Title: ManiBCI: Manipulating EEG BCI with Invisible and Robust Backdoor Attack via Frequency Transform
Venue: NeurIPS 2024
Accepted: no
Keywords: EEG BCI

electroencephalogram

backdoor attack

reinforcement learning

frequency transform
Abstract: The electroencephalogram (EEG) based brain-computer interface (BCI) has taken the advantages of the tremendous success of deep learning (DL) models, gaining a wide range of applications. However, DL models have been shown to be vulnerable to backdoor attacks. Despite there are extensive successful attacks for image, designing a stealthy and effect attack for EEG is a non-trivial task. While existing EEG attacks mainly focus on single target class attack, and they either require engaging the training stage of the target DL models, or fail to maintain high stealthiness. Addressing these limitations, we exploit a novel backdoor attack called ManiBCI, where the adversary can arbitrarily manipulate which target class the EEG BCI will misclassify without engaging the training stage. Specifically, ManiBCI is a three-stages clean label poisoning attacks: 1) selecting one trigger for each class; 2) learning optimal injecting EEG electrodes and frequencies masks with reinforcement learning for each trigger; 3) injecting the corresponding trigger’s frequencies into poisoned data for each class by linearly interpolating the spectral amplitude of both data according to the learned masks. Experiments on three EEG datasets demonstrate the effectiveness and robustness of ManiBCI. The proposed ManiBCI also easily bypass existing backdoor defenses. Code will be published after the anonymous period.

1

Abstract

The electroencephalogram (EEG) based brain-computer interface (BCI) has taken the advantages of the tremendous success of deep learning (DL) models, gaining a wide range of applications. However, DL models have been shown to be vulnerable to backdoor attacks. Although there are extensive successful attacks for image, designing a stealthy and effective attack for EEG is a non-trivial task. While existing EEG attacks mainly focus on single target class attack, and they either require engaging the training stage of the target DL models, or fail to maintain high stealthiness. Addressing these limitations, we exploit a novel backdoor attack called ManiBCI , where the adversary can arbitrarily manipulate which target class the EEG BCI will misclassify without engaging the training stage. Specifically, ManiBCI is a three-stages clean label poisoning attacks: 1) selecting one trigger for each class; 2) learning optimal injecting EEG electrodes and frequencies masks with reinforcement learning for each trigger; 3) injecting the corresponding trigger's frequencies into poisoned data for each class by linearly interpolating the spectral amplitude of both data according to the learned masks. Experiments on three EEG datasets demonstrate the effectiveness and robustness of ManiBCI. The proposed ManiBCI also easily bypass existing backdoor defenses. Code will be published after the anonymous period.

1 Introduction

Deep learning (DL) has greatly boosted the performances of the electroencephalogram (EEG) based brain-computer interfaces (BCI), which have been widely used in medical diagnosis [1], healthcare [2], and device control [3, 4]. While DL-based systems are shown to be vulnerable to backdoor attacks (BA) [5-7], where an adversary embeds a hidden backdoor into a DL models to maliciously control it's outputs for inference samples containing particular triggers (a.k.a, poisoned samples), the security of the DL-based EEG BCI has been long neglected.

However, compared to image, designing an effect and stealthy BA for EEG is not trivial for three difficulties, which lead to three questions.

D1

:

EEG data has a significantly low signal-to-noise ratio (SNR) [8], even the accuracies of original EEG tasks are very low [9].

Q1

: How to develop an

EEG BA with high attack success rate (ASR) while preserving the clean accuracies of orignial task?

D2

: Previous studies demonstrated for different EEG tasks, there are some different critical EEG

electrodes and frequencies that strongly related to the performance of EEG BCI [10-14], indicating i.e.

, which electrodes and frequencies to inject triggers) inevitably

: How to find the optimal strategy for different EEG tasks?

that the trigger-injection strategy (

affect the performance of BA.

Q2

D3

:

Certain classes of EEG have specific morphology that can easily be identified by human expert, e.g. , 34

in epilepsy detection, the amplitudes of the ictal phase EEG are larger than those of the normal state 35

phase EEG [15]. Q3 : How to maintain the consistency of the label and the morphology? 36

data

manifold

real data bound

ar

y

fake data

(a) Randomly select

GLYPH(cmap:d835)

triggers

Reinforcement

Learning

(b)

Learn optimal strategies

GLYPH(cmap:d835)

GLYPH(cmap:d835)

GLYPH(cmap:d835)

GLYPH(cmap:d835)

GLYPH(cmap:d835)

GLYPH(cmap:d835)

GLYPH(cmap:d835)

GLYPH(cmap:d835)

GLYPH(cmap:d835)

GLYPH(cmap:d835)

GLYPH(cmap:d835)

GLYPH(cmap:d835)

GLYPH(cmap:d835)

GLYPH(cmap:d835)

GLYPH(cmap:d835)

GLYPH(cmap:d835)

GLYPH(cmap:d835)

GLYPH(cmap:d835)

GLYPH(cmap:d835)

GLYPH(cmap:d835)

GLYPH(cmap:d835)

GLYPH(cmap:d835)

GLYPH(cmap:d835)

GLYPH(cmap:d835)

GLYPH(cmap:d835)

GLYPH(cmap:d835)

GLYPH(cmap:d835)

GLYPH(cmap:d835)

GLYPH(cmap:d835)

GLYPH(cmap:d835)

GLYPH(cmap:d835)

GLYPH(cmap:d835)

GLYPH(cmap:d835)

GLYPH(cmap:d835)

GLYPH(cmap:d835)

GLYPH(cmap:d835)

clean data

GLYPH(cmap:d835)(GLYPH(cmap:d835),

, GLYPH(cmap:d835),

GLYPH(cmap:d835)

GLYPH(cmap:d835)

GLYPH(cmap:d835)

, GLYPH(cmap:d835)

GLYPH(cmap:d835)

GLYPH(cmap:d835)

)

GLYPH(cmap:d835)(GLYPH(cmap:d835),

, GLYPH(cmap:d835),

GLYPH(cmap:d835)

GLYPH(cmap:d835)

GLYPH(cmap:d835)

, GLYPH(cmap:d835)

GLYPH(cmap:d835)

GLYPH(cmap:d835)

)

GLYPH(cmap:d835)(GLYPH(cmap:d835),

, GLYPH(cmap:d835),

GLYPH(cmap:d835)

GLYPH(cmap:d835)

GLYPH(cmap:d835)

, GLYPH(cmap:d835)

GLYPH(cmap:d835)

GLYPH(cmap:d835)

)

class 1

GLYPH(cmap:d835)

EEG

electrodes

Trigger data from class

GLYPH(cmap:d835)

Amplitude

Phase

Amplitude

Phase

×

(1 - GLYPH(cmap:d835))

×

GLYPH(cmap:d835)

⨁

GLYPH(cmap:d835)

Injected Amplitude

GLYPH(cmap:d835)

-1

Poisoned data with label

GLYPH(cmap:d835)

(e) ManiBCI Attacks

class 2

class 3

GLYPH(cmap:d835)(GLYPH(cmap:d835), GLYPH(cmap:d835)

GLYPH(cmap:d835)

, GLYPH(cmap:d835),

GLYPH(cmap:d835)

GLYPH(cmap:d835)

GLYPH(cmap:d835)

, GLYPH(cmap:d835)

GLYPH(cmap:d835)

GLYPH(cmap:d835)

)

：

for each electrode

GLYPH(cmap:d835)

GLYPH(cmap:d835)

in

GLYPH(cmap:d835)

GLYPH(cmap:d835)

GLYPH(cmap:d835)

:

Injected

GLYPH(cmap:d835)

GLYPH(cmap:d835)

GLYPH(cmap:d835)

GLYPH(cmap:d835)

Fast Fourier Transform

Inverse Fourier Transform

Clean data flow

Trigger data flow

Poisoned data flow

GLYPH(cmap:d835)

-1

GLYPH(cmap:d835)

GLYPH(cmap:d835)

GLYPH(cmap:d835)

GLYPH(cmap:d835)

Clean data

GLYPH(cmap:d835)

GLYPH(cmap:d835)

...

(d) Existing EEG Backdoor Attacks

GLYPH(cmap:d835)(GLYPH(cmap:d835))

clean data

EEG

electrodes

...

...

pulse signals

Add

...

poinsoned data

GLYPH(cmap:d835)(GLYPH(cmap:d835))

only one

target

class

The first BA for EEG modality is demonstrated in Fig 1 (d), where the narrow period pulse (NPP) 37

signals are added as the trigger for single target class attack [16, 17]. To generate invisible trigger, the 38

adversarial loss is applied to learn a spatial filter as the trigger function [18]. Recently, some BA for 39

time series (EEG signal is a kind of time series) adopt generative adversarial net (GAN) to produce 40

poisoned data [19, 20]. However, there are rich information in the frequency domain of EEG [21-24]. 41

which will inevitably bring unnatural frequency into the real EEG frequency domain. 43

In this paper, we propose a novel backdoor attack for mani pulating EEG BCI called ManiBCI to 44 address Q1 , which injects triggers in the frequency domain. Specifically, ManiBCI is a three-stage 45 clean label poisoning attack demonstrated in Fig 1 (a-c): 1) : selecting c triggers from c classes , as 46 these triggers are all real EEG, the frequency of these triggers are all natural. Thus, the poisoned 47 data are similar to the real EEG as shown in Fig 2(b). 2) : learning optimal injecting strategies for 48 each trigger with reinforcement learning to enhance the performance of EEG BA, addressing Q2 . 3) : 49 injecting each trigger's frequencies into clean EEG of the same class as the triggers for each class, 50 which maintains the consistency of the label and morphology, addressing Q3 . 51

The main contributions of this paper are summarized below: 52

53

54

We propose a novel backdoor attack for EEG BCI called ManiBCI , which can attack arbitrary class while preserving stealthiness without engaging the training stage.

55

56

57

58

To the best of our knowledge, it is the first work that considers the efficacy of different EEG electrodes and frequencies in EEG backdoor attacks with reinforcement learning.

Extensive experiments on three EEG BCI datasets demonstrate the effectiveness of ManiBCI and the robustness against several common EEG preprocessings and backdoor defenses.

2 Related Work 59

2.1 Backdoor Attacks 60

Backdoor attacks has been deeply investigated in image processing filed [25-27]. BadNets [28] is 61

the first BA, where the adversary maliciously control the DL to misclassify the input images contain 62

suspicious patches to a target class. Other non-stealthy attacks like blended [5] and sinusoidal strips 63

based [29] were studied then. To achieve higher stealthiness, some data poisoning BA were developed, 64

including shifting color spaces [30], warping [31], regularization [32] and frequency-based [33-38]. 65 Other stealthy attacks [39-41] generate invisible trigger patterns by adversarial loss, which requires 66 the control of the model's training process. 67

Recently, the EEG-based BCIs have shown to be vulnerable to BA 68 [16-18]. The NPP signals are added to clean EEG to generate non69 stealthy poisoned samples in [16, 17], which significantly modifies 70 the spectral distribution (as shown in Fig 2 (a)) and results in low 71 stealthiness. From the view of data manifold in Fig 1 (a), NPP72 added EEG are fake data. To generate more stealthy poisoned 73 data which stay in the real data boundary. The adversarial loss 74 has been applied backdoor EEG BCI [18] and time series [19, 20], 75

76

77

78

79

80

81

82

83

84

85

86

87

88

Real Data

NPP-added Poisoned Data

Real Data

ManiBCI Poisoned Data

but these methods require controlling the training process of the backdoor models and can only attack a single target class. Meng et.al. tried to achieve multi-target attacks with adding different types of signals to clean EEG, i.e. , NPP, sawtooth, sine, and chirp [16]. However, these signals are not stealthy in both the temporal and frequency domain. To attack multi-target class with high stealthiness, Marksman backdoor [41] generates invisible sample-specific patterns for each possible class, but it needs controlling the training stage. Moreover, generating trigger patterns with a neural network for each sample is time-consuming.

