NERVE Attacks: Breaking AI-Powered Brain-Computer Interfaces

I. INTRODUCTION

• Neural-data exploits can threaten cognitive autonomy, mental privacy, and physical safety, while foundational security gaps can deliver ML-based exploits across the BCI stack.The cited gaps include unencrypted communication, missing authentication, inadequate access control, and absent defence-in-depth mechanisms.Source: §I · pp. 1–2

A. AI-Powered BCI Pipeline

• BCIs process noisy, nonstationary, subject-specific neural signals through preprocessing and increasingly opaque deep-learning and foundation-model classifiers, complicating security analysis.The described pipeline includes signal filtering and artifact rejection before feature extraction and classification.Source: §I · p. 1, A. AI-Powered BCI Pipeline · p. 2

I. INTRODUCTION

• The paper defines NERVE’s five orthogonal attack dimensions, formalizes 17 novel neuro-specific instances, and introduces EEGle as an extensible BCI-security analysis framework.The dimensions span the complete BCI attack surface, while the instances include new attack families and a ten-trigger backdoor suite.Source: §I · p. 2

B. Security Gaps and Prior Work

• Prior work documented weak BCI link and host protections [12],, –, but had not unified AI-specific attacks across the stack; prior EEG attacks also fail modern preprocessing –,.The cited prior work included isolated model-level backdoor analyses [50]–.Source: B. Security Gaps and Prior Work · p. 2

III. THREAT MODEL

• Attackers may begin from five entry points with different capability requirements, and the modeled scope excludes physical side-channel attacks and OS-kernel exploits.The model assumes a consumer BCI deployment and a gray-box adversary whose prior knowledge varies by attack dimension.Source: §III · pp. 3–4

A. Formal Definitions

• NFA fabricates a desired motor-imagery class by attenuating mu and beta activity at the class-associated electrode in a public resting-state epoch.The same reference epoch can produce other MI classes by relocating the suppression; preserved artifacts and cross-channel covariance support physiological plausibility.Source: A. Formal Definitions · p. 5
• TDA shifts a time-locked EEG epoch so discriminative features fall outside the classifier’s receptive field, requiring only a timing offset and no synthetic payload.The attack is described as query-free and can use calculated clock offsets or BLE injection delay.Source: A. Formal Definitions · p. 5
• NRA records an epoch classified as a target class and replays it verbatim or with spectral-feature-preserving augmentation to elicit the same output.The augmentation is intended to defeat bytewise or template-matching replay detectors.Source: A. Formal Definitions · p. 5
• Vein Tapping intercepts or manipulates neural data upstream of the model through wireless transport, authentication, or access-control weaknesses.The paper identifies four empirically verified surfaces, including unencrypted communication, absent authentication, inadequate access control, and insecure SDKs.Source: A. Formal Definitions · p. 5
• An embedded backdoor replaces a clean model with one that preserves clean-input behavior but maps trigger-overlaid inputs to attacker-chosen classes.The paper reports ten EEGNet triggers with average ASR of 97.8% and negligible clean-accuracy cost.Source: A. Formal Definitions · p. 5

V. EEGLE OVERVIEW

• EEGle represents its analysis with system states, an extensible engine set, an orchestrator, a feedback component, and an accumulated vulnerability set.The orchestrator executes plans while feedback drives the iteration.Source: §V · p. 5
• At each iteration, the SEO executes the selected plan against the current state, returns findings, and permits Φ to register newly synthesized engines.The SEO itself does not interpret findings or choose the next engine.Source: §V · p. 5
• A shared engine interface lets built-in or custom engines map a system state to findings, and the evaluation’s three built-in engines cover all five NERVE dimensions.The built-ins are the EvasionEngine for N/E/R, BackdoorEngine for embedded backdoors, and SystemEngine for Vein Tapping.Source: §V · p. 6
• Φ cross-references attack results with system findings to select bounded plans, then can request validated LLM-generated specifications when existing engines are exhausted or a novel surface appears.Keeping the LLM in a specification role rather than an execution role supports deterministic auditability.Source: §V · p. 6

A. Target Ecosystem & Assumptions

• The target ecosystem is a wireless consumer headset connected to a BrainFlow host with cloud connectivity, described through policy and context JSON files.The context records hardware, software, target models, and service endpoints; the Synthetic Board supports reproducible benchmarking through the same device-agnostic interface.Source: A. Target Ecosystem & Assumptions · pp. 6–7

B. Evasion Security Engine

• The evasion engine runs NFA, NRA, and TDA without gradients, and adds adapted ART probes when gradients are available.The white-box probes include FGSM, PGD, C&W, and DeepFool, adapted for EEG preprocessing pipelines.Source: B. Evasion Security Engine · p. 7

