pith. sign in

arxiv: 2606.02597 · v1 · pith:DCAYRJRRnew · submitted 2026-05-22 · 💻 cs.LG · cs.CR

Making Brain-Computer Interfaces More Secure

Md Fahimul Kabir Chowdhury , Gahangir Hossain This is my paper

Pith reviewed 2026-06-30 15:30 UTC · model grok-4.3

classification 💻 cs.LG cs.CR
keywords brain-computer interfaceEEGadversarial robustnessconvolutional neural networkmachine learning securitysignal classificationrobustness evaluation
0
0 comments X

The pith

A lightweight custom CNN architecture for EEG-based BCIs demonstrates improved classification performance under gradient-based adversarial attacks compared to established models.

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The paper proposes a new lightweight CNN model for classifying EEG signals in brain-computer interfaces. It tests this model against three other CNN architectures on two datasets when the inputs are perturbed by small adversarial changes designed to fool the classifier. The custom model maintains better accuracy than the baselines under these attacks. This matters because BCIs are moving toward real-world use where malicious or accidental perturbations could cause errors in medical or control applications. Establishing robustness is a necessary step before deployment.

Core claim

The authors introduce a lightweight custom Convolutional Neural Network architecture for EEG signal classification in brain-computer interfaces and show through experiments on two datasets that it achieves higher classification accuracy than EEGNet, DeepConvNet, and SleepEEGNet when the EEG inputs are subjected to gradient-based adversarial perturbations, thereby indicating greater robustness to such attacks.

What carries the argument

The lightweight custom CNN architecture, which carries the argument by outperforming baselines in classification accuracy under input perturbations.

If this is right

  • Lightweight architectures can enhance security in EEG BCIs with lower computational demands.
  • Adversarial robustness evaluation becomes essential for validating BCI models.
  • The custom model offers a practical starting point for designing secure BCI systems.
  • Greater resistance supports more reliable use in applications like medical diagnostics or device control.

Where Pith is reading between the lines

These are editorial extensions of the paper, not claims the author makes directly.

  • If the performance advantage persists, it could lower risks from adversarial tampering in clinical BCI deployments.
  • Additional testing on varied attack strategies beyond gradient-based ones would strengthen the evidence.
  • The simplicity of the architecture might allow similar robustness gains in other time-series classification tasks.
  • Real-world noisy environments may see benefits from this type of model resilience.

Load-bearing premise

The gradient-based adversarial attacks and the two chosen EEG datasets are representative of the threats and usage conditions that would matter for deployed BCI systems.

What would settle it

A test showing that the custom model no longer outperforms the baselines on a new EEG dataset or under a non-gradient adversarial attack method would challenge the claim.

Figures

Figures reproduced from arXiv: 2606.02597 by Gahangir Hossain, Md Fahimul Kabir Chowdhury.

Figure 1
Figure 1. Figure 1: Overview of a EEG-based BCIs system. In applications such as human behavior analysis, brain signal analysis has been widely used [3], [4], neuro-assistive systems including seizure prediction [5]–[7], and more re￾cently, cybersecurity applications [8], [9]. In EEG classifi￾cation, signal decomposition techniques are among the most frequently applied approaches [10], [11]. For example, Sadiq et al. [12] int… view at source ↗
Figure 2
Figure 2. Figure 2: The process of preprocessing EEG signals and generating time-frequency representations to develop the proposed [PITH_FULL_IMAGE:figures/full_fig_p003_2.png] view at source ↗
Figure 3
Figure 3. Figure 3: Accuracy of different CNN models under FGSM [PITH_FULL_IMAGE:figures/full_fig_p004_3.png] view at source ↗
Figure 4
Figure 4. Figure 4: Confusion matrices of the proposed CNN before and after applying FGSM attack. [PITH_FULL_IMAGE:figures/full_fig_p005_4.png] view at source ↗
read the original abstract

