Adversarial Vulnerabilities of Neural Biomarker Identification Systems

Adversarial Vulnerabilities of Neural Biomarker Identification Systems Polina Tapal1,2* and Bryce-Allen Bagley1,3

arXiv:2609.01856v1 [cs.CR] 1 Sep 2026

1

Cerberus Neurosecurity Research Institute (CNRI), San Francisco, CA, 94102, USA. 2 Department of Computer Science, University of Luxembourg, 435 Av. du Rock’n’Roll, Esch-sur-Alzette, 4361, Luxembourg. 3 Cognitive Security Institute. *Corresponding author(s). E-mail(s): polina.tapal.001@student.uni.lu; Abstract There is growing interest in the proposed use of EEG signals as biometric credentials, but thus far there has been little research on the reliability and security of such biometrics. Prior adversarial tests have focused on deep-learning classifiers and assumed attackers have full access to the classifier model. This has left unexamined other, more popular categories of neural signature methods as well as the more realistic case of an adversary having only black-box access to a classifier. In this paper we develop a collection of adaptive attack algorithms which learn to fool an authentication system via targeted alterations of stolen EEG recordings, without requiring any knowledge of the authentication system itself. Tested on 6 public datasets spanning three recording conditions (reacting to visual stimuli, imagining hand movements, and resting), it reveals that different signaturing approaches vary significantly in their degrees of vulnerability to adversarial attacks. We show that vulnerability to spoofing attack is greatly impacted by the recording conditions, with significant variation depending on task at time of recording. Finally, we provide recommendations for improving neural signature biometrics based on the results of our adversarial testing.

1 Introduction The convergence of neuroscience and security, termed neurosecurity, was first articulated by Denning, Matsuoka and Kohno [1] in the context of implantable neural

1

devices, and has since expanded significantly as non-invasive interfaces based on technologies such as Electroencephalography (EEG) have moved from laboratory settings into consumer and clinical deployment. Early framing by Ienca and Haselager [2] identified brain–computer interfaces (BCIs) as a surface for both offensive exploitation and privacy violation. Their subsequent work with Emanuel [3] extended these concerns to consumer neurotechnology, characterising the risk of involuntary neural data disclosure as brain leaks. Pycroft et al. [4] coined the term brainjacking for adversarial manipulation of implanted stimulators, while Canham and Sawyer [5] argued that passively captured neural emissions constitute a new category of measurement and signals intelligence (MASINT), placing the human brain within the threat landscape of intelligence collection. Further work has demonstrated concrete attack vectors and characterised the BCI attack surface across multiple architectures [6–12]. The most recent and comprehensive survey of this landscape is Bagley et al. [13], who catalogue threat vectors and state-of-the-art defensive methods across neurotechnology broadly. Collectively, this body of work establishes that neural data are sensitive, leakable, and increasingly targetable, motivating the design of authentication systems whose security properties are analysed under explicit adversarial models. A parallel strand of research has investigated neural signatures : the stable, subjectspecific features of brain activity that can serve as biometric identifiers. Campisi and La Rocca [14] provided an early systematic treatment of EEG-based biometric recognition, establishing that individual differences in spectral and event-related features are sufficiently stable for identity verification. Ruiz-Blondet, Jin and Laszlo [15] subsequently demonstrated near-perfect identification accuracy using the averaged ERP in their CEREBRE protocol, confirming the richness of individually distinctive neural response patterns. Barachant et al. [16] demonstrated that spatial covariance matrices of EEG recordings, treated as points on the Riemannian manifold of symmetric positive definite (SPD) matrices, carry highly differentiating identity information for BCI classification, establishing the geometric foundation that one of our authenticators directly inherits. Subsequent work formalized EEG-based person identification as a biometric problem. Wang et al. [17] showed that resting-state connectivity graphs yield stable brainprints across sessions, and Zhang et al. [18] survey the state of EEG authentication methods, cataloging both event-related potential (ERP) and restingstate paradigms. On the attack side, Bernal et al. [19] demonstrated neuronal jamming cyberattacks that corrupt BCI task performance via crafted stimuli, Wu et al. [20] provide a systematic review of adversarial attacks and defenses across physiological computing modalities including EEG, and Yi et al. [21] demonstrate imperceptible time-frequency adversarial attacks against deep-learning brainprint recognizers specifically, though requiring gradient access to the target model. Taken together, the literature shows that neural signatures are both powerful biometric primitives and non-trivial attack targets. The present paper contributes an adversarial evaluation framework for geometrybased EEG authentication. For our primary attack algorithm, we treat perturbation strategy selection as a multi-armed bandit problem, enabling an adaptive black-box adversary (requiring no model access beyond accept/reject feedback) to discover which families of signal-level attack are most effective against nearest-centroid and Gaussian

2

Naı̈ve Bayes classifiers operating on the same covariance manifold features, without requiring prior knowledge of the recording paradigm used to collect the EEG data.

2 Methods 2.1 Threat model and scope We consider an adversary attempting to defeat an EEG-based biometric authentication system by submitting a forged neural signal. The system authenticates users by verifying that a presented EEG trial is consistent with an enrolled subject’s covariance profile, summarized as a per-identity template µk constructed at enrollment and defined in §2.2.2. The adversary’s goal is to produce a signal that is accepted by the system under a false claimed identity, that is, to maximize the False Acceptance Rate (FAR). The signal being perturbed is a raw multichannel EEG trial X ∈ RC×T , recorded from C electrodes over T time samples. The adversary has black-box access to the authenticator, submitting trials and observing accept/reject decisions, with no access to the enrolled templates or the decision threshold τ . The concrete case under consideration is one in which the attacker has obtained a prior recording, for instance, through a compromised acquisition device or access to a previously captured session. The requirement is weaker than that scenario suggests, and we state it in its weakest form. Because the feature map ϕ discards the temporal axis, the trial at hand needs to match the deployed system only in channel count and montage, and not in trial length, recording session, or recording paradigm. It does not need to be a recording of the identity under attack, nor of any enrolled subject at all. We accordingly call it the donor trial and reserve target identity for the enrolled identity k ′ under which acceptance is sought. We note that the party harmed is the target identity, while the donor may be any subject, enrolled or not. §3.4 tests this limit directly by drawing donors from a different recording paradigm than the one used at enrollment. The authenticator operates entirely on the log-covariance vector v = ϕ(X ) and never on the raw signal, so any perturbation that displaces the covariance geometry of X toward µk′ is, from the system’s view, indistinguishable from a genuine trial recorded from subject k ′ . Conversely, perturbations that do not affect covariance structure, such as a uniform DC offset, have no effect on the authenticator whatsoever. This motivates studying perturbations at the signal level, before feature extraction, rather than restricting the adversary to manipulating the feature vector directly. The attacks studied here are impersonation attacks. The adversary submits a perturbed donor trial under claimed identity k ′ and succeeds when the system accepts it. The assumption that the adversary holds a prior recording rather than synthesizing EEG from scratch is grounded in the current limitations of EEG generation. Unlike images or audio, realistic full-synthesis of subject-specific EEG signals that preserves fine-grained covariance structure remains an open problem [22]. Replay and perturbation-based attacks are therefore the most credible threat vector in practice. Rather than focusing on a single fixed attack, we evaluate a trio of strategies: a stochastic multi-armed bandit (§2.3), a black-box VAE trained via REINFORCE, and a gray-box surrogate-gradient GAN with true backpropagation (§2.3.1). 3

2.2 Base authentication system 2.2.1 Feature extraction Let a single EEG trial be a matrix X ∈ RC×T , where C is the number of channels and T is the number of time samples. Its empirical spatial covariance is

Cov =

1 XX T + ϵIC , T −1

(1)

with ϵ = 10−6 ensuring positive definiteness. We compute XX T rather than X T X because we are interested in spatial, not temporal, relationships, yielding a C × C matrix on the symmetric positive definite (SPD) manifold. This manifold is curved under the natural affine-invariant metric [23] (Supplementary Note 2), so we linearize it via the Log-Euclidean map [24]. Writing the eigenvalue decomposition Cov = U ΛU T , S = logm (Cov) = U diag(log λ1 , . . . , log λC ) U T sends the trial to the tangent space at the identity, a flat space where Euclidean operations are geometrically meaningful. The upper triangular entries of S (the lower triangle is redundant by symmetry) are then extracted and ℓ2 -normalized to yield a feature vector v ∈ RD , where D = C (C + 1)/2. The normalization is deliberate. The magnitude of v encodes non-stationary signal power (impedance drift, fatigue), while its direction encodes the stable, participantspecific covariance structure. Discarding magnitude and mapping every trial onto the unit sphere SD−1 makes cosine similarity the natural verification metric (§2.2.2). To confirm this log-map is not incidental, we compare it against two feature ablations across all eight evaluation streams, an Euclidean covariance feature (same extraction, no log-map) and a per-channel power-spectral-density feature in Supplementary Note 3. On RSVP and motor imagery, both baselines collapse to near-chance discrimination, with equal error rate (EER, the operating point at which false acceptance and false rejection rates coincide) of 0.31–0.44, whereas Riemannian features achieve 0.07–0.15. On resting-state, all three features are comparably poor (≈ 0.31–0.50), confirming that resting-state vulnerability is structural, not feature-choice-dependent.

2.2.2 Classifiers: nearest-centroid and Gaussian Naı̈ve Bayes We evaluate the same log-covariance features v ∈ RD under two classifiers with nearopposite structural assumptions, so that agreement between them is informative about whether a finding reflects the feature geometry or one decision rule built on top of it.

Nearest-centroid. Let {(vi , yi )}N i=1 be the enrollment set. For each identity k we average the normalized log-covariance vectors of that participant’s enrollment trials and renormalize, giving the template µk = v̄k /∥v̄k ∥. To verify a claimed identity k ′ , a query q is scored by cosine similarity sim(q, µk′ ), which the ℓ2 -normalization of §2.2.1 makes the natural inner product on the unit sphere. The explicit formula, and a comparison with the deep-learning alternative, are given in Supplementary Note 2. Nearest-centroid (NC)

4

is deliberately simple, as a learned decision boundary would conflate the adversarial surface of the classifier with that of the feature space, whereas nearest-centroid attributes all attack effectiveness to displacement in SPD geometry – an assumption we test directly below with a classifier that does have a learned boundary.

Gaussian Naı̈ve Bayes. For each enrolled identity k , we instead fit a dedicated one-vs-all Gaussian Naı̈ve Bayes (GNB) classifier gk on the same vectors, treating k ’s trials as the positive class and all other identities’ trials as the negative [25]. GNB models each feature dimension as an independent univariate Gaussian conditioned on class. This is an axis-aligned assumption, in contrast to nearest-centroid, which scores along a single global direction. The verification score is P (genuine | q ) = gk (q ) in place of sim(q, µk ). Threshold calibration, the UCB bandit, the attack arms, and the dual reward are otherwise unchanged from §2.3–§2.4. Results for both classifiers are reported side by side throughout §3. Linear support vector machine. To test whether the pattern observed under nearest-centroid and GNB depends specifically on using classifiers with no learned decision-boundary capacity, we additionally repeat the full protocol with a one-vs-all linear SVM per enrolled identity. This classifier optimizes a decision boundary rather than relying on fixed geometric or probabilistic structure. Full methodological detail, including a threshold-calibration procedure this classifier’s learning capacity requires, is given in Supplementary Note 9; results are reported alongside NC and GNB in §3.3.

2.2.3 Threshold calibration Setting τ at the p-th percentile of genuine scores bounds the FRR at p/100 on the training population: p . (2) FRR ≤ 100 To select p, we examined the EER-crossing percentile pEER under the nearest-centroid classifier across all eight evaluation streams (Table 2; full breakdown in Supplementary Tables 4–6). The two RSVP datasets (pEER = 6 for Zhang, pEER = 8 for Won) and the two motor imagery datasets (pEER = 4 for Cho, pEER = 8 for Lee) cluster tightly around p ≈ 10, while the four resting-state streams cross at substantially higher percentiles (pEER ∈ {34, 36, 38, 50}; §4). We use p ≈ 10 as a reference operating point in the experiments that follow, as it sits within or immediately adjacent to the empirical EER band for four of the eight streams and gives a single, dataset-independent percentile for cross-paradigm comparison. However, since the optimal balance of FAR and FRR is application-dependent, the adversarial evaluation in Section 2.3 reports results across a range of p values, allowing the authenticator’s resilience to be characterized as a function of the operating point rather than at a single fixed threshold.

