisoning rate while keeping classification accuracy (BCA) close to baseline. Experiments on four EEG datasets (P300, ERN, MI1, MI2) and three CNN architectures (EEGNet, DeepCNN, ShallowCNN) report ASRs up to near 100% for the best strategies, with BCA within a few points of the clean baseline. The paper also investigates fine-tuning defenses, data augmentation, cross-task TL, alternative triggers, and traditional SVM classifiers.

Significance. The paper is the first to address backdoor attacks in the TL pipeline for EEG-based BCIs, a realistic and timely threat scenario for BCI security. Its strengths include a careful definition of ASR that excludes already-misclassified samples, evaluation across four datasets and three models with leave-one-subject-out cross-validation, and robustness checks across trigger types, fine-tuning, and data augmentation. If the main result—that AP strategies substantially improve attack efficiency over random poisoning while remaining stealthy—is confirmed, the work would be an important contribution to the security community and a cautionary note for BCI deployment. However, the practical risk claim is currently weakened by the absence of a sensitivity analysis for the trigger amplitude and by the lack of error bars or statistical tests on the reported mean ASRs.

major comments (3)
  1. [Section 4.4.2] The NPP trigger amplitude is a free parameter set to 0.2%, 15%, 30%, and 100% of the mean channel-wise standard deviation for P300, MI1, MI2, and ERN, respectively, with no sensitivity analysis and no quantitative evaluation of trigger visibility or detectability. The 100% amplitude used for ERN is comparable in magnitude to the EEG signal itself, so poisoned ERN trials cannot be described as 'almost identical' to benign trials (a description that is only made for the MI1 example in Figure 4 with a=30%). The paper's central claim of a serious, stealthy practical risk therefore requires either (i) a demonstration that the reported high ASRs are preserved at amplitudes that are demonstrably imperceptible (e.g., by a detection test or a perception model), or (ii) a discussion of the trade-off between ASR and amplitude with explicit detection thresholds. Without this, the external validity of the attack as a 'stealthy' backdoor is not established.
  2. [Section 4.3.1] All experimental results are reported as means over five random runs without standard deviations, confidence intervals, or significance tests. For example, Table 1 shows ASR improvements of roughly 10 percentage points for the best AP strategies over Random on P300 (e.g., EEGNet 83.2% vs. 94.3%), but the reader cannot assess whether these differences exceed run-to-run variability. Figure 5 similarly lacks error bars. Because the paper's main contribution is the claim that AP strategies improve attack efficiency over Random at the same poisoning rate, the authors should report error bars and/or perform paired statistical tests across subjects to substantiate this claim. This is a load-bearing methodological gap.
  3. [Section 4.8.1] The fine-tuning experiment shows a dramatic drop in ASR on P300 and MI1 (e.g., EEGNet ASR falls from 94.3% to 22.0% for MMCS on P300, and from 99.1% to 90.6% on MI1), which the authors attribute to the small NPP amplitudes on these datasets. This reinforces the concern that the attack success is tightly coupled to the hand-set amplitude: if a truly stealthy trigger must be much smaller than the amplitudes used here, the attack may fail in the presence of fine-tuning. The paper should either provide a sensitivity analysis showing the joint effect of amplitude and fine-tuning, or temper the claim that these attacks are a serious risk in realistic BCI workflows.
minor comments (5)
  1. [Section 4.4.2] The sentence 'Different amplitudes were used on the three datasets' should read 'four datasets', since four datasets are listed.
  2. [Section 3.1] The notation for poisoned samples is inconsistent: the text states 'P1 + P2 + ... + PS = P' but the set (~X p s , 1)Ps p=0 suggests an index range that is not clearly defined; the index should probably run from p=1 to P_s, and the total P should be defined consistently with the P_s notation.
  3. [References] Reference [45] is missing the first initial of the third author; the correct citation should include the author's full name.
  4. [Section 4.6] The subject-level stability analysis is only presented for the P300 dataset; adding subject-level results for at least one other dataset would support the generality of the stability claim, or the limitation should be explicitly acknowledged.
  5. [Figure 3] The caption of Figure 3 does not specify which dataset(s) and model(s) are shown; the text should clarify the aggregation presented in the figure to allow the reader to interpret the comparison between BCAs with and without poisoning.

