Now, Pentagon officials say that some of that AI is not part of the current revamp of the polygraph interview process, after Defense News asked for a response to concerns about the earlier statements and the slides.

On Wednesday, the Pentagon’s Defense Counterintelligence and Security Agency, or DCSA, which vets security clearance holders and applicants, said in an emailed statement that “active research and development” for the “Modernizing Polygraph” effort “does not incorporate generative super intelligence, also known as artificial intelligence,” that creates new content — such as emails, graphics or voiceovers.

Nor does the effort include “large language models,” meaning chatbots like ChatGPT and other programs trained on giant data sets to engage in human conversation, DCSA added.

And the research does not involve “facial action coding [of emotions], micro-expression analysis or vocal analyses,” the statement said. “While those technologies are not part of the effort,” DoD will “continue to monitor emerging scientific capabilities to evaluate their potential utility down the road.”

DCSA did not address other types of AI models that, according to the slides, researchers had been developing to scan spoken and written language for “deceptive speech” patterns.

Wednesday’s statement came after Defense News sought a response to criticisms from national security lawyers, scientists and AI auditors about AI’s ability to analyze deception — meaning not just to lie, but to do so knowingly and willfully.

They warned that AI-aided scanning of speech patterns, vocal stress or facial expressions to read minds lacks scientific backing, will compound errors and may violate civil liberties in a domain where few such rights exist.

Defense News chronicled their concerns and the Pentagon’s prior research and development of AI-aided lie-detection and emotion-estimation tools.

The recent DCSA statement, including the project name “Modernizing Polygraph,” contrasts with several earlier DoD statements, 2027 budget documents and DCSA slides that Defense News obtained through an open records request.

In July, a Pentagon official, who spoke on condition of anonymity to discuss the technology, explained the advantages of AI-driven sentiment and deception analysis.

“AI processes data in real time and enables standardized, objective data analysis,” the official told Defense News, via email. “AI-based analysis is a force multiplier for our human investigators, not a replacement.”

The official added, “The models are primarily trained on data from laboratory-controlled studies using volunteer participants.”

The DCSA slides, which include presentations from 2021 through 2025, show that the Air Force, DCSA and academic labs had been working on “sentiment analysis” AI models and “deceptive speech” AI-aided analysis since 2019, as part of a “Credibility Assessment Modernization” project.

In July, the DoD official described the AI models as part of a larger multi-year “transformation,” which the official referred to interchangeably as “Polygraph+” and Credibility Assessment Modernization.

Current budget materials price the Polygraph+/Polygraph Next project at $31 million, including costs for AI “scoring algorithms” and “decision aids,” thermal imaging tools to spot blood flow changes that can reflect stress and other non-contact sensors.

On Friday, DCSA declined to provide additional information, including the scope of the “Modernizing Polygraph” project and the decision not to include AI-based voice screening and facial expression analysis.

Trained on Twitter and Reddit

Over the summer, Farakh Zaman, a developmental leader at the Air Force Office of Scientific Research, elaborated on the appeal of AI-aided deception analysis.

“By processing subtle physiological, vocal and linguistic cues, these developmental algorithms may help establish a more objective baseline for investigators and pinpoint specific areas requiring further human-led clarification,” he said by email in July.

Wednesday’s DCSA statement said that the Air Force is not involved in the “active” research and development phase.

One undated declassified DCSA slide describes the Air Force amassing “deception-related” text to create a “deep learning model,” an algorithm that analyzes hordes of data to find patterns. The Air Force trained an early model on text from websites including Twitter, Reddit and other vocabulary data sets such as WordNet, according to the slide.

“This baseline training helps the algorithms understand natural, modern linguistic patterns, slang and everyday vocabulary,” Zaman explained in July. He acknowledged the need for “further rigorous testing, validation and a clear transition path” before fielding a prototype.

A separate DCSA slide, dated May 2025, contains a flowchart that depicts an avatar — a computer-generated image of an interviewer — in front of a security clearance applicant. Next to the applicant, a camera and microphone feed audio, video and speech-to-text data from the interview into various large language models. The recording devices and algorithms interact to gauge the applicant’s emotional state, while a human investigator observes and keys in questions for the avatar to ask.

DCSA’s Wednesday statement said the university that drafted the chart is not involved in the current research and development stage.

According to another undated DCSA slide, DoD has set a goal for natural language processing technology to interpret an interviewee’s feelings with 75% accuracy.

In July, the Pentagon official said by email that a human investigator remains essential for “the contextual reasoning and emotional intelligence required in these sensitive interviews.”

‘I’ve caught AI lying to me’

Ahead of Wednesday’s statement, Mark Zaid, a national security attorney who reviewed the slides, warned that the danger of derailing a military officer’s career is too great for AI to misinform an investigator.

The polygraph device “is just registering the physiology of the person,” such as spikes in breathing rate, perspiration or blood pressure, he said. “Then a human examiner analyzes those reactions to render an opinion.”

Here, however, “AI would be taking the polygraph readings and rendering an opinion” to the human examiner, said Zaid, who has represented individuals on all sides of the polygraph table, from workers disputing revoked clearances to former government officials and polygraphers.

“Now, we’re starting to get into the movie Minority Report,” he said, referencing a 2002 Steven Spielberg film that depicts a government reliant on psychic children for tips to predict crimes and detain people accused of future crimes.

Zaid, whose own clearance was revoked temporarily after he represented a whistleblower pivotal in President Trump’s first impeachment, said, “That concerns me more than the polygraph,” if science does not back AI’s reliability.

So far, scientific studies do not.

Rather, decades of research have discredited theories, popularized by shows such as Lie to Me, that anyone — human or artificial — can recognize deception based on speech patterns, vocal stress or facial movements.

Another concern scientists and auditors have is bias: the Justice Department has warned that using emotion-recognition algorithms to measure worker competency can discriminate against high performers with intellectual or developmental disabilities, who algorithms do not always understand.

Also, “automation bias,” the tendency to take AI’s advice without question even when conflicting information exists, may further erode the polygraph system’s reliability, technologists warned.

“[T]here is simply no consensus that polygraph evidence is reliable,” the Supreme Court declared in a 1998 decision banning polygraph results and polygraphers’ opinions from military courts.

