{"id":"5ba1310b-ca0a-42a5-8c84-b5f50a17250f","arxiv_id":"2412.11394","paper_version":1,"verdict":"CONDITIONAL","confidence":"MODERATE","novelty_score":3.0,"correctness_risk":"medium","formal_verification":"none","parameter_count":0,"one_line_summary":"A survey of privacy threats and privacy-preserving techniques for brain-computer interfaces, with a taxonomy of attacks, defenses, and open challenges.","lead":"This paper reviews how brain-computer interface systems can leak private information and what protections exist. It organizes known attacks and defenses into a taxonomy and lists open challenges for building privacy-preserving BCIs.","discovery_kind":"review","skeptic_critique":{"model":"deepseek-v4-flash","headline":"The central claim to be a 'contemporary and comprehensive' systematic review is not supported: no search protocol is documented, and the BCI-specific reference set stops around 2021 despite a December 2024 submission.","rationale":"The reader's weakest assumption identifies the absence of a documented search strategy and the dated reference set as the load-bearing premise. My independent reading agrees: the abstract and Section VI make a strong 'contemporary and comprehensive' claim, but the paper provides no reproducible method for assembling its reference list, and the BCI-specific citations cluster around 2017-2021. A systematic review is defined by its method, not just by its topic; without a protocol, the claim of systematicity is unverifiable. The internal summaries appear broadly consistent with the cited papers, so the concern is not that individual descriptions are wrong, but that the sample of literature is not shown to be complete or current. That directly affects the paper's central contribution as a gap-filling comprehensive review. A narrative survey of BCI privacy with clearly bounded scope would avoid this problem, or the authors could add a genuine methodology section. Either way, the current verdict of CONDITIONAL is appropriate, so I recommend no change to the reader's verdict.","tokens_in":20430,"tokens_out":3304,"duration_ms":32284,"concrete_test":"Run an independent PRISMA-style database search on PubMed, Scopus, IEEE Xplore, and ACM DL for (BCI OR EEG) AND (privacy OR inference attack OR membership inference OR model extraction OR homomorphic encryption OR differential privacy OR federated learning) covering 2012-2024. Compare the retrieved BCI-specific privacy attack and protection papers against Tables I and II. If the search surfaces five or more relevant BCI privacy papers from 2022-2024 that are absent from the review, the 'contemporary and comprehensive' claim fails; if the included tables subsume all returned BCI-specific works, or if the authors add and follow a documented protocol, the concern is resolved.","verdict_should_be":"UNCHANGED","load_bearing_attack":"The paper's central claim, stated in the abstract and reiterated in Section VI, is that it provides the first 'contemporary and comprehensive' systematic review of privacy-preserving BCIs. For that claim to hold, the included study set must be reproducible, current, and representative. None of these conditions is demonstrated. The manuscript has no methodology section, no search strategy, no inclusion or exclusion criteria, no database or date range, and no PRISMA-style selection flow; Sections III-D and IV-D summarize selected papers without explaining how they were chosen. The BCI-specific evidence is also dated: Table I's newest BCI privacy attack is from 2020, and Table II's newest BCI protection works are from 2020 and 2021, with several citations listed as 'in press' or 'submitted' and none from 2022-2024. Because the submission is dated December 2024, this is not a stylistic shortcoming but a direct gap between the 'contemporary and comprehensive' claim and the actual reference base. If the set is unrepresentative, the derived taxonomy of threats and defenses, and hence the claimed contribution of filling a gap, is fragile. This is a concern about verifiability and evidence quality, not about internal consistency of the narrative.","agreement_with_reader":"agree"},"referee_report":{"model":"deepseek-v4-flash","summary":"The manuscript is a review of privacy threats and defenses in brain-computer interface (BCI) systems. It proposes a taxonomy of private information in BCIs (personal accounts, personal preferences, physical state, commercial models), distinguishes data-level from model-level privacy threats, surveys protection approaches organized into cryptography, perturbation, and machine-learning-aided systems, and lists four research challenges and future directions. The paper claims to be the first contemporary and comprehensive systematic review of privacy-preserving BCIs, while explicitly stating that it does not introduce new attacks, defenses, or experimental data.","tokens_in":20784,"tokens_out":3761,"duration_ms":32360,"significance":"If the claims were substantiated, the paper would provide a useful structured entry point into BCI privacy: the threat taxonomy and the data-level/model-level distinction are clear, the summaries of individual works are generally faithful to the cited abstracts, and the discussion of source-free transfer learning, federated learning, utility-privacy tradeoffs, and evaluation gaps is valuable. Its contribution is