arXiv CSopen access

Secure Storage and Privacy-Preserving Scanpath Comparison via Garbled Circuits in Eye Tracking

Secure Storage and Privacy-Preserving Scanpath Comparison via Garbled Circuits in Eye Tracking

arXiv:2604.19422v1 [cs.CR] 21 Apr 2026

SULEYMAN OZDEL, Technical University of Munich, Munich Center for Machine Learning, Germany AMR NADER, Technical University of Munich, Germany YASMEEN ABDRABOU, Technical University of Munich, Munich Center for Machine Learning, Germany ENKELEJDA KASNECI, Technical University of Munich, Munich Center for Machine Learning, Germany

Fig. 1. Overview of the two privacy-preserving configurations. (Left) Two-party: Alice and Bob compute scanpath similarity via garbled circuits for MultiMatch, ScanMatch, and SubsMatch, without revealing private gaze data. (Right) Server-assisted: Bob first registers his public key for authorization, after which Alice uploads encrypted scanpaths, masks, and public keys to a server. Authorized clients, such as Bob, receive the wrapped keys and encrypted data, which are jointly processed inside the garbled circuit to verify integrity, decrypt the scanpaths, and compute similarity. The data owner (Alice) can remain offline after upload, enabling secure large-scale and asynchronous comparisons, and needs to be online only when authorizing new clients. With the growing use of eye tracking on VR and mobile platforms, gaze data is increasing. While scanpath comparison is important to gaze behavior analysis, existing methods lack privacy-preserving capabilities for real-world use. We present a garbled-circuit (GC)-based approach enabling secure storage and privacypreserving scanpath comparison under the semi-honest model. It supports two configurations: (1) a two-party setting where the data owner and processor jointly compute similarity scores without revealing their inputs, and (2) a server-assisted setting where encrypted scanpaths are stored and processed while the data owner remains offline. All decryption and comparison operations are executed inside the GC. Experiments on three eye-tracking datasets evaluate fidelity, runtime, and communication, and show secure results for MultiMatch, ScanMatch, and SubsMatch closely match plaintext outcomes, with manageable runtime and communication overhead. Tests under various network conditions indicate that the design remains feasible for real-world privacy-preserving scanpath analysis and can be extended to other GC-based behavioral algorithms. CCS Concepts: • Security and privacy → Privacy-preserving protocols; • Human-centered computing → Human computer interaction (HCI). Authors’ Contact Information: Suleyman Ozdel, Technical University of Munich, Munich Center for Machine Learning, Munich, Germany, [email protected]; Amr Nader, Technical University of Munich, Munich, Germany, amr.nader@ tum.de; Yasmeen Abdrabou, Technical University of Munich, Munich Center for Machine Learning, Munich, Germany, [email protected]; Enkelejda Kasneci, Technical University of Munich, Munich Center for Machine Learning, Munich, Germany, [email protected].

This work is licensed under a Creative Commons Attribution 4.0 International License. © 2026 Copyright held by the owner/author(s). ACM 2573-0142/2026/5-ARTETRA008 https://doi.org/10.1145/3806022

Proc. ACM Hum.-Comput. Interact., Vol. 10, No. 3, Article ETRA008. Publication date: May 2026.

ETRA008:2

Suleyman Ozdel, Amr Nader, Yasmeen Abdrabou, and Enkelejda Kasneci

Additional Key Words and Phrases: Privacy-preserving computation, Eye tracking, Garbled circuits, Scanpath comparison ACM Reference Format: Suleyman Ozdel, Amr Nader, Yasmeen Abdrabou, and Enkelejda Kasneci. 2026. Secure Storage and PrivacyPreserving Scanpath Comparison via Garbled Circuits in Eye Tracking. Proc. ACM Hum.-Comput. Interact. 10, 3, Article ETRA008 (May 2026), 24 pages. https://doi.org/10.1145/3806022

1

Introduction

Eye tracking has become increasingly integrated into virtual and augmented reality headsets, smart glasses, and screen-based systems [Adhanom et al. 2023; Bozkir et al. 2023]. This results in a growing volume of individual gaze data collected across diverse contexts. Such data enables applications in education [Ke et al. 2024; Stark et al. 2024], marketing [Boerman and Müller 2022], and usability research [Novák et al. 2024], supporting analyses of attention [Chita-Tegmark 2016], cognitive load [Krejtz et al. 2018; Ozdel et al. 2025], and visual behavior [Bulling and Wedel 2019]. A scanpath is the time-ordered sequence of eye fixations and saccades during viewing, often encoded as a symbolic sequence. Scanpath comparison quantifies the similarity between gaze sequences of different users or conditions, providing insight into how people observe and interact with visual content [Andrienko et al. 2012]. However, individual gaze data is highly sensitive, as it can reveal personal traits such as expertise, cognitive state, or even health conditions [Abdrabou et al. 2025; Kröger et al. 2020; Steil et al. 2019a]. Sharing raw gaze data across users or platforms raises significant privacy concerns, especially in large-scale or user-centric scenarios. As scanpaths preserve the spatiotemporal structure of fixations and saccades, they enable the extraction of rich behavioral features [Borji and Itti 2014; Holland and Komogortsev 2011]. Even more aggregated representations such as attention maps, can leak sensitive information about the underlying content and task [Sönnichsen et al. 2025]. Eye-tracking data should be protected from unauthorized parties and should only be used for explicitly permitted purposes. Existing privacy-preserving approaches are limited. Prior work using homomorphic encryption [Ozdel et al. 2024] enables computation on encrypted data but remains computationally expensive and impractical for interactive or pairwise comparisons. However, it requires both participants to remain online throughout the process, which is infeasible for large-scale or asynchronous scenarios involving many individual users. Privacy constraints prevent raw gaze data from being shared, yet many real-world scenarios require scanpath comparison across parties or institutions. To address this gap, where existing privacy-preserving methods are costly and require data owners to remain online, we propose a garbled-circuit-based approach for privacy-preserving scanpath comparison that supports three widely used baseline methods representing complementary methodological families, Needleman– Wunsch based sequence alignment, n-gram based similarity, and geometric similarity. Our approach performs secure two-party computation of MultiMatch [Dewhurst et al. 2012; Foulsham et al. 2012; Jarodzka et al. 2010], ScanMatch [Cristino et al. 2010], and SubsMatch [Kübler et al. 2014], and further extends this design into a server-assisted two-party protocol that enables computation directly over encrypted eye-tracking data. The two-party setting enables secure similarity computation between two parties without revealing their gaze data, while the server-assisted protocol supports encrypted storage and allows data owners to remain offline (except for authorizing new parties) after uploading their data, enabling practical large-scale applications. In this setting, scanpaths and their corresponding keys are stored on the server in encrypted form using AES-CTR [Dworkin 2001]. The decryption key is split between the server and authorized clients so that neither party alone can recover it, with only the client’s share stored on the server in wrapped form. At computation time, the wrapped share is provided to the authorized client and both shares are combined inside a garbled Proc. ACM Hum.-Comput. Interact., Vol. 10, No. 3, Article ETRA008. Publication date: May 2026.

