Researcher Sarah Laszlo places an EEG headset on a participant to detect changes in his brainwaves as a response to stimuli. Photo: Laszlo/Binghamton University

Taking a scan and identifying people by their distinct brainwaves may sound futuristic, but a new study proves that a so-called “brainprint” can identify people with 100 percent accuracy.

A team led by Sarah Laszlo, assistant professor of psychology at Binghamton University, and her collaborator Zhanpeng Jin, assistant professor of electrical and computer engineering, showed people have distinct brain waves in response to certain stimuli, which could have potential as a biometric for high-security situations, like accessing the Pentagon or Air Force labs.

When first approached by Zhanpeng about the idea, Laszlo admits she was skeptical. 

“I thought there was just way too much variability and way too much noise in the kinds of signals we collect,” she told Laboratory Equipment

Still, she took the chance and was pleasantly surprised by the success, though it’s a leap she would not likely have taken on her own. 

There has been previous work on brain biometrics but none have had the success rate of Laszlo’s work. Most earlier work involved research teams downloading publicly available databases of brain data to perform the biometric analysis. Laszlo’s team is one of the only ones collecting their own brain data.

Another key element that has aided their success is the interface between Laszlo’s psychology background and Jin’s engineering expertise.

“A lot of prior attempts at brain biometrics came from a purely engineering standpoint, and they were not as successful as we have been because they didn’t consider the human element,” Laszlo said. 

The study

For the study, 50 participants looked at a series of 500 images while hooked up to an electroencephalogram (EEG) headset.The study was designed to ensure that the images and words elicited a unique response between different people. To do so, the team performed a pre-study where they asked participants to give them extremes, such as 10 celebrities they loved and 10 celebrities they hated. Then, the 10 most polarizing choices were picked to use in the protocol— for example, Anne Hathaway and Adam Sandler.T he same was done for other images such as food, with pizza and sushi among the most polarizing options.

“In every case, we were trying to find images that people would have strong, and different, responses to,” Laszlo said. 

In 2015, Laszlo’s lab ran a similar experiment but with a smaller cohort of 32 people. That study, published in Neurocomputing, used only words rather than images and was able to identify each person with 97 percent accuracy.

Getting to 100 percent accuracy in the new study was a big deal, Laszlo said, as it bolsters its potential for use in high-security situations where one would want to be absolutely certain the right person was gaining access.

Including users’ responses to all different types of images in the protocol makes the system robust, as it is extremely unlikely that any two people would have exactly the same preferences for foods and faces, or the same vocabularies, Laszlo said. Even if somehow it were true, anatomical differences, such as shape and thickness of the skull, impact the EEG.

“It’s not only peoples’ preferences that come into play, it’s also the physical anatomy of their brain.” 

The choice to use an EEG as the method of measuring brain activity was an easy one, as there are many benefits. Laszlo explained it is a great tool for their purposes because data is relatively cheap to collect compared to something like an MRI, and it can be acquired very quickly with equipment that is fairly non-invasive. It doesn’t take an expert to acquire data from an EEG, which is important if the biometric wants to be utilized outside of the lab. EEG recordings are also sensitive to almost any kind of mental operation, including memory, emotion, stress and fear. 

Collecting data is the most time-intensive part, whereas the identification process is very fast and takes less than 10 seconds, Laszlo said. She noted that the team is working on trying to make accurate identifications with less and less data to speed up the entire process.

A more secure biometric

Brainprints overcome challenges that conventional biometrics face to remain secure. Compared to a traditional biometric, such as a fingerprint or a retina scan, brainprints would be less easy to steal, less vulnerable to coercion and are not disclosable. 

Laszlo cited a high-profile incident in 2014 where a hacker stole the fingerprints of the German defense minister by taking a high-resolution photograph of her fingers at a press conference. It would be impossible to collect brain data from a conscious person without their knowledge, and an unconscious person would not have the same brain activity.

Secondly, whereas a person may freely give up their fingerprint under the threat of violence, a person would not be able to disclose their brainprint, even if threatened with harm.Brain biometrics are not even vulnerable to a situation where a person is being threatened, as brain activity under stress is different than when a person is calm. 

“We think that one advantage of brain biometrics over conventional biometrics is that they protect not only the system, but also the users of the system,” Laszlo said.

A final advantage is that if, somehow, a brainprint was hacked or stolen, it could be replaced.

“If someone’s fingerprint is stolen, that person can’t just grow a new finger to replace the compromised fingerprint—the fingerprint for that person is compromised forever,” Laszlo said. “Brainprints, on the other hand, are potentially cancelable. So in the unlikely event that attackers were actually able to steal a brainprint from an authorized user, the authorized user could then ‘reset’ their brainprint.” 

Evaluating malicious attacks

Since reaching the 100 percent accuracy mark, researchers have begun to focus on evaluating potential malicious attacks a person could use to break the system. Laszlo is most closely involved with potential impersonation attacks, where a person attempts to train their brain activity to fool the biometric identifier.

She was surprised to find that it is possible to non-invasively stimulate a person to make their brain activity look more like someone else’s—but only a little. A new technique researchers tested made the would-be hacker’s brainprint 6 percent more similar to the target’s brain activity.That measure would need to improve 10-fold to break the biometric system. 

While Laszlo said she sees a “big future” for brain biometrics, real-world applications are still limited since the EEG system is expensive and slow. It also takes tedious, precise work to collect EEG data. The researchers are currently working toward obtaining accurate data with less expensive equipment and in less time.