SSVEP-based brain-computer interfaces are vulnerable to square wave attacks

Electroencephalogram (EEG) based brain-computer interfaces (BCIs) have attracted wide attention in recent years. Steady-state visual evoked potential (SSVEP) is one of the most popular BCI paradigms, which has high information transmission rate and short user calibration time. Recent research has shown that EEG-based BCIs are under the threat of adversarial examples. However, existing attack approaches are very difficult to implement in a real-world system. Considering SSVEP’s dependency on the frequency information, this paper proposes to use square wave signals as adversarial perturbations to attack SSVEP-based BCIs, which are easy to generate and apply in practice. EEG trials contaminated by the square wave perturbation can be classified into any target class specified by the attacker. Compared with previous approaches, our perturbation can be implemented much more easily. Experiments on two SSVEP datasets demonstrated the efficiency and robustness of the proposed approach in attacking two SSVEP classifiers based on canonical correlation analysis, exposing a critical security problem in SSVEP-based BCIs.