Professor X: Manipulating EEG BCI with Invisible and Robust Backdoor Attack

Authors: Xuan-Hao Liu, Xinhao Song, Dexuan He, Bao-liang Lu, Wei-Long Zheng
Primary area: alignment, fairness, safety, privacy, and societal considerations
Keywords: safety, backdoor attack, EEG, brain-computer interface

Abstract:
While electroencephalogram (EEG) based brain-computer interface (BCI) has been widely used for medical diagnosis, health care, and device control, the safety of EEG BCI has long been neglected. In this paper, we propose **Professor X**, an invisible and robust “mind-controller” that can arbitrarily manipulate the outputs of EEG BCI through backdoor attack, to alert the EEG community of the potential hazard. However, existing EEG attacks mainly focus on single-target class attacks, and they either require engaging the training stage of the target BCI, or fail to maintain high stealthiness. Addressing these limitations, Professor X exploits a three-stage clean label poisoning attack: **1)** selecting one trigger for each class; **2)** learning optimal injecting EEG electrodes and frequencies strategy with reinforcement learning for each trigger; **3)** generating poisoned samples by injecting the corresponding trigger’s frequencies into poisoned data for each class by linearly interpolating the spectral amplitude of both data according to previously learned strategies. Experiments on datasets of three common EEG tasks demonstrate the effectiveness and robustness of Professor X, which also easily bypasses existing backdoor defenses. Code will be released soon.

Decision: reject
Reviewer scores: 1, 6, 8, 6, 5

Reviews and discussion:
<thread>
creation date:
1730125184482

thread_type:
official_review

<thread_object>
creator: reviewer_dg1e

<content>
summary:
This paper presents Professor X, a novel backdoor attack method specifically designed for EEG-based brain-computer interfaces (BCIs). The proposed approach employs a three-stage clean-label poisoning strategy that includes trigger selection, reinforcement learning to identify optimal injection techniques, and the generation of poisoned data in the frequency domain.

strengths:
The introduction of a three-stage clean-label poisoning strategy represents an innovative approach to backdoor attacks in the context of EEG-based BCIs.

The use of reinforcement learning to optimize injection techniques enhances the potential effectiveness of the attack and contributes to the growing body of research on adversarial techniques in neurotechnology.

weaknesses:
The literature review is notably limited, overlooking key studies such as Liu et al. (2021) and Zhang & Wu (2019), which highlight the vulnerabilities of EEG-based BCIs to adversarial attacks on signal integrity.

This oversight significantly diminishes the impact and originality of the research, as the proposed method lacks validation against established vulnerabilities within existing literature.

A more thorough engagement with relevant studies would enhance the study's contributions and contextual relevance.

Reference:
Liu, Z., Meng, L., Zhang, X., Fang, W., & Wu, D. (2021). Universal adversarial perturbations for CNN classifiers in EEG-based BCIs. Journal of Neural Engineering, 18(4), 0460a4.
Zhang, X., & Wu, D. (2019). On the vulnerability of CNN classifiers in EEG-based BCIs. IEEE transactions on neural systems and rehabilitation engineering, 27(5), 814-825.

questions:
What motivated the specific design choices made in the three-stage clean-label poisoning strategy?

How does the proposed method compare in effectiveness to existing backdoor attack methods in the literature?
</content>
</thread_object>

</thread>
<thread>
creation date:
1730245460540

thread_type:
official_review

<thread_object>
creator: reviewer_kedv

<content>
summary:
This paper introduces "Professor X," a novel EEG backdoor attack designed to manipulate the outputs of electroencephalogram (EEG)-based brain-computer interfaces (BCIs). While EEG BCIs are commonly used for medical and device control applications, their safety has often been overlooked. Professor X addresses the limitations of existing EEG attacks, which typically focus on single-target classes and require interaction with the training stage of the BCI or lack stealthiness. This method uniquely considers the specific EEG electrodes and frequencies to be injected based on different EEG tasks and formats. Utilizing a reinforcement learning-based reward function enhances both robustness and stealthiness. Experimental results demonstrate Professor X's effectiveness, robustness, and generalizability, highlighting the potential vulnerabilities in EEG BCIs and urging the community to conduct defensive studies. Additionally, Professor X offers applications in protecting intellectual property within EEG datasets and BCI models by providing a concealed watermark. The attack exploits a three-stage clean label poisoning strategy: selecting triggers for each class, optimizing electrode and frequency injection strategies, and generating poisoned samples through spectral interpolation. Tests on various EEG task datasets confirm the method's efficacy and its ability to bypass existing defenses.

