Original: Physically-Constrained Adversarial Attacks on Brain-Machine Interfaces
Revised: Physically-Constrained Adversarial Attacks on Brain-Machine Interfaces

Original: Anonymous Author(s)

Original: AffiliationAddress email

Original: Abstract
Revised: Abstract

Original: Deep learning (DL) has been widely employed in brain–machine interfaces (BMIs)to decode subjects’ intentions based on recorded brain activities enabling directinteraction with machines.
Revised: Deep learning (DL) has been widely employed in brain–machine interfaces (BMIs) to decode subjects’ intentions based on recorded brain activities enabling direct interaction with machines.

Original: BMI systems play a crucial role in medical applications and have recently gained an increasing interest as consumer-grade products.
Revised: BMI systems play a crucial role in medical applications and have recently gained an increasing interest as consumer-grade products.

Original: Failures in such systems might cause medical misdiagnoses, physical harm, andfinancial loss.
Revised: Failures in such systems might cause medical misdiagnoses, physical harm, and financial loss.

Original: Especially with the current market boost of such devices, it is ofutmost importance to analyze and understand in-depth, potential malicious attacksto develop countermeasures and avoid future damages.
Revised: Especially with the current market boost of such devices, it is of utmost importance to analyze and understand in-depth, potential malicious attacks to develop countermeasures and avoid future damages.

Original: This work presents thefirst study that analyzes and models adversarial attacks based on physical domainconstraints in DL-based BMIs.
Revised: This work presents the first study that analyzes and models adversarial attacks based on physical domain constraints in DL-based BMIs.

Original: Specifically, we assess the robustness of EEGNetwhich is the current state-of-the-art network embedded in a real-world, wearable
Revised: Specifically, we assess the robustness of EEGNet which is the current state-of-the-art network embedded in a real-world, wearable

Original: BMI.
Revised: BMI.

Original: We propose new methods that incorporate domain-specific insights and constraints to design natural and imperceptible attacks and to realistically model signalpropagation over the human scalp.
Revised: We propose new methods that incorporate domain-specific insights and constraints to design natural and imperceptible attacks and to realistically model signal propagation over the human scalp.

Original: Our results show that EEGNet is significantlyvulnerable to adversarial attacks with an attack success rate of more than 50%.
Revised: Our results show that EEGNet is significantly vulnerable to adversarial attacks with an attack success rate of more than 50%.

Original:  Introduction
Revised:  Introduction

Original: Recent work has shown that adversarial perturbations can cause state-of-the-art (SoA) deep learningmodels to misbehave in various domains including vision [38, 17], NLP [24, 42], speech [34, 25] and biomedicine [15, 18].
Revised: Recent work has shown that adversarial perturbations can cause state-of-the-art (SoA) deep learning models to misbehave in various domains including vision [38, 17], NLP [24, 42], speech [34, 25], and biomedicine [15, 18].

Original: Neural networks have been applied in brain–machine interfaces (BMIs)achieving impressive results [23, 11].
Revised: Neural networks have been applied in brain–machine interfaces (BMIs) achieving impressive results [23, 11].

Original: A BMI enables direct interactions with external devices basedon brain activities, typically recorded using non-invasive electroencephalographic (EEG) systems.
Revised: A BMI enables direct interactions with external devices based on brain activities, typically recorded using non-invasive electroencephalographic (EEG) systems.

Original: Itcan provide a communication pathway for severely paralyzed patients or assist in rehabilitation [10].
Revised: It can provide a communication pathway for severely paralyzed patients or assist in rehabilitation [10].

Original: Besides medical applications, recent developments in wearable devices have pushed BMIs towardsconsumer-grade products to improve life quality [3], e g., the Interaxon Muse headband for stressrelief [4] or the Emotiv headset for controlling drones [28] and ground vehicles [44].
Revised: Besides medical applications, recent developments in wearable devices have pushed BMIs towards consumer-grade products to improve life quality [3], e.g., the Interaxon Muse headband for stress relief [4] or the Emotiv headset for controlling drones [28] and ground vehicles [44].

Original: Safety in BMIsystems is paramount [12, 7], because a failure would cause misdiagnoses, user frustration, or evendanger while driving a wheelchair or controlling a drone, causing physical and financial damages.
Revised: Safety in BMI systems is paramount [12, 7], because a failure would cause misdiagnoses, user frustration, or even danger while driving a wheelchair or controlling a drone, causing physical and financial damages.

Original: Zhang and Wu [43] were the first to show that EEG-based BMIs are vulnerable to adversarial attacksby proposing an unsupervised fast gradient sign method (FGSM)
Revised: Zhang and Wu [43] were the first to show that EEG-based BMIs are vulnerable to adversarial attacks by proposing an unsupervised fast gradient sign method (FGSM)

Original: The work assumes that theacquired signals are sent to a remote compute engine, e.g., a computer, and the attacker can alterthe signals during the transmission, between the signal preprocessing step and the classifier.
Revised: The work assumes that the acquired signals are sent to a remote compute engine, e.g., a computer, and the attacker can alter the signals during the transmission, between the signal preprocessing step and the classifier.

Original: Recentdevelopments in smart edge computing [1, 5] eliminate the need for data transmission, makingthis attack scenario inapplicable.
Revised: Recent developments in smart edge computing [1, 5] eliminate the need for data transmission, making this attack scenario inapplicable.

Original: Novel BMI solutions [21, 40] embed the signal processing andclassification directly at the sensor edge.
Revised: Novel BMI solutions [21, 40] embed the signal processing and classification directly at the sensor edge.

Original: A more practical adversarial example has been identified by[29].
Revised: A more practical adversarial example has been identified by [29].

Original: It consists of a square-shaped signal that can be added to EEG trials before the preprocessingstep.
Revised: It consists of a square-shaped signal that can be added to EEG trials before the preprocessing step.

Original: However, the attack is proposed as a backdoor key, which is improbable if the attacker is notdirectly involved in the data acquisition or in the training of the classifier.
Revised: However, the attack is proposed as a backdoor key, which is improbable if the attacker is not directly involved in the data acquisition or in the training of the classifier.

Original: Li et al.
Revised: Li et al.

Original: [25] have shown an attack scenario in the audio domain by considering the on-board edge processing of a wake-worddetection system, where an adversarial audio trace is delivered to the environment causing the systemto malfunction.
Revised: [25] have shown an attack scenario in the audio domain by considering the on-board edge processing of a wake-word detection system, where an adversarial audio trace is delivered to the environment causing the system to malfunction.

