PaperlayerView exact revision on arXiv

Source-linked AI summary

NeuroPriv: Adversarial Representation Learning for Privacy in Wearable EEG Systems

Sarmistha Sarna Gomasta, Bhawana Chhaglani, Prashant Shenoy

arXiv:2609.00390v1cs.CRcs.HCcs.LG

TL;DR

Compact EEG features can retain sensitive demographic and identity information even when raw signals are not released. NeuroPriv learns a task-relevant representation with adversarial suppression, reducing private-attribute inference while preserving task performance close to the original representation.

  • Problem

    Compact EEG-derived representations may remain identifiable and expose demographic or subject information despite removing raw waveform details and explicit identifiers.

  • Method

    NeuroPriv maps compact EEG features and pairwise interactions into a task-relevant latent representation, then uses adversarial learning to suppress gender, age, and subject-identity information before release.

  • Results

    0.788 balanced accuracy for the intended task coexists with gender, age, and subject-identity inference accuracies of 0.858, 0.789, and 0.692, while NeuroPriv reduces leakage by up to 0.486 balanced-accuracy points with near-preserved task performance.

  • Takeaways & Limitations

    Wearable EEG privacy requires representation-level protection rather than relying only on raw-signal avoidance, uniform perturbation, or fixed feature removal.

  • Takeaways & Limitations

    The evaluation uses one controlled-laboratory dataset with 36 subjects, closed-set enrolled-user identification, a lab-based arithmetic task, and same-population labeled auxiliary attacker data.

Abstract

from arXiv · show

Wearable EEG systems may expose sensitive information beyond their intended health function, creating substantial risks to neuroprivacy. In this work, we show that commonly used EEG features can reveal participant identity and demographic attributes in addition to supporting the intended cognitive task. Wearable EEG is increasingly being explored for cognitive monitoring, neurological assessment, and longitudinal digital-health applications, yet many systems assume that transmitting compact spectral or spatial features instead of raw EEG provides sufficient privacy protection. Using EEGMAT as a motivating case study, we find that compact EEG features achieve a balanced accuracy of 0.788 for cognitive-state classification while enabling gender, age, and subject-identity inference with balanced accuracies of 0.858, 0.789, and 0.692, respectively. We further show that privacy-aware representation learning preserves task performance at 0.781 while reducing these inference accuracies to 0.563, 0.467, and 0.206. These findings motivate purpose-limited representations and explicit privacy auditing in wearable neurohealth systems.

1 Introduction

Wearable EEG features can preserve intended cognitive-task utility while exposing gender, age, and subject identity, even when raw EEG is withheld. NeuroPriv addresses this leakage with adversarial representation learning before feature release.

  • Privacy motivation: Compact EEG features can reveal sensitive attributes despite removing raw waveform data and explicit identifiers.The released representation itself remains a privacy boundary because EEG contains subject-specific and demographic information.
  • Observed leakage: 0.788 balanced accuracy supports Baseline-versus-Arithmetic classification, while gender, age, and subject identity reach 0.858, 0.789, and 0.692, respectively.
  • Leakage sources: Gender leakage is associated mainly with theta power, age with beta-relative power and asymmetry, and subject identity with beta power and alpha–beta relationships.
  • Baseline limitations: Uniform perturbation can damage task-relevant information, whereas fixed feature masking does not consistently suppress all private attributes.
  • Proposed framework: NeuroPriv maps compact features and pairwise interactions into a task-relevant latent representation, then adversarially suppresses gender, age, and identity information before release.External attackers are trained independently to measure residual privacy leakage.
  • Contributions: The work evaluates lightweight defenses and designs NeuroPriv to preserve task utility while suppressing multiple private attributes before feature release.

2 Related Work

Prior EEG privacy work spans side-channel inference, biometric identification, cryptographic protection, federated or transfer learning, split inference, perturbation, and learned anonymization. NeuroPriv focuses this privacy–utility problem at the compact-feature release boundary and evaluates leakage through independent attackers.

  • Existing privacy risks: Prior studies show EEG can support sensitive inference, including neural-response side channels, biometric identification, and cross-session re-identification.
  • Existing protections: Cryptographic, federated, transfer-learning, and split-inference approaches reduce direct raw-signal disclosure but do not necessarily make released representations private.Intermediate activations can remain highly correlated with raw physiological signals, challenging privacy assumptions based only on where computation is split.
  • Metric limitations: Similarity-based privacy metrics may miss nonlinear attribute recovery and produce scores relative to evaluated split points rather than absolute leakage.
  • Learned defenses: Prior perturbation, adversarial, autoencoder, and identity-removal methods demonstrate learned privacy–utility optimization across multiple private attributes.
  • Position of this work: NeuroPriv transforms spectral and spatial features into a latent representation and compares it with Gaussian perturbation and privacy-ranked masking using independent external attackers.

3 Methods

The methods define released EEG representation z as the privacy boundary, quantify utility and attribute leakage with balanced accuracy, analyze feature responsibility, and compare coordinate-level defenses with NeuroPriv’s learned latent representation. NeuroPriv expands features, encodes them compactly, and uses adversarial privacy heads during training.