The development of brain-computer interfaces (BCIs) based on electroencephalograms (EEGs) has advanced significantly mainly to machine learning. Although the majority of earlier research has been on increasing classification accuracy, relatively little focus has been placed on security and robustness. According to recent research, EEG-based BCIs are susceptible to adversarial attacks, which can cause misdiagnosis due to minute, well-crafted disturbances. Evaluating model robustness against such perturbations is therefore critical for ensuring reliable deployment. In this study, we propose a lightweight custom Convolutional Neural Network (CNN) architecture to investigate adversarial robustness in EEG-based BCIs. The suggested method is assessed using two EEG datasets and contrasted with three novel CNN models tailored to EEG, namely EEGNet, DeepConvNet, and SleepEEGNet, under gradient-based adversarial attack scenarios. According to experimental findings, the suggested model continuously performs better in classification under adversarial perturbations compared to baseline models, indicating improved robustness. These findings highlight the potential of lightweight architectures for enhancing the reliability of EEG-based BCI systems under adversarial conditions.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, simulated authors' rebuttal, and a circularity audit. Tearing a paper down is the easy half of reading it; the pith above is the substance, this is the friction.

Referee Report

2 major / 1 minor

Summary. The manuscript proposes a lightweight custom CNN architecture for EEG-based BCIs, evaluates it against gradient-based adversarial attacks on two EEG datasets, and claims superior classification performance under perturbations relative to EEGNet, DeepConvNet, and SleepEEGNet, thereby indicating improved robustness for reliable deployment.

Significance. If the empirical results were presented with quantitative metrics, attack parameters, and statistical validation, the work could usefully highlight lightweight architectures as a route to greater adversarial robustness in EEG BCIs. The emphasis on security addresses a recognized gap, but the current text supplies no numbers or experimental details with which to assess whether the claimed margin is meaningful.

major comments (2)
  1. [Abstract] Abstract, experimental findings paragraph: the assertion that the suggested model 'continuously performs better in classification under adversarial perturbations' is unsupported by any accuracy values, clean-vs-robust deltas, attack parameters (ε, iterations, norm), dataset statistics, or statistical tests. Without these, the central empirical claim cannot be evaluated.
  2. [Abstract] Abstract: the evaluation is restricted to gradient-based white-box attacks on two unnamed EEG datasets with no discussion of whether these instantiate realistic BCI threat models (subject-specific transfer, black-box queries, sensor-level perturbations, or non-stationary noise). If they do not, superior accuracy on the chosen perturbations does not establish deployment-relevant robustness.
minor comments (1)
  1. [Abstract] Abstract: the clause 'has advanced significantly mainly to machine learning' is grammatically unclear and should be revised (e.g., 'mainly due to advances in machine learning').

Simulated Author's Rebuttal

2 responses · 0 unresolved

We thank the referee for the constructive feedback on improving the clarity of our empirical claims and the discussion of threat models. We address each major comment below and will revise the manuscript to strengthen these aspects.

read point-by-point responses

  1. Referee: [Abstract] Abstract, experimental findings paragraph: the assertion that the suggested model 'continuously performs better in classification under adversarial perturbations' is unsupported by any accuracy values, clean-vs-robust deltas, attack parameters (ε, iterations, norm), dataset statistics, or statistical tests. Without these, the central empirical claim cannot be evaluated.

    Authors: We agree that the abstract should be self-contained with quantitative support. The full manuscript reports these details in the experimental section (accuracy tables, clean vs. adversarial deltas, attack parameters such as ε and iteration counts, and statistical comparisons). We will revise the abstract to include key metrics, such as average accuracies under perturbation and observed margins over baselines. revision: yes

  2. Referee: [Abstract] Abstract: the evaluation is restricted to gradient-based white-box attacks on two unnamed EEG datasets with no discussion of whether these instantiate realistic BCI threat models (subject-specific transfer, black-box queries, sensor-level perturbations, or non-stationary noise). If they do not, superior accuracy on the chosen perturbations does not establish deployment-relevant robustness.

