When Certificates Fail: A Unified Safety Framework for Embedded Neural Interface Models

Jasmeet Singh Bindra

REVIEW 3 major objections 6 minor 28 references

When Certificates Fail: A Unified Safety Framework for Embedded Neural Interface Models

T0 review · 3 major / 6 minor · reviewed 2026-07-11 · grok-4.5

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read Formal robustness certificates for neural-interface models can pass while task accuracy collapses under attack, so operational safety audits—not certificates alone—are required for responsible deployment.

desk verdict Clean official-session evidence that task accuracy collapses under PGD while a deliberately loose Lipschitz check still passes; useful audit package, but the verification gap is partly by construction. read the letter →

arxiv 2607.06630 v1 pith:OJFM65X4 submitted 2026-07-07 cs.LG eess.SP

Jasmeet Singh Bindra This is my paper · ORCID

classification cs.LGeess.SP

keywords neuralinterfacesrobustnesscertificatesEEGdecodingAIalignmentprivacyleakageproxyfidelityBCIsafetyoperationalauditing

verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

This paper argues that mathematical safety certificates for brain–computer interface models can look valid while the models fail at the job users care about: decoding intent accurately under stress. At a moderate attack budget, EEGNet motor-imagery accuracy falls by about a quarter while a Lipschitz-style output-sensitivity certificate still passes for every subject tested, and the same task-failure pattern appears in classical CSP and FBCSP pipelines. The authors treat this gap as one instance of a broader alignment failure—training proxies diverging from user welfare—and propose a unified empirical audit around three linked modes: certificates that pass while behavior degrades, task-trained representations that damage neural signal structure, and public-task embeddings that leak private subject identity. Instantiated on standard EEG benchmarks with official session splits, null controls, and paired tests, the results show that responsible deployment needs multi-objective operational auditing, not certificate verification alone.

What carries the argument

A unified empirical audit framework organized around three failure modes: verification insufficiency (certificate true while task-level safety false), proxy-fidelity divergence (task objective improves while a separate neural-fidelity metric degrades), and latent information exfiltration (public-task embeddings retain recoverable private attributes). The framework is carried by official session-level protocols, null controls, and paired statistical tests on EEG/BCI data.

What would settle it

Re-run the official-session EEGNet PGD grid with a tighter local Lipschitz or margin certificate: if that certificate yields a nonzero certified-safe fraction while accuracy at ε=0.25 stays near clean levels—or fails whenever accuracy collapses—the claimed operational gap between certification and task safety is closed.

Watch

Extended reading notes

Core claim

At perturbation budget ε=0.25, official-session EEGNet classification accuracy drops by 25.7% under projected-gradient attack while a Lipschitz-style certificate remains valid for all nine BCI Competition IV 2a subjects; the same task-failure pattern holds for CSP+LDA and FBCSP+LDA, so the verification gap is architecture-independent. Parallel audits show that a time-domain auxiliary objective can cut reconstruction MSE by 0.1132 while worsening spectral log-MSE, and that public-task embeddings recover subject identity at 48.1% versus 6.7% chance. Operational safety auditing across verification, fidelity, and privacy—not certificate verification alone—is therefore necessary for responsible n

Load-bearing premise

The central claim rests on treating a loose global product-of-layer Lipschitz upper bound as a representative formal certificate that would be offered or accepted as safety evidence; if tighter certificates closed the gap, the verification-insufficiency result would weaken.

Share X Bluesky LinkedIn Reddit HN

Signed reviews

No signed human review yet.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Desk Editor's Note

read the letter

The one thing worth knowing: on official BCI IV 2a train-to-eval sessions, EEGNet accuracy falls about 25.7% at ε=0.25 under PGD while their product-of-layer Lipschitz output-sensitivity check still passes for all nine subjects, and CSP+LDA / FBCSP+LDA show the same task fragility. That empirical package is the paper’s real contribution, not a new theory of certificates.

What is actually new is the quantified architecture-independent gap under the official protocol, plus the joint packaging of three audits (verification, proxy-fidelity, privacy) with null controls and paired stats. E1 is the load-bearing piece and it is done carefully: session-level splits, label-permutation near chance, BH-corrected subject-paired tests, classical baselines. E2’s objective-dependent trade-offs (time-domain MSE improves while spectral log-MSE worsens, and the reverse under spectral losses) are clean and controlled. E3 shows subject identity above chance with a permutation collapse; under-powered, but directionally honest.