strengths:
It introduces a novel method for manipulating EEG BCI outputs, filling a gap in the existing literature that largely focuses on single-target attacks.
The design incorporates reinforcement learning to enhance the attack's robustness and stealthiness, allowing it to evade detection more effectively than previous methods.
Professor X considers the specific EEG electrodes and frequency ranges relevant to different tasks and formats, making it adaptable to various EEG applications.
Experimental results demonstrate that Professor X is effective across multiple EEG tasks, indicating a broad applicability beyond a single context.

weaknesses:
The potential for malicious use raises significant ethical issues, as manipulating EEG outputs could lead to harmful consequences for users and their applications.

The method involves a sophisticated three-stage clean label poisoning attack, which may be complex to implement in practice, especially for those lacking expertise in reinforcement learning and EEG signal processing.

The design's focus on particular EEG tasks might result in overfitting, reducing its effectiveness in more generalized scenarios or with novel tasks.

The approach may face challenges in scaling up for larger or more complex datasets, potentially limiting its effectiveness in real-world applications involving diverse user populations.

questions:
What ethical frameworks are in place to govern the use of techniques like Professor X, and how can researchers ensure that such methods are not misused?

How effective is STRIP in detecting backdoor inputs under various levels of perturbation? Are there specific types of perturbations that significantly impact its performance?

How does STRIP compare to other defense mechanisms in terms of robustness against backdoor attacks like Professor X? What are its relative strengths and weaknesses?

 What specific mechanisms within the model lead to the observed drop in attack success rate (ASR) when Fine-Pruning is applied? Can these mechanisms be quantified?

How are low-activated neurons determined, and could this method inadvertently remove important features that are crucial for classification?

 How effective is Fine-Pruning at different pruning ratios beyond 0.7? Are there specific thresholds where the attack's effectiveness is significantly impacted?

What future research avenues could be explored to improve defenses against backdoor attacks like Professor X, particularly in the context of Fine-Pruning?
</content>
</thread_object>

</thread>
<thread>
creation date:
1730396869810

thread_type:
official_review

<thread_object>
creator: reviewer_ueul

<content>
summary:
This paper presents "Professor X," a new EEG backdoor attack aimed at influencing the outputs of electroencephalogram (EEG)-based brain-computer interfaces (BCIs). While EEG BCIs are widely utilized in medical and device control settings, their security has often been neglected. Professor X improves upon existing EEG attack methods, which typically target single classes and either require interaction with the BCI's training phase or lack stealth. This innovative approach strategically selects specific EEG electrodes and frequencies for injection based on various EEG tasks and formats. By employing a reinforcement learning-based reward function, the method enhances both robustness and stealth. Experimental results demonstrate Professor X's effectiveness, resilience, and generalizability, underscoring vulnerabilities in EEG BCIs and calling for further defensive research in the field. Additionally, Professor X can help protect intellectual property within EEG datasets and BCI models by embedding a concealed watermark. The attack employs a three-stage clean label poisoning strategy: selecting triggers for each class, optimizing injection strategies for electrodes and frequencies, and generating poisoned samples via spectral interpolation. Testing on diverse EEG task datasets validates the method’s effectiveness and its capacity to circumvent existing defenses.

strengths:
It presents an innovative approach for manipulating EEG BCI outputs, addressing a gap in the existing literature that predominantly emphasizes single-target attacks. The design leverages reinforcement learning to improve the attack's robustness and stealth, enabling it to evade detection more successfully than earlier methods. Professor X takes into account the specific EEG electrodes and frequency ranges associated with different tasks and formats, making it versatile for various EEG applications. Experimental results show that Professor X is effective across multiple EEG tasks, highlighting its broad applicability beyond just one context.

weaknesses:
The method might encounter difficulties when scaling to larger or more intricate datasets, which could restrict its effectiveness in real-world applications with varied user populations.

