Tiny Noise Can Make an EEG-Based Brain-Computer Interface Speller Output Anything

An electroencephalogram (EEG) based braincomputer interface (BCI) speller allows a user to input text to a computer by thought. It is particularly useful to severely disabled individuals, e.g., amyotrophic lateral sclerosis patients, who have no other effective means of communication with another person or a computer. Most studies so far focused on making EEGbased BCI spellers faster and more reliable; however, few have considered their security. Here we show that P300 and steadystate visual evoked potential BCI spellers are very vulnerable, i.e., they can be severely attacked by adversarial perturbations, which are too tiny to be noticed when added to EEG signals, but can mislead the spellers to spell anything the attacker wants. The consequence could range from merely user frustration to severe misdiagnosis in clinical applications. We hope our research can attract more attention to the security of EEG-based BCI spellers, and more broadly, EEG-based BCIs, which has received little attention before.

[1]  H. Akaike.  Canonical Correlation Analysis of Time Series and the Use of an Information Criterion , 1976 .

[2]  Christian Jutten,et al.  Multiclass Brain–Computer Interface Classification by Riemannian Geometry , 2012, IEEE Transactions on Biomedical Engineering.

[3]  J. Polich.  Updating P300: An integrative theory of P3a and P3b , 2007, Clinical Neurophysiology.

[4]  S. Coyle,et al.  Brain–computer interfaces: a review , 2003 .

[5]  E. Donchin,et al.  Talking off the top of your head: toward a mental prosthesis utilizing event-related brain potentials. , 1988, Electroencephalography and clinical neurophysiology.

[6]  Dongrui Wu,et al.  On the Vulnerability of CNN Classifiers in EEG-Based BCIs , 2019, IEEE Transactions on Neural Systems and Rehabilitation Engineering.

[7]  Brendan Z. Allison,et al.  Brain-Computer Interfaces: A Gentle Introduction , 2009 .

[8]  E R John,et al.  Information Delivery and the Sensory Evoked Potential , 1967, Science.

[9]  Yijun Wang,et al.  Brain-Computer Interfaces Based on Visual Evoked Potentials , 2008, IEEE Engineering in Medicine and Biology Magazine.

[10]  Lei Wu,et al.  Understanding and Enhancing the Transferability of Adversarial Examples , 2018, ArXiv.

[11]  Christian Jutten,et al.  Classification of covariance matrices using a Riemannian-based kernel for BCI applications , 2013, Neurocomputing.

[12]  Guillaume Gibert,et al.  xDAWN Algorithm to Enhance Evoked Potentials: Application to Brain–Computer Interface , 2009, IEEE Transactions on Biomedical Engineering.

[13]  Samy Bengio,et al.  Adversarial examples in the physical world , 2016, ICLR.

[14]  Percy Liang,et al.  Adversarial Examples for Evaluating Reading Comprehension Systems , 2017, EMNLP.

[15]  Tzyy-Ping Jung,et al.  High-speed spelling with a noninvasive brain–computer interface , 2015, Proceedings of the National Academy of Sciences.

[16]  Jonathon Shlens,et al.  Explaining and Harnessing Adversarial Examples , 2014, ICLR.

[17]  Dan Boneh,et al.  The Space of Transferable Adversarial Examples , 2017, ArXiv.

[18]  Logan Engstrom,et al.  Synthesizing Robust Adversarial Examples , 2017, ICML.

[19]  Yuan Yu,et al.  TensorFlow: A system for large-scale machine learning , 2016, OSDI.

[20]  Joan Bruna,et al.  Intriguing properties of neural networks , 2013, ICLR.

[21]  Dawn Xiaodong Song,et al.  Delving into Transferable Adversarial Examples and Black-box Attacks , 2016, ICLR.

[22]  M. Hestenes.  Multiplier and gradient methods , 1969 .

[23]  Xiaogang Chen,et al.  A Benchmark Dataset for SSVEP-Based Brain–Computer Interfaces , 2017, IEEE Transactions on Neural Systems and Rehabilitation Engineering.

[24]  Patrick D. McDaniel,et al.  Adversarial Perturbations Against Deep Neural Networks for Malware Classification , 2016, ArXiv.

[25]  Shang-Lin Wu,et al.  EEG-Based Brain-Computer Interfaces: A Novel Neurotechnology and Computational Intelligence Method , 2017, IEEE Systems, Man, and Cybernetics Magazine.

[26]  Fusheng Yang,et al.  BCI competition 2003-data set IIb: enhancing P300 wave detection using ICA-based subspace projections for BCI applications , 2004, IEEE Transactions on Biomedical Engineering.

[27]  Martín Abadi,et al.  Adversarial Patch , 2017, ArXiv.

[28]  R Chavarriaga,et al.  Learning From EEG Error-Related Potentials in Noninvasive Brain-Computer Interfaces , 2010, IEEE Transactions on Neural Systems and Rehabilitation Engineering.

[29]  Dongrui Wu,et al.  Transfer Learning for Brain–Computer Interfaces: A Euclidean Space Data Alignment Approach , 2018, IEEE Transactions on Biomedical Engineering.

[30]  Francesco Piccione,et al.  User adaptive BCIs: SSVEP and P300 based interfaces , 2003, PsychNology J..

[31]  Xiaogang Chen,et al.  Filter bank canonical correlation analysis for implementing a high-speed SSVEP-based brain–computer interface , 2015, Journal of neural engineering.

[32]  Cuntai Guan,et al.  High performance P300 speller for brain-computer interface , 2004, IEEE International Workshop on Biomedical Circuits and Systems, 2004..

[33]  David A. Wagner,et al.  Audio Adversarial Examples: Targeted Attacks on Speech-to-Text , 2018, 2018 IEEE Security and Privacy Workshops (SPW).

[34]  Seyed-Mohsen Moosavi-Dezfooli,et al.  Universal Adversarial Perturbations , 2016, 2017 IEEE Conference on Computer Vision and Pattern Recognition (CVPR).

[35]  Helge J. Ritter,et al.  Improving Transfer Rates in Brain Computer Interfacing: A Case Study , 2002, NIPS.

[36]  E. John,et al.  Evoked-Potential Correlates of Stimulus Uncertainty , 1965, Science.

[37]  G Pfurtscheller,et al.  EEG-based communication: improved accuracy by response verification. , 1998, IEEE transactions on rehabilitation engineering : a publication of the IEEE Engineering in Medicine and Biology Society.

[38]  Wei Wu,et al.  Frequency recognition based on canonical correlation analysis for SSVEP-based BCIs , 2007, IEEE Transactions on Biomedical Engineering.

[39]  J. Polich.  Updating P 300 : An Integrative Theory of P 3 a and P 3 b , 2009 .

[40]  ROBERT M. CHAPMAN,et al.  Evoked Responses to Numerical and Non-Numerical Visual Stimuli while Problem Solving , 1964, Nature.

[41]  Patrick D. McDaniel,et al.  Transferability in Machine Learning: from Phenomena to Black-Box Attacks using Adversarial Samples , 2016, ArXiv.

[42]  E Donchin,et al.  The mental prosthesis: assessing the speed of a P300-based brain-computer interface. , 2000, IEEE transactions on rehabilitation engineering : a publication of the IEEE Engineering in Medicine and Biology Society.

[43]  A. Cichocki,et al.  Steady-state visually evoked potentials: Focus on essential paradigms and future perspectives , 2010, Progress in Neurobiology.