# On the Vulnerability of CNN Classifiers in EEG-Based BCIs

arXiv: https://arxiv.org/abs/1904.01002 · HTML: https://mlsanity.com/paper/1904.01002/

## Key facts

- Cited by 17 papers in the map (data through 14 Oct 2026).
- First posted on arXiv 31 Mar 2019.

## Built on by (most cited first, 17 of 17)

- [Toward Open-World Electroencephalogram Decoding Via Deep Learning: A Comprehensive Survey](https://mlsanity.com/paper/2112.06654/) (2021)
- [Interpretable and Robust AI in EEG Systems: A Survey](https://mlsanity.com/paper/2304.10755/) (2023)
- [Adversarial Attacks and Defenses in Physiological Computing: A Systematic Review](https://mlsanity.com/paper/2102.02729/) (2021)
- [Revisiting Euclidean Alignment for Transfer Learning in EEG-Based Brain-Computer Interfaces](https://mlsanity.com/paper/2502.09203/) (2025)
- [Alignment-Based Adversarial Training (ABAT) for Improving the Robustness and Accuracy of EEG-Based BCIs](https://mlsanity.com/paper/2411.02094/) (2024)
- [Reputation-Based Federated Learning Defense to Mitigate Threats in EEG Signal Classification](https://mlsanity.com/paper/2401.01896/) (2023)
- [User-wise Perturbations for User Identity Protection in EEG-Based BCIs](https://mlsanity.com/paper/2411.10469/) (2024)
- [Adversarial Artifact Detection in EEG-Based Brain-Computer Interfaces](https://mlsanity.com/paper/2212.00727/) (2022)
- [PAT: Privacy-Preserving Adversarial Transfer for Accurate, Robust and Privacy-Preserving EEG Decoding](https://mlsanity.com/paper/2412.11390/) (2024)
- [SAFE: Secure and Accurate Federated Learning for Privacy-Preserving Brain-Computer Interfaces](https://mlsanity.com/paper/2601.05789/) (2026)
- [Adversarial Stimuli: Attacking Brain-Computer Interfaces via Perturbed Sensory Events](https://mlsanity.com/paper/2211.10033/) (2022)
- [Robust EEG-based Emotion Recognition Using an Inception and Two-sided Perturbation Model](https://mlsanity.com/paper/2404.15373/) (2024)
- [AIM: Adversarial Information Masking for Faithfulness Evaluation of Saliency Maps](https://mlsanity.com/paper/2605.16905/) (2026)
- [Making Brain-Computer Interfaces More Secure](https://mlsanity.com/paper/2606.02597/) (2026)
- [Brain-Prompt Injection: A Route-Safety Audit for BCI-LLM Agents](https://mlsanity.com/paper/2606.09315/) (2026)
- [SW-ProxyCE: Zero-Query Adversarial Transfer from Public EEG Encoders to Private Downstream Models](https://mlsanity.com/paper/2608.16931/) (2026)
- [AERIAL: Adversarial Evaluation of Robustness in Accuracy-Preserving Low-Precision EEG Decoders](https://mlsanity.com/paper/2609.30037/) (2026)

## Abstract (arXiv)

Deep learning has been successfully used in numerous applications because of its outstanding performance and the ability to avoid manual feature engineering. One such application is electroencephalogram (EEG) based brain-computer interface (BCI), where multiple convolutional neural network (CNN) models have been proposed for EEG classification. However, it has been found that deep learning models can be easily fooled with adversarial examples, which are normal examples with small deliberate perturbations. This paper proposes an unsupervised fast gradient sign method (UFGSM) to attack three popular CNN classifiers in BCIs, and demonstrates its effectiveness. We also verify the transferability of adversarial examples in BCIs, which means we can perform attacks even without knowing the architecture and parameters of the target models, or the datasets they were trained on. To our knowledge, this is the first study on the vulnerability of CNN classifiers in EEG-based BCIs, and hopefully will trigger more attention on the security of BCI systems.