questions:
What potential research directions could be pursued to enhance defenses against backdoor attacks such as Professor X, especially regarding Fine-Pruning techniques?
</content>
</thread_object>

</thread>
<thread>
creation date:
1730713335152

thread_type:
official_review

<thread_object>
creator: reviewer_jubu

<content>
summary:
The paper introduces Professor X, a novel, frequency-based EEG attack designed to be stealthy and multi-target. The method involves three main steps: 1) Finding triggers for each class, 2) using reinforcement learning to find optimal electrodes and frequencies injection
strategies, and 3) generating poisoned samples using triggers and clean data.

strengths:
1. The study has a clear research question, which makes its purpose easy to understand.
3. The idea of employing reinforcement learning for finding the optimal electrodes and frequencies for data poisoning is interesting. 
2. The authors designed multiple experiments to evaluate different parts of their method, and the ones focused on showing the method's robustness are especially valuable.

weaknesses:
As mentioned in the related works, a research direction exists that focuses on designing frequency-based backdoor attacks. Although existing methods are designed for images rather than time series, the authors could still compare their proposed method with existing approaches to better highlight the novelty of the work in relation to current frequency-based methods.

The authors designed several baselines (stealthy and non-stealthy) based on BadNets, PP-based BD attacks, and so on, which is great. However, it would be great if the authors considered and designed some baselines based on the existing frequency-based BD attack, if applicable.

The stealthiness of the method is one of the claims of the method. Although there are some visualizations in this regard, it would be great if the authors designed an experiment to validate the stealthiness of the method. It may be similar to a previous study [1], which used anomaly detection methods.

The author only considers three models for the classifiers: EEGNet, DeepCNN, and LSTM. However, it would be great if the author considered other new models, like TIMESNET [2] and other new transformer-based models.

The quality of the writing needs improvement; here are some points:
The third paragraph of the introduction requires revision for clarity and coherence. 
Figure 1 consists of five sub-figures that provide a good summary of the method. However, in the introduction (line 050), the authors begin by explaining Figure 1-d, which destroys the flow.

The Methodology section should be improved by first defining the key concepts, symbols, and problems. 
It would also be helpful to include a table of abbreviations and symbols, as the multiple terms used throughout the paper may be confusing for readers. 



[1]. Lin X, Liu Z, Fu D, Qiu R, Tong H. BACKTIME: Backdoor Attacks on Multivariate Time Series Forecasting. arXiv e-prints. 2024 Oct:arXiv-2410.

[2]. Wu H, Hu T, Liu Y, Zhou H, Wang J, Long M. TimesNet: Temporal 2D-Variation Modeling for General Time Series Analysis. InThe Eleventh International Conference on Learning Representations.

questions:
In addition to the points in the 'Weaknesses' section, I'd like to add one more:

How effective is the proposed BD attack when applied to approaches that utilize frequency information of data, such as [3]?



[3] Zhang X, Zhao Z, Tsiligkaridis T, Zitnik M. Self-supervised contrastive pre-training for time series via time-frequency consistency. Advances in Neural Information Processing Systems. 2022 Dec 6;35:3988-4003.
</content>
</thread_object>

</thread>
<thread>
creation date:
1730883992592

thread_type:
official_review

<thread_object>
creator: reviewer_rejd

<content>
summary:
From the outset, the abstract of the submission presents a proposition that appears to be unrealistic and somewhat disconnected from contemporary research realities. It remains inaccurate to assert that "While electroencephalogram (EEG) based brain-computer interfaces (BCIs) have been extensively employed in medical diagnosis, healthcare, and device control, the safety of EEG BCIs has long been neglected."