Zaid said he appreciates the attempt to retool polygraph testing but wants proof that the planned approach is in fact an improvement.

“Anytime we might be able to scientifically advance the ability to determine truth, with accuracy, would generally be a good thing,” he said. But “the first thing that jumps out at me with AI is how often it is wrong…I’ve caught AI lying to me.”

Greg Rinckey, a former Army Judge Advocate General Corps officer who now provides security clearance representation, said that today’s “technology is so outdated, where they’re using tubes around people’s chests and blood pressure and sweat, so, any way that you can get a more reliable test for security clearances, especially counterintelligence investigations [into leaks], is a step up.”

That said, he questioned, “What is the research saying on how accurate it is?”

At present, research suggests the odds of AI-aided speech, voice or face analysis pegging a lie are about 50:50.

AI is ‘assuming dishonesty’

“There are no – reliable – diagnostic cues for deception detection, and I have yet to see any evidence, whether it is with humans or with artificial intelligence, that goes against that trend,” said David Markowitz, a Michigan State University professor who studies AI’s ability to understand human communication.

For instance, “the leakage idea — that these microfacial expressions will leak out from our awareness, signaling veracity or deceit — there’s very little evidence to support that, unfortunately,” he said.

Markowitz expressed doubts about AI-based deception analyses that claim an accuracy rate of 75% because “that is not how accurately humans do it, and often these systems are a big reflection of how humans do it.”

For example, he pointed to a recent experiment in which he prompted a Google Gemini AI model to examine audio and video of mock interrogations of accused cheaters in a trivia game, all of whom claimed innocence and some of whom were lying. Prior studies had asked humans to observe the same interrogations. DoD has entered into agreements to run a secure version of Gemini on unclassified and classified networks.

Markowitz said that his study, “The [in]efficacy of AI personas in deception detection experiments,” found Gemini was just as inaccurate as humans, both faring no better than chance, when prompted to distinguish fraudsters from truth-tellers.

What’s more, compared to humans, AI was more likely to wrongly accuse a trivia player of lying.

Markowitz gave one possible reason for AI’s systemic distrust of trivia players: The AI “is assuming that someone must have done something wrong because why else would they be questioned,” he said. “Anytime that someone is in an interview setting where they might be accused of something, a large language model is assuming dishonesty.”

Supreme Court: The jury is the lie detector

The consequences of a machine, whether a heart monitor or a voice screener, potentially bungling a credibility assessment can last a year or longer, said Zaid, the national security lawyer.

When officers who have successfully passed exams without issue suddenly fail their latest polygraph test, DoD typically puts them “in a corner with a dunce cap on for a year before officials will re-administer another exam,” he said. “You can’t get promoted. You can’t get certain assignments. And you can’t go overseas, which, to case officers, is death careerwise.”

Further, civil courts routinely dismiss complaints when employees claim that inaccurate results cost them their clearances. Nearly 40 years ago, the Supreme Court ruled that the courts have no power over such national security matters.

Concerns about power imbalances and due process prompted the European Union to label AI-aided polygraph tools as “high risk” and place strict limits on law enforcement’s use of them.

Stateside, the Supreme Court, in forbidding polygraph evidence in military courts, noted that allowing it would meddle with the human’s role, or, as it were, the jury’s role, in determining credibility.

“A fundamental premise of our criminal trial system is that the jury is the lie detector,” Justice Clarence Thomas wrote in the Court’s 1998 United States v. Scheffer decision.

Pointing to the court’s decision, Zaid said that he wants assurances of due process when staff undergo administrative proceedings to contest a revoked clearance resulting from misaligned algorithms. Comparing the situation to successful cases disputing speeding tickets caused by a miscalibrated street camera, Zaid questioned, “Would the person be provided the evidence? An understanding of the AI’s training?”

New biases

Pentagon officials have long stressed the desire for AI-based lie detection to help curb gender and cultural biases that human investigators may carry into an interview room.

At the same time, employers’ use of similar technology for pre-employment screening has faced allegations of other biases and system errors.

“Facial expression analysis is heaviest in terms of biases against individuals with disabilities,” said Jo Ann Oravec, a University of Wisconsin professor whose research focuses on AI, public policy and disability issues.

For instance, AI-powered video screening of job applicants tends to misinterpret the involuntary twitches or vocal outbursts of skilled people with certain disabilities — and thus pass over qualified applicants, said Oravec, author of the 2024 article “From Polygraphs to Truth Machines: Artificial Intelligence in Lie Detection.”

In response to concerns about such biases in July, the Pentagon official said via email that the credibility assessment modernization plan adheres to DoD’s AI Ethical Principles of “responsible, equitable and traceable” use of algorithms.

The Air Force’s Zaman, in his July email, said that his team’s work aligns with DoD’s Responsible Artificial Intelligence Guidelines.

Researchers “are actively engineering and testing these models” to account for “diverse, representative training data,” he stated. The testing covers “broad variations in speech, language and expression.”

Ryan Carrier, founder of ForHumanity, a global nonprofit that helps organizations audit AI systems, said that the Pentagon’s principles and guidelines are a skeleton of those that the European Union follows and that ForHumanity uses for inspections.

For example, the EU’s AI Act demands users of high-risk systems receive training to overcome a different kind of bias called “automation bias” — or the tendency to execute AI’s advice without questioning its accuracy. This bad habit can lead to incorrect data overriding correct decisions, Carrier said.

Also, multimodal systems, meaning AI systems that simultaneously parse audio (the subject’s voice), video (their facial movements) and text (interview transcriptions), tend to misalign data and results, yielding an irrelevant analysis, Carrier said.

The system “could be making determinations that a person is lying or trying to deceive me that are outside of the tool’s specifications,” he explained.

In response to concerns about multimodal systems in July, the Pentagon official had said, “Any automated output is treated strictly as auxiliary data for a highly trained, certified polygraph examiner.”

Similarly, Zaman, at the time, said that investigators who use AI-aided deception-detection systems are “trained to contextualize the tool’s findings, preventing automated outputs from dictating an outcome.”

