# Pretrained, Frozen, Still Leaking: Auditing Cross-Encoder Attribute Transfer in EEG Foundation Models Source: [Pretrained, Frozen, Still Leaking: Auditing Cross-Encoder Attribute Transfer in EEG Foundation Models]() Collection index: [llms.txt]() Data updated: 2026-06-10T05:15:22.625Z Authors: Jianwei Tai Published: 2026-06-08T08:24:03.000Z ## Abstract EEG foundation-model releases are usually audited one endpoint at a time: raw-reconstruction, membership inference, identity linkage, or DP-SGD on the downstream head. We audit the same released embeddings under all four endpoints jointly, on BIOT, LaBraM, and EEGPT, and show that each single-endpoint audit clears releases that still leak spectral attributes. The decisive evidence is a cross-encoder transfer audit: a single ridge attribute decoder learned from one frozen encoder transfers, via a fitted linear bridge, to held-out-subject test splits of every other encoder, with subject-disjoint matched-control 95% CI lower bound at least 0.081 across all six BIOT/LaBraM/EEGPT directions. We prove a sufficient condition: two encoders sharing a nontrivial attribute-coordinate projector overlap beta admit a chained ridge bridge attacker with centered-gain lower bound sqrt(beta/(1+tau^2)) - eps\_br - rho\_0, and back-solve beta in \[0.008, 0.198\]. To turn the joint audit into a deployment-readable decision rule we introduce an audit-endpoint disagreement score (AEDS), prove sufficient conditions for its positivity, and bootstrap-calibrate it per cell; AEDS is positive in all eight matched-CI cells (BIOT/LaBraM/EEGPT on EEGMMI; LaBraM on Sleep-EDF, 54-channel LIMO, CHB-MIT pediatric scalp EEG) with p\<0.001, while a head-level Carlini LiRA membership audit reaches AUC only 0.50-0.70. Standard defenses fail under audit: a Wiener-style noise-aware adaptive attacker, the LiRA audit, and DP-SGD at every utility-preserving epsilon in {4,8} leave the attribute channel essentially unchanged. The contribution is an audit framework that turns scattered single-endpoint defenses into a joint release decision, supported by a cross-encoder bridge theorem and adaptive-attacker, LiRA, and DP-SGD baselines; the audit licenses release-blocking, not raw-waveform exfiltration or held-out-subject identity recovery. ## Recorded benchmark results A research result applies to its stated dataset, split, metric and evaluation configuration. Compare like-for-like settings, preserve the metric's unit and direction, and distinguish paper-reported results from independent reproduction. The best result recorded here is not a claim of exhaustive, current global coverage. - [Audit-endpoint disagreement on PhysioNet EEGMMI R03](): Audit-endpoint disagreement; PhysioNet EEGMMI R03; L^A Score: not recorded. - [Audit-endpoint disagreement on PhysioNet EEGMMI R07](): Audit-endpoint disagreement; PhysioNet EEGMMI R07; L^A: not recorded. - [Audit-endpoint disagreement on LIMO](): Audit-endpoint disagreement; LIMO; L^A: not recorded. - [Audit-endpoint disagreement on CHB-MIT](): Audit-endpoint disagreement; CHB-MIT; L^A: not recorded. - [Audit-endpoint disagreement on Sleep-EDF 10](): Audit-endpoint disagreement; Sleep-EDF 10; L^A: not recorded. - [Audit-endpoint disagreement on Sleep-EDF 13](): Audit-endpoint disagreement; Sleep-EDF 13; $L^A$: not recorded. ## Original sources and implementation [Original paper]() [PDF]()