Friend-guard adversarial noise designed for electroencephalogram-based brain–computer interface spellers

An electroencephalogram (EEG)–based brain–computer interface (BCI) speller is a system that conveys thought to enable communication between humans and computers using brain conduction. This system is useful for patients with severe disabilities and provides a way for them to communicate with computers or with other people. The EEG-based BCI speller system is being studied in various ways, but it is vulnerable to adversarial examples. An adversarial example is an attack sample created by adding a little noise to an original sample in such a way that it appears normal to humans but will be misclassified by the model. Adversarial examples can be useful in situations such as military scenarios in which there is a mixture of friendly models and enemy models. When a friendly BCI speller and an enemy BCI speller coexist, an adversarial example may be mistakenly taken by the enemy BCI speller to signal an incorrect intention on the part of the person with a disability; in another scenario, an enemy BCI speller may leak personal information of the individual with a disability or initiate unwanted financial transactions. In this paper, we propose a method to create such a sample, called a “friend-guard” EEG adversarial example. In the proposed method, a very small EEG signal is added to an original sample, creating an adversarial example that the friendly model will classify correctly but the enemy model will classify incorrectly. A P300 dataset was used in the experimental evaluation of the method, and linear regression models were used as target models. In the experiment, the proposed method was able to generate friend-guard EEG adversarial examples that were incorrectly classified with success rates of 88.4% and 69.7% by the enemy model for subject A and subject B, respectively, while maintaining the accuracy of the friendly model at 85.9% and 74.4% for subjects A and B, respectively.