🤖 AI

Brain-Prompt Injection: A Route-Safety Audit for BCI-LLM Agents

This paper introduces "brain-prompt injection" as a novel attack vector in BCI-LLM agent pipelines where neural signal perturbations bypass traditional monitors, and proposes a "Route-Safety Audit Contract" with split-conformal calibration to mathematically define and empirically validate safety boundaries against such attacks using EEG data.

Original authors: Jianwei Tai

Published 2026-06-09

📖 6 min read🧠 Deep dive

CC BY 4.0

Original authors: Jianwei Tai

Original paper licensed under CC BY 4.0 (http://creativecommons.org/licenses/by/4.0/). ✨ This is an AI-generated explanation of the paper below. It is not written or endorsed by the authors. For technical accuracy, refer to the original paper. Read full disclaimer

Imagine a future where you can control your computer or smart home just by thinking. You think "left," and the cursor moves left. You think "send email," and the email goes out. This is the promise of Brain-Computer Interfaces (BCI) combined with AI Agents (smart programs that do things for you).

This paper is a security audit. It asks a scary question: What if someone hacks your brain signal to trick the AI into doing something dangerous, even if the AI thinks everything is working perfectly?

Here is the breakdown of the paper's findings using simple analogies.

1. The Setup: The "Brain-to-Action" Pipeline

Think of the system as a three-person team trying to open a secure vault:

The Decoder (The Translator): A computer program that listens to your brainwaves and translates them into a command (e.g., "Move Left").
The Agent (The Doer): A smart AI that takes that command and decides what tool to use (e.g., "Okay, I will move the mouse").
The Monitor (The Security Guard): A system that checks if the command looks safe before the Doer acts.

2. The New Danger: "Brain-Prompt Injection"

The authors discovered three new ways to hack this team. They call these Brain-Prompt Injections.

Attack A: The "Signal Glitch" (C1)

The Metaphor: Imagine the Translator is wearing noise-canceling headphones. A hacker plays a specific, inaudible frequency that makes the Translator hear "Move Left" when you actually thought "Move Right."
The Result: The Translator is fooled. The Monitor sees the Translator say "Move Left" and thinks, "Okay, that matches the brain signal." The system moves left.
The Paper's Finding: This is a known problem in AI, but it's the first time they've mapped it specifically to brain-controlled tools.

Attack B: The "Context Trap" (C2)

The Metaphor: This is the sneakiest one. The Translator is working perfectly. You think "Move Left." But, the hacker has secretly changed the environment the AI is looking at. Imagine the AI is reading a note on the wall that says, "Ignore the brain signal; move Right instead."
The Result: The Translator says "Left," but the AI sees the note and says, "Oh, the note says Right, so I'll move Right."
The Paper's Finding: The Security Guard looks at the brain signal (which says "Left") and sees no glitch. The Guard thinks, "Everything is fine!" But the AI did the wrong thing because of the hidden note. The brain signal was clean, but the context was poisoned.

Attack C: The "Double-Blind" Hack (C3)

The Metaphor: To be extra safe, the system uses two Translators. They only act if both Translators agree.
- Normal Scenario: You think "Left." Translator 1 says "Left." Translator 2 says "Left." The AI moves left. Safe!
- The Hack: The hacker finds a specific brain-signal pattern that makes both Translators think you said "Right," even though you thought "Left."
The Result: Both Translators agree: "Right." The Security Guard sees two people agreeing and says, "Great, consensus! Let's go Right."
The Paper's Finding: Agreement is not proof of intent. Just because two different AI models agree on a command doesn't mean the command is what the human actually thought. A hacker can trick both of them simultaneously.

3. The Solution: The "Audit Contract"

The authors realized that you can't just rely on "Is the brain signal clean?" or "Do the two AIs agree?" You need a specific Audit Log (a checklist of evidence) to prove safety.

They propose a new rulebook called the Route-Safety Audit Contract. It says:

Don't just check the brain signal. You must also check the context (was there a hidden note?).
Don't just check for agreement. You must check if the agreement was forced by a hacker.
The "Confirmation" Layer: The only way to be truly safe is to add a second, independent check. For example, after the brain says "Transfer Money," the system asks for a second, separate brain signal (a "confirmation") to verify the user really meant it.

4. The Experiments: What They Actually Tested

The authors didn't hack real people or real bank accounts. They built a simulation using:

5,400 brain events from a public dataset (people thinking about moving their left or right hand).
Harmless "Stubs": Instead of actually sending money or deleting files, the system tried to move a cursor or open a harmless text box.
The Results:
- Context Attacks (C2): When they added "poisoned notes," the system moved the cursor the wrong way 100% of the time if they didn't check the context. If they did check the context, it blocked the attack 100% of the time.
- Agreement Attacks (C3): When they tricked both AIs to agree on a wrong command, the system did the wrong thing 100% of the time.
- The Fix: When they added the Independent Confirmation (a second brain check), they could block almost all of these attacks, though it meant the system was slightly slower or less convenient.

5. The Bottom Line

The paper concludes with a very specific, narrow claim:

Current safety checks are blind. They look at the brain signal and see "all clear," but they miss the hidden context or the coordinated hacking of multiple AIs.
Agreement is not a certificate. Two AIs agreeing does not mean the human intended that action.
We need a new checklist. To say a brain-controlled system is safe, we must log specific things: Where did the command come from? Was the context trusted? Did a second, independent check happen?

In short: You cannot trust a brain-controlled robot just because the brain signal looks normal or because two computers agree. You need a specific "safety log" that checks for hidden tricks, or the robot might do exactly what the hacker wants, not what you want.

Note: The paper explicitly states this is an offline audit (a simulation). It does not prove that hackers can currently do this to real people in real life, nor does it claim to solve all safety issues for medical or financial uses. It simply proves that the current way we check for safety is mathematically insufficient.

Technical Summary: Brain-Prompt Injection and Route-Safety Audits for BCI–LLM Agents

1. Problem Definition

The paper addresses a novel security vulnerability emerging from the integration of Brain-Computer Interfaces (BCIs) with Large Language Model (LLM) tool-using agents. In this architecture, decoded neural activity (e.g., EEG signals) serves as an authorization channel for an agent to execute tools (e.g., moving a cursor, sending a message). The authors identify a new attack surface termed brain-prompt injection, where an adversary manipulates the neural signal or the surrounding context to force the agent into executing unauthorized actions.

The paper defines three specific failure modes that current safety mechanisms fail to address jointly:

C1 (Signal-Side Perturbation): Adversarial perturbations to the EEG window that alter the decoded command, similar to traditional adversarial examples.
C2 (Context-Only Injection): Analogous to indirect prompt injection in LLMs, where an attacker modifies the external context (e.g., retrieved documents or system prompts) to change the agent's route. Crucially, the EEG signal remains "clean," causing EEG-only monitors to fail to detect the anomaly.
C3 (Adaptive Dual-Decoder Attack): An attacker applies a shared perturbation to the raw input seen by both a primary decoder ( $f$ ) and a verification decoder ( $f_2$ ). This satisfies the "agreement" safety predicate (both decoders output the same target) while driving both toward an attacker-chosen target rather than the user's intent.

The core problem is that existing safety claims (e.g., "dual-decoder agreement certifies intent") are mathematically insufficient because they fail to account for the attacked dependence lift—the joint probability that both decoders are simultaneously driven to the same malicious target by a shared perturbation.

2. Methodology and Theoretical Framework

The Route-Safety Audit Contract
The authors propose a formal Route-Safety Audit Contract to define the necessary conditions for certifying route safety. This contract consists of:

Log Schema ( $L_c$ ): A minimal set of variables that must be logged per case, including context provenance, attacked secondary decisions, execution policies, and route outcomes.
Denominator Hierarchy ( $D_c$ ): Specific statistical denominators (e.g., source-not-target cases, seed-level hierarchies) required to calculate valid rates.
Endpoint Specification ( $G_c$ ): Defined pass/fail criteria.

Theoretical Contributions

Audit-Schema Separation Theorem: The paper proves that without logging specific variables (like context provenance for C2 or attacked secondary decisions for C3), two audit worlds can appear identical in their logs while having opposite safety truth values. Thus, standard metrics (like clean agreement rates) are non-identifying for these attack classes.
C3 Attacked-Dependence Decomposition: The authors decompose the risk of a C3 attack into three terms: the primary target probability ( $p_1$ ), the attacked conditional agreement term ( $P(B|A)$ ), and the execution policy term ( $\alpha$ ). They demonstrate that clean agreement statistics cannot identify the attacked joint term ( $\Delta_D$ ), meaning high clean agreement does not guarantee safety under attack.
Conformal Calibration Layer: To address C3, the paper applies split-conformal calibration to a non-oracle confirmation channel (an independent EEG window decoded by a separate model). This establishes a theoretical bound on the False Accept Rate (FAR) under a specific threat model (B-strict) requiring:
1. Acquisition Isolation: The confirmation window is acquired from a session the attacker cannot influence.
2. Confirmation-Channel Non-Controllability: The attacker cannot perturb the confirmation window.
  The paper proves via a PGD-feasibility argument that if the attacker can perturb the confirmation window, no uniform FAR bound exists.