Original: No similar studies can be currently found in the BMI domain.
Revised: No similar studies can be currently found in the BMI domain.

Original: Challenges: Designing natural attacks and modeling its propagation.
Revised: Challenges: Designing natural attacks and modeling its propagation.

Original: Unlike in audio applications where the signal can simply propagate over-the-air and is sensed by a microphone, extramodeling is required to evaluate the signal propagation in BMIs based on the physical properties ofthe biological tissues.
Revised: Unlike in audio applications where the signal can simply propagate over-the-air and is sensed by a microphone, extra modeling is required to evaluate the signal propagation in BMIs based on the physical properties of the biological tissues.

Original: In this work, we consider a practical attack scenario where the adversarial perturbations are introduced at the source of the data acquisition, as showcased in Appendix A, Figure 5.
Revised: In this work, we consider a practical attack scenario where the adversarial perturbations are introduced at the source of the data acquisition, as showcased in Appendix A, Figure 5.

Original: This can be achieved, for example, via electromagnetic waves delivered to the environment [12] orvia current stimulation delivered to the scalp [8, 14].
Revised: This can be achieved, for example, via electromagnetic waves delivered to the environment [12] or via current stimulation delivered to the scalp [8, 14].

Original: The perturbations translate into electrical signalspropagating over the scalp and are sensed by the electrodes in addition to the EEG signals.
Revised: The perturbations translate into electrical signals propagating over the scalp and are sensed by the electrodes in addition to the EEG signals.

Original: To guarantee the imperceptibility of the attacks, previous works in BMIs create perturbations thatare small in amplitude [43, 19, 26], limiting the attack success rate (ASR).
Revised: To guarantee the imperceptibility of the attacks, previous works in BMIs create perturbations that are small in amplitude [43, 19, 26], limiting the attack success rate (ASR).

Original: Increased perturbation’samplitude yields higher ASR [29], but makes the attack more easily detectable.
Revised: Increased perturbation’s amplitude yields higher ASR [29], but makes the attack more easily detectable.

Original: Moreover, the generated perturbations are square-shaped, which is implausible for biosignals.
Revised: Moreover, the generated perturbations are square-shaped, which is implausible for biosignals.

Original: [18] are the first to observesquare-wave artifacts in biosignals’ attacks and propose smooth perturbations for electrocardiograms(ECGs).
Revised: [18] are the first to observe square-wave artifacts in biosignals’ attacks and propose smooth perturbations for electrocardiograms (ECGs).

Original: No similar works have been found for designing natural EEG signals.
Revised: No similar works have been found for designing natural EEG signals.

Original: This work: Physically-constrained attacks.
Revised: This work: Physically-constrained attacks.

Original: To address the above technical challenges, and foranalyzing the vulnerability of BMI models in practical scenarios including edge computing, wedesign a new attack algorithm that generates natural adversarial examples based on the signals’ firstderivative and model its propagation over the scalp based on a realistic head model by taking intoconsideration the attack source and the electrical and physical properties of the conducting tissues.
Revised: To address the above technical challenges, and for analyzing the vulnerability of BMI models in practical scenarios including edge computing, we design a new attack algorithm that generates natural adversarial examples based on the signals’ first derivative and model its propagation over the scalp based on a realistic head model by taking into consideration the attack source and the electrical and physical properties of the conducting tissues.

Original: We attack the most energy-efficient network that has been embedded on microcontrollers for smartwearable BMIs called EEGNet [23, 37].
Revised: We attack the most energy-efficient network that has been embedded on microcontrollers for smart wearable BMIs called EEGNet [23, 37].

Original: It is a resource-friendly convolutional neural network (CNN)and is the SoA in terms of accuracy and energy-efficiency trade-off [6, 27, 40, 37].
Revised: It is a resource-friendly convolutional neural network (CNN) and is the SoA in terms of accuracy and energy-efficiency trade-off [6, 27, 40, 37].

Original: We evaluate our methods and show experimental results on BMIs based on the motor imagery(MI) paradigm.
Revised: We evaluate our methods and show experimental results on BMIs based on the motor imagery (MI) paradigm.

Original: By imagining the movement of different body parts, the decoded intention istranslated into control signals.
Revised: By imagining the movement of different body parts, the decoded intention is translated into control signals.

Original: It is widely applied in several BMI applications, such as the control ofwheelchairss [41], prosthetic armss [13], ground vehicles [44], and in communication [9].
Revised: It is widely applied in several BMI applications, such as the control of wheelchairss [41], prosthetic armss [13], ground vehicles [44], and in communication [9].

Original: It has beenproven to be the most difficult task to be attacked among the most common BMI paradigms [43, 29].
Revised: It has been proven to be the most difficult task to be attacked among the most common BMI paradigms [43, 29].

Original: We evaluate our methods by “fooling” the victim model to always predict the target MI class.
Revised: We evaluate our methods by “fooling” the victim model to always predict the target MI class.

Original: Main contributions.
Revised: Main contributions.

Original: Our main contributions are:
Revised: Our main contributions are:

Original: • We design a new method to generate natural adversarial perturbations that are similar to originalEEG signals and imperceptible to the human eye.•
Revised: • We design a new method to generate natural adversarial perturbations that are similar to original EEG signals and imperceptible to the human eye.

Original:  We model a practical scenario where the perturbation is added at the signal acquisition source andmodel its propagation constrained by the physical properties of the human scalp.•
Revised: • We model a practical scenario where the perturbation is added at the signal acquisition source and model its propagation constrained by the physical properties of the human scalp.

Original:  The first study of adversarial perturbations in BMI to consider the practical scenario of smart edge computing and physical signal propagation.
Revised: • The first study of adversarial perturbations in BMI to consider the practical scenario of smart edge computing and physical signal propagation.

Original: Our attacks consistently achieve a success rate of> 50 % pointing to the significant vulnerability of the SoA embedded EEGNet.
Revised: Our attacks consistently achieve a success rate of > 50 % pointing to the significant vulnerability of the SoA embedded EEGNet.

Original: We hope that our work raises awareness for potential risks, also considering the market tendency ofsmart wearable devices, and motivates the future development of appropriate countermeasures.
Revised: We hope that our work raises awareness for potential risks, also considering the market tendency of smart wearable devices, and motivates the future development of appropriate countermeasures.

Original:  Modeling natural and physically-constrained attacks
Revised:  Modeling natural and physically-constrained attacks

Original: We first introduce a new method to eliminate the square wave artifacts to generate natural perturbations.
Revised: We first introduce a new method to eliminate the square wave artifacts to generate natural perturbations.

