Evaluating multi-level membership inference risk in federated EEG learning

Abstract

Electroencephalography (EEG) records electrical brain activity from the scalp and is widely used in brain–computer interface (BCI) systems for communication, and assistive technologies. EEG is widely used in motor-imagery (MI) based BCIs, where neural recordings contain highly individual and potentially sensitive information. In this regard, federated learning (FL) is a prominent privacy-enhancing approach which enables collaborative model training without centralising raw signals. However, recent work has shown that FL models still leak private information through membership inference attacks (MIAs). Most existing studies examine only single attack type, so it remains unclear how multiple MIAs together expose different layers of privacy risk in FL-based EEG systems. To address this gap, this study develops a federated MI-EEG classification framework and evaluates privacy leakage across four complementary MIAs: record-level, feature-level, gradient-level, and client-identity inference. Two neural networks were trained using per-subject FL, and differential privacy (DP) with epsilon (ε) ∈ {1, 5, 10} was applied to client updates. Results showed that standard FL alone provides limited intrinsic protection, while adding DP substantially reduces attack success particularly for gradient and identity-level attacks. Strong privacy settings (ε = 1) offered the greatest leakage reduction but degraded classification accuracy, whereas a moderate privacy budget (ε = 5) achieved the most favourable privacy–utility balance. Overall, the findings demonstrate that FL alone is insufficient as a privacy safeguard for EEG-BCI systems. Explicit privacy mechanisms such as DP are required to mitigate multi-level leakage, supporting the design of trustworthy and secure neural-learning technologies.

Introduction

Electroencephalography (EEG) records millisecond-scale electrical activity from the scalp and is widely used in brain–computer interface (BCI) systems for communication, neurorehabilitation, and assistive control [1–3]. In motor imagery (MI) based BCIs, users imagine movements (for example, left- or right-hand actions), and machine learning models decode the resulting oscillatory patterns into discrete commands [4]. These systems have shown promise for restoring communication in severe motor impairment, monitoring cognitive state, and enabling everyday human–machine interaction. However, EEG signals are not limited to task-related responses; they also embed information about affective state, attention, neurological pathology, and even quasi-biometric traits [5–7]. As a result, both raw recordings and learned model parameters can reveal sensitive attributes beyond the intended MI task, making privacy protection a critical design requirement for practical MI-BCI deployment. To address this, a number of researchers have explored privacy-preserving EEG frameworks that reduce direct access to raw EEG data recordings. Recent studies have proposed domain adaptation and source-free transfer learning strategies that share model parameters instead of raw EEG data across users or sites. For example, augmentation-based source-free domain adaptation methods adapt a pre-trained MI classifier to new subjects using only target-side unlabeled EEG, thereby reducing cross-site data exchange. Other studies propose lightweight source-free transfer and multi-source decentralized transfer frameworks that train on multiple source cohorts and then adapt models to new users without sending their raw EEG back to the server. These approaches can mitigate some privacy risks by limiting where raw signals are stored and processed, and they improve cross-subject robustness under distribution shift. However, they typically assume an honest-but-curious environment and primarily report classification accuracy and convergence. They do not explicitly consider adaptive adversaries who exploit model outputs or gradients, and they rarely quantify privacy leakage using formal attack metrics such as membership-inference accuracy or gradient reconstruction quality.

Federated learning (FL) has therefore been proposed as a privacy-aware training paradigm because it enables collaborative model development without centralising raw EEG signals [8, 9]. However, the absence of raw-data sharing does not necessarily imply that privacy is guaranteed, since model parameters and updates may still reveal patterns associated with the training data. Similar ideas have been explored for EEG-based epileptic seizure detection and other clinical applications, where FL is used to combine data from multiple hospitals without pooling raw signals. More recent frameworks for FL in BCIs focus on handling non-independent client distributions, communication efficiency, and robustness to device heterogeneity, and often describe privacy as a motivation for avoiding raw data sharing [10]. However, despite its data-locality design, FL alone does not guarantee privacy. Research shows that shared gradients or model parameters can still leak sensitive information [11]. Wang et al. [12] introduced deep leakage from gradients (DLG), showing that raw inputs can be reconstructed from FL gradient updates [13]. These findings challenge the assumption that FL guarantees privacy. In the EEG context, model updates may reveal whether a specific trial participated in training (record-level membership inference), expose subject-specific neural signatures, or identify which client generated a given update (client-identity inference) through membership inference attack (MIA) [14–16]. These MIAs can distinguish whether a particular sample or user participated in training by exploiting confidence scores, loss values, or gradient statistics, and have been demonstrated against both centralized and federated models [17]. However, in almost all of these studies, privacy is treated as a by-product of data locality. They do not systematically evaluate how vulnerable federated EEG models are to concrete attacks such as record-level (RLA), feature-level (FLA), gradient-level (GLA), and client-level or identity membership inference (CLA). They provide limited guidance on how safe standard FL is for neural data.

Differential privacy (DP) has therefore been proposed as a formal mitigation technique in FL where calibrated noise is added to gradients or parameters to bound the contribution of individual samples or clients [18]. However, applying DP to high-dimensional, multichannel EEG is challenging because excessive noise reduces EEG-based framework accuracy, disrupt convergence, and distort important MI features [19]. Moreover, many recent privacy-preserving EEG-based frameworks rely on architectural design choices such as source-free transfer, representation learning, or decentralized training to limit exposure of raw data, but to our knowledge they do not combine FL with explicit DP noise and do not evaluate privacy leakage under multiple layered attacks on real MI datasets [20, 21]. A further research gap is that most prior work examines only a single threat model at a time, for example a RLA based on model confidence scores, or informal concerns about gradient leakage. In contrast, Federated MI-BCI systems face privacy threats at multiple levels. These include: (i) RLA that determine whether a specific EEG trial was included in training, (ii) FLA that exploit sensitive information encoded in learned feature representations, (iii) GLA that reconstruct inputs or infer labels from shared model updates, and (iv) CLA that link model updates back to the user or site that generated them. Without a unified empirical analysis across these layers, it remains unclear how effective FL and DP are in protecting EEG data in practice, or how to select a DP budget that achieves an appropriate privacy–utility balance. The novelty of this study is empirical. We systematically evaluate privacy leakage in federated MI based EEG learning across multiple adversarial access levels and quantify how differential privacy mitigates these risks under controlled privacy budgets. This motivates a unified empirical investigation designed to quantify both privacy risk and mitigation effectiveness under realistic federated EEG training conditions. To address these gaps, we develop a deep learning-based differentially private federated learning (DP-FL) framework for MI based EEG classification and systematically evaluate privacy leakage under multi-level MIAs, both with and without DP. We train two neural models, a lightweight fully connected network (SimpleNet) and a compact EEGNet architecture in a federated setting on two public MI datasets. Laplace noise is injected into the shared model parameters at privacy budgets epsilon (ε) ∈ {1, 5, 10, ∞} to implement an explicit DP mechanism. Utility is assessed using standard performance metrics accuracy, precision, recall, F1-score, AUC, and loss while privacy leakage is quantified through four complementary MIAs: RLA, FLA, GLA, and CLA [22–24]. Our empirical results show that standard FL without DP provides only partial privacy protection for RLA and FLA, with GLA and CLA achieving high attack success rates across both datasets. Adding DP substantially reduces attack success but also degrades classification performance at very small ε; however, a moderate privacy budget (ε = 5) yields a favourable trade-off, maintaining stable MI decoding while reducing gradient and client-level leakage. Overall, the results provide unified evidence on the privacy–utility trade-off of DP-FL for MI-EEG classification under multiple MIAs, offering practical guidance for configuring DP in FL-based EEG-BCI systems. Importantly, this work does not introduce new FL or DP algorithms; instead, it provides a systematic empirical evaluation of privacy risks under realistic federated EEG training conditions. The main contributions of this work are as follows:

• Developing an end-to-end DP-FL framework designed to reduce privacy vulnerabilities in federated EEG learning.

• Evaluating four attack categories RLA, FLA, GLA, and CLA offering a unified privacy analysis for federated EEG learning.

