ORBITAL: Optimization of Robust Brain--Computer Inference Through Architecture-Aware Low-Precision Compression

Saim Rehman; Muhammad Shafique

cs.CVOct 26, 2026

ORBITAL: Optimization of Robust Brain--Computer Inference Through Architecture-Aware Low-Precision Compression

Authors: Saim Rehman, Muhammad Shafique

Organizations: eBRAIN Lab, New York University Abu Dhabi, Abu Dhabi, UAE

Abstract

Compact electroencephalography (EEG) decoders enable embedded brain--computer interfaces (BCIs), but compression can alter adversarial robustness without proportional hardware savings. We present ORBITAL, a robustness-constrained framework combining hardware-realizable structured compression, recovery-aware operating-point selection, multi-attack evaluation, and native edge validation. Across nine subjects and three seeds on BCI Competition IV-2a, S25-TRADES achieves the highest observed mean true-union robustness among compressed EEGNet models (23.06% vs 21.27% for standard Full), with 26.27% fewer parameters and 25.10% fewer MACs. Matched controls identify TRADES as the main source of robustness recovery, improving S25 union accuracy by 6.74 percentage points over clean recovery (p=0.0039), while per-example analysis reveals boundary redistribution rather than uniform margin expansion. On Jetson Orin Nano, FP16 compression reduces board energy by up to 16.20% and latency by 8.00%. Despite 99.3% prediction agreement, native INT8 Q/DQ incurs about twice the FP16 latency and energy, demonstrating the need for joint robustness and hardware-aware optimization.

Figures & tables

Fig. 1: Motivation for robustness-constrained EEG compression. ORBITAL’s accuracy–robustness–hardware trade-off under structured EEG compression. S10 satisfies predefined screening constraints, S25 achieves the highest observed mean true-union robustness among compressed candidates, and S50 offers greater structural and measured hardware savings.

Fig. 2: Overview of the ORBITAL methodology. EEGNet serves as the primary deployment architecture, while ShallowConvNet evaluates cross-architecture generalization.

Variant	$F_{1}/F_{2}$	Param. $\downarrow$	MAC $\downarrow$	Clean	PGD100	APGD-CE	APGD-DLR	FAB	Union
Full	8/16	–	–	57.39	22.78	22.67	21.66	21.48	21.27
S10-TRADES	7/14	13.24	12.56	55.32	23.98	23.87	22.39	22.45	22.22
S25-TRADES	6/12	26.27	25.10	53.95	24.92	24.76	23.33	23.15	23.06
S40-TRADES	5/10	39.08	37.63	52.34	22.87	22.65	20.99	20.81	20.69
S50-TRADES	4/8	51.68	50.14	49.83	22.58	22.29	20.19	19.87	19.70
S60-TRADES	3/6	64.05	62.63	44.68	20.91	20.67	18.76	18.47	18.38

TABLE I: Strong-attack confirmation across selected EEGNet operating points on BCI IV-2a. Results average three seeds within each of nine subjects. All accuracy values are percentages. Union requires clean correctness and survival under all four attacks.

Fig. 3: TRADES union-accuracy gain over clean recovery across EEGNet compression levels. Markers denote subject means; intervals show 95% subject-bootstrap confidence intervals.

Fig. 4: Worst-case post-attack margin differences between S25-TRADES and standard Full, grouped by per-example union-robustness outcome. Intervals denote 95% confidence intervals.

Comparison	$\Delta$ union	$p$
Full-TRADES vs. Full	$+3.42$	$0.0234$
S25-TRADES vs. Full	$+1.79$	$0.5703$
S25-TRADES vs. Full-TRADES	$-1.63$	$0.0977$
S25-TRADES vs. S25-raw	$+7.45$	$0.0039$
S25-TRADES vs. S25-clean	$+6.74$	$0.0039$
TRADES gain: S25 vs. Full width	$+3.27$	$0.0078$

TABLE II: Paired subject-level causal and recovery comparisons. Union-accuracy differences are in percentage points;

p

values are from two-sided Wilcoxon tests after averaging seeds within each of nine subjects.

