Practical Adversarial Attacks on Brain--Computer Interfaces

1 INTRODUCTION . Recent work has shown that adversarial perturbations can cause state-of-the-art ( SoA ) deep learning models to misbehave in various domains including vision ( Szegedy et al. , 2014 ; Goodfellow et al. , 2015 ) , NLP ( Li et al. , 2019a ; Zhang et al. , 2020 ) , speech ( Qin et al. , 2019 ; Li et al. , 2019b ) , and biomedicine ( Finlayson et al. , 2019 ; Han et al. , 2020 ) . Neural networks have been applied in brain–computer interfaces ( BCIs ) achieving impressive results ( Lawhern et al. , 2018 ; Dose et al. , 2018 ) . A BCI enables direct interactions with external devices based on brain activities , typically recorded using electroencephalographic ( EEG ) systems . It can provide a communication pathway for severely paralyzed patients or assist in rehabilitation ( Chaudhary et al. , 2016 ) . Besides medical applications , recent developments in wearable devices have pushed BCIs towards consumer-grade products to improve life quality ( Aricò et al. , 2020 ) , e.g. , the Interaxon Muse headband for stress relief ( Arsalan et al. , 2019 ) or the Emotiv headset for controlling drones ( Marin et al. , 2020 ) and ground vehicles ( Zhuang et al. , 2021 ) . Safety in BCI systems is paramount ( Dutta , 2020 ; Bernal et al. , 2021 ) , because a failure would cause misdiagnoses , user frustration , or even danger while driving a wheelchair or controlling a drone , causing physical and financial damages . Zhang & Wu ( 2019 ) were the first to show that EEG-based BCIs are vulnerable to adversarial attacks by proposing an unsupervised fast gradient sign method ( FGSM ) ( Goodfellow et al. , 2015 ) . More recent work has proposed a more practical attack where a universal adversarial perturbation ( UAP ) is computed once and can be applied to all EEG trials without learning it for every new input ( Liu et al. , 2021 ) . Both works assume that the acquired signals are sent to a remote compute engine , e.g. , a computer , and the attacker can alter the signals during the transmission by attaching a “ jamming ” module between the signal preprocessing step and the classifier . Recent developments in smart edge computing ( Akmandor & Jha , 2018 ; Beach et al. , 2021 ) eliminate the need for data transmission , making this attack scenario inapplicable . Novel BCI solutions ( Kartsch et al. , 2019 ; Wang et al. , 2020 ) embed the signal processing and classification directly at the sensor edge . A more practical adversarial example has been identified by Meng et al . ( 2021 ) . It consists of a square-shaped signal that can be added to EEG trials before the preprocessing step . However , the attack is proposed as a backdoor key , which means that the attacker has direct access to the training dataset and pollutes it with adversarial examples , which is improbable if the attacker is not directly involved in the data acquisition or in the training of the classifier . Li et al . ( 2019b ) have shown an attack scenario in the audio domain by considering the on-board edge processing of a wake-word detection system , where an adversarial audio trace is delivered to the environment causing denial-of-service ( DoS ) . No similar studies can be currently found in the BCI domain . Challenges : Designing natural attacks and modeling its propagation . Unlike in audio applications where the signal can simply propagate over-the-air and is sensed by a microphone , extra modeling is required to evaluate the signal propagation in BCIs based on the physical properties of the biological tissues . In this work , rather than assuming a “ jamming ” module between the preprocessing and the classification steps as in related works , we consider a more realistic and practically applicable attack scenario where the adversarial perturbations are introduced at the source of the data acquisition , as showcased in Figure 6 in Appendix A . This can be achieved , for example , via electromagnetic waves delivered to the environment ( Dutta , 2020 ) or via transcranial current stimulation with electrical current delivered directly to the scalp ( Bodranghien et al. , 2017 ; Fertonani et al. , 2015 ) , by exploiting wearable devices , such as smart glasses or over-ear headsets ( Flowneuroscience , 2021 ; Marin et al. , 2020 ) . The adversarial perturbations translate into electrical signals propagating over the scalp and are sensed by the electrodes in addition to the EEG signals . To guarantee the imperceptibility of the attacks , previous works in BCIs create perturbations that are small in amplitude ( Zhang & Wu , 2019 ; Jiang et al. , 2019 ; Liu et al. , 2021 ) , limiting the attack success rate ( ASR ) . Increased perturbation ’ s amplitude yields higher ASR ( Meng et al. , 2021 ) , but makes the attack more easily detectable . Moreover , the generated perturbations are square-shaped , which is implausible for biosignals . Han et al . ( 2020 ) are the first to observe square-wave artifacts in biosignals ’ attacks and propose smooth perturbations for electrocardiograms ( ECGs ) . No similar works have been found for EEGs . This work : Practical attacks on BCI models . To address the above technical challenges , and for analyzing the vulnerability of embedded BCI models in practical scenarios , we design a new attack algorithm that generates smooth adversarial examples based on the signals ’ first derivative and model its propagation over the scalp based on a realistic head model by taking into consideration the attack source and the electrical and physical properties of the conducting tissues . This enables the creation of practically effective perturbations , that can be delivered by an external device to attack EEG-based BCIs at the source of signal acquisition . We attack the most energy-efficient network that has been embedded on microcontrollers for smart