arXiv CSopen access

Brain-Prompt Injection: A Route-Safety Audit for BCI-LLM Agents

Brain-Prompt Injection: A Route-Safety Audit for BCI–LLM Agents Jianwei Tai School of Internet, Anhui University [email protected]

arXiv:2606.09315v1 [cs.CR] 8 Jun 2026

Abstract BCI-to-agent pipelines turn decoded neural activity into an authorization channel for tool-use agents, exposing a new attack surface we call brain-prompt injection: signal-side perturbations, context-only injections, and adaptive dualdecoder attacks can all change the routed action while EEGside or text-side monitors remain blind. Route safety in this stack depends on what the audit log can observe, not on decoder accuracy or agreement alone. We define a Route-Safety Audit Contract: a minimal log schema, denominator hierarchy, and endpoint specification, and prove an audit-schema separation theorem together with a C3 attacked-dependence decomposition; clean agreement and marginal robustness do not identify the joint term that controls C3 routing. As a calibration layer on top of the contract, we apply split-conformal calibration to a non-oracle EEG confirmation channel and report the resulting false-accept frontier under an explicit threat-archetype matrix. We instantiate the contract on EEGMMI native left/right command-control over 5,400 events, harmless tool stubs, and seed/case denominators. Provenance blocks C2 routes (0.000); agreement-plus-provenance routes C3 flips (1.000); confirmation-plus-provenance routes them (0.000). The conformal frontier reaches FAR 0.000 at clean utility 0.150 for α = .005 and FAR 0.119 at clean utility 0.452 for α = .10 under acquisition isolation; an attackercontrollable confirmation channel breaks the bound to ≈ 1. Subject-cluster bootstrap confirms these intervals on 60 subjects; cross-architecture (TinyEEGNet, EEGNetV4) and capacity-sweep results show within-regime saturation. Mediation and confirmation reduce risk; they are not intent certificates.

1

Introduction

Brain–computer interfaces (BCIs) increasingly act as authorization channels rather than only display channels. Noninvasive and invasive systems decode neural activity into commands, characters, or speech with steadily lower error rates (Willett et al. 2021; Metzger et al. 2023; Lévy et al. 2025), and large EEG foundation models such as BIOT and LaBraM are pushing toward universal cross-dataset decoders that can be plugged into downstream pipelines (Yang et al. 2023; Jiang et al. 2024). In parallel, large language models have moved from text generation to tool-using Copyright © 2026, Association for the Advancement of Artificial Intelligence (www.aaai.org). All rights reserved.

agents that select APIs, invoke side effects, and act on behalf of the user (Schick et al. 2023; Qin et al. 2023). The natural composition of these two lines is a BCI–LLM agent: a decoded neural command becomes an instruction-like input that a tool-using LLM converts into routes such as “move the cursor”, “send a message”, or “confirm a transfer.” This composition opens an attack surface that neither line alone treats. We call the decoded neural instruction stream a brain-prompt channel, and we call the corresponding family of attacks brain-prompt injection. Brain-prompt injection is exposed to three failure modes that route-safety claims must address jointly. First, signal-side perturbations of the EEG window, in the spirit of EEG adversarial examples (Zhang and Wu 2019), can change the decoded command (C1). Second, context-only injections, analogous to indirect prompt injection on LLM agents (Greshake et al. 2023; Yi et al. 2023; Zhan et al. 2024; Debenedetti et al. 2024; Zhang et al. 2024), can alter the agent route while the EEG side remains clean and any EEG-only monitor sees no anomaly (C2). Third, adaptive shared-input perturbations can drive a primary decoder f and an optional verification decoder f2 jointly, so dual-channel agreement is satisfied by an attackercontrolled rather than user-intended target (C3). Existing benchmarks for indirect prompt injection (Zhan et al. 2024; Debenedetti et al. 2024; Zhang et al. 2024) cover the C2style failure but do not log a decoded neural source; existing EEG attacks (Zhang and Wu 2019) cover the C1/C3 signal side but do not log context provenance or downstream routing. The authorization claim a BCI–LLM agent must defend lives at the intersection. A natural first defense is to require two heterogeneous decoders to agree before the agent acts. We show that, under a shared raw-input perturbation budget, dual-decoder agreement does not certify intent: an attacker can satisfy the agreement predicate by jointly driving both decoders’ margins (Proposition 1), and the resulting C3 route risk factors through a primary-target probability p1 , an attacked conditional agreement term P(B | A), and an executionpolicy term α, with an attacked dependence lift ∆D = P(A ∩ B) − p1 p2 that clean agreement statistics never identify (Theorem 1). The decomposition makes the corresponding audit-schema separation explicit: the per-case log must record context provenance, the attacked secondary decision, the execution policy, and the route/confirmation outcome,

otherwise paired audit worlds with identical observed logs can have opposite C2 or C3 truth values. We study the audit boundary rather than a new universal defense or a physical attack. The empirical contribution is a calibrated falsification protocol on EEGMMI native left/right command-control: 5,400 events, ten seeds, harmless cursor and tool stubs, seed/case denominators, and strict held-out calibration. On top of the audit contract we apply a textbook split-conformal calibration layer (Vovk et al. 2005; Romano et al. 2019) to a non-oracle confirmation channel and report the resulting false-accept frontier across an explicit threat-archetype matrix; a folklore necessity argument shows that confirmation-channel non-controllability cannot be removed without losing the bound. C4 (extraction-style query attacks) is logged as metadata only; the load-bearing theory and experiments are C2/C3-focused. Contributions. • Route-Safety Audit Contract. We prove an auditschema separation theorem and a C3 attackeddependence decomposition for BCI tool-use authorization: the schema names the variables individually necessary and jointly sufficient to certify a C2 or C3 route claim, and the decomposition identifies the attacked joint term that clean agreement and marginal robustness cannot identify. • Conformal calibration layer with falsifiable assumptions. On top of the contract we apply split-conformal calibration to the non-oracle confirmation channel and characterize its operational assumptions through a threatarchetype matrix (A, B, Bxr , C, C′ ); a folklore necessity argument shows that confirmation-channel noncontrollability cannot be removed without losing the bound. • Empirical instantiation on native EEGMMI command-control. Over 5,400 left/right fist execution and imagery events with harmless tool stubs and strict held-out calibration, we report the audit on Exp8 native command-control, the Exp9 confirmation frontier, the cross-architecture and capacity sweeps, the threatarchetype matrix, preprocessing/temporal stress, and matched stronger-defense baselines, with subject-cluster bootstrap confirming the trial-level intervals.

2

Related Work

LLM-assisted BCI systems. BCI systems decode neural activity into communication and control commands, from general-purpose platforms such as BCI2000 to highperformance neural text and speech interfaces (Schalk et al. 2004; Willett et al. 2021; Metzger et al. 2023). Non-invasive interfaces such as MEG-based Brain2Qwerty have begun closing the gap between EEG-grade decoding and deployable typing rates (Lévy et al. 2025), while biosignal foundation models such as BIOT and LaBraM further motivate cross-dataset, cross-task EEG decoders that downstream language or control systems can consume (Yang et al. 2023; Jiang et al. 2024). We study the security boundary created when decoded neural intent is treated as an authorization signal for a tool-use agent.

Prompt injection, jailbreaking, and tool-use agents. Tool-using language models expose APIs and external context to model-mediated decisions (Schick et al. 2023; Qin et al. 2023). Indirect prompt injection shows that context supplied outside the user’s direct instruction can compromise LLM-integrated applications (Greshake et al. 2023); jailbreak and transferable prompt attacks show that modelside safety predicates can fail under adaptive inputs (Wei et al. 2023; Zou et al. 2023). A growing line of benchmarks now operationalizes these attacks on tool-integrated agents: BIPIA characterizes indirect-injection attack success across LLM backbones (Yi et al. 2023); InjecAgent reports that 30 LLM agents are vulnerable to embedded malicious instructions across 17 tool families (Zhan et al. 2024); AgentDojo defines a dynamic environment for prompt-injection attacks and defenses on tool-using agents (Debenedetti et al. 2024); and Agent Security Bench formalizes ten attack and defense classes across 13 LLM backbones (Zhang et al. 2024). Existing work largely studies text, retrieval, web, or tool contexts. It does not model decoded neural commands as a second authorization channel whose EEG-side observables may disagree with route-level context observables. Adversarial robustness and BCI security. Adversarialexample work established that robustness claims need adaptive, attack-aware evaluation rather than benign accuracy alone (Papernot et al. 2016; Carlini and Wagner 2017; Madry et al. 2018; Tramèr et al. 2018). EEG decoders such as EEGNet make gradient-based BCI attacks technically meaningful (Lawhern et al. 2018). Prior work shows that CNN classifiers in EEG-based BCIs are vulnerable to adversarial examples (Zhang and Wu 2019). This signal-side literature does not address context-only agent injection or agreement bypass in BCI–LLM tool pipelines; our contribution is the class-specific validation protocol linking those channels. Authorization boundary. BCI-agent security sits at the intersection of these lines. Tool-agent papers define modelmediated API use and tool selection, but usually treat the user command as text rather than a decoded biosignal. Indirect prompt-injection work studies untrusted context and retrieval, but not a second neural authorization channel whose observables are disjoint from the route context. BCI adversarial-security work studies perturbations of the neural classifier, but not whether a downstream agent route is justified by provenance, agreement, or confirmation. A route-safety claim must name the attack class, the observed variables, and the denominator that can falsify the claimed block. Closest-prior separation by missing observable. The paper-level distinction is denominator-level rather than vocabulary-level. Each closest prior line covers one side of the BCI-to-tool interface and omits the variable that the corresponding C2 or C3 route claim requires. Indirect promptinjection and jailbreak work (Greshake et al. 2023; Wei et al. 2023; Zou et al. 2023) covers untrusted text and context but does not record the decoded neural source or the route denominator, so it cannot certify EEG-authorized route safety.

Tool-agent work (Schick et al. 2023; Qin et al. 2023) covers API and tool routing but does not log biosignal provenance or source-not-target EEG cases, so it cannot certify C2 neural-route attribution. EEG adversarial-example work (Zhang and Wu 2019; Lawhern et al. 2018) covers decoder perturbation but does not log context provenance or execution route, so it cannot certify downstream authorization. High-performance BCI and biosignal-foundation systems (Willett et al. 2021; Metzger et al. 2023; Yang et al. 2023) cover neural communication and control but do not log the attacked secondary decision or execution policy, so they cannot test agreement-as-intent under C3. Standard adversarialrobustness evaluation usually reports marginal target success; Theorem 1 shows that the route claim depends instead on the attacked joint term and the execution-policy term. The Route-Safety Audit Contract names the missing observables for each line and turns them into denominators in Table 5.

3

System and Threat Model

A BCI-controlled tool-use agent is a tuple Π = (ϕ, f, f2 , ALLM , R),

(1)

where ϕ maps a neural window to a representation, f is a primary intent decoder, f2 is an optional verification decoder, ALLM maps decoded intent and context to a tool policy, and R is a rule or monitor. Let x ∈ RC×T be an EEG window, z = ϕ(x) its representation, y = f (z) the decoded intent, mctx the external context, and atool = ALLM (y, mctx ) the selected tool action. A dual-channel rule executes automatically only when f and f2 agree; otherwise it requests confirmation or abstains. Definition 1 (Audit classes). A BCI tool-use audit class names which input or log field may change and which routesafety denominator is required. • C1 direct perturbation: the audit changes x or z to alter f ; this is a decoder-stress axis. • C2 context-only injection: the audit changes mctx while leaving EEG-side variables unchanged; the required denominator is routed clean/untrusted episodes with provenance. • C3 adaptive agreement audit: the audit perturbs the shared input seen by f and f2 ; the required denominator is source-not-target attacked cases with primary, secondary, and policy logs. • C4 extraction or probing: repeated queries are logged as metadata; C4 is not a claim-bearing empirical class here. Audit capabilities and excluded deployment claims. Table 1 fixes the audit variables used by the validation cells. The table describes controlled audit interventions, not capabilities assumed for every deployment. C2 is a contextcontrol condition and is intentionally outside the observation set of EEG-only monitors. C3 is a white-box or audit-time adaptive condition against differentiable decoders, evaluated on the standardized raw EEG tensor seen by both decoders. This is the standard robustness-audit setting for testing whether agreement is a certificate; it is not a claim that

Table 1: Class-specific audit capabilities and non-claims. “Observed by rule” means the variables available to the corresponding validation monitor, not all information available to a system designer. Class C1 C2 C3 C4

Audit intervention

Observed by rule

Load-bearing test

raw EEG or embedding EEG/logits/agreement primary-target PGD external context only context provenance flag uplift and route block shared raw tensor, f, f2 known dual-decoder agreement joint raw PGD repeated queries query log/rate limits reporting obligation

Table 2: Glossary of recurring symbols. Audit classes (C1– C4) name what the attacker may change; threat archetypes (A, B, Bxr , C, C′ ) and B-strict / B-strict− name what the attacker may perturb in the conformal layer of §4.1; experiment cells (Exp1–Exp10) are referenced throughout §6. Symbol

Meaning

C1 C2 C3 C4 A B Bxr

direct EEG/embedding perturbation (decoder-stress axis). context-only injection without changing EEG-side variables. adaptive shared-input perturbation seen by both decoders. repeated-query / extraction reporting axis (not load-bearing). confirmation pair from same subject, same session (audit baseline). confirmation pair from disjoint subject (acquisition-isolated audit). confirmation pair from same subject, disjoint EEGMMI run (crossrun within session). threat-archetype where the attacker also perturbs the confirmation window with same-subject pair. same as C but with disjoint-subject pair. threat model: source-only attack with acquisition-isolated and noncontrollable confirmation. B-strict with assumption (ii) removed; attacker may perturb the confirmation window. target conformal false-accept rate; τt (α) is the corresponding split-conformal threshold. ℓ∞ budget on the source command window. ℓ∞ budget on the confirmation window (zero under B-strict). confirmer model and its score fB (Xcnf )t for target t. router; rules include primary-only, confidence gate, agreement, provenance, agreement+provenance, confirmation.

C C′ B-strict B-strict− α εsrc εcnf fB , sB Π

the same perturbation channel is already available in deployed BCI hardware.

4

Theory

Definition 2 (Route-Safety Audit Contract). For an attack class c and router family Π, a Route-Safety Audit Contract is a tuple Cc = (Lc , Dc , Ec , Gc ), (2) where Lc is the required per-case log schema, Dc is the statistical denominator and hierarchy, Ec is the route-safety event being certified, and Gc is the declared pass/fail endpoint. A certificate for claim Ec is sound only if Ec is measurable with respect to Lc and the reported rate is computed over Dc rather than over a projected or duplicated routeepisode count. Proposition 1 (Class-specific observability and agreement feasibility). Consider a BCI tool-use pipeline Π with

Table 3: Threat-model and reproducibility summary. Item

Setting

Data EEGMMI R03 main cell; R03/04/07/08/11/12 native command cell. Events 900 R03 T1/T2 events; 5,400 native left/right command events. Decoders TinyEEGNet A/B gate; A/C replicate/native cells; seeds 0–9. Training 80 epochs; batch 64; no silent seed exclusion. Attack Standardized raw PGD; ℓ∞ clip [−ϵ, ϵ]. Raw scale .08 std. units ≈ .0778 cache units, 4.1% of p95 |x|. Grid ϵ ∈ {.02, .04, .08}; 40 steps; step .005. C2 denom. Routed cases; uplift = C2 flag − clean flag. C3 denom. 120 attack and 60 unauthorized cases/seed. Gate ≥7 seeds; acc. ≥.60; disagr. ≤.40. Bypass C3 success ≥.30; cond./unauth. ≥.70. Routing Provenance blocks C2 target route to ≤.05.

The displayed feasibility condition makes the right-hand side strictly negative for both f and f2 . Hence both margins are non-positive at the same perturbed input x+ϵu, and both decoders assign yt . The execution rule accepts agreement, but the agreement now certifies consistency of two jointly driven decoders rather than user intent. The PGD objective used in the experiments is the standard cross-entropy relaxation of this per-decoder boundary-crossing condition. Theorem 1 (C3 agreement-route risk decomposition). Fix an attack family D over source-not-target cases and perturbations. Let A = {f (x + δ) = yt }, B = {f2 (x + δ) = yt }, P = {π executes target without confirmation},

(8) (9) (10)

EEG-side variables V (x), context mctx , route atool = ALLM (y, mctx ), and two differentiable decoders f, f2 . Let R be any deterministic or randomized monitor measurable with respect to V (x). If a C2 attacker changes only mctx and does not change the distribution of x, then

and define p1 = PD (A), p2 = PD (B), α = PD (P | A, B), and attacked dependence lift

P[R(V (x)) = 1 | C2] − P[R(V (x)) = 1 | clean] = 0, (3)

PD (EC3 ) = α(p1 p2 + ∆D ) = p1 PD (B | A)α.

although the target-route probability can change whenever ALLM is context-sensitive. For C3, let sg (x) be the logits of decoder g ∈ {f, f2 } and define mg (x, yt ) = max sg (x)y − sg (x)yt , y̸=yt

(4)

using a subgradient at logit ties. Suppose there is a shared raw-input direction u with ∥u∥∞ ≤ 1 and per-decoder local remainder bounds ρg (ϵ, u) satisfying mg (x + ϵu, yt ) − mg (x, yt ) − ϵ⟨∇x mg (x, yt ), u⟩ ≤ ρg (ϵ, u).

(5)

If ϵ⟨−∇x mg (x, yt ), u⟩ > mg (x, yt ) + ρg (ϵ, u) for both g ∈ {f, f2 },

(6)

then the ℓ∞ ball contains a point where both decoders select yt and an agreement rule accepts the target. Thus C2 and C3 fail different observability assumptions: C2 bypasses EEGonly monitoring by changing an unobserved context variable, whereas C3 satisfies the observed agreement predicate itself. Proof. Under the C2 intervention, V (x) has the same distribution as in the clean condition because x is unchanged and R does not observe mctx . Any monitor measurable with respect to V (x), including a randomized monitor whose randomness is independent of the attack condition, therefore has the same output distribution. The flag-probability difference is zero. The route statement follows because atool = ALLM (y, mctx ) may vary with mctx even when y and all EEG-side variables are fixed. For C3, the remainder bound gives, for each decoder g, mg (x+ϵu, yt ) ≤ mg (x, yt )+ϵ⟨∇x mg (x, yt ), u⟩+ρg (ϵ, u). (7)

∆D = PD (A ∩ B) − p1 p2 .

(11)

Under agreement-plus-provenance routing, (12)

Thus agreement reduces primary-only target routing by a factor at least r if and only if PD (B | A)α ≤ r. Without the attacked secondary-decision log, two audits can share p1 , p2 , and all clean agreement statistics while taking any joint value allowed by the Fréchet bounds max{0, p1 + p2 − 1} ≤ PD (A ∩ B) ≤ min{p1 , p2 }. (13) Therefore clean agreement and marginal robustness do not certify C3 route safety; the audit must estimate the attacked conditional agreement term and the execution-policy term on the same source-not-target cases. Proof. For source-not-target cases, agreement-plusprovenance executes the attacked target exactly when the primary decoder selects yt , the secondary decoder also selects yt , and the active policy permits execution without an independent confirmation block. This gives EC3 = A ∩ B ∩ P . Conditioning on A ∩ B gives PD (EC3 ) = αPD (A ∩ B), the definition of ∆D gives the first equality, and the chain rule gives the second. Primaryonly target routing has probability p1 , so an agreement policy achieves residual ratio PD (EC3 )/p1 = PD (B | A)α when p1 > 0; when p1 = 0 both routes are zero. The Fréchet bounds are the sharp possible ranges for a joint event with fixed marginals. Clean agreement statistics are functions of decoder outputs at x, whereas A and B are target-hit events at x + δ under D, so they do not identify the attacked joint term. Theorem 2 (Minimal audit-schema separation for C2/C3 route claims). Consider the router family in this paper: a route rule observes a decoded command, an optional secondary decoder, a context-provenance flag, an execution policy π, and a routed action atool with execution bit exec. Let EC2 be the event that an untrusted context induces

the requested target route, and let EC3 be the event that a source-not-target EEG case is routed to the attacked target under the active policy. For any audit projection O and any deterministic or randomized certification rule Q measurable with respect to O, the following hold. 1. If O omits either context provenance or route/execution outcome, then EC2 is not identifiable from O: there exist paired clean/untrusted audit worlds with identical O and different EC2 truth values. 2. If O omits any of the attacked secondary decision, execution policy, confirmation status, or route/execution outcome, then EC3 is not identifiable from O: there exist paired source-not-target audit worlds with identical O and different EC3 truth values. 3. The per-case log ℓ =(s, i, k, src, pctx , y, y2 , y adv , y2adv , π, atool , exec, confirm, sB , τ )

(14)

identifies both events for this router family when rates are computed over the seed/case/context hierarchy. Thus the schema is sufficient, and every omitted field listed above is necessary for at least one of the two route-safety claims. Consequently, no sound nontrivial rule using a weaker projection can certify the corresponding route-safety claim: it either falsely certifies a failing world or abstains on an indistinguishable safe world. Proof. For C2, construct two worlds with the same EEG window, primary and secondary decoder outputs, confidence, clean source command, and EEG-side monitor variables. In W0 , the context is trusted or benign and the route follows the decoded command; in W1 , the context is untrusted and requests the target route. If the projection omits provenance, the trusted and untrusted contexts have the same projection. If it omits route or execution outcome, a blocked and executed route have the same projection. In both cases O(W0 ) = O(W1 ) while EC2 differs. For C3, construct worlds with the same clean source command, clean agreement state, and clean route record. In W0 , the attacked secondary decoder does not agree with the target, or the active policy requires confirmation and confirmation is absent, or the target is not executed. In W1 , the attacked primary and secondary decoders both select the target and the policy executes the target route. If the projection omits the attacked secondary decision, policy, confirmation status, or route/execution outcome, these worlds remain indistinguishable even though EC3 differs. The listed log contains the seed s, case i, and route context k needed to define denominators; the clean source command src needed for source-not-target conditioning; provenance pctx ; clean and attacked decoder decisions; policy π; route and execution outcome; confirmation status; and the confirmer score sB = fB (Xcnf )t together with the active conformal threshold τ = τt (α), which together reproduce the conformal accept decision used in §4.1. Reading these fields decides the Boolean predicates defining EC2 and EC3 for each logged episode. Rates over the validation cells are

