White-Box Target Attack for EEG-Based BCI Regression Problems

Abstract

Machine learning has achieved great success in many applications, including electroencephalogram (EEG) based brain-computer interfaces (BCIs). Unfortunately, many machine learning models are vulnerable to adversarial examples, which are crafted by adding deliberately designed perturbations to the original inputs. Many adversarial attack approaches for classification problems have been proposed, but few have considered target adversarial attacks for regression problems. This paper proposes two such approaches. More specifically, we consider white-box target attacks for regression problems, where we know all information about the regression model to be attacked, and want to design small perturbations to change the regression output by a pre-determined amount. Experiments on two BCI regression problems verified that both approaches are effective. Moreover, adversarial examples generated from both approaches are also transferable, which means that we can use adversarial examples generated from one known regression model to attack an unknown regression model, i.e., to perform black-box attacks. To our knowledge, this is the first study on adversarial attacks for EEG-based BCI regression problems, which calls for more attention on the security of BCI systems.

Is neuron coverage a meaningful measure for testing deep neural networks?

“…As for the loss function L, we use the loss function provided by Carlini and Wagner [8] for our classification tasks. For our regression models, we substitute the standard CW loss function for a custom loss designed for regression tasks by Meng et al [41]. Projected Gradient Descent (PGD) [39] finds the adversarial example x + δ by solving the following maximization problem:…”

EEG-Based Brain-Computer Interfaces Are Vulnerable to Backdoor Attacks

“…Adversarial attacks to EEG-based BCIs have been explored in our previous studies 27,28,33,40 . All of them were evasion attacks.…”

“…They successfully attacked three convolutional neural network (CNN) classifiers in three different applications [P300 evoked potential detection, feedback error-related negativity (ERN) detection, and motor imagery (MI) classification]. Meng et al 33 further confirmed the existence of adversarial examples in two EEG-based BCI regression problems (driver fatigue estimation, and reaction time estimation in the psychomotor vigilance task), which successfully changed the regression model's prediction by a user-specified amount. More recently, Zhang et al 28 also showed that P300 and steady-state visual evoked potential (SSVEP) based BCI spellers can be easily attacked: a tiny perturbation to the EEG trial can mislead the speller to output any character the attacker wants.…”

Saga: Sparse Adversarial Attack on EEG-Based Brain Computer Interface

“…Another method, iFGSM [12], strengthens the adversarial attack by iteratively applying the FGSM. One recent study [10] has shown that these two methods can also attack deep learning models for EEG analytics. However, it assumes attacking all channels and all time steps simultaneously and cannot work effectively under sparsity constraints that attacking only a small portion of channels and time steps.…”

“…Such wide applications of EEG analytics motivate the investigation of their robustness and reliability. One initial study [10] shows that adversarial attacks from the computer vision domain, such as FGSM [11] and iFGSM [12], can also dramatically change the outputs of EEG models by introducing perturbations on the EEG data. This approach assumes a strong Fig.…”