Federated EEG Learning Leaks Privacy Despite Local Data

Published in Brain Informatics, the study evaluates how differentially private federated learning (DP-FL) mitigates membership inference risks in brain-computer interface (BCI) systems. The findings indicate that while standard federated learning keeps raw neural signals local, the shared model updates still expose sensitive information about individual users and their specific brain activity patterns.

The study addresses a critical gap in privacy-preserving machine learning for neural data. EEG records millisecond-scale electrical activity from the scalp and is widely used in motor imagery (MI) based BCIs for communication and assistive control. These signals contain highly individual and potentially sensitive information, including quasi-biometric traits and neurological states. Federated learning (FL) has been proposed as a privacy-enhancing approach because it enables collaborative model training without centralising raw signals. However, previous research often treated privacy as a by-product of data locality, failing to systematically evaluate how vulnerable these models are to concrete adversarial attacks.

To address this, the researchers developed a deep learning-based differentially private federated learning framework for MI-based EEG classification. The study systematically evaluated privacy leakage under four complementary membership inference attacks (MIAs): record-level, feature-level, gradient-level, and client-identity inference. This multi-layered approach allows for a comprehensive assessment of how privacy risks manifest at different stages of the federated training pipeline, from individual data samples to the identity of the participating clients.

The experimental design utilized two publicly available MI-based EEG datasets: the BCI Competition IV Dataset 2a (MI1) and the PhysioNet Motor Movement/Imagery dataset (MI2). The MI1 dataset contained recordings from nine subjects using 22 channels, while MI2 comprised data from 109 subjects using 64 channels. Each subject was treated as an independent federated client, ensuring that raw EEG data remained locally stored. Two neural network architectures were trained using per-subject federated learning: a lightweight fully connected network called SimpleNet and a compact EEG-specific architecture called EEGNet.

Differential privacy (DP) was applied to client updates using Laplace noise with privacy budgets epsilon (ε) set to 1, 5, and 10. The DP mechanism involved clipping gradient norms to a threshold and adding element-wise Laplace noise before the optimization step. This process limits the influence of any single client’s data on the shared model parameters. The study assessed utility using standard performance metrics such as accuracy, precision, recall, F1-score, and AUROC, while privacy leakage was quantified through the four MIA categories using logistic regression and random forest attacker models.

The results revealed that standard federated learning alone provides limited intrinsic protection against privacy attacks. Under the baseline FL setting without DP, gradient-level and client-level attacks achieved near-perfect success rates. For instance, in the MI1 dataset, gradient-level attack accuracy reached 96.5–99.2% with an AUROC of 100.0%, indicating that adversaries could easily distinguish between member and non-member samples based on model updates. Similarly, client-identity inference accuracy was high, suggesting that model updates could be linked back to specific users.

Applying differential privacy substantially reduced attack success, particularly for gradient-level and client-identity attacks. At a moderate privacy budget of ε = 5, the framework achieved a favorable balance between privacy protection and classification utility. While strong privacy settings (ε = 1) offered the greatest leakage reduction, they significantly degraded classification accuracy, with some models showing near-random discrimination. In contrast, ε = 5 maintained stable MI decoding performance while effectively suppressing update-level and client-level leakage. This trade-off highlights the challenge of balancing privacy and utility in neural data applications.

The study also found that record-level and feature-level attacks remained comparatively higher across privacy budgets, indicating residual leakage. Although DP noise was applied to model updates, it did not directly perturb internal feature spaces. Consequently, latent representations derived from common spatial patterns (CSP) feature extraction may retain sufficient structure to support feature-level inference. This suggests that DP is more effective against update-level leakage than against inferential signals preserved in model outputs or latent representations.

An important finding was the dataset-dependent relationship between model generalization and privacy risk. In the MI1 dataset, a significant positive association was observed between the training-testing loss gap and record-level attack success, suggesting that overfitting amplifies privacy risk. However, in the MI2 dataset, substantial privacy leakage persisted even when generalization gaps were small. This indicates that privacy risk in federated EEG learning is not solely an artifact of poor model generalization; intrinsic subject-specific characteristics of EEG signals can produce baseline privacy vulnerability even in well-trained models.

The researchers noted several limitations of the study. Both evaluated datasets represent relatively balanced binary MI tasks, whereas many real-world EEG applications, such as seizure detection, involve highly imbalanced class distributions. Class imbalance may influence membership inference vulnerability by increasing the distinguishability of minority-class samples. Additionally, the epsilon values reported represent per-round privacy settings, and cumulative privacy loss over repeated rounds may be larger under standard composition theory. Future work should incorporate cumulative privacy accounting and evaluate more adaptive attack models.

