BCIwiki (bciwiki.com) — Compressing EEG decoders through pruning or low-precision quantization while preserving accuracy does not make them more robust to adversarial attacks, researchers Saim Rehman and Muhammad Shafique reported in a preprint posted to arXiv on September 24, 2026. The work has not been peer reviewed.
Using the public BCI Competition IV-2a motor imagery dataset across 9 subjects and 3 random seeds, the authors compared 32-bit floating-point (FP32) EEGNet and ShallowConvNet models with versions produced by global magnitude pruning and by simulated INT8 post-training quantization (PTQ) and quantization-aware training (QAT). Differentiable quantize-dequantize models were used for white-box attacks and gradient analysis, and native TensorRT deployment was used for validation.
At a perturbation budget of ε=0.005, EEGNet accuracy under projected gradient descent (PGD) attack stayed at 22-24% across FP32, 50% pruning (P50), PTQ and QAT.
Pruning did change how attacks transfer. P50 reduced bidirectional transfer efficiency to 0.963 and 0.928 (FP32→P50 and P50→FP32), compared with 0.994 and 0.997 for PTQ, and ShallowConvNet showed the same trend. Gradient alignment showed a matching separation, while native PTQ agreed with simulated clean and adversarial predictions in 95-98% of cases.
The authors conclude that direct robustness, adversarial transfer and deployment efficiency are distinct properties of compressed EEG decoders. According to the author comment, the 5-page paper has been submitted to IEEE ICASSP 2027.