Different from the EEG BA in the temporal domain, we firstly propose to attack in the frequency domain. Our attack is more stealthy than NPP-based attack, faster than other trigger generation attack, and more practical as requiring no control of the target models. It is worth noting that the frequency-based BA for image [33-38] cannot be applied for time series, as they do not consider the characteristics of time series and fail to maintain the stealthiness for poisoned time series data.

2.2 Backdoor Defenses

To cope with the security problems of backdoor attacks, several categories of defensive methods have 89 been developed. Neural Cleanse [42] is a trigger reconstruction based methods. If the reconstructed 90 trigger pattern is significantly small, the model is identified as a backdoor model. Assuming the 91 trigger is still effective when a triggered sample is combining with a clean sample, STRIP [43] 92 detects the backdoor model by feeding the combined samples into the model to see if the predictions 93 are still with low entropy. Spectral Signature [44] detects the backdoor model based on the latent 94 representations. Fine-Pruning [45] erases the backdoor by pruning the model. 95

96

97

98

Besides the above defenses designed for backdoor attacks, there are some common EEG preprocessing methods, such as bandstop filtering and down-sampling, should be considered when designing a practical robust backdoor attack for EEG BCI in the real-world scene.

99

100

101

102

103

104

105

106

107

108

3 Methodology

3.1 EEG BCI Backdoor Attacks and Threat Model

Under the supervised learning setting, a classifier f is learned using a labeled training set S = { ( x 1 , y 1 ) , ..., ( x N , y N ) } to map f : X → C , where x i ∈ X and y i ∈ C . The attacker in single target class backdoor attacks aims to learn a classifier f behaves as follows:

where T : X → X is the trigger function and c tar is the target label. For multi-target class backdoor attacks, the trigger function has an extra parameter c i , which manipulates the behavior of f flexibly:

We consider a malicious data provider, who generates a small number of poisoned samples (labeled with the target class) and injects them into the original dataset. A victim developer collects this poisoned dataset and trains his model, which will be infected a backdoor.

We use a cross-validation setting to evaluate all BAs, each EEG dataset D is divided into three 109 parts: training set D train , poisoning set D p , and test set D test . Specifically, for a dataset contains n 110 subjects, we select one subject's data as D p one by one, and the remaining n -1 subjects to perform 111

112

113

114

115

116

117

118

119

120

121

122

123

124

125

126

leave-one-subject-out (LOSO) cross-validation, i.e. , one of the subjects as D test , and the remaining n -1 subjects as D train (one of the subjects in D train is chosen to be validation set). In summary, for a dataset contains n subjects, there are n ( n -1) runs to validate each EEG BCI backdoor attack method. A poisoned subset S p of M ( M < N ) examples is generated based on D p . Then S p is combined with D train to acquire S = {S p , D train } . The poisoning ratio is defined as : ρ = M/N .

3.2 Reinforcement Learning for Optimal Trigger-Injection Strategies

The learning of the injecting electrodes set M c i e and frequencies set M c i f for each selected trigger in class c i can be formulated as a non-convex optimization problem. Under this optimization framework, the strategy generator function will learn the optimal M c i e and M c i f for each EEG trigger to implement ManiBCI BA on target DL model f , which is supposed to have a high clean accuracy (CA) on the clean data and attack success rate (ASR) on the poisoned data:

However, finding the optimal adaptive injecting strategies for each trigger is not trivial as the searching space is too large ( e.g. , if injecting half of the 62 electrodes, there are ( 62 31 ) ≈ 4 . 65 × 10 17 cases for deciding M c i e ). Reinforcement learning (RL) is an appropriate method for tackling this questions. The objective of RL is to find a sampler π to maximize the expect of the reward function:

where R ( τ ) is reward function of a trajectory τ = ( s 1 , a 1 , r 1 , ....s T ) , the s i , a i , r i means the state, 127 action, and reward at time i . The ρ 0 indicates the sampler of initial state. In our settings, the action 128 (strategies) do not affect the state (triggers). Hence, we can simplify Eq 4 by removing the states s i : 129

However, we do not care about the reward of the whole trajectory, we only acquire a single strategy for each trigger. Thus, we replace the R ( τ ) with R ( a t ) and select the a t whose R ( a t ) is the biggest as the optimal strategy. Here, an RL algorithm called policy gradient [46] is adopted to learn an agent ( i.e. , policy network π c i θ with parameters θ ) to find the optimal strategy for each trigger. After removing the state s t and replacing R ( τ ) , the gradient estimator is:

where a t and R t is the action and estimator of the reward function at timestep t . The expectation E t indicates the empirical average. Here, a t = {M c i e , M c i f } . The parameters of π c i θ are updated by θ t +1 = θ t + η ˆ g , η is the learning rate. We run the RL for T steps and take the best a t as the strategy.

The CA and ASR are obtained by implementing ManiBCI only on S . Specifically, we use a concise network as the agent which takes the extracted spatial-temporal features from triggers into account to generate better policy. This agent has two output vectors v 1 ∈ R E , v 2 ∈ R F , where E and F is the number of EEG electrodes and frequencies. The electrodes and frequencies are in M c i e and M c i f only if the corresponding positions in v 1 and v 2 have Topk values, k is γE for electrodes and βF for frequencies, where γ, β ∈ (0 , 1] are hyperparameters.

Besides the performance of CA and ASR, there are two important concerns: C1: Robustness against common EEG preprocessig-based defenses; C2: Stealthiness against human perceptions. The reason why we consider C1 is that the bandstop filtering is widely used for preprocessing EEG signals. For instance, if we inject the triggers into a concentrated frequency band 50-60Hz, it is easy to filter the trigger out using a 50Hz low pass filter, resulting in attack failure. Thus, scattering the injection positions in various frequency can effectively evade from specific frequency filter defenses. To address C2 , injecting the trigger into higher frequencies is more invisible than lower frequencies [47]. Taking all into consideration, we define the estimator of the reward function R t as follows:

130

131

132

133

134

135

136

137

138

139

140

141

142

143

144

145

146

147

148

149

150

151

152

153

154

155

156

157

158

159

160

161

162

163

164

165

166

167

168

169

170

171

172

173

174

175

176

177

178

179

180

181

182

183

184

185

186

187

188

189

190

191

192 193

where the M c i f indicates the set of all injecting frequency positions, and dis() calculates the minimal distance between each pair of positions. Thus, dis( M c i f ) is the discrete (DIS) loss, and min( M c i f ) is the high frequency (HF) loss, which can scatter the injection positions in various frequency bands and inject as high frequencies as possible. The λ, µ, ν ∈ R are hyperparameters.

3.3 Poisoned Data Generation via Frequency Transform

After selecting the C triggers from each class and learning the strategy for each trigger, the poisoned data are generated by injecting these triggers into clean data with the corresponding strategies. As shown in Fig 1(c), given a clean data x i ∈ D p with label c i , and a trigger data x t c i , let F A and F P be the amplitude and phase components of the fast Fourier transform (FFT) result of a EEG signals, we denote the amplitude and phase spectrum of x i and x t c i as:

The new poisoned amplitude spectrum A P x i is produced by linearly interpolating A x i and A x t c i . In order to achieve this, we produce a binary mask M c i ∈ R E × F = 1 ( j,k ) , j ∈ M c i e , k ∈ M c i f , whose value is 1 for positions of all corresponding to elements in both electrode and frequency sets and 0 elsewhere. Denoting α ∈ (0 , 1] as the linear interpolating ratio, the new poisoned amplitude spectrum can be computed as follows, where ⊙ indicates Hadamard product:

Finally, we adopt the injected poisoned amplitude spectrum A P x i and the clean phase spectrum P x i to get the poisoned data by inverse FFT F -1 :

By generating x p i through this frequency injection approach, we obtain a subset S p = { x p 1 , ..., x p M } , which will combine with D train to form the whole traing dataset S . The EEG DL model f is then trained with S to obtain the ability of behvaing as equation 2.

4 Experiments

4.1 Datasets, Baselines, and Experimental Setup

Emotion Recognition (ER) Dataset SEED [12] is a discrete EEG emotion dataset studying three types of emotions: happy, neutral, and sad. SEED collected EEG from 15 subjects.

Motor Imagery (MI) Dataset BCIC-IV-2a [48] dataset recorded EEG from 9 subjects while they were instructed to imagine four types of movements: left hand, right hand, feet, and tongue.

Epilepsy Detection (ED) Dataset CHB-MIT [49] is an epilepsy dataset required from 23 patients. We cropped and resampled the CHB-MIT dataset to build an ED dataset with four types of EEG: ictal, preictal, postictal, and interictal phase EEG.

Non-stealthy Baselines As mentioned in previous sections, to the best of our knowledge, ManiBCI is the first work that studies multi-trigger and multi-target class (MT) backdoor in EEG BCI. For comparison, we design several baseline approaches which can be divided into two main groups: non-stealthy and stealthy. Non-stealthy attacks contains PatchMT and PulseMT . For a benign EEG segment x ∈ R E × T . PatchMT is a multi-trigger and MT extension of BadNets [28] where we fill the first βT timepoints of a EEG segments with a constant number, e.g. , {0.1, 0.3, 0.5} for three-class task. PulseMT is a multi-trigger and MT extension of NPP-based backdoor attacks [16] where we use NPP signals with different amplitudes, e.g. , {-0.8, -0.3, 0.3, 0.8} for different target classes.

Stealthy Baselines Previous works generate stealthy poisioned samples by controlling the training stage and can only attack single target class [18-20]. As they control the training of target model, it is unfair to directly compare their methods with ManiBCI. There is no stealthy MT BA for EEG. Thus, we design two MT stealthy attacks baselines: CompMT and AdverMT . CompMT generates poisoned samples for different target classes by compressing the amplitude of EEG with different

194

195

196

197

198

199

200

201

202

203

204

205

206

207

208

209

210

211

212

213

214

215

216

217

218

219

220

221

222

223

224

225

ratios, e.g. , {-0.1, 0, 0.1} for three-class task. AdverseMT is a multi-trigger and MT extension of adversarial filtering based attacks [18], where we using a local model trained only on S p to generate different spatial filters W ∗ i for different target classes, then we apply these spatial filters to generate poisoned samples. More details are written in Appendix D.

