Every transformative technology gets one chance to build its foundation right. The internet did not take that chance. TCP/IP shipped without authentication. HTTP shipped without encryption. DNS shipped without integrity verification. We spent the next four decades bolting on security after the fact. TLS, DNSSEC, OAuth, zero-trust architectures. Each one a patch on a foundation that was never designed to be secure.

Brain-computer interfaces are at that same inflection point. The first cortical implants are in human skulls. The first commercial devices are shipping. And the security architecture is, once again, an afterthought. The difference this time is that the attack surface is not a credit card number or a social security record. It is the human nervous system. There are no rollbacks for neural tissue damage. There is no “change your password” for a compromised sensory cortex.

This is not a warning. It is a proposal.

Every security defense introduces new attack surface. This is inevitable. SSL was designed to secure the web and gave us Heartbleed. Firewalls were designed to filter traffic and became misconfiguration targets. Password managers were designed to store credentials, and LastPass was breached. The defense paradox is not an argument against defense. It is a design constraint: minimize the number of layers, because each layer is a place the paradox can bite.

The same physics that makes a BCI technique dangerous also makes it therapeutic. Transcranial magnetic stimulation treats depression and induces seizures. Deep brain stimulation manages Parkinson's and causes involuntary movement. The mechanism is identical. The difference is intent, dosage, and governance.

Security and clinical safety are not separate problems. They are two views of the same system. A framework that only catalogs threats misses half the picture. A framework that only tracks therapies misses the risks. QIF maps both, for every technique, in a single proposed framework.

All publications are released under the Apache 2.0 license. Neural security standards are too critical to be proprietary. The people whose brains will be connected deserve to understand exactly how they are protected.

We address this with three interlocking pillars:

3.1 Where the Architecture Comes From

The 11-band model was not designed from first principles. It was derived by converging three established layered architectures:

1. The OSI model (ISO/IEC 7498) — 7 layers that decompose a network into physical, data link, network, transport, session, presentation, and application. Every security framework for digital systems uses some variant of this decomposition. But the OSI model stops at the wire. It has no concept of the biological system connected to the other end.
2. Neural systems anatomy (Kandel et al., Principles of Neural Science, 6th ed., 2021) — The brain is not a single structure. It is a hierarchy of functionally distinct regions: spinal cord, brainstem, cerebellum, diencephalon (thalamus/hypothalamus), basal ganglia, limbic system, and neocortex. Each has different cellular architecture, different oscillatory regimes, and different clinical consequences if compromised. The 7 neural bands (N7–N1) map directly to this established neuroanatomical hierarchy, with thalamic relay logic (Sherman & Guillery, 2006) providing the gating mechanism between cortical and subcortical layers. An architecture that treats “the brain” as one layer misses this entirely.
3. The bio-digital boundary (Deering, 2001; the Internet hourglass principle) — Where electrodes touch tissue, signals transition from ionic to electronic. This is not a clean handoff. It is a physical interface with its own impedance characteristics, its own failure modes, and its own threat profile. The I0 band applies Deering’s hourglass insight — that all traffic must pass through a narrow waist — to the electrode-tissue boundary, where every neural signal crosses from biology to silicon. Neither the OSI model nor neuroanatomy alone accounts for this zone.

QIF maps all three onto a single stack. The 7 neural bands (N7–N1) come from neuroanatomy, ordered by clinical severity. The 3 synthetic bands (S1–S3) come from the electronic processing chain, analogous to OSI's lower layers. The interface band (I0) is the bridge — the electrode-tissue boundary where biology becomes data. The result is an 11-band, 7-1-3 asymmetric hourglass: wide at the top (neural complexity), narrow at the center (physical bottleneck), and wider at the bottom (synthetic processing).

3.3 Architecture

The QIF Hourglass is an 11-band architectural model that maps all potential threat surfaces within a BCI, from the highest cortical structures through the electrode-tissue boundary and into the synthetic processing chain.

Seven bands are neural (N7 Neocortex through N1 Spinal Cord), representing biological tissue with distinct functional properties and vulnerability profiles. One band is the interface (I0), the electrode-tissue boundary where biological signals are converted to digital data, and where the highest concentration of techniques converges. Three bands are synthetic (S1 Near-Field through S3 Far-Field), covering the electronic processing, host compute, and communication chain.

