Here's an uncomfortable finding: a formal math certificate can promise a brain-signal model is robust while the model quietly falls apart. At one perturbation level, an EEGNet classifier's accuracy dropped by nearly 26% under attack, yet the Lipschitz-style certificate still declared it safe for every subject tested. The proof held; the behavior didn't.

The authors call this one flavor of a bigger problem, where training goals drift from what users need, and lay out an audit framework covering three failure modes: certificates that pass while performance rots, task-tuned representations that damage the neural signal, and public embeddings that still leak private facts, like subject identity, recoverable at 48% versus a 7% chance rate. The verification gap showed up across several decoders, so it isn't an artifact of one architecture.

Their point, from the abstract: operational safety needs auditing, not certificate-trust alone. See the paper for the full test setup.