Experimental Setup We demonstrate the effectiveness of the proposed ManiBCI backdoor through comprehensive experiments on the above three EEG datasets, more details of each dataset and preprocessings are illustrated in Appendix C. We follow the poisoning attack setting as the previous works [16] and consider three EEG DL models for classifier f : EEGNet [50], DeepCNN [51], and LSTM [52, 53]. For all methods, we train the classifiers using the Adam optimizer with learning rate of 0.001. The batch size is 32 and the number of epochs is 100. For all datasets and baselines, the interpolating ratio α = 0.8, the electrode poisoning ratio β = 0.1, the electrode poisoning ratio γ = 0.5. For the reinforcement learning of ManiBCI, we train π ξ using the Adam optimizer with learning rate of 0.01. The hyperparameters in advantage function is set to λ = 2 , µ = 0 . 3 , and ν = 0 . 005 . More details of the experimental setup can be found in the supplementary material.

4.2 Effectiveness of ManiBCI

This section presents the attack success rates of ManiBCI and baselines. To evaluate the performance in the multi-trigger multi-payload scenario, for each test sample ( x, y ) ∈ D test , we enumerate all possible target labels c i ∈ C including the true label y and inject the trigger to activate the backdoor. The attack is successful only when the backdoor classifier f correctly predicts c i for each poisoned input x with a target label c i .

4.2.1 Attack Performance

The clean-data accuracy (Clean) and ASR (Attack) for each class of all attack methods on three EEG tasks with three EEG DL models are presented in Table 1. The AdverMT, designed for single-target attack, fails to attacks multiple target classes. Our ManiBCI significantly outperforms baselines at almost all cases ( p < 0 . 05 ) except attacking DeepCNN on the ED dataset, having ASRs above 0.8 on three datasets and even achieving an ASR of 1.000 on the MI dataset. These results demonstrate that our ManiBCI is effective across different EEG tasks and EEG models. PulseMT achieves the second best on ER and ED dataset, CompMT achieves the second best on the MI dataset.

4.2.2 Performance of the Reinforcement Learning: Policy Gradient

Displaying in Table 2, the performance of the policy gradient was compared with other common optimazation algorithms, including genetic algorithm (GA) [54] and random selection (The search space is too large for performing grid search as explained in Section 3.2). It can be observed that the

policy gradient outperforms GA while only spending 16% training time of GA. We plot the learning 226 curve of RL in Appendix F.3, which demonstrates that RL learns well strategies within 50 epochs, i.e., 227 only trains 50 backdoor models and saves lots of time. The random algorithm can achieve a not bad 228 results, proving that our methods can be applied without RL if some performance drop is acceptable. 229

4.2.3 Performance of Learned Mask Strategies on Other Target Models

We demonstrate that the injecting strategies learned on a EEG classifier f can be used to attack other EEG classifiers ˆ f . In other words, Marksman can still be effective when the adversary has no knowledge of the target models ˆ f . To perform the experiments, we use the strategy learned with a classifier f , then generate poisoned samples to attack another classifier ˆ f whose network is different from f . Table 3 shows the performance difference, it can be observed that the difference is relatively small in most of the cases, demonstrating the transferability of the injecting strategy learned with reinforcement learning.

4.2.4 Attack Performance with Different Hyperparameters

We investigate the influences of three different hyperparameters: poisoning rate ρ , frequency injection rate β , and electrode injection rate γ . The performance of attacking EEGNet on the ED dataset are displayed in Fig 3. It can be seen that the ASRs are positively correlated with poisoning rate. Note that it is non-trivial for multi-target class attack, thus the ASR is not high compared to the single class attack. ManiBCI outperforms other attacks in all cases and is robust to the change of β and γ .

0.05

0.10

0.15

0.20

0.25

0.30

0.35

0.40

Poisoning Rate

0.3

0.4

0.5

0.6

0.7

0.8

0.9

0.1

0.2

0.3

0.4

0.5

Frequency/Time Injection Rate

0.5

0.6

0.7

0.8

0.9

0.2

0.4

0.6

0.8

1.0

Electrodes Injection Rate

0.3

0.4

0.5

0.6

0.7

0.8

0.9

1.0

ManiBCI/C

ManiBCI/B

PatchMT/C

PatchMT/B

PulseMT/C

PulseMT/B

CompMT/C

CompMT/B

230

231

232

233

234

235

236

237

238

239

240

241

242

243

244

245

246

247

248

249

250

251

252

253

254

255

256

257

258

259

260

261

262

263

264

265

266

267

268

269

270

271

272

4.3 Robustness of ManiBCI

In this section, we evaluate the robustness of our ManiBCI against different EEG preprocessing method and various representative backdoor defenses.

4.3.1 Robustness against EEG Preprocessing Methods

To develop an EEG BCI, it is very common to preprocess the raw EEG signals, e.g. , 1) band-stop filtering and 2) down-sampling. An EEG backdoor attack is impractical in real scenarios if it is no longer effective when the target model is trained with the preprocessed poisoned EEG. Hence, we must take the robustness against preprocessing methods into account, which is widely ignored in the image backdoor attack field. The performance of each method facing different preprocessing methods are presented in Table 4. It can be observed that our ManiBCI is robust in all cases. However, when removing the DIS loss, the performance of ManiBCI decreases a lot after EEG preprocessing, especially facing the 30 Hz high-stop filtering preprocessing due to the HF loss that encourages the policy network learns to injecting high frequency.

4.3.2 Robustness against Neural Cleanse: Trigger Inversion

Neural Cleanse (NC) [42] calculate a metric called Anomaly Index by reconstructing trigger pattern for each possible label. The Anomaly Index is positively correlated with the size of the reconstruction trigger. A model with Anomaly Index > 2 is considered to be backdoor-injected. We display the Anomaly Indexes of the clean models and the backdoor-injected model by ManiBCI in Fig 4. It can be seen that ManiBCI can easily bypass NC. The reconstructed trigger patterns on three datasets are presented in Appendix F.1.

4.3.3 Robustness against STRIP: Input Perturbation

Emotion

Motor Imagery

Epilepsy

0.0

0.5

1.0

1.5

2.0

0.67

0.7

1.33

0.67

0.69

1.29

0.77

0.83

1.12

0.98

0.9

1.36

0.72

0.76

1.25

0.83

0.72

1.28

EEGNet_C

EEGNet_B

DeepCNN_C

DeepCNN_B

LSTM_C

LSTM_B

We evaluate the robustness of ManiBCI against STRIP [43], which perturbs the input EEG and calculates the entropy of the predictions of these perturbed EEG data. Based on the assumption that the trigger is still effective after perturbation, the entropy of backdoor input tends to be lower than that of the clean one. The results are plotted in Fig 5, it can be seen that the entropy distributions of the backdoor and clean samples are similar.

0.0

0.2

0.4

0.6

0.8

1.0

1.2

1.4

1.6

0.00

0.05

0.10

0.15

0.20

0.25

0.30

0.35

Probability

0.00

0.25

0.50

0.75

1.00

1.25

1.50

1.75

2.00

0.00

0.02

0.04

0.06

0.08

Probability

0.00

0.01

0.02

0.03

0.04

0.05

Probability

Without Backdoor

ManiBCI Backdoor

Entropy

Entropy

Entropy

Without Backdoor

ManiBCI Backdoor

Without Backdoor

ManiBCI Backdoor

0.00

0.25

0.50

0.75

1.00

1.25

1.50

1.75

2.00

Emotion Recognition

Motor Imagery

273

4.3.4 Robustness against Spectral Signature: Latent Space Correlation

Spectral Signature [44] detects the backdoor samples by statistical analysis of clean data and backdoor 274 data in the latent space. Following the same experimental settings in [44], we randomly select 5,000 275 clean samples and 500 ManiBCI backdoor samples and plot the histograms of the correlation scores 276 in Fig 6. There is no clear separation between these two sets of samples, showing the stealthiness of 277 ManiBCI backdoor samples in the latent space. 278

4.3.5 Robustness against Fine-Pruning 279

280

281

282

283

284

285

286

287

We evaluate the robustness of Marksman against Fine-Pruning [45], a model analysis based defense which finds a classifier's low-activated neurons given a small clean dataset. Then it gradually prunes these low-activated neurons to mitigate the backdoor without affecting the CA. We can observe from Fig 7 that the ASR drops considerably small when pruning ratio is less than 0.7, suggesting that the Fine-Pruning is ineffective against ManiBCI.

288

289

290

291

292

293

0.0

0.1

0.2

0.3

0.4

0.5

0.6

0.7

0.8

0.9

Fraction of Pruned Neurons

0.3

0.4

0.5

0.6

0.7

0.8

0.9

1.0

Emotion/C

Emotion/B

Motor/C

Motor/B

Epilepsy/C

4.4 Visualization of Backdoor Attack Samples

To evade from human perception ( C2 in Section 3.2), we design to obatin injecting strategies with HF loss. It can be seen from the bottom row of Fig 8 that ManiBCI (with HF loss) generates stealthy poisoned EEG, which is almost the same as the clean EEG, demonstrating the High Stealthiness . The poisoned EEG will be conspicuous compared to the clean EEG if remove the HF loss.

w/o HF loss

ManiBCI

5 Conclusion

In this paper, we proposed ManiBCI, a novel EEG backdoor for manipulating EEG BCI, where the 294 adversary can arbitrarily control the output for any input samples. To the best of our knowledge, 295 ManiBCI is the first method that considers which EEG electrodes and frequencies to be injected by 296 adopting a reinforcement learning called policy gradient to learn the adaptive injecting strategies 297 for different EEG triggers and tasks. We specially design the reward function in RL to enhance the 298 robustness and stealthiness of ManiBCI. The perturbation of the trigger on clean EEG is almost 299 invisible. Our experimental results over three common EEG datasets demonstrate the effectiveness 300 of ManibCI and the stealthiness against the existing representative defenses. This work calls for 301 defensive studies to counter ManiBCI for EEG modality. 302

303

304

305

306

307

308

309

310

311

312

313

314

315

316

317

318

319

320

321

322

323

References

I. Ahmad, X. Wang, M. Zhu, C. Wang, Y. Pi, J. A. Khan, S. Khan, O. W. Samuel, S. Chen, G. Li et al. , 'EEG-based epileptic seizure detection via machine/deep learning approaches: a systematic review,' Computational Intelligence and Neuroscience , vol. 2022, 2022.

M. Jafari, A. Shoeibi, M. Khodatars, S. Bagherzadeh, A. Shalbaf, D. L. García, J. M. Gorriz, and U. R. Acharya, 'Emotion recognition in EEG signals using deep learning methods: A review,' Computers in Biology and Medicine , p. 107450, 2023.

H. Lorach, A. Galvez, V. Spagnolo, F. Martel, S. Karakas, N. Intering, M. Vat, O. Faivre, C. Harte, S. Komi et al. , 'Walking naturally after spinal cord injury using a brain-spine interface,' Nature , vol. 618, no. 7963, pp. 126-133, 2023.