The manuscript constructs a fictitious framework, suggesting that research regarding BCIs has already translated into widespread applications. The submission relies on historical datasets such as BCIC-IV-2a. It is critical to note that motor imagery may not be effective for the target demographic of individuals with paralysis due to significant neural degeneration. Moreover, the methodology seems to rely on a dubious SEED database to fabricate artificial backdoor attack scenarios, ultimately suggesting solutions that are not based in rigorous academic research. This strategy does not promote the growth of academic inquiry, thus justifying a rejection of this submission.

strengths:
The reviewer found no substantial strengths in the submission. It is fundamentally inadequate to fabricate problems only to propose solutions. Backdoor attacks do not present a significant concern in the field of BCI research at this time, as established paradigms are still lacking. Nonetheless, BCI research is experiencing significant growth due to advancements in machine learning; however, a considerable distance remains before it can transition to healthcare and broader applications that would necessitate the implementation of protections against backdoor attacks.

weaknesses:
The prevailing conditions within the submission exhibit a lack of realism, an insufficiency of novel contributions, and a substantial deficiency in advancements for the BCI community.

questions:
Why did the authors construct an entirely unrealistic and artificial scenario? Where did the authors encounter such hyperbolic or enthusiastic claims regarding the purported applications of BCI in healthcare and medical diagnostics? Currently, only a limited number of conditionally approved, mostly invasive devices have been tested on a small cohort of subjects within closed clinical studies.
</content>
</thread_object>

</thread>
<thread>
creation date:
1731991711035

thread_type:
official_comment

<thread_object>
creator: authors

<content>
title:
General Response by Authors

comment:
We thank all the reviewers for your proficient and valuable comments and suggestions. We are cheerful to find that most of the reviewers have reached the consensus that our methods are novel and our idea of using reinforcement learning to optimize injection techniques is interesting (JuBu, uEuL, kEdv, dg1E). Moreover, we're also glad to see that our extensive experiments for showing the robustness (JuBu, uEuL, kEdv), the innovative three-stage attack (dg1E), the first multi-target attck on EEG BCI, effectiveness across multiple EEG tasks (uEuL, kEdv) are well recognized, and the research question is thought to be clear and easy to understand (JuBu).

**Here, we sincerely invite all the reviewers to read this general response before diving into the detailed responses to your individual concerns,** to help readers to understand **what we are contributing** and **the value of our work (or the severe potential hazard)**.

> What we are contributing.

Before the invention of Professor X, people may think EEG BCI is safe and cannot be injected with any backdoor, or the trigger in a backdoor poisoned sample is easily detected. However, our work alerts the EEG community that **EEG BCI is absolutely not safe**, and **EEG BCI can actually be injected with an invisible and robust backdoor attack**.

We conducted comprehensive experiments and validated the effectiveness of Professor X on various EEG tasks/formats. Moreover, we employed multiple backdoor defensive approaches to defend Professor X, but all of them failed. As a result, we didn't find an effective way to prevent Professor X.

Our work has determined that the **EEG BCI is not safe**, and **alert the whole community of the potential hazard** of misusing Professor X.

> The value of our work (or the severe potential hazard).

Some may worried that the application of EEG BCI is not broad, so regarding the safety of EEG BCI is lack of realism. However, **we don't have to wait until the horse has bolted before close the stable door**, that is, we don't need to wait for the widespread application of a technique before considering its security risk.

We admit that in clinical practice, the number of patients using EEG BCI is limited as they are all suffering severe illnesses like epilepsy [1] (for medical diagnosis) and paralysis [2] (for device control). However, **as long as the EEG BCI is not safe, the result of malicious manipulation is catastrophic for any single patient** -- like misleading the localization of epilepsy lesions, or controlling a paralytic to act dangerously.

**As long as there is one person may be harmed by the security risk of EEG BCI, studying the safety is meaningful.** Not to mention that there are **50 million** epilepsy patients and **15 million** patients suffering from spinal cord injuries worldwide (data from World Health Organization' website). Although only a small number of them have the conditions to receive BCI treatment, this is still not a small number. Since the EEG BCI already helps a paralytic walk again [2], the wider application of EEG BCI is predictable.

Besides the real-world security risk, our attack can also be misused for **falsifying EEG datasets**, which is **more severe in academia**. With the help of Professor X, one can essentially adjust the classification accuracy of a EEG dataset to any level (by adjusting the poisoning rate $\rho$). This will be a disaster for EEG research community, since one can **draw any neuroscience conclusion from a fake EEG dataset** by misuing Professor X.