1) Black-Box Evasion Attacks: •

• The black-box attacks synthesize plausible EEG, replay recorded epochs with augmentation, or shift timing to disrupt event-locked classification.TDA’s truncation variant replaces early samples with the channel mean; both temporal-shift variants are described as computationally trivial to deploy at the transport layer.Source: 1) Black-Box Evasion Attacks: • · p. 7, Figure 3 · p. 7

C. Backdoor Attack Engine

• The backdoor engine uses poisoned fine-tuning and trigger overlays to associate structured waveforms with attacker-chosen outputs while retaining clean accuracy.The codebook caption specifies ten EEGNet templates and five DeepSleepNet templates, with stealth tiers based on Clean Target rate.Source: C. Backdoor Attack Engine · pp. 7–8, Table II · p. 8

D. BCI-System Security Engine

• The system engine uses hybrid static analysis when source code is available and runtime BLE sniffing and MitM simulations otherwise.The analysis surfaced over 100 candidate weaknesses; BrainFlow included 34 externally controlled format-string sites and 317 potential memory-corruption sites, treated as upper-bound candidates rather than confirmed exploitable vulnerabilities.Source: D. BCI-System Security Engine · p. 8

E. Feedback Engine

• When the static repertoire is exhausted, the feedback engine uses a constrained LLM call to generate structured attack specifications that can be registered as new engines.The feedback engine is described as a stateful component that uses findings to guide iteration.Source: E. Feedback Engine · p. 8
• The end-to-end demonstration hijacked cursor control, wheelchair navigation, and ice-machine manipulation, where misclassification caused the robotic arm to tip.The demonstrated tasks used NRA/NFA attacks.Source: Figure 4 · p. 8

1) Black-Box Evasion Attacks:

• NFA exceeded 33.3% chance across tested conditions, reaching 61.0% overall accuracy for same-subject rest epochs and 44.7–52.3% cross-subject or cross-device.Right-hand MI reached 83% for Subject 9 same-subject trials, while feet MI reached 33%.Source: 1) Black-Box Evasion Attacks · p. 8, Table IV · p. 9
• Replay attacks found target-class epochs in a median of 7.3 s, and raw replay, LLM-synthesised epochs, and augmented replay each caused adversary-chosen actions in the CYBATHLON emulator.Frequency-domain augmentation preserved class-defining spectral features and cross-channel covariance while adding variability.Source: 1) Black-Box Evasion Attacks · pp. 8–9, Table V · p. 9

VII. EVALUATION

• The evaluation maps each NERVE dimension to a target component, model or device, and data source, and includes multi-trigger backdoor testing on held-out EEGNet subjects S021–S030.The supplied table caption establishes the evaluation scope, not the backdoor test outcome.Source: Table III · p. 9, Table VII · p. 10

1) Black-Box Evasion Attacks:

• EEGNet fell from 0.99 accuracy at 3T/10 shift to 0.10 by 8T/10, while DeepSleepNet declined more gradually from 0.86 to 0.41.For the ten-class MMI classifier, 0.10 is chance; the minimum effective shift was 4T/10 (about 1.2 s for a 3 s epoch).Source: 1) Black-Box Evasion Attacks · p. 9, Figure 5 · p. 9

2) White-Box Robustness Probe:

• In the white-box upper-bound probe, EEGNet had PGD ASR 1.000 at ϵ=0.2 versus DeepSleepNet’s 0.243 at the same budget.DeepSleepNet’s DeepFool perturbation had L2 ≈6711, indicating high cost for a practical adversary in that probe.Source: 2) White-Box Robustness Probe · p. 9, Table VI · p. 10

B. NERVE-E: Backdoor Attacks Engine

• Backdoor tests used held-out subjects disjoint from training and poisoning, with ten EEGNet triggers and five DeepSleepNet triggers applied through low-amplitude overlays.The PhysioNet MMI split reserved S021–S030 for evaluation; S001–S010 trained the clean baseline and S011–S020 supplied poisoning data.Source: B. NERVE-E: Backdoor Attacks Engine · p. 10
• EEGNet’s ten triggers averaged 97.8% ASR, while DeepSleepNet averaged 20.0%, showing sharply architecture-dependent backdoor performance.For EEGNet, Clean Target averaged 11.1%; for DeepSleepNet, ASR was near or below Clean Target for most triggers.Source: B. NERVE-E: Backdoor Attacks Engine · p. 10
• Seven triggers had Clean Target rates ≤0.75%, and six reached 99–100% ASR; OB and SWP had higher Clean Target rates but 100% ASR.The paper describes this as a stealth–effectiveness spectrum, with a trade-off between an invisible implant and guaranteed activation.Source: B. NERVE-E: Backdoor Attacks Engine · p. 10