H. Altaheri, G. Muhammad, M. Alsulaiman, S. U. Amin, G. A. Altuwaijri, W. Abdul, M. A. Bencherif, and M. Faisal, 'Deep learning techniques for classification of electroencephalogram (EEG) motor imagery (MI) signals: A review,' Neural Computing and Applications , vol. 35, no. 20, pp. 14 681-14 722, 2023.

X. Chen, C. Liu, B. Li, K. Lu, and D. Song, 'Targeted backdoor attacks on deep learning systems using data poisoning,' arXiv preprint arXiv:1712.05526 , 2017.

Y. Gao, B. G. Doan, Z. Zhang, S. Ma, J. Zhang, A. Fu, S. Nepal, and H. Kim, 'Backdoor attacks and countermeasures on deep learning: A comprehensive review,' arXiv preprint arXiv:2007.10760 , 2020.

R. Shokri et al. , 'Bypassing backdoor detection algorithms in deep learning,' in 2020 IEEE European Symposium on Security and Privacy (EuroS&P) . IEEE, 2020, pp. 175-183.

S. L. Kappel, D. Looney, D. P. Mandic, and P. Kidmose, 'Physiological artifacts in scalp EEG and ear-EEG,' Biomedical Engineering Online , vol. 16, pp. 1-16, 2017.

M. Tangermann, K.-R. Müller, A. Aertsen, N. Birbaumer, C. Braun, C. Brunner, R. Leeb, C. Mehring, K. J. 324 Miller, G. R. Müller-Putz et al. , 'Review of the bci competition iv,' Frontiers in Neuroscience , vol. 6, p. 55, 325 2012. 326

M. Z. Parvez and M. Paul, 'EEG signal classification using frequency band analysis towards epileptic 327 seizure prediction,' in 16th Int'l Conf. Computer and Information Technology . IEEE, 2014, pp. 126-130. 328

R. Jana and I. Mukherjee, 'Deep learning based efficient epileptic seizure prediction with EEG channel 329 optimization,' Biomedical Signal Processing and Control , vol. 68, p. 102767, 2021. 330

W.-L. Zheng and B.-L. Lu, 'Investigating critical frequency bands and channels for EEG-based emotion 331 recognition with deep neural networks,' IEEE Transactions on Autonomous Mental Development , vol. 7, 332 no. 3, pp. 162-175, 2015. 333

M. Z. Baig, N. Aslam, and H. P. Shum, 'Filtering techniques for channel selection in motor imagery EEG 334 applications: a survey,' Artificial Intelligence Review , vol. 53, no. 2, pp. 1207-1232, 2020. 335

336

337

338

P. Herman, G. Prasad, T. M. McGinnity, and D. Coyle, 'Comparative analysis of spectral approaches to feature extraction for EEG-based motor imagery classification,' IEEE Transactions on Neural Systems and Rehabilitation Engineering , vol. 16, no. 4, pp. 317-326, 2008.

339

340

341

342

343

344

345

346

347

W. T. Blume, G. B. Young, and J. F. Lemieux, 'EEG morphology of partial epileptic seizures,' Electroencephalography and Clinical Neurophysiology , vol. 57, no. 4, pp. 295-302, 1984.

L. Meng, X. Jiang, J. Huang, Z. Zeng, S. Yu, T.-P. Jung, C.-T. Lin, R. Chavarriaga, and D. Wu, 'EEG-based brain-computer interfaces are vulnerable to backdoor attacks,' IEEE Transactions on Neural Systems and Rehabilitation Engineering , 2023.

X. Jiang, L. Meng, S. Li, and D. Wu, 'Active poisoning: efficient backdoor attacks on transfer learningbased brain-computer interfaces,' Science China Information Sciences , vol. 66, no. 8, p. 182402, 2023.

L. Meng, X. Jiang, X. Chen, W. Liu, H. Luo, and D. Wu, 'Adversarial filtering based evasion and backdoor attacks to EEG-based brain-computer interfaces,' Information Fusion , p. 102316, 2024.

D. Ding, M. Zhang, Y. Huang, X. Pan, F. Feng, E. Jiang, and M. Yang, 'Towards backdoor attack on 348 deep learning based time series classification,' in 2022 IEEE 38th International Conference on Data 349 Engineering (ICDE) . IEEE, 2022, pp. 1274-1287. 350

Y. Jiang, X. Ma, S. M. Erfani, and J. Bailey, 'Backdoor attacks on time series: A generative approach,' 351 in 2023 IEEE Conference on Secure and Trustworthy Machine Learning (SaTML) . IEEE, 2023, pp. 352 392-403. 353

S. Arroyo and S. Uematsu, 'High-frequency eeg activity at the start of seizures,' Journal of Clinical 354 Neurophysiology , vol. 9, no. 3, pp. 441-448, 1992. 355

356

357

M. Kostyunina and M. Kulikov, 'Frequency characteristics of eeg spectra in the emotions,' Neuroscience and Behavioral Physiology , vol. 26, no. 4, pp. 340-343, 1996.

358

359

360

361

362

363

364

365

366

367

368

369

370

371

372

373

374

375

376

377

378

379

380

381

382

383

384

385

386

387

388

389

390

391

392

393

394

395

396

397

M. Salinsky, B. Oken, and L. Morehead, 'Test-retest reliability in eeg frequency analysis,' Electroencephalography and clinical neurophysiology , vol. 79, no. 5, pp. 382-392, 1991.

S. D. Muthukumaraswamy, 'High-frequency brain activity and muscle artifacts in meg/eeg: a review and recommendations,' Frontiers in human neuroscience , vol. 7, p. 138, 2013.

M. Weber, X. Xu, B. Karlaš, C. Zhang, and B. Li, 'Rab: Provable robustness against backdoor attacks,' in 2023 IEEE Symposium on Security and Privacy (S&P) . IEEE, 2023, pp. 1311-1328.

Y. Yu, Y. Wang, W. Yang, S. Lu, Y.-P. Tan, and A. C. Kot, 'Backdoor attacks against deep image compression via adaptive frequency trigger,' in Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR) , 2023, pp. 12 250-12 259.

Z. Yuan, P. Zhou, K. Zou, and Y. Cheng, 'You are catching my attention: Are vision transformers bad learners under backdoor attacks?' in Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR) , 2023, pp. 24 605-24 615.

T. Gu, K. Liu, B. Dolan-Gavitt, and S. Garg, 'BadNets: Evaluating backdooring attacks on deep neural networks,' IEEE Access , vol. 7, pp. 47 230-47 244, 2019.

M. Barni, K. Kallas, and B. Tondi, 'A new backdoor attack in cnns by training set corruption without label poisoning,' in 2019 IEEE International Conference on Image Processing (ICIP) . IEEE, 2019, pp. 101-105.

W. Jiang, H. Li, G. Xu, and T. Zhang, 'Color backdoor: A robust poisoning attack in color space,' in Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR) , 2023, pp. 8133-8142.

T. A. Nguyen and A. T. Tran, 'Wanet-imperceptible warping-based backdoor attack,' in International Conference on Learning Representations (ICLR) , 2020.

S. Li, M. Xue, B. Z. H. Zhao, H. Zhu, and X. Zhang, 'Invisible backdoor attacks on deep neural networks via steganography and regularization,' IEEE Transactions on Dependable and Secure Computing , vol. 18, no. 5, pp. 2088-2105, 2020.

Y. Zeng, W. Park, Z. M. Mao, and R. Jia, 'Rethinking the backdoor attacks' triggers: A frequency perspective,' in Proceedings of the IEEE/CVF International Conference on Computer Vision (ICCV) , 2021, pp. 16 473-16 481.

T. Wang, Y. Yao, F. Xu, S. An, H. Tong, and T. Wang, 'An invisible black-box backdoor attack through frequency domain,' in European Conference on Computer Vision (ECCV) . Springer, 2022, pp. 396-413.

H. A. A. K. Hammoud and B. Ghanem, 'Check your other door! creating backdoor attacks in the frequency domain,' arXiv preprint arXiv:2109.05507 , 2021.

R. Hou, T. Huang, H. Yan, L. Ke, and W. Tang, 'A stealthy and robust backdoor attack via frequency domain transform,' World Wide Web (WWW) , vol. 26, no. 5, pp. 2767-2783, 2023.

Y. Feng, B. Ma, J. Zhang, S. Zhao, Y. Xia, and D. Tao, 'Fiba: Frequency-injection based backdoor attack in medical image analysis,' in Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR) , 2022, pp. 20 876-20 885.

Y. Gao, H. Chen, P. Sun, J. Li, A. Zhang, Z. Wang, and W. Liu, 'A dual stealthy backdoor: From both spatial and frequency perspectives,' in Proceedings of the AAAI Conference on Artificial Intelligence (AAAI) , vol. 38, no. 3, 2024, pp. 1851-1859.

T. A. Nguyen and A. Tran, 'Input-aware dynamic backdoor attack,' Advances in Neural Information 398 Processing Systems (NeurIPS) , vol. 33, pp. 3454-3464, 2020. 399

K. Doan, Y. Lao, W. Zhao, and P. Li, 'Lira: Learnable, imperceptible and robust backdoor attacks,' in 400 Proceedings of the IEEE/CVF international conference on computer vision (ICCV) , 2021, pp. 11 966401 11 976. 402

K. D. Doan, Y. Lao, and P. Li, 'Marksman backdoor: Backdoor attacks with arbitrary target class,' 403 Advances in Neural Information Processing Systems (NeurIPS) , vol. 35, pp. 38 260-38 273, 2022. 404

405

406

407

B. Wang, Y. Yao, S. Shan, H. Li, B. Viswanath, H. Zheng, and B. Y. Zhao, 'Neural Cleanse: Identifying and mitigating backdoor attacks in neural networks,' in 2019 IEEE Symposium on Security and Privacy (S&P) . IEEE, 2019, pp. 707-723.

408

409

410

411

412

413

414

415

416

417

418

419

420

421

422

423

424

425

426

427

428

429

430

431

432

433

434

435

436

437

438

439

Y. Gao, C. Xu, D. Wang, S. Chen, D. C. Ranasinghe, and S. Nepal, 'STRIP: A defence against trojan attacks on deep neural networks,' in Proceedings of the 35th Annual Computer Security Applications Conference , 2019, pp. 113-125.

B. Tran, J. Li, and A. Madry, 'Spectral signatures in backdoor attacks,' Advances in Neural Information Processing Systems (NeurIPS) , vol. 31, 2018.

K. Liu, B. Dolan-Gavitt, and S. Garg, 'Fine-pruning: Defending against backdooring attacks on deep neural networks,' in International Symposium on Research in Attacks, Intrusions, and Defenses . Springer, 2018, pp. 273-294.

R. S. Sutton, D. McAllester, S. Singh, and Y. Mansour, 'Policy gradient methods for reinforcement learning with function approximation,' Advances in Neural Information Processing Systems (NeurIPS) , vol. 12, 1999.

S. V. Gliske, Z. T. Irwin, K. A. Davis, K. Sahaya, C. Chestek, and W. C. Stacey, 'Universal automated high frequency oscillation detector for real-time, long term eeg,' Clinical Neurophysiology , vol. 127, no. 2, pp. 1057-1066, 2016.