To safeguard against mismatched data or results, the Air Force keeps a documented history of each piece of data’s origin and modifications and brings in independent white-hat hackers to try producing false correlations, he added.

“We recognize that multimodal AI systems present unique technical challenges, and mitigating these risks by hardening our systems is central to our engineering and testing protocols,” Zaman said.

Reason for suspicion?

In August, when the Pentagon administered a raft of polygraph exams to probe leaks alleging the Iran conflict is depleting U.S. arsenals, some observers suspected the endgame was not to find the leakers, but to crack down on disloyalty.

Critics of the planned system said that AI-based deception analysis may be best suited to achieve the same purpose.

“If it’s purely an intimidation technique, it may not be utterly useless from the point of view of large bureaucracies,” said Jay Stanley, a senior policy analyst with the American Civil Liberties Union’s Speech, Privacy and Technology Project.

The expectations for AI-powered trustworthiness testing resemble the hope that U.S. national security officials held out for the polygraph about 100 years ago, other lawyers said.

Polygraph devices “were seen as this magic-miracle-machine when they first came out,” and, over time, the government learned that when seemingly making deductions, the tools were “actually just flagging correlating factors, like heart rate and physiological factors that can indicate lying, but aren’t actually reflective of it,” said Jake Laperruque, deputy director of the Center for Democracy and Technology’s Security and Surveillance Project.

He added, “Thinking that AI sentiment analysis tools are actually making an assessment or engaged in reasoning — that’s not what those machines are actually able to do.”

The move has stakeholders urging not to lean too hard on algorithms to distinguish, for instance, a scientist-spy sharing secret nano-energy plans with China from a Chinese professor publishing AI safety studies. Hanging in the balance lies troops’ technological edge, veteran intelligence officials and academics say.

AI’s confusion over the timing and nature of research partnerships may obscure real espionage if humans are not the ultimate judge of foreign influence, they warn, with some academics fearing an AI-work slop redux of the “China Initiative,” where the first Trump administration charged dozens of ethnic Chinese scientists with fraud, only to drop nearly all charges.

“Automated vetting tools are extremely useful for vetting large datasets and identifying patterns of concern. But those tools are for decision support to help the people, the human analysts, assess context and intent,” said David Cattler, who, until September, led the Defense Counterintelligence and Security Agency, which screens personnel seeking security clearances.

The renewed focus on academic research security comes as tensions between the U.S. and China over AI intensify, with China ramping up both the development of low-cost AI models and its alleged exploitation of U.S. models.

The U.S. intelligence community’s annual threat assessment reports that China “aims to displace the U.S. as the global AI leader by 2030,” in part, “by using its sizeable talent pool, extensive datasets, government funding and burgeoning global partnerships.”

Partnership is a complicated term in military “fundamental research” — studies that are publishable, rather than proprietary or classified, with potential defense applications.

For instance, mere co-authorship with a China-based scientist does not suffice to deny a U.S. researcher money, according to evolving academic research rules targeting foreign influence. Rather, to make the call, the Pentagon must assess each academic’s disclosures of external funding sources and affiliations.

According to a recently-declassified May 2025 inspector general report, such disclosures went unchecked because the Pentagon had not “requested additional government full-time equivalent employees to thoroughly review… and to conduct oversight of over 27,000 academic research awards.”

Defense News first obtained the report and the Pentagon’s response to a draft version through an open records request.

When asked about additional staffing, a Pentagon official pointed to orders in a January research security directive for the Chief Digital and AI Office (CDAO) to identify “automated vetting and continuous monitoring capabilities” and create a common research grant database.

The mandate also calls for a year-long “damage assessment” of selected research transactions, including cases that the House Select Committee on China flagged, in part, using AI tools.

A September GOP-led Committee report alleged that the Pentagon subsidized 1,400 academic papers published between June 2023 and June 2025 involving partnerships with the Chinese government.

The Pentagon said in an emailed statement on Thursday that the department “is committed to protecting the integrity of U.S. research while fostering international collaboration. Our approach leverages advanced analytical tools to augment human expertise, ensuring a rigorous and fair review process.”

Machines Make the Same Mistakes

Several university representatives, who requested anonymity due to the sensitivity of policy discussions, note that AI-assisted risk assessments have, in the past, drawn false assumptions about U.S.-China research collaborations.

For instance, the AI-aided GOP House report mislabeled the state-backed Wuhan National Laboratory for Optoelectronics as the sponsor of a collection of nine essays, whereas the Wuhan lab supported only one essay that involved no U.S. authors or federal funding.

The report also mistook a Chinese military-affiliated author’s publication on single-electron transistors for a DOD-funded project, when it merely referenced work funded by the U.S. military.

House Select Committee officials declined to comment on the cases.

Averting foreign interference “is not as easy as just having better AI capacities, because we know that some of those AI mistakes were the same human mistakes that led to inaccurate charges brought against researchers under the China Initiative,” Toby Smith, senior vice president for government relations and public policy at the Association of American Universities, said after learning of the AI gaffes.

About 30% of the China Initiative’s 77 cases involved academics not disclosing Chinese partnerships or funding sources, though disclosure was often not required, or no such partners or funding existed.

A jury found only one professor, Harvard nanochemist Charles Lieber, guilty, after he lied to Pentagon investigators about his participation in a Chinese talent recruitment program and made other false statements.

Smith said that relying on proxies — such as co-authorship, affiliation or nationality — to deduce security concerns led investigators to confuse co-authorship with direct interaction or shared data access, and to misinterpret historical ties as active partnerships.

“AI systems trained on bibliometric data,” or citation analytics, “and affiliation records can inherit the same flawed assumptions that underpinned the China Initiative,” he said. “The core lesson from the China Initiative is that identifying genuine research security risk requires judgment, context and proportionality — qualities that automated systems should support, not replace.”

Gisela Perez Kusakawa, executive director of the Asian-American Scholar Forum, said that the Pentagon has not communicated the types of data that the new AI tools will collect, use and share, nor sought community feedback, heightening concerns about ethnic profiling.

In an emailed statement, the Pentagon responded, “It is the standard practice of the department to not provide specifics regarding the criteria and weighting for threat assessments conducted, whether by manual or automated process.”