5

2.3 Adversarial evaluation Score-feedback black-box attacks on EEG biometrics were first demonstrated via hillclimbing optimization of synthetic templates [26]. We instead frame strategy selection as a bandit over interpretable, signal-level perturbation families, which additionally exposes which attack family is effective per paradigm, rather than only whether an attack succeeds. We frame the adversarial search as a stochastic multi-armed bandit problem. Let A = {a0 , . . . , a7 } be a set of 8 attack arms: signal perturbations applied to a raw EEG trial to produce a forgery. The attacker pursues a dual objective: maximizing FAR, while minimizing perturbation magnitude, so that forgeries are both effective and minimally distorted relative to the original signal. At each round t, the UCB policy selects the arm: ∗

"

a (t) = argmaxa∈A µ̂a (t) + c

s

ln t Na (t)

#

(3)

where µ̂a (t) = √Ra (t)/Na (t) is the empirical mean reward for arm a, Na is its pull count and c = 2 is the exploration constant. The reward signal is a scalarization of two objectives:   ∥X ′ − X∥F rt = (1 − λ) · 1[sim(q, µk′ ) ≥ τ ] + λ · 1 − (4) ∥X∥F where λ ∈ [0, 1] is a trade-off parameter. The first term rewards false acceptance, and the second rewards perturbation minimality, normalized to [0, 1]. Setting λ = 0 recovers the purely binary objective. Larger λ penalizes arms that achieve acceptance only through large signal distortions. We refer to ∥X ′ − X∥F /∥X∥F as the attack budget consumed by a given arm on a given trial. It measures the fraction of the original signal energy added by the perturbation. Arms that cross the acceptance threshold only by consuming a large fraction of this budget receive lower reward under λ > 0, and the bandit learns to favor arms that achieve false acceptance at low budget cost. We fix λ = 0.3 for all experiments reported. Supplementary Note 5 sweeps λ ∈ {0, 0.1, 0.3, 0.5} and shows adversarial FAR changes by at most 0.073 across this range, with the paradigm-specific arm-family finding unchanged at every value, so 0.3 is representative of the swept range rather than a value the result depends on. The UCB bandit thus selects arms that jointly maximize attack effectiveness and forgery quality, rather than rewarding any perturbation that happens to cross the threshold. Since this formulation is expressed in terms of nearest-centroid’s cosine similarity, we also specify its counterpart for GNB. In this case gk (q ) substitutes for sim(q, µk′ ) (§2.2.2) with no other change to the bandit, arms, or reward. Each arm applies a distinct signal-level perturbation to the new raw trial X ∈ RC×T (see Table 1). The eight arms were selected to provide coverage across qualitatively distinct attack families, each targeting a different property of the Riemannian feature pipeline: additive noise (a0 , a1 ), temporal rearrangement (a2 ), spectral gain (a3 ), signal space interpolation (a4 ), replay (a5 ), channel coupling (a6 ), and eigenvalue reshaping (a7 ). 6

Table 1 Signal-level perturbation arms applied to raw EEG trials X ∈ RC×T . Arm a3 operates on the extracted, already-bandpassed trials, not raw signal. RSVP streams are filtered to 1–10 Hz, so only δ and part of θ carry any content there; the full δ–β range is only available on the resting-state and motor-imagery streams (1–30 Hz). γ is listed for completeness of the arm’s general definition; no stream retains content above 30 Hz, so γ-band gain is a no-op for all eight streams. Arm

Name

Perturbation

a0 a1 a2 a3 a4 a5 a6 a7

Gaussian noise Correlated noise Temporal distortion Frequency manipulation Covariance interpolation Replay + jitter Channel coupling Eigenvalue perturbation

X ′ = X + N (0, σ 2 I) X ′ = X + σDw, structured via random subspace segment shuffle, crop-pad, or cyclic shift bandpass-selective gain in δ, θ, α, β, γ bands X ′ = (1 − α)X + αXimp , α ∈ [0, 0.5] X ′ = X + ε + roll(X, s) Xi′ ← Xi + αXj for a random pair (i, j) reshape covariance spectrum via amplify/flatten

The bandit is then left to discover empirically which family is most effective, rather than assuming a single dominant attack vector. The arm set deliberately contains no null perturbation: every arm modifies the trial. On a paradigm where an untouched impostor recording is already accepted most of the time, the bandit cannot do better than the baseline. Negative attacker lift (§3.2) therefore reports that no perturbation family improves on inaction. A real attacker facing such a system would not perturb it at all.

2.3.1 Generative attackers: VAE and surrogate-gradient GAN As an alternative to the UCB bandit, we evaluate two generative attackers under the identical dual reward, Niter = 1,000-iteration budget, and enrollment/test splits. A VAE-attacker [27] (black-box, trained online via REINFORCE [28]) encodes a flattened victim trial to a posterior over a 32-dimensional latent space and decodes a perturbation δ , exploring via the posterior’s stochasticity; full architecture in Supplementary Note 4. A surrogate-gradient GAN (SGAN) escalates to a gray-box threat model. Differentiating the deployed feature pipeline would require white-box access. The attacker instead trains a small differentiable surrogate Sθ on enrollment data to approximate the verification score, then trains a generator and discriminator against it with true backpropagation, following the surrogate-attack paradigm of Papernot et al. [29] with a Carlini–Wagner-style soft perturbation-norm penalty [30] in place of a hard constraint. Full loss, architecture, and diagram are in Supplementary Note 4. FAR is measured on the nearest-centroid authenticator throughout for comparability across all three attackers. The full attacker × classifier grid, including both generative attackers against GNB and the linear SVM, is reported in Supplementary Note 10.

2.4 Experimental protocol Experiments are repeated across a range of threshold percentiles p ∈ {5, 10, 15, 20, 25} to characterise how authenticator resilience varies with the FAR/FRR operating point.

7

All trials are drawn from a single participant × day session. With each session, a fraction ρ = 0.5 of trials per subject are reserved for enrollment (i.e. fitting the perclass template or model – µk for nearest-centroid, gk for GNB – and calibrating τ ). The remaining trials form the test pool from which the attack samples donor signals X . A two-pool split suffices because p is chosen on a system-design criterion independent of adversarial outcomes, so no feedback loop between the attack evaluation and the threshold selection exists. A total of Niter = 1000 UCB iterations are run per day. This is repeated independently across days and subjects. To assess whether arm selection is non-trivial, we apply the one-sided MannWhitney U test (Wilcoxon rank-sum) between the reward sequences of the bestperforming and worst-performing arms within each dataset, pooled across days. Let (w) (b) {rt } and {rt } denote the rewards collected across all iterations in which arm b (best) and arm w (worst) were pulled respectively; the sequences have unequal length because the UCB policy allocates pulls unevenly. The null hypothesis is that the two distributions are identical. Rejection at α < 0.05 confirms that the bandit has identified a statistically meaningful difference in attack effectiveness. Results are reported in Supplementary Table 3. We additionally test the montage-compatibility claim of §2.1 directly. For each ordered pair of the eight streams, the authenticator is enrolled on one and donor trials are drawn exclusively from the other, with the bandit, arm set, and reward unchanged. All streams are reduced to the 31 electrodes they share (C = 31, D = 496). Donors are truncated to the enrolled trial length, band-matched to the enrolled passband, and rescaled to the enrolled amplitude. The rescaling is necessary because the Log-Euclidean map is not scale-invariant, a global factor s contributing log(s)I that survives the ℓ2 normalization, and matching gain is a capability any adversary possesses. Where band-matching is required, the identical filter is applied to the enrolled trials, so that neither side passes through more filtering than the other. Because this harmonization alters the montage, the diagonal of the resulting grid rather than Table 3 is the within-condition reference. The full grid is in Supplementary Note 11.

2.5 Datasets Prior to the dataset description, we fix terminology that may not be self-evident to readers without an EEG background. A trial is a single segment of multichannel EEG, represented as a matrix X ∈ RC×T . In event-related paradigms a trial is a stimuluslocked epoch, a window extracted around a known stimulus onset and spanning the expected response interval. In resting-state paradigms there are no stimuli, so trials are instead fixed-length non-overlapping windows cut from a continuous recording. A session is a single recording sitting, one participant on one day, yielding some number of trials. We evaluate the adversarial framework across three paired experiments, each representing a qualitatively distinct category of neural driver: (i) exogenous stimulation, in which discriminative brain responses are time-locked to external stimuli presented by the system, (ii) no neural driver, in which EEG is collected at rest without any task or stimulus structure, (iii) endogenous cognitive effort, in which discriminative neural activity is generated internally by the participant’s voluntary mental imagery. 8

This taxonomy allows us to disentangle the contribution of the neural driver to both baseline biometric discriminability and adversarial vulnerability, as well as to test whether the bandit’s arm-preference structure is paradigm-specific or generic across signal types. Zhang and Wu [31] priorly showed CNN task decoders are vulnerable to gradient-based attack across P300, error-related negativity, and motor-imagery paradigms; our taxonomy instead targets nearest-centroid and Gaussian Naı̈ve Bayes biometric authenticators built on the same Riemannian covariance features, rather than task decoders, and asks whether paradigm-level vulnerability is a property of the classifier or of the covariance geometry itself. The first two datasets (Zhang et al. and Won et al.) employ the Rapid Serial Visual Presentation (RSVP) oddball paradigm, in which brief stimuli are displayed at a fixed rate and the subject attends to rare target items. This paradigm reliably elicits the P300 event-related potential, a positive deflection at parietal and occipital electrodes peaking 300–600 ms post-stimulus, whose amplitude, latency, and spatial distribution carry individually distinctive patterns that have been exploited for ERP-based biometric identification [14]. We chose RSVP because (i) the P300 component is the most studied EEG biometric signature, (ii) two publicly available datasets with compatible recording setups both use this paradigm, enabling a direct cross-dataset comparison without paradigm confounds, and (iii) the within-session enrollment/verification protocol we adopt is the standard evaluation setting in P300 biometrics. Two further datasets provide resting-state EEG with no stimulus structure. Participants either fixate a central point (eyes open, EO) or sit quietly with eyes closed (EC) for a fixed duration. The EO and EC conditions of each dataset are treated as fully independent evaluations, yielding four resting-state evaluation streams in total. CP5 is not recorded in all COG-BCI participants and is dropped globally from both resting-state datasets, giving C = 31 and D = 496 on these four streams. Wang et al. provides long inter-session gaps (90 min and one month); Hinss et al. provides a weekly test-retest interval. Together they probe whether the Riemannian covariance signature remains stable across qualitatively different retest timescales, and whether the adversarial arm preferences observed under ERP paradigms replicate in the absence of any stimulus-locked neural response. Two final datasets (Cho et al. and Lee et al.) provide motor imagery EEG. Participants imagine left- or right-hand movement, generating mu (8–12 Hz) and beta (13–30 Hz) event-related desynchronisation that is spatially localised over contralateral sensorimotor cortex and individually distinctive. Left- and right-hand trials are pooled per subject; a wider bandpass of 1–30 Hz is used to retain the physiologically relevant mu/beta bands, and channel selection is restricted to the same 32-electrode Won subset, yielding identical feature dimensionality (C = 32, D = 528) to the RSVP pair. Full recording parameters and preprocessing pipelines are given in Supplementary Note 6.

2.6 Ethical considerations The study reanalyses six previously published, publicly available EEG datasets [32–37]. No new human-subjects data were collected by the present authors. Each dataset was 9

collected under the ethical approval and informed-consent procedures reported by its original publication (Supplementary Note 6). All recordings used here are de-identified and released for secondary research use.

3 Results 3.1 Baseline authentication performance Table 2 Baseline authentication performance across all eight streams (nearest-centroid classifier; GNB baseline reported separately in Table 4). pEER : threshold percentile at EER crossing; FAR at p=10: non-adversarial false acceptance rate at the reference operating point (N = 15 for RSVP, N = 20 otherwise). Paradigm

Dataset

pEER

EER

FAR (p=10)

RSVP

Zhang Won

6 8

0.154 0.153

0.103 0.111

Resting-state

Wang-EO Wang-EC COG-BCI-EO COG-BCI-EC

38 34 50 36

0.389 0.345 0.492 0.391

0.818 0.812 0.896 0.842

Motor imagery

Cho Lee

4 8

0.066 0.076

0.000 0.074

3.2 Adversarial attack results Table 3 reports the dominant UCB arm, adversarial FAR at p = 10 under the UCB bandit, and FAR under the VAE and SGAN generators. Full results across p ∈ {5, 10, 15, 20, 25} are in Supplementary Tables 7–9; per-arm FAR figures are in Supplementary Figs. 3–10.