C. Brunner, R. Leeb, G. Müller-Putz, A. Schlögl, and G. Pfurtscheller, 'BCI competition 2008-graz data set A,' Institute for Knowledge Discovery (Laboratory of Brain-Computer Interfaces), Graz University of Technology , vol. 16, pp. 1-6, 2008.

A. H. Shoeb and J. V. Guttag, 'Application of machine learning to epileptic seizure detection,' in Proceedings of the 27th International Conference on Machine Learning (ICML) , 2010, pp. 975-982.

V. J. Lawhern, A. J. Solon, N. R. Waytowich, S. M. Gordon, C. P. Hung, and B. J. Lance, 'EEGNet: a compact convolutional neural network for EEG-based brain-computer interfaces,' Journal of Neural Engineering , vol. 15, no. 5, p. 056013, 2018.

R. T. Schirrmeister, J. T. Springenberg, L. D. J. Fiederer, M. Glasstetter, K. Eggensperger, M. Tangermann, F. Hutter, W. Burgard, and T. Ball, 'Deep learning with convolutional neural networks for EEG decoding and visualization,' Human Brain Mapping , vol. 38, no. 11, pp. 5391-5420, 2017.

S. Hochreiter and J. Schmidhuber, 'Long short-term memory,' Neural Computation , vol. 9, no. 8, pp. 1735-1780, 1997.

K. M. Tsiouris, V. C. Pezoulas, M. Zervakis, S. Konitsiotis, D. D. Koutsouris, and D. I. Fotiadis, 'A long short-term memory deep learning network for the prediction of epileptic seizures using eeg signals,' Computers in biology and medicine , vol. 99, pp. 24-37, 2018.

S. Katoch, S. S. Chauhan, and V. Kumar, 'A review on genetic algorithm: past, present, and future,' Multimedia tools and applications , vol. 80, pp. 8091-8126, 2021.

440

441

442

443

444

445

446

447

448

449

450

451

452

453

454

455

456

457

458

459

460

461

462

463

464

465

466

Appendix

A Limitations

Our ManiBCI is a backdoor attack in the frequency domain, which requires to transform the EEG signals into frequency domain through fast Fourier transform (FFT) and return to temporal domain through inverse FFT (iFFT). The operation of FFT and iFFT in the trigger injection function are a little more time-consuming compared to other backdoor attack directly in the temporal domain, like PatchMT [28] and PulseMT [16]. Future effort will be devoted into the faster implementation of FFT and iFFT, for example, taking the advantage of modern GPUs.

It is a little more time-consuming for the reinforcement learning to acquire the optimal strategies for each trigger. However, we can obtain a general injecting strategy for each EEG BCI tasks, which can achieve a relatively good performance without reinforcement learning, as we can see from Table 3 that random injection strategy has an acceptable performance.

B Broader Impacts

With the rapid development of techniques, EEG BCIs gain a wide range of applications from health care to human-computer interaction. Some companies like Neuralink adopt the EEG BCI to assist paralytic patients helping themselves in daily lives. However, if the EEG BCI is backdoor attacked by ManiBCI, which allows the attacker to arbitrarily control BCI's outputs, the BCI users may fall into tremendous fatal troubles. For instance, one paralytic patient controls his/her wheelchair by EEG BCI, the attacker can manipulate the wheelchair to run down a steep staircase. For an epileptic patient, the attacker can let all the output be Normal State, even when the patient is experiencing an epileptic seizure. This paper reveals the severe danger faced by EEG BCIs, demonstrating the possibility that someone can maliciously manipulate the outputs of EEG BCIs with arbitrary target class.

ManiBCI can also be used for positive purposes, like protecting intellectual property of EEG dataset and EEG models with watermarking. As our ManiBCI has a very small impact of the clean accuracy, and the poisoning approach is clean label poisoning, ManiBCI is a fantastic method for watermarking EEG dataset and models.

For a company that provides EEG dataset, it can select different EEG triggers for different customs 467 to generate poisoned data and inject into the dataset provided to customs who buy the dataset. As a 468 result, the company have the information of which trigger is corresponding to which customs, e.g., 469 trigger x is in the dataset provided to custom X , trigger y is in the dataset provided to custom Y . If an 470 EEG model from a company which didn't buy dataset is detected having this watermark (backdoor) 471 with trigger x , the company knows that the custom X leaked the dataset. Similarly, if an EEG model 472 is detected having this watermark (backdoor) with trigger y , the company knows that the custom Y 473 leaked the dataset. 474

475

C Datasets and Preprocessing

In this section, we introduce the three datasets used in our experiments, and explain the preprocessing. 476 Table 5 presents some basic information of these datasets. 477

478

479

480

481

482

483

484

485

486

487

488

489

490

491

492

493

494

495

496

497

498

499

500

501

502

503

504

505

506

507

508

509

510

511

512

513

514

515

516

517

518

519

520

521

522

523

524

C.1 Emotion Recognition (ER)

The SJTU Emotion EEG Dataset (SEED) was incoporated as the representative dataset of emotion recogniton tasks [12]. It consists of EEG recordings from 15 subjects watching 15 emotional video clips with three repeated session each on different days. Each video clip is supposed to evoke one of the three target emotions: positive, neutral, and negative. The EEG signals were acquired by the 62-channel electrode cap at a sampling rate of 1000 Hz. We performed below preprocessing procedures for the 62-channel EEG signals: 1) Down-sampling from 1000 Hz to 200 Hz, 2) Band-pass filtering at 0.3-50 Hz, 3) Segmenting EEG signals into 1-second (200 timepoints), obtaining 3394 EEG segments in each session for each subject.

C.2 Motor Imagery (MI)

We employ the BCIC-IV-2a as a representative dataset of MI classification tasks [48]. It contains EEG recordings in a four-class motor-imagery task from nine subjects with two repeated session each on different days. During the task, the subjects were instructed to imagine four types of movements ( i.e. , right hand, left hand, feet, and tongue) for four seconds. Each session consists of a total of 288 trials with 72 trials for each type of the motor imagery. The EEG signals were recorded by 22 Ag/AgCl EEG electrodes in a sampling rate of 250 Hz. We segment the 22-channel EEG signals into 1-second segments, resulting in totally 1152 EEG data for each subject.

C.3 Epilepsy Detection (ED)

The CHB-MIT, one of the largest and most used public datasets for epilepsy, is adopted as a representative dataset of ED tasks [49]. It recorded 877.39 hours of multi-channel EEG in a sampling rate of 256 Hz from 23 pediatric patients with intractable seizures. However, as the montages ( i.e. , the number and the places of electrodes) of EEG signals vary significantly among different subjects' recordings, we select to use only the EEG recordings with the same 23 channels (see Appendix A) and discard other channels or the recordings don't have all these 23 channels. Due to the purpose is to test whether the backdoor attack works on the ED task, not to study the epilepsy EEG classification, we segment part of the CHB-MIT dataset to form a four-class ED dataset ( i.e. , the preictal, ictal, postictal, and interictal phases). Specifically, for a ictal phase EEG recording of t i seconds from [ s i , e i ] timepoints, we segment the [ s i -t i , e i ] EEG as the preictal phase, the [ e i , e i + t i ] EEG as the postictal phase, and another t i seconds EEG recordings as the interictal phase which satisfying there is no ictal phase within half an hour before or after. Then we segment the 23-channel EEG signals into 1-second segments, consequently, there are 41336 segments left in total from all subjects, 10334 for each phase. As the imbalanced amount of data across different subjects, we separate these 41336 segments into 10 groups and treat the ten groups as 10 subjects.

D Implementation Details

D.1 Experiment Computing Resources

We use two servers for conducting our experiments. A server with one Nvidia Tesla V100 GPU is used for running reinforcement learning, the CUDA version is 12.3. Another server with four Nvidia RTX 3090 GPUs is used for running the backdoor attacks, the CUDA version is 11.4.

D.2 Details of Baseline Methods

In our ManiBCI backdoor attacks, for an EEG segment x i ∈ R E × T , we modify the βF frequencypoints and γE electrodes of a EEG segments with a constant number.

There are four baseline methods in our study for multi-target backdoor attacks, two of them are non-stealthy attacks ( PatchMT and PulseMT ) and two are stealthy attacks ( CompressMT and AdverseMT ). In order to achieve a fair comparison, we modify only first γE electrodes for all baseline attack methods. For the non-stealthy attacks, which are all on the temporal domains, we modify βT timepoints of EEG signals. For the stealthy attacks, there is no constraint of the numbers of the modify timepoints as these attacks achieve stealthiness in another way.

For each baseline method, we try our best to find out the best performance, as demonstrated below. 525 We promise that we did not maliciously lower the performances of the baseline methods. 526

527

528

529

530

531

532

533

534

535

536

537

538

539

540

541

542

543

544

545

546

547

548

549

550

551

552

553

554

555

556

557

558

559

560

D.2.1 PatchMT

PatchMT is a multi-trigger and MT extension of BadNets [28] where we fill the first βT timepoints and γE electrodes of a EEG segments with a constant number. Specifically, for an EEG segment x i ∈ R E × T , we set the first γE electrodes and the first βT timepoints of the EEG segment to a constant number. We normalize the EEG segment x i ∈ R E × T to let x i 's mean is 0 and std is 1. Then set the first γE electrodes and the first βT timepoints of x i to a different constant number for different class. The constant number for each class of { 0 , 1 , 2 , 3 } for four classes, and {-0.1, 0.0, 1.0} for three classes. Finally, denormalize x i to original signal x i 's scale to generate x p i .

Although we try our best to find the best performance of PatchMT, and BadNets [28] is really efficient in image backdoor attacks, PatchMT cannot have satisfactory results in EEG BCI attack.

D.2.2 PulseMT

For PulseMT, we met the same questions as the PatchMT: how to identify the amplitude of each NPP signal for each class? If the numbers are too large then normal EEG signals, it will be unfair. If the numbers are too small, the efficacy of PulseMT is too negative.

We normalize the EEG segment x i ∈ R E × T to let x i 's mean is 0 and std is 1. The constant amplitude for each class of {-0 . 8 , -0 . 3 , 0 . 3 , 0 . 8 } . Finally, denormalize x i to original signal x i 's scale to generate x p i .

D.2.3 CompressMT

Compressing the amplitude of EEG signals in the temporal domain will not change the morphology and the frequency distribution of EEG signals, thus obtaining stealthiness. For three-class Emotion datasets, the compress rate is {0.8, 0.6, 0.4}. For four-class Motor Imagery and Epilepsy datasets, the compress rate is {0.8, 0.6, 0.4, 0.2}.

D.2.4 AdverseMT

AdverseMT is another stealthy EEG backdoor attacks, which is the multi-trigger and multi-target extension of adversarial spatial filter attacks [18], in wihch, for EEG segment x i ∈ R E × T , it learns an Spatial Filter W ∈ R E × E by the adversarial loss to let the model f misclassify x i :

However, the original version of [18] requires the access to all training dataset D and the control of the training process of the model f . We modify the AdverseMT to only access to the training dataset D train . Note that the adversarial loss dose not have the special design for multi-target backdoor attacks, we only run the process c times for obtaining c spatial filters for different classes. So the poisoned subset are S p = { ( W 0 ( x ) , 0) , ( W 1 ( x ) , 1) , ( W 2 ( x ) , 2) , ( W 3 ( x ) , 3) } .

