E-MagDiP: Electro-Magnetic based Differential Privacy for EEG based Community Sensing

Technical Summary of E-MagDiP

Problem Statement
EEG-based community sensing programs are increasingly used to analyze aggregated brain data for insights into attentiveness in educational and industrial settings. However, these programs face significant privacy challenges because raw EEG signals contain sensitive biometric data capable of revealing personal traits, cognitive states, and even private information like PINs. While Differential Privacy (DP) offers a theoretical framework to protect individual data within aggregates, its practical application to EEG is hindered by hardware constraints. Most commercial EEG headsets are closed systems that cannot be modified to inject the necessary user-level noise. Furthermore, adding noise via software on wearable devices is often impractical due to strict power and computation limits, which can degrade sampling rates and increase latency. Existing encryption methods protect data in transit but do not prevent untrusted aggregators from inferring individual identities from the decrypted aggregated data.

Methodology: E-MagDiP Framework
The authors propose E-MagDiP (Electro-Magnetic based Differential Privacy), a framework that achieves DP by perturbing EEG signals at the point of acquisition using external electromagnetic (EM) signals, rather than modifying the headset's internal hardware or software.

• Core Mechanism: The system leverages the principle that Amplitude Modulated (AM) RF signals can induce controlled Gaussian noise on analog sensors and electrodes. Instead of using this phenomenon for attacks (as seen in prior work), E-MagDiP uses it for defense.
• System Architecture:
  • Transmitter: A Software-Defined Radio (SDR), specifically a USRP B200, generates a white Gaussian noise signal. This signal is amplitude-modulated and transmitted via a directional or omnidirectional antenna.
  • Induction: The RF signal is directed at the EEG headset's electrodes and wires. The interaction induces a calibrated white Gaussian noise onto the EEG stream.
  • Calibration: The system calculates the required noise standard deviation ($\sigma$) based on DP theory (specifically the Gaussian Mechanism), the number of participants ($N$), the number of channels, and the sampling rate. The SDR parameters (carrier amplitude, modulation index, and gain) are tuned to induce the precise noise level needed to satisfy the $(\epsilon, \delta)$-DP guarantee.
  • Deployment: The transmitter is placed in the same room as the participants (e.g., a classroom). The EEG data, now perturbed with DP noise, is transmitted (often via Bluetooth) to an untrusted server. The server aggregates the data, potentially using Homomorphic Encryption (HE) to perform computations on encrypted data before decryption and analysis.
• Hardware Compatibility: The framework was tested on three off-the-shelf headsets without any modifications:
  1. OpenBCI Cyton: Research-grade, 5 channels, 250 Hz.
  2. Neurosky MindWave Mobile 2: Consumer-grade, 1 channel, 512 Hz.
  3. Sichiray Taurus 2.0: Consumer-grade, 1 channel, 215 Hz.

Key Contributions

1. First RF-Based DP for EEG: E-MagDiP is presented as the first framework to utilize RF signals specifically for inducing differential privacy in EEG community sensing, rather than for attacking the system.
2. Non-Invasive Implementation: It provides a mechanism to achieve DP guarantees without requiring any hardware or software modifications to existing commercial EEG headsets, addressing the "closed system" limitation of current wearables.
3. RF Perturbation Design: The authors designed an AM transmission technique that induces calibrated white Gaussian noise on EEG signals, effectively meeting the statistical noise requirements for DP.
4. Empirical Validation: The system was validated on three distinct commercial EEG systems, demonstrating its ability to function across different form factors and sampling rates.

Experimental Results

• Privacy Guarantee: In user trials involving 10 participants, E-MagDiP successfully induced sufficient noise to provide a DP guarantee. When scaled to a community sensing scenario of 100 participants, the system achieves a privacy guarantee of $\epsilon = 38.12$.
• Accuracy Impact: The addition of RF-induced noise resulted in a minimal impact on classification accuracy. In a Steady-State Visual Evoked Potential (SSVEP) classification task, E-MagDiP achieved 69.4% accuracy. This represents a drop of only 3.1% compared to the "NoDP" baseline (72.5%) and an improvement of 1.2% over a state-of-the-art software-based DP method (SoftwareDP, 68.2%).
• Distance and Antenna Flexibility: Experiments showed that the system functions effectively over distances of 1 to 4 meters. While directional antennas induced slightly higher noise at close range, the difference between directional and omnidirectional antennas became negligible at 2–4 meters, suggesting flexible deployment options.
• Multi-User and Cross-Device: The system successfully provided DP noise to multiple users simultaneously, even when they were wearing different headset models (OpenBCI, Neurosky, Sichiray) and located at varying angles and distances from the transmitter.
• Safety: The Maximum Transmission Power Density (MTPD) used in the experiments was calculated at 9.7 $\mu$W/cm², which is approximately 60 times lower than the FCC safety threshold of 580 $\mu$W/cm², indicating no harmful thermal effects.

Significance and Claims
The paper claims that E-MagDiP represents a paradigm shift in EEG privacy protection. By moving the noise generation from the constrained wearable device to an external RF source, it bypasses the power and latency limitations that have previously made DP impractical for commercial EEG headsets. The authors emphasize that this approach enables "practical DP for EEG community sensing without any user-level modification."

The work highlights that while standard anonymization fails for biometric EEG data and encryption only protects against unauthorized access, E-MagDiP protects against inference by untrusted aggregators. The authors modestly note limitations, such as the dependency on exposed wires for carrier frequency tuning (though they observed noise induction on flex-circuit headsets like Muse 02) and the need for further study on complex software notch filters. They also identify regulatory hurdles, noting that specific carrier frequencies used (e.g., 754 MHz) fall outside standard ISM bands and would require adjustment for commercial deployment.

Ultimately, the paper positions E-MagDiP as a viable solution to unlock the potential of large-scale EEG community sensing by ensuring privacy at the source of data acquisition without compromising the utility of the aggregated data.