A signal that reveals more than intent
A cursor decoder only needs your intended movement. But the same neural signals it reads also carry your emotional state, fatigue, disease markers, response to a face or a word, and a stable signature of who you are. Security for a BCI therefore protects far more than a data file — it protects inferences a person never chose to disclose. The field that studies this is neurosecurity.
Neural responses are individually distinctive: a person's ERP to a familiar image is stable and hard to forge, which is exactly why it works as a brainprint biometric — and why even neural data stripped of names carries a re-identification risk, since the pattern itself is the identifier. Worse, a passive BCI monitors mental state in the background — workload, attention, drowsiness — with no explicit command from the user, turning every session into a potential covert channel.
The CIA triad, re-cast for a brain
Classic security asks for confidentiality, integrity, and availability. For a BCI each acquires a bodily meaning. Confidentiality: the decoded intent and the raw signal must not leak. Integrity: neither the recorded signal nor the decoder nor any stimulation command may be tampered with. Availability: a person who relies on the device to move or speak cannot tolerate denial of service.
Assets, adversaries, attack surface
A usable threat model names three things. Assets: raw signals, extracted features, the trained decoder, and stimulation commands. Adversaries: a curious insider, a network attacker on the wireless link, a malicious application granted access, or even the device maker itself. Attack surface: every stage from electrode to amplifier to wireless link to edge processor to cloud is a place data can be observed or altered. Formally, an attacker who observes features x tries to infer a private attribute a — a PIN digit, a preference, a diagnosis; the best possible guess follows Bayes' rule, and how much any defense can hope to hide is bounded by the mutual information between the attribute and the signal.
An attacker inverts the encoding to a posterior over the private attribute; total leakage is the mutual information I(A;X).
This is not hypothetical. A well-known 2012 study showed that a consumer EEG headset running a P300-style paradigm could extract private facts — bank, PIN digits, familiar faces — at rates better than random chance, simply by flashing stimuli and reading the brain's involuntary recognition response. It is a modest, proof-of-concept side-channel, but it proved the category is real.
The privacy pipeline
It helps to picture the whole path as a pipeline: raw neural data flows toward an attacker's inference, and a defense stage sits in between. Everything in this track is a way to make that defense stage stronger without destroying the signal the user actually needs.