WorksComputer Science

ORBITAL: Optimization of Robust Brain–Computer Inference Through Architecture-Aware Low-Precision Compression

Published Oct 26, 2026Fresh — added to the Hub within the last 30 daysv19 min read

AI contributions

ChatGPT
Grammarly

Abstract

Compact electroencephalography (EEG) decoders enable embedded brain–computer interfaces (BCIs), but compression can alter adversarial robustness without proportional hardware savings. We present ORBITAL, a robustness-constrained framework combining hardware-realizable structured compression, recovery-aware operating-point selection, multi-attack evaluation, and native edge validation. Across nine subjects and three seeds on BCI Competition IV-2a, S25-TRADES achieves the highest observed mean true-union robustness among compressed EEGNet models (23.06% vs 21.27% for standard Full), with 26.27% fewer parameters and 25.10% fewer MACs. Matched controls identify TRADES as the main source of robustness recovery, improving S25 union accuracy by 6.74 percentage points over clean recovery (p=0.0039), while per-example analysis reveals boundary redistribution rather than uniform margin expansion. On Jetson Orin Nano, FP16 compression reduces board energy by up to 16.20% and latency by 8.00%. Despite 99.3% prediction agreement, native INT8 Q/DQ incurs about twice the FP16 latency and energy, demonstrating the need for joint robustness and hardware-aware optimization.

Introduction

EEG-based BCIs increasingly rely on compact convolutional neural networks such as EEGNet [1] and ShallowConvNet [2]. Their embedded use creates three coupled objectives: (i) preserve task accuracy, (ii) resist small adversarial perturbations, and (iii) reduce real latency/energy. Conventional compression work largely optimizes storage or arithmetic cost [3, 4, 5, 6], whereas adversarial training and evaluation are usually studied independently [7, 8, 9]. In EEG, this separation is particularly problematic because compact decoders operate on low-amplitude, non-image signals for which perturbation geometry and hardware overheads differ from standard vision workloads.

Figure 1 illustrates how structured compression changes clean accuracy, adversarial robustness, and model complexity non-monotonically. Mathematical compression does not automatically guarantee actual hardware efficiency; thus, relying on a fixed compression ratio is insufficient for dependable edge deployment. Recent BCI studies established that EEG decoders are vulnerable to adversarial manipulation [10] and benchmarked multiple defenses [11]. More recent alignment-based defense benchmarks demonstrate the benefits of combining

Reference topomap, clean accuracy, robustness, and structural compression trade-off — Figure 1. Motivation for robustness-constrained EEG compression. ORBITAL’s accuracy–robustness–hardware trade-off under structured EEG compression. S10 satisfies predefined screening constraints, S25 achieves the highest observed mean true-union robustness among compressed candidates, and S50 offers greater structural and measured hardware savings.

preprocessing and adversarial training for EEG decoding [12], but leave compression-aware operating-point selection and native hardware costs unexplored. Prior work, including AERIAL [13], has demonstrated that accuracy-preserving compression does not necessarily preserve adversarial robustness, and that robustness and hardware efficiency may evolve independently. Nonetheless, characterization alone does not establish how to select a physically realizable compressed decoder that satisfies specified accuracy and robustness requirements. Furthermore, the interaction between compression severity and robust recovery remains insufficiently understood, complicating the choice of an efficient deployment configuration. ORBITAL addresses these limitations through robustness-constrained architecture search, recovery-aware evaluation, and native hardware validation.

Our main contributions are:

Robustness-constrained structured compression. We introduce a hardware-realizable EEG decoder compression workflow that enumerates physically valid channel widths, screens clean and adversarial performance, and selects constraint-feasible and Pareto operating points rather than prescribing a fixed compression ratio.
Compression–recovery interaction. Through matched full-width TRADES controls and compression-level recovery ablations, we show that robust training is the principal source of adversarial recovery, while its benefit depends significantly on compression severity. At S25, TRADES improves true-union robustness by 6.74 percentage points

Figure 2. Overview of the ORBITAL methodology. EEGNet serves as the primary deployment architecture, while ShallowConvNet evaluates cross-architecture generalization.

over clean-only recovery across all nine subjects.