  • Dataset and labels: EEGMAT contains recordings from 36 people under Baseline and Arithmetic conditions, with gender, age group, and subject identity as private attributes.
  • Input features: Each EEG window is represented by a 17-dimensional vector containing band powers, spectral ratios, and spatial asymmetry measures.
  • Threat model: The released representation z may be original features, a defended representation, or NeuroPriv’s latent representation, and it defines the system’s privacy boundary.Raw EEG remains upstream on the device while downstream services operate on z.
  • Threat model: An attacker with same-population labeled auxiliary data may infer gender, age group, or subject identity from z without observing raw EEG, encoder parameters, or gradients.
  • Evaluation metrics: Utility is task balanced accuracy, while privacy leakage is the strongest balanced accuracy among SVM, RF, and GB attackers for each private attribute.
  • Evaluation metrics: Chance balanced accuracies are 0.500 for binary task and gender labels, 0.333 for age, and 0.028 for closed-set subject identity.
  • Feature responsibility: One-way ANOVA F-values estimate feature–attribute separability and guide analysis of leakage sources and construction of the feature-masking baseline.
  • Gaussian noise: Gaussian noise perturbs every standardized coordinate equally, without using information about which features carry private or task information.

4 Evaluation

The evaluation shows that compact EEG features preserve intended task information while exposing multiple private attributes, and that leakage differs across attribute-specific feature groups. Lightweight defenses provide inconsistent protection, whereas NeuroPriv jointly reduces evaluated leakage while keeping task performance close to the original representation.

  • Original representation: 0.788 task balanced accuracy coexists with gender, age, and subject-identity inference at 0.858, 0.789, and 0.692, respectively.The original representation exposes multiple private attributes, with gender inference exceeding intended task performance.
  • Feature responsibility: Gender, age, and subject identity are associated most strongly with different spectral and spatial feature groups.Gender is associated with theta power, age with beta-relative power and alpha asymmetry, and identity with beta power and alpha–beta relationships.
  • Gaussian noise: 0.602 task balanced accuracy under Gaussian noise at σ=0.30 accompanies gender and subject-identity reductions but an age increase from 0.322 to 0.415.This operating point changes task accuracy from 0.608 to 0.602, while gender changes from 0.691 to 0.633 and subject identity from 0.718 to 0.594.
  • Feature masking: 0.608 task balanced accuracy remains unchanged with Top-8 feature masking, while subject identity decreases from 0.718 to 0.518 and age increases from 0.322 to 0.363.Gender decreases modestly from 0.691 to 0.664, showing that masking effects differ across private attributes.
  • NeuroPriv: 0.781 task balanced accuracy versus 0.788 for the original features accompanies NeuroPriv reductions in gender, age, and subject identity to 0.563, 0.467, and 0.206.The corresponding reductions are 0.295, 0.322, and 0.486 balanced-accuracy points; identity information is reduced but not completely removed.
  • Overall comparison: NeuroPriv learns one representation that preserves the intended task while jointly reducing gender, age, and subject-identity leakage.The evaluation compares it with the original representation and lightweight Gaussian-noise and feature-masking defenses under their corresponding protocols.

5 Discussion

EEG feature release is not privacy-neutral: compact representations can expose demographic and identity information alongside task utility. Because fixed feature-level defenses do not consistently protect multiple attributes, privacy protection should operate on the released representation before it leaves the device.

  • Compact EEG features expose demographic and identity information alongside the intended task, making feature release a systems-level privacy concern.The concern is heightened because compact features are widely treated as safer than transmitting raw signals.
  • Gaussian noise and feature masking affect private attributes differently and do not consistently reduce gender, age, and identity inference together.Feature masking largely preserves task performance but does not decrease age inference, while Gaussian perturbation does not consistently reduce age inference.
  • Privacy protection should target the released representation before compact EEG features leave the device.This frames privacy as a property of the representation rather than of raw-signal transmission alone.

6 Limitations and Future Work

The evaluation is limited to EEGMAT and a controlled laboratory setting, with closed-set identification, a lab-based mental-arithmetic task, and attackers holding labeled auxiliary data from the same population. Future work therefore targets broader datasets and deployment contexts, open-set and cross-session evaluation, additional privacy attributes, and real-device measurements.

  • The evaluation uses a single dataset with 36 subjects in a controlled lab setting, limiting generalization to diverse populations and real-world deployment.The authors identify EEGMAT and the controlled setting as scope boundaries.
  • Subject identification is evaluated in a closed-set setting over enrolled users, so open-set and cross-session privacy–utility tradeoffs may differ.The authors explicitly identify open-set and cross-session scenarios as future evaluation targets.
  • The utility task is lab-based mental arithmetic, whereas real-world applications may involve different cognitive states, continuous monitoring, or multimodal sensing.This limits direct transfer from the evaluated task to broader wearable EEG applications.
  • The attacker model assumes labeled auxiliary data from the same population, and inference may differ with less or different side information.The authors also plan deployment on actual wearable devices to measure computational cost, latency, and energy consumption.

7 Conclusion

The paper concludes that compact EEG features are not privacy-neutral and presents NeuroPriv as a representation-level approach to suppress private attributes while retaining task-relevant information. Across validation, NeuroPriv reduces private-attribute inference while keeping task performance close to the original representation.

  • Compact spectral and spatial EEG features are not privacy-neutral because the task representation also exposes gender, age, and subject identity.Feature-responsibility analysis found that this leakage is structured across different spectral and spatial feature groups.
  • Gaussian noise and feature masking have attribute-dependent effects, limiting consistent multi-attribute privacy protection.These lightweight defenses were evaluated as alternatives but did not provide uniform protection across the private attributes.
  • NeuroPriv learns a compact representation that preserves task-relevant information while adversarially suppressing private attributes before release.The framework targets representation-level protection rather than relying only on raw-signal avoidance, uniform perturbation, or fixed feature removal.
  • Up to 0.486 balanced-accuracy points of private-attribute inference reduction were achieved while task performance remained close to the original feature representation.Table 5 reports original-feature task balanced accuracy of 0.788, with the strongest attackers varying by task or private attribute.
Loading 2609.00390v1…