# Alignment-Based Adversarial Training (ABAT) for Improving the Robustness and Accuracy of EEG-Based BCIs

arXiv: https://arxiv.org/abs/2411.02094 · HTML: https://mlsanity.com/paper/2411.02094/

## Key facts

- Cited by 6 papers in the map (data through 14 Oct 2026).
- Builds on 23 of its 53 references that are in the map.
- First posted on arXiv 4 Nov 2024.

## Builds on (most cited first, 23 of 23)

- [Explaining and Harnessing Adversarial Examples](https://mlsanity.com/paper/1412.6572/) (2014)
- [Towards Deep Learning Models Resistant to Adversarial Attacks](https://mlsanity.com/paper/1706.06083/) (2017)
- [Theoretically Principled Trade-off between Robustness and Accuracy](https://mlsanity.com/paper/1901.08573/) (2019)
- [Reliable evaluation of adversarial robustness with an ensemble of diverse parameter-free attacks](https://mlsanity.com/paper/2003.01690/) (2020)
- [Fast is better than free: Revisiting adversarial training](https://mlsanity.com/paper/2001.03994/) (2020)
- [Square Attack: a query-efficient black-box adversarial attack via random search](https://mlsanity.com/paper/1912.00049/) (2019)
- [Adversarial Training for Free!](https://mlsanity.com/paper/1904.12843/) (2019)
- [EEGNet: A Compact Convolutional Network for EEG-based Brain-Computer Interfaces](https://mlsanity.com/paper/1611.08024/) (2016)
- [Minimally distorted Adversarial Examples with a Fast Adaptive Boundary Attack](https://mlsanity.com/paper/1907.02044/) (2019)
- [Adversarial Examples Improve Image Recognition](https://mlsanity.com/paper/1911.09665/) (2019)
- [Transfer Learning for Brain-Computer Interfaces: A Euclidean Space Data Alignment Approach](https://mlsanity.com/paper/1808.05464/) (2018)
- [Transfer Learning for EEG-Based Brain-Computer Interfaces: A Review of Progress Made Since 2016](https://mlsanity.com/paper/2004.06286/) (2020)
- [Transfer Learning for Motor Imagery Based Brain-Computer Interfaces: A Complete Pipeline](https://mlsanity.com/paper/2007.03746/) (2020)
- [On the Vulnerability of CNN Classifiers in EEG-Based BCIs](https://mlsanity.com/paper/1904.01002/) (2019)
- [Tiny noise, big mistakes: Adversarial perturbations induce errors in Brain-Computer Interface spellers](https://mlsanity.com/paper/2001.11569/) (2020)
- [White-Box Target Attack for EEG-Based BCI Regression Problems](https://mlsanity.com/paper/1911.04606/) (2019)
- [Universal Adversarial Perturbations for CNN Classifiers in EEG-Based BCIs](https://mlsanity.com/paper/1912.01171/) (2019)
- [EEG-Based Brain-Computer Interfaces Are Vulnerable to Backdoor Attacks](https://mlsanity.com/paper/2011.00101/) (2020)
- [Different Set Domain Adaptation for Brain-Computer Interfaces: A Label Alignment Approach](https://mlsanity.com/paper/1912.01166/) (2019)
- [Toward Open-World Electroencephalogram Decoding Via Deep Learning: A Comprehensive Survey](https://mlsanity.com/paper/2112.06654/) (2021)
- [Manifold Embedded Knowledge Transfer for Brain-Computer Interfaces](https://mlsanity.com/paper/1910.05878/) (2019)
- [Driver Drowsiness Estimation from EEG Signals Using Online Weighted Adaptation Regularization for Regression (OwARR)](https://mlsanity.com/paper/1702.02901/) (2017)
- [Adversarial Attacks and Defenses in Physiological Computing: A Systematic Review](https://mlsanity.com/paper/2102.02729/) (2021)

## Built on by (most cited first, 6 of 6)

- [Revisiting Euclidean Alignment for Transfer Learning in EEG-Based Brain-Computer Interfaces](https://mlsanity.com/paper/2502.09203/) (2025)
- [PAT: Privacy-Preserving Adversarial Transfer for Accurate, Robust and Privacy-Preserving EEG Decoding](https://mlsanity.com/paper/2412.11390/) (2024)
- [SAFE: Secure and Accurate Federated Learning for Privacy-Preserving Brain-Computer Interfaces](https://mlsanity.com/paper/2601.05789/) (2026)
- [Spiking Neural Network for Intra-cortical Brain Signal Decoding](https://mlsanity.com/paper/2504.09213/) (2025)
- [NERVE Attacks: Breaking AI-Powered Brain-Computer Interfaces](https://mlsanity.com/paper/2609.08971/) (2026)
- [AERIAL: Adversarial Evaluation of Robustness in Accuracy-Preserving Low-Precision EEG Decoders](https://mlsanity.com/paper/2609.30037/) (2026)

## Abstract (arXiv)

Machine learning has achieved great success in electroencephalogram (EEG) based brain-computer interfaces (BCIs). Most existing BCI studies focused on improving the decoding accuracy, with only a few considering the adversarial security. Although many adversarial defense approaches have been proposed in other application domains such as computer vision, previous research showed that their direct extensions to BCIs degrade the classification accuracy on benign samples. This phenomenon greatly affects the applicability of adversarial defense approaches to EEG-based BCIs. To mitigate this problem, we propose alignment-based adversarial training (ABAT), which performs EEG data alignment before adversarial training. Data alignment aligns EEG trials from different domains to reduce their distribution discrepancies, and adversarial training further robustifies the classification boundary. The integration of data alignment and adversarial training can make the trained EEG classifiers simultaneously more accurate and more robust. Experiments on five EEG datasets from two different BCI paradigms (motor imagery classification, and event related potential recognition), three convolutional neural network classifiers (EEGNet, ShallowCNN and DeepCNN) and three different experimental settings (offline within-subject cross-block/-session classification, online cross-session classification, and pre-trained classifiers) demonstrated its effectiveness. It is very intriguing that adversarial attacks, which are usually used to damage BCI systems, can be used in ABAT to simultaneously improve the model accuracy and robustness.