The hourglass shape is deliberate. I0, the neural interface band, constitutes the architectural chokepoint. All signals must traverse this point. With over half of the 161 catalogued techniques targeting this band, it represents the majority of the total threat surface. Securing I0 is the single highest-leverage investment in BCI safety.

TARA (Therapeutic Applications & Risk Assessment) is a dual-use atlas of 161 BCI techniques. Every entry is three things at once: a security threat, an ethical concern, and a potential therapy. Of these, 102 have confirmed therapeutic applications with published clinical evidence. 76 are mapped to DSM-5-TR psychiatric diagnoses. This is not a threat registry with clinical notes appended. It is a single atlas built from the ground up to serve security engineers, clinicians, researchers, and regulators from the same source of truth.

TARA exposes each technique through four explicit projections:

• Modality — Attack severity, status, and physical coupling mechanism
• Clinical — Therapeutic analog, FDA status, evidence level, treated conditions
• Diagnostic — DSM-5-TR diagnostic mapping via the Neural Impact Chain
• Governance — Consent tier, regulatory requirements, data classification

Each technique can be analyzed through any of these projections. Interactive exploration of the TARA grid reveals all four perspectives for a given technique: its neural effects, potential therapeutic applications, diagnostic mappings, and applicable regulations.

TARA organizes 161 techniques across 7 operational domains and 17 tactics using a QIF-[Domain].[Action] format:

Of the 161 techniques, 102 have confirmed therapeutic applications — published clinical use with evidence. Another 19 are probable (under active investigation) and 10 are possible (theoretical mapping exists). Only 30 are pure silicon-only vectors with no known tissue analog.

NISS is a proposed vulnerability scoring system built for neural devices. CVSS measures three things: confidentiality, integrity, availability. NISS measures six:

NISS scores are computed as a weighted average of all assessed metrics, normalized to a 0–10 scale. Default weights: BI=1.0, CR=0.5, CD=0.5, CV=1.0, RV=1.0, NP=1.0. CR and CD are weighted at 0.5 each to maintain backward compatibility with v1.0’s single Cognitive Integrity dimension, keeping cognitive contribution at 20% of the total score. Severity bands align with CVSS thresholds: 0.0 (None), 0.1–3.9 (Low), 4.0–6.9 (Medium), 7.0–8.9 (High), and 9.0–10.0 (Critical). Four context profiles (Clinical, Research, Consumer, Military) override these defaults for domain-specific scoring.

The current NISS scoring maps attack outcomes to DSM-5-TR diagnostic categories for threat modeling purposes. This mapping is useful but incomplete. DSM-5-TR is a psychiatric classification system. It was not designed to capture the full spectrum of neurological disruption that a BCI attack could produce.

Sensory modality disruption. A BCI attack that corrupts olfactory processing — causing phantosmia, anosmia, or parosmia — has no primary DSM-5-TR diagnostic category. The same is true for vestibular disruption, somatosensory attacks, and gustatory hallucinations. These are clinically documented neurological conditions with ICD-11 codes and known neural pathway correlates. They are not psychiatric disorders.

Neurological disorders absent from DSM. Conditions like tinnitus, central pain syndrome, cortical blindness, prosopagnosia, spatial neglect, and movement disorders are well-characterized in neurology. A BCI attack targeting the relevant circuits could induce or exacerbate any of them.

Traditional cybersecurity scoring assumes attacks are discrete events. Neural attacks break this assumption. The brain is a learning system. It rewires itself in response to sustained input. An attack that delivers malicious stimulation patterns over time does not just cause momentary disruption — it causes the brain to adapt to the malicious pattern, creating lasting neural pathway changes that persist after the attack ends.

NP values (expanded from 3 to 4 levels in v1.1.1):

Current severity distribution across 161 techniques: 24 structural, 6 partial, 38 temporary, 67 none. The 4-level NP scale provides finer granularity. Techniques previously scored as structural (NP:S) may now score as partial (NP:P) where recovery is possible with intervention.

Why NP has no traditional analogue. A firewall breach does not make future breaches easier by physically restructuring the target network. A neural attack with NP:S does exactly that. The brain adapts through Hebbian learning, making the attack’s effects self-reinforcing. For these techniques, “turn it off” is not sufficient remediation. The damage persists after the device is removed because the damage is encoded in the biology, not the technology.