Circularity Check

0 steps flagged · score 1.0 of 10

No significant circularity: the AP-versus-Random attack comparison is an empirical measurement on public datasets, and the self-citations are provenance rather than load-bearing evidence.

full rationale

The paper's central claim—that active poisoning (MUS, MMCS, MDS, RDS, and combinations) yields higher attack success rates than random poisoning at the same poisoning rate—is established by leave-one-subject-out experiments on four public EEG datasets and three CNN models. The selection heuristics (entropy, model change, diversity) are computed on source-domain data, while ASR is measured on held-out target-domain samples that were not used in sample selection, so the comparison is not forced by construction. The NPP trigger (Meng et al. [23]) and EA alignment (He and Wu [18]) are adopted as inputs from prior work, and the statement that RDS is identical to the RD active-learning approach in Wu [36] is an attribution, not a derivation of the attack results. The per-dataset trigger amplitude (0.2% to 100% of mean channel-wise standard deviation) is a hand-set experimental constant with no sensitivity analysis; this is an external-validity concern, not a circular one. No equation or metric is defined in terms of the outcome it is supposed to predict, and no fitted parameter is relabeled as a prediction. The minor self-citations are therefore not load-bearing, and the empirical core is self-contained against external benchmarks.

Assumptions & free parameters 3 free parameters · 4 assumptions · 0 invented entities

The paper introduces no new physical entities. The main free parameter is the per-dataset trigger amplitude, which is tuned to make attacks effective. The key domain assumptions are the realizability of the NPP trigger and the effective transfer of the backdoor through EA alignment. The AP selection heuristics are adopted without formal justification.

free parameters (3)
  • NPP trigger amplitude per dataset = P300: 0.2%, MI1: 15%, MI2: 30%, ERN: 100% of mean channel-wise standard deviation
    Set manually per dataset to achieve high ASR; no sensitivity analysis or principled criterion. Location: Section 4.4.2.
  • NPP trigger period and duty cycle = T = 1 s, duty cycle d = 20%
    Fixed choices that affect the trigger; not varied in the paper. Location: Section 4.4.2.
  • k for k-means in label alignment = 10
    Used in the cross-task TL experiment to select target samples for labeling; not central to the main results. Location: Section 4.8.3.
assumptions (4)
  • domain assumption Euclidean alignment (EA) is a valid and representative transfer learning method for EEG BCIs.
    The attack scenario assumes a data alignment based offline TL, and EA is used in all experiments. Location: Section 4.3.3.
  • domain assumption A narrow period pulse (NPP) can be injected into EEG signals during acquisition without detection.
    The trigger is assumed physically realizable; no hardware or human-subject validation is provided. Location: Sections 3.2 and 4.4.2.
  • ad hoc to paper Samples with low uncertainty (MUS) or low model change (MMCS) are the most effective to poison.
    Heuristic adapted from active learning; no theoretical proof, only empirical support. Location: Sections 3.3.3 and 3.3.4.
  • domain assumption The attacker can obtain clean source-domain labels and can add the trigger to target-domain samples at test time.
    Threat model premise for the attack scenario. Location: Section 3.1.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Active Poisoning: Efficient Backdoor Attacks on Transfer Learning-Based Brain-Computer Interfaces." pith.science (2026). https://pith.science/paper/JVNRJADN

@misc{pith2026241209933,
  author       = {Pith},
  title        = {Pith review of: Active Poisoning: Efficient Backdoor Attacks on Transfer Learning-Based Brain-Computer Interfaces},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/JVNRJADN}},
  note         = {Machine review of arXiv:2412.09933}
}
read the original abstract

Transfer learning (TL) has been widely used in electroencephalogram (EEG)-based brain-computer interfaces (BCIs) for reducing calibration efforts. However, backdoor attacks could be introduced through TL. In such attacks, an attacker embeds a backdoor with a specific pattern into the machine learning model. As a result, the model will misclassify a test sample with the backdoor trigger into a prespecified class while still maintaining good performance on benign samples. Accordingly, this study explores backdoor attacks in the TL of EEG-based BCIs, where source-domain data are poisoned by a backdoor trigger and then used in TL. We propose several active poisoning approaches to select source-domain samples, which are most effective in embedding the backdoor pattern, to improve the attack success rate and efficiency. Experiments on four EEG datasets and three deep learning models demonstrate the effectiveness of the approaches. To our knowledge, this is the first study about backdoor attacks on TL models in EEG-based BCIs. It exposes a serious security risk in BCIs, which should be immediately addressed.