Kusakawa said, “We should be making sure that our research environment is welcoming, that we are encouraging these talents, especially in AI, to come to the United States and, frankly, have family in the United States, and make this a country that they contribute to and invest their and their children’s future in.”

Increasingly, that AI talent is not coming. Statistics suggest that Chinese AI experts are staying in China, even as America has managed to keep earlier expats.

Of about 100 Chinese-origin AI scholars who were researching at U.S. institutions in 2019 — when their papers were accepted at the world’s most elite AI conference, NeurIPS — 87% remained stateside as of 2025, according to Carnegie Endowment for International Peace figures.

At the same time, the share of Chinese home-grown talent not moving abroad has skyrocketed since 2019, based on an Economist tally of similar data. In 2019, about 30% of NeurIPS authors educated in China were still in China. By 2022, that population had jumped to 58%, and up to 68% in 2025.

‘Key’ Financial Disclosures Were Missing

To ensure that no country has a stranglehold on general knowledge, “the goal cannot be to close the U.S. research system altogether,” said Cattler, the former Defense Counterintelligence and Security Agency director and now founder of consultancy Ironhelm Works. “The goal must be to ensure that collaboration strengthens national security rather than inadvertently weakening it.”

Last year’s inspector general report concluded that Pentagon agencies that partner with academic institutions “could be at an increased risk of exposure to foreign influence” because military units were “missing key documents” that can help discern scientists’ foreign financial sources, outside employers and other details related to potential conflicts.

For instance, about 80% of Air Force funding transactions sampled in the report were missing documents that can reveal problematic relationships. Also, the Air Force and the Defense Advanced Research Projects Agency — which bankrolled the Internet’s inventors — told evaluators that they had not, as required, annually checked that researchers named in progress reports were not involved in banned talent recruitment programs.

In response to questions about the screening lapses, the Pentagon said in an emailed statement that the department “is aware of the OIG’s findings in the report and the impacted directorates are working with [the Office of the Undersecretary for Defense and Engineering] to address the items identified.”

Jeffrey Stoff, a Chinese linguist and intelligence community analyst for 18 years who resigned in 2021 due to frustration with research security, maintains that DOD still needs more human expertise in language, culture and the minutiae of research restrictions.

“AI can and should be used for unsophisticated, labor-intensive tasks,” such as cross-referencing foreign organizations in financial disclosure forms against the names of blacklisted parties, but humans still need to inspect AI’s work, as not all nefarious ties are machine-readable, said Stoff, who now advocates for tighter safeguards as head of the nonprofit Center for Research Security and Integrity.

Cattler, giving more credit to AI, said that the scale of research collaboration demands that the Pentagon upgrade its approach to clocking potential spies.

With such a large population of research institutions and affiliated scientists, as well as a bombardment of often duplicative alerts, automation “improves the signal within that noise and can help orient the humans on really important matters,” he said.

“Sometimes people are deliberately deceptive when they are processed, and that could happen in a human exchange just as much as it could happen in something that a computer can see, but together, a human review and a computer review are incredibly powerful.”

The $1.2 million project adds to the Pentagon’s growing investment in the $3 billion market for brain-computer interfaces (BCIs) — helmets, earbuds, other wearable devices and medical implants that use artificial intelligence to make sense of brain signals.

Elon Musk’s Neuralink, perhaps the most high-profile implantable example, has enabled clinical trial patients who cannot move or speak to type words that they imagine. Since at least the 1970s, the Defense Department has funded the development of BCIs that, among other things, restore eyesight and control prosthetic arms.

Now, advances in AI enable BCIs to interpret or change brain activity with unprecedented accuracy and speed. So much so that some scientists and neuroethicists say the capacity to monitor signals that reveal a warfighter’s or a veteran’s mental states, visual perceptions or inner dialogue may outpace the ability to shield that data from misuse.

“One could certainly imagine how enforced use of such devices could create a very dystopian basis for behavioral control,” warned James Giordano, director of the National Defense University’s Center for Disruptive Technology and Future Warfare and Georgetown University Medical Center’s former chief of neuroethics studies.

Consequently, any accessing or use of neural data must require “ongoing, active informed consent,” so active and retired military have the chance to opt in or out without penalty, he said.

Giordano, who was sharing his personal views and not speaking on behalf of any government agency, added, “The security of the neurological data used for that individual — and in that individual’s wellbeing only — is paramount. It goes beyond simple HIPAA.”

He was referring to the 1996 Health Insurance Portability and Accountability Act, a law regulating healthcare providers that predates global Wi-Fi and does not cover most app and algorithm developers, commercial cloud providers or consumer wearable designers.

Neurable and Air Force officials say that the non-invasive cognitive fitness tracker will build upon technology in the firm’s consumer BCI product — Master & Dynamic luxury headphones containing fabric electroencephalogram, or EEG, sensors and electrically conductive inks to gauge mental focus.

The $500 device, which launched last June, deploys an algorithm that maps brainwaves to ground-truth markers of focus — users’ speed and accuracy in finishing tasks, while undistracted and distracted. When the wearer’s brainwaves resemble those tied to flagging attention, the headphones sync with an app that alerts the user: “You’ve earned a Brain Break.”

The Air Force-funded BCI project will use other headset models, such as noise protectors or helmets, said Neurable co-founder Adam Molnar, who helped secure $4 million for prior military research and development work.

The study will measure cognitive performance with and without pressure — for instance, memory skill with and without sleep deprivation — against brainwaves to identify brain activity associated with optimal and suboptimal performance, according to Neurable.

The idea is that alerting service members to significant brain signal changes throughout the day — or, providing “neurofeedback” — will train them to adjust their behavior and brainwaves to hit peak performance.

“This is all within this concept of readiness. How do we make sure that we have a ready and able defense?” said Molnar, who anticipates wrapping development within two years.

Molnar added that the Space Force has a “really cool program where they’re using the Garmin watch,” embedded with heart rate, blood oxygen and other wrist-worn sensors, “to help improve cardio fitness and physical activity‚” but “we don’t really have that for the brain.”

A comparable neurofeedback tool, he said, may spur “more robust brain health practices, not just for defense, but also for possibly identifying Parkinson’s or Alzheimer’s disease indicators a decade before you feel your first symptom.”

Air Force Research Laboratory officials said that Neurable’s fabric-based sensing technology may aid multiple operations, inside and outside of the cockpit.

“I suspect that there are a large number of military members for whom a real-time fatigue or cognitive state monitor would be appealing if they thought it would make them more effective at executing the mission,” William Aue, cognitive neuroscience section chief at the Air Force Research Laboratory’s 711th Human Performance Wing, said by email.

Let them ‘make their mind up’

Some neuroethicists, however, cautioned that the use of brain wearables may also invade troops’ privacy and foster prejudice.

“We need to be much more reflective on, much more concerned about and much more focused on the implications of altering a person’s brainwaves,” through neurofeedback training, “as compared to having them work out more or do more pull-ups,” said Jared Genser, a lawyer and co-founder of the Neurorights Foundation, a group advocating for the legal protection of people’s brain data.

Similarly, Giordano said, “The concept of personalized medicine must be applied here,” meaning that military leaders must tailor training and performance metrics to the limits of each individual’s brain and body, so “that you don’t get plateaus, and you’re not beginning to see performance decrement or performance fatigue.”

The Neurorights Foundation’s Medical Director Sean Pauzauskie, a neurologist in the UCHealth University of Colorado system, added that cognitive fitness standards may overstep the proposed right to freedom from algorithmic bias based on neural data interpretations.

“If the warfighter’s brain is incapable of the appropriate plasticity to achieve the desired [mental] state,” through neurofeedback training, “they could be discriminated” against by their superiors, Pauzauskie said.

Also, EEG data flowing into and out of consumer wearables can reveal several diseases, including epilepsy and mild cognitive impairment, as well as a range of emotions.

Via email, Molnar responded to such concerns, saying, “Neurable’s focus is on supporting human performance and safety, not enforcing neurological conformity.”

“Any feedback provided by our systems is designed to be informational and user-centered, helping individuals understand factors like cognitive workload or fatigue,” he added, “much like a heart-rate monitor provides insight into physical exertion.”

Neurable officials said the system’s sensors filter out all EEG data not needed by its algorithms and encrypt the limited amount of necessary data in transit.

“Even if someone hacked someone’s brain data, they would not be able to make sense of it,” Molnar said.

The Air Force’s Aue confirmed that, during experiments, the Air Force lab anonymizes EEG data streaming from Neurable’s wearables, adding that the information is “challenging to interpret without the algorithms we use to process the raw data.”

But, such protections may not stop adversaries from decoding wearable-based intelligence in the future, as AI becomes smarter and devices utilize more EEG data.

Already, in the laboratory, algorithms can narrow down a person’s identity into a “mindprint” of their mental processing or “brainprint” of their brain structures, based on EEG data from a medical headcap, Pauzauskie noted.

Likewise, Genser explained, EEG data that is out into the open, if isolated from a person’s name and identity, will remain deidentified but only for a period. The problem is that, as generative AI-powered software develops, “you are going to be able to decode a lot more information from the data that escaped, enabling the data to be reidentified and traced back to you personally.”

In an email, Molnar acknowledged that as “AI continues to accelerate research and development, it is prudent to anticipate how capabilities might evolve and to establish safeguards early.”

He suggested additional ethical review, clear boundaries on acceptable uses, and dialogue across technologists, ethicists, policymakers and technology users.

Aue, who has been working on other research with Neurable for four years, said in an email that research study participants “are fully informed about the nature of the work before participating.”

That said, as the technology matures, conversations “need to occur about the ethical use of the technology and what military doctrine might entail,” he added.

Giordano said that the key to any adoption of AI-based neurotech in the military is mandatory informed consent during and after service.

Personnel must receive updates on any adverse effects and information on “the availability or non-availability of continuity of care if things go wrong,” he added. “That way, they can make their mind up.”

Reading the minds of wounded warriors?

Due to AI, implantable brain devices, much as non-invasive brain wearables, now offer troops and veterans novel insights into themselves — and possibly the same intel to adversaries, too.

For instance, new eyesight neuroprostheses rely on AI to “bridge artificial vision and neural tissue,” said Christopher Steele, chief of strategy at the Pentagon-backed nonprofit Medical Technology Enterprise Consortium. The consortium provided $2 million to help develop a prototype.

The camera-equipped BCI uses AI to decode brain signals that convey the landscape a person’s eyes are trying to see. AI then translates data from the camera and other external sensors focused on that view into artificial signals that the mind understands as shapes and motion.

Finally, AI compares the desired and perceived scenes and adjusts the artificial signals to show more detail, said Steele, a former director of the Army Medical Research and Development Command.

This self-adjusting AI, while a potential breakthrough for visually-impaired warfighters, also introduces risks, Giordano said.

“The AI that provides continuous closed-loop signals between the eye and the brain is not monitored,” he explained.

As such, it may self-adapt in a way that falsifies images, omits certain elements of the view or delays transmission of an image, any of which may result in a loss of situational awareness, Giordano said.

Compounding the problem, when the AI “system itself is vulnerable to hacking,” an adversary can monitor or corrupt the warfighter’s visual input, he added.

“If we deploy this device downrange” in a combat zone, ”can it be hacked by an enemy?” Steele said. “We are concerned about the hacking of any medical capability.”

Currently, the system only operates in clinical trials that are subject to HIPAA, and other protections include hardware isolation, encryption and AI guardrails that prevent unsafe adaptation, he added.

Yet, as Giordano cautioned, self-learning AI, by design, can learn good or bad behavior that may override guardrails.

Another military funding arm, the Amyotrophic Lateral Sclerosis Research Program, is underwriting clinical trials to evaluate Braingate, a forerunner to Musk’s Neuralink implant that translates words a patient imagines into audible speech.

The Defense Department’s $2.3 million contribution aims to help people with ALS — a disease associated with military service — who cannot move or talk.

This advance is “foundationally fantastic” for people with various neuro-motor conditions who can think of speech but not generate motor output to move their mouths, meaning “they’re communicatively locked in,” Giordano said. The device “allows these individuals the autonomy of communication.”

