ORBITAL: Optimization of Robust Brain--Computer Inference Through Architecture-Aware Low-Precision Compression

ORBITAL: Optimization of Robust Brain–Computer Inference Through Architecture-Aware Low-Precision Compression Saim Rehman and Muhammad Shafique

arXiv:2610.36411v1 [cs.CV] 26 Oct 2026

eBRAIN Lab, New York University Abu Dhabi, Abu Dhabi, UAE sr7849@nyu.edu, muhammad.shafique@nyu.edu Abstract—Compact electroencephalography (EEG) decoders enable embedded brain–computer interfaces (BCIs), but compression can alter adversarial robustness without proportional hardware savings. We present ORBITAL, a robustness-constrained framework combining hardware-realizable structured compression, recovery-aware operating-point selection, multi-attack evaluation, and native edge validation. Across nine subjects and three seeds on BCI Competition IV-2a, S25-TRADES achieves the highest observed mean true-union robustness among compressed EEGNet models (23.06% vs 21.27% for standard Full), with 26.27% fewer parameters and 25.10% fewer MACs. Matched controls identify TRADES as the main source of robustness recovery, improving S25 union accuracy by 6.74 percentage points over clean recovery (p=0.0039), while per-example analysis reveals boundary redistribution rather than uniform margin expansion. On Jetson Orin Nano, FP16 compression reduces board energy by up to 16.20% and latency by 8.00%. Despite 99.3% prediction agreement, native INT8 Q/DQ incurs about twice the FP16 latency and energy, demonstrating the need for joint robustness and hardware-aware optimization. Index Terms—EEG, Brain–Computer Interface, Adversarial Robustness, Structured Pruning, Quantization-Aware Training, Edge AI, TensorRT.

I. I NTRODUCTION EEG-based BCIs increasingly rely on compact convolutional neural networks such as EEGNet [1] and ShallowConvNet [2]. Their embedded use creates three coupled objectives: (i) preserve task accuracy, (ii) resist small adversarial perturbations, and (iii) reduce real latency/energy. Conventional compression work largely optimizes storage or arithmetic cost [3]–[6], whereas adversarial training and evaluation are usually studied independently [7]–[9]. In EEG, this separation is particularly problematic because compact decoders operate on low-amplitude, non-image signals for which perturbation geometry and hardware overheads differ from standard vision workloads. Fig. 1 illustrates how structured compression changes clean accuracy, adversarial robustness, and model complexity nonmonotonically. Mathematical compression does not automatically guarantee actual hardware efficiency; thus, relying on a fixed compression ratio is insufficient for dependable edge deployment. Recent BCI studies established that EEG decoders are vulnerable to adversarial manipulation [10] and benchmarked multiple defenses [11]. More recent alignment-based defense benchmarks demonstrate the benefits of combining

Fig. 1. Motivation for robustness-constrained EEG compression. ORBITAL’s accuracy–robustness–hardware trade-off under structured EEG compression. S10 satisfies predefined screening constraints, S25 achieves the highest observed mean true-union robustness among compressed candidates, and S50 offers greater structural and measured hardware savings.

preprocessing and adversarial training for EEG decoding [12], but leave compression-aware operating-point selection and native hardware costs unexplored. Prior work, including AERIAL [13], has demonstrated that accuracy-preserving compression does not necessarily preserve adversarial robustness, and that robustness and hardware efficiency may evolve independently. Nonetheless, characterization alone does not establish how to select a physically realizable compressed decoder that satisfies specified accuracy and robustness requirements. Furthermore, the interaction between compression severity and robust recovery remains insufficiently understood, complicating the choice of an efficient deployment configuration. ORBITAL addresses these limitations through robustness-constrained architecture search, recovery-aware evaluation, and native hardware validation. Our main contributions are: • Robustness-constrained structured compression. We introduce a hardware-realizable EEG decoder compression workflow that enumerates physically valid channel widths, screens clean and adversarial performance, and selects constraint-feasible and Pareto operating points rather than prescribing a fixed compression ratio. • Compression–recovery interaction. Through matched full-width TRADES controls and compression-level recovery ablations, we show that robust training is the principal source of adversarial recovery, while its benefit depends significantly on compression severity. At S25, TRADES improves true-union robustness by 6.74 percentage points

Fig. 2. Overview of the ORBITAL methodology. EEGNet serves as the primary deployment architecture, while ShallowConvNet evaluates cross-architecture generalization.

