Compact electroencephalography (EEG) decoders enable embedded brain--computer interfaces (BCIs), but compression can alter adversarial robustness without proportional hardware savings. We present ORBITAL, a robustness-constrained framework combining hardware-realizable structured compression, recovery-aware operating-point selection, multi-attack evaluation, and native edge validation. Across nine subjects and three seeds on BCI Competition IV-2a, S25-TRADES achieves the highest observed mean true-union robustness among compressed EEGNet models (23.06% vs 21.27% for standard Full), with 26.27% fewer parameters and 25.10% fewer MACs. Matched controls identify TRADES as the main source of robustness recovery, improving S25 union accuracy by 6.74 percentage points over clean recovery (p=0.0039), while per-example analysis reveals boundary redistribution rather than uniform margin expansion. On Jetson Orin Nano, FP16 compression reduces board energy by up to 16.20% and latency by 8.00%. Despite 99.3% prediction agreement, native INT8 Q/DQ incurs about twice the FP16 latency and energy, demonstrating the need for joint robustness and hardware-aware optimization.
Figures & tables
Fig. 1: Motivation for robustness-constrained EEG compression. ORBITAL’s accuracy–robustness–hardware trade-off under structured EEG compression. S10 satisfies predefined screening constraints, S25 achieves the highest observed mean true-union robustness among compressed candidates, and S50 offers greater structural and measured hardware savings.
Fig. 2: Overview of the ORBITAL methodology. EEGNet serves as the primary deployment architecture, while ShallowConvNet evaluates cross-architecture generalization.
Variant
F1/F2
Param. ↓
MAC ↓
Clean
PGD100
APGD-CE
APGD-DLR
FAB
Union
Full
8/16
–
–
57.39
22.78
22.67
21.66
21.48
21.27
S10-TRADES
7/14
13.24
12.56
55.32
23.98
23.87
22.39
22.45
22.22
S25-TRADES
6/12
26.27
25.10
53.95
24.92
24.76
23.33
23.15
23.06
S40-TRADES
5/10
39.08
37.63
52.34
22.87
22.65
20.99
20.81
20.69
S50-TRADES
4/8
51.68
50.14
49.83
22.58
22.29
20.19
19.87
19.70
S60-TRADES
3/6
64.05
62.63
44.68
20.91
20.67
18.76
18.47
18.38
TABLE I: Strong-attack confirmation across selected EEGNet operating points on BCI IV-2a. Results average three seeds within each of nine subjects. All accuracy values are percentages. Union requires clean correctness and survival under all four attacks.
Fig. 3: TRADES union-accuracy gain over clean recovery across EEGNet compression levels. Markers denote subject means; intervals show 95% subject-bootstrap confidence intervals.
Fig. 4: Worst-case post-attack margin differences between S25-TRADES and standard Full, grouped by per-example union-robustness outcome. Intervals denote 95% confidence intervals.
Comparison
Δ union
p
Full-TRADES vs. Full
+3.42
0.0234
S25-TRADES vs. Full
+1.79
0.5703
S25-TRADES vs. Full-TRADES
−1.63
0.0977
S25-TRADES vs. S25-raw
+7.45
0.0039
S25-TRADES vs. S25-clean
+6.74
0.0039
TRADES gain: S25 vs. Full width
+3.27
0.0078
TABLE II: Paired subject-level causal and recovery comparisons. Union-accuracy differences are in percentage points; p values are from two-sided Wilcoxon tests after averaging seeds within each of nine subjects.
Variant
Latency (ms)
Active power (W)
Energy (mJ)
Full
0.1712±0.0029
14.203±0.098
2.4314±0.0244
S25
0.1688±0.0002
13.630±0.017
2.3013±0.0015
S50
0.1575±0.0044
12.940±0.210
2.0374±0.0237
TABLE III: Jetson Orin Nano TensorRT FP16 measurements (mean ± SD over five runs).