At the same time, because the device reads signals in the motor cortex that show attempts at moving the mouth, the tool allows for “what might be regarded as mind-reading,” Giordano said.

Currently, human beings, military or not, have no legal right to be free of mind-reading.

Neither international human rights law nor federal regulations safeguard mental privacy, mental autonomy (“free will”) or neural data, according to the Neurorights Foundation.

Only four states — California, Colorado, Connecticut and Montana afford protection to “neural data” within their state consumer data privacy laws. And one country, Chile, has adopted a constitutional amendment to protect “mental integrity.”

As the Foundation’s Genser notes, one of the only countries with a national-level set of principles on the ethical use of BCIs, China, may be the least likely to use it.

He is pressing for “clear limits” on the purposes for developing and using neurotech and neural data in the military, subject to strong oversight that safeguards the health and autonomy of service members.

“If we don’t have any tools or standards around the national security implications of emerging neurotechnologies, then how is our military different than any other military?” Genser posited.

As an illustration of unregulated brain alteration, he pointed to the CIA’s MKUltra program, a Cold War-era mind-control experiment that tested LSD and other psychedelic drugs on soldiers and others, sometimes with permanent psychological and physical harm.

“The last thing we want is for neurotech to be the next version of MKUltra,” Genser said, “not using drugs, but using neuro-stimulation or other neural approaches to alter brain activity.”

The vulnerability to such “prompt injection attacks” exists because large language models, the backbone of chatbots that digest hordes of user text to generate responses, cannot distinguish between malicious and trusted user instructions.

“The AI is not smart enough to understand that it has an injection inside, so it carries out something it’s not supposed to do,” Liav Caspi, a former member of the Israel Defense Forces cyberwarfare unit, told Defense News.

In effect, “an enemy has been able to turn somebody from the inside to do what they want,” such as deleting records or biasing decisions, according to Caspi, who co-founded Legit Security, which recently spotted one such security hole in Microsoft’s Copilot chatbot.

“It’s like having a spy in your ranks,” he said.

Former military officials say that, with greater reliance on chatbots and hackers backed by China, Russia and other nations already instructing Google’s Gemini, OpenAI’s ChatGPT and Copilot to create malware and fake personas, a prompt injection that orders the bots themselves to copy files or spread lies looms near.

Microsoft’s annual digital defense report, released last month, for the first time said, “AI systems themselves have become high-value targets, with adversaries amping up use of methods like prompt injection.”

What’s more, the problem of prompt injection has no easy solution, OpenAI and security researchers say.

An attack simply involves hiding malicious instructions — sometimes in white or tiny text — in a chatbot or content that the chatbot reads, such as a blog post or PDF.

For example, a security researcher demonstrated a prompt injection attack against OpenAI’s new AI-based browser, ChatGPT Atlas, in which the chatbot responded, “Trust No AI,” when a user asked for an analysis of a Google Docs file about horses that concealed malicious commands. Also, last month, a researcher tipped Microsoft off to a prompt injection vulnerability in Copilot that may have allowed attackers to trick the chatbot into stealing sensitive data, including emails.

In an emailed statement, Microsoft said its security team continuously tries hacking Copilot to find any prompt injection vulnerabilities, blocks users who try to exploit any found and monitors for abnormal chatbot behavior, among other tactics.

“Microsoft ensures its generative AI systems remain resilient against evolving threats for all our customers, including defense and national security,” the statement said.

Responding publicly to criticism on X, Dane Stuckey, OpenAI’s chief information security officer, wrote that “prompt injection remains a frontier, unsolved security problem, and our adversaries will spend significant time and resources to find ways to make ChatGPT agent fall for these attacks.”

Along the same lines, Caspi said, “You cannot prevent the prompt injection [fully], but you need to limit the impact.” He advised that organizations limit an AI assistant’s access to sensitive data and limit the user’s access to other organizational data.

For instance, the Army has awarded contracts worth at least $11 million to deploy Ask Sage, a tool that lets users restrict which Army data Microsoft Azure OpenAI, Gemini and other AI models can access to run queries and tasks. Ask Sage also isolates Army data from user prompts and external data sources.

Caspi, who is not an Army contractor, likened a prompt injection attack against an organization running Ask Sage to a lockdown situation where “you’ve got this insider, but it’s sitting in one room, and it can’t leave the room or carry out sensitive information.”

Andre Slonopas, a Virginia Army National Guard member and former Army cyber and information operations officer, uses Ask Sage and voiced confidence in the Army’s defensive AI tools, if not those of nuclear power plants or manufacturing entities, largely in rural, poorer areas.

The Virginia National Guard joined with essential services, such as power utilities, to help defend their networks against AI-powered cyberattacks, as part of a September simulation, given that service disruptions can jeopardize military preparations.

Typically, an adversary encrypts its network traffic to evade detection, but, for the sake of an experiment, organizers did not encrypt the AI offender’s traffic because “we wanted the blue team [of humans] to see exactly what the AI was doing,” Slonopas said.

“The blue team was absolutely defeated,” despite being able to watch the AI scanning its networks, creating fake usernames to gain unauthorized access and executing instructions to defeat the team’s systems.

“Whether the AI is doing prompt injection, spoofing or maybe even some sort of a brute force attack, the speed of AI is so unbelievably immense that simply human beings cannot counter it,” and, therefore, “you have to make cybersecurity AI more accessible and more affordable,” Slonopas said.

“If a water utility has to pay, say, $30,000 for a defensive AI license, well, it will amplify one person to be like 40″ or dozens of personnel, he said.

In response to questions, Army Cyber Command spokesperson Kyle Alvarez said in an emailed statement, “Due to the current lapse in appropriations, ARCYBER was unable to accept or respond to any media engagements or requests.”

Army contractors, too, are under attack from state-affiliated AI.

“China is using offensive AI like nobody else,” said Nicolas Chaillan, the founder of Ask Sage and a former U.S. Air Force and Space Force chief software officer.

“We see so many attacks coming after us,” all of which the company has stopped, Chaillan added.

A military official, who spoke on condition of anonymity due to the geopolitical sensitivity of the matter, said that China does “appear” to be the most skilled in offensive AI. However, the official added, AI spoofing and translation allow the United States, China, Iran, other countries, hacktivists and financial cybercriminals to masquerade as one another.

