Privacy attacks: reading what was not offered
The simplest privacy attack is a side-channel: watch the involuntary brain responses that leak alongside the task. An active variant, malicious stimulus probing, goes further — it injects its own stimuli (images, words, a fake keypad) to provoke a recognition or error-related response and read the answer off the brain.
Two attacks target the model rather than the live signal. A membership inference attack asks whether a particular person's recordings were in a decoder's training set — a real breach when the training data is a clinical cohort, and a growing worry for large models pretrained on many subjects. A model inversion attack instead reconstructs a representative input — an approximate neural signature — from access to the model and its outputs. Together they show that even a shared decoder can leak its training subjects.
Integrity attacks: corrupting the decoder
Machine-learning decoders inherit machine-learning weaknesses. An adversarial attack adds a perturbation too small to notice in the raw trace, yet crafted to flip the decoder's output. Such attacks have been demonstrated in the lab on EEG classifiers spanning P300, SSVEP, and motor-imagery paradigms.
A fast gradient-sign perturbation: nudge every input sample in the direction that most increases the decoder's loss, within a tiny bound ε.
A subtler threat strikes at training time. In a poisoning or backdoor attack, the adversary corrupts a fraction of the calibration data so that the decoder behaves normally — except when a chosen trigger pattern appears, at which point it does the attacker's bidding. Because BCIs recalibrate constantly, they present an unusually large training-time surface.
Write-channel attacks: real risk, mostly still theoretical
The gravest attacks target the write path. Brain-spoofing and signal injection means forcing false activity into the system — electromagnetic injection into the recording front-end to fake a signal, or misuse of a stimulation channel to write an unwanted percept. On integrity, this is the nightmare case.
Seeing an attack succeed
The widget below makes the read-side threat concrete. Raw neural features carry a private attribute; watch how well an attacker's classifier recovers it before any defense is switched on.