Do EEG-biometric templates threaten user privacy?

The electroencephalogram (EEG) was introduced as a method for the generation of biometric templates. So far, most research focused on the optimisation of the enrolment and authentication, and it was claimed that the EEG has many advantages. However, it was never assessed whether the biometric templates obtained from the EEG contain sensitive information about the enrolled users. In this work we ask whether we can infer personal characteristics such as age, sex, or informations about neurological disorders from these templates. To this end, we extracted a set of 16 feature vectors from EEG epochs from a sample of 60 healthy subjects and neurological patients. One of these features was the classical power spectrum, while the other 15 features were derived from a multivariate autoregressive model, considering also interdependencies of EEG channels.We classified the sample by sex, neurological diagnoses, age, atrophy of the brain, and intake of neurological drugs. We obtained classification accuracies of up to .70 for sex, .86 for the classification of epilepsy vs. other populations, .81 for the differentiation of young vs. old people's templates, and .82 for the intake of medication targeted to the central nervous system. These informations represent privacy sensitive information about the users, so that our results emphasise the need to apply protective safeguards in the deployment of EEG biometric systems.