Variant	Latency (ms)	Active power (W)	Energy (mJ)
Full	$0.1712\!\pm\!0.0029$	$14.203\!\pm\!0.098$	$2.4314\!\pm\!0.0244$
S25	$0.1688\!\pm\!0.0002$	$13.630\!\pm\!0.017$	$2.3013\!\pm\!0.0015$
S50	$0.1575\!\pm\!0.0044$	$12.940\!\pm\!0.210$	$2.0374\!\pm\!0.0237$

TABLE III: Jetson Orin Nano TensorRT FP16 measurements (mean

\pm

SD over five runs).

Fig. 5: Native Jetson precision comparison. Learned-scale INT8 Q/DQ preserves approximately 99.3% prediction agreement with the QAT models, yet increases latency and board energy by roughly twofold relative to FP16 for S25 and S50.

Adversarial Robustness

Adversarial robustness studies how well AI systems withstand deliberately crafted inputs, training-data corruption, and other attacks.

See all 481 papers

AERIAL: Adversarial Evaluation of Robustness in Accuracy-Preserving Low-Precision EEG Decoders
Sep 24, 2026Saim Rehman, Muhammad ShafiqueQuantization-Aware Training EEG Decoding
eBRAIN Lab, Division of Engineering, New York University Abu Dhabi (NYUAD), Abu Dhabi, UAE
SwitchBraidNet: Quantisation-Aware Lightweight Architecture for Hybrid Brain-Computer Interface
Jun 17, 2026Gourav Siddhad, Yogesh Kumar MeenaEfficient Neural Network Inference Brain-Computer Interfaces
Human-AI Interaction (HAIx) Lab, Indian Institute of Technology Gandhinagar, Gujarat, 382055, India
Same Brain, Different Prediction: How Preprocessing Choices Undermine EEG Decoding Reliability
May 8, 2026Dengzhe Hou, Zihao Wu, Lingyu Jiang +3Uncertainty Quantification EEG Decoding
Tohoku University · University of Georgia · Texas A&M University +1

Sep 24, 2026J/K move · Enter open · S save

AERIAL: Adversarial Evaluation of Robustness in Accuracy-Preserving Low-Precision EEG Decoders

Saim Rehman, Muhammad Shafique

eBRAIN Lab, Division of Engineering, New York University Abu Dhabi (NYUAD), Abu Dhabi, UAE

Quantization-Aware Training EEG Decoding Adversarial Robustness Post-Training Quantization Adversarial Transferability Neural Network Pruning

Open paper AskPDF arXiv

Deployment-oriented compression is attractive for resource-constrained brain--computer interfaces (BCIs), but whether it changes adversarial vulnerability remains unclear. On BCI Competition IV-2a, we compare 32-bit floating-point (FP32) EEGNet and ShallowConvNet models with global magnitude pruning and simulated INT8 post training quantization (PTQ) and quantization-aware training (QAT) across nine subjects and three seeds. Simulation provides differentiable quantize--dequantize models for white-box attacks and gradient analysis, while native TensorRT deployment is used for validation. Accuracy-preserving compression does not improve direct robustness: at

ε=0.005

, EEGNet PGD accuracy remains 22--24% across FP32, 50% pruning (P50), PTQ, and QAT. However, P50 reduces bidirectional transfer efficiency to 0.963/0.928 (FP32

\rightarrow

P50/P50

\rightarrow

FP32), versus 0.994/0.997 for PTQ; the same trend holds for ShallowConvNet. Gradient alignment shows a corresponding separation, while native PTQ agrees with simulated clean/adversarial predictions in 95--98% of cases. These results show that direct robustness, adversarial transfer, and deployment efficiency are distinct properties of compressed EEG decoders.

Abstract

Adversarial Robustness

Explore similar work

AERIAL: Adversarial Evaluation of Robustness in Accuracy-Preserving Low-Precision EEG Decoders

SwitchBraidNet: Quantisation-Aware Lightweight Architecture for Hybrid Brain-Computer Interface

Same Brain, Different Prediction: How Preprocessing Choices Undermine EEG Decoding Reliability