For example, Jack is an EEG researcher and he wants to know whether can we detect Alzheimer's disease from EEG. So he put in great effort to build an large dataset recording 100 older's EEG signals (half are Alzheimer patients). But he runs classification model on this dataset and finds that the accuracy is very low, let's say just 52% (random level is 50%). Jack doesn't want to see his efforts go to waste, and **unethically used Professor X** to falsify his dataset, increasing the accuracy to 80%. Finally, Jack claims he find that he can detect Alzheimer's disease from EEG signals. However, this neuroscience conclusion is totally a fake finding.

**Every coin has two sides**, our attack can be adopted for protecting intellectual properties of EEG datasets and BCI models. But most importantly, we want to **call for defensive research** as we have not found an effective way to detect and defend Professor X.

[1] Shoeb A, Guttag J. Application of machine learning to epileptic seizure detection[C]//Proceedings of the 27th International Conference on International Conference on Machine Learning. 2010: 975-982.

[2] Lorach H, Galvez A, Spagnolo V, et al. Walking naturally after spinal cord injury using a brain–spine interface[J]. Nature, 2023, 618(7963): 126-133.
</content>
</thread_object>

</thread>
<thread>
creation date:
1732147738210

thread_type:
official_comment

<thread_object>
creator: area_chair_r9hc

<content>
title:
Rebuttal

comment:
Dear Reviewers,

I encourage you to review the rebuttal and reach out to the authors with any additional questions or requests for clarification.

Best,\
AC
</content>
</thread_object>

</thread>
<thread>
creation date:
1732331895727

thread_type:
official_comment

<thread_object>
creator: authors

<content>
title:
Kindly request for post-rebuttal comments

comment:
Dear Reviewers:
﻿

Thank you again for your wisdom and valuable comments. We have provided additional results or complete explanations for all the questions. Since the rebuttal process is approaching its end, we would be glad to hear from you whether our rebuttal has addressed your concerns. Feel free to comment on our rebuttal if you have further questions or considerations.
</content>
</thread_object>

</thread>
<thread>
creation date:
1732545356844

thread_type:
official_comment

<thread_object>
creator: area_chair_r9hc

<content>
comment:
Dear Reviewers,

As we approach the end of the discussion period, I would like to encourage you again to review the rebuttal and engage with the authors if you have any additional questions or need further clarification. If you have no further questions, please acknowledge that you have received and reviewed the rebuttal.

Best,\
AC
</content>
</thread_object>

</thread>
<thread>
creation date:
1732611445650

thread_type:
official_comment

<thread_object>
creator: authors

<content>
title:
Adding a discussion section about defensive study in the revised paper

comment:
Dear ACs, reviewers, and readers:

Thanks to the reviewer JuBu, uEuL and kEdv, who asked many questions regarding the defensive study against Professor X. These insightful concerns deepen our understanding of our attack and how to guard backdoor attack in EEG BCIs. Thus, we added a new section in the revised paper's appendix (marked in blue) to discuss our humble opinion on the defensive study against Professor X, which we hope will benefit the future research.

Best,

Authors
</content>
</thread_object>

</thread>
<thread>
creation date:
1732897106971

thread_type:
official_comment

<thread_object>
creator: area_chair_r9hc

<content>
comment:
Dear Reviewers,

If you haven’t already done so, I strongly encourage you to engage with the authors. Please note that there is no need to make any commitments regarding the final score at this time; but I would appreciate it if you could acknowledge that you have received and reviewed their responses, and ask any follow-up questions you may have.

Best,\
AC
</content>
</thread_object>

</thread>


Metareview:
metareview:
The paper introduces a novel and robust backdoor attack framework for EEG-based Brain-Computer Interfaces. The method employs a label-poisoning strategy with reinforcement learning to inject undetectable triggers into EEG signals. The paper introduces and tackles a very interesting notion - one which should not be ignored as BCI technologies become more adopted. The solution is also interesting and effective. However, the paper had a few weaknesses. The paper is somewhat difficult to follow, with key concepts like "stealth" lacking clear definition and justification. It also falls short in benchmarking against recent methods in time-series or signal-processing attacks. Additionally, the absence of an ethical discussion is a significant oversight for a topic of this nature. The analysis of backdoor defense mechanisms is limited in both scope and depth.