Human brain interfaces are advancing at a startling pace; Ray Kurzweil has just joined a startup that dispenses with skull surgery in favour of you snorting charged nanoparticles that are then driven by magnetic coils in a cap.
This all sounds very scifi, but the software stack on these BCI devices have an enormous and unguarded attack surface. Zahra Tarkhani has just uploaded a preprnt NERVE Attacks: Breaking AI-Powered Brain-Computer Interfaces that we worked on with two brilliant interns who visited last summer, Georgios Akkogiounoglou (KTH) and Isabel Tscherniak (TUM), and Lorena Qendro at Nokia Bell Labs.
Back in 2022, our first pass at this found over 300 vulnerabilities across the stacks of commodity BCI headsets. The new paper categorises this surface into what we dub the NERVE attacks, which between them cover the entire Brain-Computer stack from the radio interface to the underlying trained model:
- Neuro-mimetic Forgery synthesises a physiologically plausible brain signal that the classifier accepts without any data from the user.
- Evasion via Desynchronization nudges the timing of the signal by a fraction of a second so discriminative features fall outside the model's receptive window.
- Replay-based Hijacking records a real epoch and replays it over the wireless link to reissue commands without the user knowing.
- Vein Tapping the unencrypted radio links, finding missing authentication, exporting world-readable model files, and (of course) memory-unsafe SDKs that expose everything else to the sort of buffer overflow I was chasing over twenty years ago.
- Embedded Backdoors via trojaned models that behave normally until they see a trigger disguised as an eye blink, a muscle twitch or even mains interference.
In order to help find these vulnerability points, we built 'EEGle' (no relation to my Energy and Environment Group!). EEGle's an extensible framework for BCI security analysis that exposed 17 novel neuro-specific attacks. And like other areas recently LLMs remove the need for any expertise in neuroscience and make it super easy to supply the physiological parameters for a forged motor-imagery signal. The same models are just as happy scanning for the flaws as finding ways through them.
The end-to-end demonstration in the paper against the CYBATHLON 2024 BCI game is pretty cool. This game has three tasks: cursor control, wheelchair navigation, and operating an ice machine with a robotic arm. All three were hijacked via raw replay, synthesised epochs and augmented replay in about 8 seconds.
The defences aren't in good shape unfortunately. There's no (published) protection against some of these such as the evasion/desynchronisation signal attacks, and the information flow control approach we proposed back in 2022 only covers the systems half of the problem. The reason it's all so worrying is that chained attacks are really easy to execute these days, several of which are shown in the paper and often take <10ms. In the ice machine task, a misclassification tips the robotic arm over, showing the physical stakes involved given the same mechanisms are intended to be used for wheelchairs and prosthetics.
So there's certainly some brainy work to be done here! The preprint is on arXiv and comments are very welcome.
Read more about NERVE Attacks: Breaking AI-Powered Brain-Computer Interfaces.