Original: We then present a practical signal propagation model based on the physical properties of the underlyingbiological tissues.
Revised: We then present a practical signal propagation model based on the physical properties of the underlying biological tissues.

Original: Appendix B summarizes the background knowledge of BMI classification.
Revised: Appendix B summarizes the background knowledge of BMI classification.

Original: 2.1 Design and assessment of natural attacks
Revised: 2.1 Design and assessment of natural attacks

Original: Projected gradient descent (PGD)-designed attacks on EEG tend to form perturbation signals whichresemble a square-wave artifact (see Figure 2), an effect that has been observed on ECG data, too [18].
Revised: Projected gradient descent (PGD)-designed attacks on EEG tend to form perturbation signals which resemble a square-wave artifact (see Figure 2), an effect that has been observed on ECG data, too [18].

Original: However, EEG signals are of random nature and can be modeled as frequency dependent stationaryor non-stationary random processes [20].
Revised: However, EEG signals are of random nature and can be modeled as frequency dependent stationary or non-stationary random processes [20].

Original: To this end, we introduce a new loss term in the PGDoptimization such that the perturbation resembles the random nature of EEG signals, which we achieve by promoting signal changes represented in the first order derivative.
Revised: To this end, we introduce a new loss term in the PGD optimization such that the perturbation resembles the random nature of EEG signals, which we achieve by promoting signal changes represented in the first order derivative.

Original: We estimate theper-channel derivative V ′
Revised: We estimate the per-channel derivative V ′

Original: = ( v ′ 0 , v ′ 1 , ..., v ′ N ch − 1 )
Revised: = ( v ′ 0 , v ′ 1 , ..., v ′ N ch − 1 )

Original: ∈ R N s − 1 × N ch using the sample-wise difference:
Revised: ∈ R N s − 1 × N ch using the sample-wise difference:

Original: v

Original: [Equation]
Revised: [Equation]

Original: c [ t ] :=

Original: [Equation]

Original: [Equation]

Original: [Equation]

Original: , ..., N

Original: [Equation]

Original: [Equation]

Original: [Equation]

Original: The additive loss term is determined by l 1 ( V ) =
Revised: The additive loss term is determined by l 1 ( V ) =

Original: − βϵ (cid:80) N ch c
Revised: − βϵ (cid:80) N ch c

Original: =1 || v ′
Revised: =1 || v ′

Original: c
Revised: c

Original: || 1 , where || · || 1 is the ℓ 1 -norm, ϵ themaximum perturbation amplitude, and β ≥ 

Revised: || 1 , where || · || 1 is the ℓ 1 -norm, ϵ the maximum perturbation amplitude, and β ≥

Original: a weighting factor.
Revised: a weighting factor.

Original: When designing a one-dimensionalperturbation, the derivative loss becomes l 1 ( v ) =
Revised: When designing a one-dimensional perturbation, the derivative loss becomes l 1 ( v ) =

Original: − βϵ
Revised: − βϵ

Original: || v ′
Revised: || v ′

Original: || .
Revised: || .

Original: Measuring the plausibility of attacks.
Revised: Measuring the plausibility of attacks.

Original: None of the previous works have given quantitative measuresto assess the physiological plausibility of an EEG adversarial attack.
Revised: None of the previous works have given quantitative measures to assess the physiological plausibility of an EEG adversarial attack.

Original: In this work, we propose datadriven measures for quantifying the naturalism of an attack.
Revised: In this work, we propose datadriven measures for quantifying the naturalism of an attack.

Original: We compute the cross correlation andthe cosine similarity between the attacked signal and the original EEG, and average the values overthe N ch channels and over the samples in the dataset.
Revised: We compute the cross correlation and the cosine similarity between the attacked signal and the original EEG, and average the values over the N ch channels and over the samples in the dataset.

Original: 2.2 Spatial propagation model
Revised: 2.2 Spatial propagation model

Original: We consider the realistic use case where the perturbation signal v ∈ R N s is emitted from one location,e.g., from an adversarial device placed on the left side of the subject or close to the left ear.
Revised: We consider the realistic use case where the perturbation signal v ∈ R N s is emitted from one location, e.g., from an adversarial device placed on the left side of the subject or close to the left ear.

Original: Morespecifically, in this study, we assume that the EEG electrode at the position T9 according to theinternational 10-10 system [36], which is the closest to the left ear, senses the largest perturbation.
Revised: More specifically, in this study, we assume that the EEG electrode at the position T9 according to the international 10-10 system [36], which is the closest to the left ear, senses the largest perturbation.

Original: The signal subsequently propagates over the skin to each electrode, which results in an individualmagnitude and delay depending on the distance between the adversarial device and the electrode.
Revised: The signal subsequently propagates over the skin to each electrode, which results in an individual magnitude and delay depending on the distance between the adversarial device and the electrode.

Original: This phenomenon can be experimentally observed on measured EEG traces [30, 35].
Revised: This phenomenon can be experimentally observed on measured EEG traces [30, 35].

Original: More formally,we model the sensed perturbation at channel i and time instant t as
Revised: More formally, we model the sensed perturbation at channel i and time instant t as

Original: [Equation]
Revised: [Equation]

Original: where m ( l i , λ m ) and d ( l i , λ d ) are the magnitude and the delay respectively, both of which dependon the distance l i and on characteristic parameters λ m and λ d .
Revised: where m ( l i , λ m ) and d ( l i , λ d ) are the magnitude and the delay respectively, both of which depend on the distance l i and on characteristic parameters λ m and λ d .

Original: We define the resulting multi-channelperturbation V ∈ R N s × N ch , which is added to the multi-channel EEG signal, as
Revised: We define the resulting multi-channel perturbation V ∈ R N s × N ch , which is added to the multi-channel EEG signal, as

Original: [Equation]
Revised: [Equation]

Original: We estimate the distance l i between the electrode at position T9 and the remaining, attacked positionsusing the 10-10 system and a head model with a radius of 8.7 cm [2].
Revised: We estimate the distance l i between the electrode at position T9 and the remaining, attacked positions using the 10-10 system and a head model with a radius of 8.7 cm [2].

Original: We decouple the distancedependent modeling of the magnitude and delay, explained in the following paragraphs.
Revised: We decouple the distancedependent modeling of the magnitude and delay, explained in the following paragraphs.

Original: Magnitude.
Revised: Magnitude.

Original: We assume that the adversarial device injects or induces a current I , yielding a potential
Revised: We assume that the adversarial device injects or induces a current I , yielding a potential

Original: V measured near T9.
Revised: V measured near T9.

