By- Polina Tapal
Every major technology wave, the internet, mobile, cloud, was built first and secured later. Neural interfaces are next. The window to change that pattern is now. Before deployment, not after.
Authentication is moving in one direction: away from what you know, toward what you are. The password was never a good security primitive. It was simply the first one we had, and it fails in well-understood, large-scale ways: phishing, reuse, large-scale leakage. Verizon’s 2024 Data Breach Investigations Report found compromised credentials as the initial access vector in 31% to 38% of all breaches. A recent industry response has been the passkey: a device-bound credential that removes the need to transmit secrets.
But a passkey still requires a device. Lose it, and the system breaks.
Image generated using Gemini
Biometrics removed the memory problem. Your fingerprint, your face: permanent, unforgettable, difficult to lend. They introduced a different problem: biometric data, once compromised, cannot be reset. You cannot issue yourself a new fingerprint.
Behavioural biometrics went further: verifying not a static feature but continuous patterns. How you type, the rhythm of your keystrokes, how you move.
Brainwave authentication takes this to its logical conclusion. Your electroencephalogram (EEG), the electrical pattern your brain produces moment to moment, is unique, changes continuously, cannot be trivially replicated from a database. Researchers have demonstrated identification accuracy exceeding 99% in controlled conditions [Arias-Cabarcos et al., ACM Transactions on Privacy and Security, 2023].
What accuracy does not tell you
Accuracy is not a security guarantee.
A system that correctly identifies you 99% of the time tells you nothing about whether it fails safely under adversarial pressure.
EEG authentication is typically evaluated on clean, cooperative laboratory data.
A security system must be evaluated against an active adversary. Not an absent one.
When you systematically attack EEG authentication pipelines, injecting noise into specific frequency bands, perturbing signal timing, systems that looked resilient under laboratory conditions fail in structured and sometimes exploitable ways. The attack surface is not random — but structured. That means it can be mapped. And mapped before deployment rather than after.
There is a deeper problem. EEG authentication systems rely on representations that have never been analysed as cryptographic objects. For a biometric to function as a credential, it must uniquely identify a person under adversarial conditions. It is not yet known whether EEG representations meet this requirement under adversarial conditions.
These foundations have not yet been formally established.
The limitations the field acknowledges, and the ones it does not
EEG signals are sensitive to fatigue, medication, emotional state, time of day. These are known problems. Researchers are working on them. What is less openly discussed is the adversarial dimension. Whether a motivated attacker can break the system. Whether the system has any formal guarantee of resistance. The field has optimised extensively for accuracy. It has not yet asked, with the rigour the question deserves, whether accuracy under cooperative conditions implies security under adversarial ones. It does not.
Secure by design. Or not at all.
The internet was not designed to be secure — but to be connected. Security came later: SSL bolted onto HTTP, firewalls inserted between networks built to trust each other. We have spent thirty years patching what should have been designed correctly from the start.
Neural interfaces are following this pattern at a moment when the stakes are qualitatively higher. A compromised password can be reset. A compromised fingerprint database is a permanent problem, but it is a problem on the outside of your body. Neural signals carry information that may be more sensitive than other biometrics, because neural patterns correlate with cognitive and physiological states in ways we are only beginning to understand.
The World Economic Forum identified adversarial attacks on BCI machine learning components as key threat categories for neural interface systems. Research has demonstrated neuronal cyberattacks, Neuronal Flooding and Neuronal Jamming, that disrupt spontaneous neural signalling in implants.
These are not science fiction scenarios. They are documented threat classes, already formalised in the research literature, against systems being commercially deployed now.
Who defines “secure”
The question is not whether to use brainwave authentication or neural interfaces. The technology has genuine benefits: for people with motor impairments, for high-security environments, for the long-term future of human-computer interaction. The question is who gets to define what secure means before these systems are embedded in critical infrastructure, medical devices, and identity verification systems that will be difficult to replace.
Governance frameworks catch up to technology after the damage is done. GDPR arrived years after the data practices it was designed to regulate had already become standard. By the time a regulatory framework exists for neural interfaces, the architecture will already be fixed. The researchers and engineers building these systems now are making the security decisions that governance will later have to work around.
The formalisation is the work
The organisations building neural authentication systems today are not malicious. They are moving fast in a space where the security questions have not been formalised yet. That is precisely the problem.
Formalisation means specifying the threat model, what the attacker can observe, what they can manipulate, what constitutes a successful attack. It means deriving information-theoretic bounds on what the neural representation actually carries. It means red-teaming the pipeline before deployment, systematically exploring the attack surface, finding the structured failure modes that exist in every system and are always easier to fix before the system is in production. We have seen this pattern before. Whether we recognise it in time is still a choice.