QIF-T0103
highSSVEP Frequency Hijack via Imperceptible Display Flicker
Tier 3 — Demonstrated (Lab-proven)
Legacy status: DEMONSTRATED
Exploit the SSVEP pathway by injecting imperceptible display flicker (above critical flicker fusion threshold, ~60Hz) that drives visual cortex responses without user awareness. Proven: Ming et al. 2023 demonstrated 60Hz flickers invisible to users produce classifiable SSVEP responses at 52.8 bits/min. Attack scenarios: (1) inject false BCI commands by matching SSVEP control frequencies, (2) jam BCI operation with broadband visual noise, (3) exfiltrate neural state via stimulus-response probing, (4) trigger photosensitive seizures at epileptogenic frequencies. Unlike T0040 (neurophishing via app-layer stimuli), this attack operates at the display hardware level and requires no BCI application cooperation. The display itself becomes the attack vector.
Technique Details
- Tactic
- QIF-C.EX
- Status
- DEMONSTRATED
- Bands
- S3, I0, N7
✚ Therapeutic Application
Display renders imperceptible flicker patterns at frequencies matching SSVEP response bands. Visual cortex phase-locks to stimulus below conscious awareness. BCI decoder interprets evoked response as user command or is jammed by broadband interference.
Clinical Analog
High-frequency SSVEP-based BCI for locked-in patients
Treats
- ALS/locked-in syndrome communication (SSVEP-BCI, FDA investigational)
- attention assessment via covert SSVEP monitoring
- visual pathway integrity testing
Neural Impact
3 of 7 neural bands affected
Drag to rotate. Click a region to learn more.
Click or hover over a glowing region to see the attack techniques targeting it and their severity.
DSM-5-TR Diagnostic Mappings
Diagnostic category references for threat modeling, not diagnostic claims.
Pathway: S3 (display) → I0 (retina/optic nerve) → N7 (visual cortex V1) → BCI decoder
Following Poldrack (2006), brain region disruption does not uniquely predict psychiatric outcomes.
Scoring
NISS:1.1/BI:L/CR:H/CD:H/CV:I/RV:P/NP:T CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:L/SC:H/SI:L/SA:N Governance
Neurorights at Risk
This technique threatens 5 of the 4 proposed neurorights (Ienca & Andorno, 2017).
FDORA §3305 Compliance
- ! CVSS cannot express neural-specific impacts
- ! No FDA pathway for consumer sensor exploitation
- ! Consent complexity under-matches neural impact (CCI/NISS mismatch)
Population Vulnerability
CRB vulnerability adjustment (γ=0.30) accounts for age, diagnosis severity, consent capacity, and device dependency.
| Population | NISS Base | Adjusted | Severity | Delta |
|---|---|---|---|---|
| Adult (Default) | 6.0 | 6.0 | Medium | - |
| Child (10yr) + ADHD | 6.0 | 7.1 | High ▲ | +1.06 |
| Adult with ALS | 6.0 | 7.0 | Medium | +0.97 |
Validation Status
Theoretical / Not yet validated. This technique has not been independently tested. See the validation dashboard for what has been tested.