Original: The current propagates over the head surface through the skin to each of theremaining attacked electrodes, which can be modeled as a cylindrical resistor with resistance
Revised: The current propagates over the head surface through the skin to each of the remaining attacked electrodes, which can be modeled as a cylindrical resistor with resistance

Original: [Equation]
Revised: [Equation]

Original: where σ is the conductivity of the skin which can be in the range of [0.28, 0.87]
Revised: where σ is the conductivity of the skin which can be in the range of [0.28, 0.87]

Original: Siemens/m [39], and
Revised: Siemens/m [39], and

Original: A is the area of the skin conductor.
Revised: A is the area of the skin conductor.

Original: The potential at electrode i is V
Revised: The potential at electrode i is V

Original: i
Revised: i

Original: =
Revised: =

Original: V − I · R i , and hence themagnitude can be described as
Revised: V − I · R i , and hence the magnitude can be described as

Original: [Equation]
Revised: [Equation]

Original: where we further constrain 0 ≤ m ( l i , λ m ) ≤ 1 .
Revised: where we further constrain 0 ≤ m ( l i , λ m ) ≤ 1 .

Original: The characteristic magnitude parameter λ mrepresents the complex interplay between input current, voltage, conductivity, and area, coveringvarious attack scenarios.
Revised: The characteristic magnitude parameter λ m represents the complex interplay between input current, voltage, conductivity, and area, covering various attack scenarios.

Original: We consider different characteristic magnitude parameters λ m ∈ [1 , 15] .
Revised: We consider different characteristic magnitude parameters λ m ∈ [1 , 15] .

Original: A large λ m represents cases with large attenuation and limited propagation, i.e., a limited set ofneighboring electrodes sense the perturbation.
Revised: A large λ m represents cases with large attenuation and limited propagation, i.e., a limited set of neighboring electrodes sense the perturbation.

Original: Conversely, a small λ m covers cases with lowerattenuation where the perturbation can propagate further and infects all electrodes.
Revised: Conversely, a small λ m covers cases with lower attenuation where the perturbation can propagate further and infects all electrodes.

Original: We consider alsoan intermediate case where around half of the electrodes are affected by the attack with λ m = 5 .
Revised: We consider also an intermediate case where around half of the electrodes are affected by the attack with λ m = 5 .

Original: Appendix C provides examples of the magnitude of the spatial propagation on the head model.
Revised: Appendix C provides examples of the magnitude of the spatial propagation on the head model.

Original: Delay.
Revised: Delay.

Original: The propagation of a signal on the head surface yields a position-dependent phase angle ordelay, as shown by experimental measurements of related studies [32, 33].
Revised: The propagation of a signal on the head surface yields a position-dependent phase angle or delay, as shown by experimental measurements of related studies [32, 33].

Original: The delay stems from acombination of resistive and capacitive components that are encountered during the propagation of the signal, which can be modeled as an RC-circuit with resistance R , capacity C , and time constantτ = R · C that relates to the group delay.
Revised: The delay stems from a combination of resistive and capacitive components that are encountered during the propagation of the signal, which can be modeled as an RC-circuit with resistance R , capacity C , and time constant τ = R · C that relates to the group delay.

Original: Specifically, the contacts between the electrodes and theskin are predominantly capacitive whereas the skin itself is both resistive and capacitive [22].
Revised: Specifically, the contacts between the electrodes and the skin are predominantly capacitive whereas the skin itself is both resistive and capacitive [22].

Original: Asexplained in the previous part, an increasing distance between the attacker and the target electrodeyields a larger resistance R .
Revised: As explained in the previous part, an increasing distance between the attacker and the target electrode yields a larger resistance R .

Original: As a result, the time constant τ and the delay increase too.
Revised: As a result, the time constant τ and the delay increase too.

Original: Here, we model a linear distance-delay relation.
Revised: Here, we model a linear distance-delay relation.

Original: We rely on a study by [32], which conducted humanskin impedance and phase angle measurements by placing electrodes at an approximate distanceof 10 cm and applying voltages with frequencies in the range 2–1000 Hz.
Revised: We rely on a study by [32], which conducted human skin impedance and phase angle measurements by placing electrodes at an approximate distance of 10 cm and applying voltages with frequencies in the range 2–1000 Hz.

Original: When assuming a linearfrequency-phase relation in low-frequency region [33], one can derive the group delay to be 2.8 mswhen considering a measured angle of 10 ◦ at 10 Hz.
Revised: When assuming a linear frequency-phase relation in low-frequency region [33], one can derive the group delay to be 2.8 ms when considering a measured angle of 10 ◦ at 10 Hz.

Original: As those measurements were conducted for onlyone distance, we extrapolate the delay for the remaining distances using a rectified linear model:
Revised: As those measurements were conducted for only one distance, we extrapolate the delay for the remaining distances using a rectified linear model:

Original: [Equation]
Revised: [Equation]

Original: where d 0 = 2 . 8 ms is the delay at distance l 0 = 10 cm.
Revised: where d 0 = 2 . 8 ms is the delay at distance l 0 = 10 cm.

Original: The delay depends not only on the distance,but also on other parameters such as the electrode-to-skin contact, the humidity of the skin, etc.
Revised: The delay depends not only on the distance, but also on other parameters such as the electrode-to-skin contact, the humidity of the skin, etc.

Original: Tothis end, we evaluate the propagation of the attack with different characteristic delay parametersλ d ∈ [0 . 1 , 0 .
Revised: To this end, we evaluate the propagation of the attack with different characteristic delay parameters λ d ∈ [0 . 1 , 0 .

Original: 563] s/m. With λ d = 0 .
Revised: 563] s/m. With λ d = 0 .

Original: 1 we cover the cases where very little delay happens, while thelargest considered λ d = 0 .
Revised: 1 we cover the cases where very little delay happens, while the largest considered λ d = 0 .

Original: 563 s/m yields a maximum delay of 0.1 s at the farthest electrode T10,which is in alignment with the observed EEG measurements [30, 35].
Revised: 563 s/m yields a maximum delay of 0.1 s at the farthest electrode T10, which is in alignment with the observed EEG measurements [30, 35].

Original: Similarly to λ m , we showcasealso for an intermediate value of λ d = 0 . 3 which corresponds to a delay of 0.053 ms at T10.
Revised: Similarly to λ m , we showcase also for an intermediate value of λ d = 0 . 3 which corresponds to a delay of 0.053 ms at T10.

Original: 2.3 Attack Design
Revised: 2.3 Attack Design

Original: We present imperceptible attacks in BMIs that respect domain constraints such as maximum amplitude,spectral distribution, physiological plausibility, and the spatial propagation of the perturbation.
Revised: We present imperceptible attacks in BMIs that respect domain constraints such as maximum amplitude, spectral distribution, physiological plausibility, and the spatial propagation of the perturbation.

Original: To thisend, we formulate a general objective function that contains the spatial propagation, the preprocessingstep, and the first order derivative loss term:
Revised: To this end, we formulate a general objective function that contains the spatial propagation, the preprocessing step, and the first order derivative loss term:

Original: [Equation]
Revised: [Equation]

Original: where l ( · , · ) is the negative log-likelihood loss and β =1e-6 is a scalar that weights the contributionof the derivative loss term.
Revised: where l ( · , · ) is the negative log-likelihood loss and β =1e-6 is a scalar that weights the contribution of the derivative loss term.

Original: We compute the perturbation using PGD with G =10 iterations, whereeach iteration consists of a gradient-based update of the perturbation and a projection to the L ∞ ballwith radius ϵ defining the maximum perturbation amplitude.
Revised: We compute the perturbation using PGD with G =10 iterations, where each iteration consists of a gradient-based update of the perturbation and a projection to the L ∞ ball with radius ϵ defining the maximum perturbation amplitude.

Original: The update rate α is initialized with ϵ/ 2and linearly decreased with each iteration, reaching a final value of 0.1 mV at iteration 10.
Revised: The update rate α is initialized with ϵ/and linearly decreased with each iteration, reaching a final value of 0.1 mV at iteration 10.

Original: The PGDcomputation is restarted 5 times with different initial perturbations, which are drawn from a uniformdistribution within the range [ − ϵ, + ϵ ] .
Revised: The PGD computation is restarted 5 times with different initial perturbations, which are drawn from a uniform distribution within the range [ − ϵ, + ϵ ] .

Original: See Appendix D for algorithmic details.
Revised: See Appendix D for algorithmic details.

Original: Propagation model.
Revised: Propagation model.

Original: We distinguish between three use cases of spatial propagation model, wherein all cases an instance-specific attack is computed: Case 1)
Revised: We distinguish between three use cases of spatial propagation model, where in all cases an instance-specific attack is computed: Case 1)

Original: Ignore the propagation model: a multichannel perturbation V is computed, which attacks each channel individually, replacing the terms
Revised: Ignore the propagation model: a multichannel perturbation V is computed, which attacks each channel individually, replacing the terms

Original: H ( v , λ m , λ d ) by V and v ′ by V ′ in equation 7.
Revised: H ( v , λ m , λ d ) by V and v ′ by V ′ in equation 7.

Original: This case is the same as the channel-specific attacksin [43].
Revised: This case is the same as the channel-specific attacks in [43].

Original: It is used as a comparison baseline and for imperceptibility analyses.
Revised: It is used as a comparison baseline and for imperceptibility analyses.

Original: Case 2) Considerthe propagation model: a single-channel perturbation v is computed and tested with a specificpropagation configuration λ m and λ d .
Revised: Case 2) Consider the propagation model: a single-channel perturbation v is computed and tested with a specific propagation configuration λ m and λ d .

Original: With this, we simulate the case where the attacker is aware ofthe physical properties of the head.
Revised: With this, we simulate the case where the attacker is aware of the physical properties of the head.

Original: Case 3) Consider a use-case where the attacker does not knowthe spatial propagation model and computes the same perturbation v for all channels.
Revised: Case 3) Consider a use-case where the attacker does not know the spatial propagation model and computes the same perturbation v for all channels.

Original: It is similarto the channel-invariant attacks in [29].
Revised: It is similar to the channel-invariant attacks in [29].

Original: However, the previous study does not consider the physicalconstraints of the signal propagation.
Revised: However, the previous study does not consider the physical constraints of the signal propagation.

Original: Whereas, in our case, we model the real-world scenario byapplying the actual propagation model and demonstrate that, without the physical knowledge, theattacker would fail.
Revised: Whereas, in our case, we model the real-world scenario by applying the actual propagation model and demonstrate that, without the physical knowledge, the attacker would fail.

Original:  Experiments and results
Revised:  Experiments and results

Original: We evaluate our methods on the public Physionet EEG Motor Movement/Imagery Dataset [16, 36]tackling the inter-subject variability typical of real-world BMIs. We use a total of 6615 trials with
Revised: [Figure]

Original: N cl =3 balanced classes (“left”, “right”, and “rest”) and obtain the classification accuracy of 74.78%similar to the SoA [40]. Details on the dataset and the training/validation methodology can be foundin Appendix E. We then “fool” the classifier to always predict the “rest” class. To determine the ASR,
Revised: [Figure]

Original: [Figure] [Figure]
Revised: [Figure] [Table]

Original: [Figure]
Revised: [Figure]

Original: [Table]
Revised: [Table]

Original: [Figure]
Revised: [Figure]

Original: [Table]
Revised: [Table]

Original: [Figure]
Revised: [Figure]

Original: [Table]
Revised: We evaluate our methods on the public Physionet EEG Motor Movement/Imagery Dataset [16, 36] tackling the inter-subject variability typical of real-world BMIs. We use a total of 6615 trials with N cl =3 balanced classes (“left”, “right”, and “rest”) and obtain the classification accuracy of 74.78% similar to the SoA [40].

Original: [Figure]
Revised: Details on the dataset and the training/validation methodology can be found in Appendix E. We then “fool” the classifier to always predict the “rest” class.

Original:  we compute the ratio between the successfully fooled trials and the total number of attacked trials,where we only consider the ones initially correctly classified as “left”/“right”.
Revised: To determine the ASR, we compute the ratio between the successfully fooled trials and the total number of attacked trials, where we only consider the ones initially correctly classified as “left”/“right”.

Original: Attacks’ imperceptibility.
Revised: Attacks’ imperceptibility.

Original: We first analyze the attacks without considering the propagation model(Case 1), depicted in Figure 1.
Revised: We first analyze the attacks without considering the propagation model (Case 1), depicted in Figure 1.

Original: We compare our methods against random noise with amplitudeϵ as in [43] and FGSM that is the same as in [43] with targeted scenario.
Revised: We compare our methods against random noise with amplitude ϵ as in [43] and FGSM that is the same as in [43] with targeted scenario.

Original: For both FGSM and 
Revised: For both FGSM and PGD, the

Original: PGD, the ASR increases together with the maximum amplitude ϵ of the perturbation.
Revised: ASR increases together with the maximum amplitude ϵ of the perturbation.