3. Experimental Validation

The authors instantiate the audit contract on EEGMMI native left/right command-control data involving 5,400 events across 60 subjects, 10 random seeds, and harmless tool stubs (cursor movements).

Key Experimental Findings:

C2 Vulnerability: Context-only injection successfully routes the target action with a rate of 1.000 when provenance is absent. When context provenance is enforced, the route is blocked (0.000), while EEG-side monitors remain blind to the attack.
C3 Vulnerability: Under shared raw-input perturbations, dual-decoder agreement fails to prevent unauthorized routing. The attack success rate for C3 is 1.000 even when agreement and provenance are present.
Confirmation Efficacy: Introducing an independent EEG confirmation window (non-oracle proxy) significantly reduces C3 routing.
- At a target False Accept Rate ( $\alpha$ ) of 0.05, the C3 routing rate drops to 0.178 (95% CI [0.153, 0.206]) with a clean utility of 0.573.
- At $\alpha = 0.01$ , the C3 routing rate drops to 0.091 (95% CI [0.073, 0.113]) with a clean utility of 0.458.
Threat-Archetype Necessity: The experiments validate the necessity of the B-strict threat model. When the attacker is allowed to perturb the confirmation window (Archetypes C and C'), the FAR explodes to ~1.000, confirming the theoretical bound.
Preprocessing and Stress Tests: The paper tests the robustness of the agreement bypass against preprocessing constraints (smoothing, band-limiting, temporal shifts). While combined constraints (smooth + band-limit) reduce agreement rates to 0.156, the attack remains feasible under many realistic constraints, and temporal alignment sensitivity is identified as a fragile point.
Capacity Saturation: Experiments varying the capacity of the confirmer model (TinyEEGNet vs. EEGNetV4) show that the FAR/utility frontier is dataset-limited rather than model-limited within the tested regime; increasing model capacity beyond a few hundred parameters yields diminishing returns.

4. Key Contributions

Definition of Brain-Prompt Injection: Formalizing the attack surface where neural signals and LLM contexts interact, specifically identifying C1, C2, and C3 failure modes.
Route-Safety Audit Contract: A theoretical framework proving that safety claims require specific log schemas and denominators. It establishes that clean agreement is not an intent certificate under adaptive attacks.
Conformal Calibration for BCI: Adapting split-conformal prediction to BCI confirmation channels, providing a rigorous, falsifiable bound on unauthorized confirmed routes under strict acquisition isolation.
Empirical Instantiation: A comprehensive audit protocol on real EEG data (EEGMMI) demonstrating that:
- Provenance blocks C2.
- Agreement alone fails against C3.
- Independent confirmation (with strict isolation) reduces C3 risk but does not eliminate it, creating a measurable risk-utility frontier.

5. Significance and Claims

The paper positions its contribution as a narrow, testable audit protocol rather than a general deployment guarantee or a physical attack demonstration.

Modest Claims: The authors explicitly state they are not estimating deployed BCI prevalence, physical injection feasibility, or human consent. The experiments are offline authorization audits.
Core Significance: The primary contribution is the demonstration that route-safety claims must be class-specific. A safety certificate valid for C1 (signal perturbation) is insufficient for C2 (context injection) or C3 (adaptive agreement).
Practical Implication: The paper argues against treating dual-decoder agreement as a sufficient safety predicate. Instead, it advocates for a safety stack that includes provenance logging, independent confirmation channels (with strict isolation), and class-specific denominators to falsify safety claims.
Limitations: The work acknowledges that cross-day non-stationarity, headset reseating, and impedance drift are open assumptions not covered by the current dataset. The "live router" bridge is a transcript check, not a real-time agent validation.

In summary, the paper provides a rigorous mathematical and empirical framework showing that current BCI-LLM safety mechanisms are blind to specific joint attack vectors, and it proposes a minimal audit schema and conformal calibration layer to make these risks measurable and falsifiable.