Secure Storage and Privacy-Preserving Scanpath Comparison via Garbled Circuits in Eye Tracking

ETRA008:3

circuit, where key reconstruction, decryption, and scanpath comparison are performed securely, revealing only the final similarity score. The proposed protocol combines AES-CTR encryption, XOR masking, and X25519-HKDF-AES-GCM key wrapping to ensure confidentiality, authenticated access, and unlinkability, allowing the data owner to remain offline while enabling scalable and efficient computation on encrypted data. Consider multiple research labs across countries with strict privacy laws wish to compare scanpaths without sharing raw fixation data. To assess our algorithm, we measure fidelity to ensure agreement with plaintext results, runtime to assess practical latency, and communication bandwidth to quantify network overhead in realistic deployments. Our contributions are as follows, focusing on the application of privacy-preserving computation to existing eye-tracking analysis methods: (1) secure and efficient garbled circuit application of established scanpath comparison methods MultiMatch, ScanMatch, and SubsMatch; (2) a server-assisted two-party protocol with an end-to-end encrypted pipeline for scanpath storage and processing, where decryption and comparison are performed entirely within garbled circuits, enabling data owners to remain offline during secure function evaluation after data upload and client authorization, and to come online only when authorizing new clients; (3) a lightweight storage and access-control protocol combining AES-CTR, XOR masking, and X25519-HKDF-AES-GCM to ensure confidentiality, authenticated access, and unlinkability across items; and (4) a comprehensive evaluation on three eye-tracking datasets quantifying fidelity, runtime, and communication bandwidth, demonstrating the practicality of privacy-preserving scanpath comparison 1 . 2

Related Work

We organize related work into three categories: scanpath comparison methods, privacy-preserving eye-tracking algorithms, and encrypted storage with secure computation frameworks closely related to our contribution. 2.1

Scanpath Comparison Methods

Scanpath comparison algorithms are a well-studied area in eye-tracking research. [Anderson et al. 2015] provide an overview of scanpath comparison methods. Early approaches relied on string-based comparison methods, such as edit distance or sequence alignment algorithms like Needleman-Wunsch [Needleman and Wunsch 1970], as implemented in algorithms such as ScanMatch [Cristino et al. 2010]. Subsequently, the SubsMatch algorithm [Kübler et al. 2014] introduced the use of n-gram frequencies to capture transitional similarities between scanpaths, while the MultiMatch algorithm [Dewhurst et al. 2012; Foulsham et al. 2012; Jarodzka et al. 2010] evaluated geometric similarities across multiple components of the scanpaths. [Anderson et al. 2013] introduced recurrence quantification analysis to capture temporal fixation similarity. More recent methods use deep learning models to extract scanpath embeddings, which are then compared using the local alignment technique, the Smith–Waterman algorithm [Castner et al. 2018, 2020]. In this work, we implement privacy-preserving versions of three representative methods, ScanMatch, SubsMatch, and MultiMatch, and thereby also cover Needleman-Wunsch-based algorithms, as ScanMatch directly relies on this approach. 2.2

Privacy-Preserving Eye Tracking

Eye-tracking data has been shown to contain sensitive personal information in prior studies [Graham et al. 2011; Kröger et al. 2020; Liebling and Preibusch 2014; Wenzlaff et al. 2016] and it can be susceptible to adversarial perturbations [Hagestedt et al. 2020]. To address these concerns, multiple privacy-preserving methods have been proposed for eye-tracking data. [David-John et al. 2021] 1 https://gitlab.lrz.de/hctl/private-scanpath-gc.

Proc. ACM Hum.-Comput. Interact., Vol. 10, No. 3, Article ETRA008. Publication date: May 2026.

ETRA008:4

Suleyman Ozdel, Amr Nader, Yasmeen Abdrabou, and Enkelejda Kasneci

evaluates three privacy mechanisms including Gaussian noise, temporal and spatial downsampling to reduce user reidentification risk in streamed gaze data. [Liu et al. 2019] applied Gaussian differential privacy (DP) to gaze heatmap, while [Steil et al. 2019b] used an exponential mechanism on aggregated features. Since DP mechanisms are vulnerable to data correlations, [Bozkir et al. 2021] adds frequency-domain decorrelation for temporal dependence. Similarly, [Li et al. 2021] uses DP to defend against spatio-temporal inference on gaze streams. [David-John et al. 2022, 2023] compared k-anonymity, plausible deniability, and DP, showing that k-anonymity offers the best gaze prediction performance, while plausible deniability and DP achieve balanced privacy-utility trade-offs. [Bozkir et al. 2020] introduced a randomized encoding framework that provides formal privacy guarantees. [Fuhl et al. 2021] used a reinforcement learning–based approach to protect subject and gender information, outperforming DP and GAN-based methods. [Elfares et al. 2023] enhanced gaze estimation in federated settings. [Elfares et al. 2024] propose PrivatEyes, a federatedlearning pipeline with secure MPC aggregation for appearance-based gaze estimation. Recently, QualitEye [Elfares et al. 2025] enabled privacy-preserving data quality verification by extending private set intersection, allowing gaze data consistency checks without exposing raw images. Specifically, in scanpath comparison, [Ozdel et al. 2024] proposed a homomorphic encryption protocol for privately computing Needleman–Wunsch-based edit distance. Similar secure two-party approaches using garbled circuits have been applied to DNA and genomic sequence alignment, though mainly limited to edit-distance-based metrics [Huang et al. 2011; Jha et al. 2005; Rane and Sun 2010]. In contrast, our work offers a cryptographic approach to scanpath similarity using garbled circuits and a server-assisted p2rotocol that enables encrypted storage with offline data owners. 2.3

Encrypted Data Storage and Offline Secure Computation

Previous works addressed the problem of combining data storage and secure processing by integrating different tools and developing interaction protocols where users can store and process their data safely [Kamara and Lauter 2010]. [Choi et al. 2007] introduced early decrypt-in-GC techniques, proving the feasibility of symmetric decryption within a circuit. [Manohar et al. 2020] introduced garbled encryption, a practical framework that unifies encrypted data storage and secure offline computation, enabling function evaluations directly on encrypted data without requiring the data owner to be online. [Poddar 2020] enable secure querying, collaborative analytics, network processing, and machine learning on encrypted data through a combination of multi-party computation, garbled circuits, and trusted execution environments. Systems such as Microsoft’s Secure Data Exchange [Gilad-Bachrach et al. 2019] support cloud-resident encrypted inputs but rely on per-session key material and label permutation, which requires semi-online data owners and keeps input ownership implicitly linkable across sessions. Unlike prior work, our approach separates long-term key management from computation via key wrapping and masked-key reconstruction, enabling reusable encrypted storage with data owners remaining offline (except for new client authorization) and unlinkable. We integrate integrity checking and in-circuit decryption so that authorized parties can compute on stored ciphertexts within a non-colluding architecture, providing strong confidentiality and practical reusability. In the following sections, we present the preliminaries and describe the protocol and circuit design in detail. 3

Preliminaries

In this section, we introduce secure computation tools, specifically garbled circuits and XOR masking. This enables secure function evaluation without revealing private inputs. Then, we describe Proc. ACM Hum.-Comput. Interact., Vol. 10, No. 3, Article ETRA008. Publication date: May 2026.

Secure Storage and Privacy-Preserving Scanpath Comparison via Garbled Circuits in Eye Tracking

ETRA008:5

cryptographic components such as symmetric encryption, key derivation, and key wrapping, which provide data confidentiality and secure key management. 3.1