• Exploring a dual-layer vulnerability analysis showing how privacy leakage emerges at both the sample and client levels using real MI-EEG data.

The remainder of this paper is organized as follows. Section  2 describes the methodology and federated architecture. Section  3 presents the experimental setup and evaluation procedures, performance and privacy-risk results. Section  4 discusses implications, limitations. Section  5 concludes the summary of the study and directions for future research.

Related work

The aim of MIA is to determine whether a specific data sample or user contributed to a model’s training set. Early work in centralised deep learning showed that modern classifiers often leak membership information through output confidence scores, loss distributions, or internal representations. Shokri et al. [25] first formalised this threat using shadow-model-based MIAs, showing that overfitted models exhibit systematically different behaviours for member and non-member samples. Subsequent studies extended this line of work to stronger white-box adversaries. Nasr et al. [15] for example, showed that gradients and intermediate representations can be exploited to infer training membership, even when access to raw data is restricted. These works established MIAs as a fundamental privacy risk in machine learning and motivated the development of mitigation strategies such as regularisation, confidence suppression, and differential privacy.

More recent studies have examined MIAs in FL and model-sharing environments. Yang et al. [26] proposed client-level input perturbation to reduce RLA success while maintaining accuracy, reporting reductions of approximately 30–45% points in some settings. Ahmed et al. [27] introduced MemberShield, which uses label smoothing and early stopping to attenuate the distinguishability of member vs. non-member samples. Gradient-based MIAs have also been explored, Wang et al. [28] proposed GradDiff, which exploits differences in gradient statistics to infer membership, and showed that gradient normalisation and DP can mitigate leakage. However, these studies primarily evaluate single-level MIAs (usually RLA) using image datasets, and do not consider neural time-series data such as EEG. Privacy vulnerabilities in EEG machine-learning systems have only recently begun to be explored. In addition, many clinical EEG applications such as seizure detection operate under strongly imbalanced class distributions, where abnormal events constitute only a small fraction of total recordings. Prior studies have shown that class imbalance substantially affects model learning dynamics, sensitivity, and generalisation performance in EEG systems. Cost-sensitive learning and imbalance-aware classifiers have been proposed as effective approaches for seizure detection under rare-event settings [29, 30]. These findings are also relevant to privacy analysis, as imbalance-driven overfitting may increase membership distinguishability. A number of EEG-FL studies describe privacy as a motivation but do not empirically test MIAs. Some work has investigated EEG-specific privacy leakage, showing that neural signals can encode identity or disease-related features, but very few studies explicitly implement MIAs against EEG classifiers, and even fewer quantify the effect of mitigation strategies [31]. One recent EEG-focused study examined MIA behaviour in CNN-based classifiers and observed that regularisation had limited effect compared with expectations from the vision domain; however, the work did not report percentage-level attack success or reductions under DP [32]. Recent systematic reviews of privacy-preserving BCIs also identify MIAs as a relevant but under-studied threat vector in EEG machine learning, particularly in the context of clinical or BCI applications. While these research work provides important theoretical and empirical insights, it is largely confined to centralised learning settings and vision or tabular datasets and typically evaluates a single attack level at a time. As a result, it offers limited guidance on how privacy risks manifest in distributed training paradigms or in neural time-series data such as EEG, where subject identity and physiological traits are intrinsically embedded in the signal. Importantly, there are currently no published studies that evaluate MIAs on federated MI based EEG classification models while also quantifying the reduction in adversarial success under DP, nor studies that evaluate multiple complementary attack layers beyond RLA. This gap motivates the need for a systematic, empirical investigation of privacy leakage in federated EEG learning under multiple complementary attack models.

Despite these advances, an important empirical gap still remains in existing studies. Existing studies have not systematically evaluated privacy leakage in federated MI-based EEG learning across multiple adversarial access levels under DP. To address this gap, this work establishes an empirical benchmarking framework that systematically quantifies multi-level privacy leakage and mitigation effects in differentially private federated EEG learning.

Table 1 summarises key prior work and highlights the limited empirical study of MIAs in EEG systems compared with other modalities. This work differs from existing research in three key ways. First, unlike EEG-only MIA studies, we analyse privacy leakage specifically in federated EEG learning. Second, unlike FL-privacy studies based mainly on image datasets, we evaluate real neural data where identity-linked structure is more deeply embedded. Third, unlike EEG-FL studies that motivate privacy qualitatively but do not test attacks, we empirically evaluate four complementary MIAs and quantify the effect of DP on each. Together, this provides the first multi-layer privacy-utility analysis for federated MI-EEG systems.

Table 1.

Prior work on MIA and privacy in EEG and machine-learning systems

Study / area	Data type	Attack method	Defense / mitigation	MIA success quantified	EEG-specific
Shokri et al [25]	Image / tabular	Shadow-model MIA	Regularization, DP	√	×
Nasr et al [15]	Deep learning models	White-box GLA and posterior-based MIA	Adversarial and confidence regularization	√	×
Yang et al [26], (CIP)	Federated image models	Posterior-based RLA	Client-level input perturbation	√ (reduction reported)	×
Ahmed et al [27], (MemberShield)	FL	Confidence-based RLA	Label smoothing, early stopping	√ (reduction reported)	×
Wang et al. [28], (GradDiff)	FL	GLA	Gradient normalisation, DP	√	×
EEG privacy surveys (e.g., Xia et al [31])	EEG / BCI	Survey of threat models	N/A	× (review only)	√
EEG classifier MIA analysis (e.g., Cobilean et al [32])	EEG	Posterior-based MIA against EEG CNN classifiers	Regularisation examined	Partially (no DP reduction reported)	√
This study	MI- EEG	RLA, FLA, GLA and CLA	DP (ε-budgets)	√ (multi-level quantified)	√

Methodology

This study develops a privacy-preserving FL framework to assess multi-level privacy leakage in EEG-based MI classification. The framework integrates: (i) decentralized per-subject federated training using the flower framework, (ii) lightweight deep neural classification using SimpleNet alongside EEGNet for benchmarking, (iii) Laplace-based DP applied to client parameter updates, and (iv) systematic evaluation of MIA at multiple levels. Figure 1 illustrates how multi-level privacy leakage can occur in a federated EEG learning pipeline, even when raw neural data never leave the user device. EEG signals are first processed locally and only model updates are transmitted to a central aggregation server. However, these updates can still be exploited by adversaries through several forms of MIAs. The aim of RLA is to determine whether a specific EEG trial was used during client training. On the other hand, FLA infers membership from internal representations such as CSP derived embeddings that capture subject-specific neural structure. The GLA exploits raw gradient updates to distinguish member from non-member samples. The CLA links uploaded model parameters back to the originating subject or device, compromising anonymity. Together, the diagram highlights that standard FL does not eliminate privacy risk; sensitive neural information can still be inferred from model behaviour and shared updates, underscoring the need for explicit privacy-preserving safeguards.

Fig. 1.

Privacy risk in federated EEG learning

Figure 2 illustrates how the proposed DP-FL framework mitigates multi-level MIAs in EEG-based MI classification. As in standard FL, EEG data are processed locally and only model updates are transmitted to a central aggregation server. However, before transmission, Laplace DP noise is injected into client model updates with DP budgets (ε = 1, 5, 10). This noise reduces the distinguishability between member and non-member samples, masking feature-level signals, weakening gradient-based reconstruction, and reducing the ability to link updates to specific clients. Stronger privacy budgets (smaller ε) provide greater protection but may reduce learning performance, highlighting the privacy–utility trade-off. Overall, the figure shows that DP-FL significantly suppresses RLA, FLA, GLA and CLA compared with standard FL The full workflow is described below.

Fig. 2.