Adversarial boundary characterization. Using per-example robustness transitions, post-attack margins, gradient geometry, and random-channel controls, we show that compression redistributes adversarial robustness rather than uniformly increasing classification margins. The S25 operating point achieves the highest observed mean union robustness among the compressed EEGNet candidates.
Native edge-hardware validation. We quantify actual latency, board power, and energy on Jetson Orin Nano using repeated FP16 inference measurements. We additionally show that learned-scale INT8 Q/DQ can preserve model predictions while increasing deployment cost because of conversion and kernel overhead.

Methodology

ORBITAL integrates physical structured compression, post-pruning recovery, robust evaluation, and deployment profiling into a unified pipeline. Algorithm 1 summarizes the complete procedure. The following subsections detail each stage.

Physical Structured Compression

ORBITAL performs structured channel pruning to obtain smaller, dense EEG decoders rather than sparsely masked networks. For EEGNet, coupled temporal and pointwise filter dimensions ( $F_1$ , $F_2$ ) are reduced while preserving the depthwise structure and downstream compatibility. Retained parameters are transferred into the rebuilt architecture. As for ShallowConvNet, filter importance accounts for filter magnitude and downstream connectivity, with corresponding convolutional, normalization, and classifier dimensions rebuilt consistently. Unlike unstructured sparsity, the resulting models directly reduce parameter storage and arithmetic requirements [4], [5].

Robustness-Aware Recovery and Quantization

Following physical compression, ORBITAL evaluates raw, clean-recovered, and adversarially recovered decoders. Robust recovery follows TRADES [8]:

\mathcal{L}_{\mathrm{TRADES}} = \operatorname{CE}(f(x), y) + \beta D_{\mathrm{KL}}\left(p(x) \mathbin{\|} p(x')\right), \tag*{(1)}

Algorithm 1 ORBITAL: Robustness-Constrained Operating-Point Selection

Require: Decoder $f$ , widths $W$ , tolerances $\delta_c$ , $\delta_r$

Ensure: Selected deployable operating points

Enumerate physically valid widths $W$
for $w \in W$ do
Rebuild dense decoder $f_w$
Recover $f_w^{\mathrm{clean}}$ and $f_w^{\mathrm{TRADES}}$
Screen clean and PGD20 accuracy
end for
Average seeds within each subject
Enforce clean/robust feasibility constraints
Construct the accuracy–robustness–size Pareto set
Select feasible and representative candidates
Confirm with PGD100×10, APGD-CE, APGD-DLR, and FAB
Compute clean-correct true-union accuracy
Profile selected models on edge hardware
return Constraint-selected, highest-mean-robustness, and efficiency-oriented points

where $x'$ is an adversarially perturbed EEG input. An optional parameter-anchor penalty regularizes deviations from the pruned initialization. For low-precision deployment, EEGNet additionally supports QAT with fake-quantized activations and per-output channel weights. Explicit Q/DQ export enables evaluation of native TensorRT execution, separating quantization fidelity from realized hardware efficiency.

Robustness-Constrained Operating-Point Selection

Rather than selecting compression severity heuristically, ORBITAL identifies deployable operating points under explicit clean-accuracy and robustness constraints. For candidate width $w$ , let $A_c(w)$ denote clean accuracy and $A_r(w)$ denote clean-correct PGD screening robustness. Relative to the full model $w_0$ , feasibility requires

A_c(w) \ge A_c(w_0) - \delta_c,

A_r(w) \ge A_r(w_0) - \delta_r. \tag*{(2)}

The strict operating point maximizes realized parameter reduction $R_p(w)$ :

w^* = \underset{w \in W_{\mathrm{feas}}}{\arg\max}\ R_p(w). \tag*{(3)}

Nondominated candidates are additionally retained over clean accuracy, screening robustness, and parameter reduction. The final robustness is quantified by the intersection of clean correctness and all confirmation attacks:

A_{\mathrm{union}} = \frac{1}{N}\sum_{i=1}^{N}\mathbf{1}\left[f(x_i)=y_i \land\bigwedge_{\alpha\in\mathcal{A}} f(x_i^\alpha)=y_i\right]. \tag*{(4)}

This prevents initially misclassified trials from being counted as adversarially robust.

