Neuro Audit: An Interpretable Framework For EEG Privacy Risk Assessment and Empirical Neural Identity-Inference Analysis

Abstract

Electroencephalography (EEG) is more and more being recorded outside of the clinical setting but neural recordings can provide information beyond the purpose for which they are recorded and there are few tools to audit them. NeuroAudit, a web-based platform for EEG privacy and neurosecurity auditing, preprocesses the uploaded recordings using MNE-Python, extracts 19 interpretable features and generates a rule-based heuristic score across four dimensions (Identity, Emotion, Stress and Workload). It then generates rule-based privacy and security recommendations and generates an automated PDF audit report, while treating the raw EEG as a temporary input that can be deleted after processing. A separate research part examines empirical identity-inference vulnerability on the public PhysioNet auditory EEG-biometric dataset (20 subjects, 239 recordings, 5,764 five-second epochs) using Dummy, Logistic Regression and Random Forest models under a recording-disjoint five-fold GroupKFold protocol. The Random Forest reached 64.35% balanced accuracy and 63.82% macro-F1 against a 5% chance level, and 87.03% accuracy after recording-level majority voting. Excluding the heuristic-related feature group reduced the balanced accuracy to 56.49%. However, the heuristic Identity Risk score does not show a clear correlation with recording-level inference success (point-biserial correlation 0.1016, p = 0.1172; bootstrap 95% CI -0.0107 to 0.2098). NeuroAudit is therefore presented as an interpretable auditing baseline and not a trustworthy indicator of privacy vulnerability. We therefore find that calibration of the risk score should be the next direction for research.