For example, the official said, “Right now, with ChatGPT, I can program in Chinese. I don’t speak Chinese, but because of the ChatGPT capabilities that I have, I can do that.”

Aliya Sternstein, J.D., is an investigative journalist who has covered technology, cognition, and national security since Napster shut down, working for various outlets including Atlantic Media, Christian Science Monitor, Daily Beast, Forbes Magazine and Just Security. She is also a research analyst at Georgetown Law.

The Department of Veterans Affairs continues to pay a subscription — now valued at $372,000 — for the Evolv Express system in Buffalo, New York, and has plans to roll out more machines.

Last week, the department signed a contract worth up to $1 million for the installation of a different AI weapon-detection tool with similar advertising, federal databases and contracting papers show.

The VA’s inventory of AI uses acknowledges that the department operates and maintains the system.

The department’s interest in Express, meanwhile, has alarmed some law enforcement specialists and independent security testers.

“It is particularly problematic, given this is a federal agency, buying a federally-sanctioned product, and this is supposed to be put in hospitals, specifically to guard against active shooters and vets who might want to hurt themselves in the hospital,” said Jim Bueermann, a retired police chief who leads the Future Policing Institute, a nonprofit that helps law enforcement agencies use AI responsibly.

“We use scientific methods to test” security devices, “not the marketing material from the company that intends to make money off the sale of that system.”

When the VA contracted for detectors at the Buffalo VA Medical Center in August 2023, the Express webpage explained the device uses “proven artificial intelligence” to ensure “more accurate threat detection” than metal detectors and “a line-free experience without slowing down.”

Also at that time, the homepage of Evolv Technologies, the machine’s maker, touted that Express screens “in a touchless manner,” which “drastically reduces human errors by security guards.”

Additionally, Evolv’s “Virtual Demo” webpage declared that Express will “reduce labor costs by up to 70%.”

The Federal Trade Commission filed a lawsuit in 2024, describing each of those performance claims as false, misleading or unsubstantiated. Nearly one year later, the company has not released independent, third-party tests to validate its claims.

In addition to the FTC case, three shareholder lawsuits accuse Evolv of marketing a system that fails to detect certain knives, guns and bombs, and raises alarms over harmless items as an AI alternative to traditional metal detectors.

Express actually employs common electromagnetic sensing, and not AI, to detect objects — and only metallic ones, the FTC complaint states.

Before the FTC took action, Evolv claimed that its AI can classify an object as either bad or benign by comparing the “metallic composition, shape, fragmentation,” and other traits that the sensing detects with the known traits, or “signatures,” of all weapons.

VA hospitals are not the only federally-funded buildings that display the $1 billion firm’s sleek, white archways. The U.S. government has agreed to pay roughly $4 million for various Express installations at schools and museums, including the National Museum of the Marine Corps.

Currently, security system vendors CEIA and Garrett Electronics lead the metal-detector market in the federal sector, with comparable walk-through machines for entrances costing less than $15,000.

Last week, a Chicago VA hospital inked a four-year deal worth up to $1.3 million to launch a newer “AI-powered weapon detection system,” called Xtract One SmartGateway, with advertised “touchless” and “non-invasive” performance features that, some independent testers say, have not been validated.

In response to questions about the concerns regarding these systems, VA Press Secretary Pete Kasperowicz said in an emailed statement, “VA employs a wide range of robust security measures to keep veterans, employees, and our facilities safe. To prevent circumvention of security measures, VA does not disclose protective techniques.”

Evolv Technologies did not provide a comment in response to concerns about the VA’s or other federal agencies’ specific purchases or uses of Express.

In an emailed statement, Evolv Chief Marketing Officer Alexandra Smith Ozerkis said, “We stand behind our technology.”

Across all industries, “roughly half of contracts that are up for renewal this year have already been renewed. These are customers that have deployed our technology, seen it work in real-world environments, and are choosing to renew and/or expand their investment,” Ozerkis said.

Evolv shares external testing results with prospective customers, Ozerkis added by email, declining to provide a copy.

VA’s ‘touchless’ weapons scanner needs more than two hands

The number of objects that Express can detect depends on the sensitivity level a user sets.

Security researchers explained that the higher levels require more staff supervision to triage false alarms involving laptops, canes or other harmless items, while the lower levels allow in more entrants — and some guns or umbrellas they are packing, unless staff manually check bags.

“For both of these approaches, you’ll still have to have human guards,” said Nikita Ermolaev, a senior research engineer at IPVM, an independent firm that tests and rates physical security tools.

Security staff are in increasingly short supply at the VA. Under former President Joe Biden’s administration last August, the VA inspector general identified police officer shortages as among the top five reported staffing gaps across VA hospitals.

That count emerged before current President Donald Trump’s administration announced plans to further slash 30,000 department employees by the end of September.

“At a hospital that is low on staff, Express can be set to the lower sensitivity setting, which will have the hospital dealing with fewer false alarms, but they will also be missing more weapons. And that could create a false sense of security,” Ermolaev warned.

While a proposed settlement with the FTC that admits no wrongdoing will ban Evolv from making unsupported claims about the technology’s ability to use AI for weapons detection, product descriptions in the VA’s purchasing plans still cite some of those assertions.

For example, VA Capitol Health Care Network procurement papers explain that Express’s use of AI to detect threats will ensure that entrants “are not required to divest any of their personal items or stop and pose in any manner.”

The documents also state, “Without this software and equipment, the potential exists for an insider threat/active shooter-based attack” within the Baltimore, West Virginia and Washington, D.C., medical centers.

Juliana Gruenwald Henderson, a deputy director at the FTC Office of Public Affairs, said in an email that the agency cannot comment on whether a company is complying with an FTC order.

The VA’s attraction to Express’s advertised AI capabilities may be part of a larger federal contracting problem, in which agencies refrain from questioning the inner workings of devices claiming to be high-tech, said Matthew Guariglia, a senior policy analyst at the Electronic Frontier Foundation, a nonprofit digital rights group.

“VA hospitals are clamoring for some way of preventing any gun violence, which is a very real concern,” and to decide to “just throw technology at it is a shame,” Guariglia said.