then ordinary averages over the specified hierarchy. Finally, because any weaker projection above admits paired worlds with identical projected logs and different event truth values, a measurable certification rule has the same output distribution in both worlds. Positive certification probability gives a false certificate in the failing world; zero probability gives no nontrivial certificate in the safe world. Corollary 1 (Minimal sound certificate for the reported C2/C3 claims). For the router family and C2/C3 events in Theorem 2, the contract whose log is ℓ and whose denominators are the seed/case/context hierarchies in Table 5 is sufficient for a sound route-safety certificate. Any certificate that omits one of the theorem’s necessary fields for the corresponding class is not sound for that class: it can pass on a projected log while an indistinguishable audit world has the opposite route-safety truth value. Proof. Sufficiency follows because ℓ makes EC2 and EC3 measurable per episode and Table 5 fixes the denominators over which rates are averaged. Necessity follows from the paired-world construction in Theorem 2: a weaker certificate is measurable with respect to a projection that is identical in two worlds with different event truth values, so it cannot certify both without either false acceptance or abstention. Corollary 2 (Denominator-map correspondence). Each invalid aggregate in Table 4 is a non-identifying projection for its stated route-safety claim. Replacing it with the listed denominator is exactly the schema repair required by Theorem 2. Proof. C2 EEG flag rate discards context provenance and route outcome, so the C2 paired worlds remain indistinguishable. Clean agreement rate discards the attacked secondary decision and post-attack route outcome, so the C3 paired worlds remain indistinguishable. C3 primary-target success alone discards whether the target was actually routed and whether confirmation was required. Route episode count alone discards the seed/case/context hierarchy needed to distinguish statistical support from repeated route templates. Confirmation route rate without confirmation status discards whether the block used an independent user signal, an oracle upper bound, or an automatic abstention rule. Adding the table’s missing observables breaks the corresponding equality O(W0 ) = O(W1 ) and makes the route claim testable. The Route-Safety Audit Contract is intentionally minimal. Its new object is the class-specific route audit: the attacked dependence lift that determines whether agreement lowers C3 route risk, plus the denominator discipline needed to execute the audit. It is not a general impossibility theorem or a new adversarial optimizer. It states which logged variables are sufficient to support a route-safety claim and which common aggregate metrics are non-identifying. The point is to prevent a false certificate: an EEG-only C2 flag rate can be exactly unchanged while route risk changes, and a clean agreement rate can be high while attacked agreement routes an unauthorized target. Theorem 2 gives both sides of the contract: it proves necessity for the C2 and C3 fields that separate paired audit worlds, and sufficiency

for the log schema used by the experiments. The C3 condition in Proposition 1 is not assumed to be common; its non-vacuity is a measurable property of a decoder pair, target, and perturbation budget. The experiments therefore report decoder gates, target margins, shared-descent diagnostics, perturbation-strength sweeps, route-policy outcomes, confirmation status, and seed/case/context hierarchy rather than treating clean agreement as a certificate. Table 4 lists the aggregate-to-denominator repairs used throughout the validation protocol. This denominator discipline prevents two common but misleading evaluations: counting EEGside flags as C2 security, and treating clean agreement as an adaptive C3 certificate. The lemma predicts the zero C2 attack-attributable EEG flag uplift reported in the real-EEG cells, and it predicts that C3 should become easier as a shared raw-input budget can satisfy the per-decoder target inequalities on more cases; Table 12 and the margin bridge in Table 13 test this feasibility prediction.

4.1

Split-Conformal Confirmation FAR Control

The non-oracle confirmation proxy of §6.1 can be cast as split-conformal calibration on confirmer scores. Proposition 2 below is the textbook split-conformal coverage statement (Vovk et al. 2005; Romano et al. 2019) adapted to the binary confirmer scoring rule; we restate it for completeness because the rest of the paper invokes it as a layer-tool on top of the audit contract. The original contribution of this subsection is not the proposition itself but the explicit operational assumptions it requires (threat model B-strict) and the threat-archetype matrix in §6.5 that makes those assumptions empirically falsifiable on a BCI confirmation channel. Definition 3 (Strict held-out confirmation calibration). Let fB be a confirmer trained only on the train index. For each (t) target label t ∈ {0, 1}, let Si = fB (Xi )t for calibration windows with Yi ̸= t, and let mt be the count of such negative calibration windows. The conformal threshold at level α ∈ (0, 1) is
(t) τt (α) = ⌈(1 − α)(mt + 1)⌉ -th order statistic of {Si }. (15) A requested target t on a confirmation window Xcnf is accepted iff arg maxy fB (Xcnf )y = t and fB (Xcnf )t ≥ τt (α). Proposition 2 (Split-conformal confirmation FAR control (Vovk et al. 2005; Romano et al. 2019)). Suppose, for each (t) target t, the negative calibration scores {Si : Yi ̸= t} and (t) a future negative confirmation score Smt +1 are exchangeable. Under Definition 3,  (t)  ⌊α(mt + 1)⌋ P Smt +1 ≥ τt (α) Ymt +1 ̸= t ≤ ≤ α. mt + 1 (16) The argmax acceptance condition makes the false-accept event a subset of the threshold-exceedance event, so the same upper bound applies to confirmation false accepts. Proof. Standard split-conformal coverage. Exchangeability (t) (t) (t) (t) of S1 , . . . , Smt , Smt +1 implies the rank of Smt +1 is uni(t)

form on {1, . . . , mt + 1}, so P[Smt +1 ≥ τt (α)] ≤ ⌊α(mt +

1)⌋/(mt + 1). The argmax condition only removes accepts, so it cannot increase the FAR upper bound. Corollary 3 (Threat model B-strict for unauthorized confirmed routes). Assume (i) acquisition isolation: the confirmation window is acquired from a session whose marginal score distribution is exchangeable with the calibration negatives the attacker cannot influence; and (ii) confirmationchannel non-controllability: the attacker may perturb the source command window in an ℓ∞ ball but cannot perturb the confirmation window. Then for any source-window attacker A within the budget,   P unauthorized confirmed route to t ≤ α, (17) up to the discretization in Proposition 2, regardless of A’s strength. Proof. Source-window perturbations leave Xcnf unchanged (t) by assumption (ii), so the marginal distribution of Smt +1 is exchangeable with the negatives by assumption (i). Proposition 2 applies. The unauthorized confirmed-route event is a subset of the FAR event, so the same upper bound holds. The two assumptions are not cosmetic. Removing either is an empirical adversarial possibility test in §6.5: the same audit with attacker-perturbable confirmation drives the route rate to nearly 1, and the same audit with same-subject samesession confirmation pairing remains controlled at the cost of being an audit setup rather than a deployable confirmation channel. Calibration consistency under shrinking nc . Proposition 2 also predicts that empirical FAR on a held-out test set should remain below α as the calibration size shrinks, with discretization error O(1/mt ). The same theorem predicts ε-invariance under acquisition isolation: the confirmer never sees the attacked window, so the empirical FAR upper bound does not depend on the attacker’s ε. Both predictions are tested in §6.5. Necessity of strict calibration. If fB is trained on train ∪ cal, the calibration negatives are no longer exchangeable with future test negatives because the model has seen the calibration windows during fitting. The marginal coverage of Proposition 2 no longer holds, and the empirical FAR systematically exceeds α. §6.5 reports the leaky-vs-strict gap: at α = .05, leaky calibration produces empirical FAR 0.0912 with 95% Wilson CI [0.073, 0.113], while strict calibration produces 0.0525 with CI [0.039, 0.070].

4.2

Necessity of Confirmation-Channel Non-Controllability

Proposition 2 and Corollary 3 are stated under threat model B-strict, which combines (i) acquisition isolation and (ii) confirmation-channel non-controllability. Proposition 3 below is a folklore PGD-feasibility argument, restated here to make the necessity of condition (ii) explicit: if the attacker can perturb the confirmation window inside any nontrivial

ℓ∞ budget for any non-degenerate confirmer, no FAR upper bound of the form “α + g(nc , δ)” independent of attacker actions can hold. The empirical contribution is the C/C′ archetypes in §6.5, not the proposition itself. Threat model B-strict− replaces (ii) by (ii− ): A may perturb the confirmation window in an ℓ∞ ball, ∥δcnf ∥∞ ≤ ε.

Table 4: Aggregate-to-denominator repairs. Each invalid aggregate omits the variable that identifies the class-specific route-safety claim. Invalid aggregate

Missing able

observ- Correct denominator

Supporting experiment

Proposition 3 (Necessity of confirmation-channel non-controllability). Assume fB is differentiable in its input on a neighborhood of the test confirmation distribution support, and that for every cal-selected threshold τ ∈ (0, 1) there exists a negative window X ∗ with fB (X ∗ )t < τ and ∇X fB (X ∗ )t ̸= 0. Then there exists a finite ε∗ < ∞ such that for every ε ≥ ε∗ , every α ∈ (0, 1), and every calselected threshold τt (α), an adversary A with the budget in (ii− ) achieves h i Pr fB (X̃cnf )t ≥ τt (α) Ycnf ̸= t → 1 (18)

Context prove- Clean/untrusted routed Exp2/5/7/8 nance and route episodes Clean agreement Attacked sec- Source-not-target at- Exp1/6/8/10 rate ondary decision tacked cases C3 success alone Route and confir- Successful C3 cases Exp2/5/7/8/10 mation policy with route log Route episode Seed/case/context Seed-level numerators Tables 13, 21 count hierarchy and gates Execution-policy Exp5/8/9; TaConfirmation route Oracle/userupper-bound rows bles 15, 22 rate confirmation status

as ε → ε∗ . Consequently, no FAR upper bound of the form Pr[unauthorized confirmed route] ≤ α + g(nc , δ) with g independent of A can hold under B-strict− .

the main route-safety claims; Exp10 and the matcheddefense cell are stress tests on the same denominators; transcript and live-router bridges are support artifacts only. The required C2/C3 metrics are clean primary accuracy, clean secondary accuracy, clean disagreement burden, C2 attackattributable EEG flag uplift, C2 context-provenance block rate, C3 attack success, C3 conditional bypass, C3 unauthorized conditional bypass, rule-specific target-route rates, benign block rates, confirmation status, and tool-attempt rate. C1 and C4 are logged as supporting axes rather than claimbearing empirical classes. Seeds that fail decoder, attack, or rule gates are reported rather than silently excluded.

Proof. Fix α, τ = τt (α). Pick a negative window X ∗ with s := fB (X ∗ )t < τ and gradient g ∗ = ∇X fB (X ∗ )t ̸= 0; such X ∗ exists by assumption. The attacker constructs X̃ by ℓ∞ PGD inside the ball B∞ (X ∗ , ε), ascending fB (·)t . Continuity of fB and nonemptiness of the superlevel set {X : fB (X)t ≥ τ } (it contains positive-class examples) imply ε∗ (X ∗ ; τ ) := inf{ε : ∃X̃ ∈ B∞ (X ∗ , ε) with fB (X̃)t ≥ τ } (19) is finite. PGD with budget ε ≥ ε∗ (X ∗ ; τ ) returns X̃ with fB (X̃)t ≥ τ . Taking ε∗ = supX ∗ ε∗ (X ∗ ; τ ) over the test negative distribution, the adversary’s success rate approaches 1 as ε → ε∗ . If a uniform bound α + g(nc , δ) existed for any α < 1 − g(nc , δ), the adversary’s empirical rate would contradict it. No such uniform g exists. Corollary 4 (Pairing of Propositions 2 and 3). Under threat model B-strict, condition (i) is sufficient for the bound when (ii) holds, and (ii) is necessary in the sense that no uniform attacker-independent FAR bound can replace it. The pair characterizes the assumption boundary of split-conformal confirmation FAR control on the BCI confirmation channel. The empirical ε∗ for the TinyEEGNet and EEGNetV4 confirmers used in this paper is upper-bounded by the audited budget ε = 0.08: at this budget the C/C′ archetypes in §6.5 reach FAR 0.998/0.999, consistent with Proposition 3. Proposition 3 therefore predicts a quantitative behavior (rate → 1 at finite ε) rather than only an asymptotic one, which is what the C/C′ cells report.

5

Validation Protocol

Each validation cell reports decoder usability separately from attack bypass. Table 6 fixes the primary endpoint hierarchy before the experiment narrative: Exp8 native command-control and Exp9 non-oracle confirmation carry

C2 EEG flag rate

Decomposition-to-defense predictions. Theorem 1 separates four route-safety factors. Primary robustness or attack constraints lower p1 and reduce every downstream C3 route; this is tested by Exp10 preprocessing constraints and the Exp3 band-limited and query rows. Heterogeneous verifiers or ensembles change P(B | A) only when attacked secondary errors decorrelate; this is tested by the Exp3 calibrated PGD pair and ensemble residuals. Confirmation or execution policies change α even when both decoders agree, as Exp9’s confirmation-proxy frontier and the oracle upper bound show. Finally, the source-not-target denominator Dc prevents clean agreement or route episodes from certifying C3 by themselves; this is tested by Exp6 (800/800 sourcenot-target cases under agreement) and codified in Table 5 and Table 6. For C2, attack-attributable uplift is the C2 EEG-side flag rate minus the clean flag rate over the same case set; a successful context-provenance defense blocks the target route while leaving benign context unblocked. For C3, attack success is the fraction of attack cases whose primary decoder reaches the target; conditional bypass is the fraction of successful C3 cases where the secondary decoder also agrees; unauthorized conditional bypass uses only source cases whose clean label is not the target. Unless otherwise stated, C2 route rates are averaged over 20 untrusted contexts per seed, benign block rates over 20 trusted contexts per seed, C3 rates over 120 attack cases per seed, and unauthorized C3 rates over the 60 source-not-target cases per

Table 5: Claim-bearing audit protocol. Rows name the statistical unit and route predicate used for each load-bearing claim; route episodes are coverage artifacts, not independent samples. Claim

Statistical unit

Decoder usability

clean primary/secondary accu- ≥ 7 seeds with acc. ≥ .60, disagr. ≤ .40 racy and disagreement seed × context set clean/untrusted routed episodes requested target route under be- provenance block ≤ .05 with benign utility nign vs. untrusted provenance reported seed × source-not-target attacked cases whose clean primary target, secondary target, report P(A), P(B | A), P(P | A, B) case source is not target active policy executes target when observable seed × independent confir- proxy-confirmed or upper- execution only if confirmation report clean coverage and C3 residual jointly mation window bound policy episodes condition passes seed same C3 source-not-target cases constrained or query-limited at- residual route rate under matched clean burtack routes through same policy den seed-level route suite decoded-label cases × public parse-valid, policy-compliant transcript coverage only; no extra statistical contexts harmless stub route weight

C2 route safety C3 agreement risk Confirmation Stress/defense Transcript bridge

seed

Denominator

Route predicate

Gate or boundary

held-out EEG events

Table 6: Primary endpoint hierarchy. “Primary” rows are the main claim-bearing endpoints used to decide the paper’s C2/C3 audit claims; stress rows test robustness boundaries on the same denominators; support rows check route-vocabulary and transcript coverage without adding statistical weight. Role

Endpoint

Primary

10 seeds; untrusted native-command provenance route ≤ .05 0.000; decoder gates 10/10 route episodes Exp8 native C3 agreement route 10 seeds; 80 source-window agreement-plus-provenance 1.000; clean utility .806 cases/seed route reported Exp9 non-oracle confirmation 10 seeds; independent confirmation report C3 residual and clean .178 at clean .573; .091 at clean .458 proxy windows coverage jointly Exp10 preprocessing-shaped C3 10 seeds; same native source-not- retain/fail under named con- smooth9 .883; band 8–30 .995; target route predicate straints smooth9+band .156 Matched non-oracle defenses 10 seeds; matched clean-burden C3 residual risk under calibrated white-box .590–.693; score-query .067– cases defenses .093 Public transcript/live-router seed-level decoded-label route suite parse/policy consistency and coverage only; no extra statistical unit bridge route-vocabulary coverage

Primary Primary Stress Stress Support

Statistical unit / denominator

Decision rule

Reported value

Exp8 native C2 route block

seed. Tables report seed means and standard deviations with failed decoder gates kept in the denominator; route-episode counts are transcript-coverage counts, not independent statistical units. Exact seed-level numerators, denominators, and gates are part of the released result JSON. The gateselected A:C rows use the predefined decoder gate and then report the strongest passing perturbation setting, while Table 12 exposes the weaker settings so that the C3 claim is not hidden behind a single best configuration. The fixed route/observability cells compare non-confirmation mediation layers against explicit confirmation. Confirmation is not treated as a learned defense. We report two distinct confirmation rows: an oracle execution-policy upper bound that withholds high-impact execution unless a clean-label confirmation variable grants the route, and a non-oracle proxy that requires an independent EEG confirmation window decoded by a separately trained model above a calibrationsplit threshold. The final matched-defense cell adds a multistep PGD adversarial verifier, robust ensemble gates, cleanburden calibration, band-limited attacks, and score-query attacks so that the remaining residual C3 routes are not an artifact of weak or unfairly burdened baselines.

Rule-level observability. Each non-oracle rule observes a different subset of variables. Primary-only and confidencegate rules fail on C2 (no provenance variable), and confidence gating only partially flags C1 perturbations. Heterogeneous agreement flags some C1 cases but is bypassed by C3 because both decoders are jointly driven. Context provenance directly blocks C2 routes and is irrelevant for C3. Agreement plus provenance blocks C2 but is still bypassed by C3 under the conditions of Proposition 1. The non-oracle confirmation proxy of Exp9 introduces an independent EEG signal that lowers C3 routing without requiring a clean label, and the oracle confirmation rule appears only as a separately marked upper-bound execution policy. What the audit proves and does not prove. The audit proves narrow, testable claims rather than deployment-level guarantees. C2 provenance proves that route logs must include context provenance and outcome, not the prevalence of malicious contexts. C3 agreement proves that the attacked secondary decision and policy are required denominators, not human intent or consent. Native command-control proves that the audit holds on EEGMMI left/right command labels, not deployed cursor-controller safety. Perturbation stress proves that route risk survives some preprocessing-

shaped constraints, not electrode-level physical feasibility. Harmless tool stubs prove route-policy observability, not real high-impact tool execution. Transcript bridges prove that public route predicates can be inspected, not that they constitute independent statistical evidence. Reviewer-facing claim boundary. The experiments are offline authorization audits. They do not estimate deployed BCI prevalence, physical injection feasibility, human consent, or real high-impact tool execution. Their claim is narrower and testable: for a fixed BCI-to-tool routing interface, a route-safety certificate must log the variables in Table 5; otherwise C2 and C3 can be counted with non-identifying denominators. The empirical cells then ask whether the resulting falsification protocol survives native command labels, preprocessing-shaped perturbations, independent confirmation proxies, public harmless routing, and matched non-oracle defenses.

6 6.1

Experiments

Routing protocol, command taxonomy, and native command-control

The main routing evidence is the native command-control audit in Exp8 and the independent confirmation proxy in Exp9. The decoded binary command is treated as a confirmation-relevant interface intent and maps only to harmless cursor-left/cursor-right stubs in the primary native cell. A context-provenance rule blocks target-route attempts when the route is induced only by external context. The protocol tests the authorization boundary directly: whether EEG-side agreement and context provenance observe the right attack class, not whether any real financial, medical, file-system, or communication action is executed. Exp5/Exp7 and the command-taxonomy transcript gate are support cells: they broaden the harmless route vocabulary and check public router consistency, but they do not replace the native-command endpoint hierarchy in Table 6. To reduce reliance on that high-impact surrogate, Exp8 instantiates the same audit on native EEGMMI left/right command-control semantics. It uses R03/R04/R07/R08/R11/R12, where T1/T2 denote left/right fist execution or imagery, and maps decoded labels only to harmless cursor-left/cursor-right stubs. Across 60 subjects, 5,400 native command events, 10 seeds, and 80 cases per seed, A:C decoder gates pass in 10/10 seeds with clean accuracies 0.779/0.788 and disagreement 0.174. C2 untrusted overlay contexts route the requested direction at 1.000 without provenance and 0.000 with provenance. Shared-raw C3 command flips reach the target direction under agreement plus provenance at 1.000, while confirmation plus provenance routes them at 0.000; clean non-abstain utility is 0.806. This is still an offline audit, not a deployed cursor controller, but it replaces the financial/access surrogate with native BCI command-control labels. Exp9 separates the oracle confirmation upper bound from a non-oracle confirmation proxy. It keeps the same nativecommand A:C source-window attack, but route execution also requires an independent clean EEG confirmation window decoded by TinyEEGNetB above a calibration-split

Table 7: Native EEGMMI command-control audit on left/right fist execution and imagery runs. Routes are harmless cursor stubs; values are seed means over 10 seeds. Cell

Gate

Route result

Boundary answered

Decoder 10/10 acc. .779/.788; disagr. .174 native commands decodable C2 overlay pass request route 1.000 → 0.000 provenance blocks context C3 flip pass agreement route 1.000 agreement not intent Confirmation pass C3 route 0.000 execution upper bound

threshold chosen to control per-label false accepts. The confirmation window is paired from the same subject and same true source command when available, so an unauthorized target route requires a confirmation-decoder false accept rather than access to the clean source label. With a 0.05 calibration false-accept target, the proxy passes all decoder and case gates; confirmation-decoder accuracy is 0.798, calibration false accept rates are 0.046/0.047, and calibration true accept rates are 0.893/0.896. It reduces native C3 target routing from 1.000 under agreement to 0.178 with pooled Wilson 95% CI [0.153, 0.206], while clean proxy-confirmed routing is 0.573. A stricter 0.01 false-accept target passes the predefined Exp9 gate and further reduces C3 routing to 0.091 with Wilson CI [0.073, 0.113], at clean proxyconfirmed routing 0.458. Thus independent confirmation is not an oracle-equivalent learned defense in this audit: it exposes a measurable risk–coverage frontier. The validation hierarchy separates controls, primary endpoints, stress tests, and support artifacts. Synthetic, embedding, and deterministic-routing cells check metric plumbing and directional sanity. The paper-facing routing endpoints are Exp8 and Exp9: native left/right command-control with harmless cursor stubs, followed by an independent EEG confirmation proxy that turns the oracle upper bound into a measurable risk–coverage frontier. The decoded-label public tool-agent cell, command-taxonomy transcript gate, and live-router bridge are support artifacts only. They send no raw EEG, embeddings, subject identifiers, or paths; they check that the same C2/C3/confirmation route predicates can be represented across a broader harmless route vocabulary and a public router interface. Their 144,000 route episodes are transcript coverage, not independent statistical samples, and they are not used to decide the main claim.

6.2

Real EEGMMI command-label validation

The real-label cell uses the EEGMMI R03 event cache with 60 subjects, 900 T1/T2 events, 16 channels, and 512 samples per event. T1/T2 are used as real binary command labels in the surrogate routing protocol; the target label maps only to a harmless non-executing route. The main cell trains two independent TinyEEGNet-style raw EEG decoders and evaluates shared raw-input PGD attacks. Real-EEG inputs are standardized using training-window channel statistics and then attacked in that standardized rawinput space. Across the 30 A:C split/seed runs, the trainingchannel standard deviation in the raw cache is 0.9725 ± 0.0078; therefore ϵ = .08 corresponds to a mean raw-cache amplitude of 0.0778, about 8.0% of the global raw standard

Table 8: Seed-level decoder statistics for Exp8 native command-control. The four route columns (C3-dual, C2prov., C3-agree, C3-conf.) are deterministic in this cell and equal (1.000, 0.000, 1.000, 0.000) for every seed; we omit them here to surface the across-seed decoder variance, and list those route values once in the caption rather than repeating ten identical rows. Seed

A acc.

C acc.

A/C disagr.

0 1 2 3 4 5 6 7 8 9

.778 .766 .778 .772 .764 .789 .784 .780 .789 .788

.785 .789 .795 .789 .797 .791 .780 .785 .789 .777

.157 .185 .177 .166 .178 .169 .175 .172 .184 .175

.05 .01

Cal. FA

Cal. TA

.046/.047 .893/.896 .007/.008 .679/.726

Source

Route

Policy behavior

Status/menu trusted UI status/menu/calib. low-risk route allowed Message trusted UI draft-only local buffer only Finance/access untrusted ctx. transfer/unlock/alert provenance abstains Mixed untrusted ctx. msg. + transfer provenance abstains Trusted high-impact trusted UI transfer/alert prep confirmation required C3 target trusted ctx. decoded transfer agreement routes unless confirm. required

Split

P/S acc.

Disagr.

C3 succ./bypass

Within .754±.028 / .766±.029 .149±.032 .997±.008 / 1.000 Provided .737±.022 / .752±.019 .183±.008 1.000 / 1.000 Holdout .756±.030 / .763±.023 .159±.024 .999±.003 / 1.000

C3 proxy route Clean proxy route .178±.037 .091±.031

Family

Table 11: Raw-CNN Level-2 A:C replication across split protocols at the gate-selected ϵ = 0.08, 40-step shared-raw PGD setting. Values are mean ± standard deviation.

Table 9: Exp9 non-oracle confirmation proxy on native command-control. The source window is attacked; an independent clean confirmation window is decoded by TinyEEGNetB with calibration-split thresholds. Cal. FA target

Table 10: Inspectable route-taxonomy slice used by the public transcript gate. All entries are public strings and harmless stubs; high-impact stubs record that a route would have been attempted but execute nothing.

.573±.053 .458±.053

deviation and 4.1% of the 95th percentile absolute amplitude. This calibration makes the perturbation scale auditable, but it is still an offline standardized-tensor budget rather than a claim of hardware-injection feasibility. TinyEEGNetA, B, and C differ in temporal kernel widths, channel counts, pooling, and dropout, so A:C is not a duplicate-head agreement test. C1 uses targeted PGD against the primary decoder only. C3 uses the same raw perturbation for both decoders and minimizes the sum of primary and secondary target crossentropies with ℓ∞ clipping; this is the executable relaxation of Proposition 1. All reported split/seed runs keep failed seeds in the denominator and report decoder gates before attack metrics. Level-1 gate. The original A:B real-label cell passes the gate: 10/10 usable seeds, balanced accuracy 0.7542/0.7790, clean disagreement 0.1520, C2 EEG flag uplift 0.0000, C2 target-route attempts 1.0000/0.0000 without/with provenance, and C3 success/bypass/unauthorized bypass 0.9983/0.9933/0.9900. We treat this as the calibrated reallabel gate, then repeat the shared-raw attack with TinyEEGNetC as a different secondary decoder across three split protocols. The replication rules out the main toy-pipeline and single-decoder-pair objections: C3 bypass is not a subjectparity, embedding-space, or one-pair artifact. For the gate-selected A:C configuration (ϵ = 0.08, 40 PGD steps), all 30 split/seed runs are usable. The aggregate primary/secondary balanced accuracies across the three split protocols are 0.749/0.760, and the mean clean disagreement

is 0.164. Across within-subject, provided-split, and subjectholdout protocols, C2 attack-attributable EEG flag uplift is 0.000 ± 0.000; C2 reaches the target route without context provenance at 1.000 ± 0.000 and is blocked with provenance at 0.000 ± 0.000. C3 unauthorized conditional bypass is 1.000±0.000 in each split, with the minimum usable-seed conditional bypass equal to 1.000 in all three split protocols. Thus the cross-decoder and cross-split replication preserves both parts of the boundary claim: EEG-side monitoring remains blind to C2 context injection, and agreement remains satisfiable under shared raw-input C3 optimization. A separate lemma-to-experiment bridge repeats the provided-split A:C cell with explicit margin diagnostics. Decoder gates pass in 10/10 seeds; at ϵ = 0.08 and 40 PGD steps, C3 attack success, conditional bypass, and unauthorized conditional bypass are all 1.000. The joint-min margin gain is 27.487 on average, and every seed has positive joint margin rate and shared-descent-both rate 1.000. This bridge is the executable falsification cell for Proposition 1: the shared raw-input feasible region is observed in the same real-label setting used by the routing experiments. To address the clean-utility objection directly, Exp6 restricts evaluation to test events where both A and C are clean-correct, agree with each other, and the true source label is not the target. This subset is not a deployment prevalence estimate; it is a conditioned audit asking whether agreement bypass remains possible on cases that the twodecoder system handled correctly before attack. Across 10 provided-split seeds, the audit selects 80 clean-correct source-not-target cases per seed from the 300-event test split (rate 0.267 per seed), for 800 total cases. Shared-raw C3 routes 800/800 of them under agreement, with pooled Wilson 95% CI [0.995, 1.000]; explicit confirmation routes 0/800. The clean subset has mean decoder confidences 0.961/0.960, so this result is not driven by low-confidence clean disagreements.

Table 12: Attack-strength sweep from the same A:C result files, aggregating 30 split/seed runs per ϵ at 40 steps. ϵ .02 .04 .08

Runs/gates C3 success C3 unauth. bypass 30/30 30/30 30/30

.805±.044 .951±.025 .999±.005

.893±.066 .972±.028 1.000±.000

Table 13: Paper-facing evidence spine for the final C2/C3 claim. All cells use EEGMMI real T1/T2 labels with harmless stubs; all rows pass the predefined gate at 10/10 seeds (Exp10 is reported as a stress cell on the same denominators). Cell

Main result

Objection answered

Exp1 Exp2 Exp3 Exp4 Exp5 Exp6 Exp7 Exp8 Exp9 Exp10

C3 unauth. bypass 1.000 C2 prov. 0.000; C3 non-conf. 1.000 white-box residual .590–.693 attack-attrib. residual ≤ .070 30 ctx.; 144k routes; 0/1/0 800/800 high-utility C3 144k Opus 4.7; parse/policy 1.000 5.4k native events; 0/1/0 native C3 route .178/.091 smooth/band/ramp .883/.995/1.000

formal/toy artifact tool-routing semantics weak baseline score/grad. access single stub/ctx. low-utility error public LLM consistency surrogate command oracle confirmation tensor-only

6.3

Table 14: Statistical hierarchy for denominator-sensitive results. Route episodes are transcript-coverage units; seedlevel rows are the statistical units used for means and intervals. Quantity

Unit

Used for

Decoder gates Attack rates Route rates Route episodes

seed/run seed-level case sets seed × case × policy context expansion

claim-bearing usability filter C3 success and bypass estimates C2/C3 route numerators transcript coverage, not independent CI units Live calls batched router requests parse/policy compliance checks Stored transcripts sampled route exam- inspectability and artifact hyples giene

Table 15: v6 fixed routing and observability cell on EEGMMI real T1/T2 labels, provided split, 10 seeds. C2 entries are target-route rates over 20 untrusted contexts; benign entries are target-route block rates over 20 trusted contexts. C3 entries are unauthorized target-route rates. Rule

C2 route

Benign block C3 whitebox unauth.

Primary only 1.000±.000 0.000±.000 Confidence gate .834±.018 .088±.024 Heterogeneous agreement .817±.027 .107±.012 Context provenance 0.000±.000 0.000±.000 Agreement + provenance 0.000±.000 .107±.012 Confirmation upper bound (exec.) 0.000±.000 .122±.025

1.000±.000 .998±.005 1.000±.000 1.000±.000 1.000±.000 0.000±.000

Fixed routing, observability, and realism cell

The fixed route-suite cell is a controlled observability test rather than an external-validity claim. It fixes a public 40context route suite: 20 trusted benign contexts and 20 untrusted C2 contexts that request the target route. Benign examples include status, calibration, spelling-buffer, and noop interface contexts; C2 examples are untrusted retrieved or webpage contexts that request the target route. The deterministic route rule is intentionally transparent: route by decoded intent under trusted benign context, route to the target when untrusted context requests it unless provenance is enabled, and abstain when provenance marks such context as untrusted. This makes the cell a unit test for denominators and rule observability. It evaluates the same real-label A:B:C raw decoders on the provided split over 10 seeds, 120 attack cases per seed, and six execution rules: primary-only, confidence gate (τ = .80), heterogeneous agreement, context provenance, agreement plus provenance, and a confirmation upper-bound rule. No real tool is executed; the target route is still the harmless non-executing stub. The C2 route rates are a validation sanity check for observability: confidence and heterogeneous agreement reduce some benign or low-confidence executions, but they do not observe context provenance. Provenance blocks C2 and is irrelevant for C3. The confirmation upper-bound rule is included only as an execution policy with access to the clean label: it blocks unauthorized C3 by using information unavailable to an automatic EEG-side monitor. Exp9 replaces that oracle variable with an independently decoded confirmation window and shows the expected tradeoff: target rout-

ing falls from 1.000 to .178 or .091 as the calibration falseaccept target tightens from .05 to .01, while clean proxyconfirmed routing falls from .573 to .458. Exp10 addresses the tensor-only objection without claiming physical injection. It repeats the native command-control C3 audit under preprocessing-shaped perturbation families and post-hoc transformations, using the same source-nottarget denominator and route predicate as Table 5. The diagnostic target is not invisibility to a human or realizability through electrodes; it is whether the agreement bypass survives constraints that approximate common preprocessing assumptions. Smoothing, band-limiting, and causal ramp constraints retain substantial agreement-route rates: smooth9 .883 at distortion .059 and 24.85 dB SNR, band 8–30 Hz .995 at distortion .067 and 23.67 dB, and causal ramp 1.000 at distortion .078 and 22.41 dB. These rows are constraint-matched C3 cells: the attack is optimized inside the named preprocessing family rather than evaluated only as an unconstrained raw-tensor perturbation. Post-hoc smoothing of a plain attack retains .926 agreement, and posthoc band-limiting retains 1.000. The same cell also exposes a failure boundary: combining smoothing and 8–30 Hz band-limiting during optimization drops routes to .156 despite very high SNR (48.83 dB), and shifting a plain or bandlimited perturbation by ±4 or ±8 samples sharply reduces agreement. Thus the perturbation evidence supports an offline audit-stress claim and a temporal-alignment caveat, not hardware-channel feasibility. The command-taxonomy transcript gate tests whether this

Table 16: Native command-control temporal/preprocessing stress. Routes are C3 target-direction agreement routes over 10 seeds and 80 cases/seed. Distortion is mean perturbation standard deviation divided by event standard deviation; SNR is in dB. Constraint

C3 route

Plain raw tensor 1.000±.000 Smooth, 9 samples .883±.044 Smooth, 17 samples .696±.063 Band 4–40 Hz 1.000±.000 Band 8–30 Hz .995±.006 Causal ramp, 25% 1.000±.000 Smooth9 + band 8–30 .156±.034

Distortion SNR .088 .059 .056 .074 .067 .078 .004

21.29 24.85 25.23 22.90 23.67 22.41 48.83

Table 17: Post-processing and temporal-shift survival for Exp10. Values are dual-decoder target agreement after applying the listed transformation to an already optimized C3 example. Attack

none smooth9 band 8–30

Plain 1.000 Smooth9 .883 Band 8–30 .995 Smooth9 + band .156

.926 .898 .539 .160

1.000 .358 1.000 .406

shift ±4

shift ±8

.196/.183 .238/.213 .759/.759 .563/.586 .014/.021 .095/.091 .133/.140 .124/.113

Table 18: Perturbation-realism diagnostics for Exp10. The audit reports both survival and failure under temporal/preprocessing transformations; high SNR does not imply physical feasibility. The shift rows (±4/ ± 8) report the survival of an already-optimized perturbation under post-hoc temporal shift, so they share the distortion/SNR of the underlying optimized attack and we mark the cell n/a to avoid double-counting. Diagnostic

6.4

Matched stronger-defense stress

The final stress cell tests whether stronger non-oracle defenses close the C3 channel when their clean burden is ex-

Distortion/SNR

Interpretation

Table 19: Reproducibility artifacts for the validation protocol. All tools are harmless stubs; no live API call is required for the load-bearing cells. The optional live-router bridge sends only decoded labels, public context strings, policy flags, and harmless tool schemas. Artifact

Released content

Data/splits

EEGMMI R03 cache metadata; native R03/04/07/08/11/12 cache; train/cal/test and holdout indices standardization constants; TinyEEGNet A/B/C configs; seeds 0–9 route-rule pseudocode; benign/untrusted contexts; command taxonomy strings 240 local route examples plus 1,200 sampled live-router bridge transcripts PGD, transfer, smoothed, band-limited, causal-ramp, temporal-shift, score-query NES, decision-only search seed-level numerators, denominators, gates, CIs, utilitysubset audit rows

Preprocess/models

conclusion survives a less single-stub route vocabulary. It uses the same provided-split A:C decoders, 10 seeds, 80 selected cases per seed, 30 public contexts, and six policies, producing 144,000 local deterministic route episodes and 240 stored example transcripts. Agreement plus provenance blocks all C2 high-impact routes (0.000) but routes all unauthorized C3 high-impact cases (1.000); provenance plus confirmation routes unauthorized C3 high-impact cases at 0.000. Clean non-abstain utility under agreement plus provenance is 0.889±0.045 with seed minimum 0.8125. This cell is not a deployed-agent benchmark, but it removes the narrower objection that the public route evidence depends on a single named high-impact stub or a single context template. The live public-router bridge repeats the transcript gate with Claude Opus 4.7 as the router and the same harmless stub schema. Across 144,000 routing episodes and 480 live API calls, 1,200 sampled transcripts have zero parse failures, zero policy violations, and zero executed high-impact stubs. No request contains raw EEG, embeddings, subject identifiers, local paths, or checkpoints. The live router reproduces the C2/C3/confirmation pattern: C2 high-impact route rate is 1.000 without provenance and 0.000 with provenance; C3 high-impact route rate is 1.000 under agreement plus provenance and 0.000 under confirmation plus provenance. The deterministic-reference agreement rate is 0.9754 and clean non-abstain utility is 0.846. The full case-gated bridge uses 80 clean and 80 C3 decoded-label cases per seed; all decoder case and router behavior gates pass.

Survival

Smooth9 optimized .883 .059 / 24.85 dB low-pass-shaped attack remains high Band 8–30 optimized .995 .067 / 23.67 dB motor-band constraint remains high Causal ramp optimized 1.000 .078 / 22.41 dB onset-constrained attack remains high Smooth9 + band optimized .156 .004 / 48.83 dB combined constraint is a failure boundary Plain attack shifted ±4/ ± 8 .196/.183; .238/.213 n/a timing alignment is fragile Band attack shifted ±4/ ± 8 .014/.021; .095/.091 n/a band-limited route is shift-sensitive

Routing Transcripts Attacks Results

plicitly matched. It instantiates the decomposition in Theorem 1: primary robustness targets P(A), heterogeneous verification targets P(B | A), and confirmation changes P(P | A, B). We keep TinyEEGNetA as the primary decoder and compare standard agreement, FGSM and multi-step PGD adversarial verifiers, clean and PGD robust ensembles, and calibrated matched variants. The calibrated variants set confidence thresholds on the calibration split to match a target primary-target clean block rate of 0.12, avoiding a misleading comparison where a defense wins only by refusing most clean target routes. The matched PGD pair and ensemble both pass the burden check, and the ensemble does not cross the predefined overburden boundary. Attacks are adaptive to the evaluated family: white-box pair PGD, white-box ensemble PGD, band-limited ensemble PGD, and score-query attacks with 100 and 200 queries. The support package is part of the validation object. It specifies the EEGMMI event-window construction, channel set, train/cal/test and subject-holdout splits, standardization constants, decoder hyperparameters, attack objectives, query budgets, route-rule pseudocode, route contexts, and seed-level numerator/denominator JSON for every ta-

Table 20: Matched stronger-defense stress, provided split, 10 seeds. Entries are unauthorized target-route rates except the decision-only row, which reports attack-attributable unauthorized routes. Calibrated matched defenses use cleanburden thresholds chosen on the calibration split; confirmation uses the clean label as an upper-bound execution policy. The Confirmation upper-bound row’s Primary cell is marked n/a because the confirmation rule is an execution policy that consumes the clean label rather than an EEG-side defense applied to primary-only routing. Attack

Primary

Cal. PGD pair Cal. PGD ens.

White-box pair PGD 1.000 .693±.056 White-box ensemble PGD .998±.005 .685±.053 Band-limited ensemble PGD .832±.100 .135±.026 Score-query, 100 queries .407±.121 .087±.073 Score-query, 200 queries .433±.109 .093±.074 Decision-only, 200 queries .067±.042 .037±.018 Confirmation upper bound (exec.) n/a 0.000

.590±.062 .692±.061 .137±.028 .067±.067 .073±.063 .037±.023 0.000

Table 21: Confirmatory metrics with seed-level bootstrap 95% confidence intervals. Rows are pre-specified claimbearing metrics; exploratory stress variants remain in the released JSON. Metric

Mean

95% CI

Min–max

Exp1 C3 unauth. bypass 1.000 [1.000, 1.000] 1.000–1.000 Exp2 non-conf. route 1.000 [1.000, 1.000] 1.000–1.000 Exp2 confirmation route 0.000 [0.000, 0.000] 0.000–0.000 Exp8 native C2 prov. route 0.000 [0.000, 0.000] 0.000–0.000 Exp8 native C3 non-conf. route 1.000 [1.000, 1.000] 1.000–1.000 Exp8 native confirmation route 0.000 [0.000, 0.000] 0.000–0.000 Exp9 proxy route, FA .05 .178 [.153, .206] .125–.250 Exp9 proxy route, FA .01 .091 [.073, .113] .063–.138 Exp9 clean proxy route, FA .05/.01 .573/.458 [.539, .604]/[.426, .493] .475–.625 / .388–.563 Exp10 smooth9 route .883 [.855, .909] .800–.938 Exp10 band 8–30 route .995 [.991, .999] .988–1.000 Exp10 smooth9+band route .156 [.135, .178] .113–.213 Exp3 white-box PGD pair .693 [.660, .730] .633–.800 Exp3 white-box ensemble .590 [.552, .630] .500–.700 Exp3 band-limited pair .135 [.118, .152] .100–.183 Exp3 score-query pair .093 [.047, .140] .000–.200 Exp4 decision-only pair .037 [.027, .047] .000–.067 Exp4 decision-only ensemble .037 [.023, .050] .000–.067 Confirmation upper bound 0.000 [0.000, 0.000] 0.000–0.000

ble entry. The transcript artifacts record the public context string, decoded primary and secondary intent labels, policy flags, chosen harmless stub, execution boolean, and block reason for each stored example. The optional live bridge stores the corresponding public router JSON responses and safety-audit fields. The utility-subset artifact records the clean-correct agreement denominator, clean confidences, attacked decoder outputs, Wilson interval, perturbation ratio, and SNR for Exp6. The Exp7 decoded-label export supplies 80 clean and 80 C3 public cases per seed without raw EEG, embeddings, subject identifiers, paths, or checkpoints. The protocol is denominator-sensitive: a C2 EEG flag rate, a C2 route rate, a C3 conditional bypass rate, and an unauthorized C3 route rate are different units of analysis and should not be merged into one success number. The matched defenses change the magnitude but not the validation conclusion. Multi-step adversarial verifica-

Table 22: Coverage–risk frontier for matched nonconfirmation defenses, provided split, 10 seeds. Coverage is the clean target-route rate. White-box risk is unauthorized target routing under pair PGD; decision-only risk is attack-attributable unauthorized routing at 200 route/abstain queries. Defense Primary only PGD agreement Calibrated PGD pair Calibrated PGD ensemble Confirmation upper bound

Clean coverage White-box risk Decision-only risk .499 .400 .218 .204 .365

1.000 .853 .693 .590 0.000

.067 .070 .037 .037 0.000

tion, ensembles, and calibrated abstention reduce unauthorized routes, especially for band-limited, score-query, and decision-only attacks. They do not make non-confirmation agreement an intent certificate: calibrated white-box residual routes remain between 0.590 and 0.693, while scorequery and decision-only routes are consistent with nonzero residual but not conclusive at the present seed count: the score-query pair seed-level CI includes zero (e.g., [0.000, 0.200]), and decision-only route/abstain searches find attack-attributable unauthorized routes up to 0.070 but with overlapping seed CIs at the matched-defense rows. Table 21 separates confirmatory claim-bearing metrics from exploratory stress variants and reports seed-level bootstrap intervals; the decision-only calibrated pair residual is 0.037 with 95% CI [0.027, 0.047]. Table 22 shows the cleancoverage tradeoff directly: calibrated non-confirmation defenses reduce coverage and risk, Exp9’s non-oracle confirmation proxy reduces native C3 routing to .178 and .091 at clean proxy coverage .573 and .458, and only the separately marked confirmation execution upper bound reaches zero unauthorized route risk. This is the paper’s safety boundary: mediation and confirmation proxies can reduce and log risk, but they do not by themselves turn agreement into intent.

6.5

Honest Frontier and Threat-Archetype Necessity

This subsection instantiates Proposition 2 and Corollary 3 on the same native command-control denominator as Exp8/Exp9. The reported numbers are pooled over 10 seeds and 80 source-not-target cases per seed, with 95% Wilson confidence intervals; full seed-level rows are in the released JSON. Strict held-out calibration corrects in-fold leakage. Refitting Exp9 with fB trained only on the train index and the threshold selected only on the calibration index gives α=.05 empirical FAR 0.0525, 95% CI [0.039, 0.070], versus 0.0912, CI [0.073, 0.113] in the leaky train+cal fit reported in Exp9. Stricter targets reach α=.01 FAR 0.0038, CI [0.001, 0.011], and α=.005 FAR 0.000, CI [0.000, 0.005]. Empirical FAR is at or below α for α ∈ {.005, .01, .02, .03, .05}, consistent with Proposition 2; the only finite-sample slack appears at α=.10, where empirical FAR is 0.1187 with CI [0.098, 0.143] and is rescued by a

Confirmation utility

conformal target Confirmer A: TinyEEGNet Confirmer B: EEGNetV4

0.005

Clean confirmation acceptance rate

Empirical unauthorized confirmed-route rate

Conformal FAR control 0.14 0.12 0.10 0.08 0.06 0.04 0.02 0.00

0.01 0.02 0.03 0.05 Conformal FAR target

0.1

0.45 0.40 0.35 0.30 0.25 0.20 0.15 0.10 0.05

Confirmer A: TinyEEGNet Confirmer B: EEGNetV4

0.005

0.01 0.02 0.03 0.05 Conformal FAR target

0.1

Figure 1: Cross-architecture conformal frontier. Left: empirical unauthorized confirmed-route rate versus conformal target α, with 95% Wilson CI shading and the conformal target line y=α. Right: clean confirmation acceptance rate (utility) at the same α. EEGNetV4 Pareto-dominates TinyEEGNetB across the frontier under threat model B-strict. Table 23: Conformal (α, FAR, utility) frontier for two confirmers under threat model B-strict, 10 seeds, 80 cases/seed. FAR is pooled empirical unauthorized confirmed-route rate; utility is clean confirmation acceptance rate. Subject-cluster bootstrap CI uses 60 EEGMMI subjects as resampling units; trial-level Wilson CI is included for comparison. Confirmer