Mitigating multi-level MIAs using differentially private federated learning (DP-FL)

Dataset and experimental design

Two publicly available MI based EEG datasets were used. The first dataset (MI1) was the BCI Competition IV Dataset 2a, which contains EEG recordings from nine subjects acquired using 22 channels during a four-class MI task (left hand, right hand, both feet, and tongue). Each subject provided a total of 144 trials, resulting in a data tensor of shape (144 trials × 22 channels × 1000 samples). To align with our binary MI framework, only the left-hand (class 1) and right-hand (class 2) imagery trials were included in the analysis [33–35]. A limitation of the selected benchmark datasets is that both MI1 and MI2 provide relatively balanced binary motor imagery tasks after preprocessing. While this design allows controlled benchmarking of privacy leakage under FL, it does not fully reflect many real-world EEG and clinical applications, such as epileptic seizure detection, where class distributions are highly imbalanced and abnormal events are rare. In practical clinical settings, severe class imbalance may alter both classifier generalisation behaviour and privacy leakage patterns. Therefore, the findings of this study should be interpreted as controlled benchmark evidence rather than direct representation of all clinical EEG scenarios. The second dataset (MI2) was the PhysioNet Motor Movement/Imagery (MMI) dataset, comprising EEG from 109 subjects recorded using 64 channels [36]. All EEG channels were retained. Each trial was segmented into 750-sample epochs, yielding a final per-subject tensor of approximately (250 trials × 64 channels × 750 samples). Each subject completed repeated left-fist (class 1) and right-fist (class 2) MI tasks. In both datasets, each subject was treated as an independent federated client; therefore, raw EEG data remained locally stored, and only model parameters were transmitted during training. After preprocessing, subjects were partitioned using an 80/20 stratified split to create subject-wise training and testing sets. This split was performed once per experiment and was not repeated across multiple random runs. The resulting client datasets were inherently non-IID, reflecting realistic variability in BCI applications. Performance and privacy metrics were evaluated across federated communication rounds (R = 20) and participating clients. Accordingly, the reported standard deviation values capture variability arising from federated optimisation dynamics, reflecting stochastic variation naturally arising from heterogeneous client data distributions and iterative federated aggregation, rather than variability due to repeated random train–test resampling. This evaluation protocol follows established FL practice, where stochastic variation naturally emerges from communication rounds and heterogeneous clients rather than repeated dataset partitioning used in centralised learning settings. For both MI datasets, spatial feature extraction was performed locally on each client using the CSP algorithm. This algorithm learns spatial filters that maximise the variance of one MI class while minimising that of the opposing class, thereby enhancing class-discriminative oscillatory activity. These filters were trained independently for each subject using only local training data, ensuring that raw EEG signals and subject-specific projections never left the client device. The filtered signals were subsequently projected into a low-dimensional subspace, and these components were used as inputs to the classification models.

Decentralized per-subject FL using the flower framework

FL was implemented using the flower framework [37]. In this study, each subject from both datasets was treated as an independent federated client, ensuring strict data locality and preventing any raw EEG signals from leaving the subject’s storage environment. Federated optimization was performed using flower’s implementation of federated averaging (FedAvg), where each client trained a local classifier on its own EEG trials and transmitted only model parameters not data to the central server. In each communication round, eight clients were randomly selected, trained locally using Adam optimisation for 20 epochs and transmitted only their model parameters to the server. The server aggregated these updates and redistributed the global model.

Algorithm 1

Concise differentially private federated EEG learning

Input: EEG datasets split per subject (clients), FL rounds R, epochs E, learning rate η, DP budget ε

Output: Global model G

Initialize global model G₀

For each round r = 1…R:

Server sends current model G_r to selected clients

For each client k in parallel:

Load local EEG data Dₖ

Split into train/test

Initialize local model Wₖ = G_r

For each epoch e = 1…E:

Compute gradients gₖ

Clip gradient norm to threshold C

Add Laplace noise with scale (C/ε)

Update Wₖ using noisy gradients

Return updated weights Wₖ′ to server

Server aggregates:

G_r₊₁ = FedAvg(W₁′ … Wₙ′)

Evaluate model performance (Acc, Precision, Recall, F1, AUC)

Run membership inference attacks:

• Record‑level

• Feature‑level

• Gradient‑level

• Client‑identity

Measure attack accuracy + AUROC

Deep neural classification using SimpleNet and EEGNet

Two deep learning classifiers were implemented to evaluate decentralized MI decoding performance under federated training. The first model, SimpleNet, is a lightweight feedforward neural network [38]. It consists of a compact architecture with two fully connected layers (input projection → ReLU → dropout → classification layer), enabling fast local training and minimal communication overhead during federated aggregation. This makes it particularly suitable for low-resource or privacy-constrained federated environments where computational efficiency and small model size are essential. The second model is EEGNet which is compact CNN architecture tailored for EEG, combining temporal convolutions, depthwise spatial filtering and separable convolutions for spectral–spatial learning [39]. Training used the Adam optimizer (learning rate 0.001), cross-entropy loss, and 20 federated rounds. Performance metrics included accuracy, precision, recall, F1-score, and AUROC.

Differential privacy mechanism to mitigate privacy leakage

To reduce information leakage from shared client updates, a Laplace based DP mechanism was applied locally at each client before transmitting model updates to the server. Laplace noise was selected because it provides a closed form ε-DP guarantee under bounded sensitivity, where sensitivity is controlled through gradient clipping with threshold C. This mechanism is computationally efficient for high-dimensional neural network training. In contrast, Gaussian mechanisms require (ε, δ)-DP accounting and were therefore not used in this study. During training, gradients were first computed using standard backpropagation and then subsequently processed using a two-stage DP procedure at every federated communication round. First, each client’s gradient vector was clipped using an ℓ₂-norm threshold (‖g‖₂ ≤ C (with C = 1.0)) which bounds the influence of any single client update and establishes a fixed sensitivity. Second, element-wise Laplace noise was added to the clipped gradients prior to the optimisation step. The noise was sampled from a Laplace distribution, Laplace (0, σ), where 0 denotes a zero-centered location parameter and σ controls the magnitude of injected noise. The scale parameter was defined as σ = C/ε, with ε ∈ {1,5,10} [40]. The resulting noisy gradients were then used to update local model parameters, and only these DP-perturbed updates were communicated to the server for aggregation. This procedure provides client-level DP protection by limiting how strongly a client’s EEG data can influence shared model parameters. In this study, ε values are reported at the per-round mechanism level to enable controlled empirical comparison across privacy settings. Under standard DP composition theory, repeated application of a DP mechanism across multiple federated rounds results in cumulative privacy loss, meaning that end-to-end privacy guarantees are weaker than the per-round ε value alone [18]. Advanced accounting approaches such as moments accountant and Rényi Differential Privacy (RDP) can provide tighter cumulative privacy bounds [20, 21]. Because the present work focuses on empirical privacy–utility benchmarking rather than deployment-level formal certification, cumulative privacy accounting was outside the current scope and is reserved for future work. Nevertheless, cumulative privacy accounting remains essential for real-world deployment and will be incorporated in future work. The details of DP configuration is shown in Table 2.

Table 2.

DP configuration summary table

Component	Design choice	Description
Clipping mode	Per-update ℓ₂-norm gradient clipping	Applied to each client’s aggregated gradient vector
Clipping threshold	C = 1.0	Bounds the sensitivity of client updates
Noise distribution	Laplace(0, σ)	σ = C/ε
Noise application	Per gradient element	Noise added to each clipped gradient component before optimisation step
Privacy level	ε ∈ {1,5,10}	Lower ε = stronger privacy
DP scope	Client -level DP	Limits each client’s contribution to the global model
Frequency	Every FL communication round	Applied locally before uploading the model update
Accounting	Mechanism-level reporting	ε reported per round (no composition-aware cumulative accounting

Multi-level privacy attack in federated EEG-based MI classification

To systematically assess privacy risks in federated EEG-based MI classification, we implemented a multi-level MIA group. The goal was to evaluate how much private information can be inferred by an adversary under realistic FL conditions. All attacks were conducted under an honest-but-curious threat model, where the server follows the FL protocol but attempts to extract hidden information from model updates. The attacker had access to model prediction outputs, intermediate feature embeddings (white-box access) transmitted model updates and gradients, and historical updates across rounds.

Membership inference attack models

To provide a rigorous yet practical benchmark, two attacker models were employed: Logistic Regression (LR) and Random Forest (RF). Logistic Regression was selected as the primary baseline attacker because classifier-based membership inference methods commonly rely on simple, interpretable models that distinguish member from non-member samples using posterior confidence or loss-based signals [41]. As a linear probabilistic model, LR offers a transparent benchmark for assessing separability between private and non-private samples without excessive adversarial complexity. However, linear classifiers may underestimate privacy leakage when attack signals contain nonlinear interactions or threshold effects. Therefore, Random Forest was additionally incorporated as a stronger ensemble-based attacker baseline. Random Forest can capture nonlinear decision boundaries and higher-order feature interactions, thereby providing a more challenging and realistic adversarial benchmark [42]. Comparative evaluation of LR and RF allows privacy vulnerability to be assessed under both standard and stronger attacker capabilities. All attacks were evaluated for both SimpleNet and EEGNet under standard FL and differentially private FL (DP-FL) settings. This comparative design enables examination of how privacy-preserving mechanisms alter leakage risk across different model architectures and attacker strengths.

RLA: did this individual EEG trial participate in training?

The RLA aims to determine whether an individual EEG trial was part of a client’s local training set [43]. The adversary is assumed to have black-box access to the model, allowing it to observe only the predicted class probabilities and per-trial cross-entropy losses. After federated training, the attacker collects softmax outputs and loss values for both member and non-member samples. These values are combined into a compact three-dimensional attack feature vector comprising the two class probabilities and the loss. LR and RF attack classifiers were trained separately and evaluated comparatively to distinguish member from non-member samples. During evaluation, the attack success is quantified using accuracy, AUC, and the true-positive rate at an extremely low false-positive threshold (TPR@0.1%FPR), providing a sensitive estimate of how easily single-trial membership can be inferred.

FLA: did this feature representation originate from training data?

The FLA extends membership inference to internal model representations, targeting latent features that emerge from SimpleNet’s fully connected mapping or EEGNet’s convolutional layers [44]. In this setting, the adversary has white-box access to intermediate activations extracted during forward passes. For every trial in the training and test sets, the activations at the chosen internal layer are recorded, flattened, and treated as the attack input. These activation vectors are labelled as member or non-member according to their origin. LR and RF attack classifiers were trained separately on these flattened features, and its performance reflects the degree to which internal representations retain subject-specific or sample-specific information. Successful feature-level inference indicates that latent embeddings, although not raw EEG, still leak identifying structure about the training data.

GLA: did this gradient representation originate from training data?

The GLA evaluates whether membership information is encoded within the transmitted model updates themselves [23]. Here the adversary has full white-box access to client weight updates and computationally reconstructs per-round gradient vectors by subtracting the previous round’s parameters from the newly received ones. These real gradients represent updates influenced by the client’s training samples. To form a contrasting non-member baseline, we generate synthetic “negative” gradients by sampling from a Gaussian distribution matched to the empirical mean and variance of the real updates. The positive (member-linked) and negative (baseline) gradient vectors are used to train a LR classifier to discriminate the two. Attack accuracy directly reflects how strongly individual data points influence model updates and how much sensitive training information survives the DP noise injected during DP-SGD.

CLA: did this model update originate from a specific federated client?

The CLA attempts to identify which federated client (i.e., which EEG subject) generated a given model update vector [45]. Unlike the primary MI classification task, which predicts behavioural labels (left-hand vs. right-hand imagery), the objective of CLA is to infer client identity, representing a higher-level privacy threat in FL. For this attack, gradient update vectors from all communication rounds are collected and assigned a client-ID label corresponding to their true source. Each federated client therefore represents one class in the attack classifier; consequently, the number of classes equals the number of participating subjects, resulting in 9 clients/classes for MI1 and 109 clients/classes for MI2. To construct the attack dataset, client update vectors are aggregated across all federated communication rounds (R = 20) and labelled according to their originating client. This aggregated cross-round setting reflects a realistic honest-but-curious server adversary that can observe historical updates throughout training rather than a single communication step. Because model update vectors are high-dimensional and noisy, principal component analysis (PCA) is applied to obtain a compact latent representation that preserves dominant variance while improving numerical stability. Update vectors are compressed into a low-dimensional space using up to 16 principal components (d ≤ 16), balancing variance retention, computational efficiency, and prevention of adversarial overfitting. The resulting representations are used to train both LR and RF classifiers that map each update vector to its originating client. High CLA performance indicates that federated model updates encode subject-specific neural signatures, demonstrating that federated EEG training may leak client identity information even when individual EEG trials remain locally stored. To improve conceptual clarity for readers unfamiliar with adversarial privacy analysis, Table 3 summarizes the different MIAs, their adversary access assumptions, and the corresponding level of privacy risk in federated EEG learning.

Table 3.

Summary of MIAs, adversary access assumptions, and privacy risks in federated EEG learning

Attack type	Privacy level analyzed	Adversary access	Inference objective	Privacy risk
RLA	Trial/record-level	Model output confidence + loss (black-box)	Whether a sample was in training set	Medium
FLA	Representation-level	Intermediate feature representations / latent activations (white-box feature access)	Whether extracted features originate from training set	Medium–High
GLA	Gradient/Update level	Client update vectors/gradients per round (white-box server)	Whether a client update contains member information	High
CLA	Client identity level	Client updates + client ID labels across rounds (server access)	Which client/subject produced an update	Very High

Result

This study evaluates the proposed privacy-preserving FL framework using two real MI based EEG datasets. The framework combines (i) decentralized per-subject training implemented in the flower FL architecture, (ii) two neural classifiers (the lightweight SimpleNet model and the EEG-specific EEGNet model), and (iii) a non-Opacus DP mechanism based on gradient clipping with Laplace noise. Model performance and privacy leakage were jointly assessed under a multi-level adversarial evaluation consisting of RLA, FLA, GLA and CLA MIAs. For each attack category, we quantified the extent to which information about individual EEG trials or client identity could be inferred from model predictions, internal feature representations, or shared gradient updates. This allowed a comprehensive examination of the privacy–utility trade-off in federated EEG learning.

In Table 4, under the baseline FL setting without DP, FL-EEGNet achieved slightly higher classification performance than FL-SimpleNet (60.4% vs. 57.6% accuracy; AUROC 63.0% vs. 62.5%), indicating modestly improved utility under standard FL. Introducing stronger privacy noise (ε = 1) substantially reduced predictive performance, particularly for DP-FL-SimpleNet, which showed poor discriminatory ability (AUROC 42.7%). In contrast, DP-FL-EEGNet demonstrated comparatively greater robustness, maintaining near-random discrimination (AUROC 50.6%) with higher recall. At ε = 5, both models recovered part of their predictive utility, with DP-FL-SimpleNet approaching baseline accuracy and DP-FL-EEGNet showing moderate improvement in F1 score and AUROC. When ε increased to 10, classification performance became closer to the non-DP baseline, reflecting reduced privacy noise and partial restoration of model utility. Training and testing loss were generally comparable across most settings, although baseline FL-EEGNet showed elevated testing loss, suggesting some calibration instability. Overall, these findings demonstrate the expected privacy–utility trade-off, with ε = 5 representing a practical compromise between privacy preservation and predictive performance.

Table 4.