C. NERVE-V: Vein Tapping Results

• Tests on BrainFlow Emulator and OpenBCI, Muse, and NeuroSky confirmed all four Vein Tapping surfaces, including plaintext sniffing, BLE MitM, and unauthenticated access paths.The evaluation also reports accessible EEG and derived data, plus SDK analyzer candidates that were not confirmed vulnerabilities.Source: C. NERVE-V: Vein Tapping Results · pp. 10–11
• The BrainFlow candidate sites were not shown to enable a working control-flow hijack or arbitrary code execution; practical exploitability remains future work.The confirmed narrower finding was that OpenBCI GUI helper components run without privilege separation.Source: C. NERVE-V: Vein Tapping Results · p. 11

D. Feedback Engine

• EEGle+Φ’s full feedback loop was compared with Static-EEGle’s one-pass fixed engine order, but the study used one commercial LLM API and did not compare model families.The authors identify sensitivity of findings to LLM choice as a limitation and future evaluation direction.Source: D. Feedback Engine · p. 11

VIII. POTENTIAL DEFENSES

• Although broader systems-security defenses address the V1–V4 surface, the paper reports that no BCI ecosystem project has adopted these practices and identifies security culture and shipping pressures as factors.The discussion also notes practical limits for enclave approaches on legacy, resource-constrained devices and large EEG foundation models.Source: §VIII · pp. 11–12
• Defenses include transport encryption and identity checks, access control and reduced helper privileges, model signing, and authenticated timing checks; no current combination provides end-to-end protection.The authors say no validated defense against TDA currently exists, and identify timing validation as the least mature recommendation.Source: §VIII · p. 12

IX. RESPONSIBLE DISCLOSURE

• All findings were disclosed to BrainFlow maintainers and OpenBCI, NeuroSky, and Muse before submission; system-level exploit code is withheld until fixes are available.The authors state they are committed to collaborating on mitigation efforts before publication.Source: §IX · p. 12

X. CONCLUSION

• The conclusion presents NERVE Attacks’ five dimensions and EEGle, evaluated across three real-world platforms and diverse EEG pipelines, with 17 novel neuro-specific attack instances.The authors release EEGle to the community as a tool to audit and protect BCI devices.Source: §X · p. 12
• Table VIII maps NERVE attack classes to candidate mitigations, and no row is fully covered by a single mitigation.Its symbols distinguish effective, partial, and ineffective or inapplicable mitigations; cost denotes the dominant deployment barrier.Source: Table VIII · p. 13

A. Datasets •

• The evaluation uses MMI, Sleep-EDF, BCI Competition IV 2a, and NeuroTUM EEG recordings for different experiments.MMI uses 64-channel recordings at 160 Hz; the replay experiments use three BCI-IV-2a channels resampled to 128 Hz, and NeuroTUM rest epochs are mapped to overlapping montage channels.Source: A. Datasets • · p. 16

B. Architectures •

• EEGNet uses temporal, depthwise spatial, and separable convolutions, while DeepSleepNet follows its official two-stage training regime.EEGNet reaches 100% accuracy on the held-out MMI split; DeepSleepNet yields approximately 86% accuracy on held-out Sleep-EDF data.Source: B. Architectures • · p. 16

APPENDIX B EEGLE FRAMEWORK: FEEDBACK ENGINE ABLATION

• Static-EEGle misses the E-desynchronisation dimension and V4, while EEGle+Φ synthesises three engines and uses 11 iterations versus 3.The additional engines target BLE replay injection, cross-session fingerprinting, and E1 dependency confusion; Φ also refines NFA parameters after preprocessing failure.Source: Appendix B · pp. 16–17, Table IX · p. 17
• Φ’s runtime-generated engines would not exist in a static repertoire, and its additional iterations reflect refinement plans after partial failures.The ablation describes a BLE replay-injection module, an augmented-NRA cross-session fingerprinting variant, and a supply-chain simulation engine.Source: Appendix B · p. 17

APPENDIX C SYNTHETIC EEG DATA GENERATION

• Synthetic MI trials are created by suppressing frequency-band components of real resting-state epochs at class-specific spatial locations.This preserves the reference recordings’ spectral structure, artifacts, and cross-channel covariance while producing class-discriminative ERD patterns.Source: Appendix C · p. 17
• A sigmoid temporal envelope ramps the suppression, and changing the focal electrode generates another MI class from the same rest epoch.The method retains the reference epoch’s physiological noise, blink artifacts, and non-stationarity, requiring no additional noise or artifact injection.Source: Appendix C · p. 17