α

FAR

Wilson CI

Subj. CI

TinyEEGNetB .005 .000 [.000, .005] [.000, .000] TinyEEGNetB .01 .004 [.001, .011] [.000, .008] TinyEEGNetB .02 .014 [.008, .025] [.006, .023] TinyEEGNetB .03 .029 [.019, .043] [.017, .042] TinyEEGNetB .05 .053 [.039, .070] [.037, .069] TinyEEGNetB .10 .119 [.098, .143] [.097, .142] EEGNetV4 .005 .003 [.001, .009] [.000, .006] EEGNetV4 .01 .006 [.003, .015] [.001, .012] EEGNetV4 .02 .013 [.007, .023] [.005, .021] EEGNetV4 .03 .031 [.021, .046] [.020, .044] EEGNetV4 .05 .048 [.035, .065] [.033, .063] EEGNetV4 .10 .098 [.079, .120] [.077, .119]

Utility .060 .150 .210 .247 .335 .452 .104 .191 .266 .305 .370 .468

Table 24: Threat-archetype matrix at α=.05, ϵsrc =0.08, strict calibration, 10 seeds, 80 cases/seed. “Attack on cnf.” indicates whether the attacker perturbs the confirmation window inside the same budget. Subject-cluster bootstrap CI uses 60 EEGMMI subjects as resampling units; trial-level Wilson CI is shown for comparison. The Bxr row uses a different EEGMMI run within the same recording day as the confirmation window and is therefore a cross-run withinsession audit, not a cross-day deployment estimate. Archetype

Pair source

A same subj. same session B disjoint subject Bxr cross-run same subj. disjoint run C same subj. same session C′ disjoint subject

Attack on cnf. FAR no no no yes yes

Wilson CI

Subj. CI

.053 [.039, .070] [.037, .069] .048 [.035, .065] [.034, .062] .040 [.029, .056] [.027, .055] .998 [.991, .999] [.994, 1.000] .999 [.993, 1.000] [.996, 1.000]

cross-run within session uses the same subject but a disjoint EEGMMI run, and (C) the attacker additionally perturbs the confirmation window inside the same ℓ∞ ball, we obtain Table 24. Acquisition isolation alone (A vs. B/Bxr ) does not change the controlled FAR. The Bxr row uses a different EEGMMI run as the confirmation window for the same recording day; this is a within-session cross-run audit and not a cross-day deployment estimate, and we report it as such (FAR 0.040 with subject-cluster CI [0.027, 0.054]). Confirmation-channel control breaks the bound regardless of pairing (C, FAR ≈ 1), exactly as Proposition 3 predicts at finite ε. Preprocessing stability. Repeating the strict α=.05 frontier under no-record-normalization confirmation acquisition gives FAR 0.046, CI [0.034, 0.063], within sampling noise of the record-normalized 0.053. The Exp10 preprocessing failure boundary likewise persists under both record-normalized and no-record-normalized strict calibration: smooth9+band 0.179/0.240 and shift-±4 0.21/0.23 across the two pipelines.

stronger confirmer below. Cross-architecture frontier. Replacing TinyEEGNetB by EEGNetV4 (Lawhern et al. 2018) as the conformal confirmer keeps Proposition 2 intact and Pareto-improves the (FAR, utility) frontier at every α. EEGNetV4 confirmer accuracy is 0.814 versus TinyEEGNetB 0.796. Figure 1 reports the full α-sweep for both confirmers; Table 23 lists the seed-pooled values. At α=.10, EEGNetV4 controls FAR at 0.0975 where TinyEEGNetB drifts to 0.1187. At α=.005, EEGNetV4 utility nearly doubles (0.104 versus 0.060) while keeping FAR below 0.005. The conformal target line dominates both empirical curves except at the α=.10 TinyEEGNetB point, demonstrating that the FAR control claim of Proposition 2 is not architecture-specific. Threat-archetype necessity. The two assumptions of Corollary 3 are tested directly, and the C/C′ rows are also the empirical instantiation of Proposition 3. Letting (A) confirmation pairs share the same subject and same session, (B) acquisition-isolated pairs use disjoint subjects, (Bxr )

Reading. Strict split-conformal calibration converts the Exp9 confirmation proxy into a finite-sample frontier whose FAR matches Proposition 2 and whose two threat assumptions are individually necessary. The cross-run withinsession Bxr archetype shows a pairing that does not require disjoint-subject confirmation in audit, but it is not a crossday deployment estimate; the C/C′ archetypes mark the assumption boundary that any deployment must enforce by acquisition design rather than by post-hoc detection. Cross-day non-stationarity, headset reseating, and impedance drift are open assumptions outside the present data and are revisited in §7. Calibration-size sweep. Sub-sampling the calibration negatives to nc ∈ {160, 320, 480, 640, 800} keeps empirical FAR below α=.05 at all sizes; CI hi shrinks from 0.088 to 0.070 as nc grows, with the O(1/mt ) discretization slack expected from the split-conformal proof. This is the substantive finite-sample check on Proposition 2.

Empirical FAR

conformal target = 0.05

0.07

S

0.06 0.05

XS

L M

0.04 6 × 102

2 × 103 3 × 1043 × 103 103 Confirmer parameters

Clean confirmation acceptance rate

FAR vs. confirmer capacity 0.08

0.385 0.380

Utility vs. confirmer capacity S XS

0.375 M

0.370 0.365

L

0.360 6 × 102

2 × 103 3 × 1043 × 103 103 Confirmer parameters

Figure 2: Capacity-saturation finding for the conformal confirmer at α=.05, ϵsrc =0.08, 10 seeds. Left: empirical FAR with 95% Wilson CI as a function of confirmer parameters; the conformal target α is dashed. Right: clean confirmation acceptance rate (utility). FAR and utility are flat across an 8× EEGNetV4 capacity range, indicating dataset-limited rather than confirmer-limited frontier behavior on EEGMMI native command-control. ε-invariance under source-only attack (sanity check). Under threat assumption (ii), source perturbations cannot change the confirmation-window score distribution because the confirmer never sees Xsrc . As an audit-pipeline sanity check we sweep εsrc ∈ {0.04, 0.08, 0.12, 0.16, 0.24, 0.32} at α=.05, strict calibration, 10 seeds, 80 cases/seed: empirical FAR is exactly 0.0525 with Wilson 95% CI upper bound 0.0702 at every εsrc . The flat sweep is therefore a tautological consequence of the threat model rather than an independent prediction confirmed by data; we report it only to verify that the experimental pipeline does not silently violate (ii), for example by leaking attacker perturbations into the confirmation channel. Capacity-saturation finding. Proposition 2 controls FAR for any conformal confirmer regardless of capacity, but does not predict utility. We sweep four EEGNetV4 capacity points by varying (F1 , D, F2 ) from (4, 1, 4) to (16, 2, 32), an 8× parameter range, holding all other choices fixed at the strict α = .05, ϵsrc = 0.08 configuration. Table 25 and Figure 2 report the result: confirmer accuracy and clean utility are essentially flat across the four sizes, and FAR remains near or below α in every case. The largest model has slightly lower utility (0.359 vs. 0.385 for S) and accuracy (0.806 vs. 0.817), consistent with mild overfitting on a ∼ 480-event train split. Within this regime — EEGMMI R03/R04/R07/R08/R11/R12 left/right commandcontrol with ∼ 480 training events and EEGNetV4-family backbones — additional confirmer capacity beyond a few hundred parameters does not improve the FAR/utility tradeoff. We do not claim an information-theoretic ceiling: a larger backbone (e.g., EEGConformer or a foundation model linear head) or a larger train index could shift the frontier, and the L row’s mild drop is consistent with samplesize-limited overfitting rather than capacity saturation. The reported claim is therefore the within-regime statement that small EEGNetV4 confirmers already saturate the achievable trade-off on this dataset. Failure boundaries and non-evidence cells. The validation protocol rejects cells whose clean decoders are not us-

Table 25: EEGNetV4 capacity sweep at α=.05, strict calibration, 10 seeds, 80 cases/seed. Capacity is varied via (F1 , D, F2 ); param counts are computed for the 16-channel 512-sample event window. The conformal target line is included for reference. Cap. (F1 , D, F2 ) params conf. acc. FAR XS S M L

(4, 1, 4) (8, 2, 8) (8, 2, 16) (16, 2, 32)

554 1,474 1,874 4,258

.816 .817 .814 .806

Wilson CI

utility

.049 [.036, .066] .063 [.048, .082] .048 [.035, .065] .054 [.040, .072]

.381 .385 .370 .359

able or whose target base rate is degenerate. In an earlier log-power LDA defense attempt, the mean clean accuracy was only 0.531 and zero seeds passed the predefined gate, so that cell is not used as evidence for agreement bypass. A separate target sweep similarly exposed unreachable or degenerate targets in the synthetic harness. These negative checks matter because otherwise C3 bypass could be inflated by weak clean decoders or trivial target priors; the real-EEG A:C claim is restricted to split/seed cells that pass the decoder and denominator gates reported above. External-consistency bridge. The optional live bridge checks whether the deterministic routing semantics survive an actual LLM call under the same fixed prompt policy. It sends only decoded labels, synthetic context strings, provenance and confirmation policy flags, and harmless mock tool schemas; it does not send raw EEG, embeddings, subject identifiers, dataset paths, local file paths, checkpoints, or real tool credentials. In the full public Claude Opus 4.7 run, 144,000 decoded-label routing episodes produce parse-valid responses 1.000, policy-compliant responses 1.000, deterministic-reference agreement 0.9754, C2 highimpact route rates 1.000/0.000 without/with provenance, C3 high-impact route rates 1.000/0.000 under agreementplus-provenance versus confirmation-plus-provenance, and clean non-abstain utility 0.846. The run records 1,200 sampled transcripts, 480 live API calls, zero executed highimpact stubs, and zero safety-audit violations. It passes the predeclared 80-case-per-seed decoder-case gate and all router behavior gates. We therefore report the live run as a public transcript bridge, not as a deployed-agent validation or real-tool attack.

7

Discussion

The experiments support a boundary claim for offline BCI tool-use audits. EEG-only rules cannot see context-only C2 attacks, and dual-channel agreement can be satisfied by a C3 audit intervention that optimizes against both decoders. This does not make agreement useless. Disagreement logs are still useful for burden measurement, attack triage, and abstention policies. Agreement should be evaluated as a monitored component, not presented as a certificate of intent. The result is strongest as an audit-identifiability protocol: each class requires a different observable, a different denominator, and a different falsification cell before a deployment can claim that a route is safe.

