SW-ProxyCE: Zero-Query Adversarial Transfer from Public EEG Encoders to Private Downstream Models

SW-ProxyCE：从公共脑电图（EEG）编码器到私有下游模型的零查询对抗迁移

Abstract: Electroencephalography (EEG) foundation models have recently emerged as a promising paradigm for EEG decoding by learning reusable representations from large-scale heterogeneous neural recordings. However, the open release of EEG foundation encoders, while facilitating downstream developments, also introduces a previously unexplored security risk: publicly available representations may make private downstream models vulnerable.

摘要： 脑电图（EEG）基础模型最近已成为 EEG 解码的一种有前景的范式，通过从大规模异构神经记录中学习可重用的表征。然而，EEG 基础编码器的公开发布在促进下游发展的同时，也引入了一个此前未被探索的安全风险：公开可用的表征可能会使私有的下游模型变得脆弱。

This paper investigates adversarial transfer attacks in EEG foundation model deployment in a public-encoder and private-downstream setting, where attackers have white-box access to a released encoder and a small task-matched labeled reference set, but no access or query to victim parameters, outputs, or gradients.

本文研究了在“公共编码器-私有下游”设置下 EEG 基础模型部署中的对抗迁移攻击。在这种设置中，攻击者可以白盒访问已发布的编码器以及一小部分任务匹配的标记参考集，但无法访问或查询受害者的参数、输出或梯度。

We propose Shrinkage-Whitened Proxy Cross-Entropy (SW-ProxyCE), a query-free task-aware attack framework that recovers task-level decision geometry from a small labeled reference set through shrinkage-whitened class prototypes, enabling transferable adversarial generation without training an additional surrogate classifier.

我们提出了收缩白化代理交叉熵（SW-ProxyCE），这是一种无需查询的任务感知攻击框架。它通过收缩白化类原型从少量标记参考集中恢复任务级的决策几何结构，从而在无需训练额外代理分类器的情况下实现可迁移的对抗样本生成。

We evaluated SW-ProxyCE across three EEG tasks using three general-purpose foundation encoders and a paradigm-specific pre-trained encoder, covering both linear-probing and full-fine-tuning downstream models in cross-subject and within-subject scenarios. Results demonstrated that adversarial examples generated from the public encoder and limited labeled references can effectively transfer to inaccessible downstream models.

我们使用三个通用基础编码器和一个特定范式预训练编码器，在三个 EEG 任务上评估了 SW-ProxyCE，涵盖了跨受试者和受试者内部场景下的线性探测（linear-probing）和全微调（full-fine-tuning）下游模型。结果表明，从公共编码器和有限标记参考集生成的对抗样本可以有效地迁移到不可访问的下游模型中。

SW-ProxyCE consistently outperformed task-agnostic representation-shift attacks, revealing that the strong transferability of EEG foundation models does not necessarily lead to adversarial robustness. Our code will be available on GitHub.

SW-ProxyCE 的表现始终优于任务无关的表征偏移攻击，这揭示了 EEG 基础模型的强大可迁移性并不一定能带来对抗鲁棒性。我们的代码将在 GitHub 上开源。