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

54 extracted references · 49 canonical work pages

  1. [1]

    Brain-computer interfaces: A gentle introduction

    Graimann B, Allison B, Pfurtscheller G. Brain-computer interfaces: A gentle introduction. In: Graimann B, Pfurtscheller G, Allison B, eds. Brain-Computer Interfaces. Berlin: Springer, 2010. 1--27

    work page 2010

  2. [2]

    Brain computer interfaces, a review

    Nicolas-Alonso L F, Gomez-Gil J. Brain computer interfaces, a review. Sensors, 2012, 12: 1211--1279

    work page 2012

  3. [3]

    Motor imagery and direct brain-computer communication

    Pfurtscheller G, Neuper C. Motor imagery and direct brain-computer communication. Proceedings of the IEEE, 2001, 89: 1123--1134

    work page 2001

  4. [4]

    A novel task-oriented optimal design for P 300-based brain-computer interfaces

    Zhou Z T, Yin E W, Liu Y, et al. A novel task-oriented optimal design for P 300-based brain-computer interfaces. Journal of Neural Engineering, 2014, 11: 056003

    work page 2014

  5. [5]

    Robust similarity measurement based on a novel time filter for SSVEP s detection

    Jin J, Wang Z Q, Xu R, et al. Robust similarity measurement based on a novel time filter for SSVEP s detection. IEEE Trans. on Neural Networks and Learning Systems, 2021, in press, doi: 10.1109/TNNLS.2021.3118468

    work page arXiv 2021

  6. [6]

    Recent advances in wireless epicortical and intracortical neuronal recording systems

    Ji B W, Liang Z K, Yuan X C, et al. Recent advances in wireless epicortical and intracortical neuronal recording systems. Sci China Inf Sci, 2022, 65: 140401

    work page 2022

  7. [7]

    Long-term flexible penetrating neural interfaces: materials, structures, and implantation

    Gu C, Jiang J J, Tao, T H, et al. Long-term flexible penetrating neural interfaces: materials, structures, and implantation. Sci China Inf Sci, 2021, 64: 221401

    work page 2021

  8. [8]

    A 124 dB dynamic range sigma-delta modulator applied to non-invasive EEG acquisition using chopper-modulated input-scaling-down technique

    Chen K Q, Chen M Y, Cheng L L, et al. A 124 dB dynamic range sigma-delta modulator applied to non-invasive EEG acquisition using chopper-modulated input-scaling-down technique. Sci China Inf Sci, 2022, 65: 140402

    work page 2022

Show all 54 references
  1. [9]

    Recent progress of integrated circuits and optoelectronic chips

    Hao Y, Xiang S Y, Han G Q, et al. Recent progress of integrated circuits and optoelectronic chips. Sci China Inf Sci, 2021, 64: 201401

    2021

  2. [10]

    Evolving signal processing for brain-computer interfaces

    Makeig S, Kothe C, Mullen T, et al. Evolving signal processing for brain-computer interfaces. Proceedings of the IEEE , 2012, 100: 1567--1584

    2012

  3. [11]

    Correlation-based channel selection and regularized feature optimization for MI -based BCI

    Jin J, Miao Y Y, Daly I, et al. Correlation-based channel selection and regularized feature optimization for MI -based BCI . Neural Networks, 2019, 118: 262--270

    2019

  4. [12]

    Internal feature selection method of CSP based on L 1-norm and D empster- S hafer theory

    Jin J, Xiao R C, Daly I, et al. Internal feature selection method of CSP based on L 1-norm and D empster- S hafer theory. IEEE Trans. on Neural Networks and Learning Systems, 2021, 32: 4814--4825

