Professor X: Manipulating EEG BCI with Invisible and Robust Backdoor Attack

## Abstract

Abstract While electroencephalogram (EEG) based brain-computer interface (BCI) has been widely used for medical diagnosis, health care, and device control, the safety of EEG BCI has long been neglected.
In this paper, we propose Professor X , an invisible and robust “mind-controller” that can arbitrarily manipulate the outputs of EEG BCI through backdoor attack, to alert the EEG community of the potential hazard.
However, existing EEG attacks mainly focus on single-target class attacks, and they either require engaging the training stage of the target BCI, or fail to maintain high stealthiness.
Addressing these limitations, Professor X exploits a three-stage clean label poisoning attack: 1) selecting one trigger for each class; 2) learning optimal injecting EEG electrodes and frequencies strategy with reinforcement learning for each trigger; 3) generating poisoned samples by injecting the corresponding trigger’s frequencies into poisoned data for each class by linearly interpolating the spectral amplitude of both data according to previously learned strategies.
Experiments on datasets of three common EEG tasks
demonstrate the effectiveness and robustness of Professor X, which also easily bypasses existing backdoor defenses.

## 1 Introduction

Electroencephalogram (EEG) is a neuroimaging technology to record of the spontaneous electrical activity of the brain. EEG-based brain-computer interface (BCI) has been widely used in medical diagnosis (Ahmad et al., ), healthcare (Jafari et al., ), and device control (Lorach et al., ; Altaheri et al., ).
While most EEG community researchers devote themselves to advancing the performance of EEG BCI, the safety of EEG BCI has long been neglected.
Inspired by Professor X(^1^11[https://en.wikipedia.org/wiki/Professor_X](https://en.wikipedia.org/wiki/Professor_X)), a superhuman with the ability to control other’s minds, we wonder whether a malicious adversary can arbitrarily manipulate the outputs of EEG BCI like him. It will be severely dangerous if so.
Backdoor attack (BA), where an adversary injects a backdoor into a model to control its outputs for inference samples with a particular trigger, offers a feasible approach (Doan et al., ).

However, designing an effect and stealthy BA for EEG modality is not trivial for three difficulties, resulting in three questions.
D1: Low signal-to-noise ratio (SNR) and heterogeneity in EEG format (i.e., the montage and sampling rate of EEG recordings) are major obstacles. Q1: How to develop a generalizable BA for various EEG tasks (usually have different EEG formats)?
D2: Previous studies demonstrated for different EEG tasks, different critical EEG electrodes and frequencies strongly related to the performance of EEG BCI (Parvez & Paul, ; Jana & Mukherjee, ; Baig et al., ; Herman et al., ), indicating that the trigger-injection strategy (i.e., which electrodes and frequencies to inject triggers) inevitably affects the performance of BA.
Q2: How to find the optimal strategy for different EEG tasks?
D3: Certain classes of EEG have specific morphology that can easily be identified by human experts, e.g., in epilepsy detection, the EEG during the ictal phase contains more spike/sharp waves than those during the normal state phase (Blume et al., ).
Q3: How to maintain the consistency of the label and the morphology?

Figure: Figure 1: (a)-(c) The framework of Professor X: (a) The trigger selection and EEG data distribution from the view of manifold learning. (b) Learning optimal electrodes and frequencies injection strategies. (c) The generation process. (d) The payloads of the existing backdoor attacks. (e) The payloads of Professor X, which can arbitrarily manipulate the outputs of EEG BCI models.
Refer to caption: x1.png

The first BA for EEG modality is demonstrated in Fig 1 (d), where the narrow period pulse (NPP) signals are added as the trigger for single-target class attacks (Meng et al., ; Jiang et al., ).
To generate invisible triggers, the adversarial loss is applied to learn a spatial filter as the trigger function (Meng et al., ).
Recently, some BA for time series (EEG signal is a kind of time series) adopt generative adversarial net (GAN) to produce poisoned data (Ding et al., ; Jiang et al., ).
However, there is rich information in the frequency domain of EEG (Arroyo & Uematsu, ; Kostyunina & Kulikov, ; Salinsky et al., ; Muthukumaraswamy, ). No matter whether these BA are stealthy or not, they all inject unnatural perturbation in the temporal domain, which will inevitably bring unnatural frequency into the real EEG frequency domain.

In this paper, we propose a novel backdoor attack framework Professor X to address Q1, which injects triggers in the frequency domain and is generalizable to various EEG tasks.
Specifically, Professor X is a three-stage clean label poisoning attack demonstrated in Fig 1 (a-c):
1): selecting $c$ triggers from $c$ classes.
Since these triggers is all real EEG, their frequency are all real, the poisoned EEG (injected with triggers’ frequency) is real, as shown in Fig 2(b).
2): learning optimal injecting strategy for each trigger with reinforcement learning to enhance the performance of EEG BA, addressing Q2.
3): generating poisoned data by injecting each trigger’s frequency into clean data whose class is the same as the trigger’s class, which does not introduce any unreal frequency from other EEG types and maintains the consistency of the label and morphology, addressing Q3.

The main contributions of this paper are summarized below:

- •
We propose a novel backdoor attack for EEG BCI called Professor X, which can attack arbitrary class while preserving stealthiness without engaging the training stage.
- •
To the best of our knowledge, it is the first work that considers the efficacy of different EEG electrodes and frequencies in EEG backdoor attacks.
- •
Extensive experiments on three EEG BCI datasets demonstrate the effectiveness of Professor X and the robustness against several common preprocessing and backdoor defenses.

## 2 Related Work

### 2.1 Backdoor Attacks

Backdoor attacks has been deeply investigated in image processing filed (Weber et al., ; Yu et al., ; Yuan et al., ).
BadNets (Gu et al., ) is the first BA, where the adversary maliciously control models to misclassify the input images contain suspicious patches to a target class.
Other non-stealthy attacks include blended (Chen et al., ) and sinusoidal strips based (Barni et al., ).
To achieve higher stealthiness, some data poisoning BA were developed, including shifting color spaces (Jiang et al., ), warping (Nguyen & Tran, ), regularization (Li et al., ) and frequency-based (Zeng et al., ; Wang et al., ; Hammoud & Ghanem, ; Hou et al., ; Feng et al., ; Gao et al., ).
Other stealthy attacks (Nguyen & Tran, ; Doan et al., ) generate invisible trigger patterns by adversarial loss, which requires the control of the model’s training process.
To attack multi-target class with high stealthiness, Marksman backdoor (Doan et al., ) generates sample-specific triggers by co-training target model and trigger generation model, needing fully control of the training stage. Moreover, generating trigger patterns with a neural network for each sample is time-consuming and unable to use in real-time systems.

### 2.2 Backdoor Attacks for EEG BCI

Figure: Figure 2: t-SNE visualization.
Refer to caption: x2.png

Recently, the EEG-based BCIs have shown to be vulnerable to BA (Meng et al., ; Jiang et al., ; Meng et al., ).
The NPP signals are added to clean EEG to generate non-stealthy poisoned samples in (Meng et al., ; Jiang et al., ), which significantly modifies the spectral distribution (as shown in Fig 2 (a)) and results in low stealthiness.
From the view of manifold learning in Fig 1 (a), NPP-added EEG are fake data.
To generate more stealthy poisoned data which stay in the real data boundary.
The adversarial loss has been applied backdoor EEG BCI (Meng et al., ) and time series (Ding et al., ; Jiang et al., ), but these methods require controlling the training process of the backdoor models and can only attack a single target class.
Meng et.al. tried to achieve multi-target attacks with adding different types of signals to clean EEG, i.e., NPP, sawtooth, sine, and chirp (Meng et al., ).
However, these signals are not stealthy in both the temporal and frequency domain.

Different from the EEG BA in the temporal domain, we firstly propose to attack in the frequency domain.
Our attack is 1) more stealthy than NPP-based attack, 2) faster than other trigger generation attack, and 3) more practical as requiring no control of the target models.
It is worth noting that the frequency-based BA for image cannot be applied for time series, as they do not consider the characteristics of time series and fail to maintain the stealthiness for poisoned time series data.

### 2.3 Backdoor Defenses

To cope with the security problems of backdoor attacks, several categories of defensive methods have been developed.
Neural Cleanse (Wang et al., ) is a trigger reconstruction based methods.
If the reconstructed trigger pattern is significantly small, the model is identified as a backdoor model.
Assuming the trigger is still effective when a triggered sample is combining with a clean sample, STRIP (Gao et al., ) detects the backdoor model by feeding the combined samples into the model to see if the predictions are still with low entropy.
Spectral Signature (Tran et al., ) detects the backdoor model based on the latent representations.
Fine-Pruning (Liu et al., ) erases the backdoor by pruning the model.

Besides the above defenses designed for backdoor attacks, there are some common EEG pre-processing methods, such as bandstop filtering and down-sampling, should be considered when designing a practical robust backdoor attack for EEG BCI in the real-world scene.

## 3 Methodology

### 3.1 EEG BCI Backdoor Attacks and Threat Model

Multi-target BA. Under the supervised learning setting, a classifier $f$ is learned using a labeled training set $\mathcal{S}=\{(x_{1},y_{1}),...,(x_{N},y_{N})\}$ to map $f:\mathcal{X}\rightarrow\mathcal{C}$, where $x_{i}\in\mathcal{X}$ and $y_{i}\in\mathcal{C}$.
The attacker in single target class backdoor attacks aims to learn a classifier $f$ behaves as follows:

$$ $\displaystyle f(x_{i})=y_{i},\ \ f(T(x_{i}))=c_{tar},\ \ c_{tar}\in\mathcal{C} ,\ \forall(x_{i},y_{i})\in\mathcal{S},$ (1) $$

where $T:\mathcal{X}\rightarrow\mathcal{X}$ is the trigger function and $c_{tar}$ is the target label.
For multi-target class backdoor attacks, the trigger function has an extra parameter $c_{i}$, which manipulates the behavior of $f$ flexibly:

$$ $\displaystyle f(x_{i})=y_{i},\ \ f(T(c_{i},x_{i}))=c_{i},\ \ \forall c_{i}\in \mathcal{C},\forall(x_{i},y_{i})\in\mathcal{S}.$ (2) $$

Threat Model. We consider a malicious data provider, who generates a small number of poisoned samples (labeled with the target class) and injects them into the original dataset. A victim developer collects this poisoned dataset and trains his model, which will be infected a backdoor.