The implications of this study extend to the design of trustworthy and secure neural-learning technologies. The findings demonstrate that FL alone is insufficient as a privacy safeguard for EEG-BCI systems. Explicit privacy mechanisms such as differential privacy are required to mitigate multi-level leakage. However, even with DP, residual risks remain, particularly for record-level and feature-level inference. This underscores the need for system-level safeguards that account for the unique statistical and identity-linked properties of EEG signals.

As BCI technologies become more integrated into clinical and assistive applications, the privacy of neural data becomes a critical design requirement. This study provides empirical evidence that privacy leakage in federated EEG learning occurs at multiple levels and cannot be assumed absent simply because raw data remain local. The results offer practical guidance for configuring DP in FL-based EEG-BCI systems, emphasizing the importance of selecting appropriate privacy budgets to balance protection and performance.

Future research should extend multi-level privacy evaluation to broader EEG modalities and attack classes. Exploring stronger system-level defences such as secure aggregation, cryptographic protection, and adaptive DP mechanisms will be essential for advancing trustworthy BCI technologies. Treating privacy protection as a core design objective rather than an afterthought is crucial for the development of deployable and ethical neural data analytics systems.

The study employed a specific threat model to test these vulnerabilities, assuming an honest-but-curious server that adheres to the federated learning protocol but attempts to extract hidden information from the transmitted data. In this scenario, the adversary had access to model prediction outputs, intermediate feature embeddings, and the historical model updates shared across communication rounds. This setup reflects a realistic risk in distributed systems where the central aggregator might possess the computational resources to analyze the statistical patterns within the shared parameters, even without direct access to the raw neural recordings stored on individual devices.

To quantify the privacy leakage, the researchers utilized two distinct attacker models: logistic regression and random forest. Logistic regression served as a primary baseline, offering a transparent and interpretable method to distinguish between member and non-member samples using posterior confidence or loss-based signals. However, because linear classifiers may underestimate privacy leakage when attack signals contain nonlinear interactions, the random forest model was incorporated as a stronger ensemble-based attacker. This comparative design allowed the study to assess privacy vulnerability under both standard and more complex adversarial capabilities, ensuring that the observed risks were not merely artifacts of a weak attack method.

The feature-level attack specifically targeted the internal representations generated by the neural networks, such as the latent features emerging from the fully connected layers of SimpleNet or the convolutional layers of EEGNet. The adversary extracted intermediate activations during forward passes, flattening them into vectors labeled as either member or non-member based on their origin. Successful inference at this level indicates that even though the raw EEG signals are not shared, the latent embeddings retain subject-specific or sample-specific information. This finding highlights that the internal structure of the model, shaped by the unique neural signatures of the training data, can serve as a vector for privacy leakage that is distinct from the raw signal itself.

For the client-identity inference attack, the objective was to determine which specific federated client generated a given model update vector. This represents a higher-level privacy threat than standard membership inference, as it compromises the anonymity of the participating subjects. The attack involved collecting gradient update vectors from all communication rounds and assigning them to their true source client. Because these update vectors are high-dimensional and noisy, principal component analysis was applied to compress them into a low-dimensional space, preserving dominant variance while improving numerical stability. The high success rates of this attack in the non-private setting demonstrate that federated model updates can encode subject-specific neural signatures, allowing an adversary to link shared parameters back to individual users.

The study also examined the relationship between model generalization and privacy risk through regression analysis of the training-testing loss gap. In the MI1 dataset, a significant positive association was found, suggesting that models with larger generalization gaps leaked more record-level membership information. This aligns with the hypothesis that overfitting encourages reliance on idiosyncratic neural patterns, making it easier for an attacker to distinguish between training and non-training samples. However, the absence of a significant relationship in the MI2 dataset suggests that privacy risk is not solely driven by poor model performance. Instead, the intrinsic subject-specific characteristics of EEG signals can create a baseline vulnerability that persists even when the model generalizes well, indicating that high decoding accuracy does not necessarily equate to strong privacy protection.

These findings underscore the complexity of securing neural data in federated environments. While differential privacy effectively mitigates leakage from gradient and client-level attacks, the persistence of record-level and feature-level risks suggests that a multi-layered defense strategy is necessary. The study provides a systematic empirical benchmark for evaluating these risks, offering a foundation for future research into more robust privacy mechanisms that can address the unique statistical properties of EEG data in brain-computer interface applications.

Subject of Research: Privacy risks and mitigation in federated learning for EEG-based brain-computer interfaces

Article Title: Evaluating multi-level membership inference risk in federated EEG learning

Article References: Khanam, T., Siuly, S., Wang, K., Whittaker, F., & Wang, H. (2026). Evaluating multi-level membership inference risk in federated EEG learning. Brain Informatics, 13(1), Article 26. https://doi.org/10.1186/s40708-026-00313-1

Image Credits: AI Generated

DOI: 10.1186/s40708-026-00313-1

Keywords: federated learning, EEG, differential privacy, brain-computer interface, membership inference, neural data privacy, machine learning security, Evaluating, multi-level, membership, inference, risk