Secure Multiparty Computation

Secure multiparty computation (SMPC) allows multiple parties to jointly compute a function over private inputs without revealing them beyond the agreed output [Ben-Or et al. 2019; Evans et al. 2018; Goldreich et al. 1987; Yao 1982]. Two primary styles of SMPC exist in practice: arithmetic protocols [Ben-Or et al. 2019; Damgård et al. 2012], which operate over finite rings using additive secret sharing [Shamir 1979], and Boolean protocols, which represent computations as bit-level circuits. In this work, we utilize boolean-based protocols, specifically garbled circuits and XOR masking. Garbled circuits are used to execute integrity checking, masked-key reconstruction, decryption, and scanpath comparison. XOR masking splits each decryption key into two shares and reconstructs it inside the garbled circuit. 3.1.1 Garbled Circuits (GC). GC represents a two-party special case of secure computation and enable two parties to jointly compute a function 𝑓 (𝑥, 𝑦) over their private inputs 𝑥 and 𝑦 without revealing them to each other [Bellare et al. 2012; Yao 1982, 1986]. One party, called the garbler, encrypts the Boolean circuit representation of 𝑓 by assigning two random cryptographic labels to each wire, corresponding to the binary values 0 and 1. The other party, called the evaluator, receives the encrypted circuit and the associated wire labels, and evaluates the circuit gate by gate using encrypted truth tables. While all intermediate wire values are hidden, only the final output is revealed. Formally, for each gate 𝐺 (𝑎, 𝑏) → 𝑐 and 𝐸𝐺 = {𝐸𝑎,𝑏 = Enc𝑘𝑎 ,𝑘𝑏 (𝑘𝑐 ) | 𝑎, 𝑏 ∈ {0, 1}}, where 𝑘𝑎 , 𝑘𝑏 , and 𝑘𝑐 denote the cryptographic labels of the input and output wires, consisting of uniformly random bit strings assigned to each wire to encode Boolean values without revealing their semantics. Each ciphertext 𝐸𝑎,𝑏 encrypts the output label 𝑘𝑐 for the gate output 𝑐 = 𝐺 (𝑎, 𝑏), using the input label pair (𝑘𝑎 , 𝑘𝑏 ) as encryption keys. During evaluation, the evaluator can decrypt only one entry per gate corresponding to the actual input labels. This reveals only the correct output label 𝑘𝑐 while keeping all other input combinations and intermediate values secret. Garbled circuits efficiently support bitwise operations such as AND, OR, and XOR, and represent inputs using integer or fixed-point arithmetic. They are effective for secure comparison, addition, and subtraction with moderate circuit depth and communication overhead, while nonlinear or iterative operations like division or trigonometric functions significantly increase circuit size and computation cost. Garbled circuits can also be composed sequentially, allowing multiple functions to be evaluated one after another without revealing any intermediate values. If 𝑓1, 𝑓2, . . . , 𝑓𝑛 denote a sequence of subfunctions, the secure evaluation can be written as y1 = 𝑓1 (𝑥 1, 𝑥 2 ), y2 = 𝑓2 (y1 ), . . . , y𝑛 = 𝑓𝑛 (y𝑛−1 ), where y𝑖 denotes the collection of garbled wire labels (not plaintext values) output by 𝑓𝑖 . These labels can be directly reused as input wire labels to 𝑓𝑖+1 without exposing any intermediate results. This composition preserves security, and the total computation and communication cost scale linearly. Such composability enables multi-stage analyses, such as decryption followed by scanpath comparison, to be executed securely without exposing intermediate data. 3.1.2 XOR Masking. XOR masking hides a secret by mixing it with an equal-length random string. Let 𝐾 ∈ {0, 1}128 be the secret key and 𝑅 ∈ {0, 1}128 the random mask. The masked key and its reconstruction are computed as 𝑀 = 𝐾 ⊕ 𝑅 and 𝐾 = 𝑀 ⊕ 𝑅, where ⊕ denotes the bitwise exclusive OR. Neither 𝑀 nor 𝑅 alone reveals information about 𝐾. This method is simple constant time and enables efficient obfuscation and secure reconstruction with perfect secrecy under one time use. In our server-assisted protocol, XOR masking splits the encryption key into two shares Proc. ACM Hum.-Comput. Interact., Vol. 10, No. 3, Article ETRA008. Publication date: May 2026.

ETRA008:6

Suleyman Ozdel, Amr Nader, Yasmeen Abdrabou, and Enkelejda Kasneci

stored on the server, with only the client’s share kept in wrapped form. The full key is reconstructed inside the garbled circuit with negligible overhead using free-XOR operations. 3.2

Cryptographic Foundations

We introduce the cryptographic fundamentals used in our system, including symmetric encryption to protect scanpath payloads (AES-CTR), asymmetric key derivation to establish shared secrets between parties (X25519), key wrapping mechanisms to securely transfer encryption keys (HKDF), and message authentication to ensure integrity (HMAC). 3.2.1 Symmetric Encryption (AES-CTR). Symmetric encryption uses one secret key for encryption and decryption. The Advanced Encryption Standard (AES) [Daemen and Rijmen 1999] is a widely used 128-bit symmetric block cipher based on substitution and permutation transformations. For a plaintext block 𝑃 and key 𝐾, encryption applies a sequence of linear and nonlinear transformations, while decryption performs the inverse operations in reverse order. AES supports several operational modes, and the counter (CTR) mode provides high efficiency and is suitable for use in garbled circuits as it allows parallel encryption of independent blocks structure and simple bitwise operations. In CTR mode, each plaintext block 𝑃𝑖 is encrypted as 𝐶𝑖 = 𝑃𝑖 ⊕ AES𝐾 (IV + 𝑖), where IV is a nonce and 𝑖 is the block counter. This property is advantageous for garbled-circuit–based designs, as each block requires only one forward AES operation followed by an XOR, minimizing circuit depth and computation cost. 3.2.2 Key Derivation and Wrapping (X25519–HKDF–AES-GCM). In the server-assisted setting, we use X25519 to derive a shared secret between Alice’s per-scanpath key pair and Bob’s static public key, and expand it via HKDF-SHA256 into a symmetric wrapping key. This wrapping key is then used with the AEAD scheme AES-GCM to encrypt the masked key 𝑀𝑖 = 𝐾𝑖 ⊕ 𝑅𝑖 as: 𝐾𝐴𝐵,𝑖 = X25519(𝑠𝑘𝐴,𝑖 , 𝑝𝑘𝐵 ),

𝐾wrap,𝑖 = HKDF(𝐾𝐴𝐵,𝑖 ),

𝐸𝑖 = AES-GCM_ENC(𝐾wrap,𝑖 , 𝑀𝑖 ).

Bob later derives the same 𝐾wrap,𝑖 and decrypts 𝐸𝑖 to recover 𝑀𝑖 , while the server cannot do so without Bob’s secret key. AES-GCM provides confidentiality and integrity for the wrapped masked key, and using a fresh (𝑠𝑘𝐴,𝑖 , 𝑝𝑘𝐴,𝑖 ) per scanpath supports unlinkability across stored items. In a multi-client setting, each client 𝐵 𝑗 holds its own independently generated X25519 key pair (𝑠𝑘𝐵 𝑗 , 𝑝𝑘𝐵 𝑗 ) rather than sharing a single secret key. Alice wraps 𝑀𝑖 separately for each authorized client using their respective public key 𝑝𝑘𝐵 𝑗 , without re-encrypting the stored ciphertext or mask. 3.2.3 Message Authentication (HMAC-SHA256). We use HMAC-SHA256 to provide ciphertext integrity and authenticity. Let 𝐾 ∈ {0, 1}128 be the AES-CTR key, IV ∈ {0, 1}128 the nonce in the header, and derive 𝐾mac = SHA256(𝐾 ∥ “MAC” ∥
IV). During upload, Alice computes the tag 𝑇 = HMAC-SHA256 𝐾mac, HEADER ∥ SHA256(CT) and stores it together with the ciphertext. At computation time, the server forwards (CT,𝑇 ) to Bob, and integrity is verified by checking equality with the expected HMAC. 4

Methodology

In this section, we describe the secure computation protocols that enable privacy-preserving scanpath comparison. It includes a two-party computation for online settings and a server-assisted two-party protocol supporting encrypted storage and offline data owners. Implementation details and the evaluation methodology are in the following Section 5. Proc. ACM Hum.-Comput. Interact., Vol. 10, No. 3, Article ETRA008. Publication date: May 2026.

Secure Storage and Privacy-Preserving Scanpath Comparison via Garbled Circuits in Eye Tracking

4.1

ETRA008:7

Threat Model

We assume a semi-honest adversary model, in which parties follow the protocol without any deviation but may attempt to infer additional information by analyzing their local transcripts, received messages, and outputs. We adopt this model as our primary concern is protecting input and data confidentiality rather than defending against active protocol deviations. All communication channels are authenticated and confidential. In the server-assisted configuration, the server and Bob are assumed to be non-colluding. In the two-party setting, only substitution matrices, gap penalties, and sequence lengths are public, and only the final similarity and MultiMatch component scores are revealed as an output. In the server-assisted setting, ciphertexts and headers are public, while decryption keys and plaintexts remain hidden. 4.2

Two-party Computation with Garbled Circuits

We design separate garbled circuits for three representative scanpath comparison algorithms within the garbled circuit framework. ScanMatch performs symbolic sequence alignment, MultiMatch provides geometric vector-based analysis, and SubsMatch captures probabilistic similarity in dynamic scenes. Each circuit is designed to securely compute the similarity score between two parties while ensuring that no intermediate or raw data is revealed to either party, except for the scanpath lengths and the final similarity scores. The two-party protocol is based on Yao’s garbled circuit construction and provides 128-bit security under standard assumptions [Lindell and Pinkas 2009], enabling efficient Boolean-circuit evaluation with minimal interaction while offering a widely accepted security level that aligns with contemporary cryptographic standards [bsi 2025; Barker and Roginsky 2024]. We define two parties, Alice and Bob, each holding their own scanpath data and jointly computing scanpath similarities. 4.2.1 ScanMatch. ScanMatch [Cristino et al. 2010] compares fixation sequences by representing scanpaths as strings of symbolic labels that encode spatial and temporal information. Each fixation is mapped to a symbol according to its position within a grid of areas of interest and its duration bin. The resulting symbolic sequences are aligned using the Needleman-Wunsch algorithm with a substitution matrix 𝑀 that captures spatial similarity and fixed penalties for insertions and deletions. The dynamic programming matrix is computed recursively as
𝑆 (𝑖, 𝑗) = max 𝑆 (𝑖 − 1, 𝑗 − 1) + 𝑀 (𝐴𝑖 , 𝐵 𝑗 ), 𝑆 (𝑖 − 1, 𝑗) − 𝑔del, 𝑆 (𝑖, 𝑗 − 1) − 𝑔ins and the final alignment score is normalized by the path length to obtain a similarity value in the range [0, 1]. In the secure computation protocol, each party computes its own symbolic scanpath locally. Alice, acting as the garbler, constructs the circuit that securely evaluates this recurrence. Bob’s input wire labels for his symbol sequence are obtained through oblivious transfer, which lets Bob obtain the correct input labels without revealing his bits to Alice, [Even et al. 1985; Ishai et al. 2003], ensuring his data remain hidden during circuit setup. Only public parameters such as sequence lengths, substitution matrix 𝑀, and gap penalties are shared, while all other data remain private. In the circuit, we use half gates and each row is computed using dynamically adjusted bit-widths to reduce gate count while preserving exact signed scores. Apart from scanpath lengths, only the final similarity score 𝑆 overall is revealed. This circuit design follows the optimizations proposed by [Huang et al. 2011]. 4.2.2 MultiMatch. MultiMatch [Dewhurst et al. 2012; Foulsham et al. 2012; Jarodzka et al. 2010] compares scanpaths as sequences of saccade vectors and evaluates similarity across five dimensions: shape, length, direction, position, and duration. Each scanpath is represented as a sequence of Proc. ACM Hum.-Comput. Interact., Vol. 10, No. 3, Article ETRA008. Publication date: May 2026.

ETRA008:8

Suleyman Ozdel, Amr Nader, Yasmeen Abdrabou, and Enkelejda Kasneci

consecutive saccades 𝐴 = {(Δ𝑥𝑖 , Δ𝑦𝑖 , amp𝑖 , 𝜃 𝑖 , turn𝑖 , 𝑠𝑖0, 𝑠𝑖1, ℓ𝑖 )}𝑚 𝑖=1,

′

′

𝐵 = {(Δ𝑥 ′𝑗 , Δ𝑦 ′𝑗 , amp′𝑗 , 𝜃 ′𝑗 , turn′𝑗 , 𝑠 0 𝑗 , 𝑠 1 𝑗 , ℓ 𝑗′ )}𝑛𝑗=1 .

In our secure implementation, both parties provide preprocessed saccade vectors as private inputs. Alice constructs the garbled circuit, while Bob provides his vectors as evaluator inputs. Bob’s input labels for per-saccade features are obtained through oblivious transfer. The alignment is implemented using dynamic time warping (DTW) over saccade displacements, replacing the Dijkstra’s algorithm in the MultiMatch procedure. In the original method, connections are restricted to the right, below, or below-right to preserve temporal order [Wagner et al. 2019], implicitly making the comparison graph directed and acyclic. Additionally, all edge weights represent non-negative vector differences. Under these two conditions, computing DTW is equivalent to a shortest-path problem, where the optimal path is the shortest path from (1,1) to (m,n), which can be computed via Dijkstra’s algorithm [Xi and Kuszmaul 2022]. The local alignment cost is the squared Euclidean distance to obtain the best match between saccade displacement vectors. It serves as a computationally convenient monotonic approximation of the true Euclidean distance. Formally, 𝐷𝑖,𝑗 = min{𝐷𝑖 −1,𝑗 , 𝐷𝑖,𝑗 −1, 𝐷𝑖 −1,𝑗 −1 } + 𝑐 (𝑖, 𝑗),

𝑐 (𝑖, 𝑗) = (Δ𝑥𝑖 − Δ𝑥 ′𝑗 ) 2 + (Δ𝑦𝑖 − Δ𝑦 ′𝑗 ) 2,

with the first row and column initialized cumulatively. Direction values are stored using 2-bit codes that represent up, left, or diagonal moves, other values use fixed-point format. The circuit performs secure equality, absolute, and arithmetic operations, accessing data with oblivious array selection. The optimal alignment path P is obtained by backtracking from (𝑚, 𝑛) using conditional selection gates, yielding a single alignment path consistent with the shortest-path formulation. For each matched pair, the circuit computes the five MultiMatch component deviations, where shape is derived from the wrapped turn angle difference between consecutive saccades, length from amplitude difference, direction from the wrapped angular difference within [−𝜋, 𝜋], position from the mean Euclidean distance between corresponding fixation start and end points, and duration as the normalized absolute difference |ℓ𝑖 − ℓ 𝑗′ |/max(ℓ𝑖 , ℓ 𝑗′ ). After backtracking, the circuit sums the deviations and counts for each component, and these values are normalized. Each component score is then revealed, and the overall similarity score is computed as the average of the five per-component scores. Thus, at the end of the protocol, only the scanpath lengths, the five component scores 𝑆𝑑 , and the overall score 𝑆 overall are revealed. 4.2.3 SubsMatch. SubsMatch [Kübler et al. 2014] compares scanpaths by analyzing the frequency of recurring subsequences (𝑛-grams) extracted from their symbolic representations. We transform each scanpath into a normalized frequency vector 𝑝 ∈ [0, 1]𝑑 , where each entry 𝑝𝑘 denotes the relative frequency of the 𝑘-th 𝑛-gram within a shared symbol alphabet of size 𝑑. In the secure protocol, both parties locally compute their respective frequency vectors 𝑝 and 𝑞 and input them into the garbled circuit. Using oblivious transfer, Bob privately obtains the input wire labels for all bits of 𝑞 while Alice assigns labels for 𝑝 and no plaintext values are revealed during input injection. The circuit evaluates the SubsMatch distance and normalized similarity in one step: 𝑑 ∑︁ 𝐷 (𝑝, 𝑞) = 12 |𝑝𝑘 − 𝑞𝑘 |, 𝑆 = 1 − 𝐷 (𝑝, 𝑞). 𝑘=1

All arithmetic uses fixed-point representation inside the GC, with constant depth per element and total linear complexity in 𝑑. We employ free-XOR and half-gate garbling to minimize AND-gate count and communication. Only the final similarity 𝑆 is revealed; no raw or intermediate frequencies leak. Proc. ACM Hum.-Comput. Interact., Vol. 10, No. 3, Article ETRA008. Publication date: May 2026.