    2021

  5. [13]

    A review of classification algorithms for EEG -based brain-computer interfaces: A 10 year update

    Lotte F, Bougrain L, Cichocki A, et al. A review of classification algorithms for EEG -based brain-computer interfaces: A 10 year update. Journal of Neural Engineering, 2018, 15: 031005

    2018

  6. [14]

    Evidence of variabilities in EEG dynamics during motor imagery-based multiclass brain-computer interface

    Saha S, Ahmed K I U, Mostafa R, et al. Evidence of variabilities in EEG dynamics during motor imagery-based multiclass brain-computer interface. IEEE Trans. on Neural Systems and Rehabilitation Engineering, 2018, 26: 371--382

    2018

  7. [15]

    Transfer learning for EEG -based brain-computer interfaces: A review of progress made since 2016

    Wu D R, Xu Y F, Lu B L. Transfer learning for EEG -based brain-computer interfaces: A review of progress made since 2016. IEEE Trans. on Cognitive and Developmental Systems, 2020, in press, doi: 10.1109/TCDS.2020.3007453

    2016

  8. [16]

    A survey on transfer learning

    Pan S J, Yang Q. A survey on transfer learning. IEEE Trans. on Knowledge and Data Engineering, 2010, 22: 1345--1359

    2010

  9. [17]

    Transfer learning in brain-computer interfaces

    Jayaram V, Alamgir M, Altun Y, et al. Transfer learning in brain-computer interfaces. IEEE Computational Intelligence Magazine, 2016, 11: 20--31

    2016

  10. [18]

    Transfer learning for brain-computer interfaces: A Euclidean space data alignment approach

    He H, Wu D R. Transfer learning for brain-computer interfaces: A Euclidean space data alignment approach. IEEE Trans. on Biomedical Engineering, 2019, 67: 399--410

    2019

  11. [19]

    Different set domain adaptation for brain-computer interfaces: a label alignment approach

    He H, Wu D R. Different set domain adaptation for brain-computer interfaces: a label alignment approach. IEEE Trans. on Neural Systems and Rehabilitation Engineering, 2020, 28: 1091--1108

    2020

  12. [20]

    On the vulnerability of CNN classifiers in EEG -based BCI s

    Zhang X, Wu D R. On the vulnerability of CNN classifiers in EEG -based BCI s. IEEE Trans. on Neural Systems and Rehabilitation Engineering, 2019, 27: 814--825

    2019

  13. [21]

    Universal adversarial perturbations for CNN classifiers in EEG -based BCIs

    Liu Z H, Meng L B, Zhang X, et al. Universal adversarial perturbations for CNN classifiers in EEG -based BCIs . Journal of Neural Engineering, 2021, 18: 0460a4

    2021

  14. [22]

    Tiny noise, big mistakes: A dversarial perturbations induce errors in brain-computer interface spellers

    Zhang X, Wu D R, Ding L Y, et al. Tiny noise, big mistakes: A dversarial perturbations induce errors in brain-computer interface spellers. National Science Review, 2021, 8: nwaa233

    2021

  15. [23]

    EEG -based brain-computer interfaces are vulnerable to backdoor attacks

    Meng L B, Wu D R, Huang J, et al. EEG -based brain-computer interfaces are vulnerable to backdoor attacks. arXiv:2011.00101

    2011 arXiv

  16. [24]

    SSVEP-based brain-computer interfaces are vulnerable to square wave attacks

    Bian R, Meng L B, Wu D R. SSVEP-based brain-computer interfaces are vulnerable to square wave attacks. Sci China Inf Sci, 2022, 65: 140406

    2022

  17. [25]

    Badnets: Identifying vulnerabilities in the machine learning model supply chain

    Gu T Y, Dolan-Gavitt B, Garg S. Badnets: Identifying vulnerabilities in the machine learning model supply chain. arXiv:1708.06733

    arXiv

  18. [26]

    Adversarial patch

    Brown T B, Man\' e D, Roy A, et al. Adversarial patch. In: Proc. Advances in Neural Information Processing Systems, Long Beach, CA, 2017