The soft spot the stress-test flags is real and not minor: Lemma 1 only bounds output movement, the margin-certified-safe fraction is zero for every nonzero budget, and the authors themselves call the bound conservative. So the certificate that “passes” is already the one they treat as insufficient for task correctness. Classical pipelines show fragility but are not Lipschitz-certified, so they do not prove that a non-vacuous formal certificate can pass while the task fails. The deployment slogan (“operational auditing, not certificates alone”) is still reasonable as engineering advice; it is just stronger than the formal gap they actually measured. Scope is narrow (two EEG datasets, de LDS features for privacy, no released code), and the alignment vocabulary is heavier than the experiments require.

Math is standard sufficient-condition Lipschitz; data and citations look solid for the claims as written. This is for people writing BCI safety cases and for neurotech/AI-safety readers who need multi-objective audits, not for pure verification theorists. I would send it to peer review. Engage if you work on BCI robustness or neuroprivacy; treat the certificate story as a demonstration of loose bounds plus task fragility, not as a surprise failure of formal methods.

Referee Report

3 major / 6 minor

Summary. The paper argues that formal robustness certificates for embedded neural-interface models can be mathematically valid while task performance collapses under bounded perturbations, and treats this as one instance of a broader alignment failure between training proxies and user welfare. It defines three operational failure modes—verification insufficiency (Definition 1), proxy-fidelity divergence (Definition 2), and latent information exfiltration (Definition 3)—and instantiates them as empirical audits E1–E3 on BCI Competition IV 2a (official train-to-evaluation sessions) and SEED-IV (session-holdout). The load-bearing E1 result is that at ε=0.25, official-session EEGNet accuracy drops by 0.2573 under PGD while a conservative Lipschitz-style output-sensitivity check remains passed for all 9 subjects; parallel accuracy drops are reported for CSP+LDA and FBCSP+LDA. E2 shows objective-dependent fidelity trade-offs (time-domain auxiliary loss improves MSE by 0.1132 while worsening spectral log-MSE), and E3 shows public-task embeddings leak subject identity at ~48% versus ~6.7% chance, with permutation controls collapsing to chance. The authors conclude that operational multi-objective auditing, not certificate verification alone, is necessary for responsible deployment.

Significance. If the central claim holds, the paper supplies a concrete, falsifiable demonstration that a standard sufficient-condition certificate can be operationally uninformative for EEG decoding, and packages that demonstration with classical baselines, official-session protocols, null controls, and paired statistical tests. The architecture-independent task-failure pattern (EEGNet, CSP+LDA, FBCSP+LDA) and the multi-metric E2/E3 audits are useful engineering contributions for BCI safety practice, even if the alignment framing is more rhetorical than theoretical. Strengths include the official MOABB session protocol, label- and private-attribute permutation controls, subject-paired sign-flip tests with BH correction, and explicit reporting that the margin-certified-safe fraction is zero. The work is significant as a methodological audit paper rather than as a new certification method or a general theory of alignment.

major comments (3)

The load-bearing E1 claim (abstract; §5.2; Table 1; Fig. 2) rests on a certificate the paper itself shows is vacuous for task safety. Lemma 1 (§3) only bounds output movement by Lε; §4.1 and §5.2 report that the margin-certified-safe fraction is zero for every nonzero budget, and §6.2 acknowledges the product-of-layer bound is known to be conservative. The “certificate that passes” is therefore the bare output-sensitivity check, which the authors already treat as insufficient for decision correctness. Classical CSP/FBCSP results establish task fragility under PGD but are not Lipschitz-certified models, so they do not independently show that a non-vacuous formal certificate can pass while the task fails. The deployment conclusion that “operational safety auditing, not certificate verification alone, is necessary” overstates what the current certificate comparison supports. Either (i) repl
The architecture-independence claim for the verification gap (§1 contributions; abstract; §5.2) is imprecise. The paper correctly shows that PGD task failure is architecture-independent, but the formal certificate C(fθ,ε) is only computed for the spectral-normalized / EEGNet setting (§4.1). CSP+LDA and FBCSP+LDA are used as task-failure controls, not as certified models. The abstract and contribution statements should be revised so that “verification gap” is not attributed to the classical pipelines, and so that the architecture-independent claim is limited to adversarial task degradation.
E3 statistical support is weaker than the abstract’s 48.1% vs 6.7% claim suggests (§4.4; §5.4; Table 3; Table 5). With n=3 seeds the minimum exact one-sided p-value is 0.125; the paper correctly labels this as directional multiseed evidence, but the abstract and conclusion present the leakage figure without that caveat. RF/MLP probes are capacity-bounded and class-balanced subsampled (n_train_fit=6000), so measured leakage may understate what a fully optimized probe could extract. Either increase seeds / report full-data nonlinear probes, or qualify the abstract claim to match the inferential limits already stated in §4.4 and §6.2.