The Neural Impact Chain (NIC) is a six-stage mapping that traces every technique from its physical mechanism to its potential clinical outcome for threat modeling purposes. For each entry in TARA, the chain identifies the targeted hourglass band, the affected neural structure, the disrupted cognitive or motor function, the resulting NISS severity score, and the corresponding DSM-5-TR diagnostic reference. These references illustrate the potential severity of sustained attack patterns; they are not diagnostic predictions.

To our knowledge, this represents a systematic mapping from cybersecurity severity to clinical outcome references. It traces a structured pathway: specific techniques, applied to specific neural bands, produce functional impacts that correspond to recognized clinical conditions. A security engineer can see that a technique targeting the limbic system (N6) with high cognitive integrity impact references mood and trauma-related disorders. A clinician can see that the same attack vector shares its mechanism with an FDA-approved therapy. These references must be interpreted with caution — neural correlates do not prove causation, and the brain's complexity means that identical stimulation can produce different outcomes across individuals.

This is the bridge between cybersecurity and clinical neuroscience that we found missing from existing frameworks.

Ienca & Andorno (2017) proposed four neurorights: Mental Privacy, Cognitive Liberty, Mental Integrity, and Psychological Continuity. Chile enshrined them in law. The OECD published neurotechnology governance guidelines (2019). But to our knowledge, no published work had tested them against a systematic threat taxonomy.

Every technique in the TARA atlas is now mapped to the affected neurorights through a systematic, multi-layer process: UI category provides the primary signal, DSM-5-TR cluster adds overlays, and NISS vector components refine the result. This mapping is deterministic and reproducible — the same technique always maps to the same rights.

Running 161 techniques through this process confirmed all four established rights from Ienca & Andorno (2017). QIF operationalizes Mental Integrity with engineering-level signal dynamics specifications and Mental Privacy with data-lifecycle specifications. QIF also maps these neurorights onto the CIA triad (MP = Confidentiality, MI = Integrity) and demonstrates both violations via a disclosed vulnerability in a BCI-adjacent streaming library. Cross-validated against six established frameworks (Ienca & Andorno 2017, Yuste/NeuroRights Foundation 2017, Chile Law 21.383, UNESCO 2025 Recommendation, Farahany 2023, Bublitz 2022):

CIA Triad Mapping: QIF maps Ienca & Andorno's neurorights onto the CIA triad: Mental Privacy = Confidentiality (don't read my neural data), Mental Integrity = Integrity (don't write into my neural signals). A disclosed vulnerability in a BCI-adjacent streaming library demonstrates both violations in a single exploit chain: Phase 2 (exfiltrate neural data) = MP violation, Phase 3 (inject false signals) = MI violation.

Mental Integrity (MI) — QIF Operationalized: QIF provides engineering-level specifications for Mental Integrity (Ienca & Andorno, 2017), including signal dynamics protections. Some attacks don't break neural function; they retune it. Gradual drift, neurofeedback falsification, and baseline adaptation poisoning reshape the brain's homeostatic equilibrium. QIF operationalizes MI with measurable specifications for detecting these dynamical retuning attacks. 101 techniques map to MI.

Mental Privacy (MP) — QIF Operationalized: QIF provides engineering-level specifications for Mental Privacy (Ienca & Andorno, 2017), including data-lifecycle protections. Multi-modal biometric fusion attacks correlate neural data with gait, voice, and typing rhythm. QIF operationalizes MP to cover cross-modal re-identification and the right to consent to each data modality independently.

Policy-Layer Rights

Three additional neurorights proposed by Yuste and the NeuroRights Foundation (2017) and reinforced by UNESCO's 2025 Recommendation — equitable access to mental augmentation, protection from algorithmic bias, and free will — are not mapped in the threat taxonomy. These are distributive justice and governance concerns: no attack technique directly violates “fair access,” and algorithmic bias arises from systems processing neural data, not from attacks on the interface itself. Free will substantially overlaps with Cognitive Liberty when mapping threats to harm. These rights are addressed at QIF's governance layer rather than the security layer. See Governance → Neuroethics Alignment for the full mapping.

Each technique within the TARA atlas is assigned a consent tier reflecting the minimum regulatory oversight necessary for its deployment. These tiers are derived directly from NISS scores: higher biological impact, lower reversibility, and greater consent violation require stricter governance.