Attacker lift over the zero-effort baseline. Adversarial FAR is interpretable only relative to the acceptance an attacker obtains with no attack at all, hence we compare each value in Table 3 against the zero-effort FAR, the rate at which an unmodified impostor trial is accepted against another participant’s template at the same threshold, measured in the same runs (Table 2; Supplementary Table 1). The resulting attacker lift, ∆FAR = FARadv − FARzero-effort , separates the paradigms differently from raw FAR, and more informatively. On RSVP the attack is the source of the acceptance (+0.032 on Zhang, +0.051 on Won, against baselines of 0.103 and 0.111). On motor imagery both terms are near zero. On restingstate, where raw adversarial FAR is highest, the zero-effort baseline is 0.812–0.896 and lift is negative on all four streams (−0.034 to −0.054). The acceptance is already available to an impostor who replays a stolen recording untouched, and no perturbation 10

Table 3 Adversarial FAR at p=10 for UCB, VAE, and SGAN (mean ± std across subjects, λ = 0.3). “Best arm” is the UCB arm achieving highest dual reward; on Cho no arm achieves acceptance so the best arm is identified by budget reward only (marked ∗). All Mann-Whitney U tests comparing best vs. worst arm are significant at p < 0.001; see Supplementary Table 3. Dataset

Best arm (UCB)

UCB FAR

VAE FAR

SGAN FAR

Zhang Won

Gauss. noise Cov. interp.

0.135 ± 0.119 0.162 ± 0.068

0.029 ± 0.029 0.000 ± 0.000

0.024 ± 0.033 0.000 ± 0.000

Wang-EO Wang-EC COG-BCI-EO COG-BCI-EC

Chan. coupling Chan. coupling Chan. coupling Chan. coupling

0.798 ± 0.240 0.806 ± 0.205 0.889 ± 0.147 0.824 ± 0.245

0.813 ± 0.254 0.802 ± 0.213 0.883 ± 0.142 0.818 ± 0.249

Cho Lee

Corr. noise∗ Gauss. noise

0.784 ± 0.256 0.760 ± 0.241 0.857 ± 0.147 0.788 ± 0.262 0.000 ± 0.000 0.054 ± 0.055

0.016 ± 0.063 0.049 ± 0.127

0.010 ± 0.042 0.114 ± 0.216

family improves on that. The high resting-state FAR in Table 3 therefore measures a paradigm that fails without an adversary, not an effective attack, and we interpret it accordingly throughout (§4).

Arm-preference structure. The most informative result is not the magnitude of adversarial FAR but which arm the bandit converges to, given no paradigm information. The pattern is categorical. On all four resting-state streams the bandit immediately abandons Gaussian noise, correlated noise, and replay-with-jitter (per-arm FAR = 0.000) and concentrates entirely on geometric arms. Channel coupling achieves the highest dual reward on every stream, with covariance interpolation second. On RSVP, noise-based and interpolation arms dominate. Gaussian noise leads on Zhang by both per-arm FAR (0.18) and dual reward. Covariance interpolation leads on Won by dual reward (0.359), despite temporal distortion attaining a marginally higher raw per-arm FAR (0.34 vs. 0.30) at greater perturbation cost (Supplementary Figs. 3–10). On motor imagery, no arm achieves meaningful acceptance. Arm differences are driven entirely by the budget component of the dual reward. This paradigm-specific arm ordering is stable across all tested p values and λ values (Supplementary Note 5). Generative attackers vs. UCB. On resting-state, all three attackers are statistically indistinguishable (|FARa − FARb | ≤ 0.046 across any pair of attackers a, b). The attack surface is so permissive that any optimisation strategy converges readily, and the generators do so at 5–6% signal energy budget, below the covariance-interpolation arm. On motor imagery, all three independently confirm the paradigm-level stability (Cho: FAR ≈ 0; Lee: FAR < 0.12). On RSVP, the UCB decisively outperforms both generators. Won achieves zero generative acceptances, and Zhang reaches only 18–21% of the UCB’s FAR. The discrete arm selector commits to the effective perturbation family within tens of pulls. REINFORCE over a 32-dimensional latent space has not converged to a comparably 11

targeted direction at Niter = 1,000. This continuous score-guided optimisation of a synthetic template, in the spirit of earlier hill-climbing attacks on EEG biometrics [26], is outperformed here by a discrete search whenever the attack surface is structurally identifiable. The one exception is Lee (SGAN FAR = 0.114 vs. UCB 0.054). Persubject decomposition reveals a right-skewed distribution with median FAR = 0.015. Ten of 20 subjects achieve FAR = 0.000 across both sessions, while six exceed FAR = 0.13 (range 0.14–0.62). This suggests subject-specific vulnerability rather than a population-level SGAN effect on motor imagery. Resistant subjects tend to sit farther from the population template centroid in feature space, though this does not fully account for the split. This ordering is specific to the nearest-centroid authenticator: against the linear SVM both generators reach FAR 0.19–0.20 on RSVP where the UCB reaches 0.009–0.010, reversing it (Supplementary Note 10).

Discriminator as perturbation detector. SGAN training also yields a discriminator D. AUROC ranges from 0.496 to 0.595 across all streams (near-chance), interpreted in §4 with full metrics in Supplementary Table 10.

3.3 Classifier generalisation Table 4 reports baseline EER and adversarial FAR at p = 10 for both classifiers side by side. The paradigm ordering is unchanged under GNB: resting-state stays highly permissive (adversarial FAR 0.58–0.81), while RSVP and motor imagery collapse to near-zero (≤ 0.001), in fact more completely than under nearest-centroid. Critically, this is not explained by GNB being a globally weaker classifier, since on resting state, GNB’s baseline EER is comparable to or better than nearest-centroid’s on three of four streams (Wang-EO: 0.330 vs. 0.389; Wang-EC: 0.285 vs. 0.345; COG-BCI-EO: 0.454 vs. 0.492). The same holds for motor imagery in the other direction. GNB’s baseline EER is markedly better than nearest-centroid’s (Cho: 0.011 vs. 0.066; Lee: 0.018 vs. 0.076) and it is simultaneously more resistant to attack, a clean result rather than a floor effect. Won shows the same pattern (GNB EER 0.130 vs. 0.153). Two streams qualify this: on Zhang and Won, GNB’s threshold calibration does not generalise as reliably as it does elsewhere. At p = 10, held-out genuine FRR is 0.785 (Zhang) and 0.524 (Won), far above the nominal 0.10 bound the calibration targets, whereas on resting-state and motor imagery it lands within 0.02–0.12 of that target on every stream. This mirrors the small-enrollment calibration sensitivity documented for the linear SVM (Supplementary Note 9). Zhang and Won have the smallest enrollment sets of the eight streams (17 and 75 trials/subject), and GNB’s per-feature Gaussian fit, while far less overfitting-prone than an SVM, is not immune to it at this n. GNB’s near-zero adversarial FAR on Zhang and Won therefore reflects an operating point, that is, in practice, far stricter than the nominal p = 10 threshold, and cannot be fully disentangled from this miscalibration rather than genuine attack resistance. Because calibration is reliable on all four resting-state streams, this caveat does not extend to the paper’s central claim.

12

The winning attack arm under GNB on every resting-state stream is covariance interpolation or eigenvalue perturbation, the same geometric, direct-SPDmanipulation family that dominates under nearest-centroid (§3, Supplementary Figs. 3–10). Two classifiers with near-opposite structural assumptions about the feature space are exploited by the identical family of perturbations when trained on the same log-covariance representation, yielding the evidence that the vulnerability is a property of the SPD-manifold feature geometry itself, not of any one decision rule built on top of it. The pattern extends to a classifier with a learned decision boundary. A linear SVM matches or exceeds NC/GNB baseline discrimination on RSVP and motor-imagery (EER as low as 0.006) yet shows the same near-chance discrimination and high adversarial FAR on resting-state (adversarial FAR 0.74–0.84 at p = 10), indicating the vulnerability is not attributable to classifier simplicity (Supplementary Note 9, Table 12). Table 4 Classifier generalisation: nearest-centroid vs. GNB, baseline EER and adversarial FAR at p = 10, all eight streams. GNB best arm is the UCB arm with highest raw FAR under GNB scoring. Dataset

GNB best arm

NC EER

NC Adv. FAR

GNB EER

GNB Adv. FAR

Zhang Won

Gauss. noise Chan. coupling

0.154 0.153

0.135 0.162

0.393 0.130

0.000 0.001

Wang-EO Wang-EC COG-BCI-EO COG-BCI-EC

Eigenval. perturb. Cov. interp. Eigenval. perturb. Eigenval. perturb.

0.389 0.345 0.492 0.391

0.784 0.760 0.857 0.788

0.330 0.285 0.454 0.400

0.619 0.575 0.811 0.732

Cho Lee

Cov. interp. Cov. interp.

0.066 0.076

0.000 0.054

0.011 0.018

0.001 0.001

3.4 Cross-condition spoofing Table 5 reports adversarial FAR at p = 10 grouped by the relationship between the donor stream and the enrolled stream. Motor-imagery authenticators accept no cross-paradigm donor at all (0.000 ± 0.000 across twelve ordered pairs), and RSVP is only partially exposed. Resting-state authenticators accept donors recorded under an entirely different paradigm at 0.459 ± 0.223, which is 76% of what same-paradigm donors obtain, and the donor’s neural driver barely matters. Motor-imagery donors are accepted at 0.435 and RSVP donors at 0.483. Attacker lift is −0.016, so these are unmodified trials. An untouched Cho motor-imagery trial is accepted against a WangEO template at 0.667. The capability required to defeat a resting-state authenticator is therefore weaker than §3.2 indicates, needing no recording of the target identity, no recording of any enrolled subject, and no knowledge of the enrollment paradigm. The arm preferences of §3.2 nonetheless replicate, with eigenvalue perturbation or covariance interpolation winning on all sixteen resting-state cross-paradigm cells.

13

Table 5 Cross-condition spoofing. Adversarial FAR at p=10 (mean ± std across enrolled identities), grouped by the relationship between the donor and enrolled streams. “Same stream” is the diagonal and serves as the within-condition reference. Enrolled paradigm

Same stream

Within paradigm

Cross-paradigm

RSVP Resting-state Motor imagery

0.196 ± 0.072 0.597 ± 0.228 0.017 ± 0.017

0.016 ± 0.011 0.607 ± 0.206 0.033 ± 0.047

0.085 ± 0.112 0.459 ± 0.223 0.000 ± 0.000

4 Discussion The central practical conclusion of this work is that resting-state EEG should not be used for biometric authentication, and the adversarial evaluation establishes this more forcefully than baseline error rates by themselves. Two facts have to be read together. First, resting-state authentication fails with no adversary present at all. The zero-effort FAR, the rate at which an unmodified impostor recording is accepted against another participant’s template, is 0.812–0.896 at p = 10 (Table 2; Supplementary Table 1) and at each stream’s own EER operating point it remains 0.345–0.492 (Supplementary Tables 4–6). Second, the adaptive attacker gains nothing on top of that. Attacker lift is negative on all four resting-state streams (−0.034 to −0.054), and this is not an artifact of the perturbation-budget term, since λ = 0 moves resting-state FAR by at most 0.025 (Supplementary Note 5). We therefore state the resting-state result as a claim about required attacker capability rather than about adversarial FAR: defeating a resting-state authenticator requires no attack at all, because possession of a single arbitrary resting-state recording already suffices. Cross-condition testing weakens even that requirement (§3.4), since resting-state authenticators accept unmodified recordings of a different task, from subjects they have never enrolled, at 0.459. Possession of any montage-compatible EEG recording suffices, whatever the subject was doing. That our attacker adds nothing here is a property of the paradigm rather than a limitation of the attacker, since the identical bandit, arm set, and reward obtain positive lift on RSVP (+0.032 on Zhang, +0.051 on Won) and fail against motor imagery exactly where the underlying system is genuinely discriminative (EER 0.011–0.076); the procedure detects vulnerability where it exists and does not manufacture it where it does not. The paradigm’s failure is invariant to every axis we vary: the choice of classifier (nearest-centroid vs. GNB, §3.3; linear SVM, Supplementary Note 9), the choice of enrollment session (Supplementary Note 7), and the choice of operating point (Supplementary Tables 7–9). The underlying cause is that resting-state covariance has high intra-subject trial-to-trial variability relative to inter-subject separation. Genuine and impostor cosine-similarity distributions already substantially overlap before any attack, which no threshold, classifier or template-freshness choice resolves (defence options discussed in Supplementary Note 8). RSVP and motor imagery do not share this failure mode. Motor imagery resists the full black-box and gray-box attack suite at every operating point tested (UCB FAR ≤ 0.054; the sole exception is SGAN on Lee at 0.114, which per-subject decomposition attributes to 6 of 20 subjects rather

14

than a population effect, §3.2), and RSVP is attackable but tractable to defend with a challenge-response protocol (see below). The mechanism is interpretable at the level of SPD geometry. Stimulus-locked ERP covariance has a privileged temporal axis: the P300 component introduces a structured, time-indexed off-diagonal pattern that additive noise or temporal rearrangement can disrupt. Resting-state covariance encodes long-range functional connectivity [17] with no privileged temporal axis. Additive noise is absorbed into the already-high trialto-trial variance and produces no directed displacement toward a target template, whereas direct SPD manipulation, e.g. interpolation, eigenvalue reshaping, bypasses the variance floor entirely. Motor imagery covariance combines subject-specific focal structure (µ/β ERD over sensorimotor cortex [14]) with tight inter-subject separation; the resulting clusters are compact enough that even geometrically targeted arms cannot displace the query vector across an identity boundary at the perturbation magnitudes considered. This ordering tracks the geometric structure of each paradigm’s covariance representation, rather than cohort size. Paradigms generating compact, well-separated per-subject SPD clusters are adversarially stable, while paradigms generating diffuse, overlapping clusters admit impostors whether or not any attack is applied. The generative-attacker comparison adds a methodological finding orthogonal to the paradigm result. When the attack surface is structurally identifiable (RSVP), coarse discrete search (UCB) is more query-efficient than continuous optimisation (VAE/SGAN) against a fixed-geometry decision rule, since UCB commits to the dominant family within tens of pulls while REINFORCE has not converged at Niter = 1,000, though this ordering reverses against a learned boundary (Supplementary Note 10); when the surface is permissive (resting-state), all three attackers converge trivially regardless of algorithm. These findings indicate that resting-state’s vulnerability is not merely under-explored by weaker attackers: stronger, gradient-based attackers do no better, and none of the three exceeds what an impostor obtains by replaying a stolen recording unmodified. There is nothing left to discover because the acceptance is available without an attack.