Classification performance of SimpleNet and EEGNet on MI1 under FL and DP-FL (ε ∈ {1,5,10})

Methods	Epsilon (ε)	Acc ± Std	Precision ± Std	Recall ± Std	F1 Score ± Std	AUROC ± Std	Avg training loss	Avg testing loss
FL-SimpleNet	–	57.6 ± 2.3	58.6 ± 2.8	53.2 ± 1.9	55.5 ± 2.1	62.5 ± 2.6	0.6	0.6
FL-EEGNet	–	60.4 ± 2.9	61.6 ± 2.3	56.5 ± 6.3	58.5 ± 4.8	63.0 ± 2.9	0.7	7.1
DP-FL-SimpleNet	ε = 1	44.1 ± 4.1	43.8 ± 4.3	52.9 ± 18.3	46.8 ± 9.65	42.7 ± 4.4	13.5	12.9
DP-FL-EEGNet	–	50.3 ± 2.3	50.1 ± 2.3	67.6 ± 11.6	57.01 ± 4.84	50.6 ± 2.8	7.5	7.1
DP-FL-SimpleNet	ε = 5	55.9 ± 4.4	55.3 ± 5.2	68.1 ± 12.9	53.92 ± 4.85	52.5 ± 2.3	0.8	0.8
DP-FL-EEGNet	–	51.3 ± 3.2	50.8 ± 3.1	55.6 ± 12.1	59.59 ± 5.97	58.6 ± 5.6	0.8	0.8
DP-FL-SimpleNet	ε = 10	56.0 ± 1.9	58.0 ± 4.2	51.3 ± 11.1	52.80 ± 6.06	59.8 ± 2.9	0.7	0.6
DP-FL-EEGNet	–	58.1 ± 2.0	59.2 ± 3.3	58.1 ± 12.2	57.37 ± 5.42	61.7 ± 2.6	0.7	0.7

Values are reported as mean ± Std aggregated across federated rounds (R = 20) under each ε setting

Tables 5 and 6 present privacy attack performance on the MI1 dataset under FL and DP-FL using LR and RF attacker baselines. Under standard FL, RF generally achieved higher attack success than LR, particularly for the more sensitive GLA and CLA scenarios, where GLA accuracy reached 96.5–99.2% with AUROC = 100.0%, and CLA accuracy reached 93.0–94.7% with AUROC of 97.2–98.1%, indicating substantial privacy leakage in the non-private setting. After applying DP-FL (ε = 1, 5, and 10), attack performance was markedly reduced for both attacker models, especially for GLA and CLA. For example, RF-based GLA accuracy decreased to 34.3–42.1% with AUROC of 28.3–41.3%, while CLA accuracy declined to 28.1–36.7% with AUROC of 45.2–60.1%. Similar reductions were observed under LR. Although some DP-FL settings retained moderate or high accuracy values for RLA and FLA, the corresponding AUROC values remained near or below chance level, indicating poor separability between member and non-member samples. Therefore, these higher accuracy values likely reflect prediction bias rather than meaningful privacy leakage. Overall, DP substantially mitigated effective privacy leakage on MI1.

Table 5.

MIA performance (accuracy and AUROC) on MI1 across four attack types under FL and DP-FL

Methods	Epsilon ( ε)	RLA		FLA		GLA			CLA
		Acc ± Std	AUROC ± Std	Acc ± Std	AUROC ± Std	Acc ± Std	AUROC ± Std	TPR at 1% FPR	Acc ± Std	AUROC ± Std
FL-SimpleNet	–	70.4 ± 2.1	52.2 ± 3.1	77.8 ± 0.2	48.4 ± 0.3	100 ± 0.1	100 ± 0.1	100 ± 0.2	95.8 ± 15.7	99.9 ± 0.2
FL-EEGNet	–	68.5 ± 2	49.1 ± 4.5	77.8 ± 0.4	48.4 ± 0.1	98.7 ± 2.9	100 ± 0.3	100 ± 0.4	96.4 ± 13.1	99.5 ± 2.1
DP-FL-SimpleNet	ε = 1	72.1 ± 1.6	50.8 ± 4.3	77.8 ± 0.1	48.4 ± 0.2	39.3 ± 13.2	36.6 ± 13.9	2.8 ± 4.7	8.1 ± 5.3	47.5 ± 4.6
DP-FL-EEGNet	–	72.7 ± 2.2	50.1 ± 4.2	77.8 ± 0.3	48.4 ± 0.2	43.8 ± 11.1	41.3 ± 15.6	6.9 ± 22.5	11.1 ± 6.1	49.7 ± 6.1
DP-FL-SimpleNet	ε = 5	69.6 ± 2.3	49.9 ± 4.9	77.8 ± 0.1	48.4 ± 0.5	40.8 ± 8.3	34.9 ± 13.3	1.4 ± 3.7	12.5 ± 5.1	50.9 ± 6.1
DP-FL-EEGNet	–	68.9 ± 2.9	49.5 ± 3.9	77.8 ± 0.2	48.4 ± 0.3	41.2 ± 11.9	36.6 ± 14.2	2.5 ± 4.4	9.7 ± 7.0	49.7 ± 5.9
DP-FL-SimpleNet	ε = 10	68.4 ± 1.9	49.5 ± 4.1	77.8 ± 0.4	48.5 ± 0.1	27.9 ± 18.9	23.9 ± 15.9	0.0	14.53 ± 3.54	60.3 ± 13.5
DP-FL-EEGNet	–	69.4 ± 2.3	50.0 ± 4.3	77.8 ± 0.2	48.4 ± 0.1	41.6 ± 12.8	38.9 ± 12.9	1.9 ± 5.1	14.9 ± 6.6	51.9 ± 5.9

Values are reported as mean ± Std aggregated across federated rounds (R = 20) under each ε setting under LR attack model

Table 6.

MIA performance (accuracy and AUROC) on MI1 across four attack types under FL and DP-FL

Methods	Epsilon (ε)	RLA		FLA		GLA			CLA
		Acc ± Std	AUROC ± Std	Acc ± Std	AUROC ± Std	Acc ± Std	AUROC ± Std	TPR at 1% FPR	Acc ± Std	AUROC ± Std
FL-SimpleNet	–	66.8 ± 4.6	50.9 ± 6.7	79.3 ± 0.0	49.3 ± 0.0	99.2 ± 1.9	100.0 ± 0.0	100.0 ± 0.0	93.0 ± 16.3	98.1 ± 5.4
FL-EEGNet	–	68.4 ± 3.6	49.8 ± 7.0	79.3 ± 0.0	49.3 ± 0.0	96.5 ± 7.9	100.0 ± 0.0	100.0 ± 0.0	94.7 ± 10.1	97.2 ± 11.8
DP-FL-SimpleNet	ε = 1	71.0 ± 4.4	51.6 ± 8.4	79.3 ± 0.0	49.3 ± 0.0	34.3 ± 16.7	28.3 ± 23.1	8.3 ± 23.1	33.5 ± 14.7	51.9 ± 11.5
DP-FL-EEGNet	–	72.2 ± 3.3	48.2 ± 8.1	79.3 ± 0.0	49.3 ± 0.0	36.5 ± 24.6	31.0 ± 27.2	12.2 ± 30.5	34.6 ± 16.1	52.7 ± 19.1
DP-FL-SimpleNet	ε = 5	69.7 ± 4.9	46.4 ± 8.6	79.3 ± 0.0	49.3 ± 0.0	34.9 ± 25.9	32.6 ± 27.6	11.5 ± 30.6	36.7 ± 15.3	60.1 ± 20.2
DP-FL-EEGNet	–	69.3 ± 3.5	52.0 ± 7.7	79.3 ± 0.0	49.3 ± 0.0	36.9 ± 19.7	28.9 ± 22.3	6.7 ± 22.7	29.8 ± 17.1	45.2 ± 16.4
DP-FL-SimpleNet	ε = 10	69.9 ± 4.2	50.6 ± 7.2	79.3 ± 0.0	49.3 ± 0.0	42.1 ± 22.5	41.3 ± 24.3	15.7 ± 30.1	28.1 ± 17.5	50.9 ± 15.1
DP-FL-EEGNet	–	67.7 ± 4.1	49.3 ± 6.6	79.3 ± 0.0	49.3 ± 0.0	41.5 ± 22.1	35.0 ± 27.8	14.8 ± 30.8	33.8 ± 17.9	54.7 ± 15.4

Values are reported as mean ± Std aggregated across federated rounds (R = 20) under each ε setting under RF attack model

Table 7 reports MI classification performance of the two federated EEG models under differential privacy budgets for the MI2 dataset. In the baseline FL condition without DP, EEGNet generally outperformed SimpleNet, achieving the highest accuracy (59.7%), precision (70.6%), recall (68.6%), F1 score (68.9%), and AUROC (74.5%), indicating stronger discriminative feature learning for MI-based EEG classification. SimpleNet showed moderate performance (accuracy 57.5%), with lower recall and F1 score. Introducing strong privacy noise (ε = 1) substantially reduced performance for both models, with accuracy declining to approximately 50% and AUROC approaching random discrimination (50–51%), indicating that aggressive noise injection disrupted useful signal representations. Under a moderate privacy budget (ε = 5), both models showed partial recovery in classification accuracy; however, model robustness varied by metric. Notably, DP-FL-EEGNet achieved higher accuracy (57.7%) but AUROC remained low (48.9%), suggesting limited class separability despite acceptable threshold-based predictions. At ε = 10, corresponding to weaker privacy noise, both models improved further, with EEGNet regaining competitive performance (58.6% accuracy; 62.0% AUROC), although still below its non-private baseline. Training and testing loss were generally similar within each ε setting, suggesting stable optimisation behaviour. Overall, the results demonstrate the expected privacy–utility trade-off, where stronger privacy protection reduces predictive performance, while relaxed privacy budgets allow partial utility recovery.

