Chinese developers have discovered that neural interfaces that display characters on the basis of evoked potentials of the brain, you can cheat by using implementation in a test sample of small oscillations of a signal, imperceptible to man. In this case, oscillations serve as a controversial example and confuse the algorithm, because of what he ultimately displays not the character you want by reading embedded signals. The details are available in the Preprint, published in arXiv.org.
Most brain-computer interfaces, which allow you to display characters based on activity of a brain who looks at this, consider two types of evoked potentials. The first positive component, P300, which appears on the EEG after 300 milliseconds after the stimulus imposed. Traditionally, such systems used a matrix of symbols, where each column and row in the order highlighted. The most intense P300 appears in the EEG when the desired character is highlighted the column and row, and the intersection allows you to specify the symbol and bring it to the screen.
The second SSVEP, visual evoked potential steady state, which is reflected in EEG oscillations of the same frequency with which the stimulus is presented. Based on this potential of the interface need the image of characters, each of which flashes at a certain frequency when a person looks at the character on the EEG signal appears at the appropriate frequency and character, again can be displayed on the screen.
Simply register brain activity while demonstrating some incentive to use it, however, it is impossible, therefore, any brain-computer interface is primarily based on training on large amounts of data. Like any other such algorithm, the neural interface may be subjected to attacks from the outside, including using controversial examples of data which do not differ from valid to humans, but can be misinterpreted by the computer.
To check the vulnerability of P300 and SSVEP decided researchers led by Xiao Zhang (Zhang Xiao) from Huajumbaro University of science and technology. They found that in order to deceive each system, you need to make adjustments signal with Gaussian noise in some data from a test sample. The resulting adjustments imperceptible to the human eye, but are recorded by the computer processing, it is considered a good controversial example.
Consider such an attack on the example of the P300. For example, the required positive component appears when the backlight of the third row — it is highlighted in 350 milliseconds after the presentation of the screen. The noise may be superimposed on the signal that appears on the EEG two times before — at 175 second, when the first row is highlighted. The system, therefore, will think that this is the right line, which means that the symbol is on it.
In the case of SSVEP, the researchers were able to get the system to classify the signal with a frequency of 8.6 Hertz as the signal frequency is 13.2 Hertz, which corresponds to different letters.
Yet such attacks has two limitations. First, it must be configured to a specific user interface that makes it universal. Secondly, it is necessary to know the time of presentation of the stimulus to understand when to use a controversial example. If these limitations to get around, according to scientists, neural interfaces will be more vulnerable to attacks that could lead to serious problems for the safety of those who use them.
Unfortunately, the vulnerability of the signal to random fluctuations, the primary problem of the modern brain-computer interface: most of them, for example, is still quite low performance and accuracy. About why the ideal of such a system will not be soon, you can read in our article “my computer”.