SW-ProxyCE attack exposes security flaw in public EEG foundation models

Researchers Linhua Cong, Dingkun Liu, and Dongrui Wu have unveiled SW-ProxyCE (Shrinkage-Whitened Proxy Cross-Entropy), a novel zero-query adversarial attack targeting EEG foundation model deployments. The attack exploits the standard practice of releasing pre-trained encoders publicly while keeping downstream classification models private. By white-box accessing the public encoder and a small task-matched labeled reference set, SW-ProxyCE reconstructs task-level decision geometry through shrinkage-whitened class prototypes — eliminating the need to train a surrogate classifier or query the victim model.

Evaluated across three EEG tasks using three general-purpose foundation encoders and one paradigm-specific pre-trained encoder, SW-ProxyCE successfully transferred adversarial perturbations to private downstream models in both linear-probing and full-fine-tuning scenarios, spanning cross-subject and within-subject conditions. The attack consistently beat task-agnostic representation-shift baselines, demonstrating that even robust transferable representations can be inverted into effective attacks. The authors emphasize that the strong transferability of EEG foundation models does not inherently provide adversarial robustness — a critical caveat as EEG-based brain-computer interfaces and clinical decoders increasingly rely on shared public encoders. Code is promised on GitHub, allowing the research community to reproduce and extend these findings.