# EEG-Based Brain-Computer Interfaces Are Vulnerable to Backdoor Attacks

arXiv: https://arxiv.org/abs/2011.00101 · HTML: https://mlsanity.com/paper/2011.00101/

## Key facts

- Cited by 13 papers in the map (data through 14 Oct 2026).
- First posted on arXiv 30 Oct 2020.

## Built on by (most cited first, 13 of 13)

- [UNICORN: A Unified Backdoor Trigger Inversion Framework](https://mlsanity.com/paper/2304.02786/) (2023)
- [Toward Open-World Electroencephalogram Decoding Via Deep Learning: A Comprehensive Survey](https://mlsanity.com/paper/2112.06654/) (2021)
- [Accumulative Poisoning Attacks on Real-time Data](https://mlsanity.com/paper/2106.09993/) (2021)
- [Adversarial Attacks and Defenses in Physiological Computing: A Systematic Review](https://mlsanity.com/paper/2102.02729/) (2021)
- [Revisiting Euclidean Alignment for Transfer Learning in EEG-Based Brain-Computer Interfaces](https://mlsanity.com/paper/2502.09203/) (2025)
- [Alignment-Based Adversarial Training (ABAT) for Improving the Robustness and Accuracy of EEG-Based BCIs](https://mlsanity.com/paper/2411.02094/) (2024)
- [Adversarial Artifact Detection in EEG-Based Brain-Computer Interfaces](https://mlsanity.com/paper/2212.00727/) (2022)
- [Explainable Data Poison Attacks on Human Emotion Evaluation Systems based on EEG Signals](https://mlsanity.com/paper/2301.06923/) (2023)
- [Adversarial Filtering Based Evasion and Backdoor Attacks to EEG-Based Brain-Computer Interfaces](https://mlsanity.com/paper/2412.07231/) (2024)
- [PAT: Privacy-Preserving Adversarial Transfer for Accurate, Robust and Privacy-Preserving EEG Decoding](https://mlsanity.com/paper/2412.11390/) (2024)
- [Adversarial Stimuli: Attacking Brain-Computer Interfaces via Perturbed Sensory Events](https://mlsanity.com/paper/2211.10033/) (2022)
- [Recover Triggered States: Protect Model Against Backdoor Attack in Reinforcement Learning](https://mlsanity.com/paper/2304.00252/) (2023)
- [NERVE Attacks: Breaking AI-Powered Brain-Computer Interfaces](https://mlsanity.com/paper/2609.08971/) (2026)

## Abstract (arXiv)

Research and development of electroencephalogram (EEG) based brain-computer interfaces (BCIs) have advanced rapidly, partly due to deeper understanding of the brain and wide adoption of sophisticated machine learning approaches for decoding the EEG signals. However, recent studies have shown that machine learning algorithms are vulnerable to adversarial attacks. This article proposes to use narrow period pulse for poisoning attack of EEG-based BCIs, which is implementable in practice and has never been considered before. One can create dangerous backdoors in the machine learning model by injecting poisoning samples into the training set. Test samples with the backdoor key will then be classified into the target class specified by the attacker. What most distinguishes our approach from previous ones is that the backdoor key does not need to be synchronized with the EEG trials, making it very easy to implement. The effectiveness and robustness of the backdoor attack approach is demonstrated, highlighting a critical security concern for EEG-based BCIs and calling for urgent attention to address it.