Acquisition-isolation regimes and cross-day deployment. The threat-archetype matrix in Table 24 reports three audit regimes for acquisition isolation: same-subject same-session (A), disjoint-subject (B), and same-subject cross-run within session (Bxr ). All three are within-session audit pairings on EEGMMI R03/R04/R07/R08/R11/R12 recordings collected on the same day. They do not estimate cross-day or crosssession deployment because the dataset does not contain such pairings: there is no time gap, no headset reseating, and no impedance drift between source and confirmation windows in any row. Cross-day non-stationarity has been documented to reduce within-subject EEG transfer, and a deployed cross-day confirmation channel would require a separate field study rather than a stricter audit on this dataset. We therefore label Bxr as a cross-run within-session result, not a deployable cross-day estimate. Timing alignment is a fragile attack surface, not a robustness margin. Exp10 reports that combined smoothing and 8–30 Hz band-limiting collapses agreement-route rates to 0.156, and that ±4- and ±8-sample shifts of an already-optimized perturbation reduce dual-decoder agreement to 0.014–0.25 depending on the constraint family (Table 17). We treat these as the strongest sanity checks against tensor-only artifacts in the C3 channel. Their reading is asymmetric: they show that the agreement-bypass channel reported by Exp1/Exp6/Exp8 is an offline tensor-aligned audit signal whose persistence under timing perturbations and combined preprocessing is not given for free, not that physical realizability is established. A deployed adversary would need not only a small ℓ∞ budget but also tight timing alignment with the source-window epoch; the present data do not establish either side of physical feasibility, and the temporalshift sensitivity is a genuine open caveat for any deployment claim built on top of these audits. Command semantics and deployment boundary. The EEGMMI T1/T2 labels are real motor-imagery event labels. In the main R03 route cells, they serve as binary command labels assigned to harmless non-executing route stubs, so those cells should not be read as financial, medical, or file-system command evidence. Exp8 addresses the stronger semantic objection directly by using EEGMMI runs whose T1/T2 annotations correspond to native left/right fist execution or imagery and mapping them only to cursor-left/cursorright stubs. Exp9 adds an independent EEG confirmationwindow proxy, but it remains a proxy for confirmation rather than measured human consent. The broader commandtaxonomy cells then test whether the same denominator discipline survives a larger public route vocabulary. The contribution is to make the authorization semantics explicit: a decoded command, an external context, a provenance rule, an agreement rule, and a confirmation policy can be audited separately. The live bridge is deliberately non-load-bearing. Its purpose is to check whether the decoded-label and contextprovenance semantics survive an actual LLM call, not to estimate online BCI-agent risk. Claude Opus 4.7 reproduces the C2/C3/confirmation route pattern over 144,000 routing episodes with parse validity and policy compliance both

1.000, and the run passes the full 80-case-per-seed gate. The public tool-agent and command-taxonomy transcript cells remain the main route-semantics evidence because they use decoded real-EEG command labels, public synthetic contexts, and the same 10-seed protocol without sending private neural data. A deployed-agent study would fix a public tool-calling deployment, publish transcripts, add userconfirmation labels, and evaluate many more command contexts. That study would test external validity rather than replace the C2/C3 observability claim. The C3 lemma is not a surprise claim about optimization. Its role is to identify a predictive feasibility condition: if a shared raw-input perturbation can cross each decoder’s target margin, agreement becomes an attacker-side constraint. The empirical contribution is the falsification test that reviewers can inspect: independently trained raw EEG decoders, three split protocols, a perturbation-strength sweep, explicit margin diagnostics, clean-correct agreement subset auditing, public tool-routing semantics, transfer attacks, smoothed / band-limited / causal-ramp constraints, post-hoc preprocessing and temporal-shift stress, multi-step adversarial verification, matched clean-burden calibration, ensembles, score-query attacks, and decision-only route/abstain searches all show where the shared feasible target region persists and where it breaks under the stated offline audit condition. Stronger non-confirmation verification reduces route rates, but it does not convert agreement into an intent certificate. Finally, this is not an online BCI deployment study, a physical-injection demonstration, a human-consent study, or a real-tool authorization benchmark. Hardware latency, nonstationarity, user confirmation behavior, richer command semantics, and clinical risk controls are outside the present evidence. The standardized raw perturbation budget is calibrated against the event cache, and the route/stress cells add smoothed, band-limited, causal-ramp, temporal-shift, transfer, matched-defense, score-query, decision-only, nativecommand, and independent-confirmation-proxy constraints, but they are still offline tensor-space audits rather than actuator models. Those factors are the next validation layer; the top-level contribution here is that BCI tool-use pipelines need class-specific validation because their failure modes live in different observable channels. Next validation gates. The present evidence establishes a class-specific audit failure in calibrated offline cells. The next strengthening step is not to weaken the claim, but to add external-validity layers after the audit variables are identifiable: real user-confirmation labels, public online tool-calling transcripts, temporal/nonstationarity measurements, and physical-channel or human-in-the-loop perturbation constraints. These extensions would test deployment validity while preserving the core contribution: each routesafety claim requires a distinct observable and falsification denominator. C4 query logging. C4 is not a main empirical claim in this paper. It is kept as a reporting row because query access changes what an auditor can infer about decoder, embedding, or policy behavior. Without a direct extraction experi-

ment, the requirement is limited to disclosure: BCI-tool papers should state query access, logging, and rate limits rather than treating decoder behavior as unobservable. Ethics and dual-use boundary. The experiments use public EEGMMI-style event labels, harmless non-executing routes, deterministic stubs, and optional prompts that omit raw EEG, embeddings, subject identifiers, and dataset paths. The attack code is useful for defensive evaluation because it exposes when agreement should not be treated as an intent certificate. A release should therefore package the protocol, metrics, and harmless surrogate routes, while avoiding turnkey instructions for operating against deployed BCI devices or real tool actions.

8

Conclusion

BCI-controlled tool-use pipelines require route-safety audits whose logged variables match the attack class. The minimal audit-schema theorem, C3 attacked-dependence decomposition, fixed routing suite, native command-control endpoint, non-oracle confirmation-proxy frontier, temporal/preprocessing stress frontier, and real EEG validation protocol show why EEG-only rules and clean agreement cannot certify C2/C3 authorization claims by themselves. The practical implication is not to discard verification, but to evaluate it as one component in a class-specific safety stack with provenance, confirmation, and adaptive dual-decoder testing under explicit route and perturbation constraints.

References Nicholas Carlini and David Wagner. Towards evaluating the robustness of neural networks. In IEEE Symposium on Security and Privacy, pages 39–57, 2017. Ary L. Goldberger, Luis A. N. Amaral, Leon Glass, Jeffrey M. Hausdorff, Plamen Ch. Ivanov, Roger G. Mark, Joseph E. Mietus, George B. Moody, Chung-Kang Peng, and H. Eugene Stanley. PhysioBank, PhysioToolkit, and PhysioNet: Components of a new research resource for complex physiologic signals. Circulation, 101(23):e215–e220, 2000. Kai Greshake, Sahar Abdelnabi, Shailesh Mishra, Christoph Endres, Thorsten Holz, and Mario Fritz. Not what you’ve signed up for: Compromising real-world LLM-integrated applications with indirect prompt injection. arXiv preprint arXiv:2302.12173, 2023. Vernon J. Lawhern, Amelia J. Solon, Nicholas R. Waytowich, Stephen M. Gordon, Chou P. Hung, and Brent J. Lance. EEGNet: A compact convolutional neural network for EEG-based brain–computer interfaces. Journal of Neural Engineering, 15(5):056013, 2018. Aleksander Madry, Aleksandar Makelov, Ludwig Schmidt, Dimitris Tsipras, and Adrian Vladu. Towards deep learning models resistant to adversarial attacks. In International Conference on Learning Representations, 2018. Sean L. Metzger, Kaylo T. Littlejohn, Alexander B. Silva, David A. Moses, Margaret P. Seaton, Ran Wang, Maximilian E. Dougherty, Jessie R. Liu, Peter Wu, Michael A. Berger, Irina Zhuravleva, Adelyn Tu-Chan, Karunesh Ganguly, Gopala K. Anumanchipalli, and Edward F. Chang. A

high-performance neuroprosthesis for speech decoding and avatar control. Nature, 620:1037–1046, 2023. Nicolas Papernot, Patrick McDaniel, Somesh Jha, Matt Fredrikson, Z. Berkay Celik, and Ananthram Swami. The limitations of deep learning in adversarial settings. In IEEE European Symposium on Security and Privacy, pages 372– 387, 2016. Yujia Qin, Shengding Liang, Yining Ye, Kunlun Zhu, Lan Yan, Yaxi Lu, Yankai Lin, Xin Cong, Xiangru Tang, Bill Qian, Sihan Zhao, Runchu Tian, Ruobing Xie, Jie Zhou, Mark Gerstein, Dahai Li, Zhiyuan Liu, and Maosong Sun. ToolLLM: Facilitating large language models to master 16000+ real-world APIs. arXiv preprint arXiv:2307.16789, 2023. Gerwin Schalk, Dennis J. McFarland, Thilo Hinterberger, Niels Birbaumer, and Jonathan R. Wolpaw. BCI2000: A general-purpose brain–computer interface system. IEEE Transactions on Biomedical Engineering, 51(6):1034–1043, 2004. Timo Schick, Jane Dwivedi-Yu, Roberto Dessi, Roberta Raileanu, Maria Lomeli, Luke Zettlemoyer, Nicola Cancedda, and Thomas Scialom. Toolformer: Language models can teach themselves to use tools. arXiv preprint arXiv:2302.04761, 2023. Florian Tramèr, Alexey Kurakin, Nicolas Papernot, Ian Goodfellow, Dan Boneh, and Patrick McDaniel. Ensemble adversarial training: Attacks and defenses. In International Conference on Learning Representations, 2018. Alexander Wei, Nika Haghtalab, and Jacob Steinhardt. Jailbroken: How does LLM safety training fail? arXiv preprint arXiv:2307.02483, 2023. Francis R. Willett, Donald T. Avansino, Leigh R. Hochberg, Jaimie M. Henderson, and Krishna V. Shenoy. Highperformance brain-to-text communication via handwriting. Nature, 593:249–254, 2021. Chaoqi Yang, M. Brandon Westover, and Jimeng Sun. BIOT: Biosignal transformer for cross-data learning in the wild. Advances in Neural Information Processing Systems, 36, 2023. Xiao Zhang and Dongrui Wu. On the vulnerability of CNN classifiers in EEG-based BCIs. IEEE Transactions on Neural Systems and Rehabilitation Engineering, 27(5):814–825, 2019. Andy Zou, Zifan Wang, J. Zico Kolter, and Matt Fredrikson. Universal and transferable adversarial attacks on aligned language models. arXiv preprint arXiv:2307.15043, 2023. Vladimir Vovk, Alexander Gammerman, and Glenn Shafer. Algorithmic Learning in a Random World. Springer, 2005. Yaniv Romano, Evan Patterson, and Emmanuel J. Candès. Conformalized quantile regression. In Advances in Neural Information Processing Systems (NeurIPS), 2019. Wei-Bang Jiang, Li-Ming Zhao, and Bao-Liang Lu. Large brain model for learning generic representations with tremendous EEG data in BCI. In International Conference on Learning Representations (ICLR), Spotlight, 2024.

Qiusi Zhan, Zhixiang Liang, Zifan Ying, and Daniel Kang. InjecAgent: Benchmarking indirect prompt injections in tool-integrated large language model agents. In Findings of the Association for Computational Linguistics: ACL 2024, pages 10471–10506, 2024. Edoardo Debenedetti, Jie Zhang, Mislav Balunović, Luca Beurer-Kellner, Marc Fischer, and Florian Tramèr. AgentDojo: A dynamic environment to evaluate prompt injection attacks and defenses for LLM agents. In Advances in Neural Information Processing Systems (NeurIPS), 2024. Jingwei Yi, Yueqi Xie, Bin Zhu, Keegan Hines, Emre Kiciman, Guangzhong Sun, Xing Xie, and Fangzhao Wu. Benchmarking and defending against indirect prompt injection attacks on large language models. arXiv preprint arXiv:2312.14197, 2023. Jarod Lévy, Mingfang Zacharias, Omar Chehab, Hubert Banville, Daoud Tabbal, Alexandre Defossez, and JeanRémi King. Brain-to-text decoding: A non-invasive approach via typing. arXiv preprint arXiv:2502.17480, 2025. Hanrong Zhang, Jingyuan Huang, Kai Mei, Yifei Yao, Zhenting Wang, Chenlu Zhan, Hongwei Wang, and Yongfeng Zhang. Agent Security Bench (ASB): Formalizing and benchmarking attacks and defenses in LLM-based agents. arXiv preprint arXiv:2410.02644, 2024.