minor comments (6)

Figure 1 is schematic and does not convey quantitative results; consider moving it to an appendix or tightening the caption so it does not compete with Figs. 2–5 for attention.
Notation for the certificate is slightly inconsistent: C(fθ,ε) in Definition 1 vs. the bare lemma check in Eq. (8) and the √2 Lε margin rule in §4.1. A short clarifying sentence would help.
The SEED-IV E3 experiments use pre-extracted de LDS features rather than raw EEG (§5.1, §6.2). This is disclosed but should also appear in the abstract or early methods so readers do not assume raw-signal privacy leakage.
Table 4 and Fig. 5 are useful but dense; highlighting the physiological conditions that meet or exceed the ε=0.25 PGD drop (already bolded in the table note) in the main text would improve readability.
A few phrasing issues: “deceptive alignment” is used as an operational analogy (§2.1, §3.2) for non-strategic EEG decoders; a single clarifying sentence that this is analogy, not a claim of mesa-optimization, would reduce misreading.
References [8], [9], [14], [20] are alignment surveys/position pieces; their use is fine for framing, but the empirical sections should continue to stand without them.

Circularity Check

0 steps flagged · score 0.0 of 10

No significant circularity: claims are independent empirical measurements of PGD accuracy, fidelity deltas, and probe accuracies against chance/permutation baselines, with the Lipschitz bound a standard sufficient condition not fitted to or defined from the task-failure results.

full rationale

The paper's load-bearing results are empirical audits on public BCI IV 2a and SEED-IV data under official session protocols, null controls, and paired tests. Lemma 1 is the ordinary L-Lipschitz output-movement inequality (a standard sufficient condition computed from product-of-layer spectral norms); the bare check that observed movement stays ≤ Lε is independent of the separately measured PGD classification drops (Table 1, Fig. 2) and of the zero margin-certified-safe fraction. The paper itself treats the bound as conservative and non-task-safety (Defs. 1, §4.1, §5.2, §6.2), so the gap is not obtained by defining C from S or by fitting a free parameter then re-predicting it. E2 compares reconstruction metrics under matched latent bottlenecks with explicit time/spectral objectives (Table 2); E3 reports subject-probe accuracies versus 1/15 chance and private-attribute permutation controls (Table 3). No free parameters are fitted to a subset and then called predictions of a closely related quantity; there are no self-citations carrying uniqueness theorems or ansatzes; classical CSP/FBCSP results are architecture controls, not certificates. The three failure-mode definitions are operational and the experiments instantiate them without reducing any claimed prediction to its inputs by construction. This is the expected non-circular case for an empirical safety-audit paper.

Assumptions & free parameters 4 free parameters · 4 assumptions · 4 invented entities

The paper is primarily empirical. Its central claim rests on standard Lipschitz mathematics, public BCI evaluation conventions, and three operational definitions of failure that package existing safety ideas. Free parameters are experimental knobs (loss weights, sanitizer strengths) rather than quantities fitted to force the headline accuracy drop. The main invented entities are the named failure modes and the audit framework itself; they have no independent evidence outside the experiments reported here.

free parameters (4)

time-domain reconstruction weight = 1.0
Fixed at 1.0 in the joint E2 objectives; chosen by hand and directly shapes the reported MSE/spectral trade-off.
spectral reconstruction weight = 0.1
Fixed at 0.1 in full-spectrum and bandpower E2 objectives; hand-chosen scale that determines the size of the spectral repair.
projection-removal direction count = 12 (headline)
Sweep 0–12 subject-discriminative directions; the headline leakage reduction uses remove-12, an experimental choice not derived from theory.
Gaussian latent noise scale = up to 1.0
Sweep 0–1.0 after embedding standardization; used to claim sanitization trade-offs.