Experimental Setup

Dataset and models: Experiments use BCI Competition IV-2a [14], containing nine subjects, 22 EEG channels, and four motor-imagery classes. Signals are sampled at 250 Hz and bandpass filtered to 4–38 Hz. Each subject provides 230/58/288 training/validation/test trials with 4.5-s input windows. EEGNet is the primary compression and deployment architecture; ShallowConvNet evaluates cross-architecture generalization.

Compression and recovery: We evaluate EEGNet width-reduction targets $\{0, 10, 20, 25, 30, 40, 50, 60\}\%$ with valid coupled $(F_1,F_2)$ dimensions. Requested width reductions are distinguished from realized parameter and MAC reductions. Raw pruning, clean recovery, and TRADES recovery are evaluated. TRADES uses $\beta=2$ , $\epsilon=0.005$ , ten inner steps, step size 0.00125, and an anchor coefficient of 1. Recovery uses a learning rate of $5\times10^{-5}$ , up to 30 epochs, and validation-based early stopping.

Selection and robustness evaluation: The screening stage uses PGD20 with one random restart and predefined clean and robustness tolerances of $\delta_c=0.03$ and $\delta_r=0.02$ . Selected candidates are confirmed using PGD100×10, APGD-CE, APGD-DLR, and FAB under a common $\ell_\infty$ threat radius $\epsilon=0.005$ . Robustness is reported using the clean-correct true union.

Reproducibility and statistics: EEGNet compression-search and ShallowConvNet experiments cover nine subjects and three seeds $\{1, 48, 550\}$ . Seed results are averaged within each subject before paired subject-level Wilcoxon tests and bootstrap 95% confidence intervals. Selected aggressive EEGNet QAT experiments remain single-seed.

Hardware evaluation: Native deployment uses TensorRT on NVIDIA Jetson Orin Nano Super [15, 16] under fixed MAXN SUPER clocks. FP16 configurations are measured in five independent 60-s runs. We report inference latency, throughput, active whole-board power (VDD IN), and board energy per inference. Learned-scale Q/DQ exports are separately evaluated to distinguish numerical fidelity from native INT8 deployment cost.

Results & Analysis

Compression–Robustness Operating Points

Table 1 reports strong-attack confirmation for selected EEGNet widths. Under the predefined clean-accuracy and PGD20 screening tolerances, S10-TRADES is the maximum-compression screen-feasible candidate: it removes 13.24% of parameters and 12.56% of MACs while obtaining 55.32% clean accuracy and 22.22% true-union robustness. S25-TRADES

Variant	$F_1/F_2$	Param. ↓	MAC ↓	Clean	PGD100	APGD-CE	APGD-DLR	FAB	Union
Full	8/16	–	–	57.39	22.78	22.67	21.66	21.48	21.27
S10-TRADES	7/14	13.24	12.56	55.32	23.98	23.87	22.39	22.45	22.22
S25-TRADES	6/12	26.27	25.10	53.95	24.92	24.76	23.33	23.15	23.06
S40-TRADES	5/10	39.08	37.63	52.34	22.87	22.65	20.99	20.81	20.69
S50-TRADES	4/8	51.68	50.14	49.83	22.58	22.29	20.19	19.87	19.70
S60-TRADES	3/6	64.05	62.63	44.68	20.91	20.67	18.76	18.47	18.38

Table 1. Strong-attack confirmation across selected EEGNet operating points on BCI IV-2a. Results average three seeds within each of nine subjects. All accuracy values are percentages. Union requires clean correctness and survival under all four attacks.

achieves the highest observed mean union robustness among the evaluated compressed candidates (23.06%) with 26.27% fewer parameters and 25.10% fewer MACs. Its numerical advantage over the standard full-width decoder (21.27%) is not statistically significant (+1.79 pp, $p=0.5703$ ). Higher compression reduces both clean and union accuracy, exposing distinct robustness-oriented and efficiency-oriented operating points.

Compression–Recovery Interaction

Matched full-width controls show that Full-TRADES increases union robustness over standard Full by 3.42 pp ( $p=0.0234$ ), whereas S25-TRADES is numerically 1.63 pp below Full-TRADES ( $p=0.0977$ ). Thus, compression alone does not explain the gain. Figure 3 shows that the TRADES benefit over clean recovery peaks at S25 (+6.74 pp). This recovery gain exceeds that at full width by 3.27 pp ( $p=0.0078$ ), establishing a compression-dependent recovery interaction. Table II reports the paired tests.