Secure Storage and Privacy-Preserving Scanpath Comparison via Garbled Circuits in Eye Tracking

4.3

ETRA008:9

Server-assisted Two-party Computation and Secure Storage

This server-assisted two-party setup is designed for scenarios where Alice remains offline after uploading her data, while the server and Bob perform the computation. Alice uploads her encrypted scanpath data to the server along with the corresponding decryption keys for authorized parties. An authorized party, such as Bob, can later compare his scanpath data with Alice’s by decrypting the data inside the garbled circuit and then executing the two-party scanpath comparison protocols. The server stores the encrypted data and corresponding keys, and provides the garbled circuit and associated encrypted data to Bob during computation. Garbled-circuit composability ensures that the encrypted outputs of one circuit can directly serve as encrypted inputs to another. This property enables first decrypting scanpaths and then comparing them without revealing any intermediate data. In this protocol, Alice is the data owner; the Server stores data and generates the garbled circuit; Bob is the party who wants to process the data. Alice preprocesses her scanpaths and holds a set S𝐴 = {𝑆𝐴,1, 𝑆𝐴,2, . . . , 𝑆𝐴,𝑛 }, prepared according to the requirements of the corresponding scanpath comparison algorithm. For each scanpath 𝑆𝐴,𝑖 , Alice generates a unique 128-bit symmetric AES key 𝐾𝑖 ∈ {0, 1}128 and encrypts 𝐶𝑖 = AES_ENC(𝐾𝑖 , 𝑆𝐴,𝑖 ), where 𝐶𝑖 is the ciphertext. To protect 𝐾𝑖 , Alice generate a random 128-bit XOR mask 𝑅𝑖 ∈ {0, 1}128 and computes 𝑀𝑖 = 𝐾𝑖 ⊕ 𝑅𝑖 . Given 𝑀𝑖 , deducing 𝐾𝑖 is equivalent to deducing 𝑅𝑖 . Alice also generates an X25519 key pair (𝑠𝑘𝐴,𝑖 , 𝑝𝑘𝐴,𝑖 ) per scanpath. Bob generates and permanently stores his X25519 secret key 𝑠𝑘𝐵 locally and never shares. In a multi-client setting, each client 𝐵 𝑗 has its own key pair (𝑠𝑘𝐵 𝑗 , 𝑝𝑘𝐵 𝑗 ), and Alice authorizes a client by obtaining its public key and wrapping 𝑀𝑖 masked key to that recipient. Using Bob’s public key 𝑝𝑘𝐵 , Alice derives a wrapping key and computes 𝐾𝐴𝐵,𝑖 = X25519(𝑠𝑘𝐴,𝑖 , 𝑝𝑘𝐵 ),

𝐾wrap,𝑖 = HKDF(𝐾𝐴𝐵,𝑖 ),

𝐸𝑖 = Enc𝐾wrap,𝑖 (𝑀𝑖 ).

Alice uploads {𝐶𝑖 , 𝐸𝑖 , 𝑅𝑖 , 𝑝𝑘𝐴,𝑖 } to the Server, which stores the encrypted scanpaths with wrapped masked key. At this point, the data is securely stored on the Server. Without 𝑠𝑘𝐵 , the Server cannot derive 𝐾wrap,𝑖 and thus cannot recover 𝐾𝑖 or the plaintext scanpath. When Bob needs to compute, the Server sends {𝐸𝑖 , 𝑝𝑘𝐴,𝑖 } to Bob. Then, Bob derives 𝐾𝐴𝐵,𝑖 = X25519(𝑠𝑘𝐵 , 𝑝𝑘𝐴,𝑖 ) and then 𝐾wrap,𝑖 = HKDF(𝐾𝐴𝐵,𝑖 ), and computes 𝑀𝑖 = Dec𝐾wrap,𝑖 (𝐸𝑖 ). Thus, Bob holds only the masked key 𝑀𝑖 = 𝐾𝑖 ⊕ 𝑅𝑖 , but not 𝐾𝑖 or 𝑅𝑖 individually. Then, the Server prepares a garbled circuit that first performs decryption and subsequently computes the scanpath similarity. Inside the circuit, 𝐾𝑖 is reconstructed and the scanpath is decrypted securely: 𝐾𝑖 = 𝑀𝑖 ⊕ 𝑅𝑖 , 𝑆𝐴,𝑖 = AES_DEC(𝐾𝑖 , 𝐶𝑖 ). Before decryption, the server shares the ciphertext CT with Bob. Bob computes 𝑑 ′ = SHA256(CT𝐵 ) locally and provides (CT𝐵 , 𝑑 ′ ) as public inputs; the server provides (CT𝑆 , HEADER,𝑇 ). Inside the GC, a bytewise check CT𝑆 = CT𝐵 first binds 𝑑 ′ to the exact bytes being processed. The circuit reconstructs the AES key as 𝐾 = 𝑀𝑖 ⊕ 𝑅𝑖 , derives 𝐾mac = SHA256(𝐾 ∥ “MAC” ∥ IV), and verifies the tag via HMAC(𝐾mac, HEADER ∥ 𝑑 ′ ) = 𝑇 (see Appendix B). Only if both checks pass does the circuit run AES-CTR decryption on CT𝑆 . This keeps SHA-256 over the ciphertext external, binds the HMAC to the exact ciphertext via equality inside the GC, and ensures that 𝑆𝐴,𝑖 and 𝑆 𝐵 exist only as private bit scanpaths inside the circuit for subsequent functions such as scanpath comparison in Section 4.2. In this setting, we use AES for efficiency and standardized security, and efficient in-circuit decryption. XOR masking adds a lightweight key-obfuscation layer via bitwise operations. X25519 provides a secure, efficient shared secret between Alice and authorized parties (e.g., Bob) with low overhead. Using per-scanpath key pairs prevents Bob from linking encrypted scanpaths to the same owner, ensuring unlinkability in multi-user settings. Proc. ACM Hum.-Comput. Interact., Vol. 10, No. 3, Article ETRA008. Publication date: May 2026.

ETRA008:10

Suleyman Ozdel, Amr Nader, Yasmeen Abdrabou, and Enkelejda Kasneci

4.3.1 Security Guarantees. Ciphertexts (CT) and headers are provided as public inputs to the circuit, revealing only their lengths and allowing limited linkability when identical ciphertexts appear across sessions. The server stores ciphertexts and the corresponding mask shares, while Bob receives the wrapped masks from server and can reconstruct the AES keys only inside the circuit. Plaintext scanpaths and decryption keys remain hidden from both parties at all times. Further details are provided in Appendix C. In our threat model, if the server and Bob collude, confidentiality would be broken as the server holds the mask 𝑅𝑖 while Bob possesses the wrapped key material. To avoid this assumption, 𝑅𝑖 may be divided between two servers or managed by a trusted key manager. . 5 5.1

Implementation and Evaluation Implementation Details

We use Python for preprocessing to generate the scanpath vectors required by each comparison algorithm. Party-independent preprocessing steps (simplification, symbolization, duration binning) are performed locally. The interactive parts of the algorithms, which require data from both parties, are implemented in C++ with EMP toolkit under a two-party semi-honest model. Experiments run on a Linux (Intel Core i9-12900K, 64 GB RAM), with Alice and Bob on localhost.In-circuit fixedpoint arithmetic uses Q16.12 (MultiMatch), Q0.14 (SubsMatch), and integer scoring (ScanMatch). The LAN represents unrestricted local communication on the same Ubuntu host, reflecting pure computation cost. The WAN1 emulates a regional datacenter connection with a 1 Gbit/s link and a 10 ms one-way delay (~20 ms RTT), corresponding to fast cross-datacenter or campus-to-cloud conditions. Finally, the WAN2 models a wide-area Internet link with 100 Mbit/s bandwidth and a 50 ms one-way delay (~100 ms RTT), implemented using Linux tc netem. In the data preparation, for MultiMatch, we followed its existing preprocessing steps and applied path simplification to all datasets. Afterwards, we extracted the saccade sequence vectors for each component. For ScanMatch, each stimulus was discretized using a 9 × 9 grid, with unique symbols assigned to represent gaze transitions. In the case of SubsMatch, both the vector dimensionality and runtime are determined by the parameter 𝐴𝑛 , where 𝐴 denotes the alphabet size and 𝑛 the n-gram length. In our experiments, we evaluated configurations with 𝐴 = 5, 10, 15 and 𝑛 = 2, 3, 4; however, for clarity, in the general tables, we report results for 𝐴 = 10 and 𝑛 = 3. 5.2

Datasets

We evaluated our method on three eye-tracking datasets, Salient360, 360EM, and EHTask, to demonstrate its practical applicability across diverse stimuli, recording durations, sampling rates, and data characteristics. When fixation data was available, we used it directly; otherwise, we applied an adaptive fixation–saccade detection algorithm [Nyström and Holmqvist 2010] before following the standard processing steps for each algorithm. In the Salient360 dataset [Rai et al. 2017a,b, 2018], 48 participants viewed 60 360° stimuli for 25 s each on an HMD. The 360EM dataset [Agtzidis et al. 2019a,b] contains recordings from 13 observers viewing 15 panoramic videos, each approximately one minute long. Eye movements were recorded at 120 Hz as 2D gaze coordinates. The EHTask dataset [Hu et al. 2021a,b] contains recordings from 30 participants who viewed 15 immersive 150-second 360° videos designed for various visual tasks, including free viewing and object tracking. Eye-tracking was recorded at 100 Hz. For our evaluation, each dataset was split into two subsets assigned to Alice and Bob using a cross-subject split, where participants were randomly assigned to either Alice or Bob, and results Proc. ACM Hum.-Comput. Interact., Vol. 10, No. 3, Article ETRA008. Publication date: May 2026.

