Technical Summary: Pretrained, Frozen, Still Leaking

1. Problem Statement

The paper addresses a critical gap in the privacy auditing of EEG Foundation Models (EEG-FMs) such as BIOT, LaBraM, and EEGPT. Current privacy assessments typically evaluate released embeddings (intermediate representations) against single endpoints: raw waveform reconstruction, membership inference, identity linkage, or differential privacy (DP) on the downstream head.

The authors argue that these single-endpoint audits are insufficient. A released embedding may fail to support high-fidelity raw waveform reconstruction or show weak membership inference signals, yet still preserve decodable spectral attributes (e.g., centered Power Spectral Density structures) relevant to subject states. Furthermore, identity linkage results are often misinterpreted; strong identity recovery in "same-subject" settings does not imply recovery for "held-out" subjects (those not in the training/reference set). The core problem is the lack of a joint audit framework that simultaneously evaluates all four endpoints to determine if a release decision is safe, specifically focusing on whether spectral attributes leak across different encoders and datasets.

2. Methodology

The paper proposes a split-controlled representation privacy audit that forces every privacy claim to survive specific falsification controls.

2.1 Threat Model

• Victim: An EEG-FM service releasing embeddings (not raw waveforms).
• Attacker: Possesses a shadow set of EEG windows and can train decoders from released embeddings to spectral attributes. For identity linkage, the attacker has a reference set of candidate subjects.
• Goals:
  1. Attribute Recovery: Infer spectral attributes (centered PSD) from embeddings.
  2. Reference-Set Linkage: Assign an embedding to a known subject in a reference set.
  3. Privacy Auditing: Test if defenses (noise, bottlenecks, DP) reduce leakage without destroying utility.

2.2 Audit Protocol & Controls

The audit evaluates embeddings under four standard endpoints but applies strict split controls to prevent overclaiming:

• Raw-Copy Check: Verifies if adjacent windows are near-duplicates (cosine similarity $\ge$ 0.99).
• Temporal-Gap Split: Separates windows by time to rule out adjacent-window artifacts.
• Subject-Disjoint Split: Ensures train and test subjects do not overlap. This is the critical control for held-out-subject attribute leakage. Identity linkage is not claimed here because candidate identities are absent.
• Reference-Set Identity: Identity linkage (BPID@1) is only evaluated when candidate subjects exist in the attacker's reference set.
• Negative Controls: Every leakage result is compared against random Gaussian embeddings and split-local permuted embeddings to establish a baseline.

2.3 Theoretical Framework

The authors introduce a Cross-Encoder Bridge Theorem and an Audit-Endpoint Disagreement Score (AEDS):

• Bridge Transferability: They prove that if two encoders share a nontrivial attribute-coordinate projector overlap ($\beta$), a ridge attribute decoder trained on one frozen encoder can transfer to the held-out-subject test split of another encoder via a fitted linear bridge. The gain lower bound is derived as $\sqrt{\beta/(1 + \tau^2_t)} - \epsilon_{br} - \rho_0$.
• AEDS: A decision rule defined as $AEDS = L_A - \max(R_M, R_I)$, where $L_A$ is the attribute leakage gain, $R_M$ is the membership inference residual, and $R_I$ is the identity linkage residual. A positive AEDS indicates that attribute leakage is the decisive risk factor, even if other endpoints appear safe.

2.4 Defense Evaluation

The audit tests standard defenses:

• Gaussian Noise: Added to embeddings.
• Bottlenecks & Dropout: Dimensional reduction and coordinate removal.
• DP-SGD: Differentially private fine-tuning of the downstream head with per-sample clipping and RDP accounting.
• Adaptive Attacker: A Wiener-style noise-aware attacker that pre-whitens embeddings based on known noise levels.

3. Key Results

3.1 Spectral Attribute Leakage

Across eight evaluation settings (BIOT, LaBraM, EEGPT on EEGMMI; LaBraM on Sleep-EDF, LIMO, CHB-MIT), spectral attributes are consistently recoverable from embeddings.