Table 7.

Classification performance of SimpleNet and EEGNet on MI2 under FL and DP-FL (ε ∈ {1,5,10})

Methods	Epsilon (ε)	Acc ± Std	Precision ± Std	Recall ± Std	F1 Score ± Std	AUROC ± Std	Avg training loss	Avg testing loss
FL-SimpleNet	–	57.5 ± 5.1	64.0 ± 4.9	48.9 ± 17.0	53.0 ± 14.1	65.70 ± 9.60	0.7	0.7
FL-EEGNet	–	59.7 ± 3.2	70.6 ± 3.8	68.6 ± 1.6	68.9 ± 2.2	74.5 ± 3.8	0.6	0.6
DP-FL-SimpleNet	ε = 1	49.8 ± 3.7	50.7 ± 4.5	47.6 ± 23.4	45.2 ± 15.9	50.8 ± 5.8	8.1	8.23
DP-FL-EEGNet	–	49.8 ± 3.7	50.7 ± 4.5	47.6 ± 23.4	45.2 ± 15.9	50.6 ± 5.8	7.2	7.2
DP-FL-SimpleNet	ε = 5	55.9 ± 2.9	59.2 ± 6.7	41.8 ± 12.3	46.6 ± 8.8	57.0 ± 4.1	0.8	0.8
DP-FL-EEGNet	–	57.7 ± 4.4	48.3 ± 4.5	55.2 ± 19.1	49.6 ± 9.6	48.9 ± 5.9	1.1	1.1
DP-FL-SimpleNet	ε = 10	53.2 ± 4.1	54.4 ± 6.6	54.7 ± 17.9	51.1 ± 10.3	55.8 ± 5.9	0.7	0.7
DP-FL-EEGNet	–	58.6 ± 5.5	63.3 ± 8.6	44.3 ± 13.1	49.9 ± 8.8	62.0 ± 6.5	0.7	0.7

Values represent mean ± standard deviation

Tables 8 and 9 summarise MIA performance on the MI2 dataset under standard FL and the proposed DP-FL framework using LR and RF attacker baselines, respectively. Under standard FL, both attacker models demonstrated substantial privacy leakage, particularly for GLA and CLA. For LR, GLA accuracy reached 98.7–99.9% with AUROC ≈ 100%, while CLA accuracy reached 94.1–97.6% with AUROC of 99.1–99.3%. Similarly, RF produced strong attack success, with GLA accuracy of 97.6–99.4% and CLA accuracy of 94.2–94.4%, both with near-perfect AUROC values. After applying DP-FL (ε = 1, 5, and 10), attack performance was markedly reduced for both attacker models, especially for GLA and CLA. For example, RF-based GLA accuracy decreased to 41.3–45.1% with AUROC of 38.7–42.0%, while CLA accuracy declined to 47.5–60.3% with lower AUROC values. Similar reductions were observed under LR, where CLA accuracy decreased to 48.1–53.9% with AUROC of 48.1–53.9%. Although RLA and FLA retained comparatively higher attack accuracy under DP-FL, especially for RF, the corresponding AUROC values were substantially lower than in the non-private FL setting, indicating weaker effective attack discrimination than suggested by accuracy alone. Overall, these findings demonstrate that the proposed DP-FL framework substantially mitigated meaningful privacy leakage on MI2, with strongest protection observed for update-level and client-level attacks.

Table 8.

MIA performance (accuracy and AUROC) on MI2 across four attack types under FL and DP-FL framework of LR attack baseline

Methods	Epsilon (ε)	RLA		FLA		GLA			CLA
		Acc ± SD	AUROC ± SD	Acc ± SD	AUROC ± SD	Acc ± SD	AUROC ± SD	TPR at 1% FPR	Acc ± SD	AUROC ± SD
FL-SimpleNet	–	70.7 ± 2.8	52.5 ± 6	78.4 ± 0.4	54.3 ± 0.3	98.7 ± 3.2	100 ± 0.1	100 ± 0.3	97.6 ± 10.1	99.3 ± 2.8
FL-EEGNet	–	69.6 ± 2.3	50.4 ± 3.9	78.4 0.2	54.3 ± 0.1	99.9 ± 0.5	100 ± 0.4	100 ± 0.1	94.1 ± 15.0	99.1 ± 3.7
DP-FL-SimpleNet	ε = 1	72.0 ± 2.8	49.2 ± 4.5	78.4 ± 0.5	54.3 ± 0.3	45.9 ± 10.3	41.3 ± 17.7	7.5 ± 22.5	13.1 ± 7.4	49.3 ± 9.2
DP-FL-EEGNet	–	71.6 ± 2.6	49.5 ± 5.6	78.4 ± 0.1	54.3 ± 0.3	40.9 ± 13.7	37.7 ± 19.3	6.3 ± 22.2	12.6 ± 5.1	48.1 ± 7.4
DP-FL-SimpleNet	ε = 5	70.3 ± 2.3	50.6 ± 4.3	78.4 ± 0.2	54.3 ± 0.1	42.4 ± 9.6	39.6 ± 19.8	7.4 ± 22.4	12.2 ± 6.3	48.3 ± 5.9
DP-FL-EEGNet	–	69.6 ± 2.6	52.2 ± 4.6	78.4 ± 0.4	54.3 ± 0.5	42.7 ± 18.2	39.3 ± 19.6	8.1 ± 22.4	17.4 ± 8.8	50.4 ± 7.7
DP-FL-SimpleNet	ε = 10	69.4 ± 2.4	52.0 ± 4.6	78.4 ± 0.1	54.3 ± 0.3	42.1 ± 11.6	41.4 ± 18.9	8.2 ± 23.7	16.2 ± 7.4	53.9 ± 8.8
DP-FL-EEGNet	–	68.9 ± 2.7	49.4 ± 4	78.4 ± 0.2	54.3 ± 0.4	47.8 ± 15.6	43.9 ± 16.6	8.6 ± 22.1	14.9 ± 8.6	53.4 ± 6.5

Table 9.

MIA performance (accuracy and AUROC) on MI2 across four attack types under FL and DP-FL framework of RF attack baseline

Methods	Epsilon (ε)	RLA		FLA		GLA			CLA
		Acc ± SD	AUROC ± SD	Acc ± SD	AUROC ± SD	Acc ± SD	AUROC ± SD	TPR at 1% FPR	Acc ± SD	AUROC ± SD
FL-SimpleNet	–	80.2 ± 3.5	88.4 ± 2.9	76.4 ± 0.0	82.5 ± 0.0	97.6 ± 2.1	99.3 ± 0.8	95.8 ± 12.4	94.4 ± 4.1	99.1 ± 0.6
FL-EEGNet	–	82.6 ± 3.2	90.1 ± 2.5	76.4 ± 0.0	82.5 ± 0.0	99.4 ± 0.6	99.9 ± 0.2	98.1 ± 6.3	94.2 ± 4.5	99.0 ± 0.8
DP-FL-SimpleNet	ε = 1	70.8 ± 3.1	76.9 ± 3.3	73.2 ± 0.0	79.8 ± 0.0	42.0 ± 11.6	39.8 ± 12.1	3.1 ± 5.4	12.0 ± 4.0	47.5 ± 4.8
DP-FL-EEGNet	–	72.0 ± 3.3	78.2 ± 3.5	73.2 ± 0.0	79.8 ± 0.0	43.0 ± 12.2	40.7 ± 12.9	4.0 ± 6.1	13.3 ± 4.3	49.0 ± 5.1
DP-FL-SimpleNet	ε = 5	72.6 ± 2.9	79.0 ± 3.1	74.1 ± 0.0	80.6 ± 0.0	45.1 ± 10.4	42.0 ± 11.7	5.1 ± 7.0	14.0 ± 4.6	50.7 ± 5.5
DP-FL-EEGNet	–	73.1 ± 3.0	79.5 ± 3.0	74.1 ± 0.0	80.6 ± 0.0	43.4 ± 11.3	40.9 ± 12.0	4.4 ± 6.8	18.3 ± 5.2	50.3 ± 5.4
DP-FL-SimpleNet	ε = 10	74.5 ± 2.8	80.8 ± 2.9	75.0 ± 0.0	81.2 ± 0.0	41.3 ± 11.5	38.7 ± 12.0	2.8 ± 5.5	12.4 ± 3.8	60.3 ± 13.5
DP-FL-EEGNet	–	75.2 ± 2.9	81.5 ± 3.1	75.0 ± 0.0	81.2 ± 0.0	43.3 ± 12.0	40.2 ± 12.6	3.1 ± 5.9	14.9 ± 6.6	51.9 ± 5.9