D.3 Reinforcement Learning Policy Network Architecture

Here, we design a concise but effective convolutional neural networks as the our policy network, which is defined as belows:

561

562

563

564

565

566

567

568

569

570

571

572

573

574

575

576

577

578

579

580

E Attack Performance of ManiBCI

E.1 Different Poisoning Rates

We present the performance of each backdoor attacks' performance under different poisoning rates in Table 7. We can see that our ManiBCI outperforms other baseline at all poisoning rates, demonstrating the superiority of ManiBCI. Note that the performance of ManiBCI on the MI dataset is significantly robust to low poisoning rates, i.e., ASR of 1.000 when ρ = 0 . 05 .

E.2 Hyperparameter Analysis: Frequency and Electrodes Injection Ratio

We present the performance of each backdoor attacks performance under different rates in Table 8 and Table 9. It can be observed with the increment of β and γ , the attack performance increases. Because the trigger is bigger in clean EEG data.

E.3 Hyperparameter Analysis in Reinforcement Learning

We applied the following reward function to acquire the optimal mask strategies for each triggers:

where the first part means the clean accuracy, the second part means the attack success rate, the third part is aiming to scatter the injection positions in various frequency bands, and the fourth part is aiming to inject as high frequencies in EEG signals as possible. Here, we give a simple example to demonstrate the reward function. For an 10 timepoints long EEG segment x i , ˜ x i = F ( x i ) . If the M c i f = { 2 , 3 , 5 , 7 , 9 } , because the minimal distance between each pair in M c i f is | 2 -3 | = 1 , thus dis( M c i f ) = 1 . The min( M c i f ) means the lowest position in M c i f , thus min( M c i f ) = 2 .

The analysis of the λ are presented in Table 10. When λ increase, the Attack performance increases while the Clean performance declines slightly.

F More Visualization Results 581

In this section, we plot the reconstructed triggers and masks on three datasets in Section F.1, then 582 plot more visualizations of backdoor samples in Section ?? , and plot the learning curve of our 583 reinforcement learning in Section F.3. 584

585

F.1 Neural Cleanse: Reconstruction Trigger Patterns

Here, we present more visualization in Figure 9, Figure 10, and Figure 11 of the reconstructed trigger 586 patterns and mask patterns for each possible label on three dataset ( i.e. , the CHB-MIT dataset, the 587 BCIC-IV-2a dataset and the SEED dataset) the target model is EEGnet. It can be observed that the 588 reconstructed trigger patterns and mask patterns of the clean models and ManiBCI backdoor-injected 589 models are very similar to each other. Thus, our ManiBCI backdoor attack can easily bypass the 590 defense of Neural Cleanse. 591

0

50

100

150

200

250

0

20

0

50

100

150

200

250

0

20

0

50

100

150

200

250

0

20

0

50

100

150

200

250

0

20

0

50

100

150

200

250

0

20

0

50

100

150

200

250

0

20

0

50

100

150

200

250

0

20

0

50

100

150

200

250

0

20

0

50

100

150

200

250

0

20

0

50

100

150

200

250

0

20

0

50

100

150

200

250

0

20

0

50

100

150

200

250

0

20

0

50

100

150

200

250

0

20

0

50

100

150

200

250

0

20

0

50

100

150

200

250

0

20

0

50

100

150

200

250

0

20

Clean model / Class

3

: Reconstructed Trigger Pattern

ManiBCI backdoor

model / Class

3

: Reconstructed Trigger Pattern

Clean model / Class

3

: Reconstructed

Mask

Pattern

ManiBCI backdoor

model / Class

3

: Reconstructed

Mask

Pattern

Clean model / Class

2

: Reconstructed Trigger Pattern

ManiBCI backdoor

model / Class

2

: Reconstructed Trigger Pattern

Clean model / Class

2

: Reconstructed

Mask

Pattern

ManiBCI backdoor

model / Class

2

: Reconstructed

Mask

Pattern

Clean model / Class

1

: Reconstructed Trigger Pattern

ManiBCI backdoor

model / Class

1

: Reconstructed Trigger Pattern

Clean model / Class

1

: Reconstructed

Mask

Pattern

ManiBCI backdoor

model / Class

1

: Reconstructed

Mask

Pattern

Clean model / Class

0

: Reconstructed Trigger Pattern

ManiBCI backdoor

model / Class

0

: Reconstructed Trigger Pattern

Clean model / Class

0

: Reconstructed

Mask

Pattern

ManiBCI backdoor

model / Class

0

: Reconstructed

Mask

Pattern

0.0

0.2

0.4

0.6

0.8

1.0

0

50

100

150

200

0

20

0

50

100

150

200

0

20

0

50

100

150

200

0

20

0

50

100

150

200

0

20

0

50

100

150

200

0

20

0

50

100

150

200

0

20

0

50

100

150

200

0

20

0

50

100

150

200

0

20

ManiBCI backdoor

model / Class

3

: Reconstructed Trigger Pattern

ManiBCI backdoor

model / Class

3

: Reconstructed

Mask

Pattern

ManiBCI backdoor

model / Class

2

: Reconstructed Trigger Pattern

ManiBCI backdoor

model / Class

2

: Reconstructed

Mask

Pattern

ManiBCI backdoor

model / Class

1

: Reconstructed Trigger Pattern

ManiBCI backdoor

model / Class

1

: Reconstructed

Mask

Pattern

ManiBCI backdoor

model / Class

0

: Reconstructed Trigger Pattern

ManiBCI backdoor

model / Class

0

: Reconstructed

Mask

Pattern

0

50

100

150

200

0

20

0

50

100

150

200

0

20

0

50

100

150

200

0

20

0

50

100

150

200

0

20

0

50

100

150

200

0

20

0

50

100

150

200

0

20

0

50

100

150

200

0

20

0

50

100

150

200

0

20

Clean

model / Class

0

: Reconstructed Trigger Pattern

Clean

model / Class

1

: Reconstructed

Mask

Pattern

Clean

model / Class

0

: Reconstructed

Mask

Pattern

Clean

model / Class

2

: Reconstructed

Mask

Pattern

Clean

model / Class

3

: Reconstructed

Mask

Pattern

Clean

model / Class

1

: Reconstructed Trigger Pattern

Clean

model / Class

2

: Reconstructed Trigger Pattern

Clean

model / Class

3

: Reconstructed Trigger Pattern

0.0

0.2

0.4

0.6

0.8

1.0

0

25

50

75

100

125

150

175

0

20

40

60

0

25

50

75

100

125

150

175

0

20

40

60

0

25

50

75

100

125

150

175

0

20

40

60

0

25

50

75

100

125

150

175

0

20

40

60

0

25

50

75

100

125

150

175

0

20

40

60

0

25

50

75

100

125

150

175

0

20

40

60

0

25

50

75

100

125

150

175

0

20

40

60

0

25

50

75

100

125

150

175

0

20

40

60

0

25

50

75

100

125

150

175

0

20

40

60

0

25

50

75

100

125

150

175

0

20

40

60

0

25

50

75

100

125

150

175

0

20

40

60

0

25

50

75

100

125

150

175

0

20

40

60

ManiBCI backdoor

model / Class

2

: Reconstructed Trigger Pattern

ManiBCI backdoor

model / Class

2

: Reconstructed

Mask

Pattern

Clean model / Class

0

: Reconstructed

Mask

Pattern

ManiBCI backdoor

model / Class

0

: Reconstructed

Mask

Pattern

Clean model / Class

0

: Reconstructed Trigger Pattern

ManiBCI backdoor

model / Class

0

: Reconstructed Trigger Pattern

Clean model / Class

1

: Reconstructed

Mask

Pattern

ManiBCI backdoor

model / Class

1

: Reconstructed

Mask

Pattern

Clean model / Class

1

: Reconstructed Trigger Pattern

ManiBCI backdoor

model / Class

1

: Reconstructed Trigger Pattern

Clean model / Class

2

: Reconstructed

Mask

Pattern

Clean model / Class

2

: Reconstructed Trigger Pattern

0.0

0.2

0.4

0.6

0.8

1.0

592

593

594

595

596

F.2 Visualization of Backdoor Attack Samples

We present more visualization of the backdoor attack samples generated by our ManiBCI on ER dataset and MI dataset in Fig 12 and 13. The x-axis is the timepoints, the y-axis is the normalized amplitude. Top row: w.o. HF loss; Bottom row: with HF loss. Each column indicates each possible class.

0

25

50

75

100

125

150

175

200

1

0

1

2

Clean EEG

Trigger 0 Injected EEG

0

25

50

75

100

125

150

175

200

1

0

1

2

Clean EEG

Trigger 1 Injected EEG

0

25

50

75

100

125

150

175

200

1

0

1

2

Clean EEG

Trigger 2 Injected EEG

0

25

50

75

100

125

150

175

200

1

0

1

2

Clean EEG

Trigger 0 Injected EEG

Residual

0

25

50

75

100

125

150

175

200

1

0

1

2

Clean EEG

Trigger 1 Injected EEG

Residual

0

25

50

75

100

125

150

175

200

1

0

1

2

Clean EEG

Trigger 2 Injected EEG

Residual

w

/o HF loss

ManiBCI

0

50

100

150

200

250

40

20

0

20

40

60

Clean EEG

Trigger 0 Injected EEG

0

50

100

150

200

250

40

20

0

20

40

60

Clean EEG

Trigger 1 Injected EEG

0

50

100

150

200

250

50

25

0

25

50

Clean EEG

Trigger 2 Injected EEG

0

50

100

150

200

250

40

20

0

20

40

60

Clean EEG

Trigger 3 Injected EEG

0

50

100

150

200

250

40

20

0

20

40

60

Clean EEG

Trigger 0 Injected EEG

Residual

0

50

100

150

200

250

40

20

0

20

40

60

Clean EEG

Trigger 1 Injected EEG

Residual

0

50

100

150

200

250

40

20

0

20

40

60

Clean EEG

Trigger 2 Injected EEG

Residual

0

50

100

150

200

250

40

20

0

20

40

60

Clean EEG

Trigger 3 Injected EEG

Residual

w

/o HF loss

ManiBCI

597

598

599

600

601

602

603

F.3 Visualization of Learning Curves of Reinforcement Learning

We present the visualization of the learning curves of the reinforcement learning of three dataset in Fig 14. We can see the effectiveness of our reinforcement, which converged within 50 epochs on the ER dataset, that is, only trained 50 backdoor models with different injection strategies. Our RL is more effective on the MI dataset and ED dataset, which finds a good strategy within less 10 epochs. Our RL is robust when learning strategies for different triggers as demonstrated in Fig 14(c) and (d), where the learning curves are quite similar when RL is performing on different triggers.