synthetic rather than technical. The main significance hinges on the asserted 'contemporary and comprehensive' and 'systematic review' status, which is exactly what the manuscript does not currently establish; if that status is removed or properly supported, the review would still be a useful survey but with a weaker scope claim.","major_comments":[{"comment":"The central claim that this is the first 'contemporary and comprehensive' review, and the 'Systematic Review' designation, is not supported by the manuscript's method. There is no methodology section, no search strategy, no database list, no date range, no inclusion/exclusion criteria, and no PRISMA-style study selection flow. Sections III-D and IV-D summarize a chosen set of BCI papers without explaining how those papers were identified or why they represent the literature. Because the contribution is explicitly framed as filling a gap through comprehensiveness, the absence of a reproducible selection protocol is a load-bearing limitation, not a stylistic one.","section":"Title, Abstract, Section VI"},{"comment":"The 'contemporary' part of the claim is contradicted by the evidence base. Table I's most recent BCI privacy attack is from 2020, and Table II's most recent BCI protection works are from 2020 and 2021; several references are listed as 'in press' or 'submitted' (e.g., refs [26], [47], [50], [53], [85]), and there are no references from 2022-2024 even though the manuscript is dated December 2024. The paper either needs a genuinely updated search covering the intervening years or a qualified scope statement that it reviews work through approximately 2021.","section":"Tables I-II and Reference List"},{"comment":"The paper makes strong negative statements, e.g., 'To our knowledge, no privacy attacks targeting the BCI models have been reported yet' and 'ML aided systems have not been studied in privacy-preserving BCIs yet.' In a systematic review, such absence claims require exhaustive coverage of the literature; without a documented search, they are not established. Please either support these claims with a searchable protocol or soften them to reflect that they are based on the authors' manually assembled reference set.","section":"Sections III-C and IV-D"},{"comment":"A large fraction of Section IV (e.g., homomorphic encryption, secure multi-party computation, secure processors, differential privacy, data reconstruction, and ML aided systems) describes generic privacy-preserving machine learning methods and cites general works with little or no BCI-specific evidence. This breadth is useful background for an unsystematic survey, but it weakens the 'comprehensiveness' claim for privacy-preserving BCIs because the reader cannot tell which described solutions have actually been evaluated on BCI data. The authors should either connect each category to concrete BCI applications or explicitly identify these parts as transferable background.","section":"Section IV"}],"minor_comments":[{"comment":"Several references are listed with incomplete publication status (e.g., refs [26], [47], [50], [53], [85], [109]); please update them to final versions or clearly mark them as preprints.","section":"Reference list"},{"comment":"There are typographical and copy-editing errors, including 'Icena' for 'Ienca' (Section I), 'CrytoNets' for 'CryptoNets' (Section IV-A), 'Cao and Jian' for 'Cao and Jain' (Section III-B2), and 'a directly communication pathway' in the first sentence of Section I.","section":"Throughout"},{"comment":"The author block contains spacing artifacts such as 'Y u Sun' and 'Fei-Y ue Wang'; these should be normalized.","section":"Author block"},{"comment":"The text references Figures 1-4, but the supplied manuscript does not show them; please ensure all figures are present in the compiled version and that their labels match the text.","section":"Figures"}],"recommendation":"major_revision","confidential_remarks":"The manuscript is better characterized as a narrative survey than as a systematic review. The central problem is one of scope and evidence quality: the 'contemporary and comprehensive' claim is not supported by the documented evidence base or by the absence of any search methodology. This is fixable either by conducting and documenting a real systematic search or by explicitly reframing the paper as a non-systematic survey with a more limited scope claim. I would not reject outright, because the structure and the BCI-specific summaries have value, but a major revision is necessary."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"You should know this paper is a decent organized overview of BCI privacy threats and defenses, but the title and abstract oversell it. The taxonomy (four private-information types, three defense families) is a reasonable way to structure the area, and the summaries of individual papers are generally accurate – I spot-checked several and they match the cited work. The tables help, and the challenges section is sensible. If you need a quick entry point to the field as it stood around 2021, this works.