Adversarial Boundary Redistribution

Figure 4 shows that S25-TRADES rescues 7.25% of examples while losing robustness on 5.47%, yielding a net +1.79 pp change. Opposing worst-case margin shifts across rescued and lost examples indicate selective adversarial boundary redistribution rather than uniform margin expansion. Gradient RMS continues declining beyond S25 despite decreasing union robustness, so smaller gradients alone do not explain the observed robustness peak.

Comparison	$\Delta$ union	p
Full-TRADES vs. Full	+3.42	0.0234
S25-TRADES vs. Full	+1.79	0.5703
S25-TRADES vs. Full-TRADES	−1.63	0.0977
S25-TRADES vs. S25-raw	+7.45	0.0039
S25-TRADES vs. S25-clean	+6.74	0.0039
TRADES gain: S25 vs. Full width	+3.27	0.0078
S25 magnitude vs. random	+0.26	1.0000

Table 2. Paired subject-level causal and recovery comparisons. Union-accuracy differences are in percentage points; p values are from two-sided Wilcoxon tests after averaging seeds within each of nine subjects.

Variant	Latency (ms)	Active power (W)	Energy (mJ)
Full	$0.1712 \pm0.0029$	$14.203 \pm0.098$	$2.4314 \pm0.0244$
S25	$0.1688 \pm0.0002$	$13.630 \pm0.017$	$2.3013 \pm0.0015$
S50	$0.1575 \pm0.0044$	$12.940 \pm0.210$	$2.0374 \pm0.0237$

Table 3. Jetson Orin Nano TensorRT FP16 measurements (mean ± SD over five runs).

Cross-Architecture Generalization

Across nine subjects and three seeds, ShallowConvNet S25-TRADES achieves 57.56% clean and 41.23% union accuracy, compared with 57.90% and 41.86% for Full; neither paired difference is significant. At S50, raw pruning yields 34.84% union accuracy; clean recovery restores it to 40.74%, compared with 39.76% for S50-TRADES. Hence, the preferred recovery method depends on architecture and compression severity rather than following a universal TRADES advantage.

Hardware Efficiency and Precision

Table III shows that S25 reduces Jetson board energy by 5.35% with little latency change, whereas S50 reduces latency and energy by 8.00% and 16.20%, respectively. In contrast, Figure 5 shows that learned-scale INT8 Q/DQ preserves 99.3% prediction agreement but incurs roughly twice the FP16 latency and energy. Conversion and reformat overheads therefore limit the benefit of lower precision.

Figure 5. Native Jetson precision comparison. Learned-scale INT8 Q/DQ preserves approximately 99.3% prediction agreement with the QAT models, yet increases latency and board energy by roughly twofold relative to FP16 for S25 and S50.

efficiency-oriented operating points. Matched controls attribute the primary robustness gains to TRADES, while per-example analysis reveals heterogeneous adversarial-boundary redistribution. Cross-architecture experiments confirm that recovery effectiveness depends on decoder structure and compression severity. Native Jetson measurements further show that structural compression can reduce energy, whereas INT8 Q/DQ may increase execution cost due to conversion overhead.

Acknowledgment

This work was supported in part by the NYUAD Center for CyberSecurity (CCS), funded by Tamkeen under the NYUAD Research Institute grant G1104.

Generative AI Use Disclosure

The authors used Generative AI tools (specifically ChatGPT and Grammarly) for language editing, text refinement, and visual refinement of the methodology figure. The authors reviewed and edited all generated or refined content as needed and take full responsibility for the publication’s content.