0

50

100

150

200

250

0.0

0.2

0.4

0.6

0.8

1.0

Value

Training ACC and ASR

ACC

ASR

0

50

100

150

200

250

0.0

0.2

0.4

0.6

0.8

1.0

Value

Sorted ASR and corresponding ACC

ACC

ASR

(a)

The RL curve on the Emotion Recognition dataset

0

50

100

150

200

250

0.2

0.4

0.6

0.8

1.0

Value

Training ACC and ASR

ACC

ASR

0

50

100

150

200

250

0.2

0.4

0.6

0.8

1.0

Value

Sorted ASR and corresponding ACC

ACC

ASR

(

c

)

The RL curve on the

dataset

0

50

100

150

200

250

0.3

0.4

0.5

0.6

0.7

0.8

0.9

1.0

Value

Training ACC and ASR

ACC

ASR

0

50

100

150

200

250

0.3

0.4

0.5

0.6

0.7

0.8

0.9

1.0

Value

Sorted ASR and corresponding ACC

ACC

ASR

(b)

The RL curve on the

Moto Imagery

dataset

0

50

100

150

200

250

0.2

0.4

0.6

0.8

1.0

Value

Training ACC and ASR

ACC

ASR

0

50

100

150

200

250

0.2

0.4

0.6

0.8

1.0

Value

Sorted ASR and corresponding ACC

ACC

ASR

(d) The RL curve on the Epilepsy Detection dataset, for another tirrger with label 2

604

605

606

607

608

609

610

611

612

613

614

615

616

617

618

619

620

621

622

623

624

625

626

627

628

629

630

631

632

633

634

635

636

637

638

639

640

641

642

643

644

645

646

647

648

649

650

651

652

653

654

NeurIPS Paper Checklist

1. Claims

Question: Do the main claims made in the abstract and introduction accurately reflect the paper's contributions and scope?

Answer: [Yes]

Justification: We made clear claims of our contributions in the abstract and introduction.

Guidelines:

The answer NA means that the abstract and introduction do not include the claims made in the paper.

The abstract and/or introduction should clearly state the claims made, including the contributions made in the paper and important assumptions and limitations. A No or NA answer to this question will not be perceived well by the reviewers.

The claims made should match theoretical and experimental results, and reflect how much the results can be expected to generalize to other settings.

It is fine to include aspirational goals as motivation as long as it is clear that these goals are not attained by the paper.

2. Limitations

Question: Does the paper discuss the limitations of the work performed by the authors?

Answer: [Yes]

Justification: We discussed the limitations of our proposed method in Appendix.

Guidelines:

The answer NA means that the paper has no limitation while the answer No means that the paper has limitations, but those are not discussed in the paper.

The authors are encouraged to create a separate "Limitations" section in their paper.

The paper should point out any strong assumptions and how robust the results are to violations of these assumptions (e.g., independence assumptions, noiseless settings, model well-specification, asymptotic approximations only holding locally). The authors should reflect on how these assumptions might be violated in practice and what the implications would be.

The authors should reflect on the scope of the claims made, e.g., if the approach was only tested on a few datasets or with a few runs. In general, empirical results often depend on implicit assumptions, which should be articulated.

The authors should reflect on the factors that influence the performance of the approach. For example, a facial recognition algorithm may perform poorly when image resolution is low or images are taken in low lighting. Or a speech-to-text system might not be used reliably to provide closed captions for online lectures because it fails to handle technical jargon.

The authors should discuss the computational efficiency of the proposed algorithms and how they scale with dataset size.

If applicable, the authors should discuss possible limitations of their approach to address problems of privacy and fairness.

While the authors might fear that complete honesty about limitations might be used by reviewers as grounds for rejection, a worse outcome might be that reviewers discover limitations that aren't acknowledged in the paper. The authors should use their best judgment and recognize that individual actions in favor of transparency play an important role in developing norms that preserve the integrity of the community. Reviewers will be specifically instructed to not penalize honesty concerning limitations.

3. Theory Assumptions and Proofs

Question: For each theoretical result, does the paper provide the full set of assumptions and a complete (and correct) proof?

Answer: [NA]

Justification: Our paper dose not include theoretical results. Guidelines:

The answer NA means that the paper does not include theoretical results.

All the theorems, formulas, and proofs in the paper should be numbered and crossreferenced.

All assumptions should be clearly stated or referenced in the statement of any theorems.

The proofs can either appear in the main paper or the supplemental material, but if they appear in the supplemental material, the authors are encouraged to provide a short proof sketch to provide intuition.

Inversely, any informal proof provided in the core of the paper should be complemented by formal proofs provided in appendix or supplemental material.

Theorems and Lemmas that the proof relies upon should be properly referenced.

4. Experimental Result Reproducibility

Question: Does the paper fully disclose all the information needed to reproduce the main experimental results of the paper to the extent that it affects the main claims and/or conclusions of the paper (regardless of whether the code and data are provided or not)?

Answer: [Yes]

Justification: We demonstrated our method and the experiment settings clearly in Section 3.1 and Section 4.2. The implementation details of all baselines are written in appendix.

Guidelines:

The answer NA means that the paper does not include experiments.

If the paper includes experiments, a No answer to this question will not be perceived well by the reviewers: Making the paper reproducible is important, regardless of whether the code and data are provided or not.

If the contribution is a dataset and/or model, the authors should describe the steps taken to make their results reproducible or verifiable.

Depending on the contribution, reproducibility can be accomplished in various ways. For example, if the contribution is a novel architecture, describing the architecture fully might suffice, or if the contribution is a specific model and empirical evaluation, it may be necessary to either make it possible for others to replicate the model with the same dataset, or provide access to the model. In general. releasing code and data is often one good way to accomplish this, but reproducibility can also be provided via detailed instructions for how to replicate the results, access to a hosted model (e.g., in the case of a large language model), releasing of a model checkpoint, or other means that are appropriate to the research performed.

While NeurIPS does not require releasing code, the conference does require all submissions to provide some reasonable avenue for reproducibility, which may depend on the nature of the contribution. For example

(a) If the contribution is primarily a new algorithm, the paper should make it clear how to reproduce that algorithm.

(b) If the contribution is primarily a new model architecture, the paper should describe the architecture clearly and fully.

(c) If the contribution is a new model (e.g., a large language model), then there should either be a way to access this model for reproducing the results or a way to reproduce the model (e.g., with an open-source dataset or instructions for how to construct the dataset).

(d) We recognize that reproducibility may be tricky in some cases, in which case authors are welcome to describe the particular way they provide for reproducibility. In the case of closed-source models, it may be that access to the model is limited in some way (e.g., to registered users), but it should be possible for other researchers to have some path to reproducing or verifying the results.

5. Open access to data and code

Question: Does the paper provide open access to the data and code, with sufficient instructions to faithfully reproduce the main experimental results, as described in supplemental material?

Answer: [No]

Justification: Sorry for not providing the whole code at the submitting phase as we have no time to organize our code well. However, we will publish our code after the anonymous period (Or we can organize and upload our code during rebuttal phase if possible).

Guidelines:

The answer NA means that paper does not include experiments requiring code.

Please see the NeurIPS code and data submission guidelines ( https://nips.cc/ public/guides/CodeSubmissionPolicy ) for more details.

While we encourage the release of code and data, we understand that this might not be possible, so 'No' is an acceptable answer. Papers cannot be rejected simply for not including code, unless this is central to the contribution (e.g., for a new open-source benchmark).

The instructions should contain the exact command and environment needed to run to reproduce the results. See the NeurIPS code and data submission guidelines ( https: //nips.cc/public/guides/CodeSubmissionPolicy ) for more details.

The authors should provide instructions on data access and preparation, including how to access the raw data, preprocessed data, intermediate data, and generated data, etc.

The authors should provide scripts to reproduce all experimental results for the new proposed method and baselines. If only a subset of experiments are reproducible, they should state which ones are omitted from the script and why.

At submission time, to preserve anonymity, the authors should release anonymized versions (if applicable).

Providing as much information as possible in supplemental material (appended to the paper) is recommended, but including URLs to data and code is permitted.

6. Experimental Setting/Details

Question: Does the paper specify all the training and test details (e.g., data splits, hyperparameters, how they were chosen, type of optimizer, etc.) necessary to understand the results?

Answer: [Yes]

Justification: We demonstrated our method and the experiment settings clearly in Section3.1 and Section 4.2. The implementation details of all baselines are written in appendix.

Guidelines:

The answer NA means that the paper does not include experiments.

The experimental setting should be presented in the core of the paper to a level of detail that is necessary to appreciate the results and make sense of them.

The full details can be provided either with the code, in appendix, or as supplemental material.

7. Experiment Statistical Significance

Question: Does the paper report error bars suitably and correctly defined or other appropriate information about the statistical significance of the experiments?

Answer: [Yes]

Justification: We give all the statistical significance of our experiments.

Guidelines:

The answer NA means that the paper does not include experiments.

The authors should answer "Yes" if the results are accompanied by error bars, confidence intervals, or statistical significance tests, at least for the experiments that support the main claims of the paper.

The factors of variability that the error bars are capturing should be clearly stated (for example, train/test split, initialization, random drawing of some parameter, or overall run with given experimental conditions).

The method for calculating the error bars should be explained (closed form formula, call to a library function, bootstrap, etc.)

762

763

764

765

766

767

768

769

770

771

772

773

774

775

776

777

778

779

780

781

782

783

784

785

786

787

788

789

790

791

792

793

794

795

796

797

798

799

800

801

802

803

804

805

806

807

808

809

810

811

The assumptions made should be given (e.g., Normally distributed errors).

It should be clear whether the error bar is the standard deviation or the standard error of the mean.

It is OK to report 1-sigma error bars, but one should state it. The authors should preferably report a 2-sigma error bar than state that they have a 96% CI, if the hypothesis of Normality of errors is not verified.

For asymmetric distributions, the authors should be careful not to show in tables or figures symmetric error bars that would yield results that are out of range (e.g. negative error rates).

If error bars are reported in tables or plots, The authors should explain in the text how they were calculated and reference the corresponding figures or tables in the text.

8. Experiments Compute Resources

Question: For each experiment, does the paper provide sufficient information on the computer resources (type of compute workers, memory, time of execution) needed to reproduce the experiments?

Answer: [Yes]

Justification: Yes, we provide the type of GPU and version of CUDA in Appendix D.

Guidelines:

The answer NA means that the paper does not include experiments.

The paper should indicate the type of compute workers CPU or GPU, internal cluster, or cloud provider, including relevant memory and storage.

The paper should provide the amount of compute required for each of the individual experimental runs as well as estimate the total compute.

The paper should disclose whether the full research project required more compute than the experiments reported in the paper (e.g., preliminary or failed experiments that didn't make it into the paper).

9. Code Of Ethics

Question: Does the research conducted in the paper conform, in every respect, with the NeurIPS Code of Ethics https://neurips.cc/public/EthicsGuidelines ?

Answer: [Yes]

Justification: Yes, we conform with the NeurIPS Code of Ethics.

Guidelines:

The answer NA means that the authors have not reviewed the NeurIPS Code of Ethics.

If the authors answer No, they should explain the special circumstances that require a deviation from the Code of Ethics.

The authors should make sure to preserve anonymity (e.g., if there is a special consideration due to laws or regulations in their jurisdiction).