The PCA scatter plot in Fig. 3a, representing the MI1 dataset, shows partial separation between the two motor imagery classes in PCA space. Label 0 samples are more widely dispersed, especially along PC1, while Label 1 samples are relatively more concentrated and extend upward along PC2. Although overlap is present near the centre, the visible directional trend indicates that CSP preserved useful class-discriminative information. Figure 3b, representing the MI2 dataset, shows clearer separation along PC2. Label 1 samples are mainly located in the upper region (positive PC2), whereas Label 0 samples are more concentrated in the lower region (negative PC2). However, some overlap and several outliers remain, indicating residual variability within the dataset.

Fig. 3.

PCA scatter plot of CSP features for datasets a MI1 and b MI2

The feature–label correlation plots in Fig. 4 indicate that both datasets retain class-discriminative neural structure after CSP transformation. In MI1, correlations are moderate and distributed across multiple features, with both positive and negative associations contributing to class separation. This suggests that discriminative information is spread across several CSP-derived components. In contrast, MI2 exhibits stronger and more concentrated correlations, particularly among a smaller subset of highly associated features, indicating that key components contribute more prominently to motor imagery discrimination.

Fig. 4.

Feature–label correlations (top-10 CSP features), for dataset a MI1 dataset and b MI2 dataset

Figure 5 illustrates the distribution of client-level classification accuracy across eight federated clients for EEGNet and SimpleNet under four privacy settings (ε = ∞, 10, 5, and 1). Each boxplot summarises the variability in accuracy across the eight participating clients under a given model–privacy configuration. For the MI1 dataset, several higher-performing settings are observed under weaker privacy constraints, particularly EEGNet with ε = ∞ and SimpleNet with ε = 10, while SimpleNet with ε = 5 also demonstrates relatively stable performance with limited inter-client variability. Accuracy generally declines under ε = 1 for both models, reflecting the impact of stronger DP noise.

Fig. 5.

Per-client accuracy distribution across models and privacy budgets for a MI1 dataset and b MI2 dataset

For the MI2 dataset, variability across the eight clients is greater than in MI1, indicating stronger subject heterogeneity. Some settings, particularly SimpleNet with ε = 10, maintain relatively high median accuracy, whereas ε = 1 yields the weakest overall performance. Overall, the figure highlights a clear privacy–utility trade-off across eight federated clients, where stronger privacy protection reduces predictive performance and may increase between-client variability.

Figure 6 shows privacy attack performance on the MI1 dataset, where panel (a) represents SimpleNet and panel (b) represents EEGNet. In both models, RLA and FLA remain comparatively higher across privacy budgets, indicating residual record-level and feature-level leakage. In contrast, GLA and CLA are near-perfect without DP (ε = ∞), showing substantial leakage through gradients and client updates. After applying DP (ε = 1, 5, 10), GLA and CLA decline markedly. RF generally achieves stronger attack success than LR. Overall, DP substantially reduces update-level and client-level privacy leakage, although some residual risks remain.

Fig. 6.

Privacy leakage under multi-level MIAs on the MI1 dataset for a SimpleNet and b EEGNet across privacy budgets (ε) under both LR and RF attacker models

Figure 7 shows privacy attack performance on the MI2 dataset, where panel (a) represents SimpleNet and panel (b) represents EEGNet. In both models, RLA and FLA remain relatively high across all privacy budgets, indicating residual record-level and feature-level leakage. GLA and CLA are near-perfect without DP (ε = ∞), demonstrating strong privacy leakage in standard FL. After applying DP (ε = 1, 5, 10), GLA and CLA decrease substantially, showing effective protection of gradients and client updates. RF generally performs stronger than LR. Overall, DP meaningfully reduces privacy leakage on MI2, especially for update-level and client-level attacks.

Fig. 7.

Privacy leakage under multi-level MIAs in the MI2 Dataset for a SimpleNet and b EEGNet across different privacy budgets (ε) under both LR and RF attack models

In Fig. 8, the x-axis represents the loss gap (test loss − train loss), reflecting the model generalization gap and potential overfitting, while the y-axis shows RLA accuracy. For the MI1 dataset, a clear positive relationship is observed, where larger loss gaps are associated with higher attack accuracy, suggesting that more overfitted FL models leak greater record-level membership information. In contrast, the MI2 dataset shows only a weak positive trend, indicating limited dependence between overfitting and leakage. Ordinary least squares (OLS) regression supported these observations, showing a significant association for MI1 (R² = 0.20, p < 0.001), but not for MI2 (R² = 0.002, p = 0.535). Overall, model generalization quality appears meaningfully associated with privacy risk, particularly in MI1.

Fig. 8.

Relationship between loss gap and RLA accuracy for a MI1 dataset and b MI2 dataset under LR attack model

Figure 9 illustrates how RLA accuracy changes over 20 federated rounds for ε = ∞, 5, and 1. Across both datasets, attack accuracy consistently remains above chance level, indicating persistent record-level privacy risk throughout training. In the non-private setting (ε = ∞), leakage remains moderately stable across rounds. The ε = 5 setting shows fluctuating but comparable behaviour. Under stronger privacy noise (ε = 1), RLA accuracy remains variable and is often similar to or higher than the other settings, suggesting that differential privacy does not consistently suppress record-level leakage. Overall, these findings indicate that record-level privacy vulnerability evolves dynamically during federated training and may persist even under DP protection

Fig. 9.

Evolution of RLA accuracy across federated rounds under different privacy budgets for (a) MI1 and MI2 dataset under LR attack model

Fig. 10.

Gradient-norm distributions for member versus non-member samples under GLA for MI1 dataset under LR attack model

Figures 11 and 11 compare gradient-norm distributions for training-set (member) and unseen (non-member) EEG samples under gradient-level attacks in federated learning. Across both MI1 and MI2 datasets, the two distributions overlap substantially, suggesting that GLA operates probabilistically rather than deterministically. However, subtle distributional shifts remain. In MI1, member samples often exhibit slightly larger spread or shifted gradient norms, whereas MI2 shows more model-dependent separation with stronger overlap in some settings. These small but systematic differences can still enable above-chance attack performance. Overall, the findings indicate that gradient statistics may encode membership information, meaning that standard federated EEG training can expose privacy-sensitive training signals unless explicit defences are applied.

Fig. 11.