Section 3305 of the Food and Drug Omnibus Reform Act (FDORA, 2022) defines a "cyber device" as one that (1) contains software, (2) can connect to the internet, and (3) could be vulnerable to cybersecurity threats. Every technique in TARA is classified against this three-prong test.

Section 524B requires five categories of cybersecurity documentation. Each technique is mapped to the requirements it is relevant to:

The regulatory coverage score (0.0–1.0) measures how well existing standards cover each technique. A score of 0.8 means current FDA pathways, IEC standards, and privacy regulations adequately address the risk. A score below 0.5 indicates a major regulatory gap — the technique represents a neural-specific threat that pre-FDORA frameworks were not designed to handle. 74 of 161 techniques fall below this threshold.

The top gaps are structural, not incidental: CVSS cannot express neural-specific impacts for the majority of techniques, and no FDA pathway exists for consumer sensor exploitation in the S-domain. These are precisely the gaps that TARA and NISS were built to fill — providing the neural threat catalog and impact scoring that Section 524B mandates but existing standards do not supply.

BCIs that use AI for stimulation decisions, signal decoding, or adaptive learning are subject to emerging regulation that spans AI ethics, medical device law, and neurotechnology governance. This section maps the frameworks that will define the legal environment QIF operates within.

The Neural Sensory Protocol (NSP) is a proposed post-quantum security protocol specifically designed for BCI data links. It protects every neural data frame using ML-KEM key exchange (NIST’s quantum-resistant replacement for classical key exchange, standardized as FIPS 203), ML-DSA digital signatures (the quantum-resistant replacement for RSA and ECDSA signing, FIPS 204), and AES-256-GCM authenticated encryption (which both encrypts data and cryptographically verifies it has not been tampered with in transit). Power modeling against the Neuralink N1 reference platform estimates an overhead of approximately 3–4% of a 40 mW implant budget (AI-derived estimate, hardware validation pending).

NSP defines five independent defense layers. Each layer operates independently — failure of one does not compromise the others:

The protocol is specified across three device tiers: implanted (most constrained, ≤40 mW), wearable (moderate power budget), and external (unconstrained). Not all tiers require all layers. Consumer wearables implement Layers 1–3, while implanted devices implement all five. Each tier uses the same cryptographic primitives but with different parameter sets and duty cycles.

Post-quantum key sizes represent the primary implementation challenge. ML-KEM-768 public keys are 1,184 bytes, 18 times larger than classical X25519 keys (the standard used in most encrypted connections today). Runemate, a purpose-built compression layer for BCI payloads, mitigates this by encoding neural interface content (visual, auditory, haptic) through a closed-vocabulary DSL, achieving 65–90% compression and net bandwidth savings over classical transport for typical BCI content exceeding 23 KB.

Scope: NSP secures the I0 data link, the wireless boundary between implant and external device. It does not address physical-layer failures such as electrode migration, chronic immune response, or biocompatibility degradation. These are clinical monitoring concerns outside the protocol’s threat model.

Web browsers are rendering engines built for screens. They parse HTML into a Document Object Model (DOM), execute JavaScript in a sandboxed runtime, apply CSS stylesheets through a cascade algorithm, composite visual layers, and rasterize the result onto a pixel grid. This pipeline — which evolved from Tim Berners-Lee’s original WorldWideWeb (1990) through Mosaic, Netscape, and the modern Chromium/WebKit duopoly — assumes a rectangular display with fixed pixel density, a pointing device, and a keyboard.

None of these assumptions hold for a cortical visual prosthesis.

A cortical implant drives an electrode array on the surface of the primary visual cortex (V1). The “pixels” are phosphenes — perceived spots of light induced by electrical stimulation of cortical tissue. Their arrangement is not a rectangular grid but a retinotopic map that varies between individuals based on cortical folding patterns. The “rendering engine” cannot be a browser because there is no DOM to parse, no CSS to cascade, no pixel grid to rasterize onto. The content must be compiled directly into electrode-addressable stimulation patterns — a fundamentally different pipeline.

Beyond architectural mismatch, browsers carry an attack surface that is unnecessary and dangerous for neural devices:

Each layer of the browser stack represents a class of vulnerabilities accumulated over three decades of web development. These vulnerabilities exist because browsers must execute arbitrary code from arbitrary sources, a requirement that is antithetical to the security needs of an implanted medical device.

