{"slug": "sw-proxyce-zero-query-adversarial-transfer-from-public-eeg-encoders-to-private", "title": "SW-ProxyCE: Zero-Query Adversarial Transfer from Public EEG Encoders to Private Downstream Models", "summary": "A new study from arXiv (2608.16931v1) introduces SW-ProxyCE, a query-free attack framework that exploits public EEG foundation encoders to generate adversarial examples that transfer to private downstream models, achieving higher attack success than task-agnostic representation-shift attacks across three EEG tasks and four encoders. The findings reveal that the strong transferability of EEG foundation models does not confer adversarial robustness, posing a security risk for private models that rely on publicly released encoders.", "body_md": "arXiv:2608.16931v1 Announce Type: new\nAbstract: Electroencephalography (EEG) foundation models have recently emerged as a promising paradigm for EEG decoding by learning reusable representations from large-scale heterogeneous neural recordings. However, the open release of EEG foundation encoders, while facilitating downstream developments, also introduces a previously unexplored security risk: publicly available representations may make private downstream models vulnerable. This paper investigates adversarial transfer attacks in EEG foundation model deployment in a public-encoder and private-downstream setting, where attackers have white-box access to a released encoder and a small task-matched labeled reference set, but no access or query to victim parameters, outputs, or gradients. We propose Shrinkage-Whitened Proxy Cross-Entropy (SW-ProxyCE), a query-free task-aware attack framework that recovers task-level decision geometry from a small labeled reference set through shrinkage-whitened class prototypes, enabling transferable adversarial generation without training an additional surrogate classifier. We evaluated SW-ProxyCE across three EEG tasks using three general-purpose foundation encoders and a paradigm-specific pre-trained encoder, covering both linear-probing and full-fine-tuning downstream models in cross-subject and within-subject scenarios. Results demonstrated that adversarial examples generated from the public encoder and limited labeled references can effectively transfer to inaccessible downstream models. SW-ProxyCE consistently outperformed task-agnostic representation-shift attacks, revealing that the strong transferability of EEG foundation models does not necessarily lead to adversarial robustness. Our code will be available on GitHub.", "url": "https://wpnews.pro/news/sw-proxyce-zero-query-adversarial-transfer-from-public-eeg-encoders-to-private", "canonical_source": "https://arxiv.org/abs/2608.16931", "published_at": "2026-08-19 04:00:00+00:00", "updated_at": "2026-08-19 04:13:29.718585+00:00", "lang": "en", "topics": ["artificial-intelligence", "machine-learning", "ai-safety"], "entities": ["arXiv", "SW-ProxyCE"], "alternates": {"html": "https://wpnews.pro/news/sw-proxyce-zero-query-adversarial-transfer-from-public-eeg-encoders-to-private", "markdown": "https://wpnews.pro/news/sw-proxyce-zero-query-adversarial-transfer-from-public-eeg-encoders-to-private.md", "text": "https://wpnews.pro/news/sw-proxyce-zero-query-adversarial-transfer-from-public-eeg-encoders-to-private.txt", "jsonld": "https://wpnews.pro/news/sw-proxyce-zero-query-adversarial-transfer-from-public-eeg-encoders-to-private.jsonld"}}