Original: They alwaysoutperform the random noise, with PGD performing slightly better than FGSM.
Revised: They always outperform the random noise, with PGD performing slightly better than FGSM.

Original: They reach themaximum ASR of 99.97% with 10mV.
Revised: They reach the maximum ASR of almost 100% with 10mV.

Original: The post-attack classification accuracy drops from 74.78% to48% for a perturbation amplitude of 2 mV and to 33% for 10 mV and higher amplitudes.
Revised: The post-attack classification accuracy drops from 74.78% to 48% for a perturbation amplitude of 2 mV and to 33% for 10 mV and higher amplitudes, as reported in Table 2.

Original: To be notedthat we have a balanced 3-class task, hence, when all samples are classified to one target class, theclassification accuracy is 33% (Appendix B).
Revised: To be noted that we have a balanced 3-class task, hence, when all samples are classified to one target class, the classification accuracy is 33% (Appendix B).

Original: Figure 2a shows the signals of a successful attack using PGD.
Revised: Figure 2a shows the signals of a successful attack using PGD.

Original: The adversarial perturbation has asquare-wave form which negatively affects the natural shape of the EEG signal.
Revised: The adversarial perturbation has a square-wave form which negatively affects the natural shape of the EEG signal.

Original: By adding theproposed derivative term, the square-wave artifacts are significantly reduced (2b), making the perturbation more physiologically plausible.
Revised: By adding the proposed derivative term, the square-wave artifacts are significantly reduced (2b), making the perturbation more physiologically plausible.

Original: When comparing the power spectral density of the originaland attacked signals, the attacked signal designed without derivative presents large components inlow frequencies, making it more easily detectable.
Revised: When comparing the power spectral density of the original and attacked signals, the attacked signal designed without derivative presents large components in low frequencies, making it more easily detectable.

Original: Whereas the attack with derivative loss betterresembles the power spectral density of the original signal (see Appendix F, Figure 7).
Revised: Whereas the attack with derivative loss better resembles the power spectral density of the original signal (see Appendix F, Figure 7).

Original: Moreover, theintroduction of the derivative term does not degrade the ASR.
Revised: Moreover, the introduction of the derivative term does not degrade the ASR.

Original: The quantitative measures between the original and the adversarial samples in Table 1 demonstratethat our proposed method with derivative term generates adversarial samples that are more similar tothe original EEG, allowing them to remain imperceptible even with high ϵ .
Revised: The quantitative measures between the original and the adversarial samples in Table 1 demonstrate [Table] [Figure] m

Revised: = m

Revised: = m =    90 ASR [%]

Revised: [Figure]

Revised: m

Revised: [Figure]

Revised: [Figure]

Revised: [Figure]

Revised: λ

Revised: [Figure]

Revised: =

Revised: [Figure]

Revised: that our proposed method with derivative term generates adversarial samples that are more similar to the original EEG, allowing them to remain imperceptible even with high ϵ .

Original: We reproduce the attacksusing a Gaussian kernel as in [18].
Revised: We reproduce the attacks using a Gaussian kernel as in [18].

Original: After tuning the kernel size and variance of the Gaussian kernel,the method could not improve the plausibility metrics.
Revised: After tuning the kernel size and variance of the Gaussian kernel, the method could not improve the plausibility metrics.

Original: The inferior performance of the Gaussiankernel could stem from the different nature of the signal: it was originally designed for ECGs whichhave a pseudo-periodic structure.
Revised: The inferior performance of the Gaussian kernel could stem from the different nature of the signal: it was originally designed for ECGs which have a pseudo-periodic structure.

Original: Spatial propagation.
Revised: Spatial propagation.

Original: Finally, we introduce the spatial constraints in the signal propagationover the scalp (Case 2).
Revised: Finally, we introduce the spatial constraints in the signal propagation over the scalp (Case 2).

Original: We consider 9 different scenarios by combining 3 realistic attenuationconfigurations λ [Equation] ∈ { 1 , 5 , 15 } with 3 delay configurations λ d ∈ { 0 . 1 , 0 .3 , 0 . 563 } , which capturethe range described in Section 2.2.
Revised: We consider 9 different scenarios by combining 3 realistic attenuation configurations λ m ∈ { 1 , 5 , 15 } with 3 delay configurations λ d ∈ { 0 . 1 , 0 .

Original: For evaluating the highest achievable attack efficiency, we test ascenario where the attacker is assumed to know the propagation model: the adversarial perturbationis generated and evaluated on fixed spatial parameters λ m and λ d , shown in Figure 3, where the ASR

Original: [Figure]

Original: m = m = m =    90 ASR [%] [Figure]
Revised: 3 , 0 . 563 } , which capture the range described in Section 2.2.

Original: =

Original: [Figure]

Original: m

Original: = m =

Original: [Figure]

Original: [Figure]

Original: [Figure]

Original: [Figure]

Original: [Figure]

Original: [Figure]

Original:  λ m =λ [Figure] [Figure] reaches up to 69.2% at 50mV. Figure 8 in Appendix F depicts an example of a successful attackwith the highest perturbation amplitude.
Revised: For evaluating the highest achievable attack efficiency, we test a scenario where the attacker is assumed to know the propagation model: the adversarial perturbation is generated and evaluated on fixed spatial parameters λ m and λ d , shown in Figure 3, where the ASR reaches up to 69.2% at 50mV. Figure 8 in Appendix F depicts an example of a successful attack with the highest perturbation amplitude.

Original: The introduction of the spatial constraints makes the attackproblem harder yielding seldom square distortions.
Revised: The introduction of the spatial constraints makes the attack problem harder yielding seldom square distortions.

Original: However, the resulting EEG signals still resemblephysiological random processes typical of EEGs.
Revised: However, the resulting EEG signals still resemble physiological random processes typical of EEGs.

Original: Next, we ablate the spatial constraints during generation and test the resulting perturbations on the 9above-mentioned scenarios (Case 3).
Revised: Next, we ablate the spatial constraints during generation and test the resulting perturbations on theabove-mentioned scenarios (Case 3).

Original: The ASR drops significantly, especially for λ m =

Revised: The ASR drops significantly, especially for λ m =

Original: and λ m = 15where the attenuation of the perturbation over the scalp is greater.
Revised: and λ m = where the attenuation of the perturbation over the scalp is greater.

Original: These results support the necessityof physical modeling while designing robust models against adversarial attacks in real-world BMIs.
Revised: These results support the necessity of physical modeling while designing robust models against adversarial attacks in real-world BMIs.

