SW-ProxyCE: Zero-Query Adversarial Transfer from Public EEG Encoders to Private Downstream Models
SW-ProxyCE is a zero-query adversarial transfer attack framework that exploits publicly available EEG foundation encoders to generate adversarial examples that transfer to private downstream models without any access to victim parameters, outputs, or gradients. The method uses shrinkage-whitened class prototypes derived from a small labeled reference set to recover task-level decision geometry, enabling transferable adversarial generation without training an additional surrogate classifier. Eval
Analysis
TL;DR
- SW-ProxyCE is a zero-query adversarial transfer attack framework that exploits publicly available EEG foundation encoders to generate adversarial examples that transfer to private downstream models without any access to victim parameters, outputs, or gradients.
- The method uses shrinkage-whitened class prototypes derived from a small labeled reference set to recover task-level decision geometry, enabling transferable adversarial generation without training an additional surrogate classifier.
- Evaluated across three EEG tasks using three general-purpose foundation encoders and one paradigm-specific pre-trained encoder, covering both linear-probing and full-fine-tuning downstream models in cross-subject and within-subject scenarios.
- Results show that adversarial examples generated from the public encoder and limited labeled references effectively transfer to inaccessible downstream models, consistently outperforming task-agnostic representation-shift attacks.
- The findings reveal that strong transferability of EEG foundation models does not necessarily imply adversarial robustness, exposing a previously unexplored security risk in open EEG foundation model deployment.
Why It Matters
This work highlights a critical security vulnerability in the growing ecosystem of open EEG foundation models: publicly released encoders can be weaponized to attack private downstream models without any query access, which has direct implications for clinical and consumer brain-computer interface systems. For AI practitioners deploying foundation models in sensitive domains, this underscores the need to treat model openness as a dual-edged sword that requires adversarial robustness considerations alongside performance gains.
Technical Details
- Attack Setting: The paper investigates a public-encoder/private-downstream threat model where attackers have white-box access to a released foundation encoder and a small task-matched labeled reference set, but zero access to the victim model's parameters, outputs, or gradients.
- SW-ProxyCE Method: The core innovation is Shrinkage-Whitened Proxy Cross-Entropy, which constructs shrinkage-whitened class prototypes from the reference set to approximate task-level decision boundaries. This allows adversarial perturbation generation directly in the representation space of the public encoder without training a surrogate classifier.
- Evaluation Setup: Three EEG tasks were tested using three general-purpose foundation encoders and one paradigm-specific pre-trained encoder. Both linear-probing and full-fine-tuning downstream models were evaluated under cross-subject and within-subject transfer scenarios.
- Baseline Comparison: SW-ProxyCE was compared against task-agnostic representation-shift attacks, demonstrating consistent superiority and confirming that task-aware geometry recovery is essential for effective adversarial transfer in EEG domains.
- Key Finding: The strong cross-task and cross-subject transferability that makes EEG foundation models useful also makes them inherently vulnerable to query-free adversarial attacks, establishing a fundamental tension between utility and robustness.
Industry Insight
- Organizations releasing EEG foundation model encoders should proactively assess and mitigate adversarial transfer risks, potentially through encoder-level robustness training or output sanitization, before open distribution.
- Deployers of private downstream EEG models—especially in clinical or safety-critical BCI applications—should treat publicly available encoders as a threat surface and implement adversarial defense mechanisms such as input preprocessing, detection filters, or certified robustness techniques.
- The broader implication extends beyond EEG: any domain adopting the open-foundation-model paradigm (e.g., medical imaging, speech, text) should anticipate similar zero-query transfer vulnerabilities and incorporate security evaluations into model release pipelines.
Disclaimer: The above content is generated by AI and is for reference only.