Imagine you're packing a suitcase for a flight. You can fold your clothes tighter (quantization) or leave some items behind (pruning) — either way, you arrive at your destination with roughly the same outfit. But here's the thing: a pickpocket who learned to steal from your full suitcase might fumble with the pruned one, not because it's harder to open, but because the items are arranged differently inside. That's the core mechanism of this paper. The committed claim: compression techniques that preserve accuracy in EEG brain-computer interface decoders do NOT improve their direct adversarial robustness, but pruning — specifically 50% global magnitude pruning — disrupts adversarial transferability between compressed and uncompressed models. Quantization (INT8 PTQ and QAT) does not. The authors frame this as evidence that direct robustness, transfer robustness, and deployment efficiency are three distinct, separable properties — not a single axis you can optimize. The experimental setup is straightforward. EEGNet and ShallowConvNet on BCI Competition IV-2a (9 subjects, 3 seeds, 4-class motor imagery). Models are compressed via global magnitude pruning at 50%, simulated INT8 post-training quantization, and quantization-aware training. White-box PGD attacks at ε=0.005 crush all variants equally — accuracy drops to 22-24% for EEGNet regardless of compression method. The adversarial floor is the adversarial floor; compression doesn't raise it. Where it gets interesting is transfer. Adversarial examples crafted on FP32 models transfer to PTQ models with 0.994 efficiency (essentially perfect). But the same examples transfer to pruned models at only 0.963 — and the reverse direction (P50→FP32) drops further to 0.928. The authors show this correlates with gradient alignment: pruning changes the loss landscape geometry enough to break the implicit agreement between source and surrogate gradients that makes transfer attacks work. Quantization, which preserves the weight structure more faithfully, doesn't create this misalignment. The validation pipeline is careful for a 5-page paper. Simulated quantize-dequantize graphs are used for differentiable white-box attacks (you can't backprop through native INT8), while TensorRT native deployment validates that the simulation is faithful — 95-98% agreement on both clean and adversarial predictions. This dual-path approach is the right way to do it, and the agreement numbers are reassuring. The limitation is scope. BCI Competition IV-2a is a 9-subject, 4-class motor imagery dataset — small by modern ML standards. The paper tests two architectures, one pruning ratio, one quantization bitwidth. The finding that pruning disrupts transfer is a clean signal, but we don't know if it scales, if it generalizes to other EEG paradigms (P300, SSVEP), or whether adversarial training combined with compression changes the picture. The authors are honest about this being a controlled study, not a general-purpose defense. The practical takeaway for BCI engineers: if you're deploying compressed EEG decoders on edge hardware, don't assume compression bought you any adversarial robustness. But if your threat model involves transfer attacks from a known uncompressed model (the most realistic scenario for black-box BCI attacks), pruning does provide a measurable — if modest — disruption. Whether that 4-7% transfer reduction matters in a clinical setting is an open question the paper doesn't try to answer.
