# On the Vulnerability of CNN Classifiers in EEG-Based BCIs

## TL;DR

This paper reveals the vulnerability of CNN classifiers in EEG-based BCIs to adversarial attacks, demonstrating the effectiveness of a new unsupervised attack method and transferability of adversarial examples, highlighting security concerns.

## Contribution

It introduces the first study on CNN vulnerability in EEG-based BCIs and proposes an unsupervised attack method demonstrating transferability of adversarial examples.

## Key findings

- UFGSM effectively fools CNN classifiers in BCIs
- Adversarial examples transfer across models without knowing architecture
- Highlights security risks in EEG-based BCI systems

## Abstract

Deep learning has been successfully used in numerous applications because of its outstanding performance and the ability to avoid manual feature engineering. One such application is electroencephalogram (EEG) based brain-computer interface (BCI), where multiple convolutional neural network (CNN) models have been proposed for EEG classification. However, it has been found that deep learning models can be easily fooled with adversarial examples, which are normal examples with small deliberate perturbations. This paper proposes an unsupervised fast gradient sign method (UFGSM) to attack three popular CNN classifiers in BCIs, and demonstrates its effectiveness. We also verify the transferability of adversarial examples in BCIs, which means we can perform attacks even without knowing the architecture and parameters of the target models, or the datasets they were trained on. To our knowledge, this is the first study on the vulnerability of CNN classifiers in EEG-based BCIs, and hopefully will trigger more attention on the security of BCI systems.