assumptions (4)

standard math A global product-of-layer Lipschitz constant yields a valid sufficient bound on output movement under ||δ||≤ε (Lemma 1).
Invoked throughout E1 as the certificate C(fθ,ε); standard but known to be loose.
domain assumption Official train-session / evaluation-session splits on BCI IV 2a (via MOABB) are the correct operational evaluation protocol.
Used for all primary E1/E2 accuracy and fidelity numbers; standard in the BCI literature but not universal.
domain assumption Subject identity is a private attribute that should not be recoverable from public-task embeddings.
Defines success for E3; grounded in neuroethics citations but still a normative modeling choice.
ad hoc to paper The three failure modes (verification insufficiency, proxy-fidelity divergence, latent information exfiltration) jointly capture the relevant alignment failures for embedded neural interfaces.
Stated in §1 and §3 as the organizing taxonomy; maps AI-safety vocabulary onto the three audits by authorial choice.

invented entities (4)

verification insufficiency (Definition 1)
purpose: Names the certificate-pass / task-fail gap that anchors the paper.
Operational definition C=true ∧ S=false; no independent formal status outside this work.
proxy-fidelity divergence (Definition 2)
purpose: Names the case where optimizing Lproxy harms a separately measured fidelity metric F.
Packages specification-gaming ideas for EEG reconstruction metrics; evidence is internal to E2.
latent information exfiltration (Definition 3)
purpose: Names above-chance recovery of private attributes from public-task latents.
Standard privacy-probe idea renamed and placed inside the three-mode taxonomy.
unified empirical audit framework (E1–E3)
purpose: Organizes the three audits as a single safety methodology for neural interfaces.
The paper’s main methodological product; validated only on the two datasets reported here.

how reviews work

0 comments

Cite this review

Pith. "Pith review of When Certificates Fail: A Unified Safety Framework for Embedded Neural Interface Models." pith.science (2026). https://pith.science/paper/OJFM65X4

@misc{pith2026260706630,
  author       = {Pith},
  title        = {Pith review of: When Certificates Fail: A Unified Safety Framework for Embedded Neural Interface Models},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/OJFM65X4}},
  note         = {Machine review of arXiv:2607.06630}
}

read the original abstract

Formal robustness certificates for embedded neural-interface models can pass while task accuracy collapses: at perturbation budget e=0.25, EEGNet classification accuracy drops by 25.7% under projected-gradient attack while the Lipschitz-style certificate remains valid for all 9 tested subjects. We argue that this gap between mathematical certification and operational safety is one instance of a broader alignment failure in neural interfaces, where training objectives diverge from user welfare. We propose a unified empirical audit framework organized around three such failures: verification insufficiency, in which certificates pass while task behavior degrades; proxy-fidelity divergence, in which task-optimized representations damage neural signal structure (a time-domain auxiliary objective reduces reconstruction MSE by 0.1132 while worsening spectral log-MSE); and latent information exfiltration, in which public-task embeddings retain private attributes (subject identity recoverable at 48.1% versus 6.7% chance). We instantiate the framework on BCI Competition IV 2a and SEED-IV using multiple deep and classical EEG decoders, official session-level validation, null controls, and paired statistical tests. The verification gap persists across EEGNet, CSP+LDA, and FBCSP+LDA, and is therefore architecture-independent. Our results establish that operational safety auditing, not certificate verification alone, is necessary for responsible neural-interface deployment.

Figures

Figures reproduced from arXiv: 2607.06630 by the authors.

