Fuzzing the brain: Automated stress testing for the safety of ML-driven neurostimulation

TL;DR

<3-5 sentence high-level summary> The paper addresses the safety of ML-driven neural stimulation in visual prosthetics by introducing a black-box, coverage-guided fuzzing framework that perturbs sensory inputs to reveal unsafe stimulation patterns. It formalizes biophysical safety constraints and develops violation-focused coverage metrics (VO-KMVP and VO-KMOC) to quantify both the frequency and diversity of unsafe outputs. Applied to retinal and cortical stimulus encoders, the approach uncovers unsafe regimes not exposed by standard training losses, enabling empirical model comparison and safer design choices. This work lays the groundwork for evidence-based safety benchmarking and regulatory-ready verification of next-generation neuroprosthetic systems, particularly as they move toward adaptive, closed-loop operation.

Abstract

Objective: Machine learning (ML) models are increasingly used to generate electrical stimulation patterns in neuroprosthetic devices such as visual prostheses. While these models promise precise and personalized control, they also introduce new safety risks when model outputs are delivered directly to neural tissue. We propose a systematic, quantitative approach to detect and characterize unsafe stimulation patterns in ML-driven neurostimulation systems. Approach: We adapt an automated software testing technique known as coverage-guided fuzzing to the domain of neural stimulation. Here, fuzzing performs stress testing by perturbing model inputs and tracking whether resulting stimulation violates biophysical limits on charge density, instantaneous current, or electrode co-activation. The framework treats encoders as black boxes and steers exploration with coverage metrics that quantify how broadly test cases span the space of possible outputs and violation types. Main results: Applied to deep stimulus encoders for the retina and cortex, the method systematically reveals diverse stimulation regimes that exceed established safety limits. Two violation-output coverage metrics identify the highest number and diversity of unsafe outputs, enabling interpretable comparisons across architectures and training strategies. Significance: Violation-focused fuzzing reframes safety assessment as an empirical, reproducible process. By transforming safety from a training heuristic into a measurable property of the deployed model, it establishes a foundation for evidence-based benchmarking, regulatory readiness, and ethical assurance in next-generation neural interfaces.

Figures (4)

• Figure 1: Overview of our framework for discovering safety violations in ML-driven neurostimulation. Top: Visual prostheses use deep nets to convert camera input into electrical stimuli applied to the brain. Outputs must satisfy neurobiological constraints; violations may occur even under normal input. Bottom: Our coverage-guided fuzzer mutates inputs to explore model behavior, using coverage and violation checks to uncover diverse unsafe outputs. The resulting violations enable quantitative safety evaluation and model comparison.
• Figure 2: Fuzzing strategy comparison for retinal models. Left: Scatterplot of number of violations found, normalized (y-axis) and normalized combined diversity score (x-axis). Right: Normalized combination of violation and diversity score, violations and diversity equally weighted. Each datapoint is the average of six tests, each with a different seed set, and error bars show the standard error. Our metrics are shown in green, with our two best VO-KMVP and VO-KMOC highlighted in dark green. Neuron coverage metrics are shown in purple, and basic metrics in red.
• Figure 3: Fuzzing strategy comparison for cortical models. Left: Scatterplot of number of violations found, normalized (y-axis) and normalized combined diversity score (x-axis). Right: Normalized combination of violation and diversity score, violations and diversity equally weighted. Each datapoint is the average of six tests, each with a different seed set, and error bars show the standard error. Our metrics are shown in green, with our two best VO-KMVP and VO-KMOC highlighted in dark green. Neuron coverage metrics are shown in purple, and basic metrics in red.
• Figure 4: Bar charts of violations found and validation loss for each trained model variant (described in Table \ref{['tab:networkversions']}). Left: retinal models; Right: cortical models. $V_{CD}$ and $V_{IC}$ violations are present in both retinal and cortical models, but $V_{PI}$ violations are only shown for retinal (impossible in cortical) and $V_{AE}$ violations are only shown for cortical (not discovered in retinal).