Algorithm 1 ORBITAL: Robustness-Constrained Operatingover clean-only recovery across all nine subjects. Adversarial boundary characterization. Using per- Point Selection Decoder f , widths W, tolerances δc , δr example robustness transitions, post-attack margins, gra- Require: Ensure: Selected deployable operating points dient geometry, and random-channel controls, we show 1: Enumerate physically valid widths W 2: for w ∈ W do that compression redistributes adversarial robustness rather raw 3: Rebuild dense decoder fw than uniformly increasing classification margins. The S25 clean and f TRADES 4: Recover fw w operating point achieves the highest observed mean union 5: Screen clean and PGD20 accuracy 6: end for robustness among the compressed EEGNet candidates. 7: Average seeds within each subject • Native edge-hardware validation. We quantify actual la8: Enforce clean/robust feasibility constraints tency, board power, and energy on Jetson Orin Nano using 9: Construct the accuracy–robustness–size Pareto set repeated FP16 inference measurements. We additionally 10: Select feasible and representative candidates Confirm with PGD100×10, APGD-CE, APGD-DLR, and FAB show that learned-scale INT8 Q/DQ can preserve model 11: 12: Compute clean-correct true-union accuracy predictions while increasing deployment cost because of 13: Profile selected models on edge hardware 14: return Constraint-selected, highest-mean-robustness, and efficiencyconversion and kernel overhead.

•

oriented points

II. M ETHODOLOGY ORBITAL integrates physical structured compression, postpruning recovery, robust evaluation, and deployment profiling into a unified pipeline. Algorithm 1 summarizes the complete procedure. The following subsections detail each stage. A. Physical Structured Compression ORBITAL performs structured channel pruning to obtain smaller, dense EEG decoders rather than sparsely masked networks. For EEGNet, coupled temporal and pointwise filter dimensions (F1 , F2 ) are reduced while preserving the depthwise structure and downstream compatibility. Retained parameters are transferred into the rebuilt architecture. As for ShallowConvNet, filter importance accounts for filter magnitude and downstream connectivity, with corresponding convolutional, normalization, and classifier dimensions rebuilt consistently. Unlike unstructured sparsity, the resulting models directly reduce parameter storage and arithmetic requirements [4], [5]. B. Robustness-Aware Recovery and Quantization Following physical compression, ORBITAL evaluates raw, clean-recovered, and adversarially recovered decoders. Robust recovery follows TRADES [8]: LTRADES = CE(f (x), y) + βDKL (p(x) ∥ p(x′ )) ,

(1)

where x′ is an adversarially perturbed EEG input. An optional parameter-anchor penalty regularizes deviations from the pruned initialization. For low-precision deployment, EEGNet additionally supports QAT with fake-quantized activations and per-output-channel weights. Explicit Q/DQ export enables evaluation of native TensorRT execution, separating quantization fidelity from realized hardware efficiency. C. Robustness-Constrained Operating-Point Selection Rather than selecting compression severity heuristically, ORBITAL identifies deployable operating points under explicit clean-accuracy and robustness constraints. For candidate width w, let Ac (w) denote clean accuracy and Ar (w) denote cleancorrect PGD screening robustness. Relative to the full model w0 , feasibility requires Ac (w) ≥ Ac (w0 ) − δc , Ar (w) ≥ Ar (w0 ) − δr .

(2)

The strict operating point maximizes realized parameter reduction Rp (w): w∗ = arg max Rp (w).

(3)

w∈Wfeas

Nondominated candidates are additionally retained over clean accuracy, screening robustness, and parameter reduction. The

final robustness is quantified by the intersection of clean correctness and all confirmation attacks: " # N ^ 1 X Aunion = 1 f (xi ) = yi ∧ f (xai ) = yi . (4) N i=1 a∈A

This prevents initially misclassified trials from being counted as adversarially robust. III. E XPERIMENTAL S ETUP Dataset and models: Experiments use BCI Competition IV2a [14], containing nine subjects, 22 EEG channels, and four motor-imagery classes. Signals are sampled at 250 Hz and bandpass filtered to 4–38 Hz. Each subject provides 230/58/288 Fig. 3. TRADES union-accuracy gain over clean recovery across EEGNet compression levels. Markers denote subject means; intervals show 95% subjecttraining/validation/test trials with 4.5-s input windows. EEGNet bootstrap confidence intervals. is the primary compression and deployment architecture; ShallowConvNet evaluates cross-architecture generalization. Compression and recovery: We evaluate EEGNet widthreduction targets {0, 10, 20, 25, 30, 40, 50, 60}% with valid coupled (F1 , F2 ) dimensions. Requested width reductions are distinguished from realized parameter and MAC reductions. Raw pruning, clean recovery, and TRADES recovery are evaluated. TRADES uses β = 2, ϵ = 0.005, ten inner steps, step size 0.00125, and an anchor coefficient of 1. Recovery uses a learning rate of 5×10−5 , up to 30 epochs, and validationbased early stopping. Selection and robustness evaluation: The screening stage uses PGD20 with one random restart and predefined clean Fig. 4. Worst-case post-attack margin differences between S25-TRADES and Full, grouped by per-example union-robustness outcome. Intervals and robustness tolerances of δc = 0.03 and δr = 0.02. standard denote 95% confidence intervals. Selected candidates are confirmed using PGD100×10, APGDCE, APGD-DLR, and FAB under a common ℓ∞ threat radius achieves the highest observed mean union robustness among ϵ = 0.005. Robustness is reported using the clean-correct true the evaluated compressed candidates (23.06%) with 26.27% fewer parameters and 25.10% fewer MACs. Its numerical union. Reproducibility and statistics: EEGNet compression-search advantage over the standard full-width decoder (21.27%) is and ShallowConvNet experiments cover nine subjects and not statistically significant (+1.79 pp, p = 0.5703). Higher three seeds {1, 48, 550}. Seed results are averaged within each compression reduces both clean and union accuracy, exposing subject before paired subject-level Wilcoxon tests and bootstrap distinct robustness-oriented and efficiency-oriented operating 95% confidence intervals. Selected aggressive EEGNet QAT points. experiments remain single-seed. B. Compression–Recovery Interaction Hardware evaluation: Native deployment uses TensorRT Matched full-width controls show that Full-TRADES inon NVIDIA Jetson Orin Nano Super [15], [16] under fixed creases union robustness over standard Full by 3.42 pp MAXN SUPER clocks. FP16 configurations are measured (p = 0.0234), whereas S25-TRADES is numerically 1.63 pp in five independent 60-s runs. We report inference latency, below Full-TRADES (p = 0.0977). Thus, compression alone throughput, active whole-board power (VDD IN), and board does not explain the gain. Fig. 3 shows that the TRADES benefit energy per inference. Learned-scale Q/DQ exports are sepaover clean recovery peaks at S25 (+6.74 pp). This recovery gain rately evaluated to distinguish numerical fidelity from native exceeds that at full width by 3.27 pp (p = 0.0078), establishing INT8 deployment cost. a compression-dependent recovery interaction. Table II reports the paired tests. IV. R ESULTS & A NALYSIS A. Compression–Robustness Operating Points

C. Adversarial Boundary Redistribution

Table I reports strong-attack confirmation for selected Fig. 4 shows that S25-TRADES rescues 7.25% of examples EEGNet widths. Under the predefined clean-accuracy and while losing robustness on 5.47%, yielding a net +1.79 pp PGD20 screening tolerances, S10-TRADES is the maximum- change. Opposing worst-case margin shifts across rescued compression screen-feasible candidate: it removes 13.24% of and lost examples indicate selective adversarial boundary parameters and 12.56% of MACs while obtaining 55.32% clean redistribution rather than uniform margin expansion. Gradient accuracy and 22.22% true-union robustness. S25-TRADES RMS continues declining beyond S25 despite decreasing union

TABLE I S TRONG - ATTACK CONFIRMATION ACROSS SELECTED EEGN ET OPERATING POINTS ON BCI IV-2 A . R ESULTS AVERAGE THREE SEEDS WITHIN EACH OF NINE SUBJECTS . A LL ACCURACY VALUES ARE PERCENTAGES . U NION REQUIRES CLEAN CORRECTNESS AND SURVIVAL UNDER ALL FOUR ATTACKS . Variant

F1 /F2

Param. ↓

MAC ↓

Clean

PGD100

APGD-CE

APGD-DLR

FAB

Union

Full S10-TRADES S25-TRADES S40-TRADES S50-TRADES S60-TRADES

8/16 7/14 6/12 5/10 4/8 3/6

– 13.24 26.27 39.08 51.68 64.05

– 12.56 25.10 37.63 50.14 62.63

57.39 55.32 53.95 52.34 49.83 44.68

22.78 23.98 24.92 22.87 22.58 20.91

22.67 23.87 24.76 22.65 22.29 20.67

21.66 22.39 23.33 20.99 20.19 18.76

21.48 22.45 23.15 20.81 19.87 18.47

21.27 22.22 23.06 20.69 19.70 18.38

TABLE II PAIRED SUBJECT- LEVEL CAUSAL AND RECOVERY COMPARISONS . U NION - ACCURACY DIFFERENCES ARE IN PERCENTAGE POINTS ; p VALUES ARE FROM TWO - SIDED W ILCOXON TESTS AFTER AVERAGING SEEDS WITHIN EACH OF NINE SUBJECTS . Comparison

∆ union

p

+3.42 +1.79 −1.63 +7.45 +6.74 +3.27 +0.26

0.0234 0.5703 0.0977 0.0039 0.0039 0.0078 1.0000

Full-TRADES vs. Full S25-TRADES vs. Full S25-TRADES vs. Full-TRADES S25-TRADES vs. S25-raw S25-TRADES vs. S25-clean TRADES gain: S25 vs. Full width S25 magnitude vs. random

TABLE III J ETSON O RIN NANO T ENSOR RT FP16 MEASUREMENTS ( MEAN ± SD OVER FIVE RUNS ). Variant Full S25 S50

Latency (ms) Active power (W) 0.1712±0.0029 0.1688±0.0002 0.1575±0.0044

Energy (mJ)

14.203±0.098 2.4314±0.0244 13.630±0.017 2.3013±0.0015 12.940±0.210 2.0374±0.0237

robustness, so smaller gradients alone do not explain the observed robustness peak. D. Cross-Architecture Generalization Across nine subjects and three seeds, ShallowConvNet S25TRADES achieves 57.56% clean and 41.23% union accuracy, compared with 57.90% and 41.86% for Full; neither paired difference is significant. At S50, raw pruning yields 34.84% union accuracy; clean recovery restores it to 40.74%, compared with 39.76% for S50-TRADES. Hence, the preferred recovery method depends on architecture and compression severity rather than following a universal TRADES advantage. E. Hardware Efficiency and Precision Table III shows that S25 reduces Jetson board energy by 5.35% with little latency change, whereas S50 reduces latency and energy by 8.00% and 16.20%, respectively. In contrast, Fig. 5 shows that learned-scale INT8 Q/DQ preserves 99.3% prediction agreement but incurs roughly twice the FP16 latency and energy. Conversion and reformat overheads therefore limit the benefit of lower precision. V. C ONCLUSION To conclude, ORBITAL demonstrates that robust EEG compression requires joint consideration of structural capacity, recovery objectives, and deployment behavior. A constrained search identifies distinct feasible, robustness-oriented, and

Fig. 5. Native Jetson precision comparison. Learned-scale INT8 Q/DQ preserves approximately 99.3% prediction agreement with the QAT models, yet increases latency and board energy by roughly twofold relative to FP16 for S25 and S50.

efficiency-oriented operating points. Matched controls attribute the primary robustness gains to TRADES, while per-example analysis reveals heterogeneous adversarial-boundary redistribution. Cross-architecture experiments confirm that recovery effectiveness depends on decoder structure and compression severity. Native Jetson measurements further show that structural compression can reduce energy, whereas INT8 Q/DQ may increase execution cost due to conversion overhead. ACKNOWLEDGMENT This work was supported in part by the NYUAD Center for CyberSecurity (CCS), funded by Tamkeen under the NYUAD Research Institute grant G1104. G ENERATIVE AI U SE D ISCLOSURE The authors used Generative AI tools (specifically ChatGPT and Grammarly) for language editing, text refinement, and visual refinement of the methodology figure. The authors reviewed and edited all generated or refined content as needed and take full responsibility for the publication’s content.