Gradient-norm distributions for member versus non-member samples under GLA for MI2 dataset under LR attack model

Discussion

This study developed a FL framework for MI based EEG classification and systematically evaluated privacy leakage under multiple MIA settings. Models were trained locally on subject-specific EEG data and aggregated using FedAvg, with two neural architectures (SimpleNet and EEGNet) evaluated across two public MI datasets. Different ε values for example, 1, 5, and 10 was incorporated with DP to examine its impact on both classification utility and privacy leakage. In addition, the relationship between model generalisation and privacy risk was analysed using regression between training–testing loss gaps and attack success. A principal finding was that FL alone did not guarantee privacy, even though raw EEG signals never left the client device. Across both datasets, federated models were consistently vulnerable to privacy leakage, even though raw EEG signals never left the client device. This confirms that sharing only parameter updates does not guarantee privacy in EEG-based BCIs, as person-specific neural structure may remains encoded within learned model representations and update dynamics. A key finding was that the relationship between generalisation quality and privacy leakage was dataset dependent. In the MI1 dataset, a significant positive association was observed between loss gap and attack success, indicating that overfitting amplifies privacy risk by encouraging reliance on idiosyncratic neural patterns. In contrast, this relationship was not significant in the MI2 dataset, where substantial privacy leakage persisted even when generalisation gaps were small. This indicates that privacy risk in federated EEG learning is not solely an artefact of poor model generalisation; rather, intrinsic subject-specific characteristics of EEG signals can produce baseline privacy vulnerability even in well-trained models. From a clinical perspective, this implies that models with acceptable decoding performance may still expose neural identity cues.

DP substantially reduced privacy leakage for GLA and CLA, particularly at lower ε values. These results indicate that perturbing shared updates can effectively suppress leakage arising from gradients and client-specific update signatures. However, RLA remained above chance across privacy budgets, and FLA often retained moderate attack accuracy, although AUROC values were frequently near chance level. This suggests that DP is more effective against update-level leakage than against inferential signals preserved in outputs or latent representations. Because DP noise was applied to model updates rather than directly to internal feature spaces, residual leakage may remain even under stronger privacy settings.

An additional contributing factor to this behaviour is the use of CSP feature extraction prior to classification. This CSP is designed to maximise variance differences between MI classes and is well known to enhance class-discriminative spatial structure in EEG signals. As reflected in the PCA projections and feature–label correlations, CSP produces low-dimensional representations that preserve both task-relevant and subject-specific neural characteristics. While this stabilises MI decoding and supports FL under non-IID conditions, it also means that identity-linked structure can persist in latent feature spaces. Consequently, even when DP perturbs gradient updates, CSP-derived representations may retain sufficient structure to support FLA.

In federated EEG learning, Gradient-level leakage represented one of the most severe exposure channels in the non-private baseline. Under standard FL, both attacker models achieved very high GLA and CLA success, with RF generally outperforming LR, particularly on MI1 and MI2. This suggests that nonlinear attackers can exploit richer leakage patterns than linear baselines. The near-perfect GLA performance warrants careful interpretation. Prior studies have shown that shared gradients can reveal highly informative private signals, including membership status and approximate reconstruction of training inputs [15, 46, 47], . In the present benchmark setting, such strong attack success likely reflects the controlled binary-task design, CSP-enhanced representations, and per-subject client federation, which together preserved highly separable membership-related statistical structure. These findings should therefore be interpreted as an upper-bound benchmark vulnerability rather than universal behaviour across all federated EEG systems. Although RF exposed stronger privacy leakage than LR in several scenarios, both attacker models showed substantial reductions in GLA and CLA after DP was applied. This strengthens confidence that the protective effect of DP was not limited to a single weak adversary. Nevertheless, more adaptive attacks, including shadow-model neural attackers, multilayer perceptrons, or white-box reconstruction methods, may reveal additional vulnerability and should be explored in future work. Regarding predictive utility, EEGNet generally achieved stronger classification performance than SimpleNet in the baseline FL setting and several DP conditions, although relative performance varied by dataset and privacy budget. However, higher decoding accuracy did not consistently correspond to better privacy robustness. Privacy leakage appeared to depend more strongly on the statistical properties of EEG signals and federated optimisation dynamics than on model architecture alone. Consequently, privacy-preserving EEG systems are likely to require system-level safeguards rather than reliance on classifier selection.

Overall, this study provides empirical evidence that privacy leakage in federated EEG learning occurs at multiple levels and cannot be assumed absent simply because raw data remain local. DP offered meaningful protection, particularly against gradient- and client-level attacks, but residual risks remained for record- and feature-level inference. These findings provide an evidence-based foundation for developing privacy-aware, clinically trustworthy BCI systems and for guiding future research into stronger privacy mechanisms for neural data analytics.

An important limitation of this study is that both evaluated datasets represent relatively balanced binary MI tasks, whereas many real-world EEG applications, particularly seizure detection and clinical monitoring, involve highly imbalanced class distributions. Class imbalance may influence membership inference vulnerability in several ways. Models trained on rare-event data are more prone to overfitting minority-class samples, which may increase distinguishability between member and non-member records and thereby amplify record-level attack success. Similarly, rare pathological EEG signatures may generate highly distinctive gradient updates, potentially increasing gradient-level and client-level leakage. Therefore, privacy risks observed in balanced MI datasets may underestimate the attack vulnerability present in real-world clinical EEG systems. Secondly, the ε values reported here represent per-round privacy settings, and cumulative privacy loss over repeated rounds may be larger under standard composition theory.

Conclusion

This study developed and evaluated a DP-FL framework for MI based EEG classification, examining both model performance and privacy leakage across multiple levels of MIAs. jointly examining model performance and privacy leakage under multiple membership-inference attack settings. Although raw EEG data were retained locally at each client, the results demonstrate that federated models remain vulnerable to privacy attacks, confirming that data locality alone does not guarantee privacy in EEG-based BCIs. Privacy leakage was observed across multiple attack settings, indicating that sensitive neural information can still be inferred from model behaviour and shared updates. A key finding was that privacy leakage was dataset dependent. In the MI1 dataset, record-level attack success was positively associated with the training–testing loss gap, consistent with established links between overfitting and membership inference. In contrast, in the MI2 dataset, substantial privacy leakage occurred even when the loss gap was small, indicating that privacy risk in federated EEG systems is not solely driven by overfitting. Instead, intrinsic subject-specific neural characteristics embedded in EEG signals contribute to baseline privacy vulnerability, even in well-generalised models.

The application of DP reduced attack success rates, particularly for GLA and CLA, demonstrating that DP can meaningfully mitigate deeper forms of privacy leakage. Under DP, both neural architectures exhibited moderate privacy robustness, in which attack performance was suppressed mainly for certain attack levels, while residual vulnerability persisted at RLA and FLA. These privacy gains were accompanied by reduced classification accuracy, confirming a practical privacy–utility trade-off. Across experimental settings, a moderate privacy budget (ε = 5) generally provided the most favourable balance between neural decoding performance and privacy protection. Overall, these findings indicate that FL alone is insufficient as a privacy mechanism for EEG-based BCIs. Effective protection of neural data requires explicit privacy-preserving safeguards that account for the unique statistical and identity-linked properties of EEG signals. Future research should extend multi-level privacy evaluation to broader EEG modalities and attack classes, while exploring stronger system-level defences such as secure aggregation, cryptographic protection, and adaptive DP. Ultimately, advancing trustworthy and deployable BCI technologies will require treating privacy protection as a core design objective rather than an afterthought.

Author contributions

Conceptualization: Taslima Khanam; Methodology: Taslima Khanam; Formal analysis and investigation: Taslima Khanam; Writing - original draft preparation: Taslima Khanam; Writing - review and editing: Siuly Siuly, Hua Wang, Taslima Khanam; Funding acquisition: Hua Wang, Siuly Siuly; Supervision: Siuly Siuly, Kate Wang, Hua Wang.

Funding

Open Access funding enabled and organized by CAUL and its Member Institutions. This research received no specific grant from any funding agency in the public, commercial, or not-for-profit sectors.

Data availability

T he EEG datasets analysed in this study are publicly available. The BCI Competition IV Dataset 2a can be accessed at: [https://www.bbci.de/competition/iv/#datasets](https:/www.bbci.de/competition/iv) . The PhysioNet EEG Motor Movement/Imagery Dataset is available at: [https://physionet.org/content/eegmmidb/1.0.0/](https:/physionet.org/content/eegmmidb/1.0.0) . No additional proprietary data were generated or analysed in this study.

Declarations

Ethics approval and consent to participate

This study uses publicly available anonymised EEG datasets and therefore did not require institutional ethics approval.

Competing interests

The authors declare no competing interests.