Secure Storage and Privacy-Preserving Scanpath Comparison via Garbled Circuits in Eye Tracking

ETRA008:11

were obtained for all randomly paired one-to-one cross-party pairs. In WAN settings, we evaluated 10 random pairs and report averaged computation times. 5.3

Two-party computation

We report the results for the two-party setting, including mean error, total computation time, and communication cost under different network conditions, together with dataset specifications in Table 1. In SubsMatch, we used the 𝐴 = 10 and 𝑛 = 3 setting. We obtain identical results for ScanMatch, and SubsMatch produces nearly identical results with a mean error of around 10−4 . In MultiMatch, there are small deviations between 0.007–0.015 across datasets. In datasets with shorter sequences, the error is higher compared to the longer ones. On EHTask, the dataset with the longest sequences, MultiMatch requires 8470 ms and 7676 MB communication on LAN, increasing the time to 83.76 s in WAN1 . ScanMatch remains more efficient with 716 ms and 661 MB, reaching 7.26 s in WAN1 and 62.78 s in WAN2 . On Salient360, MultiMatch takes 454 ms and 453 MB, while ScanMatch completes in 15.8 ms and 13.6 MB, increasing to 41.8 s in WAN2 . On 360EM, MultiMatch completes in 1593 ms and 1408 MB, with 15.09 s in WAN1 , while ScanMatch remains efficient at 125 ms and 118 MB. SubsMatch is dataset independent due to its fixed input size, with 21.4 ms and 2.66 MB on LAN, increasing moderately to 20.8 s in WAN1 and 101.8 s in WAN2 , while maintaining a mean error below 10−4 . Detailed LAN computation time and communication bandwidth results for MultiMatch and ScanMatch are provided in Appendix A. Table 1. Mean metrics for MultiMatch, ScanMatch, and SubsMatch (mean ± std). SubsMatch uses 𝑎10–𝑛3. LAN, WAN1 , and WAN2 correspond to different network speeds. Algorithm

Dataset

Seq. Length

Comm. (MB)

LAN Time (ms)

WAN1 WAN2 Time (s) Time (s)

MAE (±)

MultiMatch

EHTask Salient360 360EM

222 58 102

7676.182 ± 2981.115 453.515 ± 161.127 1408.020 ± 486.301

8470.140 ± 4595.165 454.185 ± 204.060 1593.173 ± 945.475

83.758 5.407 15.086

1314.896 41.826 127.630

0.00743 ± 0.00927 0.01513 ± 0.03195 0.01188 ± 0.01547

ScanMatch

EHTask Salient360 360EM

372 59 166

659.986 ± 305.457 13.610 ± 4.777 118.100 ± 42.384

715.649 ± 321.392 15.788 ± 5.364 125.458 ± 44.823

7.264 0.304 1.430

62.780 1.900 11.643

0.00000 ± 0.00000 0.00000 ± 0.00000 0.00000 ± 0.00000

SubsMatch

All

1000

2.657 ± 0.000

21.445 ± 1.216

20.842

101.768

0.00019 ± 0.00028

The deviation of each MultiMatch component from the plain results is shown in Table 2. The deviations remain small across all components. length and position show the lowest differences, both below 0.003 in general. Shape and Direction components have slightly higher deviations around 0.02–0.03. Duration shows the highest variation among components, reaching up to 0.17 in some cases, indicating higher sensitivity to temporal scaling. Overall, the deviation pattern tend to produce slightly higher deviations in shorter sequences compared to longer sequence comparisons. Table 2. Component-wise MultiMatch errors (mean absolute error ± root mean square error) across datasets. Dataset

Algorithm

Shape

Length

Direction

Position

Duration

EHTask Salient360 360EM

MultiMatch MultiMatch MultiMatch

0.0202 ± 0.0256 0.0340 ± 0.0509 0.0300 ± 0.0371

0.0021 ± 0.0029 0.0135 ± 0.0316 0.0109 ± 0.0141

0.0182 ± 0.0229 0.0364 ± 0.0534 0.0220 ± 0.0290

0.0023 ± 0.0030 0.0261 ± 0.0445 0.0076 ± 0.0108

0.0149 ± 0.0204 0.0312 ± 0.0485 0.0310 ± 0.0435

For SubsMatch, Table 3 presents computation time and communication cost across grid sizes and 𝑛-gram settings under different network conditions. Since the vector size depends on the grid Proc. ACM Hum.-Comput. Interact., Vol. 10, No. 3, Article ETRA008. Publication date: May 2026.

ETRA008:12

Suleyman Ozdel, Amr Nader, Yasmeen Abdrabou, and Enkelejda Kasneci

resolution 𝑎 and the 𝑛-gram order 𝑛, the runtime is configuration-driven rather than the sequence length. For smaller configurations such as (5, 2) or (10, 2), computation remains below 12 ms on LAN with under 1 MB communication. Moderate settings like (10, 3) and (15, 3) show LAN times of 25.9 ms and 66.5 ms, increasing to 20.9 s and 70.1 s in WAN1 . The largest configuration (15, 4), with vector size 154 = 50,625, reaches 212.7 MB communication and about 796 ms on LAN, extending to 1049.1 s in WAN1 . Table 3. Effect of grid size (𝑎) and neighborhood size (𝑛) on SubsMatch performance (mean time, averaged across datasets).

5.4

Config (𝑎, 𝑛)

(5,2)

(5,3)

(5,4)

(10,2)

(10,3)

(10,4)

(15,2)

(15,3)

(15,4)

LAN Time (ms) WAN1 Time (s) WAN2 Time (s) Comm. (MB)

10.4 0.69 3.28 0.33

11.2 2.75 13.37 0.57

17.1 13.09 63.88 1.76

11.0 2.22 10.85 0.51

21.4 20.84 101.77 2.66

131.0 207.22 1011.35 26.35

12.4 4.83 23.44 0.81

51.2 70.03 341.31 8.87

625.8 1048.29 5109.34 133.35

Server-assisted Two-party Computation

In the previous section, we reported results for the two-party scanpath comparison methods implemented as core functionalities in garbled circuits. Here, we focus on the server-assisted protocol, where both the HMAC integrity verification and AES–CTR decryption are executed inside the garbled circuit. Table 4 presents the mean metrics for the encryption phase and the in-circuit integrity verification combined with decryption, including total encryption time, communication cost, and the average sequence lengths for each dataset. It is important to note that ScanMatch uses raw fixation sequences, while MultiMatch applies an initial simplification, leading to different average sequence lengths on the same datasets. The encryption phase, which includes per-file key generation, ciphertext creation, and HMAC computation, is fully local and is typically 0.7–1.1 ms per scanpath. During in-circuit decryption and integrity verification, MultiMatch has the highest cost due to its long sequences, requiring ≈ 252 MB communication and ≈ 550 ms on LAN, increasing to ≈ 31.7 s in WAN1 and ≈ 156.9 s in WAN2 . ScanMatch is generally faster, with 20.3 MB communication and 36.8 ms on LAN for EHTask, 4.67 MB and 27.9 ms for Salient360, and 16.19 MB and 30.7 ms for 360EM. In the WAN2 configuration for the largest dataset (ScanMatch/EHTask), the total time is about 6.0 s. SubsMatch is the same across datasets due to its fixed vector length (𝑎 = 10, 𝑛 = 3), requiring ≈ 65 MB communication and ≈ 142 ms on LAN, increasing to ≈ 6.5 s in WAN1 and ≈ 25.7 s in WAN2 . Table 4. Encryption and in-circuit integrity verification + AES-CTR decryption (mean ± std). SubsMatch uses 𝑎10-𝑛3. Algorithm

Dataset

Seq. Len.