\n\nThe soft spot is exactly what the stress-test flags. There is no methodology section, no search strategy, no inclusion criteria, no date range. The reference list is the giveaway: Table I's newest BCI attack is from 2020, Table II's newest protection work is from 2021, and several citations are 'in press' or 'submitted' despite the December 2024 submission. So the claim to be 'contemporary and comprehensive' is not supported. The paper is a narrative review with a systematic-review title, and the gap it claims to fill – the absence of a contemporary review – is not actually filled by a reference base that stops three years earlier.\n\nThat said, the load-bearing content is not broken. The summaries are honest, the taxonomy is fine as an organizational contribution, and the authors explicitly note where evidence is missing (e.g., no model-level privacy attacks in BCIs yet). The self-citations are mostly published or preprint work, so I would not count that against them; the 'submitted' one is weaker but not central.\n\nBottom line: this deserves a serious referee, but not because it is ready as is. A competent referee should push the authors to either document a real systematic methodology or drop the 'comprehensive' and 'systematic' claims and position it as a scoped narrative review. With that change it would be a solid reference for students, regulators, and BCI developers looking for a map of the space. I would not cite it in my own work in its current form, but I might bring it to a reading group to discuss how reviews should handle currency claims.","headline":"A useful but stale narrative survey of BCI privacy that overclaims 'contemporary and comprehensive' without a search methodology or post-2021 literature.","tokens_in":21193,"tokens_out":1861,"would_cite":false,"duration_ms":19317,"reading_group":"maybe","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"This review paper claims that brain-computer interface privacy is an underserved field and that existing EEG privacy attacks and defenses can be organized into a single framework.","keywords":["brain-computer interface","EEG privacy","privacy-preserving machine learning","side-channel attacks","differential privacy","homomorphic encryption","secure multi-party computation","synthetic EEG data"],"falsifier":"A reader could search publication databases for peer-reviewed BCI privacy papers from 2022 through 2024; if several established attacks or defenses are absent from the review's tables, the contemporary and comprehensive claim would need qualification. Finding a previously published systematic review that the paper overlooks would directly test the gap claim.","tokens_in":1268,"feed_emoji":"🧠","tokens_out":5532,"duration_ms":63193,"temperature":0.7,"pith_summary":"This review paper attempts to establish that privacy has been neglected in brain-computer interface research and that attacks on EEG-derived data are already demonstrated. It assembles existing evidence that EEG carries private information about identity, preferences, physical condition, and commercial models, and it sorts attacks into data-level and model-level categories. It argues that generic privacy-preserving machine learning techniques, namely cryptography, perturbation, and ML-aided systems, can be adapted to BCIs, and it lists open challenges. If correct, the paper gives researchers a structured map of BCI privacy threats and defenses plus a research agenda. The novel contribution is the synthesis, not new attacks or defenses.","feed_headline":"EEG data leak PINs, habits, and health: a map of BCI privacy","feed_subtitle":"A systematic review classifies attacks and defenses for brain-computer interfaces and points to open problems.","key_machinery":"The organizing device is a two-axis taxonomy: private information types (personal account, personal preferences, physical state, commercial models) crossed with privacy threats (data-level identification and inference attacks, model-level extraction and inversion attacks) and protection strategies (cryptography, perturbation, ML-aided systems). This taxonomy carries the review; each surveyed paper is placed within it to show which gaps are filled and which remain open.","core_discovery":"The paper's central claim is that BCI privacy is a real and underserved problem, and that the scattered literature on attacks and defenses can be organized into a coherent framework. It reports that EEG signals let attackers infer PINs, passwords, identity, personality traits, political preferences, health conditions, and smoking status; that model-level attacks are plausible but not yet demonstrated in BCIs; and that existing defenses fall into cryptography, perturbation, and ML-aided systems, with only a handful of BCI-specific implementations. The paper also identifies cross-subject variation, utility-privacy trade-offs, computation cost, and the lack of benchmarking as open challenges.","pith_inferences":["The paper's map suggests model extraction and model inversion attacks will soon be demonstrated against BCI models; a natural extension is to run established model-stealing attacks on a published EEG classifier and measure information leakage.","The taxonomy implies that dimensionality-reduction anonymization of EEG may be fragile, and a testable extension would be to check whether differentially private variants preserve task utility while blocking re-identification.","Because many demonstrated attacks rely on event-related potentials, a plausible untested defense is to use adversarial perturbation to mask ERP responses without degrading the BCI's primary task.","The