Conclusion

To conclude, ORBITAL demonstrates that robust EEG compression requires joint consideration of structural capacity, recovery objectives, and deployment behavior. A constrained search identifies distinct feasible, robustness-oriented, and

References

[1]V. J. Lawhern, A. J. Solon, N. R. Waytowich, S. M. Gordon, C. P. Hung, and B. J. Lance, “EEGNet: A compact convolutional neural network for eeg-based brain–computer interfaces,” Journal of Neural Engineering, vol. 15, no. 5, p. 056013, 2018.DOI
[2]R. T. Schirrmeister, J. T. Springenberg, L. D. J. Fiederer, M. Glasstetter, K. Eggensperger, M. Tangermann, F. Hutter, W. Burgard, and T. Ball, “Deep learning with convolutional neural networks for eeg decoding and visualization,” Human Brain Mapping, vol. 38, no. 11, pp. 5391–5420, 2017.DOI
[3]S. Han, H. Mao, and W. J. Dally, “Deep compression: Compressing deep neural networks with pruning, trained quantization and huffman coding,” in International Conference on Learning Representations, 2016.arxiv.org/abs/1510.00149
[4]H. Li, A. Kadav, I. Durdanovic, H. Samet, and H. P. Graf, “Pruning filters for efficient convnets,” in International Conference on Learning Representations, 2017.arxiv.org/abs/1608.08710
[5]P. Molchanov, S. Tyree, T. Karras, T. Aila, and J. Kautz, “Pruning convolutional neural networks for resource efficient inference,” in International Conference on Learning Representations, 2017.arxiv.org/abs/1611.06440
[6]B. Jacob, S. Kligys, B. Chen, M. Zhu, M. Tang, A. Howard, H. Adam, and D. Kalenichenko, “Quantization and training of neural networks for efficient integer-arithmetic-only inference,” in Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, ICCV, pp. 2704–2713, 2018.arxiv.org/abs/1712.05877
[7]A. Madry, A. Makelov, L. Schmidt, D. Tsipras, and A. Vladu, “Towards deep learning models resistant to adversarial attacks,” in International Conference on Learning Representations, 2018.arxiv.org/abs/1706.06083
[8]H. Zhang, Y. Yu, J. Jiao, E. P. Xing, L. E. Ghaoui, and M. I. Jordan, “Theoretically principled trade-off between robustness and accuracy,” in Proceedings of the 36th International Conference on Machine Learning, ser. Proceedings of Machine Learning Research, vol. 97, 2019, pp. 7472–7482.arxiv.org/abs/1901.08573
[9]F. Croce and M. Hein, “Reliable evaluation of adversarial robustness with an ensemble of diverse parameter-free attacks,” in Proceedings of the 37th International Conference on Machine Learning, ser. Proceedings of Machine Learning Research, vol. 119, 2020, pp. 2206–2216.arxiv.org/abs/2003.01690
[10]X. Zhang, D. Wu, L. Ding, H. Luo, C.-T. Lin, T.-P. Jung, and R. Chavarria, “Tiny noise, big mistakes: Adversarial perturbations induce errors in brain–computer interface spellers,” National Science Review, vol. 8, no. 4, p. nwaa233, 2021.
[11]L. Meng, X. Jiang, and D. Wu, “Adversarial robustness benchmark for eeg-based brain–computer interfaces,” Future Generation Computer Systems, vol. 143, pp. 231–247, 2023.DOI
[12]X. Chen, T. Jia, and D. Wu, “Data alignment based adversarial defense benchmark for eeg-based bcis,” Neural Networks, vol. 188, p. 107516, 2025.DOI
[13]S. Rehman and M. Shafique, “AERIAL: Adversarial evaluation of robustness in accuracy-preserving low-precision eeg decoders,” arXiv preprint arXiv:2609.30037, 2026.arxiv.org/abs/2609.30037
[14]M. T. S. Rehmann, K.-R. Müller, A. Aertsen, N. Birbaumer, C. Braun, C. Brunner, R. Leeb, C. Mehring, K. J. Miller, G. R. Müller-Putz, G. Nolte, G. Pfurtscheller, H. Preissl, G. Schalk, A. Schlögl, C. Vidaurre, S. Waldert, and B. Blankertz, “Review of the BCI competition IV,” Frontiers in Neuroscience, vol. 6, p. 55, 2012.DOI
[15]NVIDIA, “Jetson orin nano developer kit user guide,” NVIDIA Developer Documentation, 2026, accessed Oct. 2026.
[16]——, “TensorRT documentation,” NVIDIA Developer Documentation, 2026, accessed Oct. 2026.