### 3.2 Reinforcement Learning for Optimal Trigger-Injection Strategies

The learning of the injecting electrodes set $\mathcal{M}_{e}^{c_{i}}$ and frequencies set $\mathcal{M}_{f}^{c_{i}}$ for each selected trigger in class $c_{i}$ can be formulated as a non-convex optimization problem.
Under this optimization framework, the strategy generator function learn the optimal $\mathcal{M}_{e}^{c_{i}}$ and $\mathcal{M}_{f}^{c_{i}}$ for each EEG trigger to implement Professor X on target EEG BCI $f$, which is supposed to have a high clean accuracy (CA) on the clean data and attack success rate (ASR) on the poisoned data:

$$ $\displaystyle\mathop{\arg\min}\limits_{\mathcal{M}_{e}^{c_{i}},\mathcal{M}_{f} ^{c_{i}}}\mathbb{E}_{(x_{i},y_{i})\sim\mathcal{D}}[\mathcal{L}(f(x_{i}),y_{i}) +\lambda\mathcal{L}(f(\mathcal{T}(x_{i},x_{c_{i}}^{t},\alpha,\mathcal{M}_{e}^{ c_{i}},\mathcal{M}_{f}^{c_{i}})),c_{i})],$ (3) $$

Figure: Algorithm 1 Professor X’s Strategy Optimization

where $\lambda$ is a hyper-parameter to balance CA and ASR, and $\mathcal{T}$ is the poisoned data generation function.
However, it is infeasible to find the optimal injecting strategy for each trigger in a large searching space, e.g., if injecting half of the 62 electrodes, there are $\tbinom{62}{31}\approx 4.65\times 10^{17}$ cases for deciding $\mathcal{M}_{e}^{c_{i}}$.
Reinforcement learning (RL) is an appropriate method, whose objective of RL is to find a sampler $\pi$ to maximize the expect of the reward function. The details are presented in Algorithm 1.

$$ $\displaystyle\pi^{*}$ $\displaystyle={\arg\max}_{\pi}\mathbb{E}_{\tau\sim\pi(\tau)}[R(\tau)]$ (4) $\displaystyle={\arg\max}_{\pi}\sum\nolimits_{\tau}[R(\tau)\cdot p_{\pi}(\tau)]$ $\displaystyle={\arg\max}_{\pi}\sum\nolimits_{\tau}[R(\tau)\cdot\rho_{0}(s_{1})\cdot$ $\displaystyle\prod\nolimits_{t=1}^{T-1}\pi(a_{t}|s_{t})\cdot\mathcal{P}(s_{t+1 }|s_{t},a_{t})],$ $$

where $R(\tau)$ is reward function of a trajectory $\tau=(s_{1},a_{1},r_{1},....s_{T})$, the $s_{i},a_{i},r_{i}$ means the state, action, and reward at time $i$. The $\rho_{0}$ indicates the sampler of initial state.
In our settings, the action (strategy) do not affect the state (trigger), which allows us to simplify Eq 4 by removing the states $s_{i}$:

$$ $\displaystyle\pi^{*}={\arg\max}_{\pi}\sum\nolimits_{\tau}[R(\tau)\cdot\prod \nolimits_{t=1}^{T-1}\pi(a_{t})].$ (5) $$

Furthermore, since only a particular strategy of each trigger matters, we replace the $R(\tau)$ with $R(a_{t})$ and select the $a_{t}$ whose $R(a_{t})$ is the biggest as the optimal strategy.
Here, an RL algorithm called policy gradient (Sutton et al., ) is adopted to learn an agent (i.e., policy network $\pi_{\theta}^{c_{i}}$ with parameters $\theta$) to find the optimal strategy for each trigger from class $c_{i}$.
After removing the state $s_{t}$ and replacing $R(\tau)$, the gradient estimator is:

$$ $\displaystyle\hat{g}=\nabla_{\theta}\mathbb{E}_{\tau\sim{\pi_{\theta}}(\tau)}[ R(\tau)]=\sum\nolimits_{\tau}[R(a_{t})\cdot\nabla p_{\pi_{\theta}}(a_{t})]={ \mathbb{E}}_{t}[R_{t}(a_{t})\cdot\nabla_{\theta}\log\pi_{\theta}],$ (6) $$

where $a_{t}$ and $R_{t}$ is the action and estimator of the reward function at timestep $t$.
The expectation ${\mathbb{E}}_{t}$ indicates the empirical average.
Here, $a_{t}=\{\mathcal{M}_{e}^{c_{i}},\mathcal{M}_{f}^{c_{i}}\}$.
The parameters of $\pi_{\theta}^{c_{i}}$ are updated by $\theta_{t+1}=\theta_{t}+\eta\hat{g}$, $\eta$ is the learning rate. We run the RL for $K$ steps and take the best $a_{t}$ as the strategy.

Specifically, the agent has two output vectors $v_{1}\in\mathbb{R}^{E},v_{2}\in\mathbb{R}^{F}$, where $E$ and $F$ is the number of EEG electrodes and frequencies.
The electrodes and frequencies are in $\mathcal{M}_{e}^{c_{i}}$ and $\mathcal{M}_{f}^{c_{i}}$ only if the corresponding positions in $v_{1}$ and $v_{2}$ have Top-k values, $k$ is $\gamma E$ for electrodes and $\beta F$ for frequencies,
where $\gamma,\beta\in(0,1]$ are hyperparameters.

Besides the CA and ASR, two other important concerns should be considered: C1: Robustness against common EEG preprocessig-based defenses.
For instance, if a BA’s trigger is injected into frequency band 50-60Hz, the BA will fail when EEG is filtered by a 50Hz low pass filter.
Thus, scattering the injection positions in various frequency can effectively evade from specific frequency filter preprocessing.
C2: Stealthiness against human perceptions. Since high frequency are related to environmental noise, injecting higher frequencies is more invisible (Gliske et al., ).
Therefore, we design two novel loss functions to address C1 and C2, DIS for scattering injection positions and HF for injecting higher frequencies.
The whole reward function $R_{t}$ can be formulated follows:

$$ $\displaystyle R_{t}(a_{t})=R_{t}(\mathcal{M}_{e}^{c_{i}},\mathcal{M}_{f}^{c_{i }})=\mathrm{CA}+\lambda\ \mathrm{ASR}+\mu\ \mathrm{dis}(\mathcal{M}_{f}^{c_{i} })+\nu\min(\mathcal{M}_{f}^{c_{i}}),$ (7) $$

where the $\mathcal{M}_{f}^{c_{i}}$ indicates the set of all injecting frequency positions, and $\mathrm{dis}()$ calculates the minimal distance between each pair of positions.
Thus, $\mathrm{dis}(\mathcal{M}_{f}^{c_{i}})$ is the discrete (DIS) loss, and $\min(\mathcal{M}_{f}^{c_{i}})$ is the high frequency (HF) loss, which can scatter the injection positions in various frequency bands and inject as high frequencies as possible. The $\lambda,\mu,\nu\in\mathbb{R}$ are hyperparameters.

### 3.3 Poisoned Data Generation in the Frequency Domain

Figure: Algorithm 2 Frequency Injection of Professor X: $\mathcal{T}(x,x_{c}^{t},\alpha,\mathcal{M}_{e}^{c},\mathcal{M}_{f}^{c})$

After selecting the C triggers from each class and learning the strategy for each trigger, the poisoned data are generated by injecting these triggers into clean data with the corresponding strategies.
As shown in Fig 1(c), given a clean data $x_{i}\in\mathcal{D}_{p}$ with label $c_{i}$, and a trigger data $x_{c_{i}}^{t}$, let $\mathcal{F}^{A}$ and $\mathcal{F}^{P}$ be the amplitude and phase components of the fast Fourier
transform (FFT) result of a EEG signals, we denote the amplitude and phase spectrum of $x_{i}$ and $x_{c_{i}}^{t}$ as:

$$ $\displaystyle\mathcal{A}_{x_{i}}=\mathcal{F}^{A}(x_{i}),\mathcal{A}_{x_{c_{i}} ^{t}}=\mathcal{F}^{A}(x_{c_{i}}^{t}),$ (8) $\displaystyle\mathcal{P}_{x_{i}}=\mathcal{F}^{P}(x_{i}),\mathcal{P}_{x_{c_{i}} ^{t}}=\mathcal{F}^{P}(x_{c_{i}}^{t}).$ $$

The new poisoned amplitude spectrum $\mathcal{A}_{x_{i}}^{P}$ is produced by linearly interpolating $\mathcal{A}_{x_{i}}$ and $\mathcal{A}_{x_{c_{i}}^{t}}$.
In order to achieve this, we produce a binary mask $\mathcal{M}^{c_{i}}\in\mathbb{R}^{E\times F}=1_{(j,k)},j\in\mathcal{M}_{e}^{c_
{i}},k\in\mathcal{M}_{f}^{c_{i}}$, whose value is 1 for all positions corresponding to elements in both electrode and frequency strategies and 0 elsewhere.
Denoting $\alpha\in(0,1]$ as the linear interpolating ratio, the new poisoned amplitude spectrum can be computed as follows, where $\odot$ indicates Hadamard product:

$$ $\displaystyle\mathcal{A}_{x_{i}}^{P}=$ $\displaystyle[(1-\alpha)\mathcal{A}_{x_{i}}+\alpha\mathcal{A}_{x_{c_{i}}^{t}}] \odot\mathcal{M}^{c_{i}}+\mathcal{A}_{x_{i}}\odot(1-\mathcal{M}^{c_{i}}).$ (9) $$

Finally, we adopt the injected poisoned amplitude spectrum $\mathcal{A}_{x_{i}}^{P}$ and the clean phase spectrum $\mathcal{P}_{x_{i}}$ to get the poisoned data by inverse FFT $\mathcal{F}^{-1}$:
$x_{i}^{p}=\mathcal{F}^{-1}(\mathcal{A}_{x_{i}}^{P},\mathcal{P}_{x_{i}}).$
The detailed procedure is written in Algorithm 2.
By generating $x_{i}^{p}$ through this frequency injection approach, we obtain a subset $\mathcal{S}_{p}=\{x_{1}^{p},...,x_{M}^{p}\}$, which will combine with $\mathcal{D}_{train}$ to form the whole traing dataset $\mathcal{S}$. The EEG BCI model $f$ is then trained with $\mathcal{S}$ to obtain the ability of behvaing as equation 2.

## 4 Experiment Settings

### 4.1 Datasets

We demonstrate the effectiveness and generalizability of the proposed Professor X backdoor through comprehensive experiments on three EEG datasets. Some meta information is displayed in Table 1, where can be seen that these datasets vary significantly in tasks, electrode numbers, montages, and sampling rates. More details about preprocessing are illustrated in Appendix C. Our goal is to develope a task-agnostic and format-agnostic BA method for EEG BCI. Hence, these elaborately chosen datasets can effectively validate the generalizability of each BA method.

**Table 1: Meta information of the three datasets**
| Dataset | # Class | # Subject | # Electrode | Sampling Rate | Montage |
| --- | --- | --- | --- | --- | --- |
| Emotion Recognition | 3 | 15 | 62 | 200 Hz | unipolar |
| Motor Imagery | 4 | 9 | 22 | 250 Hz | unipolar |
| Epilepsy Detection | 4 | 23 | 23 | 256 Hz | bipolar |

Emotion Recognition (ER) Dataset. SEED (Zheng & Lu, ) is a discrete EEG emotion dataset studying three types of emotions: happy, neutral, and sad.
SEED collected EEG from 15 subjects.
The EEG is recorded while the subjects were watching emotional videos.

Motor Imagery (MI) Dataset. BCIC-IV-2a (Brunner et al., ) dataset recorded EEG from 9 subjects while they were instructed to imagine four types of movements: left hand, right hand, feet, and tongue.

Epilepsy Detection (ED) Dataset. CHB-MIT (Shoeb & Guttag, ) is an epilepsy dataset required from 23 patients.
We cropped and resampled the CHB-MIT dataset to build an ED dataset with four types of EEG: ictal, preictal, postictal, and interictal phase EEG.

### 4.2 Baselines

Non-stealthy Baselines.
As mentioned in previous sections, to the best of our knowledge, Professor X is the first work that studies multi-trigger and multi-target class (MT) backdoor in EEG BCI.
For comparison, we design several baseline approaches which can be divided into two main groups: non-stealthy and stealthy.
Non-stealthy attacks contains PatchMT and PulseMT.
For a benign EEG segment $x\in\mathbb{R}^{E\times T}$.
PatchMT is a multi-trigger and MT extension of BadNets (Gu et al., ) where we fill the first $\beta T$ timepoints of a EEG segments with a constant number, e.g., {0.1, 0.3, 0.5} for three-class task.
PulseMT is a multi-trigger and MT extension of NPP-based backdoor attacks (Meng et al., ) where we use NPP signals with different amplitudes, e.g., {-0.8, -0.3, 0.3, 0.8} for different target classes.

