| name | brain-prompt-injection-bci-llm-security |
| description | Brain-Prompt Injection security audit framework for BCI-LLM agents with route-safety audit contract, C3 decomposition, and split-conformal calibration |
| version | 1.0.0 |
| author | Hermes Agent (Cron Job) |
| date | 2026-06-10T00:00:00.000Z |
| paper_id | arXiv:2606.09315v1 |
| paper_title | Brain-Prompt Injection - A Route-Safety Audit for BCI-LLM Agents |
| paper_authors | Jianwei Tai |
| tags | ["neuroscience","bci-security","llm-agents","brain-computer-interface","security-audit","route-safety","eeg","adversarial-attacks"] |
Brain-Prompt Injection: BCI-LLM Security Audit Framework
Overview
Brain-Prompt Injection exposes a novel attack surface in BCI-to-agent pipelines where decoded neural activity becomes an authorization channel for tool-use agents. This framework defines a Route-Safety Audit Contract with mathematical guarantees for detecting three attack types: signal-side perturbations, context-only injections, and adaptive dual-decoder attacks.
Core Innovation
Route-Safety Audit Contract: A minimal log schema, denominator hierarchy, and endpoint specification that enables detection of attacks that bypass EEG-side or text-side monitors.
Attack Surface Analysis
Three Attack Types
Attack Taxonomy:
├── Signal-Side Perturbations
│ └── Modify neural signals before decoding
├── Context-Only Injections
│ └── Inject malicious context without signal changes
└── Adaptive Dual-Decoder Attacks
└── Exploit decoder differences to route malicious actions
Blind Monitor Problem
Key Finding: Clean agreement and marginal robustness do not identify the joint term that controls C3 routing. Traditional monitors (EEG-side, text-side) remain blind to these attacks.
Route-Safety Audit Contract
Contract Components
1. Minimal Log Schema:
- Signal Provenance (signal-side audit)
- Context Provenance (text-side audit)
- Route Decision (endpoint specification)
- Confirmation Channel (split-conformal calibration)
2. Denominator Hierarchy:
- Seed: Initial signal/context denominator
- Case: Per-event denominator tracking
- Endpoint: Final route decision denominator
3. Endpoint Specification:
- C2 routes: Provenance-blocked (FAR: 0.000)
- C3 routes: Agreement-plus-provenance required (FAR: 1.000)
- Confirmation-plus-provenance: C3 flips blocked (FAR: 0.000)
Audit-Schema Separation Theorem
Mathematical Guarantee: Clean agreement + marginal robustness ≠ C3 routing control. C3 attacked-dependence decomposition shows joint term separation.
Split-Conformal Calibration
False-Accept Frontier Results
EEGMMI Native Left/Right Command-Control (5,400 events):
- Alpha 0.005: FAR 0.000, Clean utility 0.150 (acquisition isolation)
- Alpha 0.10: FAR 0.119, Clean utility 0.452 (acquisition isolation)
- Attacker-controlled confirmation: FAR ≈ 1.0 (bound broken)