R EFERENCES [1] V. J. Lawhern, A. J. Solon, N. R. Waytowich, S. M. Gordon, C. P. Hung, and B. J. Lance, “EEGNet: A compact convolutional neural network for eeg-based brain–computer interfaces,” Journal of Neural Engineering, vol. 15, no. 5, p. 056013, 2018. [2] R. T. Schirrmeister, J. T. Springenberg, L. D. J. Fiederer, M. Glasstetter, K. Eggensperger, M. Tangermann, F. Hutter, W. Burgard, and T. Ball, “Deep learning with convolutional neural networks for eeg decoding and visualization,” Human Brain Mapping, vol. 38, no. 11, pp. 5391–5420, 2017. [3] S. Han, H. Mao, and W. J. Dally, “Deep compression: Compressing deep neural networks with pruning, trained quantization and huffman coding,” in International Conference on Learning Representations, 2016. [4] H. Li, A. Kadav, I. Durdanovic, H. Samet, and H. P. Graf, “Pruning filters for efficient convnets,” in International Conference on Learning Representations, 2017. [5] P. Molchanov, S. Tyree, T. Karras, T. Aila, and J. Kautz, “Pruning convolutional neural networks for resource efficient inference,” in International Conference on Learning Representations, 2017. [6] B. Jacob, S. Kligys, B. Chen, M. Zhu, M. Tang, A. Howard, H. Adam, and D. Kalenichenko, “Quantization and training of neural networks for efficient integer-arithmetic-only inference,” in Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, 2018, pp. 2704–2713. [7] A. Madry, A. Makelov, L. Schmidt, D. Tsipras, and A. Vladu, “Towards deep learning models resistant to adversarial attacks,” in International Conference on Learning Representations, 2018. [8] H. Zhang, Y. Yu, J. Jiao, E. P. Xing, L. E. Ghaoui, and M. I. Jordan, “Theoretically principled trade-off between robustness and accuracy,” in

Proceedings of the 36th International Conference on Machine Learning, ser. Proceedings of Machine Learning Research, vol. 97, 2019, pp. 7472– 7482. [9] F. Croce and M. Hein, “Reliable evaluation of adversarial robustness with an ensemble of diverse parameter-free attacks,” in Proceedings of the 37th International Conference on Machine Learning, ser. Proceedings of Machine Learning Research, vol. 119, 2020, pp. 2206–2216. [10] X. Zhang, D. Wu, L. Ding, H. Luo, C.-T. Lin, T.-P. Jung, and R. Chavarriaga, “Tiny noise, big mistakes: Adversarial perturbations induce errors in brain–computer interface spellers,” National Science Review, vol. 8, no. 4, p. nwaa233, 2021. [11] L. Meng, X. Jiang, and D. Wu, “Adversarial robustness benchmark for eeg-based brain–computer interfaces,” Future Generation Computer Systems, vol. 143, pp. 231–247, 2023. [12] X. Chen, T. Jia, and D. Wu, “Data alignment based adversarial defense benchmark for eeg-based bcis,” Neural Networks, vol. 188, p. 107516, 2025. [13] S. Rehman and M. Shafique, “AERIAL: Adversarial evaluation of robustness in accuracy-preserving low-precision eeg decoders,” arXiv preprint arXiv:2609.30037, 2026. [14] M. Tangermann, K.-R. Müller, A. Aertsen, N. Birbaumer, C. Braun, C. Brunner, R. Leeb, C. Mehring, K. J. Miller, G. R. Müller-Putz, G. Nolte, G. Pfurtscheller, H. Preissl, G. Schalk, A. Schlögl, C. Vidaurre, S. Waldert, and B. Blankertz, “Review of the BCI competition IV,” Frontiers in Neuroscience, vol. 6, p. 55, 2012. [15] NVIDIA, “Jetson orin nano developer kit user guide,” NVIDIA Developer Documentation, 2026, accessed Oct. 2026. [16] ——, “TensorRT documentation,” NVIDIA Developer Documentation, 2026, accessed Oct. 2026.

Related documents

• ORBITAL: Optimization of Robust Brain--Computer Inference Through Architecture-Aware Low-Precision Compression#1467735
• Real-Time and Portable Chaos-based Crypto-Compression Systems for Efficient Embedded Architectures#398766
• SEMAC: Spherical Energy Matching Ambisonics Codec for Efficient Higher-Order Ambisonics Compression#1448496
• DMax: Aggressive Parallel Decoding for dLLMs#2609
• The neuron-astrocyte metabolic unit as a cornerstone of brain energy metabolism in health and disease#983706