**Figure 1.** Unified safety audit framework. Embedded neural-interface models map neural signals through a learned encoder into [PITH_FULL_IMAGE:figures/full_fig_p005_1.png] view at source ↗

**Figure 2.** Adversarial task accuracy collapses under bounded [PITH_FULL_IMAGE:figures/full_fig_p007_2.png] view at source ↗

**Figure 3.** Proxy-fidelity effects depend on the training objective. [PITH_FULL_IMAGE:figures/full_fig_p008_3.png] view at source ↗

Figures from the paper (2 more)

**Figure 4.** Figure 4: Latent privacy leakage under the SEED-IV session-holdout protocol. Stronger probes recover subject identity far above [PITH_FULL_IMAGE:figures/full_fig_p009_4.png]

**Figure 5.** Figure 5: Physiological robustness stress tests. Several non [PITH_FULL_IMAGE:figures/full_fig_p010_5.png]

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

28 extracted references · 28 canonical work pages

[1]

Wolpaw, Niels Birbaumer, Dennis J

Jonathan R. Wolpaw, Niels Birbaumer, Dennis J. McFar- land, Gert Pfurtscheller, and Theresa M. Vaughan. Brain– computer interfaces for communication and control.Clin- ical Neurophysiology, 113(6):767–791, 2002

work page 2002
[2]

Lebedev and Miguel A

Mikhail A. Lebedev and Miguel A. L. Nicolelis. Brain- machine interfaces: past, present and future.Trends in Neurosciences, 29(9):536–546, 2006

work page 2006
[3]

Hochberg, Daniel Bacher, Beata Jarosiewicz, Nicolas Y

Leigh R. Hochberg, Daniel Bacher, Beata Jarosiewicz, Nicolas Y . Masse, John D. Simeral, Joern V ogel, Sami Haddadin, Jie Liu, Sydney S. Cash, Patrick van der Smagt, and John P. Donoghue. Reach and grasp by people with tetraplegia using a neurally controlled robotic arm.Nature, 485(7398):372–375, 2012

work page 2012
[4]

Lawhern, Amelia J

Vernon J. Lawhern, Amelia J. Solon, Nicholas R. Way- towich, Stephen M. Gordon, Chou P. Hung, and Brent J. Lance. EEGNet: a compact convolutional neural net- work for EEG-based brain-computer interfaces.Journal of Neural Engineering, 15(5):056013, 2018

work page 2018
[5]

Deep learning with convolutional neural networks for EEG decoding and visualization.Human Brain Mapping, 38(11):5391–5420, 2017

Robin Tibor Schirrmeister, Jost Tobias Springenberg, Lukas Dominique Josef Fiederer, Martin Glasstetter, Katharina Eggensperger, Michael Tangermann, Frank Hutter, Wolfram Burgard, and Tonio Ball. Deep learning with convolutional neural networks for EEG decoding and visualization.Human Brain Mapping, 38(11):5391–5420, 2017

work page 2017
[6]

Security in brain-computer interfaces: State-of-the-art, opportunities, and future chal- lenges.ACM Computing Surveys, 54(1), 2021

Sergio L ´opez Bernal, Alberto Huertas Celdr ´an, Grego- rio Mart´ınez P´erez, Michael Taynnan Barros, and Sa- sitharan Balasubramaniam. Security in brain-computer interfaces: State-of-the-art, opportunities, and future chal- lenges.ACM Computing Surveys, 54(1), 2021

work page 2021
[7]

Towards new hu- man rights in the age of neuroscience and neurotechnol- ogy.Life Sciences, Society and Policy, 13(1):5, 2017

Marcello Ienca and Roberto Andorno. Towards new hu- man rights in the age of neuroscience and neurotechnol- ogy.Life Sciences, Society and Policy, 13(1):5, 2017

work page 2017
[8]

Concrete problems in AI safety, 2016

Dario Amodei, Chris Olah, Jacob Steinhardt, Paul Chris- tiano, John Schulman, and Dan Man´e. Concrete problems in AI safety, 2016

work page 2016

Show all 28 references

[9]

The alignment problem from a deep learning perspective

Richard Ngo, Lawrence Chan, and S ¨oren Mindermann. The alignment problem from a deep learning perspective. InInternational Conference on Learning Representations,
[10]

Ortega, Tom Everitt, Andrew Lefrancq, Laurent Orseau, and Shane Legg

Jan Leike, Miljan Martic, Victoria Krakovna, Pedro A. Ortega, Tom Everitt, Andrew Lefrancq, Laurent Orseau, and Shane Legg. AI safety gridworlds, 2017

2017
[11]

AI alignment: A comprehensive survey, 2023

Jiaming Ji, Tianyi Qiu, Boyuan Chen, Borong Zhang, Hantao Lou, Kaile Wang, Yawen Duan, Zhonghao He, Jiayi Zhou, Zhaowei Zhang, Fanzhi Zeng, Kwan Yee Ng, Juntao Dai, Xuehai Pan, Aidan O’Gara, Yingshan Lei, Hua Xu, Brian Tse, Jie Fu, Stephen McAleer, Yaodong Yang, Yizhou Wang, S...