Enc. (ms)

Comm. (MB)

Integrity Check + Decryption LAN (ms) WAN1 (s)

WAN2 (s)

MultiMatch

EHTask Salient360 360EM

222 58 102

1.060 ± 0.176 0.764 ± 1.403 1.083 ± 0.274

252.360 ± 63.960 76.550 ± 14.670 120.030 ± 23.560

550.130 ± 142.140 161.510 ± 33.140 257.670 ± 50.790

31.698 7.046 12.576

156.890 35.470 62.540

ScanMatch

EHTask Salient360 360EM

372 59 166

0.675 ± 0.513 0.720 ± 2.058 1.110 ± 1.857

20.280 ± 1.320 4.670 ± 1.190 16.190 ± 0.190

36.830 ± 3.080 27.930 ± 0.950 30.690 ± 1.250

1.113 0.654 0.791

6.003 3.700 4.340

SubsMatch

All

1000

0.670 ± 0.018

64.570 ± 0.000

142.100 ± 2.240

6.499

25.711

Proc. ACM Hum.-Comput. Interact., Vol. 10, No. 3, Article ETRA008. Publication date: May 2026.

Secure Storage and Privacy-Preserving Scanpath Comparison via Garbled Circuits in Eye Tracking

6

ETRA008:13

Discussion

We introduced a privacy-preserving scanpath comparison protocol that is designed for secure and efficient processing of eye-tracking data. We have two settings: a standard two-party setting, which enables one-to-one scanpath comparison, and a server-assisted setting, where the data owner can stay offline while still supporting multiple data owners and authenticated data clients, except when authorizing new clients. This structure allows both individual and scalable use under semi-honest, non-colluding assumptions and practical performance constraints. 6.1

Secure Two-Party Scanpath Comparison

In the two-party setting, we enable private scanpath comparison in garbled circuits, keeping results as close as possible to the plaintext algorithms. As is common in MPC, real-valued computations are implemented using fixed-point arithmetic. ScanMatch uses integer scoring and produces identical results. In SubsMatch, deviations arise solely from fixed-point rounding and can be reduced by increasing precision at the cost of larger circuits and longer runtime. For MultiMatch, the squared Euclidean cost approximation and the DTW origin initialization convention also contribute to the observed deviations alongside fixed-point quantization. Runtime and communication size mainly depend on the sequence length. ScanMatch and SubsMatch run in milliseconds with low megabytes of traffic. MultiMatch is heavier because of the DTW alignment and its five components, which makes it less practical for long sequences but still remains usable for shorter ones. For long sequences, using L1 cost can slightly increase the approximation error but reduces the communication load and circuit size substantially, which makes it more efficient for large-scale processing. When compared to existing homomorphic encryption-based privacy-preserving scanpath comparison approach, such as the Needleman-Wunsch-based method proposed in [Ozdel et al. 2024], our protocol shows a significant improvement in efficiency. To make a fair comparison, we consider the ScanMatch algorithm since it follows a similar sequence alignment principle. In their reported results, a case with 𝑚 = 𝑛 = 50 requires approximately 2270 s for computation, whereas in our protocol, using the Salient360 dataset with an average sequence length of 59, the same computation is completed in about 15 ms with only 13 MB communication, and around 1.9 s even under the WAN2 condition with slow network. Additionally, our two-party protocol is not limited to the Needleman–Wunsch-based method but also supports the evaluation of MultiMatch and SubsMatch. 6.2

Server-assisted Two-Party Computation

In the server-assisted setting, the data owner uploads encrypted scanpaths once and authorizes one or more evaluators. After upload, the data owner can remain offline while authorized parties compute similarity over the stored ciphertexts. The data owner needs to be online only to authorize additional evaluators, which requires generating new wrapped key material and does not require re-encrypting the stored data. Encryption runs locally and takes about 1 ms per scanpath, so the uploader’s computational load is minimal. During decryption and function evaluation on the server and client side, integrity verification (HMAC) and AES-CTR decryption are executed inside the garbled circuit (Table 4). The dominant cost comes from the AES decryption operation itself, since the verification hash is computed outside the circuit and only ciphertext equality and HMAC evaluation are performed inside. Once decrypted, scanpath comparison proceeds exactly as in the secure two-party setting. More generally, the server-assisted protocol provides encrypted storage, access control, and in-circuit processing, and naturally supports multiple data owners and authorized evaluators. Any Proc. ACM Hum.-Comput. Interact., Vol. 10, No. 3, Article ETRA008. Publication date: May 2026.

ETRA008:14

Suleyman Ozdel, Amr Nader, Yasmeen Abdrabou, and Enkelejda Kasneci

analysis that can be expressed as a Boolean circuit, such as statistics, linear regression, or SVM inference, can be executed on stored ciphertexts in the same pipeline. In this protocol, we assume a semi-honest, non-colluding model between the server and the evaluator. This matches common eye-tracking settings in which an institutional repository or cloud provider stores encrypted eye-tracking data and authorized collaborators from other institutions evaluate their functions. If desired, the non-collusion assumption can be relaxed by splitting key shares across two independent servers or by introducing a trusted key manager for authorization. In both cases, new evaluators can be authorized without re-encrypting or re-uploading the stored data, by only sharing the corresponding wrapped key material. In practice, the protocol can be applied to datasets that institutions cannot share directly, enabling cross-institution collaboration. It can also be applied to user-centric settings where individual users upload encrypted data and an application provider can provide utility only for explicitly approved analyses, without learning raw eye-tracking data. The former use case keeps users’ eye-tracking data safer against unapproved analyses; by reducing user concerns, it may facilitate the delivery of privacy-compliant utility. The latter one allows users to realize desired utility. For example, in health-related settings, a user could compare their scanpaths against a large reference dataset maintained by an institute to learn whether there might be a health concern. However, in this setting, for an individual user (the authenticated evaluator in this case), comparing against thousands of reference scanpaths may be feasible for shorter sequences, while for longer scanpaths it may be more practical to compare against representative or downsampled scanpaths to keep runtime and communication manageable. At the institutional level, datasets can be uploaded and shared under access control, enabling broader scanpath analyses; while runtime and communication overhead are not instantaneous, they remain feasible. 6.3

Privacy and Ethics

As we already know, eye-tracking data contains highly personal information—patterns of gaze can reveal attention, intent, and even biometric identity [Kröger et al. 2020]. This makes data sharing subject to strict regulations such as the GDPR and CCPA. Our work supports privacy-preserving scanpath analysis by enabling similarity computation on encrypted data without exposing individual fixations or raw gaze traces, thereby helping mitigate ethical and legal challenges associated with sharing sensitive eye-tracking data while supporting data minimization and purpose-limited use. This approach puts “privacy by design” in action, providing technical guarantees of confidentiality and integrity rather than relying solely on institutional trust. It enables cross-lab and cross-border collaboration on gaze analytics while maintaining compliance with data-protection principles. By embedding privacy preservation into the analytic workflow itself, our method supports responsible, reproducible, and ethically sound eye-tracking research—helping the community advance open science without compromising participant rights. 6.4

Limitations and Future Work

Our approach works under the semi-honest assumption and a non-colluding server-client model and does not cover active adversaries. It is vulnerable to server–client collusion. Although Alice remains offline after data upload, she must be online to authorize new clients, which can be addressed by delegating authorization to a trusted key manager. For scanpath comparison algorithms, public parameters such as sequence lengths, grids, and quantization settings are revealed. Communication and runtime increase with scanpath size, making MultiMatch more demanding for longer sequences. As future work, we plan to extend the protocol to the malicious model with stronger privacy guarantees and side-channel resistance, and to optimize circuit design to reduce computation and communication overhead for long scanpaths. Proc. ACM Hum.-Comput. Interact., Vol. 10, No. 3, Article ETRA008. Publication date: May 2026.