Fig. 5: Native Jetson precision comparison. Learned-scale INT8 Q/DQ preserves approximately 99.3% prediction agreement with the QAT models, yet increases latency and board energy by roughly twofold relative to FP16 for S25 and S50.
Deployment-oriented compression is attractive for resource-constrained brain--computer interfaces (BCIs), but whether it changes adversarial vulnerability remains unclear. On BCI Competition IV-2a, we compare 32-bit floating-point (FP32) EEGNet and ShallowConvNet models with global magnitude pruning and simulated INT8 post training quantization (PTQ) and quantization-aware training (QAT) across nine subjects and three seeds. Simulation provides differentiable quantize--dequantize models for white-box attacks and gradient analysis, while native TensorRT deployment is used for validation. Accuracy-preserving compression does not improve direct robustness: at ε=0.005, EEGNet PGD accuracy remains 22--24% across FP32, 50% pruning (P50), PTQ, and QAT. However, P50 reduces bidirectional transfer efficiency to 0.963/0.928 (FP32→P50/P50→FP32), versus 0.994/0.997 for PTQ; the same trend holds for ShallowConvNet. Gradient alignment shows a corresponding separation, while native PTQ agrees with simulated clean/adversarial predictions in 95--98% of cases. These results show that direct robustness, adversarial transfer, and deployment efficiency are distinct properties of compressed EEG decoders.
Saim Rehman, Muhammad Shafique
eBRAIN Lab, Division of Engineering, New York University Abu Dhabi (NYUAD), Abu Dhabi, UAE
Hybrid brain-computer interfaces (BCIs) that integrate motor imagery (MI) and steady-state visual evoked potentials (SSVEP) provide high-dimensional neural decoding but typically exceed the computational limits of embedded hardware. To address this, we propose SwitchBraidNet, a compact EEG classification architecture designed for low-power deployment. The model employs a dual-path temporal braid to extract multiscale oscillatory features, an adaptive squeeze-and-excitation spatial switch for electrode gating, and a log-variance readout layer for direct band-power encoding. Furthermore, through systematic quantisation-aware training on the OpenBMI dataset, we compared SwitchBraidNet against four established baselines across FP32, FP16, and INT8 precisions. Experimental results demonstrate superior efficiency and performance, achieving MI accuracy of 69.49% (FP16), SSVEP accuracy of 93.48% (FP32), and a hybrid information transfer rate of 64.82 bits/min (FP16). With an INT8 footprint of only 3.03 KB, SwitchBraidNet maintains high accuracy across varying numerical precisions, demonstrating its suitability for low-power embedded BCI deployment.
Gourav Siddhad, Yogesh Kumar Meena
Human-AI Interaction (HAIx) Lab, Indian Institute of Technology Gandhinagar, Gujarat, 382055, India
Electroencephalography (EEG) is a cornerstone of brain-computer interfaces and clinical neuroscience, yet deep learning models are typically trained and evaluated under a single, unreported preprocessing pipeline. We formalize preprocessing choices as a counterfactual intervention space and show that EEG predictions are surprisingly unstable under this space: across six datasets spanning four paradigms, up to 42% of trial-level predictions flip when only the preprocessing changes, a variability that standard uncertainty methods do not explicitly quantify because they condition on a fixed preprocessing pipeline. We provide three tools to make this instability measurable, decomposable, and reducible. First, a Walsh-Hadamard decomposition of the 2^7 pipeline space reveals that sensitivity is near-additive in practice under the binary intervention design, enabling efficient step-by-step optimization. Second, we introduce Preprocessing Uncertainty (PU), a per-trial diagnostic that captures a dimension of instability complementary to model-based confidence. Third, we study Normalized Adaptive PGI (NA-PGI), a graph-structured regularizer that exploits the compositional structure of preprocessing interventions as one mitigation strategy with clear scope conditions.
Dengzhe Hou, Zihao Wu, Lingyu Jiang +3
Tohoku University · University of Georgia · Texas A&M University +1