    2017

  19. [27]

    Audio adversarial examples: targeted attacks on speech-to-text

    Carlini N, Wagner D. Audio adversarial examples: targeted attacks on speech-to-text. In: Proc. IEEE Symposium on Security and Privacy, San Francisco, CA, 2018. 1--7

    2018

  20. [28]

    Securing connected & autonomous vehicles: Challenges posed by adversarial machine learning and the way forward

    Qayyum A, Usama M, Qadir J, et al. Securing connected & autonomous vehicles: Challenges posed by adversarial machine learning and the way forward. IEEE Communications Surveys & Tutorials, 2020, 22: 998--1026

    2020

  21. [29]

    A target-agnostic attack on deep models: Exploiting security vulnerabilities of transfer learning

    Rezaei S, Liu X. A target-agnostic attack on deep models: Exploiting security vulnerabilities of transfer learning. In: Proc. Int'l Conf. on Learning Representations, online, 2020

    2020

  22. [30]

    With great training comes great vulnerability: Practical attacks against transfer learning

    Wang B L, Yao Y S, Viswanath B, et al. With great training comes great vulnerability: Practical attacks against transfer learning. In: Proc. 27th USENIX Security Symposium, Baltimore, MD, 2018. 1281--1297

    2018

  23. [31]

    Backdoor attacks against transfer learning with pre-trained deep learning models

    Wang S, Nepal S, Rudolph C, et al. Backdoor attacks against transfer learning with pre-trained deep learning models. IEEE Trans. on Services Computing, 2020, in press, doi: 10.1109/TSC.2020.3000900

    2020

  24. [32]

    Weight poisoning attacks on pretrained models

    Kurita K, Michel P, Neubig G. Weight poisoning attacks on pretrained models. In: Proc. 58th Annual Meeting of the Association for Computational Linguistics, online, 2020

    2020

  25. [33]

    Active learning literature survey

    Settles B. Active learning literature survey. Computer Sciences Technical Report 1648, University of Wisconsin--Madison, 2009

    2009

  26. [34]

    An analysis of active learning strategies for sequence labeling tasks

    Settles B, Craven M. An analysis of active learning strategies for sequence labeling tasks. In: Proc. Conf. on Empirical Methods in Natural Language Processing, Honolulu, HI, 2008. 1070--1079

    2008

  27. [35]

    Active learning for classification with maximum model change

    Cai W B, Zhang Y X, Zhang Y, et al. Active learning for classification with maximum model change. ACM Trans. on Information Systems, 2017, 36: 1--28

    2017

  28. [36]

    Pool-based sequential active learning for regression

    Wu D R. Pool-based sequential active learning for regression. IEEE Trans. on Neural Networks and Learning Systems, 2019, 30: 1348--1359

    2019

  29. [37]

    Active learning for regression using greedy sampling

    Wu D R, Lin C T, Huang J. Active learning for regression using greedy sampling. Information Sciences, 2019, 474: 90--105

    2019

  30. [38]

    An efficient P 300-based brain-computer interface for disabled subjects

    Hoffmann U, Vesin J M, Ebrahimi T, et al. An efficient P 300-based brain-computer interface for disabled subjects. Journal of Neuroscience Methods, 2008, 167: 115--125

    2008

  31. [39]

    Objective and subjective evaluation of online error correction during P 300-based spelling

    Margaux P, Emmanuel M, S\' e bastien D, et al. Objective and subjective evaluation of online error correction during P 300-based spelling. Advances in Human-Computer Interaction, 2012, 2012

    2012

  32. [40]

    Review of the BCI C ompetition IV

    Tangermann M, M\" u ller K R, Aertsen A, et al. Review of the BCI C ompetition IV . Frontiers in Neuroscience, 2012, 6: 55

    2012

  33. [41]

    The non-invasive B erlin brain-computer interface: fast acquisition of effective performance in untrained subjects

    Blankertz B, Dornhege G, Krauledat M, et al. The non-invasive B erlin brain-computer interface: fast acquisition of effective performance in untrained subjects. NeuroImage, 2007, 37: 539-550

