Combating the “Neuro-Alchemy Chain”: A Threat Modeling and Defense Framework for Artistic Brain-Computer Interfaces

Sammanfattning

Brain-Computer Interfaces (BCIs) are increasingly deployed in artistic settings, where participants' neural signals are used to generate real-time aesthetic experiences. While such applications are often framed as creative and participatory, they introduce distinctive security and governance challenges. This thesis identifies a novel threat termed "experiential exploitation", where cognitive and affective states are systematically extracted, semantically refined, algorithmically valued, and potentially recirculated across contexts under conditions of immersive engagement and institutional power asymmetry. While existing privacy-enhancing technologies (PETs) and legal frameworks like GDPR provide robust protections against unauthorised data reuse, they cannot prevent exploitation occurring within declared artistic purposes through semantic deepening, hidden comparative valuation, or longitudinal profiling. To systematically identify the neuro-alchemy chain across the neural data lifecycle, this thesis develops the five-stage Experiential Exploitation Kill Chain (EEKC) and extends STRIDE with an additional experiential threat category (STRIDE-E). The Counter-Alchemy Framework is designed around three defensive layers: source capability minimisation through a Neural Obfuscation Circuit (NOC); semantic integrity protection via Experience-Binding Hash (EBH) and Context-aware Access Control (CAAC); and governance mechanisms implementing non-monetary accountability with a participant-initiated reverse-clearance protocol. The framework is validated through proof-of-concept Python prototypes, privacy-utility tradeoff experiments on public EEG datasets, and a scenario-based walkthrough illustrating how the framework constrains exploitation pathways across EEKC stages. Guided by Design Science Research (DSR) methodology, this thesis contributes a novel threat model for artistic BCIs and a multi-layered technical architecture aimed at preserving contextual integrity and participant agency in neuro-artistic practice, offering guidance for artists, institutions, and policymakers concerned with the ethical deployment of artistic BCIs.