• Small relative Gaussian noise perturbs frequency-domain amplitudes, with the inverse FFT reconstructing the modified signal.The implementation operates per channel on three-channel, 385-sample EEG epochs and can reduce noise in selected frequency bands.Source: Appendix D · pp. 17–18
• Small zero-centered Gaussian phase jitter adds temporal variability while limiting distortion of oscillatory structure.The stated phase-noise scale is 0.01–0.1 radians; the method is described as safer when MI class information lies mainly in mu and beta amplitudes.Source: Appendix D · p. 18
• Selective amplitude modulation targets specified frequency bands, including the 8–13 Hz mu band, using a small uniform random factor.The passage contrasts this targeted approach with global noise addition and describes it as interpretable and neurophysiologically grounded.Source: Appendix D · p. 18
• The composite augmentation perturbs amplitude and phase together while preserving critical discriminative bands such as mu and beta rhythms.The resulting augmentation is characterized as conservative and intended to maintain physiological plausibility while increasing data diversity.Source: Appendix D · p. 18

A. Notation

• The notation defines the input, true label, model logits, scalar loss, preprocessing-transform distribution, and perturbation budget ball.The transform distribution is used for expectation over transforms (EOT), and the budget ball may use an L∞ or L2 norm.Source: A. Notation · p. 18

B. Fast Gradient Sign Method (FGSM)

• FGSM forms an adversarial input using a signed loss-gradient step scaled by the perturbation budget.The passage advises substituting the model prediction for the true label to reduce label leaking when the true label is not used.Source: B. Fast Gradient Sign Method (FGSM) · p. 18
• For targeted FGSM, the update uses the negative gradient of the loss for the target class.Source: B. Fast Gradient Sign Method (FGSM) · p. 18

C. Projected Gradient Descent (PGD)

• PGD runs iterative updates with step size α, projecting each iterate into the perturbation ball and starting from the clean input.For L2 variants, the sign update is replaced by a normalized gradient direction, and the attack stops early when an example is misclassified.Source: C. Projected Gradient Descent (PGD) · p. 18

D. Carlini & Wagner (C&W)

• C&W trades perturbation norm against attack loss through unconstrained optimization, with its L2 implementation using Adam and optional restarts over c.The implementation may constrain the perturbation by a penalty or an explicit projection step.Source: D. Carlini & Wagner (C&W) · p. 18

E. DeepFool

• DeepFool iteratively estimates minimal perturbations to cross a locally linearized decision boundary until the predicted label changes.The accumulated perturbation serves as an estimate of the minimal L2 perturbation required.Source: E. DeepFool · pp. 18–19

F. Implementation notes •

• All attacks use the same preprocessing pipeline, and iterative attacks stop early on misclassification with norms measured on the final clipped example.EOT is disabled; PGD random initialization is disabled, and attack budgets and iteration counts are specified in Table VI’s caption.Source: F. Implementation notes • · p. 19

APPENDIX F CROSS-LAYER ATTACK CHAIN: V→N END-TO-END

• The V–N chain uses Vein Tapping as the injection channel for NFA payloads, which replace real EEG packets before BrainFlow ingestion.A transparent relay can observe, modify, or replace epochs; synthesized payloads are serialized to NeuroSky TGAM format and injected within the same BLE connection interval (≤7.5 ms).Source: Appendix F · p. 19
• 100 % of injection attempts across 20 trials produced attacker-chosen BrainFlow classifier outputs, with 9.3 ms mean end-to-end latency and no host-observed anomaly.Packet timing, checksum, and attention-value range remained within normal bounds.Source: Appendix F · p. 19

APPENDIX G EXPERIMENTAL SETUP

• Table X lists the workstation, software, and BCI hardware used across Section VII experiments, while Table III maps platforms to the NERVE dimensions evaluated.The supplied text does not provide the table entries.Source: Appendix G · p. 19, Table X · p. 19

APPENDIX H MODEL TRAINING HYPERPARAMETERS

• The EEGNet base-model and backdoored multi-trigger transfer-learning hyperparameters are summarized in Figures 6 and 7, respectively.Source: Appendix H · p. 19, Figure 6 · p. 20, Figure 7 · p. 20

APPENDIX I BACKDOOR FIGURES

• Figure 8 summarizes ten backdoor waveform templates and how each pattern is injected into clean EEG to create poisoned signals.Source: Appendix I · p. 19, Figure 8 · p. 21