review's sparse coverage after 2021 leaves the field open to a rapid update that could test whether the proposed taxonomy still accommodates newer attacks and defenses."],"forward_implications":["BCI system designers should treat EEG as sensitive biometric data subject to legal protections, not merely as a control signal.","Source-free transfer learning and federated learning become the leading candidates for privacy-preserving BCI calibration because they avoid sharing raw EEG.","GAN-based synthetic EEG, such as seizure-signal generation, could allow data sharing without patient re-identification risk.","Encryption-based methods remain too costly for real-time BCI use, so reducing their computation and communication overhead becomes a priority.","A quantitative index of privacy-protection strength is needed before different BCI defenses can be benchmarked against each other."],"supporting_citations":[{"why":"Shows consumer-grade EEG can reveal credit cards, PINs, and other secrets via P300 responses, establishing the foundational side-channel attack.","marker":"[17]"},{"why":"Demonstrates subliminal probing that reduces the entropy of guessing private information, making detection harder.","marker":"[8]"},{"why":"Shows passive ERP-based eavesdropping of passwords and PINs with accuracy well above random guessing, reinforcing the threat.","marker":"[18]"},{"why":"Reports over 90 percent person-identification accuracy from EEG across multiple BCI paradigms, supporting identity leakage.","marker":"[58]"},{"why":"Applies secure multi-party computation to EEG-based linear regression, giving a BCI-specific privacy-preserving approach.","marker":"[74]"},{"why":"Extends SMC-based privacy-preserving linear regression to BCI scenarios with and without calibration data.","marker":"[75]"},{"why":"Uses a differentially private GAN to generate synthetic EEG data that supports downstream tasks while limiting sensitive information.","marker":"[93]"},{"why":"Introduces EpilepsyGAN for synthetic ictal EEG, showing lower re-identification risk while maintaining data utility.","marker":"[85]"},{"why":"Demonstrates homomorphic encryption on EEG-based seizure detection and alcoholism prediction with plaintext-comparable performance.","marker":"[100]"}],"fun_headline_variants":["BCI privacy: a systematic map of EEG leaks and defenses","EEG signals expose secrets: a systematic BCI privacy review","Your brainwaves are private? A systematic BCI security review","Mapping BCI privacy: threats, defenses, and missing benchmarks"],"cache_read_input_tokens":23424,"weakest_assumption_plain":"The review's load-bearing premise is that the hand-assembled set of references is representative and complete enough to support the claim of being contemporary and comprehensive, yet no search strategy or inclusion criteria are documented and the bibliography largely stops before 2022.","fun_headline_variants_meta":{"raw":{"variants":["BCI privacy: a systematic map of EEG leaks and defenses","EEG signals expose secrets: a systematic BCI privacy review","Your brainwaves are private? A systematic BCI security review","Mapping BCI privacy: threats, defenses, and missing benchmarks"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.000702,"raw_usage":{"total_tokens":3116,"prompt_tokens":840,"completion_tokens":2276,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":456,"completion_tokens_details":{"reasoning_tokens":2205}},"tokens_in":456,"tokens_out":2276,"duration_ms":13142,"temperature":1.0,"reasoning_tokens":2205,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-11T14:58:06.325365+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"A reader could search publication databases for peer-reviewed BCI privacy papers from 2022 through 2024; if several established attacks or defenses are absent from the review's tables, the contemporary and comprehensive claim would need qualification. Finding a previously published systematic review that the paper overlooks would directly test the gap claim.","supporting_citations":[{"cited_title":"Task- independent EEG identification via low-rank matrix decompo sition,","cited_arxiv_id":null,"evidence_quote":"Reports over 90 percent person-identification accuracy from EEG across multiple BCI paradigms, supporting identity leakage."},{"cited_title":"Privacy-preserving linear r egression for brain-computer interface applications,","cited_arxiv_id":null,"evidence_quote":"Applies secure multi-party computation to EEG-based linear regression, giving a BCI-specific privacy-preserving approach."},{"cited_title":"Protecting privacy of users i n brain- computer interface applications,","cited_arxiv_id":null,"evidence_quote":"Extends SMC-based privacy-preserving linear regression to BCI scenarios with and without calibration data."},{"cited_title":"A privacy-pres erving gen- erative adversarial network method for securing EEG brain s ignals,","cited_arxiv_id":null,"evidence_quote":"Uses a differentially private GAN to generate synthetic EEG data that supports downstream tasks while limiting sensitive information."},{"cited_title":"EpilepsyGAN: Synthetic epileptic brain a ctivities with privacy preservation,","cited_arxiv_id":null,"evidence_quote":"Introduces EpilepsyGAN for synthetic ictal EEG, showing lower re-identification risk while maintaining data utility."}],"review_version":1}