Runemate eliminates the browser entirely. Content is compiled from a declarative, non-Turing-complete DSL (Staves) into compact bytecode, validated against TARA safety bounds at compile time, encrypted via NSP, and delivered directly to the on-device interpreter (Scribe). There is no arbitrary code execution. There is no third-party extension model. There is no DOM.

App stores introduce three categories of risk that are unacceptable for neural devices:

The terminal is the proposed primary interface for neural devices. It provides:

Traditional interfaces impose a navigation paradigm: menus, scroll, tap, swipe. These paradigms were designed for fingers on glass. They do not translate to a cortical interface where input may arrive via motor cortex BCI, subvocalization, or eye tracking.

The terminal provides primitives — commands, pipes, scripts — and lets the patient compose their own navigation model. One patient might prefer spatial audio landmarks. Another might use haptic pulses as navigation anchors. A third might develop a completely novel interaction pattern that no UX designer anticipated.

This is not a design limitation. It is a design principle. The terminal does not force someone new to the system to learn a prescribed way of navigating. Instead, it adapts — autodidactically — to how the user thinks and moves. The user teaches the system, not the other way around.

The same philosophy made Linux the foundation of every server, every supercomputer, and every Android phone: give people the tools, and they build what they need.

When a device IS the patient’s sensory system, the conventional user-vendor relationship is inadequate. The patient is not a “user” in the consumer technology sense. They are a person whose perception depends on the correct, continuous, and trustworthy operation of an implanted system. This relationship demands four operational rights:

In a proposed neural OS, the patient controls AI through subvocalization, thinking commands rather than typing them. Subvocalization BCI is an experimental prototype (e.g., MIT AlterEgo) that captures intended speech or motor commands before they reach the muscles, enabling silent, private interaction with the system.

The AI is the tool. It processes, suggests, retrieves, compiles, renders. But the decision to act, the consent to a thought becoming an action, the creative impulse that initiates a query or dismisses a suggestion — that is the human. That is what the terminal architecture protects.

Without this boundary, AI does not augment human capability. It replaces it. The patient becomes a passenger in their own perceptual system, receiving whatever the algorithm decides to deliver, with no mechanism to inspect, reject, or redirect.

The distinction is operational:

The terminal ensures the first model. The absence of a terminal enables the second.

If we do not have free will through consent and agency, then who is driving the car if we are not steering?

This is not a philosophical abstraction. It is a design constraint. A neural interface that delivers content without patient-initiated consent is a system where the patient is cargo, not the driver. The difference between a tool and a cage is whether the person holding it chose to pick it up.

Neural interfaces must be steering wheels, not conveyor belts. The terminal is the steering column — the mechanical linkage between the patient’s intent and the system’s behavior. Remove it, and the patient is along for the ride.

Creativity requires agency — the ability to combine ideas in unexpected ways, to follow a thought that no algorithm would predict, to say “no, show me something else.” If the AI drives and the patient rides, creativity does not diminish — it atrophies. Not because AI cannot generate, but because the human loses the practice of choosing. And a capacity that is not exercised degrades.

This is particularly acute for neural interfaces because the input channel (motor cortex, subvocalization) is also a neural pathway. If the AI is both reading the patient’s intent and generating the patient’s experience, the boundary between “what I thought” and “what the system suggested” becomes ambiguous. The terminal provides a clean separation: the patient composes commands, the system executes them. Intent flows in one direction. Content flows in the other. The boundaries are explicit.

Neurorights (MP, CL, MI, PC, EA) are the formal expression of this principle. But the terminal is what makes them enforceable. Without a CLI, neurorights are policy. With a CLI, they are access control.

Assistive autonomy exists on a spectrum. The automotive industry has standardized this spectrum (SAE J3016), and the mapping to neural interfaces is instructive:

Levels 1–2 are clearly therapeutic. Level 5 is clearly a violation of cognitive liberty. The design challenge — and the ethical battleground — is Levels 3–4: systems that operate autonomously within a bounded domain, with the patient in a supervisory role.

Lane-keep assist is Level 1. The system nudges; the driver can override instantly. Lane-keep control is Level 2. The system actively steers; the driver must exert force to override. For a nerve-damage patient whose BCI corrects their gait, Level 2 is appropriate. The system compensates for damaged motor pathways, and the patient retains the ability to override (e.g., to stop, turn, sit down).

The question is: what happens when the same architecture is applied to cognitive function?

