# Universal Adversarial Perturbations for CNN Classifiers in EEG-Based BCIs

arXiv: https://arxiv.org/abs/1912.01171 · HTML: https://mlsanity.com/paper/1912.01171/

## Key facts

- Cited by 13 papers in the map (data through 14 Oct 2026).
- First posted on arXiv 3 Dec 2019.

## Built on by (most cited first, 13 of 13)

- [Toward Open-World Electroencephalogram Decoding Via Deep Learning: A Comprehensive Survey](https://mlsanity.com/paper/2112.06654/) (2021)
- [Interpretable and Robust AI in EEG Systems: A Survey](https://mlsanity.com/paper/2304.10755/) (2023)
- [Adversarial Attacks and Defenses in Physiological Computing: A Systematic Review](https://mlsanity.com/paper/2102.02729/) (2021)
- [Alignment-Based Adversarial Training (ABAT) for Improving the Robustness and Accuracy of EEG-Based BCIs](https://mlsanity.com/paper/2411.02094/) (2024)
- [Adversarial Artifact Detection in EEG-Based Brain-Computer Interfaces](https://mlsanity.com/paper/2212.00727/) (2022)
- [Adversarial Filtering Based Evasion and Backdoor Attacks to EEG-Based Brain-Computer Interfaces](https://mlsanity.com/paper/2412.07231/) (2024)
- ["Forgetting" in Machine Learning and Beyond: A Survey](https://mlsanity.com/paper/2405.20620/) (2024)
- [Convolutional Neural Networks with A Topographic Representation Module for EEG-Based Brain-Computer Interfaces](https://mlsanity.com/paper/2208.10708/) (2022)
- [Adversarial Stimuli: Attacking Brain-Computer Interfaces via Perturbed Sensory Events](https://mlsanity.com/paper/2211.10033/) (2022)
- [Robust EEG-based Emotion Recognition Using an Inception and Two-sided Perturbation Model](https://mlsanity.com/paper/2404.15373/) (2024)
- [Optimizing food taste sensory evaluation through neural network-based taste electroencephalogram channel selection](https://mlsanity.com/paper/2410.03559/) (2024)
- [When Certificates Fail: A Unified Safety Framework for Embedded Neural Interface Models](https://mlsanity.com/paper/2607.06630/) (2026)
- [SW-ProxyCE: Zero-Query Adversarial Transfer from Public EEG Encoders to Private Downstream Models](https://mlsanity.com/paper/2608.16931/) (2026)

## Abstract (arXiv)

Multiple convolutional neural network (CNN) classifiers have been proposed for electroencephalogram (EEG) based brain-computer interfaces (BCIs). However, CNN models have been found vulnerable to universal adversarial perturbations (UAPs), which are small and example-independent, yet powerful enough to degrade the performance of a CNN model, when added to a benign example. This paper proposes a novel total loss minimization (TLM) approach to generate UAPs for EEG-based BCIs. Experimental results demonstrated the effectiveness of TLM on three popular CNN classifiers for both target and non-target attacks. We also verified the transferability of UAPs in EEG-based BCI systems. To our knowledge, this is the first study on UAPs of CNN classifiers in EEG-based BCIs. UAPs are easy to construct, and can attack BCIs in real-time, exposing a potentially critical security concern of BCIs.