Mental Privacy: What Can Actually Be Read, and How to Protect It

The threat model: what a decoder can and cannot infer

Start with sober capability, because the harm calculus depends entirely on it. Today's decoders reliably read task-locked, trained targets: which of a few options you attended (P300, SSVEP), an intended movement or cursor velocity, a workload or drowsiness level, an error signal. With invasive high-density recordings, attempted speech can be decoded into text or sound. What is not on offer is a general 'read your thoughts' oracle: no system today extracts arbitrary propositional beliefs, episodic memories, or the content of undirected inner monologue from a cooperative-but-unconstrained brain.

But 'cannot today' is a weak guarantee, and the threat model must include trajectory. Two capabilities move the line fast: decoders that generalise (a model pretrained on many people needs little of your data to work) and writing systems that probe (stimulation can elicit responses that make hidden state observable). The right stance is neither panic nor complacency: reason about the specific attribute a specific system could infer, and its base rate, before invoking a harm.

Incidental and passive readout: the real risk

The realistic privacy threat is rarely a targeted mind-probe; it is incidental inference. A signal collected for a legitimate purpose carries side information the user never intended to share. EEG recorded to run a speller also contains fatigue, affect, and neurological markers; the ErrP recorded to correct a decoder also reveals what you found surprising or wrong. Because features are shared, protecting the primary function does not automatically protect the by-products.

Passive BCI sharpens this to a point. A system whose whole purpose is to monitor you continuously — workload, attention, emotional state — produces a dense, always-on stream about mental life, often without a discrete moment of consent per inference. Aggregate that over months and even coarse, individually-harmless readings become a detailed behavioural portrait. The privacy harm here is temporal and cumulative, which is precisely the kind classical 'informed consent at signup' handles worst.

Neural data as a special category

Is neural data just another kind of health data, or a category of its own? The argument for special status rests on three properties: it is drawn from the seat of the self; it is rich in incidental inferences the subject cannot enumerate in advance; and, like a fingerprint, it can be biometrically identifying — individual neural responses are stable enough that 'anonymised' recordings can often be re-linked to a person. That last property quietly defeats the standard privacy move of de-identification.

This matters because it changes the default. If neural data re-identifies, then 'we only store anonymised aggregates' is not the safe harbour it is for many datasets, and neural-data governance must lean on access control, purpose limitation and cryptographic or on-device methods rather than on stripping names. Several jurisdictions have begun treating neural data as sensitive-by-default (Guide 5); the technical reason is exactly this re-identifiability.

The formal privacy toolkit

The strongest technical guarantee available is differential privacy (DP). A randomised mechanism \mathcal{M} is (\varepsilon,\delta)-differentially private if its output distribution barely changes when any one person's data is added or removed. The formal condition bounds, for every possible output set S and every pair of datasets D, D' differing in one record:

\Pr[\mathcal{M}(D)\in S]\;\le\; e^{\varepsilon}\,\Pr[\mathcal{M}(D')\in S] \;+\; \delta

Differential privacy. Small ε means an observer of the output learns almost nothing about whether your record was included — the guarantee holds against any adversary and any side information.

A mathematical promise that an algorithm's output barely changes whether or not your record was in the data. Because the two probabilities differ by at most a factor e^{\varepsilon}, an observer of the output can learn almost nothing about you specifically. Crucially, the guarantee holds against any attacker with any extra knowledge — a cornerstone of neural-data governance.

\mathcal{M}(D): The (randomized) algorithm run on the dataset D.
D,\,D': Two datasets differing only in one person's record.
\varepsilon: The privacy budget — smaller means stronger privacy.
\delta: A tiny allowance for the guarantee to occasionally fail.

With \varepsilon near zero, the output distributions for "your data included" versus "excluded" are almost identical, so no analysis can single you out.

DP is usually achieved by adding calibrated noise. The Laplace mechanism releases f(D) perturbed by noise scaled to the query's sensitivity \Delta f (how much one person can move the answer) divided by the privacy budget \varepsilon:

\mathcal{M}(D) = f(D) + \mathrm{Lap}\!\left(\frac{\Delta f}{\varepsilon}\right)

The Laplace mechanism. Larger ε = less noise = more accuracy but weaker privacy. This ε is a literal, tunable knob on the privacy–utility tradeoff — the thing a policy can specify and an audit can check.

The simplest way to make a query private: compute the true answer, then add a dash of random noise. How much noise? Enough to hide any single person's possible influence (the sensitivity \Delta f), scaled down by your privacy budget \varepsilon. A bigger \varepsilon means less noise and sharper answers but weaker privacy — a dial you can literally set and audit.

\mathcal{M}(D): The noisy, privacy-preserving answer.
f(D): The true answer to the query.
\Delta f: The sensitivity — the most any one person can change f.
\mathrm{Lap}(\Delta f/\varepsilon): Laplace-distributed noise whose scale is \Delta f/\varepsilon.

Halving \varepsilon doubles the noise you add, sharpening privacy at the cost of a blurrier answer.

Why does a privacy quantity help ethics? Because it converts 'the data is protected' into a checkable number. But DP is not magic: it protects membership and aggregate release, not the fact that your live decoder is inferring your state right now. For that, the workhorses are architectural — on-device / edge processing (features and models never leave the implant or headset), data minimisation (compute the class score, discard the raw epoch), and federated learning (train a shared model by exchanging gradients, not recordings). These are weaker as guarantees but far more relevant to a real-time interface.

How much can leak: bounding inference

It helps to have a currency for leakage. Let Z be a sensitive attribute (say, a mood or a clinical marker) and F the features you transmit. The mutual information I(Z;F) measures how much observing F reduces uncertainty about Z:

I(Z;F)=\sum_{z,f} p(z,f)\,\log\frac{p(z,f)}{p(z)\,p(f)}

Mutual information as a leakage budget. If I(Z;F)=0, F reveals nothing about Z; by Fano-type bounds, small I(Z;F) caps how well any adversary — now or in the future, with any model — can infer Z from F.

A measure of how much a released feature F tells an adversary about a sensitive attribute Z. If it's zero, F says literally nothing about Z — they're independent. Keeping this "leakage budget" small provably caps how well anyone, with any model now or later, could guess Z from F — the goal of neurosecurity.

I(Z;F): The mutual information between Z and F — the bits leaked.
Z: The sensitive thing you want to hide.
F: The feature or output actually released.
\frac{p(z,f)}{p(z)\,p(f)}: The joint versus "if they were independent"; the gap is the information.

If I(Z;F)=0 then knowing F leaves the odds on Z exactly as they were — a leak-proof feature; even a slightly positive value bounds the best possible guess.

This reframes privacy engineering as an optimisation: keep the mutual information with the intended target (the speller class, the cursor velocity) high, while driving the mutual information with unintended sensitive attributes toward zero. Adversarial and information-bottleneck training do exactly this — learn representations predictive of the task yet uninformative about, say, identity or affect. The result is a specification you could actually put in a spec sheet: 'attribute Z is recoverable no better than chance from transmitted F.'

Privacy is not only a technical problem

Even a perfectly minimised, DP-protected, on-device system leaves a residue that no equation closes. Who may ask for the data (an employer, an insurer, a court)? Can consent be truly free when the device is medically necessary? Does a person even have the vocabulary to consent to inferences they cannot foresee? These are questions about power and context, and they are why mental privacy eventually becomes a matter of rights and law (Guide 5), not just of better encoders.