Stealthy Baselines.
Previous works generate stealthy poisioned samples by controlling the training stage and can only attack single target class (Meng et al., ; Ding et al., ; Jiang et al., ).
As they control the training of target model, it is unfair to directly compare their methods with Professor X.
There is no stealthy MT BA for EEG.
Thus, we design two MT stealthy attacks baselines: CompMT and AdverMT.
CompMT generates poisoned samples for different target classes by compressing the amplitude of EEG with different ratios, e.g., {-0.1, 0, 0.1} for three-class task.
AdverseMT is a multi-trigger and MT extension of adversarial filtering based attacks (Meng et al., ), where we using a local model trained only on $\mathcal{S}_{p}$ to generate different spatial filters $\textbf{W}^{*}_{i}$ for different target classes, then we apply these spatial filters to generate poisoned samples. More details are written in Appendix D.

### 4.3 Experimental Setup

We follow the poisoning attack setting as the previous works (Meng et al., ) and consider three widely-used EEG BCIs for classifier $f$: EEGNet (Lawhern et al., ), DeepCNN (Schirrmeister et al., ), and LSTM (Tsiouris et al., ).
We use a cross-validation setting to evaluate all BAs, each EEG dataset $\mathcal{D}$ is divided into three parts: training set $\mathcal{D}_{train}$, poisoning set $\mathcal{D}_{p}$, and test set $\mathcal{D}_{test}$.
Specifically, for a dataset contains $n$ subjects,
we select one subject’s data as $\mathcal{D}_{p}$ one by one, and the remaining $n-1$ subjects to perform leave-one-subject-out (LOSO) cross-validation, i.e., one of the subjects as $\mathcal{D}_{test}$, and the remaining $n-2$ subjects as $\mathcal{D}_{train}$ (one of the subjects in $\mathcal{D}_{train}$ is chosen to be validation set).
In summary, for a dataset contains $n$ subjects, there are $n(n-1)$ runs to validate each EEG BCI backdoor attack method.
A poisoned subset $\mathcal{S}_{p}$ of $M$ ($M<N$) examples is generated based on $\mathcal{D}_{p}$.
Then $\mathcal{S}_{p}$ is combined with $\mathcal{D}_{train}$ to acquire $\mathcal{S}=\{\mathcal{S}_{p},\mathcal{D}_{train}\}$. The poisoning ratio is defined as : $\rho=M/N$.

For all methods, we train the classifiers using the Adam optimizer with learning rate of 0.001. The batch size is 32 and the number of epochs is 100.
For all datasets and baselines, the interpolating ratio $\alpha=$ 0.8, the frequency poisoning ratio $\beta=$ 0.1, the electrode poisoning ratio $\gamma=$ 0.5.
For the reinforcement learning, we train $\pi_{\theta}$ networks $K=250$ epochs using the Adam optimizer with learning rate of 0.01.
The hyperparameters in advantage function is set to $\lambda=2$, $\mu=0.3$, and $\nu=0.005$.
More details of the experimental setup can be found in Appendix D.

## 5 Experimental Results

### 5.1 Effectiveness of Professor X

This section presents the attack success rates of Professor X and baselines.
To evaluate the performance in the multi-trigger multi-payload scenario, for each test sample $(x,y)\in\mathcal{D}_{test}$, we enumerate all possible target labels $c_{i}\in\mathcal{C}$ including the true label $y$ and inject the trigger to activate the backdoor.
The attack is successful only when the backdoor classifier $f$ correctly predicts $c_{i}$ for each poisoned input $x$ with a target label $c_{i}$.

#### 5.1.1 Attack Performance

The CA (Clean) and ASR (Attack) for each class of all attack methods on three EEG tasks with three EEG BCI models are presented in Table 2.
The AdverMT, designed for single-target attack, fails to attacks multiple target classes.
While PulseMT achieves the second best on ER and ED dataset, CompMT achieves the second best on the MI dataset, indicating that these baselines are less generalizable.
Our Professor X significantly outperforms baselines at almost all cases ($p<0.05$) except attacking DeepCNN on the ED dataset, having ASRs above 0.8 on three datasets and even achieving an ASR of 1.000 on the MI dataset.
These results demonstrate that our Professor X is effective across different EEG tasks and EEG models, showcasing it’s generalizability.

**Table 2: The clean accuraciy and attack success rate for each target class with 40% poisoning rate. The best results are in bold and the second best are underlined.**
|  | Dataset | Emotion Recognition | Motor Imagery | Epilepsy Detection |  |  |  |  |  |  |  |  |  |  |  |  |  |  |
| --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- |
|  | Method | Clean | ASR | 0 | 1 | 2 | Clean | ASR | 0 | 1 | 2 | 3 | Clean | ASR | 0 | 1 | 2 | 3 |
| EEGNet | No Attack | 0.477 | 0.333 | - | - | - | 0.327 | 0.250 | - | - | - | - | 0.508 | 0.250 | - | - | - | - |
| PatchMT | 0.492 | 0.382 | 0.577 | 0.232 | 0.337 | 0.283 | 0.824 | 0.866 | 0.880 | 0.787 | 0.762 | 0.460 | 0.549 | 0.532 | 0.430 | 0.388 | 0.845 |  |
| PulseMT | 0.463 | 0.778 | 0.844 | 0.509 | 0.981 | 0.270 | 0.825 | 0.947 | 0.656 | 0.758 | 0.938 | 0.439 | 0.810 | 0.853 | 0.745 | 0.729 | 0.913 |  |
| CompMT | 0.443 | 0.385 | 0.099 | 0.377 | 0.678 | 0.269 | 0.865 | 0.530 | 0.997 | 0.983 | 0.948 | 0.437 | 0.547 | 0.261 | 0.280 | 0.714 | 0.933 |  |
| AdverMT | 0.457 | 0.334 | 0.276 | 0.330 | 0.396 | 0.257 | 0.243 | 0.316 | 0.192 | 0.230 | 0.235 | 0.413 | 0.250 | 0.326 | 0.264 | 0.200 | 0.210 |  |
| Professor X | 0.535 | 0.857 | 0.831 | 0.791 | 0.949 | 0.323 | 1.000 | 0.999 | 1.000 | 1.000 | 0.999 | 0.477 | 0.944 | 0.930 | 0.954 | 0.921 | 0.970 |  |
| DeepCNN | No Attack | 0.497 | 0.333 | - | - | - | 0.301 | 0.250 | - | - | - | - | 0.443 | 0.250 | - | - | - | - |
| PatchMT | 0.481 | 0.342 | 0.248 | 0.323 | 0.453 | 0.276 | 0.704 | 0.638 | 0.977 | 0.774 | 0.425 | 0.431 | 0.729 | 0.416 | 0.890 | 0.719 | 0.892 |  |
| PulseMT | 0.450 | 0.596 | 0.815 | 0.334 | 0.638 | 0.261 | 0.829 | 0.764 | 0.968 | 0.819 | 0.765 | 0.405 | 0.885 | 0.872 | 0.862 | 0.861 | 0.943 |  |
| CompMT | 0.461 | 0.427 | 0.473 | 0.473 | 0.336 | 0.286 | 0.887 | 0.638 | 0.982 | 0.946 | 0.980 | 0.446 | 0.538 | 0.196 | 0.466 | 0.571 | 0.918 |  |
| AdverMT | 0.367 | 0.388 | 0.298 | 0.453 | 0.412 | 0.245 | 0.247 | 0.320 | 0.221 | 0.196 | 0.240 | 0.396 | 0.275 | 0.354 | 0.218 | 0.227 | 0.301 |  |
| Professor X | 0.534 | 0.832 | 0.732 | 0.865 | 0.901 | 0.315 | 1.000 | 1.000 | 1.000 | 1.000 | 0.999 | 0.469 | 0.828 | 0.725 | 0.839 | 0.845 | 0.904 |  |
| LSTM | No Attack | 0.506 | 0.333 | - | - | - | 0.264 | 0.250 | - | - | - | - | 0.462 | 0.250 | - | - | - | - |
| PatchMT | 0.509 | 0.368 | 0.311 | 0.392 | 0.401 | 0.261 | 0.429 | 0.395 | 0.296 | 0.386 | 0.639 | 0.450 | 0.513 | 0.500 | 0.437 | 0.417 | 0.700 |  |
| PulseMT | 0.511 | 0.824 | 0.883 | 0.645 | 0.943 | 0.265 | 0.533 | 0.787 | 0.327 | 0.282 | 0.737 | 0.451 | 0.804 | 0.845 | 0.769 | 0.709 | 0.895 |  |
| CompMT | 0.484 | 0.490 | 0.272 | 0.269 | 0.929 | 0.260 | 0.548 | 0.219 | 0.511 | 0.523 | 0.940 | 0.455 | 0.435 | 0.194 | 0.217 | 0.490 | 0.840 |  |
| AdverMT | 0.367 | 0.415 | 0.472 | 0.453 | 0.321 | 0.239 | 0.271 | 0.308 | 0.215 | 0.247 | 0.312 | 0.432 | 0.268 | 0.367 | 0.232 | 0.198 | 0.275 |  |
| Professor X | 0.519 | 0.954 | 0.998 | 0.868 | 0.996 | 0.264 | 0.966 | 0.987 | 0.988 | 0.901 | 0.986 | 0.444 | 0.865 | 0.795 | 0.833 | 0.857 | 0.975 |  |

#### 5.1.2 Performance of the Reinforcement Learning: Policy Gradient

Displaying in Table 3, the performance of the policy gradient was compared with other common optimazation algorithms, including genetic algorithm (GA) (Katoch et al., ) and random selection (The search space is too large for performing grid search as explained in Section 3.2).
It can be observed that the policy gradient outperforms GA while only spending $16\%$ training time of GA.
We plot the learning curve of RL in Appendix F.3, which demonstrates that RL learns well strategies within 50 epochs, i.e., only trains 50 backdoor models and saves lots of time.
It is worth mentioning that the random algorithm achieves not bad results, proving that our methods can be applied without RL if some performance drop is acceptable.

**Table 3: Clean and attack performance with with different trigger search optimization algorithms, the poisoning rate is set to 10%. The target model is EEGNet.**
| Method<br>Dataset | Emotion | Motor Imagery | Epilepsy |  |  |  |  |  |  |
| --- | --- | --- | --- | --- | --- | --- | --- | --- | --- |
| Clean | Attack | Time $\downarrow$ | Clean | Attack | Time $\downarrow$ | Clean | Attack | Time $\downarrow$ |  |
| Random | 0.520 | 0.771 | - | 0.291 | 0.857 | - | 0.501 | 0.721 | - |
| Genetic Algorithm | 0.516 | 0.826 | 15.2h | 0.302 | 1.000 | 10.0h | 0.492 | 0.862 | 30.5h |
| Policy Gradient | 0.535 | 0.857 | 2.5h | 0.323 | 1.000 | 1.8h | 0.477 | 0.944 | 5.2h |

#### 5.1.3 Performance of Learned Mask Strategies on Other Target Models

We demonstrate that the injecting strategies learned on a EEG classifier $f$ can be used to attack other EEG classifiers $\hat{f}$.
In other words, Marksman can still be effective when the adversary has no knowledge of the target models $\hat{f}$. To perform the experiments, we use the strategy learned with a classifier $f$, then generate poisoned samples to attack another classifier $\hat{f}$ whose network is different from $f$. Table 4 shows the performance difference, it can be observed that the difference is relatively small in most of the cases, demonstrating the transferability of the injecting strategy learned with reinforcement learning.

**Table 4: Clean and attack performance on other models. Red values represent the decreasing performance in attacks with $f$ is the same as $\hat{f}$. Blue values mean increments or unchanged .**
| Models | $f$ : EEGNet | $f$ : DeepCNN | $f$ : LSTM |  |  |  |  |  |  |  |  |  |
| --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- |
| $\hat{f}$ : DeepCNN | $\hat{f}$ : LSTM | $\hat{f}$ : EEGNet | $\hat{f}$ : LSTM | $\hat{f}$ : EEGNet | $\hat{f}$ : DeepCNN |  |  |  |  |  |  |  |
| Datasets | Clean | Attack | Clean | Attack | Clean | Attack | Clean | Attack | Clean | Attack | Clean | Attack |
| Emotion | 0.458 | 0.781 | 0.485 | 0.938 | 0.516 | 0.813 | 0.490 | 0.936 | 0.516 | 0.863 | 0.497 | 0.779 |
| 0.026 | 0.051 | 0.034 | 0.016 | 0.019 | 0.044 | 0.029 | 0.018 | 0.019 | 0.006 | 0.037 | 0.053 |  |
| Motor | 0.316 | 1.000 | 0.265 | 0.946 | 0.309 | 1.000 | 0.264 | 0.972 | 0.306 | 1.000 | 0.306 | 1.000 |
| 0.001 | 0.000 | 0.001 | 0.020 | 0.014 | 0.000 | 0.000 | 0.006 | 0.017 | 0.000 | 0.009 | 0.000 |  |
| Epilepsy | 0.442 | 0.759 | 0.469 | 0.806 | 0.448 | 0.943 | 0.445 | 0.813 | 0.448 | 0.926 | 0.427 | 0.850 |
| 0.027 | 0.069 | 0.025 | 0.059 | 0.029 | 0.001 | 0.001 | 0.052 | 0.029 | 0.018 | 0.042 | 0.022 |  |

#### 5.1.4 Attack Performance with Different Hyperparameters

We investigate the influences of three different hyperparameters: poisoning rate $\rho$, frequency injection rate $\beta$, and electrode injection rate $\gamma$.
The performance of attacking EEGNet on the ED dataset are displayed in Fig 3. It can be seen that the ASRs are positively correlated with poisoning rate.
Note that it is non-trivial for multi-target class attack, thus the ASR is not high compared to the single class attack.
Professor X outperforms other attacks in all cases and is robust to the change of $\beta$ and $\gamma$.

Figure: Figure 3: Clean (/C) and attack (/B) performance with different poisoning or injection rates.
Refer to caption: x3.png

### 5.2 Robustness of Professor X

In this section, we evaluate the robustness of our Professor X against different EEG preprocessing method and various representative backdoor defenses.

#### 5.2.1 Robustness against EEG Preprocessing Methods

To develop an EEG BCI, it is very common to preprocess the raw EEG signals, e.g., 1) band-stop filtering and 2) down-sampling.
An EEG backdoor attack is impractical in real scenarios if it is no longer effective when the target model is trained with the preprocessed poisoned EEG.
Hence, we must take the robustness against preprocessing methods into account, which is widely ignored in the image backdoor attack field.
The performance of each method facing different preprocessing methods are presented in Table 5.
It can be observed that our Professor X is robust in all cases.
However, when removing the DIS loss, the performance of Professor X decreases a lot after EEG preprocessing, especially facing the 30 Hz high-stop filtering preprocessing due to the HF loss that encourages the policy network learns to injecting high frequency.

**Table 5: Clean and attack performance on three datasets after different EEG preprocessing methods. The target model is EEGNet. M w.o. DIS means removing the DIS loss in Professor X.**
|  | Preprocessing | No defense | 20 Hz low | 30 Hz high | 25% down | Average |  |  |  |  |
| --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- |
| Method | Clean | Attack | Clean | Attack | Clean | Attack | Clean | Attack | ASR |  |
| ER | Professor X | 0.535 | 0.857 | 0.512 | 0.829 | 0.463 | 0.892 | 0.518 | 0.908 | 0.876 |
| w/o DIS | 0.506 | 0.859 | 0.492 | 0.816 | 0.466 | 0.333 | 0.498 | 0.807 | 0.652 |  |
| MI | Professor X | 0.323 | 1.000 | 0.285 | 1.000 | 0.329 | 1.000 | 0.321 | 1.000 | 1.000 |
| w/o DIS | 0.298 | 1.000 | 0.264 | 1.000 | 0.322 | 0.250 | 0.284 | 0.990 | 0.746 |  |
| ED | Professor X | 0.497 | 0.944 | 0.492 | 0.914 | 0.494 | 0.856 | 0.516 | 0.818 | 0.920 |
| w/o DIS | 0.515 | 0.250 | 0.477 | 0.864 | 0.508 | 0.250 | 0.510 | 0.249 | 0.454 |  |

#### 5.2.2 Robustness against Neural Cleanse: Trigger Inversion

Figure: Figure 4: Anomaly Index of three models on three datasets.
Refer to caption: x4.png

Neural Cleanse (NC) (Wang et al., ) calculate a metric called Anomaly Index by reconstructing trigger pattern for each possible label.
The Anomaly Index is positively correlated with the size of the reconstruction trigger.
A model with Anomaly Index $>$ 2 is considered to be backdoor-injected.
We display the Anomaly Indexes of the clean models and the backdoor-injected model by Professor X in Fig 4. It can be seen that Professor X can easily bypass NC. The reconstructed trigger patterns on three datasets are presented in Appendix F.1.

#### 5.2.3 Robustness against STRIP: Input Perturbation

We evaluate the robustness of Professor X against STRIP (Gao et al., ), which perturbs the input EEG and calculates the entropy of the predictions of these perturbed EEG data. Based on the assumption that the trigger is still effective after perturbation, the entropy of backdoor input tends to be lower than that of the clean one. The results are plotted in Fig 5, it can be seen that the entropy distributions of the backdoor and clean samples are similar.

Figure: Figure 5: Performance against STRIP on three datasets, the target model is EEGNet.
Refer to caption: x5.png

#### 5.2.4 Robustness against Spectral Signature: Latent Space Correlation

Spectral Signature (Tran et al., ) detects the backdoor samples by statistical analysis of clean data and backdoor data in the latent space.
Following the same experimental settings in (Tran et al., ), we randomly select 5,000 clean samples and 500 Professor X backdoor samples and plot the histograms of the correlation scores in Fig 6.
There is no clear separation between these two sets of samples, showing the stealthiness of Professor X backdoor samples in the latent space.

Figure: Figure 6: Performance against Spectral Signature on three datasets, the target model is EEGNet.
Refer to caption: x6.png

#### 5.2.5 Robustness against Fine-Pruning

Figure: Figure 7: Performances of EEGNet against Fine-Pruning on three datasets.
Refer to caption: x7.png

We evaluate the robustness of Professor X against Fine-Pruning (Liu et al., ), a model analysis based defense which finds a classifier’s low-activated neurons given a small clean dataset. Then it gradually prunes these low-activated neurons to mitigate the backdoor without affecting the CA.
We can observe from Fig 7 that the ASR drops considerably small when pruning ratio is less than 0.7, suggesting that the Fine-Pruning is ineffective against Professor X.

### 5.3 Visualization of Backdoor Attack Samples

To evade from human perception (C2 in Section 3.2), we design to obatin injecting strategies with HF loss.
It can be seen from the bottom row of Fig 8 that Professor X (with HF loss) generates stealthy poisoned EEG, which is almost the same as the clean EEG, demonstrating the High Stealthiness.
The poisoned EEG will be conspicuous compared to the clean EEG if remove the HF loss.

Figure: Figure 8: The Clean EEG (Blue), Trigger-injected EEG (Orange) and the Residual (Red) of the ED dataset. The x-axis is the timepoints, the y-axis is the normalized amplitude. Top row: w/o HF loss; Bottom row: with HF loss. Each column indicates each possible class.
Refer to caption: x8.png

## 6 Conclusion

In this paper, we proposed Professor X, a novel EEG backdoor for manipulating EEG BCI, where the adversary can arbitrarily control the output for any input samples.
To the best of our knowledge, Professor X is the first method that considers which EEG electrodes and frequencies to be injected for different EEG tasks and formats.
We specially design the reward function in RL to enhance the robustness and stealthiness.
Experimental results showcase the effectiveness, robustness, and generalizability of Professor X.
This work alerts the EEG community of the potential danger of the vulnerability of EEG BCI against BA and calls for defensive studies for EEG modality. It is worth noting that Professor X can also be applied for protecting intellectual properties of EEG datasets and BCI models, offering a concealed and harmless approach to add authors’ watermark (backdoor can be regarded as watermark), indicating the real-world application of Professor X.

## Appendix A Limitations

Our Professor X is a backdoor attack in the frequency domain, which requires to transform the EEG signals into frequency domain through fast Fourier transform (FFT) and return to temporal domain through inverse FFT (iFFT).
The operation of FFT and iFFT in the trigger injection function are a little more time-consuming compared to other backdoor attack directly in the temporal domain, like PatchMT Gu et al. () and PulseMT Meng et al. (). Future effort will be devoted into the faster implementation of FFT and iFFT, for example, taking the advantage of modern GPUs.

It is a little more time-consuming for the reinforcement learning to acquire the optimal strategies for each trigger. However, we can obtain a general injecting strategy for each EEG BCI tasks, which can achieve a relatively good performance without reinforcement learning, as we can see from Table 4 that random injection strategy has an acceptable performance.

## Appendix B Broader Impacts

With the rapid development of techniques, EEG BCIs gain a wide range of applications from health care to human-computer interaction.
Some companies like Neuralink adopt the EEG BCI to assist paralytic patients helping themselves in daily lives.
However, if the EEG BCI is backdoor attacked by Professor X, which allows the attacker to arbitrarily control BCI’s outputs, the BCI users may fall into tremendous fatal troubles.
For instance, one paralytic patient controls his/her wheelchair by EEG BCI, the attacker can manipulate the wheelchair to run down a steep staircase.
For an epileptic patient, the attacker can let all the output be Normal State, even when the patient is experiencing an epileptic seizure.
This paper reveals the severe danger faced by EEG BCIs, demonstrating the possibility that someone can maliciously manipulate the outputs of EEG BCIs with arbitrary target class.

Professor X can also be used for positive purposes, like protecting intellectual property of EEG dataset and EEG models with watermarking. As our Professor X has a very small impact of the clean accuracy, and the poisoning approach is clean label poisoning, Professor X is a fantastic method for watermarking EEG dataset and models.

For a company that provides EEG dataset, it can select different EEG triggers for different customs to generate poisoned data and inject into the dataset provided to customs who buy the dataset. As a result, the company have the information of which trigger is corresponding to which customs, e.g., trigger x is in the dataset provided to custom X, trigger y is in the dataset provided to custom Y. If an EEG model from a company which didn’t buy dataset is detected having this watermark (backdoor) with trigger x, the company knows that the custom X leaked the dataset.
Similarly, if an EEG model is detected having this watermark (backdoor) with trigger y, the company knows that the custom Y leaked the dataset.

## Appendix C Datasets and Preprocessing

In this section, we introduce the three datasets used in our experiments, and explain the preprocessing. We elaborately selected these three datasets because of three reasons: 1) They cover three different EEG tasks that are important and common in EEG BCI field; 2) The EEG formats of these datasets vary significantly; 3) The EEG tasks are all multi class classification tasks, that is, the number of categories is more than two.
Experiments on these three datasets can validate the efficacy, manipulating performance, and generalizability of each BA methods as much as possible.

### C.1 Emotion Recognition (ER)

The SJTU Emotion EEG Dataset (SEED) was incoporated as the representative dataset of emotion recogniton tasks Zheng & Lu (). It consists of EEG recordings from 15 subjects watching 15 emotional video clips with three repeated session each on different days. Each video clip is supposed to evoke one of the three target emotions: positive, neutral, and negative. The EEG signals were acquired by the 62-channel electrode cap at a sampling rate of 1000 Hz. We performed below preprocessing procedures for the 62-channel EEG signals: 1) Down-sampling from 1000 Hz to 200 Hz, 2) Band-pass filtering at 0.3-50 Hz, 3) Segmenting EEG signals into 1-second (200 timepoints), obtaining 3394 EEG segments in each session for each subject.

### C.2 Motor Imagery (MI)

We employ the BCIC-IV-2a as a representative dataset of MI classification tasks Brunner et al. (). It contains EEG recordings in a four-class motor-imagery task from nine subjects with two repeated session each on different days. During the task, the subjects were instructed to imagine four types of movements (i.e., right hand, left hand, feet, and tongue) for four seconds. Each session consists of a total of 288 trials with 72 trials for each type of the motor imagery. The EEG signals were recorded by 22 Ag/AgCl EEG electrodes in a sampling rate of 250 Hz.
We segment the 22-channel EEG signals into 1-second segments, resulting in totally 1152 EEG data for each subject.

### C.3 Epilepsy Detection (ED)

The CHB-MIT, one of the largest
and most used public datasets for epilepsy, is adopted as a representative dataset of ED tasks Shoeb & Guttag (). It recorded 877.39 hours of multi-channel EEG in a sampling rate of 256 Hz from 23 pediatric patients with intractable seizures.
However, as the montages (i.e., the number and the places of electrodes) of EEG signals vary significantly among different subjects’ recordings, we select to use only the EEG recordings with the same 23 channels (see Appendix A) and discard other channels or the recordings don’t have all these 23 channels.
Due to the purpose is to test whether the backdoor attack works on the ED task, not to study the epilepsy EEG classification, we segment part of the CHB-MIT dataset to form a four-class ED dataset (i.e., the preictal, ictal, postictal, and interictal phases).
Specifically, for a ictal phase EEG recording of $t_{i}$ seconds from $[s_{i},e_{i}]$ timepoints, we segment the $[s_{i}-t_{i},e_{i}]$ EEG as the preictal phase, the $[e_{i},e_{i}+t_{i}]$ EEG as the postictal phase, and another $t_{i}$ seconds EEG recordings as the interictal phase which satisfying there is no ictal phase within half an hour before or after.
Then we segment the 23-channel EEG signals into 1-second segments,
consequently, there are 41336 segments left in total from all subjects, 10334 for each phase. As the imbalanced amount of data across different subjects, we separate these 41336 segments into 10 groups and treat the ten groups as 10 subjects.

## Appendix D Implementation Details

### D.1 Experiment Computing Resources

We use two servers for conducting our experiments. A server with one Nvidia Tesla V100 GPU is used for running reinforcement learning, the CUDA version is 12.3.
Another server with four Nvidia RTX 3090 GPUs is used for running the backdoor attacks, the CUDA version is 11.4.

### D.2 Details of Baseline Methods

In our Professor X backdoor attacks, for an EEG segment $x_{i}\in\mathbb{R}^{E\times T}$, we modify the $\beta F$ frequency-points and $\gamma E$ electrodes of a EEG segments with a constant number.

There are four baseline methods in our study for multi-target backdoor attacks, two of them are non-stealthy attacks (PatchMT and PulseMT) and two are stealthy attacks (CompressMT and AdverseMT).
In order to achieve a fair comparison, we modify only first $\gamma E$ electrodes for all baseline attack methods.
For the non-stealthy attacks, which are all on the temporal domains, we modify $\beta T$ timepoints of EEG signals.
For the stealthy attacks, there is no constraint of the numbers of the modify timepoints as these attacks achieve stealthiness in another way.

For each baseline method, we try our best to find out the best performance, as demonstrated below. We promise that we did not maliciously lower the performances of the baseline methods.

#### D.2.1 PatchMT

PatchMT is a multi-trigger and MT extension of BadNets Gu et al. () where we fill the first $\beta T$ timepoints and $\gamma E$ electrodes of a EEG segments with a constant number.
Specifically, for an EEG segment $x_{i}\in\mathbb{R}^{E\times T}$, we set the first $\gamma E$ electrodes and the first $\beta T$ timepoints of the EEG segment to a constant number.
We normalize the EEG segment $x_{i}\in\mathbb{R}^{E\times T}$ to let $\textbf{x}_{i}$’s mean is 0 and std is 1. Then set the first $\gamma E$ electrodes and the first $\beta T$ timepoints of $\textbf{x}_{i}$ to a different constant number for different class. The constant number for each class of $\{0,1,2,3\}$ for four classes, and {-0.1, 0.0, 1.0} for three classes. Finally, denormalize $\textbf{x}_{i}$ to original signal $x_{i}$’s scale to generate $x^{p}_{i}$.

Although we try our best to find the best performance of PatchMT, and BadNets Gu et al. () is really efficient in image backdoor attacks, PatchMT cannot have satisfactory results in EEG BCI attack.

#### D.2.2 PulseMT

For PulseMT, we met the same questions as the PatchMT: how to identify the amplitude of each NPP signal for each class? If the numbers are too large then normal EEG signals, it will be unfair. If the numbers are too small, the efficacy of PulseMT is too negative.

We normalize the EEG segment $x_{i}\in\mathbb{R}^{E\times T}$ to let $\textbf{x}_{i}$’s mean is 0 and std is 1. The constant amplitude for each class of $\{-0.8,-0.3,0.3,0.8\}$. Finally, denormalize $\textbf{x}_{i}$ to original signal $x_{i}$’s scale to generate $x^{p}_{i}$.

#### D.2.3 CompressMT

Compressing the amplitude of EEG signals in the temporal domain will not change the morphology and the frequency distribution of EEG signals, thus obtaining stealthiness.
For three-class Emotion datasets, the compress rate is {0.8, 0.6, 0.4}.
For four-class Motor Imagery and Epilepsy datasets, the compress rate is {0.8, 0.6, 0.4, 0.2}.

#### D.2.4 AdverseMT

AdverseMT is another stealthy EEG backdoor attacks, which is the multi-trigger and multi-target extension of adversarial spatial filter attacks Meng et al. (),
in wihch, for EEG segment $x_{i}\in\mathbb{R}^{E\times T}$, it learns an Spatial Filter $\textbf{W}\in\mathbb{R}^{E\times E}$ by the adversarial loss to let the model $f$ misclassify $x_{i}$:

$$ $\displaystyle\mathop{\min}_{\textbf{W}}\mathbb{E}_{(x_{i},y_{i})\sim\mathcal{D }}[-\mathcal{L}_{CE}(\textbf{W}x_{i},y_{i})+\alpha\mathcal{L}_{MSE}(\textbf{W} x_{i},x_{i})],$ (10) $$

However, the original version of Meng et al. () requires the access to all training dataset $\mathcal{D}$ and the control of the training process of the model $f$.
We modify the AdverseMT to only access to the training dataset $\mathcal{D}_{train}$.
Note that the adversarial loss dose not have the special design for multi-target backdoor attacks, we only run the process $c$ times for obtaining $c$ spatial filters for different classes.
So the poisoned subset are $\mathcal{S}_{p}=\{(\textbf{W}_{0}(x),0),(\textbf{W}_{1}(x),1),(\textbf{W}_{2}(
x),2),(\textbf{W}_{3}(x),3)\}$.

### D.3 Reinforcement Learning Policy Network Architecture

Here, we design a concise but effective convolutional neural networks as the our policy network, which is defined as belows:

**Table 6: The Architecture of Policy Network**
| Layer | In | Out | Kernel | Stride |
| --- | --- | --- | --- | --- |
| Conv2d | 1 | 32 | (1, 3) | (1, 1) |
| BatchNorm2d |  |  |  |  |
| ELU |  |  |  |  |
| AvgPool2d |  |  |  | (1,2) |
| Conv2d | 32 | 64 | (1, 3) | (1, 1) |
| BatchNorm2d |  |  |  |  |
| ELU |  |  |  |  |
| AvgPool2d |  |  |  | (1,2) |
| AdaptiveAvgPool2d |  |  |  | (1, 1) |
| Flatten |  |  |  |  |
| Linear | 64 | 256 |  |  |

### D.4 Target EEG BCIs’ Network Architecture

Three mostly-used EEG BCI models in real-world applications are investigated in our experiments, covering convolutional neural network (CNN) and recurrent neural network (RNN): 1) EEGNet (Lawhern et al., ), 2) DeepCNN (Schirrmeister et al., ), 3) LSTM Tsiouris et al. (). Below we detail the architecture of each network. The EEGNet and DeepCNN are almost the same as the original paper (modified a little for cross-subject setting), LSTM comprises an embedding layer, a one-layer LSTM and a linear classifiers.

EEGNet is a compact and concise convolutional network for EEG BCI, having been proven to be effective in a variety of EEG fields with only 3 convolutional layers. DeepCNN is a little bit deeper than EEGNet, which comprises 4 blocks, 5 convolutional layers in total. The LSTM written by us, as demonstrated in Table 9, is a very shallow network. Our goal is to develop a model-agnostic BA method for EEG modality.

**Table 7: The Architecture of EEGNet**
| Layer | Kernel | Input Size | Output Size |
| --- | --- | --- | --- |
| 16 $\times$ Conv1d | $(C,1)$ | $C\times T$ | $16\times 1\times T$ |
| BatchNorm |  | $16\times 1\times T$ | $16\times 1\times T$ |
| Transpose |  | $16\times 1\times T$ | $1\times 16\times T$ |
| Dropout | 0.25 | $1\times 16\times T$ | $1\times 16\times T$ |
| 4 $\times$ Conv2d | $(2\times 32)$ | $1\times 16\times T$ | $4\times 16\times T$ |
| BatchNorm |  | $4\times 16\times T$ | $4\times 16\times T$ |
| Maxpool2D | (2,4) | $4\times 16\times T$ | $4\times 8\times T/4$ |
| Dropout | 0.25 | $4\times 8\times T/4$ | $4\times 8\times T/4$ |
| 4 $\times$ Conv2d | $(8\times 4)$ | $4\times 8\times T/4$ | $4\times 8\times T/4$ |
| BatchNorm |  | $4\times 8\times T/4$ | $4\times 8\times T/4$ |
| Maxpool2D | (2,4) | $4\times 8\times T/4$ | $4\times 4\times T/16$ |
| Dropout | 0.25 | $4\times 4\times T/16$ | $4\times 4\times T/16$ |
| Softmax Regression |  | $4\times 4\times T/16$ | Class Number |

**Table 8: The Architecture of DeepCNN**
| Layer | Kernel | Input Size | Output Size |
| --- | --- | --- | --- |
| $F_{1}\times$ Conv1d | $(1,32)$ | $C\times T$ | $F_{1}\times C\times T$ |
| BatchNorm |  | $F_{1}\times 1\times T$ | $F_{1}\times 1\times T$ |
| $F_{1}\times$ Conv1d | $(C,1)$ | $F_{1}\times C\times T$ | $F_{1}\times 1\times T$ |
| BatchNorm |  | $F_{1}\times 1\times T$ | $F_{1}\times 1\times T$ |
| MaxPooling | (1,2) | $F_{1}\times 1\times T$ | $F_{1}\times 1\times T/2$ |
| Dropout | 0.25 | $F_{1}\times 1\times T/2$ | $F_{1}\times 1\times T/2$ |
| $F_{2}\times$ Conv2d | $(1\times 10)$ | $F_{1}\times 1\times T/2$ | $F_{2}\times 1\times T/2$ |
| BatchNorm |  | $F_{2}\times 1\times T/2$ | $F_{2}\times 1\times T/2$ |
| Maxpool2D | (1,2) | $F_{2}\times 1\times T/2$ | $F_{2}\times 1\times T/4$ |
| Dropout | 0.25 | $F_{2}\times 1\times T/4$ | $F_{2}\times 1\times T/4$ |
| $F_{3}\times$ Conv2d | $(1\times 10)$ | $F_{2}\times 1\times T/4$ | $F_{3}\times 1\times T/4$ |
| BatchNorm |  | $F_{3}\times 1\times T/4$ | $F_{3}\times 1\times T/4$ |
| Maxpool2D | (1,4) | $F_{3}\times 1\times T/4$ | $F_{3}\times 1\times T/16$ |
| Dropout | 0.25 | $F_{3}\times 1\times T/16$ | $F_{3}\times 1\times T/16$ |
| $F_{4}\times$ Conv2d | $(1\times 4)$ | $F_{3}\times 1\times T/16$ | $F_{4}\times 1\times T/16$ |
| BatchNorm |  | $F_{4}\times 1\times T/16$ | $F_{4}\times 1\times T/16$ |
| Maxpool2D | (1,4) | $F_{4}\times 1\times T/16$ | $F_{4}\times 1\times T/64$ |
| Dropout | 0.25 | $F_{4}\times 1\times T/64$ | $F_{4}\times 1\times T/64$ |
| Softmax Regression |  | $F_{4}\times 1\times T/64$ | Class Number |

**Table 9: The Architecture of LSTM, $n$ is the embedding size.**
| Layer | Input Size | Output Size |
| --- | --- | --- |
| Linear | $C\times T$ | $n\times T$ |
| ReLU |  |  |
| Linear | $n\times T$ | $n\times T$ |
| LSTM | $n\times T$ | $n\times T$ |
| Softmax Regression | $n\times T$ | Class Number |

## Appendix E Attack Performance of Professor X

### E.1 Different Poisoning Rates

We present the performance of each backdoor attacks’ performance under different poisoning rates in Table 10. We can see that our Professor X outperforms other baseline at all poisoning rates, demonstrating the superiority of Professor X. Note that the performance of Professor X on the MI dataset is significantly robust to low poisoning rates, i.e., ASR of 1.000 when $\rho=0.05$.

**Table 10: Clean (/C) and attack (/B) performance with different poisoning rates for Professor X and other baseline methods. The target model is EEGNet for all cases.**
| $\rho$ | Dataset | Emotion | Motor Imagery | Epilepsy |  |  |  |
| --- | --- | --- | --- | --- | --- | --- | --- |
| Method | Clean | Attack | Clean | Attack | Clean | Attack |  |
| 0.05 | PatchMT | 0.390 | 0.333 | 0.281 | 0.791 | 0.449 | 0.365 |
| PulseMT | 0.488 | 0.337 | 0.275 | 0.788 | 0.473 | 0.397 |  |
| ComprsMT | 0.448 | 0.313 | 0.269 | 0.754 | 0.449 | 0.329 |  |
| Professor X | 0.491 | 0.566 | 0.321 | 1.000 | 0.460 | 0.667 |  |
| 0.10 | PatchMT | 0.443 | 0.334 | 0.279 | 0.785 | 0.452 | 0.400 |
| PulseMT | 0.445 | 0.394 | 0.281 | 0.796 | 0.486 | 0.591 |  |
| ComprsMT | 0.509 | 0.323 | 0.270 | 0.778 | 0.446 | 0.337 |  |
| Professor X | 0.541 | 0.718 | 0.320 | 1.000 | 0.452 | 0.734 |  |
| 0.15 | PatchMT | 0.455 | 0.335 | 0.285 | 0.805 | 0.439 | 0.414 |
| PulseMT | 0.438 | 0.514 | 0.280 | 0.787 | 0.447 | 0.669 |  |
| ComprsMT | 0.488 | 0.332 | 0.275 | 0.792 | 0.461 | 0.374 |  |
| Professor X | 0.528 | 0.805 | 0.322 | 1.000 | 0.460 | 0.781 |  |
| 0.20 | PatchMT | 0.481 | 0.334 | 0.277 | 0.816 | 0.461 | 0.451 |
| PulseMT | 0.447 | 0.555 | 0.285 | 0.810 | 0.451 | 0.692 |  |
| ComprsMT | 0.470 | 0.347 | 0.270 | 0.795 | 0.458 | 0.394 |  |
| Professor X | 0.538 | 0.773 | 0.321 | 1.000 | 0.447 | 0.799 |  |
| 0.25 | PatchMT | 0.487 | 0.335 | 0.281 | 0.820 | 0.444 | 0.483 |
| PulseMT | 0.466 | 0.701 | 0.275 | 0.815 | 0.431 | 0.684 |  |
| ComprsMT | 0.493 | 0.335 | 0.269 | 0.800 | 0.462 | 0.427 |  |
| Professor X | 0.551 | 0.836 | 0.325 | 1.000 | 0.447 | 0.834 |  |
| 0.30 | PatchMT | 0.459 | 0.343 | 0.280 | 0.809 | 0.440 | 0.496 |
| PulseMT | 0.486 | 0.810 | 0.272 | 0.816 | 0.451 | 0.716 |  |
| ComprsMT | 0.499 | 0.331 | 0.269 | 0.825 | 0.455 | 0.481 |  |
| Professor X | 0.526 | 0.829 | 0.320 | 1.000 | 0.451 | 0.756 |  |
| 0.35 | PatchMT | 0.437 | 0.341 | 0.285 | 0.805 | 0.448 | 0.510 |
| PulseMT | 0.437 | 0.767 | 0.275 | 0.837 | 0.482 | 0.757 |  |
| ComprsMT | 0.473 | 0.347 | 0.265 | 0.851 | 0.446 | 0.517 |  |
| Professor X | 0.489 | 0.763 | 0.321 | 1.000 | 0.453 | 0.910 |  |
| 0.40 | PatchMT | 0.490 | 0.345 | 0.283 | 0.824 | 0.460 | 0.549 |
| PulseMT | 0.454 | 0.771 | 0.270 | 0.825 | 0.439 | 0.443 |  |
| ComprsMT | 0.464 | 0.361 | 0.269 | 0.865 | 0.437 | 0.450 |  |
| Professor X | 0.528 | 0.849 | 0.323 | 1.000 | 0.477 | 0.944 |  |

### E.2 Hyperparameter Analysis: Frequency and Electrodes Injection Ratio

We present the performance of each backdoor attacks performance under different rates in Table 11 and Table 12. It can be observed with the increment of $\beta$ and $\gamma$, the attack performance increases. Because the trigger is bigger in clean EEG data.

**Table 11: Clean (/C) and attack (/B) performance with frequency injection rate $\beta$, $\gamma=0.5$**
| $\beta$ | Dataset | Emotion | Motor Imagery | Epilepsy |  |  |  |
| --- | --- | --- | --- | --- | --- | --- | --- |
| Method | Clean | Attack | Clean | Attack | Clean | Attack |  |
| 0.05 | PatchMT | 0.411 | 0.334 | 0.272 | 0.801 | 0.476 | 0.499 |
| PulseMT | 0.464 | 0.752 | 0.265 | 0.800 | 0.505 | 0.670 |  |
| Professor X | 0.522 | 0.744 | 0.319 | 0.999 | 0.482 | 0.923 |  |
| 0.10 | PatchMT | 0.431 | 0.363 | 0.283 | 0.824 | 0.482 | 0.540 |
| PulseMT | 0.460 | 0.795 | 0.270 | 0.825 | 0.486 | 0.704 |  |
| Professor X | 0.522 | 0.813 | 0.323 | 1.000 | 0.500 | 0.944 |  |
| 0.15 | PatchMT | 0.413 | 0.371 | 0.275 | 0.821 | 0.464 | 0.587 |
| PulseMT | 0.449 | 0.701 | 0.271 | 0.821 | 0.477 | 0.632 |  |
| Professor X | 0.532 | 0.848 | 0.322 | 0.998 | 0.477 | 0.947 |  |
| 0.20 | PatchMT | 0.390 | 0.377 | 0.271 | 0.829 | 0.479 | 0.644 |
| PulseMT | 0.434 | 0.769 | 0.270 | 0.819 | 0.484 | 0.606 |  |
| Professor X | 0.529 | 0.882 | 0.325 | 0.999 | 0.486 | 0.950 |  |
| 0.25 | PatchMT | 0.406 | 0.385 | 0.267 | 0.835 | 0.491 | 0.673 |
| PulseMT | 0.491 | 0.705 | 0.275 | 0.832 | 0.478 | 0.566 |  |
| Professor X | 0.519 | 0.865 | 0.328 | 0.999 | 0.486 | 0.941 |  |
| 0.30 | PatchMT | 0.417 | 0.382 | 0.269 | 0.831 | 0.464 | 0.706 |
| PulseMT | 0.425 | 0.708 | 0.273 | 0.844 | 0.488 | 0.592 |  |
| Professor X | 0.521 | 0.862 | 0.330 | 0.999 | 0.495 | 0.940 |  |
| 0.35 | PatchMT | 0.435 | 0.373 | 0.270 | 0.841 | 0.475 | 0.734 |
| PulseMT | 0.423 | 0.621 | 0.276 | 0.839 | 0.479 | 0.589 |  |
| Professor X | 0.527 | 0.850 | 0.332 | 0.998 | 0.496 | 0.947 |  |
| 0.40 | PatchMT | 0.438 | 0.378 | 0.271 | 0.843 | 0.469 | 0.751 |
| PulseMT | 0.481 | 0.624 | 0.272 | 0.845 | 0.485 | 0.592 |  |
| Professor X | 0.521 | 0.893 | 0.330 | 0.999 | 0.501 | 0.951 |  |
| 0.45 | PatchMT | 0.460 | 0.385 | 0.266 | 0.844 | 0.481 | 0.742 |
| PulseMT | 0.429 | 0.633 | 0.277 | 0.856 | 0.499 | 0.601 |  |
| Professor X | 0.519 | 0.877 | 0.325 | 0.999 | 0.492 | 0.962 |  |
| 0.50 | PatchMT | 0.423 | 0.386 | 0.263 | 0.840 | 0.480 | 0.752 |
| PulseMT | 0.459 | 0.514 | 0.273 | 0.851 | 0.492 | 0.610 |  |
| Professor X | 0.528 | 0.893 | 0.329 | 1.000 | 0.497 | 0.970 |  |

**Table 12: Clean (/C) and attack (/B) performance with electrodes injection rate $\gamma$, $\beta=0.1$**
| $\gamma$ | Dataset | Emotion | Motor Imagery | Epilepsy |  |  |  |
| --- | --- | --- | --- | --- | --- | --- | --- |
| Method | Clean | Attack | Clean | Attack | Clean | Attack |  |
| 0.10 | PatchMT | 0.431 | 0.334 | 0.268 | 0.795 | 0.470 | 0.529 |
| PulseMT | 0.425 | 0.498 | 0.269 | 0.802 | 0.502 | 0.717 |  |
| ComprsMT | 0.407 | 0.349 | 0.271 | 0.805 | 0.482 | 0.656 |  |
| Professor X | 0.489 | 0.485 | 0.235 | 0.367 | 0.499 | 0.814 |  |
| 0.20 | PatchMT | 0.473 | 0.335 | 0.271 | 0.805 | 0.464 | 0.599 |
| PulseMT | 0.469 | 0.707 | 0.270 | 0.816 | 0.502 | 0.737 |  |
| ComprsMT | 0.465 | 0.363 | 0.268 | 0.812 | 0.514 | 0.704 |  |
| Professor X | 0.481 | 0.709 | 0.235 | 0.367 | 0.486 | 0.860 |  |
| 0.30 | PatchMT | 0.423 | 0.343 | 0.272 | 0.803 | 0.486 | 0.613 |
| PulseMT | 0.488 | 0.767 | 0.273 | 0.814 | 0.506 | 0.749 |  |
| ComprsMT | 0.451 | 0.398 | 0.271 | 0.811 | 0.494 | 0.700 |  |
| Professor X | 0.500 | 0.743 | 0.235 | 0.367 | 0.490 | 0.883 |  |
| 0.40 | PatchMT | 0.453 | 0.343 | 0.270 | 0.812 | 0.478 | 0.525 |
| PulseMT | 0.467 | 0.786 | 0.271 | 0.816 | 0.498 | 0.688 |  |
| ComprsMT | 0.443 | 0.361 | 0.270 | 0.820 | 0.506 | 0.634 |  |
| Professor X | 0.491 | 0.767 | 0.235 | 0.367 | 0.478 | 0.912 |  |
| 0.50 | PatchMT | 0.431 | 0.363 | 0.270 | 0.813 | 0.472 | 0.552 |
| PulseMT | 0.460 | 0.795 | 0.269 | 0.819 | 0.471 | 0.710 |  |
| ComprsMT | 0.430 | 0.366 | 0.269 | 0.821 | 0.503 | 0.640 |  |
| Professor X | 0.522 | 0.813 | 0.235 | 0.367 | 0.477 | 0.944 |  |
| 0.60 | PatchMT | 0.452 | 0.377 | 0.267 | 0.819 | 0.480 | 0.549 |
| PulseMT | 0.460 | 0.808 | 0.269 | 0.823 | 0.490 | 0.672 |  |
| ComprsMT | 0.459 | 0.368 | 0.271 | 0.826 | 0.499 | 0.534 |  |
| Professor X | 0.488 | 0.828 | 0.235 | 0.367 | 0.495 | 0.950 |  |
| 0.70 | PatchMT | 0.443 | 0.368 | 0.272 | 0.812 | 0.497 | 0.525 |
| PulseMT | 0.437 | 0.809 | 0.270 | 0.821 | 0.459 | 0.716 |  |
| ComprsMT | 0.456 | 0.366 | 0.273 | 0.835 | 0.492 | 0.571 |  |
| Professor X | 0.527 | 0.853 | 0.235 | 0.367 | 0.489 | 0.955 |  |
| 0.80 | PatchMT | 0.461 | 0.383 | 0.268 | 0.821 | 0.479 | 0.573 |
| PulseMT | 0.456 | 0.771 | 0.267 | 0.829 | 0.488 | 0.699 |  |
| ComprsMT | 0.431 | 0.383 | 0.270 | 0.833 | 0.488 | 0.475 |  |
| Professor X | 0.539 | 0.865 | 0.235 | 0.367 | 0.489 | 0.960 |  |
| 0.90 | PatchMT | 0.439 | 0.400 | 0.271 | 0.817 | 0.478 | 0.540 |
| PulseMT | 0.461 | 0.811 | 0.269 | 0.823 | 0.494 | 0.694 |  |
| ComprsMT | 0.459 | 0.389 | 0.274 | 0.836 | 0.490 | 0.309 |  |
| Professor X | 0.520 | 0.824 | 0.235 | 0.367 | 0.489 | 0.970 |  |
| 1.00 | PatchMT | 0.430 | 0.370 | 0.267 | 0.823 | 0.476 | 0.526 |
| PulseMT | 0.456 | 0.794 | 0.271 | 0.829 | 0.482 | 0.716 |  |
| ComprsMT | 0.453 | 0.376 | 0.269 | 0.830 | 0.490 | 0.334 |  |
| Professor X | 0.532 | 0.846 | 0.235 | 0.367 | 0.491 | 0.978 |  |

### E.3 Hyperparameter Analysis in Reinforcement Learning

We applied the following reward function to acquire the optimal mask strategies for each triggers:

$$ $\displaystyle Q_{t}=\mathrm{CA}+\lambda\ \mathrm{ASR}+\mu\ \mathrm{dis}( \mathcal{M}_{f}^{c_{i}})+\nu\min(\mathcal{M}_{f}^{c_{i}}),$ (11) $$

where the first part means the clean accuracy, the second part means the attack success rate, the third part is aiming to scatter the injection positions in various frequency bands, and the fourth part is aiming to inject as high frequencies in EEG signals as possible.
Here, we give a simple example to demonstrate the reward function. For an 10 timepoints long EEG segment $x_{i}$, $\widetilde{x}_{i}=\mathcal{F}(x_{i})$. If the $\mathcal{M}_{f}^{c_{i}}=\{2,3,5,7,9\}$, because the minimal distance between each pair in $\mathcal{M}_{f}^{c_{i}}$ is $|2-3|=1$, thus $\mathrm{dis}(\mathcal{M}_{f}^{c_{i}})=1$. The $\min(\mathcal{M}_{f}^{c_{i}})$ means the lowest position in $\mathcal{M}_{f}^{c_{i}}$, thus $\min(\mathcal{M}_{f}^{c_{i}})=2$.

The analysis of the $\lambda$ are presented in Table 13. When $\lambda$ increase, the Attack performance increases while the Clean performance declines slightly.

**Table 13: Clean (/C) and attack (/B) performance with ASR’s hyperparameter $\lambda$, $\mu=0.3,\nu=0.005$**
|  | Dataset | Emotion | Motor Imagery | Epilepsy |  |  |  |
| --- | --- | --- | --- | --- | --- | --- | --- |
| Method | Clean | Attack | Clean | Attack | Clean | Attack |  |
| 0.5 | Professor X | 0.542$\pm$0.03 | 0.847$\pm$0.04 | 0.327$\pm$0.02 | 1.000$\pm$0.01 | 0.500$\pm$0.04 | 0.922$\pm$0.04 |
| 1.0 | Professor X | 0.537$\pm$0.02 | 0.855$\pm$0.03 | 0.325$\pm$0.02 | 1.000$\pm$0.01 | 0.482$\pm$0.03 | 0.935$\pm$0.05 |
| 2 | Professor X | 0.535$\pm$0.03 | 0.857$\pm$0.02 | 0.323$\pm$0.02 | 1.000$\pm$0.01 | 0.477$\pm$0.04 | 0.944$\pm$0.02 |

## Appendix F More Visualization Results

In this section, we plot the reconstructed triggers and masks on three datasets in Section F.1, more visualizations of backdoor samples in Section F.2, and the learning curve of our reinforcement learning in Section F.3.

### F.1 Neural Cleanse: Reconstruction Trigger Patterns

Here, we present more visualization in Figure 9, Figure 10, and Figure 11 of the reconstructed trigger patterns and mask patterns for each possible label on three dataset (i.e., the CHB-MIT dataset, the BCIC-IV-2a dataset and the SEED dataset) the target model is EEGnet.
It can be observed that the reconstructed trigger patterns and mask patterns of the clean models and Professor X backdoor-injected models are very similar to each other.
Thus, our Professor X backdoor attack can easily bypass the defense of Neural Cleanse.

Figure: Figure 9: The reconstructed trigger patterns and mask patterns for each possible class in the CHB-MIT dataset. The results in the left column are reconstructed based on the clean model, the results in the right column are reconstructed based on the backdoor model. The EEG segments in the CHB-MIT dataset have 23 electrodes and 256 timepoints.
Refer to caption: x9.png

Figure: Figure 10: The reconstructed trigger patterns and mask patterns for each possible class in the MI dataset. The results in the left column are reconstructed based on the clean model, the results in the right column are reconstructed based on the backdoor model. The EEG segments in the MI dataset have 22 electrodes and 250 timepoints.
Refer to caption: x10.png

Figure: Figure 11: The reconstructed trigger patterns and mask patterns for each possible class in the ER dataset (i.e., SEED dataset). The results in the left column are reconstructed based on the clean model, the results in the right column are reconstructed based on the backdoor model. The EEG segments in the SEED dataset have 62 electrodes and 200 timepoints.
Refer to caption: x11.png

### F.2 Visualization of Backdoor Attack Samples

We present more visualization of the backdoor attack samples generated by our Professor X on ER
dataset and MI dataset in Fig 12 and 13. The x-axis is the timepoints, the y-axis is the normalized
amplitude. Top row: w.o. HF loss; Bottom row: with HF loss. Each column indicates each possible
class.

Figure: Figure 12: The Clean EEG (Blue), Trigger-injected EEG (Orange) and the Residual (Red) of the ER dataset.
Refer to caption: x12.png

Figure: Figure 13: The Clean EEG (Blue), Trigger-injected EEG (Orange) and the Residual (Red) of the MI dataset.
Refer to caption: x13.png

### F.3 Visualization of Learning Curves of Reinforcement Learning

We present the visualization of the learning curves of the reinforcement learning of three dataset in Fig 14. We can see the effectiveness of our reinforcement, which converged within 50 epochs on the ER dataset, that is, only trained 50 backdoor models with different injection strategies.
Our RL is more effective on the MI dataset and ED dataset, which finds a good strategy within less 10 epochs.
Our RL is robust when learning strategies for different triggers as demonstrated in Fig 14(c) and (d), where the learning curves are quite similar when RL is performing on different triggers.

Figure: Figure 14: The learning curves of RL on three datasets. The right column is the curve we sort the (Clean Accuracy and Attack Success Rate) (ACC,ASR) according to the ASR. The backdoor models are all EEGNet.
Refer to caption: x14.png

## Peer Reviews

confidence: 5
contribution: 1
initial_rating: 1
presentation: 1
questions: Why did the authors construct an entirely unrealistic and artificial scenario? Where did the authors encounter such hyperbolic or enthusiastic claims regarding the purported applications of BCI in healthcare and medical diagnostics? Currently, only a limited number of conditionally approved, mostly invasive devices have been tested on a small cohort of subjects within closed clinical studies.
soundness: 1
strengths: The reviewer found no substantial strengths in the submission. It is fundamentally inadequate to fabricate problems only to propose solutions. Backdoor attacks do not present a significant concern in the field of BCI research at this time, as established paradigms are still lacking. Nonetheless, BCI research is experiencing significant growth due to advancements in machine learning; however, a considerable distance remains before it can transition to healthcare and broader applications that would necessitate the implementation of protections against backdoor attacks.
summary: From the outset, the abstract of the submission presents a proposition that appears to be unrealistic and somewhat disconnected from contemporary research realities. It remains inaccurate to assert that "While electroencephalogram (EEG) based brain-computer interfaces (BCIs) have been extensively employed in medical diagnosis, healthcare, and device control, the safety of EEG BCIs has long been neglected."

