An electroencephalogram (EEG) based brain-computer interface (BCI) speller allows a user to input text to a computer by thought. It is particularly useful to severely disabled individuals, e.g., amyotrophic lateral sclerosis patients, who have no other effective means of communication with another person or a computer. Most studies so far focused on making EEG-based BCI spellers faster and more reliable; however, few have considered their security. This study, for the first time, shows that P300 and steady-state visual evoked potential BCI spellers are very vulnerable, i.e., they can be severely attacked by adversarial perturbations, which are too tiny to be noticed when added to EEG signals, but can mislead the spellers to spell anything the attacker wants. The consequence could range from merely user frustration to severe misdiagnosis in clinical applications. We hope our research can attract more attention to the security of EEG-based BCI spellers, and more broadly, EEG-based BCIs, which has received little attention before.

中文翻译：

---

微小的噪音，大的错误：对抗性扰动导致脑机接口拼写错误

基于脑电图 (EEG) 的脑机接口 (BCI) 拼写器允许用户通过思想将文本输入到计算机。它对于严重残疾的人特别有用，例如肌萎缩侧索硬化患者，他们没有其他有效的方式与他人或计算机进行通信。迄今为止，大多数研究都集中在使基于 EEG 的 BCI 拼写器更快、更可靠；然而，很少有人考虑过他们的安全。这项研究首次表明 P300 和稳态视觉诱发电位 BCI 拼写者非常脆弱，即，他们可以受到对抗性扰动的严重攻击，当添加到 EEG 信号时，它们太小而无法被注意到，但可以误导拼写者拼写攻击者想要的任何东西。后果可能从仅仅是用户沮丧到临床应用中的严重误诊。我们希望我们的研究能够引起更多关注基于 EEG 的 BCI 拼写者的安全性，以及更广泛地关注之前很少受到关注的基于 EEG 的 BCI。