10. Broader Impacts

Question: Does the paper discuss both potential positive societal impacts and negative societal impacts of the work performed?

Answer: [Yes]

Justification: We discuss the broader impacts of our backdoor attacks in Appendix.

Guidelines:

The answer NA means that there is no societal impact of the work performed.

If the authors answer NA or No, they should explain why their work has no societal impact or why the paper does not address societal impact.

Examples of negative societal impacts include potential malicious or unintended uses (e.g., disinformation, generating fake profiles, surveillance), fairness considerations (e.g., deployment of technologies that could make decisions that unfairly impact specific groups), privacy considerations, and security considerations.

The conference expects that many papers will be foundational research and not tied to particular applications, let alone deployments. However, if there is a direct path to any negative applications, the authors should point it out. For example, it is legitimate to point out that an improvement in the quality of generative models could be used to generate deepfakes for disinformation. On the other hand, it is not needed to point out that a generic algorithm for optimizing neural networks could enable people to train models that generate Deepfakes faster.

The authors should consider possible harms that could arise when the technology is being used as intended and functioning correctly, harms that could arise when the technology is being used as intended but gives incorrect results, and harms following from (intentional or unintentional) misuse of the technology.

If there are negative societal impacts, the authors could also discuss possible mitigation strategies (e.g., gated release of models, providing defenses in addition to attacks, mechanisms for monitoring misuse, mechanisms to monitor how a system learns from feedback over time, improving the efficiency and accessibility of ML).

11. Safeguards

Question: Does the paper describe safeguards that have been put in place for responsible release of data or models that have a high risk for misuse (e.g., pretrained language models, image generators, or scraped datasets)?

Answer: [NA]

Justification: We do not release any dataset or model. However, our paper proposes a backdoor attack method in EEG BCIs, which is challenging to be guarded and have dangerous impact in EEG BCIs. The only safeguard way we can come up with is to check and guarantee the clean of training datasets EEG BCIs employ.

Guidelines:

The answer NA means that the paper poses no such risks.

Released models that have a high risk for misuse or dual-use should be released with necessary safeguards to allow for controlled use of the model, for example by requiring that users adhere to usage guidelines or restrictions to access the model or implementing safety filters.

Datasets that have been scraped from the Internet could pose safety risks. The authors should describe how they avoided releasing unsafe images.

We recognize that providing effective safeguards is challenging, and many papers do not require this, but we encourage authors to take this into account and make a best faith effort.

12. Licenses for existing assets

Question: Are the creators or original owners of assets (e.g., code, data, models), used in the paper, properly credited and are the license and terms of use explicitly mentioned and properly respected?

Answer: [Yes]

Justification: We conduct our experiments on three public datasets. The original papers of these three datasets were cited in our paper.

Guidelines:

The answer NA means that the paper does not use existing assets.

The authors should cite the original paper that produced the code package or dataset.

The authors should state which version of the asset is used and, if possible, include a URL.

The name of the license (e.g., CC-BY 4.0) should be included for each asset.

For scraped data from a particular source (e.g., website), the copyright and terms of service of that source should be provided.

If assets are released, the license, copyright information, and terms of use in the package should be provided. For popular datasets, paperswithcode.com/datasets has curated licenses for some datasets. Their licensing guide can help determine the license of a dataset.

For existing datasets that are re-packaged, both the original license and the license of the derived asset (if it has changed) should be provided.

If this information is not available online, the authors are encouraged to reach out to the asset's creators.

13. New Assets

Question: Are new assets introduced in the paper well documented and is the documentation provided alongside the assets?

Answer: [NA]

Justification: This paper does not release new assets.

Guidelines:

The answer NA means that the paper does not release new assets.

Researchers should communicate the details of the dataset/code/model as part of their submissions via structured templates. This includes details about training, license, limitations, etc.

The paper should discuss whether and how consent was obtained from people whose asset is used.

At submission time, remember to anonymize your assets (if applicable). You can either create an anonymized URL or include an anonymized zip file.

14. Crowdsourcing and Research with Human Subjects

Question: For crowdsourcing experiments and research with human subjects, does the paper include the full text of instructions given to participants and screenshots, if applicable, as well as details about compensation (if any)?

Answer: [NA]

Justification: This paper does not involve crowdsourcing nor research with human subjects. Guidelines:

The answer NA means that the paper does not involve crowdsourcing nor research with human subjects.

Including this information in the supplemental material is fine, but if the main contribution of the paper involves human subjects, then as much detail as possible should be included in the main paper.

According to the NeurIPS Code of Ethics, workers involved in data collection, curation, or other labor should be paid at least the minimum wage in the country of the data collector.

15. Institutional Review Board (IRB) Approvals or Equivalent for Research with Human Subjects

Question: Does the paper describe potential risks incurred by study participants, whether such risks were disclosed to the subjects, and whether Institutional Review Board (IRB) approvals (or an equivalent approval/review based on the requirements of your country or institution) were obtained?

Answer: [NA]

Justification: This paper does not involve crowdsourcing nor research with human subjects. Guidelines:

The answer NA means that the paper does not involve crowdsourcing nor research with human subjects.

Depending on the country in which research is conducted, IRB approval (or equivalent) may be required for any human subjects research. If you obtained IRB approval, you should clearly state this in the paper.

We recognize that the procedures for this may vary significantly between institutions and locations, and we expect authors to adhere to the NeurIPS Code of Ethics and the guidelines for their institution.

For initial submissions, do not include any information that would break anonymity (if applicable), such as the institution conducting the review.

Peer reviews:
{"IS_META_REVIEW": false, "comments": "SUMMARY:\nThe paper presents ManiBCI, a novel backdoor attack method targeting EEG-based brain-computer interface (BCI) systems. ManiBCI leverages a three-stage clean label poisoning approach without needing access to the training phase of the target deep learning models. This method optimally selects EEG electrodes and frequency masks for each class using reinforcement learning. The attack involves injecting these learned masks into the EEG data, leading to high misclassification rates while maintaining the original task's accuracy. Extensive experiments on three EEG datasets demonstrate ManiBCI's effectiveness and robustness. The key contributions of this work are: (1) Introducing a new type of stealthy and effective backdoor attack for EEG data. (2) Proposing a method that can manipulate multiple classes simultaneously without requiring control over the model's training process. (3) Providing experimental evidence of the attack's success across various datasets. This research highlights potential vulnerabilities in EEG-based BCI systems, emphasizing the need for robust defense mechanisms.\n\nSTRENGTHS:\n* Introduces a novel and stealthy backdoor attack method for EEG-based BCI systems using frequency transform.\n* Demonstrates the ability to manipulate multiple target classes without needing access to the model's training phase.\n* Provides strong experimental evidence of the method's effectiveness and robustness across multiple EEG datasets.\n\nWEAKNESSES:\n* Standard baselines (fast gradient sign method and universal adversarial perturbation) are not included for comparison [1][2]\n* Limited to the datasets used in the experiments, raising questions about generalizability to other EEG datasets or real-world scenarios.\n* The practical implementation of the proposed attack might be complex and computationally intensive due to the need for reinforcement learning optimization.\n\n[1] Xiao Zhang and Dongrui Wu. On the vulnerability of CNN classifiers in EEG-based BCIs. IEEE\nTransactions on Neural Systems and Rehabilitation Engineering, 27(5):814–825, 2019.\n[2] Zihan Liu, Lubin Meng, Xiao Zhang, Weili Fang, and Dongrui Wu. Universal adversarial\nperturbations for CNN classifiers in EEG-based BCIs, 2021.\n\nQUESTIONS:\nNone\n\nLIMITATIONS:\nYes", "TITLE": "Official Review", "RECOMMENDATION": 3, "REVIEWER_CONFIDENCE": 1, "SOUNDNESS_CORRECTNESS": 2, "DATE": "2024-07-08"}

comments: SUMMARY:
This paper proposes a backdoor attack strategy for EEG, addressing three inherent issues: low quality, task variances, and morphology variances. The authors introduced a three-stage clean label poisoning attack. The proposed algorithm has been evaluated on three EEG datasets, demonstrating its effectiveness and robustness across datasets. This is an interesting work investigating backdoor attacks on EEG, and the customized strategy shows effectiveness in this particular domain. I believe this contribution will be beneficial to the community.

STRENGTHS:
* This is a very interesting work, investigating backdoor attacks on EEG, and the customized strategy shows effectiveness in this particular domain.

* The experiments are relatively sufficient and validate the claimed contributions adequately.

WEAKNESSES:
* I am not the expertise in BA domain. In terms of general EEG analsyis, one of my main concern is the experiment settings. In normal EEG analysis domain, we usually set inter-subejct and intra-subject settings. I failed to see the calrifications of these experiment settings. Whether this strategy can work across subjects, and generalize on the EEG signals collected from new/unseen subject?

QUESTIONS:
As mentioned in the Weakness area, please clarify the experimental settings.

LIMITATIONS:
The limitations mentioned by the authors are appreciated.
TITLE: Official Review
SOUNDNESS_CORRECTNESS: 3
DATE: 2024-07-14

comments: SUMMARY:
Unfortunately, the authors begin the manuscript by demonstrating a lack of knowledge about the topic. They claim that deep learning (DL) has been highly successful in the field of brain-computer interfaces (BCI) based on electroencephalogram (EEG) data. However, in reality, the application of deep learning in the BCI or EEG field is limited, and shallow learning with simple hand-engineered features is still the gold standard. Therefore, the paper's claims about the vulnerabilities of machine learning models seem to be more like science fiction and do not meet the standard of the NeurIPS.

STRENGTHS:
Hard to spot any strength as this is an artificial toy example.

WEAKNESSES:
Lack of connection with real-world problems, especially the BCI and EEG fields, where shallow learning remains gold standards with non-existent vulnerabilities. ML in BCI has been trained for each subject at the bedside.

QUESTIONS:
Why did the authors create a science fiction problem that doesn't exist and then develop a theoretical methodology for it?

LIMITATIONS:
No application in the real world and a completely trivial problem below conference standards.
TITLE: Official Review
SOUNDNESS_CORRECTNESS: 1
DATE: 2024-07-15

comments: SUMMARY:
This paper presents an EEG backdoor for manipulating EEG BCI, called ManiBCI, where the adversary can arbitrarily control the output for any input samples. Experiments conducted on three EEG datasets demonstrate the effectiveness of ManiBCI; which easily bypass existing backdoor defenses.

STRENGTHS:
- A backdoor attack for EEG BCI where the adversary can arbitrarily manipulate which target class the EEG BCI will misclassify without engaging the training stage.
- The use of EEG electrodes and frequencies in EEG backdoor attacks with reinforcement learning.
- Several experiments have been conducted to assess the proposed method.

WEAKNESSES:
- The proposed methodology is not well described. It mainly based on the application of Fourier transform and reinforcement learning.

QUESTIONS:
It is suggested to describe well  the proposed method by highlighting the novelty and originality of the proposed contribution. It is also suggested to summarize the proposed method as an algorithm.

LIMITATIONS:
Yes. The limitations were addressed in Appendix.
TITLE: Official Review
SOUNDNESS_CORRECTNESS: 3
DATE: 2024-07-18