Original: Attacks designed without considering the physical constraints will likely fail in a real-world setup(Case 3).
Revised: Attacks designed without considering the physical constraints will likely fail in a real-world setup (Case 3).

Original: However, if an attacker would model the physical properties of the signal propagation, thenthe ASR would be significantly increased, yielding a failure in the BMI system (Case 2).
Revised: However, if an attacker would model the physical properties of the signal propagation, then the ASR would be significantly increased, yielding a failure in the BMI system (Case 2).

Original: Finally, our spatial propagation models allows us to identify the vulnerability of the individual EEGchannels.
Revised: Finally, our spatial propagation models allows us to identify the vulnerability of the individual EEG channels.

Original: Figure 4 shows the ASR when initiating an attack from a specific channel (T9, T10, etc.)and propagating it to the rest of the head.
Revised: Figure 4 shows the ASR when initiating an attack from a specific channel (T9, T10, etc.) and propagating it to the rest of the head.

Original: In the case with the greatest attenuation ( λ m =15) we findthe maximum ASR at the electrode Cz between the regions of the electrodes C3 and C4, which arethe most relevant ones for MI of the left and right hand tasks [31].
Revised: In the case with the greatest attenuation ( λ m =15) we find the maximum ASR at the electrode Cz between the regions of the electrodes C3 and C4, which are the most relevant ones for MI of the left and right hand tasks [31].

Original:  Conclusion
Revised:  Conclusion

Original: With the incentive of improving security in BMIs, in this work, we demonstrated that PGD-basedattacks are feasible and effective if an attacker would consider physical domain constraints.
Revised: With the incentive of improving security in BMIs, in this work, we demonstrated that PGD-based attacks are feasible and effective if an attacker would consider physical domain constraints.

Original: Experimental results reveal potential risks of imperceptible attacks at the signal acquisition source andincentivize the need for future development of defense mechanisms while designing trustworthy andreliable deep learning models not only for remote processing pipelines, but also for the emergingsmart wearable BMIs.
Revised: Exper- imental results reveal potential risks of imperceptible attacks at the signal acquisition source and incentivize the need for future development of defense mechanisms while designing trustworthy and reliable deep learning models not only for remote processing pipelines, but also for the emerging smart wearable BMIs.

Original: Our detailed analysis on each EEG channel shows that special attention has tobe paid, combined with the findings in neuroscience, to the brain regions that are found responsiblefor a specific task.
Revised: Our detailed analysis on each EEG channel shows that special attention has to be paid, combined with the findings in neuroscience, to the brain regions that are found responsible for a specific task.

Original: In future work, we will investigate physically-constrained attacks in a morerealistic scenario where the attacker does not have access to the attacked EEG signals and designsubject-independent universal attacks.
Revised: In future work, we will investigate physically-constrained attacks in a more realistic scenario where the attacker does not have access to the attacked EEG signals and design subject-independent universal attacks.

Original: Moreover, we will evaluate more complicated modelling andintroduce uncertainty in the propagation model and the timing of the MI activity.
Revised: Moreover, we will evaluate more complicated modelling and introduce uncertainty in the propagation model and the timing of the MI activity

Original: A Attack at the source of signal acquisition
Revised: A Attack at the source of signal acquisition

Original: Fig.
Revised: Fig.

Original: 5 illustrates the new attack scenario where the perturbation is delivered to the human scalp andpropagates to the sensing electrodes at the source of the signal acquisition.
Revised: 5 illustrates the new attack scenario where the perturbation is delivered to the human scalp and propagates to the sensing electrodes at the source of the signal acquisition.

Original: B Classification in BMIs
Revised: B Classification in BMIs

Original: Here we describe the commonly used approach in BMIs for classification, consisting of a preprocessing step and a classifier.
Revised: Here we describe the commonly used approach in BMIs for classification, consisting of a preprocessing step and a classifier.

Original: The brain activity is recorded with an EEG device which samples N chchannels at rate F s .
Revised: The brain activity is recorded with an EEG device which samples N ch channels at rate F s .

Original: We define one trial j as ( X ( j ) , y ( j ) ) , where y ( j ) ∈ { 0 , 1 , ..., N cl − 1 } is the truelabel of N cl MI tasks, and
Revised: We define one trial j as ( X ( j ) , y ( j ) ) , where y ( j ) ∈ { 0 , 1 , ..., N cl − 1 } is the true label of N cl MI tasks, and

Original: X ( j ) ∈
Revised: X ( j ) ∈

Original: R
Revised: R

Original: N s × N ch the multi-channel recording defined as
Revised: N s × N ch the multi-channel recording defined as

Original: [Equation]
Revised: [Equation]

Original: (8) with x ( j ) i ∈ R N s corresponding to the recording of the j -th trial and the i -th channel containing N stemporal samples.
Revised: (8) with x ( j ) i ∈ R N s corresponding to the recording of the j -th trial and the i -th channel containing N s temporal samples.

Original: For simplicity, we denote X :=
Revised: For simplicity, we denote X :=

Original: X ( j ) and y :=
Revised: X ( j ) and y :=

Original: y ( j ) .
Revised: y ( j ) .

Original: The EEG recordings are often preprocessed with a band-pass filter, e.g., using a Fast Fourier Transform(FFT) filter h bp ( · ) , before being fed to a classifier, yielding
Revised: The EEG recordings are often preprocessed with a band-pass filter, e.g., using a Fast Fourier Transform (FFT) filter h bp ( · ) , before being fed to a classifier, yielding

Original: [Equation]
Revised: [Equation]

Original: Finally, the preprocessed signal X bp is classified with a trainable model f and is mapped to p :=f ( X bp ) , where p ∈ R N cl contains the output probabilities, e.g., originating from a softmax activationas final operation in f .
Revised: Finally, the preprocessed signal X bp is classified with a trainable model f and is mapped to p := f ( X bp ) , where p ∈ R N cl contains the output probabilities, e.g., originating from a softmax activation as final operation in f .

Original: The model’s final prediction ˆ y is the index with the maximum score in p :
Revised: The model’s final prediction ˆ y is the index with the maximum score in p :

Original: [Equation]
Revised: [Equation]

Original: Classification accuracy.
Revised: Classification accuracy.

Original: The classification accuracy is calculated as the ratio between the numberof correctly classified samples and the number of total samples.
Revised: The classification accuracy is calculated as the ratio between the number of correctly classified samples and the number of total samples.

Original: In a balanced three-class problem,i.e., each class contains the same number of samples, if all samples are classified to one target class,the classification accuracy will be 33%.
Revised: In a balanced three-class problem, i.e., each class contains the same number of samples, if all samples are classified to one target class, the classification accuracy will be 33%.