2023
[12]

Universal adversarial perturbations for CNN classifiers in EEG-based BCIs, 2019

Zihan Liu, Lubin Meng, Xiao Zhang, Weili Fang, and Dongrui Wu. Universal adversarial perturbations for CNN classifiers in EEG-based BCIs, 2019

2019
[13]

Adversarial artifact detection in EEG-based brain-computer interfaces, 2022

Xiaoqing Chen and Dongrui Wu. Adversarial artifact detection in EEG-based brain-computer interfaces, 2022

2022
[14]

Unsolved problems in ML safety, 2021

Dan Hendrycks, Nicholas Carlini, John Schulman, and Jacob Steinhardt. Unsolved problems in ML safety, 2021

2021
[15]

Formal guarantees on the robustness of a classifier against adver- sarial manipulation, 2017

Matthias Hein and Maksym Andriushchenko. Formal guarantees on the robustness of a classifier against adver- sarial manipulation, 2017

2017
[16]

Evaluating the robustness of neural networks: An extreme value theory approach

Tsui-Wei Weng, Huan Zhang, Pin-Yu Chen, Jinfeng Yi, Dong Su, Yupeng Gao, Cho-Jui Hsieh, and Luca Daniel. Evaluating the robustness of neural networks: An extreme value theory approach. InInternational Conference on Learning Representations, 2018. arXiv:1801.10578

2018 arXiv
[17]

Pap- pas

Mahyar Fazlyab, Manfred Morari, and George J. Pap- pas. Safety verification and robustness analysis of neural networks via quadratic constraints and semidefinite pro- gramming, 2019

2019
[18]

Parseval networks: Improving robustness to adversarial examples

Moustapha Cisse, Piotr Bojanowski, Edouard Grave, Yann Dauphin, and Nicolas Usunier. Parseval networks: Improving robustness to adversarial examples. InPro- ceedings of the 34th International Conference on Machine Learning, pages 854–863, 2017

2017
[19]

Mahyar Fazlyab, Alexander Robey, Hamed Hassani, Man- fred Morari, and George J. Pappas. Efficient and accurate estimation of lipschitz constants for deep neural networks, 2019

2019
[20]

Risks from learned op- timization in advanced machine learning systems, 2019

Evan Hubinger, Chris van Merwijk, Vladimir Mikulik, Joar Skalse, and Scott Garrabrant. Risks from learned op- timization in advanced machine learning systems, 2019

2019
[21]

Filter bank common spatial pattern (FBCSP) in brain-computer interface

Kai Keng Ang, Zheng Yang Chin, Haihong Zhang, and Cuntai Guan. Filter bank common spatial pattern (FBCSP) in brain-computer interface. In2008 IEEE International Joint Conference on Neural Networks, pages 2390–2397, 2008

2008
[22]

MOABB: Trust- worthy algorithm benchmarking for BCIs.Journal of Neural Engineering, 15(6):066011, 2018

Vinay Jayaram and Alexandre Barachant. MOABB: Trust- worthy algorithm benchmarking for BCIs.Journal of Neural Engineering, 15(6):066011, 2018. 11

2018
[23]

Corrigibility

Nate Soares, Benja Fallenstein, Eliezer Yudkowsky, and Stuart Armstrong. Corrigibility. InWorkshops at the Twenty-Ninth AAAI Conference on Artificial Intelligence. AAAI Press, 2015

2015
[24]

Hacking the brain: brain-computer interfacing technology and the ethics of neurosecurity.Ethics and Information Technology, 18(2):117–129, 2016

Marcello Ienca and Pim Haselager. Hacking the brain: brain-computer interfacing technology and the ethics of neurosecurity.Ethics and Information Technology, 18(2):117–129, 2016

2016
[25]

Regulating next-generation implantable brain- computer interfaces: Recommendations for ethical devel- opment and implementation, 2025

Renee Sirbu, Jessica Morley, Tyler Schroder, Mari- arosaria Taddeo, Raghavendra Pradyumna Pothukuchi, Muhammed Ugur, Abhishek Bhattacharjee, and Luciano Floridi. Regulating next-generation implantable brain- computer interfaces: Recommendations for ethical devel- opment and im...

