About — Qinnovate

About Me

I'm Kevin Qi, a security engineer and aspiring neuroethics researcher. I started this project with a question: what happens to a patient when their brain-computer interface fails to protect them?

Not what happens to the data. Not what happens to the device. What happens to the person. I couldn't find a framework that answered that, so I built one. This is the OSI of Mind.

I've been building on the web since I was 12. In the early 2000s, the internet was going through a pivotal transition — from chaotic, animated GeoCities-style pages to structured, semi-professional layouts for forums and portals. I co-founded a design studio called AGFX, and we were at the forefront of that shift. We were part of the first generation of digital natives who proved that high-level technical collaboration didn't require a physical office — we built AGFX through IRC, AIM, and the Envisionboard (InvisionFree) support forums we managed.

That question about BCI safety didn't come from a textbook. A B12 deficiency damaged my nervous system. I couldn't walk for months. My hands were uncontrollable. I didn't feel like myself. Once you've felt your own nervous system fail you, the idea of plugging a machine into that system carries weight. It also gave me something I didn't expect: a personal understanding of how the brain adapts, breaks, and heals. That perspective is what drives this work.

The Origin

In 2021, COVID collided with PTSD from a traumatic event years earlier. My cognition fragmented in ways I could feel: memory unreliable, threat response stuck on high, my sense of self distorted. As a security engineer, the pattern reminded me of something — the kind of disruption I'd worry about if a brain-computer interface were compromised. Except no device was involved.

That experience raised a question, not an answer. If my own biology could produce cognitive disruption this severe without any external device, what questions should we be asking before we connect programmable devices to the same neural pathways?

Why Now

Neuralink has implanted chips in human patients. Synchron's Stentrode is in FDA trials. Consumer EEG headsets sit on store shelves. These devices are tested for safety and efficacy — but no public framework exists to audit what they can do to a mind.

This dual-use reality means BCI security is not an engineering problem. It is a patient rights problem. Every proposed neurorights framework — cognitive liberty, mental privacy, psychological continuity — can be violated through technical pathways that already exist. The question is whether we build governance before the harm, or after.

IEEE's BMI standards roadmap (IEEE Brain Initiative, 2020) identifies BCI-specific security standards as an open standardization gap. This atlas aims to fill that gap. Open source. Open data. Ready for peer review.

Why Neuroethics

The technical problems in BCI security are real, but the harder problems are human. Who decides what a neural device is allowed to do? What does informed consent look like when the technology interfaces with cognition itself? How do we ensure these devices serve patients equitably, not just the institutions that build them?

These are governance questions. Policy questions. Ethics questions. And they need people at the table who understand both the technology and its human implications.

My background is in cybersecurity. I understand layered defense, threat modeling, and vulnerability analysis. But what drew me to neuroethics is the recognition that the most important safeguards for brain-computer interfaces will not be technical. They will be the policies, consent frameworks, and ethical guidelines that determine how these technologies are developed, tested, and deployed. I want to help build those.

What I Built

I catalogued every known BCI attack technique I could find: 60 at first, merged from three inventories. Then I asked: what do computers and neurons actually have in common? The answer was physics. Signals operating at different scales, from electromagnetic fields up through cortical oscillations. That became QIF's layered architecture.

When I mapped those techniques across the frequency bands, gaps appeared everywhere. The catalogue grew to 109. I traced each technique through neural pathways, cognitive functions, and psychiatric outcomes. CVSS wasn't built for this. It can't express whether damage is reversible or whether the patient can detect the violation. So I designed NISS for neural harm.

78 of those 109 techniques have direct therapeutic counterparts. The same stimulation that causes involuntary motor activation as a side effect treats Parkinson's therapeutically. The boundary between risk and treatment is not the mechanism. It is consent, dosage, and oversight. That insight is what convinced me that BCI safety is fundamentally a governance problem, not just an engineering one.

The Hourglass

The framework is an 11-band, 3-zone architecture with the Neural Interface (I0) at its waist. Biology above. Silicon below. The TARA Atlas maps 109 techniques across this hierarchy, each scored and traced to clinical outcomes through the Neural Impact Chain.

I was inspired by Francis Preston Venable's The Development of the Periodic Law (1896), found in a bookstore in Istanbul. It documented how the periodic table went through dozens of visual representations before arriving at the grid we know today. Mendeleev didn't just organize what was known. He left gaps for what wasn't. Those gaps predicted elements that were later discovered. QIF follows the same principle: organizing what we know, highlighting what we don't, evolving as discovery fills the gaps.

About This Work

Transparency notice. I am not a mathematician, physicist, or neuroscientist. I am a security engineer with ~15 years of IT and security infrastructure experience who recognized that brain-computer interfaces have no published security framework and decided to build one.

AI tools (primarily Claude, with Gemini and ChatGPT for cross-validation) were used extensively throughout this project: for mathematical derivations, physics modeling, literature synthesis, code generation, and writing. Every AI-derived claim — especially equations, engineering benchmarks, and clinical mappings — should be treated as proposed and unvalidated until independently verified by domain experts.

What I bring is the security architecture, threat modeling methodology, and the question that started it all: what happens to the person when their neural interface is compromised? The framework, threat taxonomy, and governance structure are my contributions. The math and physics require expert review. This work is offered in good faith as a starting point for that review.

How AI Was Used

AI (predominantly Claude, alongside Gemini and ChatGPT) helped me lay out ideas, validate research, and tie together pieces I mapped out. The architecture, scoring, clinical mappings, and cross-domain connections are mine. AI helped get the work out of my head and into a form others can evaluate.

The Transparency Statement documents every AI interaction. The Derivation Log traces 93 entries of human decision-making so any reviewer can follow the reasoning and challenge it.

What Comes Next

I built the technical foundation. 109 techniques catalogued, scored, and mapped to clinical outcomes. An 11-band architecture grounded in physics. A scoring system that extends CVSS for neural harm. That foundation is open source and available for any research group to test, validate, or refute.

What I want to focus on next is the policy layer: governance frameworks, consent models, regulatory alignment, and ethical guidelines that ensure BCI technologies are developed safely and equitably. That is why I'm pursuing a master's in Neuroethics and Bioethics. The technical work showed me where the risks are. Graduate study will help me understand how to build the protections.

The goal is not to provide final answers. It's to start the right questions, and to make this space accessible for researchers, clinicians, and policymakers who want to contribute without needing to be security specialists first.

Collaborate

This is a conversation I cannot have alone. I'm looking for academics, researchers, neuroscientists, and policymakers to refine QIF and establish ethical guidelines for where technology should and shouldn't go. The gaps are the research agenda.

If you work with neural data, BCI design, neuroethics, health policy, or regulatory compliance, .

From designing web 1.0 to securing web 5.0.