New Attack Method Exploits Public EEG Encoders

The emergence of EEG foundation models, which learn reusable representations from large-scale neural recordings, has greatly advanced EEG decoding. However, the public release of these foundation encoders introduces a new security risk: private downstream models built upon them might become vulnerable to adversarial attacks. This research investigates such adversarial transfer attacks in a scenario where attackers have white-box access to a public encoder and a small labeled reference set, but no access to the victim's private model parameters or outputs. The paper proposes Shrinkage-Whitened Proxy Cross-Entropy (SW-ProxyCE), a query-free, task-aware attack framework. SW-ProxyCE reconstructs the task-level decision geometry from a limited labeled reference set using shrinkage-whitened class prototypes. This enables the generation of transferable adversarial examples without needing to train an additional surrogate classifier, making the attack highly efficient and stealthy. Evaluations across three EEG tasks, using various foundation encoders and both linear-probing and full-fine-tuning downstream models, demonstrated SW-ProxyCE's effectiveness. Adversarial examples generated from the public encoder successfully transferred to inaccessible downstream models. The findings highlight that the strong transferability of EEG foundation models does not inherently guarantee adversarial robustness, exposing a critical security flaw.