2025
[26]

Intriguing properties of neural networks, 2013

Christian Szegedy, Wojciech Zaremba, Ilya Sutskever, Joan Bruna, Dumitru Erhan, Ian Goodfellow, and Rob Fergus. Intriguing properties of neural networks, 2013

2013
[27]

Towards deep learning models resistant to adversarial attacks

Aleksander Madry, Aleksandar Makelov, Ludwig Schmidt, Dimitris Tsipras, and Adrian Vladu. Towards deep learning models resistant to adversarial attacks. In International Conference on Learning Representations,
[28]

arXiv:1706.06083. 12

arXiv

Pith tools

Reviewed July 11, 2026 · model on record in the stance chip above.

[1] [1]

Wolpaw, Niels Birbaumer, Dennis J

Jonathan R. Wolpaw, Niels Birbaumer, Dennis J. McFar- land, Gert Pfurtscheller, and Theresa M. Vaughan. Brain– computer interfaces for communication and control.Clin- ical Neurophysiology, 113(6):767–791, 2002

work page 2002

[2] [2]

Lebedev and Miguel A

Mikhail A. Lebedev and Miguel A. L. Nicolelis. Brain- machine interfaces: past, present and future.Trends in Neurosciences, 29(9):536–546, 2006

work page 2006

[3] [3]

Hochberg, Daniel Bacher, Beata Jarosiewicz, Nicolas Y

Leigh R. Hochberg, Daniel Bacher, Beata Jarosiewicz, Nicolas Y . Masse, John D. Simeral, Joern V ogel, Sami Haddadin, Jie Liu, Sydney S. Cash, Patrick van der Smagt, and John P. Donoghue. Reach and grasp by people with tetraplegia using a neurally controlled robotic arm.Nature, 485(7398):372–375, 2012

work page 2012

[4] [4]

Lawhern, Amelia J

Vernon J. Lawhern, Amelia J. Solon, Nicholas R. Way- towich, Stephen M. Gordon, Chou P. Hung, and Brent J. Lance. EEGNet: a compact convolutional neural net- work for EEG-based brain-computer interfaces.Journal of Neural Engineering, 15(5):056013, 2018

work page 2018

[5] [5]

Deep learning with convolutional neural networks for EEG decoding and visualization.Human Brain Mapping, 38(11):5391–5420, 2017

Robin Tibor Schirrmeister, Jost Tobias Springenberg, Lukas Dominique Josef Fiederer, Martin Glasstetter, Katharina Eggensperger, Michael Tangermann, Frank Hutter, Wolfram Burgard, and Tonio Ball. Deep learning with convolutional neural networks for EEG decoding and visualization.Human Brain Mapping, 38(11):5391–5420, 2017

work page 2017

[6] [6]

Security in brain-computer interfaces: State-of-the-art, opportunities, and future chal- lenges.ACM Computing Surveys, 54(1), 2021

Sergio L ´opez Bernal, Alberto Huertas Celdr ´an, Grego- rio Mart´ınez P´erez, Michael Taynnan Barros, and Sa- sitharan Balasubramaniam. Security in brain-computer interfaces: State-of-the-art, opportunities, and future chal- lenges.ACM Computing Surveys, 54(1), 2021

work page 2021

[7] [7]

Towards new hu- man rights in the age of neuroscience and neurotechnol- ogy.Life Sciences, Society and Policy, 13(1):5, 2017

Marcello Ienca and Roberto Andorno. Towards new hu- man rights in the age of neuroscience and neurotechnol- ogy.Life Sciences, Society and Policy, 13(1):5, 2017

work page 2017

[8] [8]

Concrete problems in AI safety, 2016

Dario Amodei, Chris Olah, Jacob Steinhardt, Paul Chris- tiano, John Schulman, and Dan Man´e. Concrete problems in AI safety, 2016

work page 2016