Class-Selective Adversarial Attacks on EEG-Based Motor Imagery Classifiers: Implications for Safety-Critical Mental State Monitoring

Electroencephalography (EEG)-based classifiers for mental state recognition are increasingly deployed in safety-critical settings such as pilot fatigue and operator vigilance monitoring. This paper formalizes a class-selective adversarial threat model, in which an attacker forces misclassification of a designated source class while all remaining classes continue to be classified correctly, and characterizes it on real EEG. As the instrument of this characterization we introduce Selective Projected Gradient Descent, which applies opposing gradient directions to source-class and non-source-class samples independently. Under subject-independent leave-one-subject-out cross-validation on the PhysioNet EEG Motor Movement/Imagery Dataset and an independent sustained-attention driving dataset, an oracle setting that assumes ground-truth label access, reported as an analytical upper bound rather than as deployable performance, yields selectivity scores of 0.919 on a binary pilot-state task with a clean accuracy of \(71.5%\) and 0.990 on a four-class motor imagery task at \(ε = 16/255\) , against 0.286 and 0.015 for the Fast Gradient Sign Method and standard Projected Gradient Descent on the binary task. A deployable label-free variant that uses no ground-truth labels leaves the attack success rate unchanged to within a tenth of a percentage point; it attains the oracle level of non-target preservation on the two binary scenarios but only part of it on the four-class task; in every scenario it confers no measurable advantage over restricting a standard attack to the predicted source class. In the multi-class setting such manipulation leaves aggregate accuracy far less disturbed than a standard attack, substantially weakening accuracy-based anomaly detection. The contribution therefore rests on the formulation and characterization of the class-selective threat model, and underscores the need for dedicated defenses in biosignal-based safety systems.