Data minimization: do not move the signal
The cheapest defense is not to expose the data at all. On-device (edge) decoding runs the model on the implant or a body-worn processor and emits only the low-dimensional result — a cursor velocity, a chosen letter — never the raw signal; what never leaves cannot be intercepted. But models still need to learn from many people, and federated decoding trains a shared model by exchanging updates, not data: each device computes on its own recordings and sends only gradients. The catch is that gradients themselves can be inverted to partially reconstruct the underlying data, so federation alone is necessary but not sufficient — it is usually paired with the guarantees below.
Differential privacy: a bound you can prove
Differential privacy (DP) offers something rare — a worst-case, provable guarantee. Its promise: the released result is almost equally likely whether or not any single person's data was included. The privacy budget ε measures how much that likelihood is allowed to differ; smaller ε means stronger privacy. You buy the guarantee by adding calibrated noise whose scale is the query's sensitivity — how much one person could change the answer — divided by ε.
ε-DP (with a slack δ): for any two datasets differing in one person's data and any outcome set S, the output distributions are within a multiplicative factor e^ε.
The Laplace mechanism realizes it: add noise proportional to sensitivity over budget. Higher sensitivity or smaller ε demands more noise — and more distortion.
One subtlety dominates neural DP: what is 'one person's data'? A single trial, a whole session, or an entire subject? The wider the unit you protect, the more noise you must add. Choosing this unit honestly is where most of the engineering — and most of the arguing — actually happens.
The utility-privacy frontier
Every defense so far trades away signal. Noise that hides a private attribute also blurs the intended command; a decoder that already runs near the noise floor has little to spare. The honest way to think about it is a frontier: for each privacy level, the best utility you can still achieve.
No single silver bullet
These techniques compose. A practical stack keeps raw data on-device, learns across users by federation, protects the shared model with DP, and encrypts whatever must be transmitted. Each layer covers a different attack; none is sufficient alone.