Consider a patient with spinal nerve damage who receives a BCI for motor restoration. The following escalation is medically plausible:

Each step is individually reasonable. A clinician could justify each one. Together, they are a ramp from assistive tool to autonomous controller. And the patient initiated every step.

The title references Masamune Shirow’s 1989 manga (and Mamoru Oshii’s 1995 film), which posed the question directly: if a human consciousness (the “ghost”) runs on a cybernetic body (the “shell”), and the shell has rules the ghost cannot override, is the ghost free?

This is not science fiction when applied to neural interfaces. If the kernel (Neurowall) has immutable safety rules that the patient cannot override, then the patient’s consciousness operates within constraints set by the system’s designers. The manufacturer, the regulator, the clinician: some combination of these entities decided what the patient is and is not allowed to do with their own neural device.

The resolution proposed here is: the kernel protects the hardware, not the software.

A seatbelt does not control where you drive. It prevents the physics of a crash from killing you. The immutable kernel layer works the same way:

These are not cognitive restrictions. They do not say “you cannot think that.” They say “the signal cannot physically exceed what your tissue can survive.” The ghost is free. The shell has material limits.

But the escalation scenario in Section 12.2 breaks this clean separation. When the patient asks to quit alcohol, the relevant “tissue” is the reward circuit. The “safe amplitude” for modifying dopaminergic pathways in the ventral tegmental area (VTA) or nucleus accumbens (NAc) is not a settled question — it is an active area of neuroscience research with conflicting results across studies. No standardized safe parameters have been established by regulatory bodies; published parameters are from experimental studies and require subject-specific calibration. And “run faster than body allows” puts the motor cortex in conflict with the musculoskeletal system, which has its own damage thresholds that the neural kernel cannot measure.

The proposed resolution is a five-tier guardrail model that separates immutable physical safety from configurable therapeutic and policy decisions:

The kernel (Neurowall) enforces Tiers 1–2. These limits cannot be overridden by the patient, the clinician, the manufacturer, or a software update. They are derived from the physical and biological properties of neural tissue.

Tiers 3–5 live in the capability system, where consent is explicit, domain-scoped, time-bounded, and revocable. The patient can expand their BCI’s scope, but only through a deliberate, auditable consent process, never through scope creep.

Applying the five-tier model to the escalation scenario in Section 12.2:

The patient’s walk-assist BCI was consented under Tier 4 for motor cortex (M1) only. When they say “help me quit painkillers”:

When the patient then says “help me run faster than my body allows”:

The patient’s cognitive liberty is preserved — they can ask anything. The system’s response is determined by the tier hierarchy: physics first, biology second, therapeutics third, consent fourth, policy fifth.

The escalation problem raises a fundamental question: if we allow assistive control over motor neurons (gait correction), how do we prevent the same architecture from being applied to cognitive neurons (thought modification)?

The honest answer is: we cannot prevent it architecturally. A neuron is a neuron. The Hodgkin-Huxley model (1952) describes the same ion channel dynamics in motor cortex and prefrontal cortex. An electrode that can stimulate M1 to correct a gait can, with different parameters and different placement, stimulate dorsolateral prefrontal cortex (DLPFC) to modify executive function.

The constraint must be organizational, not physical:

The distinction between motor and cognitive neurons is not architectural — it is procedural. The five-tier model enforces that distinction through consent gates, not through hardware limitations. This is an honest acknowledgment that the technology capable of restoring movement is the same technology capable of modifying thought. The guardrails must be as strong as the capability they constrain.

Passwords assume a user who can type, a device with a keyboard, and a transmission channel that can be secured. None of these assumptions hold for implanted neural devices:

The security architecture must be passwordless by design, not as a convenience feature, but as a medical necessity.

The NSP handshake establishes a session using ML-KEM-768 (NIST FIPS 203, finalized August 2024) for key encapsulation and ML-DSA-65 (NIST FIPS 204, finalized August 2024) for digital signatures. The device’s identity is a hardware-bound keypair provisioned at implantation and stored in a secure enclave on the implanted processor.

There is no password to remember, no token to carry, and no credential to phish. The device proves its identity through a cryptographic challenge-response that requires possession of the hardware key, which cannot be extracted from the secure enclave without physical access to the implanted chip.

