Pretrained, Frozen, Still Leaking: Auditing Cross-Encoder Attribute Transfer in EEG Foundation Models
On the map: LLM safety and security → Machine unlearning
Abstract (arXiv)
EEG foundation-model releases are usually audited one endpoint at a time: raw-reconstruction, membership inference, identity linkage, or DP-SGD on the downstream head. We audit the same released embeddings under all four endpoints jointly, on BIOT, LaBraM, and EEGPT, and show that each single-endpoint audit clears releases that still leak spectral attributes. The decisive evidence is a cross-encoder transfer audit: a single ridge attribute decoder learned from one frozen encoder transfers, via a fitted linear bridge, to held-out-subject test splits of every other encoder, with subject-disjoint matched-control 95% CI lower bound at least 0.081 across all six BIOT/LaBraM/EEGPT directions. We prove a sufficient condition: two encoders sharing a nontrivial attribute-coordinate projector overlap beta admit a chained ridge bridge attacker with centered-gain lower bound sqrt(beta/(1+tau^2)) - eps_br - rho_0, and back-solve beta in [0.008, 0.198]. To turn the joint audit into a deployment-readable decision rule we introduce an audit-endpoint disagreement score (AEDS), prove sufficient conditions for its positivity, and bootstrap-calibrate it per cell; AEDS is positive in all eight matched-CI cells (BIOT/LaBraM/EEGPT on EEGMMI; LaBraM on Sleep-EDF, 54-channel LIMO, CHB-MIT pediatric scalp EEG) with p<0.001, while a head-level Carlini LiRA membership audit reaches AUC only 0.50-0.70. Standard defenses fail under audit: a Wiener-style noise-aware adaptive attacker, the LiRA audit, and DP-SGD at every utility-preserving epsilon in {4,8} leave the attribute channel essentially unchanged. The contribution is an audit framework that turns scattered single-endpoint defenses into a joint release decision, supported by a cross-encoder bridge theorem and adaptive-attacker, LiRA, and DP-SGD baselines; the audit licenses release-blocking, not raw-waveform exfiltration or held-out-subject identity recovery.
Key facts. Cited by 1 paper in the map (data through 7 Oct 2026). Placed in Machine unlearning, one of 12 directions in LLM safety and security. Builds on 17 of its 36 references that are in the map. First posted on arXiv 8 Jun 2026.
Builds on
17 of 36 references.
References · 17
- 2016Membership Inference Attacks against Machine Learning Modelscited by 2,221
- 2020Extracting Training Data from Large Language Modelscited by 2,144
- 2018The Secret Sharer: Evaluating and Testing Unintended Memorization in Neural Networkscited by 847
- 2021Membership Inference Attacks From First Principlescited by 839
- 2018Exploiting Unintended Feature Leakage in Collaborative Learningcited by 509
- 2014Understanding Deep Image Representations by Inverting Themcited by 399
- 2024Large Brain Model for Learning Generic Representations with Tremendous EEG Data in BCIcited by 311
- 2020Information Leakage in Embedding Modelscited by 199
- 2021BENDR: using transformers and a contrastive self-supervised learning task to learn from massive amounts of EEG datacited by 194
- 2023Text Embeddings Reveal (Almost) As Much As Textcited by 189
- 2018Adversarial Removal of Demographic Attributes from Text Datacited by 166
- 2013Hacking Smart Machines with Smarter Ones: How to Extract Meaningful Data from Machine Learning Classifierscited by 128
5 more
- 2020Uncovering the structure of clinical EEG signals with self-supervised learningcited by 109
- 2018Privacy-preserving Neural Representations of Textcited by 54
- 2025An Investigation of Memorization Risk in Healthcare Foundation Modelscited by 5
- 2024PAT: Privacy-Preserving Adversarial Transfer for Accurate, Robust and Privacy-Preserving EEG Decodingcited by 2
- 2025Bridging Privacy and Utility: Synthesizing anonymized EEG with constraining utility functionscited by 2
Built on by
Citing papers per year: 2026: 1.
1 paper.