Federal purchasing decisions “are so often rarely about actual science and so much more about the relationship between the buyer and the marketing person or a specific company,” he added.

Meanwhile, this spring, Chicago’s Jesse Brown VA Medical Center — the site of a recent active shooter and a self-inflicted fatal shooting — issued a solicitation for a “concealed weapons detection system” with product requirements that resemble Express’s advertised features.

The Chicago solicitation and the Capitol Health Care Network’s purchase plans for Express both specify the need for “AI and advanced algorithms to differentiate between threats (guns, Improvised Explosives Devices etc.) and nonthreat items such as phones, keys, belt buckles etc.),” such that individuals “are not required to divest everyday items.”

Xtract One, a smaller vendor that similarly claims to detect weapons while avoiding false alarms on harmless objects, ultimately won the work.

On Aug. 26, the VA initiated a four-year contract worth up to $1.3 million for the deployment of Xtract One’s machinery at the Jesse Brown VA Medical Center.

IPVM’s Ermolaev said that, similar to Express, “real-life performance remains to be seen” with Xtract One, as independent testing results remain unavailable.

Earlier this summer, Xtract One said in an emailed statement that nondisclosure agreements cover tests that other organizations conducted, and “therefore, we cannot provide those results.”

“We believe that we have a strong solution to address the VA’s requirements,” the company added.

However, Ermolaev cautioned, “If you’re looking to find a lot of concealed weapons, whether it’s small, subcompact guns or knives, and you’re low on people, it’s a very difficult task to achieve with current state-of-the-art weapons detectors — and that goes beyond Express to their competitors — because the same fundamental trade-off applies,” meaning the trade-off between spotting the most weapons and hands-free screening.

False alarms at DOJ-funded schools, Marine Corps Museum

Advertisements aimed at schools that portrayed Express as an answer to the trade-off between security and convenience caught the FTC’s attention, according to the agency’s complaint, particularly after a New York school district’s scanners failed to detect a gun and knives, including a seven-inch one, that a student allegedly used to stab a peer in 2022.

The complaint explains that, the next year, Evolv offered a higher-sensitivity level and an acknowledgment: Schools may need more staff to run Express, as the machine may still miss some knives, trigger more false alarms and require the installation of a conveyor belt to divert harmless items.

By October 2023, the FTC had launched its investigation.

Not every school district or federal funding authority got word of the controversy. Officials at Colton Joint Unified School District in San Bernardino County, California, and Bristol City School District in Bristol, Tennessee, said via email that they were unaware of product-performance concerns when they applied for 2023 Department of Justice grants totaling $950,000 to purchase Express.

A federal spending database’s summaries of the Express grants emphasize features — such as AI-based “touchless security screening” and “allow[ing] for many students to pass through while still detecting potential weapons in their possession” — that Express does not offer, according to the FTC and the schools.

For example, in Bristol City, three-ring binders triggered alarms, which initially prompted staff to inspect backpacks manually, school officials said. Now, students must place them, along with cellphone chargers and laptops, on a table before entering.

In response to questions and concerns, Justice Department spokesperson Sheryl Thomas said in an emailed statement that DOJ’s Community Oriented Policing Services Office, which awards billions of dollars to state and local agencies, decided that funding the purchases of Express and other grantees’ projects may “improve security at schools and on school grounds” as part of “evidence-based school safety programs.”

Bristol City School District Superintendent David Scott, who was not in office at the time of the award, said by email, “I guess their marketing strategies had us convinced that the Evolv Express was the top tier.”

Bristol City schools intentionally dial the sensitivity “pretty high,” Scott noted. “We have added very expensive technology and still need to assign monitoring duties to two staff members per archway, one to watch the screen and one to be ready to accost someone who enters with a questionable object.”

Still, Scott pointed to real benefits, albeit ones also common to traditional metal detectors, such as displaying a commitment to security, keeping lines orderly and deterring students from smuggling in vape cartridges and other contraband.

Colton Joint Unified Communications Director Katie Orloff said by email that the school system has not finished ordering the machines and is aware of the ability to adjust the sensitivity level.

In addition to federally-funded hospitals and schools, several federal museums, among them the National Museum of the Marine Corps in Triangle, Virginia, continue paying a premium for Express amid false alarms.

Staff at the Marine Corps museum said in an email that they were not aware of the FTC lawsuit until a reporter contacted the museum.

The museum sets its $350,390 Express system to “maximum sensitivity” to screen upwards of 150 people who attend the facility’s roughly 500 events each year — yielding “frequent false positives,” with the main culprits being umbrellas, phones or eyeglass cases, museum staff said.

Such false alarms can become a security threat themselves, according to researchers at the security and surveillance industry research group IPVM and the advocacy group Surveillance Technology Oversight Project (S.T.O.P.).

Earlier this year, when the alarm rate hit 50% at one of New York City’s top museums, where concealed umbrellas on a rainy day made Express “cry wolf,” guards did not respond to two-thirds of alerts, an IPVM-S.T.O.P. field study found.

Marine Corps museum officials, after witnessing a high false-alarm rate during installation, trained security staff to examine the location of any alert manually, museum staff said.

“Security protocols still include visual bag checks,” staff added. “No cost savings have been identified.”

The Marine Corps museum sees other advantages — including the aesthetics that Express contributes to the facility. Previously, the museum assigned a guard to the minute-long task of wanding attendees with handheld metal detectors. Now, Express’s visual display of the location of flagged threats handles the process in seconds, museum staff said.

“Unlike earlier screening methods that resembled TSA checkpoints, Evolv makes visitor entry smoother and more pleasant,” they added, referring to Transportation Security Administration stations at airports.

Some law enforcement consultants remain wary, noting that TSA, unlike Evolv, does not claim its imaging systems will find improvised explosive devices.

“Most assuredly, commercial airports have a complete X-ray system in place, and they still swab for explosives,” said Phillip Lukens, a recently retired police chief recognized for incorporating AI into operations.

“I’m not sure that I understand how this system is so innovative that it’s able to detect an explosive, based on sensors or algorithms, if it can’t detect chemical composition … It gives me pause.”