Logo
ScienceStack
Table of Contents
Fetching ...
Sign In

SAFE: Secure and Accurate Federated Learning for Privacy-Preserving Brain-Computer Interfaces

Tianwang Jia, Xiaoqing Chen, Dongrui Wu

TL;DR

SAFE targets three intertwined challenges in EEG-based BCIs: cross-subject generalization, adversarial vulnerability, and privacy leakage. It fuses calibration-free federated learning with local batch-specific normalization (LBSN) and a dual-defense strategy consisting of federated adversarial training (FAT) and adversarial weight perturbation (AWP). Empirical results on five MI/ERP EEG datasets show SAFE consistently surpasses 14 baselines, including centralized methods lacking privacy protections, in both decoding accuracy and adversarial robustness while preserving subject privacy without target-subject calibration data. This work demonstrates that high decoding performance, strong security, and reliable privacy protection can coexist in real-world BCIs, enabling practical, calibration-free cross-subject deployment.

Abstract

Electroencephalogram (EEG)-based brain-computer interfaces (BCIs) are widely adopted due to their efficiency and portability; however, their decoding algorithms still face multiple challenges, including inadequate generalization, adversarial vulnerability, and privacy leakage. This paper proposes Secure and Accurate FEderated learning (SAFE), a federated learning-based approach that protects user privacy by keeping data local during model training. SAFE employs local batch-specific normalization to mitigate cross-subject feature distribution shifts and hence improves model generalization. It further enhances adversarial robustness by introducing perturbations in both the input space and the parameter space through federated adversarial training and adversarial weight perturbation. Experiments on five EEG datasets from motor imagery (MI) and event-related potential (ERP) BCI paradigms demonstrated that SAFE consistently outperformed 14 state-of-the-art approaches in both decoding accuracy and adversarial robustness, while ensuring privacy protection. Notably, it even outperformed centralized training approaches that do not consider privacy protection at all. To our knowledge, SAFE is the first algorithm to simultaneously achieve high decoding accuracy, strong adversarial robustness, and reliable privacy protection without using any calibration data from the target subject, making it highly desirable for real-world BCIs.

SAFE: Secure and Accurate Federated Learning for Privacy-Preserving Brain-Computer Interfaces

TL;DR

SAFE targets three intertwined challenges in EEG-based BCIs: cross-subject generalization, adversarial vulnerability, and privacy leakage. It fuses calibration-free federated learning with local batch-specific normalization (LBSN) and a dual-defense strategy consisting of federated adversarial training (FAT) and adversarial weight perturbation (AWP). Empirical results on five MI/ERP EEG datasets show SAFE consistently surpasses 14 baselines, including centralized methods lacking privacy protections, in both decoding accuracy and adversarial robustness while preserving subject privacy without target-subject calibration data. This work demonstrates that high decoding performance, strong security, and reliable privacy protection can coexist in real-world BCIs, enabling practical, calibration-free cross-subject deployment.

Abstract

Electroencephalogram (EEG)-based brain-computer interfaces (BCIs) are widely adopted due to their efficiency and portability; however, their decoding algorithms still face multiple challenges, including inadequate generalization, adversarial vulnerability, and privacy leakage. This paper proposes Secure and Accurate FEderated learning (SAFE), a federated learning-based approach that protects user privacy by keeping data local during model training. SAFE employs local batch-specific normalization to mitigate cross-subject feature distribution shifts and hence improves model generalization. It further enhances adversarial robustness by introducing perturbations in both the input space and the parameter space through federated adversarial training and adversarial weight perturbation. Experiments on five EEG datasets from motor imagery (MI) and event-related potential (ERP) BCI paradigms demonstrated that SAFE consistently outperformed 14 state-of-the-art approaches in both decoding accuracy and adversarial robustness, while ensuring privacy protection. Notably, it even outperformed centralized training approaches that do not consider privacy protection at all. To our knowledge, SAFE is the first algorithm to simultaneously achieve high decoding accuracy, strong adversarial robustness, and reliable privacy protection without using any calibration data from the target subject, making it highly desirable for real-world BCIs.
Paper Structure (23 sections, 8 equations, 8 figures, 7 tables, 1 algorithm)

This paper contains 23 sections, 8 equations, 8 figures, 7 tables, 1 algorithm.

Table of Contents

  1. Introduction
  2. Related Work
  3. Domain Generalization
  4. Adversarial Defense
  5. Privacy-preserving Machine Learning
  6. Secure and Accurate FEderated learning (SAFE)
  7. Problem Statement
  8. Overview
  9. LBSN
  10. FAT
  11. AWP
  12. Experiment Settings
  13. Datasets and Preprocessing
  14. Threat Models
  15. Baseline Algorithms
  16. ...and 8 more sections

Figures (8)

  • Figure 2: SAFE for BCIs. Training users are clients, and a trusted third-party institution (e.g., a hospital) is the server; only model parameters, instead of EEG data, are exchanged, protecting client user privacy.
  • Figure 3: Flowchart of the proposed SAFE. (a) Server-side operations; and, (b) client-side operations.
  • Figure 4: Average BCAs on the adversarial samples under three white-box attacks with different magnitudes $\epsilon \in \{0, 0.01, 0.03, 0.05\}$ on the three MI datasets. (a) MI1; (b) MI2; and, (c) MI3.
  • Figure 5: Average BCAs on the adversarial samples under two black-box attacks with different magnitudes $\epsilon \in \{0,0.01,0.05,0.1\}$ on the three MI datasets. (a) MI1; (b) MI2; and, (c) MI3.
  • Figure 6: Average BCAs on the adversarial samples under three white-box attacks with different magnitudes $\epsilon \in \{0, 0.01, 0.03, 0.05\}$ on the two ERP datasets. (a) ERP1; and, (b) ERP2.
  • ...and 3 more figures