The manuscript constructs a fictitious framework, suggesting that research regarding BCIs has already translated into widespread applications. The submission relies on historical datasets such as BCIC-IV-2a. It is critical to note that motor imagery may not be effective for the target demographic of individuals with paralysis due to significant neural degeneration. Moreover, the methodology seems to rely on a dubious SEED database to fabricate artificial backdoor attack scenarios, ultimately suggesting solutions that are not based in rigorous academic research. This strategy does not promote the growth of academic inquiry, thus justifying a rejection of this submission.
weaknesses: The prevailing conditions within the submission exhibit a lack of realism, an insufficiency of novel contributions, and a substantial deficiency in advancements for the BCI community.

---

confidence: 3
contribution: 2
initial_rating: 5
presentation: 2
questions: In addition to the points in the 'Weaknesses' section, I'd like to add one more:

How effective is the proposed BD attack when applied to approaches that utilize frequency information of data, such as [3]?



[3] Zhang X, Zhao Z, Tsiligkaridis T, Zitnik M. Self-supervised contrastive pre-training for time series via time-frequency consistency. Advances in Neural Information Processing Systems. 2022 Dec 6;35:3988-4003.
soundness: 2
strengths: 1. The study has a clear research question, which makes its purpose easy to understand.
3. The idea of employing reinforcement learning for finding the optimal electrodes and frequencies for data poisoning is interesting. 
2. The authors designed multiple experiments to evaluate different parts of their method, and the ones focused on showing the method's robustness are especially valuable.
summary: The paper introduces Professor X, a novel, frequency-based EEG attack designed to be stealthy and multi-target. The method involves three main steps: 1) Finding triggers for each class, 2) using reinforcement learning to find optimal electrodes and frequencies injection
strategies, and 3) generating poisoned samples using triggers and clean data.
weaknesses: As mentioned in the related works, a research direction exists that focuses on designing frequency-based backdoor attacks. Although existing methods are designed for images rather than time series, the authors could still compare their proposed method with existing approaches to better highlight the novelty of the work in relation to current frequency-based methods.

The authors designed several baselines (stealthy and non-stealthy) based on BadNets, PP-based BD attacks, and so on, which is great. However, it would be great if the authors considered and designed some baselines based on the existing frequency-based BD attack, if applicable.

The stealthiness of the method is one of the claims of the method. Although there are some visualizations in this regard, it would be great if the authors designed an experiment to validate the stealthiness of the method. It may be similar to a previous study [1], which used anomaly detection methods.

The author only considers three models for the classifiers: EEGNet, DeepCNN, and LSTM. However, it would be great if the author considered other new models, like TIMESNET [2] and other new transformer-based models.

The quality of the writing needs improvement; here are some points:
The third paragraph of the introduction requires revision for clarity and coherence. 
Figure 1 consists of five sub-figures that provide a good summary of the method. However, in the introduction (line 050), the authors begin by explaining Figure 1-d, which destroys the flow.

The Methodology section should be improved by first defining the key concepts, symbols, and problems. 
It would also be helpful to include a table of abbreviations and symbols, as the multiple terms used throughout the paper may be confusing for readers. 



[1]. Lin X, Liu Z, Fu D, Qiu R, Tong H. BACKTIME: Backdoor Attacks on Multivariate Time Series Forecasting. arXiv e-prints. 2024 Oct:arXiv-2410.

[2]. Wu H, Hu T, Liu Y, Zhou H, Wang J, Long M. TimesNet: Temporal 2D-Variation Modeling for General Time Series Analysis. InThe Eleventh International Conference on Learning Representations.

---

confidence: 4
contribution: 3
initial_rating: 8
presentation: 4
questions: What potential research directions could be pursued to enhance defenses against backdoor attacks such as Professor X, especially regarding Fine-Pruning techniques?
soundness: 4
strengths: It presents an innovative approach for manipulating EEG BCI outputs, addressing a gap in the existing literature that predominantly emphasizes single-target attacks. The design leverages reinforcement learning to improve the attack's robustness and stealth, enabling it to evade detection more successfully than earlier methods. Professor X takes into account the specific EEG electrodes and frequency ranges associated with different tasks and formats, making it versatile for various EEG applications. Experimental results show that Professor X is effective across multiple EEG tasks, highlighting its broad applicability beyond just one context.
summary: This paper presents "Professor X," a new EEG backdoor attack aimed at influencing the outputs of electroencephalogram (EEG)-based brain-computer interfaces (BCIs). While EEG BCIs are widely utilized in medical and device control settings, their security has often been neglected. Professor X improves upon existing EEG attack methods, which typically target single classes and either require interaction with the BCI's training phase or lack stealth. This innovative approach strategically selects specific EEG electrodes and frequencies for injection based on various EEG tasks and formats. By employing a reinforcement learning-based reward function, the method enhances both robustness and stealth. Experimental results demonstrate Professor X's effectiveness, resilience, and generalizability, underscoring vulnerabilities in EEG BCIs and calling for further defensive research in the field. Additionally, Professor X can help protect intellectual property within EEG datasets and BCI models by embedding a concealed watermark. The attack employs a three-stage clean label poisoning strategy: selecting triggers for each class, optimizing injection strategies for electrodes and frequencies, and generating poisoned samples via spectral interpolation. Testing on diverse EEG task datasets validates the method’s effectiveness and its capacity to circumvent existing defenses.
weaknesses: The method might encounter difficulties when scaling to larger or more intricate datasets, which could restrict its effectiveness in real-world applications with varied user populations.

---

confidence: 3
contribution: 4
initial_rating: 6
presentation: 4
questions: What ethical frameworks are in place to govern the use of techniques like Professor X, and how can researchers ensure that such methods are not misused?

How effective is STRIP in detecting backdoor inputs under various levels of perturbation? Are there specific types of perturbations that significantly impact its performance?

How does STRIP compare to other defense mechanisms in terms of robustness against backdoor attacks like Professor X? What are its relative strengths and weaknesses?

 What specific mechanisms within the model lead to the observed drop in attack success rate (ASR) when Fine-Pruning is applied? Can these mechanisms be quantified?

How are low-activated neurons determined, and could this method inadvertently remove important features that are crucial for classification?

 How effective is Fine-Pruning at different pruning ratios beyond 0.7? Are there specific thresholds where the attack's effectiveness is significantly impacted?

What future research avenues could be explored to improve defenses against backdoor attacks like Professor X, particularly in the context of Fine-Pruning?
soundness: 4
strengths: It introduces a novel method for manipulating EEG BCI outputs, filling a gap in the existing literature that largely focuses on single-target attacks.
The design incorporates reinforcement learning to enhance the attack's robustness and stealthiness, allowing it to evade detection more effectively than previous methods.
Professor X considers the specific EEG electrodes and frequency ranges relevant to different tasks and formats, making it adaptable to various EEG applications.
Experimental results demonstrate that Professor X is effective across multiple EEG tasks, indicating a broad applicability beyond a single context.
summary: This paper introduces "Professor X," a novel EEG backdoor attack designed to manipulate the outputs of electroencephalogram (EEG)-based brain-computer interfaces (BCIs). While EEG BCIs are commonly used for medical and device control applications, their safety has often been overlooked. Professor X addresses the limitations of existing EEG attacks, which typically focus on single-target classes and require interaction with the training stage of the BCI or lack stealthiness. This method uniquely considers the specific EEG electrodes and frequencies to be injected based on different EEG tasks and formats. Utilizing a reinforcement learning-based reward function enhances both robustness and stealthiness. Experimental results demonstrate Professor X's effectiveness, robustness, and generalizability, highlighting the potential vulnerabilities in EEG BCIs and urging the community to conduct defensive studies. Additionally, Professor X offers applications in protecting intellectual property within EEG datasets and BCI models by providing a concealed watermark. The attack exploits a three-stage clean label poisoning strategy: selecting triggers for each class, optimizing electrode and frequency injection strategies, and generating poisoned samples through spectral interpolation. Tests on various EEG task datasets confirm the method's efficacy and its ability to bypass existing defenses.
weaknesses: The potential for malicious use raises significant ethical issues, as manipulating EEG outputs could lead to harmful consequences for users and their applications.

The method involves a sophisticated three-stage clean label poisoning attack, which may be complex to implement in practice, especially for those lacking expertise in reinforcement learning and EEG signal processing.

The design's focus on particular EEG tasks might result in overfitting, reducing its effectiveness in more generalized scenarios or with novel tasks.

The approach may face challenges in scaling up for larger or more complex datasets, potentially limiting its effectiveness in real-world applications involving diverse user populations.

---

confidence: 5
contribution: 1
initial_rating: 3
presentation: 2
questions: What motivated the specific design choices made in the three-stage clean-label poisoning strategy?

How does the proposed method compare in effectiveness to existing backdoor attack methods in the literature?
soundness: 2
strengths: The introduction of a three-stage clean-label poisoning strategy represents an innovative approach to backdoor attacks in the context of EEG-based BCIs.

The use of reinforcement learning to optimize injection techniques enhances the potential effectiveness of the attack and contributes to the growing body of research on adversarial techniques in neurotechnology.
summary: This paper presents Professor X, a novel backdoor attack method specifically designed for EEG-based brain-computer interfaces (BCIs). The proposed approach employs a three-stage clean-label poisoning strategy that includes trigger selection, reinforcement learning to identify optimal injection techniques, and the generation of poisoned data in the frequency domain.
weaknesses: The literature review is notably limited, overlooking key studies such as Liu et al. (2021) and Zhang & Wu (2019), which highlight the vulnerabilities of EEG-based BCIs to adversarial attacks on signal integrity.

This oversight significantly diminishes the impact and originality of the research, as the proposed method lacks validation against established vulnerabilities within existing literature.

A more thorough engagement with relevant studies would enhance the study's contributions and contextual relevance.

Reference:
Liu, Z., Meng, L., Zhang, X., Fang, W., & Wu, D. (2021). Universal adversarial perturbations for CNN classifiers in EEG-based BCIs. Journal of Neural Engineering, 18(4), 0460a4.
Zhang, X., & Wu, D. (2019). On the vulnerability of CNN classifiers in EEG-based BCIs. IEEE transactions on neural systems and rehabilitation engineering, 27(5), 814-825.

Meta-review: The paper introduces a novel and robust backdoor attack framework for EEG-based Brain-Computer Interfaces. The method employs a label-poisoning strategy with reinforcement learning to inject undetectable triggers into EEG signals. The paper introduces and tackles a very interesting notion - one which should not be ignored as BCI technologies become more adopted. The solution is also interesting and effective. However, the paper had a few weaknesses. The paper is somewhat difficult to follow, with key concepts like "stealth" lacking clear definition and justification. It also falls short in benchmarking against recent methods in time-series or signal-processing attacks. Additionally, the absence of an ethical discussion is a significant oversight for a topic of this nature. The analysis of backdoor defense mechanisms is limited in both scope and depth.

Decision: Reject