    Authors: The datasets are named and described in the methods section of the full paper; we will add their names to the abstract for clarity. Our evaluation uses standard gradient-based white-box attacks as a benchmark for robustness. We will add a dedicated discussion of threat model relevance, including limitations relative to black-box, transfer, and sensor-level scenarios, and note that these attacks serve as an initial step toward deployment-relevant security analysis. revision: yes

Circularity Check

0 steps flagged

No circularity: purely empirical comparison with no derivations or self-referential claims

full rationale

The paper proposes a custom CNN and reports experimental accuracy comparisons against EEGNet, DeepConvNet, and SleepEEGNet on two EEG datasets under gradient-based adversarial attacks. No equations, parameter fittings presented as predictions, uniqueness theorems, ansatzes, or self-citations appear in the provided text. The central claim rests on observed performance deltas, which are independent measurements rather than reductions to the paper's own inputs by construction. This is the standard case of an empirical robustness study with no load-bearing circular steps.

Axiom & Free-Parameter Ledger

0 free parameters · 0 axioms · 0 invented entities

No mathematical derivations, free parameters, or invented entities are present; the work is an empirical ML comparison study.

pith-pipeline@v0.9.1-grok · 5707 in / 1048 out tokens · 36520 ms · 2026-06-30T15:30:26.868821+00:00 · methodology

discussion (0)

Sign in with ORCID, Apple, or X to comment. Anyone can read and Pith papers without signing in.

Reference graph

Works this paper leans on

28 extracted references · 3 canonical work pages · 2 internal anchors

  1. [1]

    Brain leaks and consumer neurotechnology,

    M. Ienca, P. Haselager, and E. J. Emanuel, “Brain leaks and consumer neurotechnology,”Nature biotechnology, vol. 36, no. 9, pp. 805–810, 2018

    2018

  2. [2]

    Past, present, and future of eeg-based bci applications,

    K. V ¨arbu, N. Muhammad, and Y . Muhammad, “Past, present, and future of eeg-based bci applications,”Sensors, vol. 22, no. 9, p. 3331, 2022

    2022

  3. [3]

    Human behavior analysis: A comprehensive survey on techniques, applications, challenges, and future directions,

    S. Essahraui, I. Lamaakal, Y . Maleh, K. El Makkaoui, M. F. Bouami, I. Ouahbi, A. A. Abd El-Latif, M. Almousa, and J. J. Rodrigues, “Human behavior analysis: A comprehensive survey on techniques, applications, challenges, and future directions,”IEEE Access, 2025

    2025

  4. [4]

    Spatial directionality found in frontal-parietal attentional networks,

    G. Hossain, M. H. Myers, and R. Kozma, “Spatial directionality found in frontal-parietal attentional networks,”Neuroscience journal, vol. 2018, no. 1, p. 7879895, 2018

    2018

  5. [5]

    Seizure prediction and detection via phase and amplitude lock values,

    M. H. Myers, A. Padmanabha, G. Hossain, A. L. de Jongh Curry, and C. D. Blaha, “Seizure prediction and detection via phase and amplitude lock values,”Frontiers in human neuroscience, vol. 10, p. 80, 2016

    2016

  6. [6]

    Dual eeg alignment between participants during shared intentionality experiments,

    M. H. Myers and G. Hossain, “Dual eeg alignment between participants during shared intentionality experiments,”Brain Research, vol. 1790, p. 147986, 2022

    2022

  7. [7]

    Learning patterns in imaginary vowels for an intelligent brain computer interface (bci) design,

    P. Ghane and G. Hossain, “Learning patterns in imaginary vowels for an intelligent brain computer interface (bci) design,”arXiv preprint arXiv:2010.12066, 2020

    work page arXiv 2010

  8. [8]

    Cogntive consistency analysis in adaptive bio-metric authentication system design

    G. Hossain, H. Khan, and M. I. Hossain, “Cogntive consistency analysis in adaptive bio-metric authentication system design.”

  9. [9]

    Pattern of success vs. pattern of failure: Adaptive authentication through kolmogorov–smirnov (ks) statistics,

    G. Hossain, P. Palaniswamy, and R. Challoo, “Pattern of success vs. pattern of failure: Adaptive authentication through kolmogorov–smirnov (ks) statistics,”IJARAI) International Journal of Advanced Research in Artificial Intelligence, 2016

    2016

  10. [10]

    Motor imagery eeg signals decoding by multivariate empirical wavelet transform-based framework for robust brain–computer interfaces,

    M. T. Sadiq, X. Yu, Z. Yuan, F. Zeming, A. U. Rehman, I. Ullah, G. Li, and G. Xiao, “Motor imagery eeg signals decoding by multivariate empirical wavelet transform-based framework for robust brain–computer interfaces,”IEEE access, vol. 7, pp. 171 431–171 451, 2019

    2019

  11. [11]

    Predicting the outcome of rtms depression therapy using eeg signals and cnn,

    W. Korani, M. F. K. Chowdhury, S. AlQadi, P. M. Kumar, R. Rostami, and R. Kazemi, “Predicting the outcome of rtms depression therapy using eeg signals and cnn,” inRecent Trends in Image Processing and Pattern Recognition, 2026

    2026

  12. [12]

    Electrocardiogram signal denoising based on empirical mode decomposition technique: an overview,

    G. Han, B. Lin, and Z. Xu, “Electrocardiogram signal denoising based on empirical mode decomposition technique: an overview,”Journal of Instrumentation, vol. 12, no. 03, pp. P03 010–P03 010, 2017

    2017

  13. [13]

    A new framework for automatic detection of motor and mental imagery eeg signals for robust bci systems,

    X. Yu, M. Z. Aziz, M. T. Sadiq, Z. Fan, and G. Xiao, “A new framework for automatic detection of motor and mental imagery eeg signals for robust bci systems,”IEEE Transactions on Instrumentation and Measurement, vol. 70, pp. 1–12, 2021

    2021

  14. [14]

    Alcoholic eeg signals recognition based on phase space dynamic and geometrical features,

    M. T. Sadiq, H. Akbari, S. Siuly, Y . Li, and P. Wen, “Alcoholic eeg signals recognition based on phase space dynamic and geometrical features,”Chaos, solitons & fractals, vol. 158, p. 112036, 2022

    2022

  15. [15]

    Motor imagery bci classification based on novel two-dimensional modelling in empirical wavelet transform,

    M. T. Sadiq, X. Yu, Z. Yuan, and M. Z. Aziz, “Motor imagery bci classification based on novel two-dimensional modelling in empirical wavelet transform,”Electronics Letters, vol. 56, no. 25, pp. 1367–1369, 2020

    2020

  16. [16]

    Recognizing seizure using poincar ´e plot of eeg signals and graphical features in dwt domain,

    H. Akbari, M. T. Sadiq, N. Jafari, J. Too, N. Mikaeilvand, A. Cicone, and S. Serra-Capizzano, “Recognizing seizure using poincar ´e plot of eeg signals and graphical features in dwt domain,”Bratislava Medical Journal/Bratislavske Lekarske Listy, vol. 124, no. 1, pp. 12–24, 2023

    2023

  17. [17]

    Development of a smart system for neonatal jaundice detection using cnn algorithm,

    M. F. K. Chowdhury, M. D. Chando, and S. M. Shawon, “Development of a smart system for neonatal jaundice detection using cnn algorithm,” 2022

    2022

  18. [18]

    Brain tumor classification in mri images: A computationally efficient convolutional neural network,

    M. F. K. Chowdhury and J. Ferdous, “Brain tumor classification in mri images: A computationally efficient convolutional neural network,” in 2025 IEEE International Conference on Biomedical Engineering, Com- puter and Information Technology for Health (BECITHCON). IEEE, 2025

    2025

  19. [19]

    Explaining and Harnessing Adversarial Examples

    I. J. Goodfellow, J. Shlens, and C. Szegedy, “Explaining and harnessing adversarial examples,”arXiv preprint arXiv:1412.6572, 2014

    work page internal anchor Pith review Pith/arXiv arXiv 2014

  20. [20]

    White-box target attack for eeg-based bci regression problems,

    L. Meng, C.-T. Lin, T.-P. Jung, and D. Wu, “White-box target attack for eeg-based bci regression problems,” inInternational conference on neural information processing. Springer, 2019, pp. 476–488

    2019

  21. [21]

    On the vulnerability of cnn classifiers in eeg- based bcis,

    X. Zhang and D. Wu, “On the vulnerability of cnn classifiers in eeg- based bcis,”IEEE transactions on neural systems and rehabilitation engineering, vol. 27, no. 5, pp. 814–825, 2019

    2019

  22. [22]

    Robust detection of adversarial attacks for eeg-based motor imagery classification using hierarchical deep learning,

    N. E. H. S. B. Aissa, A. Lakas, A. Korichi, C. A. Kerrache, and A. N. Belkacem, “Robust detection of adversarial attacks for eeg-based motor imagery classification using hierarchical deep learning,” in2023 15th International Conference on Innovations in Information Technology (IIT). IEEE, 2023, pp. 156–161

    2023

  23. [23]

    Towards Deep Learning Models Resistant to Adversarial Attacks

    A. Madry, A. Makelov, L. Schmidt, D. Tsipras, and A. Vladu, “Towards deep learning models resistant to adversarial attacks,”arXiv preprint arXiv:1706.06083, 2017

    work page internal anchor Pith review Pith/arXiv arXiv 2017

  24. [24]

    Saga: Sparse adversarial attack on eeg-based brain computer interface,

    B. Feng, Y . Wang, and Y . Ding, “Saga: Sparse adversarial attack on eeg-based brain computer interface,” inICASSP 2021-2021 IEEE International Conference on Acoustics, Speech and Signal Processing (ICASSP). IEEE, 2021, pp. 975–979

    2021

  25. [25]

    Review of the bci competition iv,

    M. Tangermann, K.-R. M ¨uller, A. Aertsen, N. Birbaumer, C. Braun, C. Brunner, R. Leeb, C. Mehring, K. J. Miller, G. R. M ¨uller-Putzet al., “Review of the bci competition iv,”Frontiers in neuroscience, vol. 6, p. 55, 2012

    2012

  26. [26]

    Eegnet: a compact convolutional neural network for eeg-based brain–computer interfaces,

    V . J. Lawhern, A. J. Solon, N. R. Waytowich, S. M. Gordon, C. P. Hung, and B. J. Lance, “Eegnet: a compact convolutional neural network for eeg-based brain–computer interfaces,”Journal of neural engineering, vol. 15, no. 5, p. 056013, 2018

    2018

  27. [27]

    Energy-fluctuated multiscale feature learning with deep convnet for intelligent spindle bearing fault diagnosis,

    X. Ding and Q. He, “Energy-fluctuated multiscale feature learning with deep convnet for intelligent spindle bearing fault diagnosis,”IEEE Transactions on Instrumentation and Measurement, vol. 66, no. 8, pp. 1926–1935, 2017

    1926

  28. [28]

    Sleepeegnet: Automated sleep stage scoring with sequence to sequence deep learning approach,

    S. Mousavi, F. Afghah, and U. R. Acharya, “Sleepeegnet: Automated sleep stage scoring with sequence to sequence deep learning approach,” PloS one, vol. 14, no. 5, p. e0216456, 2019

    2019