wearable BCIs called EEGNet ( Lawhern et al. , 2018 ; Schneider et al. , 2020 ) . It is a resource-friendly convolutional neural network ( CNN ) and is the SoA in terms of accuracy and energy-efficiency trade-off ( Belwafi et al. , 2018 ; Malekmohammadi et al. , 2019 ; Wang et al. , 2020 ; Schneider et al. , 2020 ) . We evaluate our methods and show experimental results on BCIs based on the motor imagery ( MI ) paradigm , which is of special interest among others because it can be asynchronously self-paced without external stimuli ( Freer & Yang , 2020 ) . By imagining the movement of different body parts , the decoded intention is translated into control signals . It is widely applied in several BCI applications , such as the control of wheelchairss ( Yu et al. , 2018 ) , prosthetic armss ( Elstob & Secco , 2016 ) , ground vehicles ( Zhuang et al. , 2021 ) , and in communication ( Brumberg et al. , 2016 ) . It has been proven to be the most difficult task to be attacked among the most common BCI paradigms ( Zhang & Wu , 2019 ; Meng et al. , 2021 ) . We evaluate our methods by “ fooling ” the victim model to always predict “ rest ” class . This essentially yields a DoS attack , because resting-state EEG signals are generally interpreted as no subject ’ s intention decoded , i.e. , no control action needs to be taken by the BCI system ( Yu et al. , 2018 ) . While for healthy subjects it might solely cause user frustration and financial losses , for severely paralyzed patients it can lead to loss of communication and independence . We generalize our methodology to an other MI task of BCI Competition IV-2a dataset and believe that it can be easily adapted to other BCI paradigms . Main contributions . Our main contributions are : • We design a new method to generate smooth adversarial perturbations that are physiologically plausible and imperceptible to the human eye . • We consider a practical scenario where the perturbation is added at the signal acquisition source and model its propagation constrained by the physical properties of the human scalp . • The first study of adversarial perturbations in BCI to consider the practical scenario of smart edge computing and physical signal propagation . We create both local and global perturbations and show that our attacks consistently achieve a success rate of > 50 % in different settings pointing to the significant vulnerability of the SoA embedded EEGNet . We hope that our work raises awareness for potential risks and motivates the future development of appropriate countermeasures . 2 BACKGROUND . 2.1 CLASSIFICATION IN BCIS . We first describe the commonly used approach in BCIs for classification , consisting of a preprocessing step and a classifier . The brain activity is recorded with an EEG device which samples Nch channels at rate Fs . We define one trial j as ( X ( j ) , y ( j ) ) , where y ( j ) ∈ { 0 , 1 , ... , Ncl − 1 } is the true label of Ncl MI tasks , and X ( j ) ∈ RNs×Nch the multi-channel recording defined as X ( j ) : = ( x ( j ) 0 , x ( j ) 1 , ... , x ( j ) Nch−1 ) , ( 1 ) with x ( j ) i ∈ RNs corresponding to the recording of the j-th trial and the i-th channel containing Ns temporal samples . For simplicity , we denote X : = X ( j ) and y : = y ( j ) . The EEG recordings are often preprocessed with a band-pass filter , e.g. , using a Fast Fourier Transform ( FFT ) filter hbp ( · ) , before being fed to a classifier , yielding Xbp = Hbp ( X ) = ( hbp ( x0 ) , hbp ( x1 ) , ... , hbp ( xNch−1 ) ) . ( 2 ) Finally , the preprocessed signal Xbp is classified with a trainable model f and is mapped to p : = f ( Xbp ) , where p ∈ RNcl contains the output probabilities , e.g. , originating from a softmax activation as final operation in f . The model ’ s final prediction ŷ is the index with the maximum score in p : ŷ = f̂ ( Xbp ) = argmax y∈ { 0 , ... , Ncl−1 } f ( Xbp ) [ y ] . ( 3 ) 2.2 INSTANCE-BASED ATTACKS . Instance-based attacks try to fool an EEG classifier f to misclassify an EEG signal X to a targeted class yt . In this section , we describe the attack directly on the classifier f without considering the preprocessing Hbp ; the inclusion of the preprocessing is described in Section 3.3 . We define an adversarial example as any X∗ = X+V ∈ RNs×Nch such that f̂ ( X ) 6= f̂ ( X∗ ) = yt . ( 4 ) FGSM . The FGSM ( Goodfellow et al. , 2015 ) generates an adversarial perturbation V ∈ RNs×Nch of magnitude which points in the negative direction of a loss function ’ s gradient : V = − · sign ( ∇X · l ( X , yt ) ) , ( 5 ) where the loss function contains the negative log likelihood l ( X , yt ) = −log ( p [ yt ] ) = −log ( f ( X ) [ yt ] ) . ( 6 ) As p is the output of the softmax activation function , equation 6 becomes a cross-entropy loss which maximizes the output p [ yt ] while minimizing the remaining outputs . PGD . The projected gradient descent ( PGD ) ( Madry et al. , 2018 ) is a variant of the basic iterative method ( Kurakin et al . ) , generally considered to be more effective than FGSM . PGD aims to find a perturbation by iteratively taking small steps of size α in the gradient ’ s direction and projecting the resulting perturbation back to the sample ’ s neighborhood after each iteration . We randomly initialize the attack inside the L∞ ball of radius and update the attack Vt+1 for any iteration t with Vt+1 = clip ( Vt − α · sign ( ∇Vl ( X+Vt , yt ) ) ) , ( 7 ) where α is a step size smaller than which decays linearly with each iteration and the function clip ( · ) clips the signal at the maximum desired amplitude .

Summary: This work analyzes the adversarial attacks on BCI systems. It induces DoS attack and incorporates domain-specific insights to achieve the adversarial attack. The designed attack is evaluated on a public dataset EEGMMIDB and shows that a popular deep learning model, EEGNet, is vulnerable to adversarial attacks.