Post-quantum algorithms are specified because implant operational lifetimes vary by type: cochlear implants are designed for lifetime use (25+ year track records), DBS leads last 10–20 years, but intracortical microelectrode arrays (e.g., Utah arrays) degrade within 1–5 years due to gliosis. Even the shorter-lived devices exceed the projected timeline for cryptographically relevant quantum computers. A device implanted today must be secure against threats that emerge in 2036–2046.

The second authentication factor is the patient themselves. Neural biomarkers, unique patterns in electrophysiological signals, are as individual as fingerprints and as difficult to forge. Short-term stability (30-day retest) has been demonstrated in lab settings. Long-term stability across months, emotional states, and aging remains an open research question.

This is not a login ceremony. It is continuous, passive verification that the person using the device is the person it was calibrated for. The biomarker check runs continuously in the background, consuming minimal additional processing because the neural signals are already being read for the device’s primary function.

If biomarker drift exceeds the patient’s baseline envelope (as established during calibration), the device can:

The device does not shut down. A biomarker anomaly might indicate a medical event (seizure, medication change, fatigue), not a security threat. The response is proportional: restrict sensitive operations, maintain basic function, alert and log.

Traditional authentication is a gate: prove your identity once, then operate freely until the session expires. For a neural device, this model is insufficient. The device should continuously verify that the person using it is the person it was calibrated for, not through repeated login prompts, but through passive biometric monitoring that is already occurring as part of the device’s normal operation.

The continuous authentication model:

The terminal does not grant root. It uses capability-based security (Dennis & Van Horn, 1966), where each session, script, and command has explicitly declared capabilities:

No command can exceed its declared capabilities. Capability escalation requires multi-party cryptographic consent, not a password prompt, not a sudo command, but a signed authorization from the required parties (patient, clinician, manufacturer, depending on the operation).

The five proposed neurorights (Yuste et al., 2017; Ienca & Andorno, 2017) map to access control flags enforced at the protocol level:

These are not philosophical concepts in this architecture. They are ACL flags enforced at the Neurowall kernel level. A content provider that attempts to modify stimulation parameters without the integrity.write capability receives a permission denial, not a policy discussion.

Runemate is the userspace layer of a proposed neural operating system. The architecture maps directly to the Unix/Linux model that has proven itself across five decades of systems engineering.

A reasonable objection: does adding a CLI to a neural device introduce new attack surface?

No. The CLI does not expand the attack surface beyond what already exists. Runemate already executes bytecode. The Scribe interpreter processes arbitrary compiled content on-device. The execution surface already exists. A CLI is a structured, capability-gated interface to that same execution engine. It is a subset of what the interpreter can do, constrained by explicit capability tokens.

A capability-based shell is strictly less powerful than the bytecode interpreter it sits on top of. It can do only what the capability token authorizes, which is always a subset of what the interpreter can process. The CLI adds visibility and control without adding capability.

The same reasons Linux won:

The pipeline for restoring vision to a patient with a cortical visual prosthesis:

The Forge compiler on the gateway converts internet content (HTML, images, video) into semantic visual intent, not pixel data, but structural content: “heading, paragraph, image with these edges, link.” This intent is compiled into Staves bytecode, validated against TARA safety bounds (ensuring no stimulation pattern exceeds tissue-safe thresholds), and encrypted via NSP for transmission.

On-device, the Scribe interpreter decrypts the bytecode, applies a retinotopic coordinate transform (mapping visual content positions to V1 electrode locations based on the patient’s individual cortical geometry), and generates stimulation patterns that the patient perceives as visual content.

The same pipeline handles auditory content (tonotopic mapping to primary auditory cortex, A1) and haptic content (somatotopic mapping to primary somatosensory cortex, S1). A single Staves file can contain all three modalities, synchronized to the same timestamp.

This means a blind patient can browse a website, watch a video, read a meme, listen to music, or build with AI — the same content sighted users access, compiled into a format their visual cortex can interpret. No browser required. No app store. No middleman. Just a compiler, a protocol, and a terminal.

The patient sees what they choose to see, hears what they choose to hear, and feels what they choose to feel. The choice is theirs. The terminal is how they exercise it.

The complete RACI matrix covers 30+ scenarios across six stakeholder categories: Patient, Clinician, Manufacturer, Regulator, Open Standard (QIF), and AI System.

See QIF-GOVERNANCE-QUESTIONS.md Part II for the complete RACI matrix.

