- No specific calendar, day-name, or relative date phrases appear in this article; every claim is anchored to the primary source without temporal qualifiers, so no dated citations are required.
A brain-signal model that anyone can download for free has been shown to open a side door into private medical AI it was never trained to attack.
The warning comes from a paper posted to arXiv by a team of machine-learning researchers studying a quiet assumption in the fast-growing field of EEG foundation models arXiv paper. These systems learn reusable representations from large-scale neural recordings, and labs increasingly release their encoders to the public to speed up downstream work.
That openness, the researchers argue, carries a cost nobody had measured. They argued: “The open release of EEG foundation encoders, while facilitating downstream developments, also introduces a previously unexplored security risk” arXiv paper. The public representations, they show, can be turned against the private models built on top of them. 
See the arXiv paper.
An attack that never touches the target
Most adversarial attacks work by poking the victim directly — feeding it inputs, reading its replies, and nudging them until it breaks. But SW-ProxyCE assumes the attacker gets none of that.
In the scenario the team built, the adversary has white-box access to a released encoder and a small set of labeled examples, but no query, gradient, or parameter access to the private downstream model they actually want to fool paper DOI. They call it a public-encoder, private-downstream setting.
The method, Shrinkage-Whitened Proxy Cross-Entropy, rebuilds the target task’s decision geometry from a handful of labeled reference samples using shrinkage-whitened class prototypes. No surrogate classifier has to be trained. From that recovered geometry, the attacker generates adversarial examples that transfer to the model they cannot see.
Transfer worked across every configuration they tried
The team tested across three EEG tasks and four encoders — three general-purpose foundation models plus one trained for a specific paradigm — covering both lightweight linear-probing setups and fully fine-tuned ones, in cross-subject and within-subject conditions.
The crafted examples consistently beat blunt representation-shift attacks that ignored the task entirely paper DOI. The uncomfortable result is that a model’s ability to share knowledge generously does not make it adversarially robust.
The split between public sharing and private protection is not unique to brain-signal AI. Cloudflare unified its private and public DNS into a single control plane Cloudflare Internal DNS Goes GA, a reminder that the line between open and closed keeps moving across the whole stack.
The authors plan to release their code, which means defenders and attackers will start from the same place. For teams shipping EEG models into clinics, wearables, or brain-computer interfaces, the paper is a warning that open and safe are different release decisions — the encoder you publish may outlive the threat model you imagined.
