Human brain interfaces are advancing at a startling pace; Ray Kurzweil has just joined a startup that dispenses with skull surgery in favour of you snorting charged nanoparticles that are then driven by magnetic coils in a cap.
This all sounds very scifi, but the software stack on these BCI devices have an enormous and unguarded attack surface. Zahra Tarkhani has just uploaded a preprnt NERVE Attacks: Breaking AI-Powered Brain-Computer Interfaces that we worked on with
two brilliant interns who visited last summer, [Georgios Akkogiounoglou](https://github.com/sdi1400258) (KTH) and [Isabel Tscherniak](https://www.linkedin.com/in/isabel-tscherniak) (TUM),
and [Lorena Qendro](https://lorenaqendro.github.io) at Nokia Bell Labs.
Back in 2022, our [first pass at this](https://anil.recoil.org/ideas/brain-interface-security) found over
[300 vulnerabilities](https://anil.recoil.org/papers/2022-enhancing-brain-security) across the stacks of commodity BCI headsets.
The new paper categorises this surface into what we dub the NERVE attacks, which between them cover the entire Brain-Computer stack from the radio interface to the underlying trained model:
In order to help find these vulnerability points, we built 'EEGle' (no relation to my Energy and Environment Group!). EEGle's an extensible framework for BCI security analysis that exposed 17 novel neuro-specific attacks. And like other areas recently LLMs remove the need for any expertise in neuroscience and make it super easy to supply the physiological parameters for a forged motor-imagery signal. The same models are just as happy scanning for the flaws as finding ways through them.
The end-to-end demonstration in the paper against the CYBATHLON 2024 BCI game is pretty cool. This game has three tasks: cursor control, wheelchair navigation, and operating an ice machine with a robotic arm. All three were hijacked via raw replay, synthesised epochs and augmented replay in about 8 seconds.
The defences aren't in good shape unfortunately. There's no (published) protection against some of these such as the evasion/desynchronisation signal attacks, and the information flow control approach we proposed back in 2022 only covers the systems half of the problem. The reason it's all so worrying is that chained attacks are really easy to execute these days, several of which are shown in the paper and often take <10ms. In the ice machine task, a misclassification tips the robotic arm over, showing the physical stakes involved given
the same mechanisms are intended to be used for wheelchairs and prosthetics. So there's certainly some brainy work to be done here! The preprint is on arXiv and comments are very welcome.