Investigating Membership Inference Attacks Against CNN Models for BCI Systems

As Deep Learning (DL) algorithms become more widely adopted in healthcare applications, there is a greater emphasis on understanding and addressing the potential privacy risks associated with these models. The purpose of this study is to investigate the privacy vulnerabilities of the Convolutional Neural Network (CNN) classifiers for Electroencephalogram (EEG) data in the Brain-Computer Interfaces (BCIs). Specifically, it focuses on the Membership Inference Attack (MIA), which seeks to determine if data from an individual were used in model training. The novelty of this work lies in its empirical analysis of MIA, by addressing two key challenges that are less common in other domains: 1) heterogeneous datasets and 2) spatio-temporal design choices. Motivated by these challenges, we investigate the susceptibility to MIA based on: 1) the specifics of the training data set (number of participants, demographics), and 2) specifics of the CNN (such as architecture, regularization). Our experiments revealed that an adversary with limited knowledge of the model and its training process can compromise the privacy of training participants, noting that the same attack is not effective against deep learning models trained on image and tabular datasets. Some of our findings are: 1) training on diverse participant datasets improves the privacy of most participants but increases risks of memorization and vulnerabilities for underrepresented groups; 2) regularization is less effective in defending against the MIA on EEG data CNN classifiers when compared to other types of input data; 3) the depth and width of the model architecture have no impact on the effectiveness of membership attack. We hope that the insights presented will help future researchers develop more privacy-aware deep learning-based BCI systems.