Original: C Spatial propagation models
Revised: C Spatial propagation models

Original: Fig.
Revised: Fig.

Original: 6 illustrates the magnitude of signal propagation using different propagation parameters λ m ={ 1 , 5 , 15 } .
Revised: 6 illustrates the magnitude of signal propagation using different propagation parameters λ m = { 1 , 5 , 15 } .

Original: A large λ m represents cases with large attenuation and limited propagation (e.g., attackover the air) and a small λ m covers cases with lower attenuation where the perturbation can propagatefarther (e.g., a smart glass).
Revised: A large λ m represents cases with large attenuation and limited propagation (e.g., attack over the air) and a small λ m covers cases with lower attenuation where the perturbation can propagate farther (e.g., a smart glass).

Original: D End-to-end algorithm
Revised: D End-to-end algorithm

Original: The end-to-end algorithm based on PGD is illustrated in Algorithm 1.
Revised: The end-to-end algorithm based on PGD is illustrated in Algorithm 1.

Original: [Figure]
Revised: [Figure]

Original: Algorithm input : X , Original EEG sample; λ m , λ d , spatial propagation parameters; β , weight of derivative loss term; ϵ , maximum perturbation amplitude; G , number of PGD iterations output : adversarial example
Revised: input : X , Original EEG sample; λ m , λ d , spatial propagation parameters; β , weight of derivative loss term; ϵ , maximum perturbation amplitude; G , number of PGD iterations output : adversarial example

Original: // Initialisation
Revised: // Initialisation

Original: Spatial propagation
Revised: Spatial propagation

Original: // Model pass with perturbation
Revised: // Model pass with perturbation

Original: // Update w/derivative
Revised: // Update w/derivative

Original: // PGD projection
Revised: // PGD projection

Original: // Learning rate update
Revised: // Learning rate update

Original: Spatial propagation and add to
Revised: Spatial propagation and add to

Original: sample E Dataset, training and validation
Revised: sample E Dataset, training and validation

Original: The Physionet EEG Motor Movement/Imagery dataset contains EEG recordings of 109 subjects [11].
Revised: The Physionet EEG Motor Movement/Imagery dataset contains EEG recordings of 109 subjects [11].

Original: Following the practice by [11], four subjects are discarded due to variability in the number of trials,resulting in the recordings of 105 subjects to be used in our experiments.
Revised: Following the practice by [11], four subjects are discarded due to variability in the number of trials, resulting in the recordings of 105 subjects to be used in our experiments.

Original: We use the MI recordingscontaining tasks of the imagination of left against right fist for 3 s. The EEG trials were recordedwith N ch =
Revised: We use the MI recordings containing tasks of the imagination of left against right fist for 3 s. The EEG trials were recorded with N ch =

Original: 64 channels sampled at F s =160 Hz, yielding N s =3 · 160=480 samples per trial.
Revised: 64 channels sampled at F s =160 Hz, yielding N s =3 · 160=480 samples per trial.

Original: Additionalbaseline runs provide resting-state data, where the subjects did not perform any tasks while havingeyes open.
Revised: Additional baseline runs provide resting-state data, where the subjects did not perform any tasks while having eyes open.

Original: Overall, we have a total of 6615 trials with N cl =3 balanced classes “left”, “right”, and“rest.”
Revised: Overall, we have a total of 6615 trials with N cl =3 balanced classes “left”, “right”, and “rest.”

Original: Training and validation.
Revised: Training and validation.

Original: We train and validate the classification models with a 5-fold crossvalidation, splitting the dataset into 84 subjects used for training and 21 subjects used for validationto effectively test the model on inter-subject variability.
Revised: We train and validate the classification models with a 5-fold crossvalidation, splitting the dataset into 84 subjects used for training and 21 subjects used for validation to effectively test the model on inter-subject variability.

Original: Similar to [40], which achieved SoAperformance on this dataset, the baseline model is trained for 100 epochs using Adam with β 1 =0.9,β 2 =0.999, and a batch size of 16.
Revised: Similar to [40], which achieved SoA performance on this dataset, the baseline model is trained for 100 epochs using Adam with β 1 =0.9, β 2 =0.999, and a batch size of 16.

Original: The learning rate is 0.01 and decreased by a factor of 10 at epochs20 and 50, achieving an average accuracy of 74.78%.
Revised: The learning rate is 0.01 and decreased by a factor of 10 at epochs 20 and 50, achieving an average accuracy of 74.78%.

Original: An FFT band-pass filter h bp with a customarypassband of 0.1–40{+0.1–
+} Hz [23] is used as preprocessing step in both baseline and attack experiments.
Revised: An FFT band-pass filter h bp with a customary passband of {+0.1–
+} Hz [23] is used as preprocessing step in both baseline and attack experiments.

Original: F Additional supporting results
Revised: F Additional supporting results

Original: Attacks’ imperceptibility.
Revised: Attacks’ imperceptibility.

Original: When comparing the power spectral density of the original and attackedsignals, the attacked signal designed without derivative presents large components in low frequencies,making it more easily detectable.
Revised: When comparing the power spectral density of the original and attacked signals, the attacked signal designed without derivative presents large components in low frequencies, making it more easily detectable.

Original: Whereas the attack with derivative loss better resembles the powerspectral density of the original signal (see Figure 7).
Revised: Whereas the attack with derivative loss better resembles the power spectral density of the original signal (see Figure 7).

Original: 40 Frequency [Hz] 0.
Revised: 40 Frequency [Hz] 0.

Original: P o w e r
Revised: P o w e r

Original: Sp e c t r a l
Revised: Sp e c t r a l

Original: D e n s i t y [
Revised: D e n s i t y [

Original: V 2 H z ]
Revised: V 2 H z ]

Revised: Attack without derivative Attack with derivative

Original: [Figure]
Revised: [Figure]

Original: Spatial propagation.
Revised: Spatial propagation.

Original: Figure 8 depicts an example of a successful attack with the highest perturbation amplitude.
Revised: Figure 8 depicts an example of a successful attack with the highest perturbation amplitude.

Original: The introduction of the spatial constraints makes the attack problem harder yieldingseldom square distortions.
Revised: The introduction of the spatial constraints makes the attack problem harder yielding seldom square distortions.

Original: However, the resulting EEG signals still resemble physiological randomprocesses typical of EEGs.
Revised: However, the resulting EEG signals still resemble physiological random processes typical of EEGs.

Original: [Figure]
Revised: [Figure]