Every governance question maps to one or more of the five proposed neurorights:

These map directly to the ACL flags defined in the passwordless security architecture and the guardrails defined in GUARDRAILS.md.

A proposed open hardware specification for neural interfaces enabling:

The hybrid path: Open standard (QIF + NSP + Staves) + certified implementations + source code escrow + formal certification body + AI-assisted support. See QIF-GOVERNANCE-QUESTIONS.md Part V for the full evaluation.

QIF raises 30+ governance questions that society must answer. They are documented in QIF-GOVERNANCE-QUESTIONS.md and QIF-NEUROETHICS.md. Key unresolved tensions:

This framework was not built in isolation from real systems. During the initial research pass that led to QIF, the author discovered a previously undisclosed vulnerability in a widely deployed, open-source data transport protocol used by nearly all BCI research platforms. The protocol operates bidirectionally — it both reads from and writes to the endpoint — and the vulnerability exists at the endpoint layer, where no authentication, encryption, or integrity verification is enforced. Any device on the local network can inject arbitrary data streams indistinguishable from legitimate neural signals.

The author performed responsible disclosure to the protocol’s maintainers. The maintainers acknowledged the finding and characterized the lack of security as “by design” — the protocol was built for laboratory convenience, not adversarial environments. The disclosure resulted in maintainer discussions about developing a secure variant of the protocol. The protocol’s name is withheld here as the underlying architecture remains unchanged in production deployments.

NISS attracted attention from the FIRST.org community responsible for maintaining CVSS, the global standard for vulnerability severity scoring. The author was invited to contribute NISS to the CVSS Resources repository as a domain-specific extension for neural interface vulnerabilities.

The author declined, temporarily. NISS is currently a single-author derivation. The mathematical model has not been independently reviewed, replicated, or stress-tested by another researcher. Contributing it to a standards resource repository before that independent validation would be premature and would risk lending unearned authority to unvalidated math.

The academic preprint is published on Zenodo (DOI: 10.5281/zenodo.18640105, v1.4 as of February 2026, CC-BY 4.0). arXiv submission is pending endorsement.

The preprint history includes a transparency note: v1.0 shipped with 3 fabricated citations that were AI-generated and not caught before publication. These were corrected in v1.1 and the incident is disclosed in the paper’s AI collaboration section. This is mentioned not as a disclaimer but as evidence that the verification protocol described in this paper exists because the author learned the hard way that AI-generated citations cannot be trusted without independent resolution.

QIF is open research, not a finished product. It was built by one independent researcher with AI collaboration. No lab, no faculty advisor, no institutional review board. The framework, the threat taxonomy, the scoring system, and the neurorights mappings all need stress testing by domain experts. Nothing here has been peer-reviewed yet. Here's where your expertise fits.

QIF is designed as a living framework. As neural devices mature, new threats will emerge. The framework has to keep up. Our immediate priorities:

The internet got one chance to build its foundation right, and missed it. Brain-computer interfaces are getting that same chance right now. The chips are in human skulls. The clinical trials are running. The question is not whether these devices need security. The question is whether we build it before or after the first patient is harmed.

This framework is one proposal. It is open, it is incomplete, and it is waiting for better ideas. What it is not is optional. Neural devices will be secured. The only question is by whom, and whether patients had a voice in the design.

QIF was developed by a single independent researcher. The framework, threat taxonomy, scoring system, clinical mappings, and architectural decisions are mine. One perspective. Multi-disciplinary peer review is essential before any component informs clinical or regulatory practice.

Every architectural choice in QIF is documented in a 106-entry derivation log written like a lab notebook. Below are the pivotal decisions that shaped the framework, each one traceable to a specific entry with full reasoning chains.

This project spans 161 attack techniques across clinical, neural, and digital domains. I used Claude, Gemini, and ChatGPT as computational research assistants to synthesize regulatory datasets, cross-reference neuroscience literature, and generate code. Every AI-generated claim was verified against primary sources. The verification methodology and full AI interaction protocol are documented in the Derivation Log.

The author takes full responsibility for all content in this research proposal, irrespective of how it was generated. AI tools cannot be listed as authors per arXiv, ACM, and IEEE policy. No AI system originated any architectural or methodological contribution.

Every decision, derivation, and AI interaction is logged in a cryptographically verifiable audit trail. Monthly checksums of collaboration logs are GPG-signed by the maintainer. The full chain of evidence: