Every technique that can harm a brain can also heal one.

The same physics that makes a BCI technique dangerous also makes it therapeutic. Transcranial magnetic stimulation treats depression and induces seizures. Deep brain stimulation manages Parkinson's and causes involuntary movement. The mechanism is identical. The difference is intent, dosage, and governance.

This is the central insight behind QIF: security and clinical safety are not separate problems. They are two views of the same system. A framework that only catalogs threats misses half the picture. A framework that only tracks therapies misses the risks. QIF maps both, for every technique, in a single standard.

All publications are released under the Apache 2.0 license. Neural security standards are too critical to be proprietary. The people whose brains will be connected deserve to understand exactly how they are protected.

We address this with three interlocking pillars:

3.1 Where the Architecture Comes From

The 11-band model was not designed from first principles. It was derived by converging three established layered architectures:

1. The OSI model (ISO/IEC 7498) — 7 layers that decompose a network into physical, data link, network, transport, session, presentation, and application. Every security framework for digital systems uses some variant of this decomposition. But the OSI model stops at the wire. It has no concept of the biological system connected to the other end.
2. Neural systems anatomy — The brain is not a single structure. It is a hierarchy of functionally distinct regions: spinal cord, brainstem, cerebellum, diencephalon (thalamus/hypothalamus), basal ganglia, limbic system, and neocortex. Each has different cellular architecture, different oscillatory regimes, and different clinical consequences if compromised. An architecture that treats "the brain" as one layer misses this entirely.
3. The bio-digital boundary — Where electrodes touch tissue, signals transition from ionic to electronic. This is not a clean handoff. It is a physical interface with its own impedance characteristics, its own failure modes, and its own threat profile. Neither the OSI model nor neuroanatomy accounts for this zone.

QIF maps all three onto a single stack. The 7 neural bands (N7–N1) come from neuroanatomy, ordered by clinical severity. The 3 synthetic bands (S1–S3) come from the electronic processing chain, analogous to OSI's lower layers. The interface band (I0) is the bridge — the electrode-tissue boundary where biology becomes data. The result is an 11-band, 7-1-3 asymmetric hourglass: wide at the top (neural complexity), narrow at the center (physical bottleneck), and wider at the bottom (synthetic processing).

3.3 Architecture

The QIF Hourglass is an 11-band architectural model that maps all potential threat surfaces within a BCI — from the highest cortical structures through the electrode-tissue boundary and into the synthetic processing chain.

Seven bands are neural (N7 Neocortex through N1 Spinal Cord), representing biological tissue with distinct functional properties and vulnerability profiles. One band is the interface (I0), the electrode-tissue boundary where biological signals are converted to digital data — and where the highest concentration of techniques converges. Three bands are synthetic (S1 Analog through S3 Radio/Wireless), covering the electronic processing and communication chain.

The hourglass shape is deliberate. I0, the neural interface band, constitutes the architectural chokepoint. All signals must traverse this point. With over half of the 161 catalogued techniques targeting this band, it represents the majority of the total threat surface. Securing I0 is the single highest-leverage investment in BCI safety.

TARA (Therapeutic Applications & Risk Assessment) is a dual-use atlas of 161 BCI techniques. Every entry is three things at once: a security threat, an ethical concern, and a potential therapy. Of these, 102 have confirmed therapeutic applications with published clinical evidence. 76 are mapped to DSM-5-TR psychiatric diagnoses. This is not a threat registry with clinical notes appended. It is a single atlas built from the ground up to serve security engineers, clinicians, researchers, and regulators from the same source of truth.

TARA exposes each technique through four explicit projections:

• Modality — Attack severity, status, and physical coupling mechanism
• Clinical — Therapeutic analog, FDA status, evidence level, treated conditions
• Diagnostic — DSM-5-TR diagnostic mapping via the Neural Impact Chain
• Governance — Consent tier, regulatory requirements, data classification

Each technique can be analyzed through any of these projections. Interactive exploration of the TARA grid reveals all four perspectives for a given technique: its neural effects, potential therapeutic applications, diagnostic mappings, and applicable regulations.

Of the 161 techniques, 102 have confirmed therapeutic applications — published clinical use with evidence. Another 19 are probable (under active investigation) and 10 are possible (theoretical mapping exists). Only 30 are pure silicon-only vectors with no known tissue analog.

The Neural Impact Scoring System (NISS) is a purpose-built vulnerability scoring system for neural devices. In contrast to CVSS, which measures confidentiality, integrity, and availability, NISS quantifies six dimensions specifically relevant to brain-computer interfaces:

NISS scores are computed as an equal-weighted average of all assessed metrics, normalized to a 0–10 scale. Severity bands align with CVSS thresholds: 0.0 (None), 0.1–3.9 (Low), 4.0–6.9 (Medium), 7.0–8.9 (High), and 9.0–10.0 (Critical). Optional context profiles (clinical, research, consumer, military) allow for differentiated weighting of each metric.

The Neural Impact Chain (NIC) is a six-stage mapping that traces every technique from its physical mechanism to its psychiatric outcome. For each entry in TARA, the chain identifies the targeted hourglass band, the affected neural structure, the disrupted cognitive or motor function, the resulting NISS severity score, and the corresponding DSM-5-TR diagnostic category.

To our knowledge, this represents a systematic mapping from cybersecurity severity to clinical outcome references. It makes a verifiable claim: specific techniques, applied to specific neural bands, produce predictable functional impacts that correspond to recognized clinical conditions. A security engineer can now see that a technique targeting the limbic system (N6) with high cognitive integrity impact maps to mood and trauma-related disorders. A clinician can see that the same attack vector shares its mechanism with an FDA-approved therapy.

This is the bridge between cybersecurity and clinical neuroscience that did not previously exist.

Ienca & Andorno (2017) proposed four neurorights: Mental Privacy, Cognitive Liberty, Mental Integrity, and Psychological Continuity. Chile enshrined them in law. The OECD published neurotechnology governance guidelines (2019). But nobody had tested them against an actual threat taxonomy.

Every technique in the TARA atlas is now mapped to the affected neurorights through a systematic, multi-layer process: UI category provides the primary signal, DSM-5-TR cluster adds overlays, and NISS vector components refine the result. This mapping is deterministic and reproducible — the same technique always maps to the same rights.

Running 161 techniques through this process confirmed four established rights from Ienca & Andorno (2017). QIF extends Mental Integrity with engineering-level signal dynamics protections and maps the read/write distinction to the CIA triad: MP = Confidentiality (don't read neural data), MI = Integrity (don't write into neural signals). MP is extended with data-lifecycle protections. Cross-validated against six established frameworks (Ienca & Andorno 2017, Yuste/NeuroRights Foundation 2017, Chile Law 21.383, UNESCO 2025 Recommendation, Farahany 2023, Bublitz 2022):

CIA Triad Mapping: QIF maps Ienca & Andorno's neurorights to the CIA triad: Mental Privacy = Confidentiality (don't read neural data), Mental Integrity = Integrity (don't write into neural signals). A disclosed vulnerability in a BCI-adjacent streaming library demonstrates both in a single exploit chain: Phase 2 (exfiltrate) = MP violation, Phase 3 (inject) = MI violation.

Mental Integrity (MI) — QIF Extended: Now includes signal dynamics protections. Some attacks don't break neural function; they retune it. Gradual drift, neurofeedback falsification, and baseline adaptation poisoning reshape the brain's homeostatic equilibrium. QIF extends MI with engineering-level specifications for detecting these dynamical retuning attacks. 101 techniques map to MI.

Mental Privacy (MP) — QIF Extended: Now includes data-lifecycle protections. Multi-modal biometric fusion attacks correlate neural data with gait, voice, and typing rhythm. QIF extends MP to cover cross-modal re-identification and the right to consent to each data modality independently.

Policy-Layer Rights

Three additional neurorights proposed by Yuste and the NeuroRights Foundation (2017) and reinforced by UNESCO's 2025 Recommendation — equitable access to mental augmentation, protection from algorithmic bias, and free will — are not mapped in the threat taxonomy. These are distributive justice and governance concerns: no attack technique directly violates “fair access,” and algorithmic bias arises from systems processing neural data, not from attacks on the interface itself. Free will substantially overlaps with Cognitive Liberty in the context of threat-to-harm mappings. These rights are addressed at QIF's governance layer rather than the security layer. See Governance → Neuroethics Alignment for the full mapping.

Each technique within the TARA atlas is assigned a consent tier reflecting the minimum regulatory oversight necessary for its deployment. These tiers are derived directly from NISS scores: higher biological impact, lower reversibility, and greater consent violation necessitate stricter governance.

Section 3305 of the Food and Drug Omnibus Reform Act (FDORA, 2022) defines a "cyber device" as one that (1) contains software, (2) can connect to the internet, and (3) could be vulnerable to cybersecurity threats. Every technique in TARA is classified against this three-prong test.

Section 524B requires five categories of cybersecurity documentation. Each technique is mapped to the requirements it is relevant to:

The regulatory coverage score (0.0–1.0) measures how well existing standards cover each technique. A score of 0.8 means current FDA pathways, IEC standards, and privacy regulations adequately address the risk. A score below 0.5 indicates a major regulatory gap — the technique represents a neural-specific threat that pre-FDORA frameworks were not designed to handle. 74 of 161 techniques fall below this threshold.

The top gaps are structural, not incidental: CVSS cannot express neural-specific impacts for the majority of techniques, and no FDA pathway exists for consumer sensor exploitation in the S-domain. These are precisely the gaps that TARA and NISS were built to fill — providing the neural threat catalog and impact scoring that Section 524B mandates but existing standards do not supply.

The Neural Sensory Protocol (NSP) is a five-layer, post-quantum communication protocol specifically designed for BCI data links. It encapsulates every neural data frame using ML-KEM key exchange, ML-DSA digital signatures, and AES-256-GCM authenticated encryption, achieving this with a modeled 3.25% power overhead on constrained implanted devices (hardware validation pending).

NSP comprises five layers: (1) Physical (electrode interface and signal conditioning); (2) Integrity (QI-based signal validation via STFT spectral analysis); (3) Encryption (post-quantum key exchange and authenticated encryption); (4) Transport (framing, sequencing, and flow control); and (5) Application (BCI command interpretation and consent enforcement).

The protocol is specified across three device tiers: implanted (most constrained, ≤40 mW), wearable (moderate power budget), and external (unconstrained). Each tier uses the same cryptographic primitives but with different parameter sets and duty cycles.

Post-quantum key sizes represent the primary implementation challenge. ML-KEM-768 public keys are 1,184 bytes — 18 times larger than X25519 keys. Project Runemate's Staves bytecode compression mitigates this overhead, achieving net bandwidth savings over classical transport for typical BCI interface content exceeding 23 KB.

QIF is open research, not a finished product. It was built by one independent researcher with AI collaboration — no lab, no faculty advisor, no institutional review board. The framework, the threat taxonomy, the scoring system, and the neurorights mappings all need stress testing by domain experts. Nothing here has been peer-reviewed yet. Here's where your expertise fits.

QIF is designed as a living framework. As neural device technology matures, the evolving threat landscape necessitates a corresponding evolution of the framework. Our immediate priorities: