Perturbing BEAMs: EEG adversarial attack to deep learning models for epilepsy diagnosing.

Area of Science:

• Neuroscience and Artificial Intelligence
• Medical Diagnostics and Machine Learning

Background:

• Deep learning models demonstrate high performance in electroencephalogram (EEG) analysis for diagnosing brain diseases.
• The safety-critical nature of medical applications necessitates thorough study of adversarial attacks and defenses for these models.
• Existing research has not fully explored the vulnerability of deep learning models in epilepsy diagnosis to adversarial manipulation.

Purpose of the Study:

• To investigate the vulnerability of deep learning models used in epilepsy diagnosis to white-box adversarial attacks.
• To propose novel methods for generating adversarial samples targeting brain electrical activity mappings (BEAMs) used in deep learning models.
• To evaluate the effectiveness of these adversarial samples in misleading deep learning diagnostic systems and to raise awareness for safer AI design.

Main Methods:

• Development of two methods, Gradient Perturbations of BEAMs (GPBEAM) and GPBEAM with Differential Evolution (GPBEAM-DE), to generate EEG adversarial samples by perturbing BEAMs.
• Experimentation using the CHB-MIT EEG dataset and two types of victim deep neural network (DNN) models (BEAMs-input and raw EEG-input).
• Analysis of attack success rates and distortion levels under different attack strategies and model architectures.

Main Results:

• BEAMs-based adversarial samples effectively misled BEAMs-input models (attack success rate up to 0.8) but were less effective against raw EEG-input models (success rate 0.01).
• GPBEAM-DE demonstrated superior performance over GPBEAM, achieving a higher attack success rate (0.8 vs. 0.59) under similar distortion constraints.
• A modified GPBEAM/GPBEAM-DE achieved high aggressiveness against both model types (success rates 0.8 and 0.64) without increasing distortion.

Conclusions:

• Deep learning models for epilepsy diagnosis, particularly those using BEAMs, exhibit significant vulnerability to adversarial attacks.
• The proposed GPBEAM and GPBEAM-DE methods can generate effective adversarial samples, highlighting potential safety risks in clinical deployment.
• The study underscores the need for robust adversarial defense mechanisms in AI-driven medical diagnostic systems to ensure patient safety and reliable diagnoses.