• Subject-Disjoint Leakage: In all subject-disjoint splits, the centered PSD gain remains significantly positive (95% CI lower bounds ranging from 0.157 to 0.487) against matched negative controls.
• Cross-Encoder Transfer: A single ridge decoder trained on one encoder (e.g., BIOT) successfully transfers to the held-out-subject splits of other encoders (LaBraM, EEGPT) via a linear bridge. The implied projector overlap $\beta$ is estimated to be in $[0.008, 0.198]$.
• Deployment Relevance: In a Sleep-EDF sleep-stage classification task, an attacker achieved 70.4% accuracy on held-out subjects, significantly outperforming controls, even with Gaussian noise ($\sigma=1.0$).

3.2 Identity Linkage Scope

• Reference-Set Linkage: Strong identity linkage (BPID@1 up to 0.950) is observed only when the attacker has a reference set containing the candidate subjects (same-subject or overlap splits).
• Held-Out Subjects: No identity recovery is claimed for subject-disjoint splits. The paper explicitly distinguishes between "reference-set linkage" (possible) and "held-out identity recovery" (not demonstrated).

3.3 Endpoint Disagreement (AEDS)

• Single-Endpoint Failure: Standard audits (raw-copy, membership inference, reference-set identity) often clear the release. For example, membership inference AUCs were low (0.50–0.70), and raw reconstruction was negative.
• Joint Audit Failure: The AEDS was positive in all eight subject-disjoint matched-CI cells ($p < 0.001$). This means the attribute leakage signal is strong enough to block a release decision, even when membership and identity endpoints suggest safety.

3.4 Defense Failure

• Noise & DP: Standard Gaussian noise and DP-SGD on the downstream head failed to close the attribute channel while maintaining utility.
  • At utility-preserving $\epsilon \in \{4, 8\}$, attribute gain remained statistically indistinguishable from the non-private baseline.
  • Only at $\epsilon=1$ did attribute gain drop, but task utility collapsed (balanced accuracy fell below operational gates).
• Adaptive Attacks: A noise-aware adaptive attacker (Wiener-style) improved performance over non-adaptive baselines but did not close the privacy gap; the attribute channel remained open.
• Bottlenecks/Dropout: These transformations reduced identity linkage slightly but left attribute leakage positive.

4. Significance and Claims

The paper makes a scoped, negative claim regarding the privacy of EEG-FM embeddings:

1. Embeddings are not a privacy boundary for spectral attributes: Released embeddings from BIOT, LaBraM, and EEGPT leak decodable spectral attributes (centered PSD) to held-out subjects, even when raw waveform reconstruction and membership inference are weak.
2. Single-endpoint audits are insufficient: Relying on raw-reconstruction, membership inference, or identity linkage alone leads to false positives (releasing unsafe embeddings). The AEDS framework is proposed to detect this disagreement.
3. Defenses are currently ineffective: Standard defenses (noise, DP, bottlenecks) do not simultaneously preserve utility and eliminate attribute leakage in the tested regimes.
4. Identity claims must be scoped: Strong identity results are valid only for reference-set settings (enrolled users) and cannot be extrapolated to held-out subjects.

Limitations Acknowledged by the Authors:

• The findings are based on specific datasets (EEGMMI, Sleep-EDF, LIMO, CHB-MIT) and models; population-level generalization to all clinical EEG data is not claimed.
• The theoretical results (Theorems 1-5) are sufficient-condition statements and stylized models, not fitted parameters for specific encoders.
• The training-noise experiments are proxies and do not constitute formal DP guarantees.

Conclusion: The paper concludes that EEG-FM embeddings should not be treated as de-identified data simply because they are not raw waveforms. A joint audit framework that prioritizes attribute leakage and split-controlled claim boundaries is necessary before releasing such representations.