Logo
ScienceStack
Table of Contents
Fetching ...
Sign In

Professor X: Manipulating EEG BCI with Invisible and Robust Backdoor Attack

Xuan-Hao Liu, Xinhao Song, Dexuan He, Bao-Liang Lu, Wei-Long Zheng

TL;DR

This work addresses safety concerns for EEG BCI by introducing Professor X, a frequency-domain, multi-trigger backdoor that operates in a clean-label setting and does not require training-stage control. It uses reinforcement learning to optimize per-trigger electrode and frequency injections and generates poisoned data through spectral interpolation, achieving high attack success rates with limited impact on clean accuracy across three EEG tasks and three models. The study demonstrates strong effectiveness, transferability, and robustness against common preprocessing and defenses, while also highlighting limitations and avenues for defense and ethical use, including watermarking potential. Overall, Professor X reveals a significant vulnerability in EEG BCIs and underscores the need for robust defenses and monitoring in real-world deployments.

Abstract

While electroencephalogram (EEG) based brain-computer interface (BCI) has been widely used for medical diagnosis, health care, and device control, the safety of EEG BCI has long been neglected. In this paper, we propose Professor X, an invisible and robust "mind-controller" that can arbitrarily manipulate the outputs of EEG BCI through backdoor attack, to alert the EEG community of the potential hazard. However, existing EEG attacks mainly focus on single-target class attacks, and they either require engaging the training stage of the target BCI, or fail to maintain high stealthiness. Addressing these limitations, Professor X exploits a three-stage clean label poisoning attack: 1) selecting one trigger for each class; 2) learning optimal injecting EEG electrodes and frequencies strategy with reinforcement learning for each trigger; 3) generating poisoned samples by injecting the corresponding trigger's frequencies into poisoned data for each class by linearly interpolating the spectral amplitude of both data according to previously learned strategies. Experiments on datasets of three common EEG tasks demonstrate the effectiveness and robustness of Professor X, which also easily bypasses existing backdoor defenses.

Professor X: Manipulating EEG BCI with Invisible and Robust Backdoor Attack

TL;DR

This work addresses safety concerns for EEG BCI by introducing Professor X, a frequency-domain, multi-trigger backdoor that operates in a clean-label setting and does not require training-stage control. It uses reinforcement learning to optimize per-trigger electrode and frequency injections and generates poisoned data through spectral interpolation, achieving high attack success rates with limited impact on clean accuracy across three EEG tasks and three models. The study demonstrates strong effectiveness, transferability, and robustness against common preprocessing and defenses, while also highlighting limitations and avenues for defense and ethical use, including watermarking potential. Overall, Professor X reveals a significant vulnerability in EEG BCIs and underscores the need for robust defenses and monitoring in real-world deployments.

Abstract

While electroencephalogram (EEG) based brain-computer interface (BCI) has been widely used for medical diagnosis, health care, and device control, the safety of EEG BCI has long been neglected. In this paper, we propose Professor X, an invisible and robust "mind-controller" that can arbitrarily manipulate the outputs of EEG BCI through backdoor attack, to alert the EEG community of the potential hazard. However, existing EEG attacks mainly focus on single-target class attacks, and they either require engaging the training stage of the target BCI, or fail to maintain high stealthiness. Addressing these limitations, Professor X exploits a three-stage clean label poisoning attack: 1) selecting one trigger for each class; 2) learning optimal injecting EEG electrodes and frequencies strategy with reinforcement learning for each trigger; 3) generating poisoned samples by injecting the corresponding trigger's frequencies into poisoned data for each class by linearly interpolating the spectral amplitude of both data according to previously learned strategies. Experiments on datasets of three common EEG tasks demonstrate the effectiveness and robustness of Professor X, which also easily bypasses existing backdoor defenses.
Paper Structure (50 sections, 11 equations, 16 figures, 13 tables, 2 algorithms)

This paper contains 50 sections, 11 equations, 16 figures, 13 tables, 2 algorithms.

Table of Contents

  1. Introduction
  2. Related Work
  3. Backdoor Attacks
  4. Backdoor Attacks for EEG BCI
  5. Backdoor Defenses
  6. Methodology
  7. EEG BCI Backdoor Attacks and Threat Model
  8. Reinforcement Learning for Optimal Trigger-Injection Strategies
  9. Poisoned Data Generation in the Frequency Domain
  10. Experiment Settings
  11. Datasets
  12. Baselines
  13. Experimental Setup
  14. Experimental Results
  15. Effectiveness of Professor X
  16. ...and 35 more sections

Figures (16)

  • Figure 1: (a)-(c) The framework of Professor X: (a) The trigger selection and EEG data distribution from the view of manifold learning. (b) Learning optimal electrodes and frequencies injection strategies. (c) The generation process. (d) The payloads of the existing backdoor attacks. (e) The payloads of Professor X, which can arbitrarily manipulate the outputs of EEG BCI models.
  • Figure 2: t-SNE visualization.
  • Figure 3: Clean (/C) and attack (/B) performance with different poisoning or injection rates.
  • Figure 4: Anomaly Index of three models on three datasets.
  • Figure 5: Performance against STRIP on three datasets, the target model is EEGNet.
  • ...and 11 more figures