    2007

  34. [42]

    EEGNet : A compact convolutional neural network for EEG -based brain-computer interfaces

    Lawhern V J, Solon A J, Waytowich N R, et al. EEGNet : A compact convolutional neural network for EEG -based brain-computer interfaces. Journal of Neural Engineering, 2018, 15: 056013

    2018

  35. [43]

    Deep learning with convolutional neural networks for EEG decoding and visualization

    Schirrmeister R T, Springenberg J T, Fiederer L D J, et al. Deep learning with convolutional neural networks for EEG decoding and visualization. Human Brain Mapping, 2017, 38: 5391--5420

    2017

  36. [44]

    Thinker invariance: E nabling deep neural networks for BCI across more people

    Kostas D, Rudzicz F. Thinker invariance: E nabling deep neural networks for BCI across more people. Journal of Neural Engineering, 2020, 17: 056008

    2020

  37. [45]

    Latent backdoor attacks on deep neural networks

    Yao Y, Li H, Zheng H, et al. Latent backdoor attacks on deep neural networks. In: Proc. ACM SIGSAC Conf. on Computer and Communications Security, London, UK, 2019. 2041--2055

    2019

  38. [46]

    Attack of the tails: Yes, you really can backdoor federated learning

    Wang H, Sreenivasan K, Rajput S, et al. Attack of the tails: Yes, you really can backdoor federated learning. In: Proc. Advances in Neural Information Processing Systems, online, 2020. 16070--16084

    2020

  39. [47]

    Fine-pruning: Defending against backdooring attacks on deep neural networks

    Liu K, Dolan-Gavitt, Garg S. Fine-pruning: Defending against backdooring attacks on deep neural networks. In: Bailey M, Holz T, Stamatogiannakis M, Ioannidis S, eds. Research in Attacks, Intrusions, and Defenses. Cham: Springer, 2018, 11050: 273--294

    2018

  40. [48]

    Neural trojans

    Liu Y, Xie Y, Srivastava A. Neural trojans. In: Proc. IEEE Int'l Conf. on Computer Design, Boston, MA, 2017. 45--48

    2017

  41. [49]

    Strong data augmentation sanitizes poisoning and backdoor attacks without an accuracy tradeoff

    Borgnia E, Cherepanova V, Fowl L, et al. Strong data augmentation sanitizes poisoning and backdoor attacks without an accuracy tradeoff. In: Proc. IEEE Int'l Conf. on Acoustics, Speech and Signal Processing, online, 2021. 3855--3859

    2021

  42. [50]

    Rethinking the trigger of backdoor attack

    Li Y M, Zhai T Q, Wu B Y, et al. Rethinking the trigger of backdoor attack. arXiv:2004.04692

    2004 arXiv

  43. [51]

    Data augmentation for self-paced motor imagery classification with C-LSTM

    Freer D, Yang G Z. Data augmentation for self-paced motor imagery classification with C-LSTM. Journal of Neural Engineering, 2020, 17: 016041

    2020

  44. [52]

    Privacy-preserving domain adaptation for motor imagery-based brain-computer interfaces

    Xia K, Deng L F, Duch, W, et al. Privacy-preserving domain adaptation for motor imagery-based brain-computer interfaces. IEEE Trans. on Biomedical Engineering, 2022, in press, doi: 10.1109/TBME.2022.3168570

    2022

  45. [53]

    xDAWN algorithm to enhance evoked potentials: application to brain-computer interface

    Rivet B, Souloumiac A, Attina V, et al. xDAWN algorithm to enhance evoked potentials: application to brain-computer interface. IEEE Trans. on Biomedical Engineering, 2009, 56: 2035-2043

    2009

  46. [54]

    Optimal spatial filtering of single trial EEG during imagined hand movement

    Ramoser H, Muller-Gerking J, Pfurtscheller G. Optimal spatial filtering of single trial EEG during imagined hand movement. IEEE Trans. on Rehabilitation Engineering, 2000, 8: 441-446

    2000

Pith tools

Reviewed August 11, 2026 · model on record in the stance chip above.