发表机构
New York University Abu Dhabi (NYUAD)（纽约大学阿布扎比分校）
机构由 AI 辅助整理，请以论文原文为准。AI 中文总结
本研究通过对抗性评估发现，精度保持的压缩（如剪枝和量化）不改善脑电解码器的直接鲁棒性，但会降低对抗性迁移效率，表明鲁棒性、迁移性和部署效率是独立属性。
AI 中文摘要
面向部署的压缩对于资源受限的脑机接口（BCI）具有吸引力，但它是否会改变对抗性脆弱性仍不清楚。在BCI Competition IV-2a上，我们比较了32位浮点（FP32）EEGNet和ShallowConvNet模型，采用全局幅度剪枝和模拟INT8训练后量化（PTQ）及量化感知训练（QAT），涵盖九名受试者和三种随机种子。模拟提供了可微分的量化-反量化模型，用于白盒攻击和梯度分析，而原生TensorRT部署用于验证。精度保持的压缩并未改善直接鲁棒性：在ε=0.005时，EEGNet的PGD准确率在FP32、50%剪枝（P50）、PTQ和QAT下保持22–24%。然而，P50将双向迁移效率降低至0.963/0.928（FP32→P50/P50→FP32），而PTQ为0.994/0.997；ShallowConvNet也呈现相同趋势。梯度对齐显示出相应的分离，而原生PTQ在95–98%的情况下与模拟的干净/对抗性预测一致。这些结果表明，直接鲁棒性、对抗性迁移和部署效率是压缩脑电解码器的不同属性。
英文摘要
Deployment-oriented compression is attractive for resource-constrained brain--computer interfaces (BCIs), but whether it changes adversarial vulnerability remains unclear. On BCI Competition IV-2a, we compare 32-bit floating-point (FP32) EEGNet and ShallowConvNet models with global magnitude pruning and simulated INT8 post training quantization (PTQ) and quantization-aware training (QAT) across nine subjects and three seeds. Simulation provides differentiable quantize--dequantize models for white-box attacks and gradient analysis, while native TensorRT deployment is used for validation. Accuracy-preserving compression does not improve direct robustness: at $ε=0.005$, EEGNet PGD accuracy remains 22--24\% across FP32, 50\% pruning (P50), PTQ, and QAT. However, P50 reduces bidirectional transfer efficiency to 0.963/0.928 (FP32$\rightarrow$P50/P50$\rightarrow$FP32), versus 0.994/0.997 for PTQ; the same trend holds for ShallowConvNet. Gradient alignment shows a corresponding separation, while native PTQ agrees with simulated clean/adversarial predictions in 95--98\% of cases. These results show that direct robustness, adversarial transfer, and deployment efficiency are distinct properties of compressed EEG decoders.
CommentsSubmitted to IEEE ICASSP 2027, 5 pages