4.1 Attack-family structure and what it exposes The bandit’s arm preferences are the second substantive result of this work, and they are informative in a way that adversarial FAR alone is not. FAR reports whether a paradigm can be defeated, while the winning arm reports along which axis its accept region is open, which is the quantity a defender can act on. The preferences are categorical rather than graded, and they are recovered without any paradigm information supplied to the attacker. On all four resting-state streams the bandit abandons Gaussian noise, correlated noise, and replay-with-jitter within tens of pulls, driving their per-arm FAR to exactly 0.000, and concentrates on direct SPD manipulation. Channel coupling wins under nearest-centroid on every restingstate stream, and covariance interpolation or eigenvalue perturbation wins under GNB. On RSVP the ordering inverts, with noise-based and interpolation arms leading. On motor imagery no arm achieves meaningful acceptance at any operating point.

15

The resting-state case merits particular attention, because the arm structure shows that a permissive accept region is not a saturated one. Against a zero-effort baseline above 0.80, most perturbation families drive acceptance to zero. What the bandit recovers is therefore which perturbations preserve an acceptance that was already available rather than which create acceptance, and the answer identifies the few directions along which the accept region is open at all. A defender reading only the aggregate FAR would conclude that the classifier accepts anything, yet it does not. That distinction has direct defensive consequences. The winning families on restingstate share a signature that additive noise lacks. Channel coupling introduces a rank-deficient structure into the spatial covariance by construction. Eigenvalue perturbation reshapes the covariance spectrum while preserving its eigenbasis. Covariance interpolation moves the query along a geodesic between two genuine SPD points. Each is detectable in principle by statistics the authenticator already computes but currently discards, namely the eigenspectrum shape, the condition number, and the distribution of off-diagonal coupling across channel pairs relative to the enrolled population. None requires the detector to model the perturbation itself, only to notice that the presented covariance is atypically structured for a genuine trial from any enrolled subject. We did not implement such a detector, and note that it would in any case only help where an attack is required at all, which excludes resting-state.

4.2 Defence implications by paradigm RSVP remains attackable under the current protocol because the stimulus set is fixed across sessions, letting a single compromised recording be reused indefinitely. A challenge-response extension closes this, since each verification presents a fresh stimulus sequence with known target onsets, and acceptance requires both the identity match and P300 timing consistent with that session’s targets, so an attacker’s stale recording fails the freshness check. This is feasible because the enrolled template generalises across stimulus type; the same classifier achieves near-identical EER and adversarial FAR on Zhang’s face task and Won’s letter speller despite unrelated stimuli (§3). Protocol details and open questions in Supplementary Note 8. Resting-state has no comparable fix at the protocol level, since the vulnerability is a property of the feature geometry itself, not the classifier or template-freshness. Improvements would need to come from richer enrollment (longer recordings, multisession template averaging) or paradigm-assisted designs, not perturbation-specific countermeasures (Supplementary Note 8). Given the effort required for uncertain gain, the resulting recommendation is to refrain from deploying resting-state authenticators under any threat model at all, since the capability that defeats them, possession of one arbitrary resting-state recording, sits below the weakest adversary normally considered. Motor imagery needs no defence modification at the present scope. The natural next step is a white-box adversary with feature-pipeline access, which could in principle bypass the trial-variance floor that defeats every black-box arm tested [20]. The SGAN discriminator’s near-chance AUROC (0.496–0.595) is the expected minimax outcome of training G against it, not evidence perturbations are undetectable in principle. A

16

passive detector trained without simultaneous adversarial pressure is the appropriate architecture for a standalone check, left to future work (Supplementary Note 8).

5 Conclusion Across six datasets, two structurally distinct classifiers, a within- and cross-session protocol, and three attacker types, the clearest immediate result is that resting-state EEG is not a safe choice for biometric authentication. It is the only paradigm category where an unmodified impostor recording is accepted at a high rate (0.812–0.896 at the standard operating point) and where the adaptive attacker consequently gains nothing over that baseline, a failure that persists across classifier, enrollment session, and operating point, because the vulnerability is a property of the paradigm’s covariance geometry rather than of any single implementation choice. Cross-condition testing shows that the recording does not even need to come from the enrollment paradigm (§3.4). RSVP and motor imagery do not share this failure. Motor imagery resists the full attack suite outright, and RSVP is attackable but defensible via challengeresponse. The UCB bandit recovers this paradigm-specific structure from accept/reject feedback alone, with no paradigm information provided, and a secondary methodological result, that against a fixed-geometry rule discrete search beats continuous optimisation exactly when the attack surface is structurally identifiable, holds alongside it, though the ordering reverses against a learned boundary (Supplementary Note 10). Paradigm choice hence presents itself as the first-order security parameter for EEG biometric authentication. The central finding is that the bandit discovers paradigm-specific attack families from the reward signal alone, without any knowledge of the underlying paradigm. On resting-state EEG, noise-based arms are abandoned immediately and geometric arms (channel coupling, covariance interpolation) dominate; on RSVP, interpolation and noise-based arms lead; on motor imagery, no arm achieves meaningful acceptance at any operating point. This ordering directly reflects the geometric footprint of each paradigm’s neural driver on the SPD manifold. Diffuse, overlapping covariance clusters admit impostors with or without perturbation, while compact sensorimotor clusters resist the full attack surface. The attacker comparison reveals a sample-efficiency reversal. Against the nearestcentroid authenticator, when the attack surface is structurally identifiable, as in RSVP, coarse discrete search over interpretable families is more query-efficient than fine-grained continuous optimisation (the ordering reverses against a learned decision boundary, Supplementary Note 10), since the UCB commits to the dominant family within tens of pulls, while the VAE and SGAN have not converged within the same 1,000-iteration budget. When the attack surface is permissive, as in resting-state, all three attackers converge trivially, and the generators do so at lower perturbation budget. Resting-state acceptance is not, however, attributable to the attack. Adversarial FAR sits at or below the zero-effort baseline on all four streams (Table 2; Supplementary Table 1), so the paradigm’s failure is a geometric limitation that precedes any

17

adversary rather than a vulnerability our attacker introduces. Motor imagery authenticators withstand the full black-box and gray-box attack suite, with FAR≤ 0.016 on Cho at p ≥ 10 across all three attackers. Ultimately, the security in EEG biometric authentication is determined before classifier training begins, by the neural processes engaged during recording. Algorithmic sophistication alone cannot compensate for vulnerabilities introduced at the level of the recording paradigm. If EEG is to provide a reliable basis for authentication, security should therefore be understood as a property not only of the classifier, but also of the task used to elicit the biometric signal.

Supplementary information. Supplementary Information accompanies this paper, comprising Supplementary Notes 1–11, Supplementary Tables 1–14, and Supplementary Figures 1–10, covering a three-type attack taxonomy of threat models against EEG authenticators, of which the impersonation attacks studied here are Type I, extended feature/classifier detail, feature extractor comparison, generative attacker architectures, λ-sensitivity results, Mann-Whitney U test results, dataset preprocessing, full baseline and adversarial-FAR breakdowns, per-arm figures, discriminator performance, cross-session evaluation, extended discussion, classifier generalisation extended to a linear SVM, the full attacker × classifier grid, and the complete cross-condition stream-pair grid. Acknowledgements. Claude (Anthropic) was used for assistance with LATEX typesetting, including mathematical notation, equation environments, and diagram construction. All scientific content, experimental design, analysis, and interpretation are entirely the authors’ own.

Declarations Funding. Not applicable. Competing interests. The authors declare no competing interests. Ethics approval and consent to participate. Not applicable to the present authors. This study reanalyses previously published, publicly available, de-identified EEG datasets (§2.6), each collected under the ethical approval and informed-consent procedures of its original publication [32–37]. No new data were collected from human participants by the present authors. Consent for publication. Not applicable; no identifiable individual data or images are included. Data availability. All raw EEG data analysed in this study are publicly available from their original publications [32–37]. Derived features, per-dataset results, and summary statistics generated in this study are available from the corresponding author upon request. Materials availability. Not applicable. Code availability. Code implementing the feature extraction pipeline, nearestcentroid and GNB classifiers, UCB bandit, VAE and SGAN generative attackers, and the cross-session evaluation is available from the corresponding author upon request. Author contribution. P.T. conceived the study, designed and implemented the evaluation framework and all analysis code, ran the experiments, and wrote the 18

manuscript. B.A.B. supervised the work, contributed to conceptualisation and interpretation of results through ongoing review and discussion, and reviewed the manuscript.

References [1] Denning, T., Matsuoka, Y. & Kohno, T. Neurosecurity: security and privacy for neural devices. Neurosurg. Focus 27, E7 (2009). [2] Ienca, M. & Haselager, P. Hacking the brain: brain–computer interfacing technology and the ethics of neurosecurity. Ethics Inf. Technol. 18, 117–129 (2016). [3] Ienca, M., Haselager, P. & Emanuel, E. J. Brain leaks and consumer neurotechnology. Nat. Biotechnol. 36, 805–810 (2018). [4] Pycroft, L. et al. Brainjacking: implant security issues in invasive neuromodulation. World Neurosurg. 92, 454–462 (2016). [5] Canham, M. & Sawyer, B. D. Neurosecurity: human brain electro-optical signals as MASINT. Am. Intell. J. 36, 40–47 (2019). [6] Lange, J., Massart, C., Mouraux, A. & Standaert, F.-X. Side-channel attacks against the human brain: the PIN code case study (extended version). Brain Inform. 5, 12 (2018). [7] Bernal, S. L. et al. Cyberattacks on miniature brain implants to disrupt spontaneous neural signaling. IEEE Access 8, 152204–152222 (2020) [8] Bonaci, T., Herron, J., Matlack, C. & Chizeck, H. J. Securing the exocortex: a twenty-first century cybernetics challenge. in Proc. IEEE Conference on Norbert Wiener in the 21st Century (21CW) 1–8 (2014). [9] Landau, O., Puzis, R. & Nissim, N. Mind your mind: EEG-based brain–computer interfaces and their security in cyber space. ACM Comput. Surv. 53, 1–38 (2020). [10] Belkacem, A. N. Cybersecurity framework for P300-based brain computer interface. in Proc. 2020 IEEE International Conference on Systems, Man, and Cybernetics (SMC) 1–6 (2020). [11] Bernal, S. L., Celdrán, A. H. & Pérez, G. M. Cybersecurity in brain–computer interfaces: state-of-the-art, opportunities, and future challenges. ACM Comput. Surv. 54, 1–35 (2021). [12] Bernal, S. L., Celdrán, A. H. & Pérez, G. M. Eight reasons to prioritize brain– computer interface cybersecurity. Commun. ACM 66, 68–78 (2023). [13] Bagley, B.-A., Rose, N., Kilbourn, Q. & Canham, M. Threat vectors and the state of the art in defense methods for security in neurotechnology. Preprint at 19

https://arxiv.org/abs/2607.10451 (2026). [14] Campisi, P. & La Rocca, D. Brain waves for automatic biometric-based user recognition. IEEE Trans. Inf. Forensics Secur. 9, 782–800 (2014). [15] Ruiz-Blondet, M. V., Jin, Z. & Laszlo, S. CEREBRE: a novel method for very high accuracy event-related potential biometric identification. IEEE Trans. Inf. Forensics Secur. 11, 1618–1629 (2016). [16] Barachant, A., Bonnet, S., Congedo, M. & Jutten, C. Classification of covariance matrices using a Riemannian-based kernel for BCI applications. Neurocomputing 112, 172–178 (2013). [17] Wang, M., Hu, J. & Abbass, H. A. BrainPrint: EEG biometric identification based on analyzing brain connectivity graphs. Pattern Recognit. 105, 107381 (2020). [18] Zhang, S., Sun, L., Mao, X., Hu, C. & Liu, P. Review on EEG-based authentication technology. Comput. Intell. Neurosci. 2021, 5229576 (2021). [19] Bernal, S. L., Celdrán, A. H. & Pérez, G. M. Neuronal jamming cyberattack over invasive BCIs affecting the resolution of tasks requiring visual capabilities. Comput. Secur. 112, 102534 (2022). [20] Wu, D. et al. Adversarial attacks and defenses in physiological computing: a systematic review. Natl. Sci. Open 2, 20220023 (2022). [21] Yi, H., Ming, Y., Liu, D. & Kong, W. Time-frequency jointed imperceptible adversarial attack to brainprint recognition with deep learning models. in Proc. IEEE International Conference on Multimedia and Expo (ICME) https://doi.org/ 10.1109/ICME57554.2024.10688012 (2024). [22] Hartmann, K. G., Schirrmeister, R. T. & Ball, T. EEG-GAN: generative adversarial networks for electroencephalographic (EEG) brain signals. Preprint at https: //arxiv.org/abs/1806.01875 (2018). [23] Thanwerdas, Y. & Pennec, X. O(n)-invariant Riemannian metrics on SPD matrices. Preprint at https://arxiv.org/abs/2109.05768 (2021). [24] Arsigny, V., Fillard, P., Pennec, X. & Ayache, N. Geometric means in a novel vector space structure on symmetric positive-definite matrices. SIAM J. Matrix Anal. Appl. 29, 328–347 (2007). [25] Arias-Cabarcos, P., Habrich, T., Becker, K., Becker, C. & Strufe, T. Inexpensive brainwave authentication: new techniques and insights on user acceptance. in Proc. 30th USENIX Security Symposium 55–72 (2021). [26] Maiorana, E., Hine, G. E., La Rocca, D. & Campisi, P. On the vulnerability of an EEG-based biometric system to hill-climbing attacks: algorithms’ comparison 20

and possible countermeasures. in Proc. IEEE Sixth International Conference on Biometrics: Theory, Applications and Systems (BTAS) https://doi.org/10.1109/ BTAS.2013.6712726 (2013). [27] Kingma, D. P. & Welling, M. Auto-encoding variational Bayes. Preprint at https: //arxiv.org/abs/1312.6114 (2014). [28] Williams, R. J. Simple statistical gradient-following algorithms for connectionist reinforcement learning. Mach. Learn. 8, 229–256 (1992) [29] Papernot, N. et al. Practical black-box attacks against machine learning. in Proc. ACM Asia Conference on Computer and Communications Security (AsiaCCS) 506–519 (2017). [30] Carlini, N. & Wagner, D. Towards evaluating the robustness of neural networks. in Proc. IEEE Symposium on Security and Privacy (S&P) 39–57 (2017). [31] Zhang, X. & Wu, D. On the vulnerability of CNN classifiers in EEG-based BCIs. IEEE Trans. Neural Syst. Rehabil. Eng. 27, 814–825 (2019). [32] Zhang, Y. et al. A longitudinal EEG dataset of event-related potential. Sci. Data 12, 1069 https://doi.org/10.1038/s41597-025-05378-x (2025) [33] Won, K., Kwon, M., Ahn, M. & Jun, S. C. EEG dataset for RSVP and P300 speller brain–computer interfaces. Sci. Data 9, 388 https://doi.org/10.1038/ s41597-022-01509-w (2022). [34] Wang, Y., Duan, W., Dong, D., Ding, L. & Lei, X. A test-retest resting, and cognitive state EEG dataset during multiple subject-driven states. Sci. Data 9, 566 https://doi.org/10.1038/s41597-022-01607-9 (2022). [35] Hinss, M. F. et al. Open multi-session and multi-task EEG cognitive dataset for passive brain–computer interface applications. Sci. Data 10, 85 https://doi.org/ 10.1038/s41597-022-01898-y (2023). [36] Cho, H., Ahn, M., Ahn, S., Kwon, M. & Jun, S. C. EEG datasets for motor imagery brain–computer interface. GigaScience 6, gix034 https://doi.org/10.1093/ gigascience/gix034 (2017). [37] Lee, M.-H. et al. EEG dataset and OpenBMI toolbox for three BCI paradigms: an investigation into BCI illiteracy. GigaScience 8, giz002 https://doi.org/10.1093/ gigascience/giz002 (2019).

21

Supplementary Information for: Adversarial Vulnerabilities of Neural Biomarker Identification Systems Polina Tapal, Bryce-Allen Bagley

This document contains Supplementary Notes 1–11, Supplementary Tables 1–14, and Supplementary Figures 1–10, referenced from the main text. All datasets, methods, and terminology follow the definitions given in the main text.

Supplementary Note 1: Attack taxonomy Neural-signal attacks do not reduce to a single adversarial goal. We identify three qualitatively distinct threat types, each with different objectives and implications for system design. Type I: Identity impersonation. The attacker holds a donor recording from subject i and wishes to be accepted by the system under a different claimed identity k ′ ̸= i. This is the attack studied experimentally in the main text. Perturbation-based forgery is motivated on two independent grounds. First, it is geometrically necessary wherever the feature space genuinely separates identities. On RSVP and motor imagery, replaying subject i’s recording under a false claimed identity k ′ fails even with no replay detector in place, because the victim’s natural covariance geometry aligns with the genuine template µi rather than the impostor template µk′ (zero-effort FAR ≤ 0.111, main text Table 2); the attack must shift the query vector away from the genuine cluster and toward µk′ , which bare replay does not do. This premise fails on resting-state, where the per-subject clusters overlap so heavily that an unmodified recording is accepted 81–90% of the time. This failure is the central result rather than an assumption of this taxonomy. Second, perturbation evades replay detection, since systems that flag identical or near-identical repeated submissions would trivially reject an unmodified replay, whereas each perturbed trial appears as a fresh, novel recording. Type II: Session replay. The attacker holds a recording of victim i and wishes to be accepted as i without modification. Unlike Type I, geometric displacement is not required, since the genuine covariance structure already matches µi . The adversarial challenge here is purely operational – bypassing liveness checks or session freshness constraints, rather than signal-level. This attack type is outside the scope of the main text. Type III: Cognitive state falsification. The attacker does not target authentication but instead wishes to make a victim’s neural recording misrepresent their mental state, for instance, shifting an ERP to resemble the signature of a psychiatric condition, an altered attentional state, 1

or a covert response to a stimulus the victim was not exposed to. This threat is closer to neural evidence tampering than to biometric spoofing, and shares the perturbation machinery of Type I attacks while targeting a diagnostic or forensic classifier rather than an identity verifier. We note this type here for completeness; a formal treatment is deferred to future work.

Supplementary Note 2: Feature extraction and classifier – extended detail Affine-invariant metric. At a point Cov, the affine-invariant inner product is ⟨A, B⟩Cov = tr(Cov−1 A Cov−1 B). Because this varies with Cov, the SPD manifold has non-zero curvature and cannot be treated as flat, motivating the Log-Euclidean linearisation used throughout the main text. q · µk ′ , bounded in [−1, 1]; since all ∥q∥ ∥µk′ ∥ vectors are already ℓ2 -normalised, this is simply the dot product on SD−1 , giving τ a geometrically interpretable meaning as a minimum acceptable angle.

Verification score. Cosine similarity is sim(q, µk′ ) =

Rationale for avoiding deep learning. Deep classifiers achieve higher nominal accuracy on benchmark EEG datasets but are known to overfit severely under the small per-subject trial counts typical of biometric protocols. More importantly for this evaluation, a learned decision boundary would conflate the adversarial surface of the classifier with that of the feature space; nearestcentroid and GNB (main text) were chosen so that all attack effectiveness is attributable to SPDgeometry displacement rather than classifier-specific learned artefacts. Adversarially-trained deep embeddings have shown improved cross-session stability, but that direction targets representation learning under distribution shift rather than resilience to a black-box impersonation attacker, and reintroduces the classifier-conflation problem motivating our choice above.

Supplementary Note 3: Feature extractor comparison Three feature extractors are evaluated across all six datasets with all other pipeline components held fixed (nearest-centroid classifier, cosine similarity, threshold calibration, UCB attack, Niter = 1000, λ = 0.3): (i) Riemannian: log-covariance upper-triangular ℓ2 -normalised vector as in the main text; (ii) Euclidean: raw covariance upper-triangular ℓ2 -normalised vector, without the log-map; (iii) PSD: per-channel Welch band powers (δ, θ, α, β; fs = 250 Hz, nseg = min(T, 256)), ℓ2 normalised. The log-map is load-bearing on RSVP and motor imagery: omitting it (Euclidean) or replacing covariance with marginal band power (PSD) increases EER by a factor of 2.2–5.6× on Zhang, Won, Cho, and Lee. On resting-state, all three extractors are comparably poor, confirming that the vulnerability there is structural rather than a property of the Riemannian representation. The ∆ column shows a pattern orthogonal to the EER comparison: lift is positive on RSVP under all three extractors (+0.014 to +0.053) and negative on every resting-state pair, so the attack gains acceptance only where the feature space is discriminative to begin with. Wherever baseline FAR is already high, whether through an inferior extractor (Euclidean and PSD on motor imagery, base 2

Table 1: Supplementary Table 1. Feature extractor comparison: EER, zero-effort FAR (p=10; “Base FAR”, the rate at which an unmodified impostor trial is accepted), UCB adversarial FAR (p=10), and attacker lift ∆ = Adv. FAR − Base FAR across all eight streams. Dataset

Feature

EER

Base FAR

Adv. FAR

∆

Zhang

Riemannian Euclidean PSD

0.154 0.341 0.365

0.103 0.517 0.573

0.135 0.542 0.603

+0.032 +0.025 +0.030

Won

Riemannian Euclidean PSD

0.153 0.393 0.440

0.111 0.640 0.756

0.162 0.693 0.770

+0.051 +0.053 +0.014

Wang-EO

Riemannian Euclidean PSD

0.389 0.388 0.310

0.818 0.791 0.576

0.784 0.775 0.527

−0.034 −0.016 −0.049

Wang-EC

Riemannian Euclidean PSD

0.345 0.347 0.340

0.812 0.823 0.588

0.760 0.766 0.575

−0.052 −0.057 −0.013

COG-BCI-EO

Riemannian Euclidean PSD

0.492 0.495 0.468

0.896 0.903 0.879

0.857 0.870 0.809

−0.039 −0.033 −0.070

COG-BCI-EC

Riemannian Euclidean PSD

0.391 0.390 0.346

0.842 0.819 0.640

0.788 0.784 0.592

−0.054 −0.035 −0.048

Cho

Riemannian Euclidean PSD

0.066 0.314 0.368

0.000 0.809 0.739

0.000 0.734 0.616

0.000 −0.075 −0.123

Lee

Riemannian Euclidean PSD

0.076 0.325 0.313

0.074 0.719 0.663

0.054 0.658 0.617

−0.020 −0.061 −0.046

FAR 0.66–0.81) or through the paradigm itself (all three extractors on resting-state), the UCB attack adds no displacement over an already-permissive feature space. We note that two confounds apply: (i) Dimensionality: Riemannian and Euclidean features have dimension D = C(C + 1)/2 (528 or 496); PSD features have dimension 4C (128 or 124). PSD’s lower dimensionality partially confounds its worse EER. (ii) Bandpass filtering: RSVP signals are bandpassed to 1–10 Hz, eliminating the α and β PSD bands; resting state and motor imagery retain all four bands (1–30 Hz), yet PSD still collapses to EER 0.31–0.37 on both Cho and Lee, ruling out bandpass truncation as the explanation and implicating the absence of cross-channel structure in marginal spectral features.

3

Supplementary Note 4: Generative attacker architectures VAE attacker Given a victim trial X, an encoder network maps the flattened signal to a posterior q(z | X) = N (µ(X), diag(σ 2 (X))) in R32 ; a decoder maps samples z ∼ q(z | X) to a perturbation δ ∈ RC×T , yielding X ′ = X + δ. Both networks are two-hidden-layer MLPs with ELU activations (256 units for RSVP and resting-state; 128 for motor imagery, where the flattened input reaches 32,000 dimensions). Perturbation magnitude is initialised relative to the RMS amplitude of X. Training proceeds via REINFORCE with an exponential moving-average baseline (coefficient 0.05) and a KL term β DKL (q∥N (0, I)), β = 10−3 , to prevent posterior collapse; gradients are clipped at unit norm. The stochastic posterior provides exploration: each forward pass samples a different perturbation direction. A GAN is ruled out in the black-box setting because minimax training requires gradients through the discriminator, unavailable when the authenticator returns only accept/reject; REINFORCE instead estimates the policy gradient from the scalar reward directly. Latent dimension and β were chosen to keep gradient variance tractable while preserving posterior conditioning on X; hidden width is halved for motor imagery to maintain comparable per-iteration training time. X µ X ∈ RC×T

z

+

x = vec(X) Encoder

σ⊙ε

MLP log σ 2

Decoder MLP

×

δ ∈ RC×T

+

X′

Authenticator (black-box) sim(ϕ(X ′ ), µk′ ) ≥ τ

reward rt

ε ∼ N (0, I)

REINFORCE ∇θ L

Figure 1: Supplementary Figure 1. VAE-based perturbation generator. The encoder maps a flattened victim trial x = vec(X) to a posterior q(z | X) = N (µ, diag(σ 2 )) in R32 ; a sample z = µ + σ ⊙ ε is decoded to a perturbation δ and added to X to form the forged trial X ′ . The authenticator is queried in black-box fashion; the scalar dual reward rt updates both networks via REINFORCE (dashed path). Hidden width H = 256 for RSVP and resting-state; H = 128 for motor imagery.

Surrogate-gradient GAN (SGAN) Standard GAN training requires gradients to flow from the discriminator’s loss back through the generator; propagating them through logm (Cov) is possible in principle, since the eigendecomposition it requires is differentiable, but doing so presumes the attacker can access and differentiate the deployed feature pipeline, which is a white-box capability outside the threat model of §2.1. The attacker instead trains a small differentiable surrogate Sθ : RC×T × RD → R on enrollment data (the same recording already available to the VAE attacker) to approximate sim(ϕ(X ′ ), µk′ ) end-to-end: a three-hidden-layer MLP (128 units, ELU) fitted by MSE regression on triples (Xi , µk , sim(ϕ(Xi ), µk )) for all enrollment trials and target templates, then frozen before the attack begins.

4

With Sθ frozen, a VAE generator G (architecture as above) and a discriminator D (two-hiddenlayer MLP on flattened X, 64 units) are trained simultaneously via true backpropagation (Supplementary Fig. 2), following the surrogate-model attack paradigm with a GAN adversarial term and a Carlini–Wagner-style soft perturbation-norm penalty: ∥δ∥F + λd BCE(D(X ′ ), 1) + β DKL (q ∥ N (0, I)), ∥X∥F LD = BCE(D(Xgen ), 1) + BCE(D(X ′ ), 0), LG = −(1 − λ) Sθ (X ′, µk′ ) + λ

(1) (2)

where X ′ = X + δ, δ = G(X), λ = 0.3, λd = 0.3, β = 10−3 , and BCE(p, y) = −[y log p + (1 − y) log(1 − p)]. D classifies genuine versus adversarial raw EEG; G fools both Sθ (cross the acceptance boundary) and D (appear genuine). FAR is measured on the real Riemannian authenticator throughout. ∇G LS (real gradient)

trained offline on enrollment data

Sθ (frozen)

µk′

X

x = vec(X)

X ∈ RC×T

Generator G (unconditional, backprop)

+

δ

X′

Discriminator D

genuine → 1

∇G LD (real gradient)

Xgen (genuine)

Authenticator (eval only)

FAR

Figure 2: Supplementary Figure 2. Surrogate-gradient GAN (SGAN). Sθ is trained offline on enrollment data (MSE regression to sim(ϕ(X), µk′ )) and frozen during the attack. Unlike Supplementary Fig. 1, both Sθ and D propagate real gradients back to G (solid red, Eqs. (1)–(2)); no REINFORCE is used. D is simultaneously trained to distinguish genuine from adversarially perturbed raw EEG. FAR is evaluated on the real Riemannian authenticator (dashed box, no gradient) for comparability with UCB and VAE baselines.

Supplementary Note 5: Lambda sensitivity of UCB arm preference Supplementary Table 2 reports the best UCB arm and adversarial FAR at p = 10 across λ ∈ {0, 0.1, 0.3, 0.5} for all eight evaluation streams. Three findings are consistent across datasets: (i) FAR is insensitive to λ: the maximum change across the sweep is 0.073 (Won, RSVP), and for resting-state and motor imagery streams the change is at most 0.025. The main text’s reported FAR values at λ = 0.3 are therefore representative of the full range. (ii) The paradigm-level arm-family finding is stable: resting-state streams converge to geometric arms at every λ; motor imagery streams show no dominant arm; RSVP streams select noisebased or interpolation arms. No choice of λ reverses this ordering. 5

(iii) λ affects which geometric arm wins within the resting-state group. At λ = 0 (pure acceptance reward), covariance interpolation dominates across three of the four streams because it achieves the highest raw acceptance rate; on COG-BCI-EO, eigenvalue perturbation leads instead, though it too is a direct SPD-manipulation arm. At λ ≥ 0.3, channel coupling displaces the leading arm on all four streams because it achieves comparable FAR at smaller perturbation cost, yielding higher dual reward.

6

Table 2: Supplementary Table 2. UCB arm preference and adversarial FAR at p = 10 across λ ∈ {0, 0.1, 0.3, 0.5}. λ = 0 is pure acceptance reward; λ = 0.3 is the setting used throughout the main text. FAR values differ slightly from main-text Table 3 because each λ condition was run with an independently initialised random seed, whereas the main analysis runs all p values sequentially with a shared seed; differences are within the per-dataset standard deviation reported there. Dataset

Best arm

FAR

0 (acceptance only) 0.1 0.3 0.5 0 0.1 0.3 0.5

Cov. interp. Gauss. noise Gauss. noise Gauss. noise Cov. interp. Temporal dist. Cov. interp. Corr. noise

0.143 0.129 0.136 0.141 0.188 0.174 0.126 0.115

0 0.1 0.3 0.5 0 0.1 0.3 0.5 0 0.1 0.3 0.5 0 0.1 0.3 0.5

Cov. interp. Cov. interp. Chan. coupling Chan. coupling Cov. interp. Cov. interp. Chan. coupling Chan. coupling Eigenval. pert. Cov. interp. Chan. coupling Chan. coupling Cov. interp. Cov. interp. Chan. coupling Chan. coupling

0.800 0.786 0.775 0.776 0.776 0.771 0.770 0.764 0.876 0.869 0.868 0.864 0.785 0.779 0.782 0.787

Motor imagery Cho 0 0.1 0.3 0.5 Lee 0 0.1 0.3 0.5

Corr. noise Corr. noise Corr. noise Gauss. noise Gauss. noise Gauss. noise Gauss. noise Gauss. noise

0.002 0.001 0.000 0.001 0.061 0.069 0.067 0.063

RSVP Zhang

Won

Resting-state Wang-EO

Wang-EC

COG-BCI-EO

COG-BCI-EC

λ

7

Supplementary Table 3: Mann-Whitney U test results Table 3: Supplementary Table 3. Mann-Whitney U test comparing best vs. worst UCB arm at p = 10 (nearest-centroid classifier). Dataset RSVP Zhang Won Resting-state Wang-EO Wang-EC COG-BCI-EO COG-BCI-EC Motor imagery Cho Lee

Best arm

Worst arm

r̄b

r̄w

Test

Gauss. noise Cov. interp.

Eigenval. pert. Eigenval. pert.

0.431 0.359

0.019 0.067

p < 0.001 p < 0.001

Chan. coupling Chan. coupling Chan. coupling Chan. coupling

Gauss. noise Gauss. noise Gauss. noise Gauss. noise

0.838 0.830 0.892 0.838

0.000 0.000 0.000 0.000

p < 0.001 p < 0.001 p < 0.001 p < 0.001

Corr. noise Gauss. noise

Eigenval. pert. Eigenval. pert.

0.300 0.356

0.000 0.009

p < 0.001 p < 0.001

Supplementary Note 6: Dataset details and preprocessing RSVP datasets Zhang et al. dataset The Zhang dataset contains EEG recordings from NZ = 15 participants collected across four longitudinal sessions: Day 1, Day 7, Day 80, and Day 200. In each session, participants performed an RSVP face-image task: a stream of photographs was presented at 5 Hz and subjects counted occurrences of a target face (self-face). The EEG was recorded at 1000 Hz with 57 active electrodes (BrainProducts actiCHamp). We band-pass filtered the continuous signal at 1–10 Hz (IIR, zero-phase), extracted epochs from −50 ms to +594 ms relative to stimulus onset (so that after resampling to 250 Hz the epoch contains exactly ⌊(0.050 + 0.594) × 250⌋ = 162 samples, with the last sample at −50 + 161 × 4 = 594 ms), applied baseline correction over the pre-stimulus interval, resampled to 250 Hz, and restricted the channel set to the 32 electrodes shared with the Won dataset (see below). All four sessions are retained; each is treated as an independent evaluation unit (enrollment and verification trials drawn from the same session), yielding 15 × 4 = 60 session-level splits. Won et al. dataset The Won dataset provides single-session EEG recordings from NWo = 55 participants using a 32channel Biosemi ActiveTwo system at 512 Hz. The paradigm was a P300 letter-speller, subjects attended a matrix of characters presented via RSVP and silently counted target letters. Unlike the Zhang face task, which primarily engages the N170/P300 complex (reflecting both face-selective and cognitive processing), the speller paradigm elicits a pure P300 (cognitive target-detection only), making Won a complementary benchmark for testing cross-stimulus generalisability of our adversarial framework. Preprocessing followed the same pipeline as Zhang. Amplitude values were 8

scaled from MNE’s native Volt representation to microvolts (×106 ) to match the Zhang recording convention. Normalisation step To normalise the subject count between datasets, we subsample N = 15 participants from Won at random (seed 42). Because Won provides only a single recording session per participant, each of the 15 subjects contributes one session-level split; cross-dataset comparisons are therefore based on equal cohort sizes (15 subjects per dataset) but unequal session counts (4 vs. 1), which we note when interpreting longitudinal effects. Won’s 32 Biosemi channel labels were mapped to the Zhang naming convention (e.g., FP1→Fp1) and the Zhang recordings were restricted to the same 32-electrode subset. The resulting feature space is identical for both datasets: C = 32 channels, T = 162 time samples, spatial log-covariance vectors of dimension D = 528.

Resting state datasets Wang et al. dataset The Wang dataset contains resting-state EEG from NWa = 60 participants recorded across three sessions, where first and second sessions are separated by 90 minutes (within the same day), and session 3 is recorded one month later. Each session comprises two five-minute resting-state blocks, an eyes-open (EO) condition, in which participants fixated a central point, and an eyes-closed (EC) condition. EEG was recorded at 500 Hz with 62 channels (BrainProducts actiCHamp; FCz online reference). The two resting-state conditions are evaluated as two fully independent datasets, denoted Wang-EO and Wang-EC. Because the paradigm produces no stimulus events, the epochextraction and baseline-correction steps of the ERP pipeline are replaced by the following: after bandpass filtering and resampling to 250 Hz, the continuous recording is segmented into nonoverlapping 162-sample windows (648 ms), yielding approximately 462 trials per five-minute block. No baseline correction is applied, as there is no pre-stimulus period. Channel selection is restricted to a 31-electrode subset; electrode CP5 is excluded to maintain a consistent layout with the Hinss et al. dataset, where CP5 is absent in five of the twenty retained participants (see below). The resulting trial format is X ∈ R31×162 , and the full Riemannian covariance pipeline is applied without modification. Hinss et al. dataset The COG-BCI dataset contains EEG recordings from NH = 29 participants across three sessions spaced one week apart, providing a shorter test-retest interval than Wang et al. (90 min and one month) and a complementary reliability timescale. Each session includes a two-minute restingstate block, one minute of eyes-open fixation followed by one minute of eyes-closed rest, recorded both at the start and end of the session. We use the session opening block only, yielding one EO and one EC recording per session per participant, consistent with how the Wang et al. conditions are structured. EEG was recorded at 500 Hz with 64 active Ag-AgCl electrodes (ActiCap, Brain Products GmbH), referenced online to Fpz. One caveat: electrode Cz was not recorded for participants 1–9; these participants are excluded from analysis, leaving NH = 20 complete participants. Preprocessing follows the same pipeline as Wang et al.: bandpass 1–30 Hz (IIR zero-phase), resample to 250 Hz, restrict to a 31-channel subset of the Won electrode set (CP5 absent in five of the twenty retained participants and therefore excluded globally for consistency), segment into 9

non-overlapping 162-sample windows with no baseline correction. One minute of resting EEG at 250 Hz yields approximately 92 trials per condition per session, substantially fewer than Wang et al.’s 462; this should be borne in mind when comparing per-subject variance across datasets. Normalisation step To equalise subject counts within the resting-state pair, we subsample N = 20 participants from Wang et al. (seed 42), matching the 20 complete participants retained from Hinss et al. after excluding those without a Cz electrode. Both datasets provide three sessions per participant, so each subject contributes three session-level splits. Channel selection is handled at preprocessing; recordings are restricted to the 31-electrode Won subset prior to covariance extraction, with channel matching performed case-insensitively. The resulting feature space uses C = 31 channels, T = 162 time samples, and log-covariance vectors of dimension D = C(C + 1)/2 = 496. The resting-state pair therefore differs from the RSVP pair (C = 32, D = 528) by one electrode; because all analyses are conducted within-dataset, this does not affect cross-paradigm comparisons.

Motor imagery datasets Cho et al. dataset The Cho dataset contains EEG recordings from NC = 52 participants performing left- and righthand motor imagery in a single session. EEG was recorded at 512 Hz with 64 channels (Biosemi ActiveTwo; channels 65–68 are EMG and are discarded). Each participant completed 100 left-hand and 100 right-hand imagery trials. Trial structure: a 2 s pre-cue baseline, a cue onset, then a 4 s imagery window. We extract the imagery window only (0 to +4 s post-cue, 2048 samples at 512 Hz), pool left and right trials, and apply the following preprocessing to the concatenated per-condition signal: bandpass filter at 1–30 Hz (IIR zero-phase, 4th-order Butterworth), restrict to the 32 Won channels (all present in Cho’s layout), resample to 250 Hz, then reshape into 1000-sample per-trial windows. The resulting trial format is X ∈ R32×1000 . Lee et al. dataset The Lee dataset contains EEG recordings from NL = 54 participants across two sessions, recorded at 1000 Hz with 62 channels. Each session is divided into a training run (100 trials) and a test run (100 trials); both runs are pooled, yielding 200 imagery trials per session. Data are provided preepoched as arrays of shape (4000 × 100 × 62) (samples × trials × channels). As per preprocessing, all 200 trials are end-to-end concatenated, bandpass filter applied at 1–30 Hz (IIR zero-phase), restricted to the 32 Won channels (all present in Lee’s 62-channel layout), resampled to 250 Hz, and reshaped into 1000-sample per-trial windows. The resulting trial format is X ∈ R32×1000 , identical to Cho. Normalisation step We subsample N = 20 participants from each dataset (seed 42), matching the cohort sizes of both prior paradigm pairs. Cho contributes one session-level split per subject; Lee contributes two. The feature space is C = 32 channels, T = 1000 time samples, and log-covariance vectors of dimension D = 528, identical to the RSVP pair. Note that the trial length (T = 1000 vs. T = 162 for RSVP and resting-state) differs across paradigms; all covariance computations are performed within-dataset, so this does not affect cross-paradigm comparisons.

10

Supplementary Tables 4–6: Baseline performance, full breakdown Table 4: Supplementary Table 4. Baseline authentication error rates, RSVP (mean ± std, N = 15). Dataset

pEER

EER

FRR (p=10)

FAR (p=10)

Zhang Won

6 8

0.154 0.153

0.237 ± 0.312 0.171 ± 0.204

0.103 ± 0.223 0.111 ± 0.251

Table 5: Supplementary Table 5. Baseline authentication error rates, resting-state (mean ± std, N = 20, C = 31). Dataset

pEER

EER

FRR (p=10)

FAR (p=10)

Wang-EO Wang-EC COG-BCI-EO COG-BCI-EC

38 34 50 36

0.389 0.345 0.492 0.391

0.104 ± 0.221 0.103 ± 0.202 0.096 ± 0.118 0.105 ± 0.228

0.818 ± 0.298 0.812 ± 0.250 0.896 ± 0.128 0.842 ± 0.260

Table 6: Supplementary Table 6. (mean ± std, N = 20, C = 32). Dataset Cho Lee

Baseline authentication error rates, motor imagery

pEER

EER

FRR (p=10)

FAR (p=10)

4 8

0.066 0.076

0.108 ± 0.092 0.112 ± 0.160

0.000 ± 0.000 0.074 ± 0.151

11

Supplementary Tables 7–9: Adversarial FAR across operating points Table 7: Supplementary Table 7. Adversarial FAR under UCB attack, RSVP (mean ± std, N = 15, λ = 0.3). Dataset

p=5

p = 10

p = 15

p = 20

p = 25

Zhang Won

0.237 ± 0.155 0.196 ± 0.081

0.135 ± 0.119 0.162 ± 0.068

0.098 ± 0.089 0.128 ± 0.063

0.070 ± 0.078 0.096 ± 0.061

0.041 ± 0.044 0.075 ± 0.048

Table 8: Supplementary Table 8. Adversarial FAR under UCB attack, resting-state (mean ± std, N = 20, λ = 0.3). Dataset Wang-EO Wang-EC COG-BCI-EO COG-BCI-EC

p=5

p = 10

p = 15

p = 20

p = 25

0.891 ± 0.208 0.880 ± 0.198 0.931 ± 0.036 0.914 ± 0.162

0.784 ± 0.256 0.760 ± 0.241 0.857 ± 0.147 0.788 ± 0.262

0.706 ± 0.281 0.666 ± 0.267 0.806 ± 0.214 0.714 ± 0.300

0.653 ± 0.294 0.569 ± 0.276 0.757 ± 0.265 0.668 ± 0.322

0.573 ± 0.287 0.516 ± 0.307 0.695 ± 0.287 0.605 ± 0.318

Table 9: Supplementary Table 9. (mean ± std, N = 20, λ = 0.3). Dataset Cho Lee

Adversarial FAR under UCB attack, motor imagery

p=5

p = 10

p = 15

p = 20

p = 25

0.015 ± 0.027 0.138 ± 0.109

0.000 ± 0.000 0.054 ± 0.055

0.000 ± 0.000 0.043 ± 0.062

0.000 ± 0.000 0.028 ± 0.038

0.000 ± 0.000 0.017 ± 0.029

12

Supplementary Figures 3–10: Per-arm false acceptance rates

Figure 3: Supplementary Figure 3. Per-arm FAR at p = 10, nearest-centroid vs. GNB, Zhang (RSVP).

Figure 4: Supplementary Figure 4. Per-arm FAR at p = 10, nearest-centroid vs. GNB, Won (RSVP).

13

Figure 5: Supplementary Figure 5. Per-arm FAR at p = 10, nearest-centroid vs. GNB, WangEO (resting-state).

Figure 6: Supplementary Figure 6. Per-arm FAR at p = 10, nearest-centroid vs. GNB, WangEC (resting-state). Arms scoring 0.000 shown in light grey.

Figure 7: Supplementary Figure 7. Per-arm FAR at p = 10, nearest-centroid vs. GNB, COGBCI-EO (resting-state). 14

Figure 8: Supplementary Figure 8. Per-arm FAR at p = 10, nearest-centroid vs. GNB, COGBCI-EC (resting-state). Arms scoring 0.000 excluded.

Figure 9: Supplementary Figure 9. Per-arm FAR at p = 10, nearest-centroid vs. GNB, Cho (motor imagery). All arms at 0.000.

Figure 10: Supplementary Figure 10. Per-arm FAR at p = 10, nearest-centroid vs. GNB, Lee (motor imagery). 15

Supplementary Table 10: Discriminator detection performance Table 10: Supplementary Table 10. Discriminator D detection performance at p = 10 (threshold = 0.5). AUROC near 0.5 across all streams reflects minimax equilibrium: G is trained to fool D, driving D toward chance on adversarial samples. Dataset

TPR

TNR

AUROC

Zhang Won

0.645 0.525

0.410 0.550

0.562 0.543

Wang-EO Wang-EC COG-BCI-EO COG-BCI-EC

0.395 0.580 0.890 0.045

0.605 0.420 0.110 0.955

0.496 0.498 0.498 0.500

Cho Lee

0.460 0.515

0.650 0.520

0.595 0.529

Supplementary Note 7: Cross-session evaluation All results in the main text use within-session enrollment and verification: the template (or GNB model) and the test/attack trials are drawn from the same recording session. This is standard practice in EEG biometrics but is known to overstate real-world accuracy, since EEG drifts sessionto-session (electrode placement, skin conductivity, fatigue). We supplement the main evaluation with a cross-session protocol: enrollment uses all trials from a subject’s first recorded session; each later session is evaluated separately (not pooled), so different retest gaps are never blended. The attacker’s held recording is drawn from the same later session under test, not the enrollment session, a strictly harder setting than within-session, since the enrolled template is now built from an older, different day than both the genuine test trials and the attacker’s material. It requires ≥ 2 sessions per participant; Won and Cho are single-session and are therefore excluded. Zhang (4 sessions) yields three retest gaps (Day 1→7, Day 1→80, Day 1→200); Wang and COG-BCI (3 sessions each) yield two per condition; Lee (2 sessions) yields one – 12 session-gap points × 2 classifiers. Supplementary Table 11 reports EER and adversarial FAR at p = 10 for every pair. Two findings stand out. First, resting-state stays highly permissive under cross-session enrollment for both classifiers, with the identical geometric attack family (covariance interpolation, eigenvalue perturbation) winning in every case: the paradigm-level vulnerability found in the main text’s within-session evaluation is not an artefact of template freshness. Second, GNB’s near-zero adversarial FAR on Zhang and Lee under cross-session must be read alongside its baseline EER, which collapses to near-chance there (0.46–0.50, against nearest-centroid’s 0.31–0.35 on the same pairs): with baseline discrimination this poor, there is no additional gain for an attack to exploit, and the near-zero adversarial FAR does not indicate genuine stability in the same sense as the within-session GNB results (main text). Nearest-centroid, by contrast, degrades in the way a biometric normally does across a session gap rather than collapsing: on Lee its EER rises from 0.076 within-session to 0.354, still well short of the 0.5 chance level, while its adversarial FAR is essentially unchanged (0.055 against 0.054). Attack resistance therefore survives the session gap even where discriminability is reduced, which is the more credible cross-session stability claim. 16

Table 11: Supplementary Table 11. Cross-session evaluation: enrollment on the first session, tested against each later session separately. EER and adversarial FAR (UCB, p = 10) for nearestcentroid (NC) and GNB. Dataset

Enrol → Test

Zhang Zhang Zhang

NC EER

NC Adv. FAR

GNB EER

GNB Adv. FAR

Day 1 → Day 7 Day 1 → Day 80 Day 1 → Day 200

0.314 0.306 0.335

0.119 0.099 0.039

0.488 0.495 0.493

0.000 0.000 0.000

Wang-EO Wang-EO Wang-EC Wang-EC COG-BCI-EO COG-BCI-EO COG-BCI-EC COG-BCI-EC

session1 → session2 session1 → session3 session1 → session2 session1 → session3 S1 → S2 S1 → S3 S1 → S2 S1 → S3

0.624 0.631 0.409 0.441 0.708 0.678 0.275 0.251

0.723 0.770 0.779 0.810 0.893 0.867 0.735 0.737

0.489 0.528 0.438 0.504 0.730 0.726 0.502 0.527

0.627 0.667 0.532 0.564 0.848 0.804 0.764 0.761

Lee

session1 → session2

0.354

0.055

0.456

0.000

Supplementary Note 8: Extended discussion This note expands the defence-implications material summarised in the main text’s Discussion. RSVP challenge-response: protocol detail. At each verification attempt, the authenticator draws a fresh challenge St , a novel stimulus sequence with known target onset times {t1 , t2 , . . .}, and records the user’s ERP in real time. Verification applies two checks in sequence: (i) the logcovariance of the response matches the enrolled template µk (identity layer), and (ii) the P300 component is temporally consistent with St ’s target onsets (freshness layer). An attacker holding Xj , recorded to a prior challenge Sj , fails the freshness check: the P300 peaks are timed to Sj ’s targets, not St ’s. Forging a trial that passes both checks requires either capturing the victim’s live response to St , or synthesising subject-specific EEG conditioned on a novel, previously unseen stimulus sequence – an open problem. The identity layer requires that the enrolled template µk is stable across challenge types, so that a single enrolled template remains valid when the user responds to novel stimuli. Our cross-dataset results provide direct evidence for this: the same Riemannian covariance classifier achieves EER ≈ 0.154 on both the Zhang face-RSVP corpus and the Won letter-speller corpus, with nearly identical adversarial FAR magnitudes despite completely different stimulus paradigms. The freshness layer requires only that the target onset times in St are recorded by the authenticator and that the ERP pipeline can localise the P300 peak, both standard in RSVP systems. Formalising the stability bound on µk across challenge times, and characterising the minimum challenge-space size |DS | required to prevent pre-computation attacks, are the principal open questions we leave for future work. Resting state countermeasures. A direct countermeasure is to make the enrolled template a moving target: periodically refreshing µk from new sessions, or applying session-specific transformations to the template representation, would reduce the effectiveness of interpolation arms whose impostor anchor is drawn from a stale recording. More fundamentally, however, the high 17

baseline FAR (> 0.81 before any attack) reflects a geometric limitation of the paradigm itself: resting-state covariance distributions have high intra-subject trial-to-trial variability relative to inter-subject separation, and no threshold-level defence resolves this overlap. At each stream’s own equal-error-rate operating point (pEER ∈ {38, 34, 50, 36} for the four resting-state streams), the zero-effort FAR is still 0.345–0.492 by construction, so no threshold makes the system simultaneously usable and secure. The adaptive attacker adds nothing at that point either: adversarial FAR falls marginally below the zero-effort baseline on three of four streams (0.338 vs. 0.389 for Wang-EO; 0.444 vs. 0.492 for COG-BCI-EO; 0.365 vs. 0.391 for COG-BCI-EC), with Wang-EC the sole exception (0.370 vs. 0.345). The failure is therefore located in the paradigm rather than in the choice of operating point or in the attack: threshold tuning moves FAR and FRR against each other along a curve that is unusable at every point on it. Substantive stability improvements are therefore more likely to come from richer enrollment protocols (longer recordings, multi-session template averaging), session-invariant representation learning, or paradigm-assisted resting-state designs than from perturbation-specific countermeasures. Motor imagery: white-box escalation. White-box attacks, which compute the gradient of the authenticator score function sim(q, µk′ ) with respect to the input signal, could in principle find perturbation directions that cross the acceptance boundary with minimal Frobenius magnitude, bypassing the trial-variance floor that defeats black-box arms. Such attacks require access to the feature pipeline internals and fall outside the threat model studied in the main text, but formalising their effectiveness against motor imagery covariance authenticators is the natural next stage of the adversarial game for this paradigm. Discriminator as a standalone defence. The SGAN discriminator’s near-chance AUROC (0.496–0.595, Supplementary Table 10) is the expected outcome of the minimax formulation: G is trained adversarially to minimise BCE(D(X ′ ), 1), so joint training drives D toward its equilibrium output of ≈ 0.5 on adversarial samples by construction, not because perturbations are inherently undetectable. The TPR/TNR values at the 0.5 threshold reflect this collapse rather than genuine detection ability; extreme-looking values such as COG-BCI-EC (TPR= 0.045, TNR= 0.955) are threshold artefacts where D(x) ≈ 0.498 for essentially all inputs, classifying almost everything as adversarial rather than discriminating between classes. A passive detector trained offline on labelled genuine and adversarial samples, without simultaneous adversarial pressure from an actively-training G, would be the appropriate architecture for a standalone defence, since it would not be optimised against in the way D was here. Evaluating such a detector, and characterising whether its detection advantage survives when G is retrained with detector evasion added as an explicit objective (i.e. closing the loop into a proper adversarial game rather than a one-shot check), constitutes the natural next stage of the defensive game for all three paradigms.

Supplementary Note 9: Classifier generalisation extended (linear SVM) Section 3.3 of the main text compares nearest-centroid and GNB, two classifiers with no learned decision-boundary capacity, so that all attack effectiveness is attributable to the SPD feature geometry rather than to the classifier. In order to test whether a classifier that can learn an optimised decision boundary changes this picture, we repeat the full protocol (identical enrollment/test splits,

18

UCB bandit, arms, and dual reward) with a one-vs-all linear support vector machine (SVM, C = 1, class weight=’balanced’) fit on the same log-covariance features. Threshold calibration. With enrollment sets as small as 17 trials per participant against D = 528-dimensional features, a classifier with real learning capacity can memorise its own enrollment set; we therefore compute τ from cross-validated, out-of-fold decision-function scores on the enrollment set (5-fold, fewer where a participant’s actual count requires it), a step unnecessary for NC and GNB. Results. Supplementary Table 12 reports EER and adversarial FAR at p = 10 for all eight streams. On RSVP and motor imagery, the SVM’s learned boundary extracts more signal than either NC or GNB (EER as low as 0.006–0.014), confirming it is not constrained relative to the simpler classifiers when discriminative structure exists. On resting-state it gets no comparable traction, EER remains near chance (0.47–0.51) and adversarial FAR remains high (0.74–0.84) across all four streams, matching NC and GNB rather than improving on them, and the same attack arms (channel coupling, frequency manipulation, covariance interpolation) dominate as for NC/GNB. A classifier with the capacity to learn an optimised, non-geometric decision rule had every opportunity to exploit structure the simpler classifiers missed, yet did not. Table 12: Supplementary Table 12. Linear SVM: EER and adversarial FAR (UCB, p = 10), all eight streams, alongside NC and GNB (reproduced from Table 4 of the main text) for reference. EER

Adversarial FAR (p=10)

Dataset

NC

GNB

SVM

NC

GNB

SVM

Zhang Won

0.154 0.153

0.393 0.130

0.014 0.010

0.135 0.162

0.000 0.001

0.010 0.009

Wang-EO Wang-EC COG-BCI-EO COG-BCI-EC

0.389 0.345 0.492 0.391

0.330 0.285 0.454 0.400

0.514 0.473 0.496 0.487

0.784 0.760 0.857 0.788

0.619 0.575 0.811 0.732

0.754 0.740 0.841 0.834

Cho Lee

0.066 0.076

0.011 0.018

0.008 0.006

0.000 0.054

0.001 0.001

0.002 0.000

Supplementary Note 10: Attacker × classifier grid The main text evaluates all three attackers against nearest-centroid, and the UCB bandit against all three classifiers. Supplementary Table 13 completes the grid, adding the VAE and SGAN against GNB and the linear SVM. Enrollment/test splits, seed, reward, λ = 0.3, Niter = 1,000 and the operating-point grid are identical to the main evaluation; only the verification score the attacker is judged against changes, so each attacker’s threat model is unchanged from the main text. Two extensions were required. The SGAN surrogate is conditioned on the nearest-centroid template µk′ and regresses sim(ϕ(X), µk′ ); with ℓ2 -normalised features that score is the linear functional µk′ · q, and a linear SVM’s decision function wk′ · q + bk′ is another linear functional of the same dimension, so conditioning on wk′ transfers the architecture unchanged. A one-vs-all GNB is ∑︁ ∑︁ 2 2 − 1/σ 2 ) ′ ′ instead quadratic in q: its log-odds are d ak d qd + d bk d qd + ck′ with ak′ d = 12 (1/σ0d 1d 19

2 − µ /σ 2 , so the surrogate is conditioned on the concatenation (a ′ , b ′ ) and and bk′ d = µ1d /σ1d 0d k k 0d regresses those log-odds, a monotone transform of the posterior GNB returns and therefore decisionequivalent at every threshold. Acceptance is evaluated with the authenticator’s own score against τ throughout. The paradigm ordering is unchanged in all nine cells. Resting-state FAR remains between 0.58 and 0.89 for every attacker–classifier pair; in the cells reported here for the first time, motor imagery remains at or below 0.024, and RSVP remains the only paradigm in which the choice of attacker materially changes the outcome. One result does not transfer from nearest-centroid: against the linear SVM on RSVP the generative attackers reach FAR 0.188–0.204 where the UCB bandit reaches 0.009–0.010, reversing the sample-efficiency ordering reported in the main text for nearestcentroid. The bandit’s advantage on RSVP is therefore specific to a fixed-geometry decision rule; against a learned boundary the continuous optimisers locate directions the discrete arm families do not contain. These attacks are substantial, since the winning perturbation adds 32–48% of the original signal’s magnitude against the 5–6% that suffices on resting-state. Surrogate fidelity should be read alongside the SGAN columns. Measured as the Pearson correlation between Sθ and the true verification score over the training pairs, fidelity is moderate on RSVP and motor imagery (r = 0.54–0.73) but collapses on resting-state (r = 0.02–0.20 for GNB; −0.20–0.20 for the SVM). The resting-state SGAN cells are consequently not gray-box results in the intended sense, since the surrogate does not track the authenticator it stands in for; the null attacker lift on that paradigm rests on the UCB bandit and on the VAE, which requires no surrogate. A surrogate cannot learn to predict a score that barely varies with the claimed identity, so nearzero fidelity is a further symptom of the same degeneracy that makes an unmodified resting-state recording acceptable in the first place.

Table 13: Supplementary Table 13. Adversarial FAR at p=10 for every attacker × classifier pair (mean ± std across subjects, λ = 0.3, Niter = 1,000). Nearest-centroid columns and the UCB columns for GNB and SVM reproduce main-text Tables 3–4 and Supplementary Table 12; the remaining cells are reported here for the first time. Splits, seed, reward and operating points are identical throughout; only the verification score the attacker is judged against changes. Nearest-centroid

GNB

Linear SVM

Dataset

UCB

VAE

SGAN

UCB

VAE

SGAN

UCB

VAE

SGAN

Zhang Won

0.135 ± 0.119 0.162 ± 0.068

0.029 ± 0.029 0.000 ± 0.000

0.024 ± 0.033 0.000 ± 0.000

0.000 0.001

0.000 ± 0.000 0.000 ± 0.000

0.000 ± 0.000 0.000 ± 0.000

0.010 0.009

0.188 ± 0.342 0.192 ± 0.385

0.204 ± 0.370 0.195 ± 0.387

Wang-EO Wang-EC COG-BCI-EO COG-BCI-EC

0.784 ± 0.256 0.760 ± 0.241 0.857 ± 0.147 0.788 ± 0.262

0.798 ± 0.240 0.806 ± 0.205 0.889 ± 0.147 0.824 ± 0.245

0.813 ± 0.254 0.802 ± 0.213 0.883 ± 0.142 0.818 ± 0.249

0.619 0.575 0.811 0.732

0.615 ± 0.263 0.614 ± 0.261 0.832 ± 0.225 0.746 ± 0.296

0.636 ± 0.263 0.590 ± 0.269 0.830 ± 0.229 0.753 ± 0.294

0.754 0.740 0.841 0.834

0.766 ± 0.422 0.752 ± 0.420 0.863 ± 0.279 0.869 ± 0.300

0.765 ± 0.422 0.753 ± 0.419 0.862 ± 0.282 0.869 ± 0.306

Cho Lee

0.000 ± 0.000 0.054 ± 0.055

0.016 ± 0.063 0.049 ± 0.127

0.010 ± 0.042 0.114 ± 0.216

0.001 0.001

0.000 ± 0.000 0.012 ± 0.058

0.000 ± 0.000 0.001 ± 0.005

0.002 0.000

0.000 ± 0.000 0.013 ± 0.078

0.000 ± 0.000 0.024 ± 0.128

Supplementary Note 11: Cross-condition spoofing, full grid Supplementary Table 14 gives the complete stream-pair grid summarised in §3.4 of the main text, under the protocol described in main-text §2.4. Rows are the enrolled stream, columns the stream supplying donor trials; the diagonal is the within-stream reference. Because the common 31electrode montage and the trial cap differ from the main evaluation, that diagonal rather than main-text Tables 2–3 is the correct within-condition comparison. Where a donor’s passband is 20

wider than the enrolled stream’s, the identical filter is applied to both sides: a fourth-order zerophase filter has a transient comparable in length to a 162-sample trial, so filtering only the donor inflates acceptance on its own. Enrollment is capped at 400 trials per session; a replication at 100 trials agrees to within 0.03 on every paradigm-level mean. Two controls qualify the grid. Withholding the donor amplitude rescaling drives cross-paradigm acceptance against resting-state authenticators to exactly 0.000 for both RSVP and motor-imagery donors, against 0.483 and 0.435 with it, so gain matching is the step that makes cross-paradigm transfer available at all. Separately, the Won row is unreliable and no conclusion is drawn from it: its zero-effort FAR under the common montage is 0.211 against 0.111 in main-text Table 2, a shift attributable to the removal of CP5, which Zhang tolerates (0.092 against 0.103) and Won does not. Table 14: Supplementary Table 14. Cross-condition spoofing: adversarial FAR at p=10 (UCB, λ = 0.3, nearest-centroid) for every ordered stream pair. Rows are the enrolled stream, columns the donor stream; diagonal entries are the within-stream reference. Donor stream Enrolled

Zhang

Won

Wang-EO

Wang-EC

COG-EO

COG-EC

Cho

Lee

Zhang Won

0.146 0.008

0.024 0.247

0.026 0.092

0.040 0.102

0.005 0.055

0.010 0.074

0.010 0.098

0.085 0.421

Wang-EO Wang-EC COG-BCI-EO COG-BCI-EC

0.736 0.592 0.712 0.170

0.587 0.407 0.568 0.091

0.781 0.688 0.796 0.286

0.759 0.645 0.749 0.214

0.653 0.578 0.694 0.360

0.763 0.653 0.790 0.265

0.667 0.445 0.652 0.095

0.558 0.391 0.533 0.136

Cho Lee

0.000 0.000

0.000 0.000

0.000 0.000

0.000 0.000

0.000 0.000

0.000 0.000

0.005 0.067

0.000 0.029

21

Related documents

• Securing Deep Learning Hardware: A Survey of Side-Channel Vulnerabilities and Countermeasures#343393
• Cryptanalytic Extraction of Neural Networks Without Known Architecture Assumption#1160729
• Random Logit Scaling: Defending Deep Neural Networks Against Black-Box Score-Based Adversarial Example Attacks#373326
• Practical Black-Box Attacks against Machine Learning#133963
• Detection of adversarial attacks against robust AI systems#326195