Secure Storage and Privacy-Preserving Scanpath Comparison via Garbled Circuits in Eye Tracking

7

ETRA008:15

Conclusion

We presented a garbled circuit based protocol for secure storage and privacy preserving scanpath comparison and implemented three representative methods, MultiMatch, ScanMatch, and SubsMatch, under a semi-honest model. Our two-party results closely match plaintext outputs while keeping all intermediate data hidden. The server-assisted extension enables practical use with offline data owners by reconstructing keys and decrypting only inside the circuit. In our evaluation, ScanMatch and SubsMatch operate in the millisecond range with only a few megabytes of communication, whereas MultiMatch requires about 10 seconds of computation on LAN. These findings show that secure scanpath analysis is feasible without sacrificing utility, and directly address the practical need to compare gaze behavior across organizations without exchanging raw eye-tracking data. In turn, this can enable compliant data sharing and cross-lab collaboration while preserving confidentiality under common privacy and ethics constraints. The approach generalizes to other algorithms that can be expressed as Boolean circuits and can support broader privacy-preserving gaze analytics. Acknowledgments This project is supported by the Chips Joint Undertaking (Chips JU) and its members, including top-up funding by Denmark, Germany, Netherlands, Sweden, under grant agreement No. 101139942. References 2025. Cryptographic Mechanisms: Recommendations and Key Lengths, BSI TR-02102-1. Technical Report. Federal Office for Information Security (BSI). https://www.bsi.bund.de/SharedDocs/Downloads/EN/BSI/Publications/TechGuidelines/ TG02102/BSI-TR-02102-1.pdf?__blob=publicationFile&v=9 Yasmeen Abdrabou, Süleyman Özdel, Virmarie Maquiling, Efe Bozkir, and Enkelejda Kasneci. 2025. From Gaze to Data: Privacy and Societal Challenges of Using Eye-tracking Data to Inform GenAI Models. In Proceedings of the 2025 Symposium on Eye Tracking Research and Applications. ACM, 109:1–109:9. doi:10.1145/3715669.3726788 Isayas Berhe Adhanom, Paul MacNeilage, and Eelke Folmer. 2023. Eye tracking in virtual reality: a broad review of applications and challenges. Virtual Reality 27, 2 (2023), 1481–1505. Ioannis Agtzidis, Mikhail Startsev, and Michael Dorr. 2019a. 360EM: Ground-truth eye movement dataset for 360-degree videos. https://gin.g-node.org/ioannis.agtzidis/360_em_dataset Accessed: 2026-01-23. Ioannis Agtzidis, Mikhail Startsev, and Michael Dorr. 2019b. A ground-truth data set and a classification algorithm for eye movements in 360-degree videos. arXiv preprint arXiv:1903.06474 (2019). Nicola C Anderson, Fraser Anderson, Alan Kingstone, and Walter F Bischof. 2015. A comparison of scanpath comparison methods. Behavior research methods 47 (2015), 1377–1392. Nicola C Anderson, Walter F Bischof, Kaitlin EW Laidlaw, Evan F Risko, and Alan Kingstone. 2013. Recurrence quantification analysis of eye movements. Behavior research methods 45, 3 (2013), 842–856. Gennady Andrienko, Natalia Andrienko, Michael Burch, and Daniel Weiskopf. 2012. Visual analytics methodology for eye movement studies. IEEE transactions on Visualization and Computer Graphics 18, 12 (2012), 2889–2898. Elaine Barker and Allen Roginsky. 2024. Transitioning the Use of Cryptographic Algorithms and Key Lengths, SP 800-131A Revision 3 (Initial Public Draft). Technical Report. National Institute of Standards and Technology. doi:10.6028/NIST.SP.800131Ar3.ipd Mihir Bellare, Viet Tung Hoang, and Phillip Rogaway. 2012. Foundations of garbled circuits. In Proceedings of the 2012 ACM Conference on Computer and Communications Security (Raleigh, North Carolina, USA) (CCS ’12). Association for Computing Machinery, New York, NY, USA, 784–796. doi:10.1145/2382196.2382279 Michael Ben-Or, Shafi Goldwasser, and Avi Wigderson. 2019. Completeness theorems for non-cryptographic fault-tolerant distributed computation. In Providing sound foundations for cryptography: on the work of Shafi Goldwasser and Silvio Micali. 351–371. Sophie C Boerman and Céline M Müller. 2022. Understanding which cues people use to identify influencer marketing on Instagram: an eye tracking study and experiment. International Journal of Advertising 41, 1 (2022), 6–29. Ali Borji and Laurent Itti. 2014. Defending Yarbus: Eye movements reveal observers’ task. Journal of vision 14, 3 (2014), 29–29. Efe Bozkir, Onur Günlü, Wolfgang Fuhl, Rafael F. Schaefer, and Enkelejda Kasneci. 2021. Differential privacy for eye tracking with temporal correlations. PLOS ONE 16, 8 (2021), 1–22. doi:10.1371/journal.pone.0255979 Proc. ACM Hum.-Comput. Interact., Vol. 10, No. 3, Article ETRA008. Publication date: May 2026.

ETRA008:16

Suleyman Ozdel, Amr Nader, Yasmeen Abdrabou, and Enkelejda Kasneci

Efe Bozkir, Suleyman Ozdel, Mengdi Wang, Brendan David-John, Hong Gao, Kevin Butler, Eakta Jain, and Enkelejda Kasneci. 2023. Eye-tracked virtual reality: A comprehensive survey on methods and privacy challenges. arXiv preprint arXiv:2305.14080 (2023). Efe Bozkir, Ali Burak Ünal, Mete Akgün, Enkelejda Kasneci, and Nico Pfeifer. 2020. Privacy Preserving Gaze Estimation Using Synthetic Images via a Randomized Encoding Based Framework. In ACM Symposium on Eye Tracking Research and Applications. ACM. doi:10.1145/3379156.3391364 Andreas Bulling and Michel Wedel. 2019. Pervasive eye-tracking for real-world consumer behavior analysis. In A handbook of process tracing methods. Routledge, 27–44. Nora Castner, Enkelejda Kasneci, Thomas Kübler, Katharina Scheiter, Juliane Richter, Thérése Eder, Fabian Hüttig, and Constanze Keutel. 2018. Scanpath comparison in medical image reading skills of dental students: distinguishing stages of expertise development. In Proceedings of the 2018 ACM Symposium on Eye Tracking Research & Applications. 1–9. Nora Castner, Thomas C Kuebler, Katharina Scheiter, Juliane Richter, Thérése Eder, Fabian Hüttig, Constanze Keutel, and Enkelejda Kasneci. 2020. Deep semantic gaze embedding and scanpath comparison for expertise classification during OPT viewing. In ACM symposium on eye tracking research and applications. 1–10. Meia Chita-Tegmark. 2016. Social attention in ASD: A review and meta-analysis of eye-tracking studies. Research in developmental disabilities 48 (2016), 79–93. Seung Geol Choi, Ariel Elbaz, Ari Juels, Tal Malkin, and Moti Yung. 2007. Two-party computing with encrypted data. In International Conference on the Theory and Application of Cryptology and Information Security. Springer, 298–314. Filipe Cristino, Sebastiaan Mathôt, Jan Theeuwes, and Iain D Gilchrist. 2010. ScanMatch: A novel method for comparing fixation sequences. Behavior research methods 42 (2010), 692–700. Joan Daemen and Vincent Rijmen. 1999. AES proposal: Rijndael. (1999). Ivan Damgård, Valerio Pastro, Nigel Smart, and Sarah Zakarias. 2012. Multiparty computation from somewhat homomorphic encryption. In Annual cryptology conference. Springer, 643–662. Brendan David-John, Kevin Butler, and Eakta Jain. 2022. For Your Eyes Only: Privacy-Preserving Eye-Tracking Datasets. In 2022 Symposium on Eye Tracking Research and Applications. ACM. doi:10.1145/3517031.3529618 Brendan David-John, Kevin Butler, and Eakta Jain. 2023. Privacy-preserving datasets of eye-tracking samples with applications in XR. IEEE Transactions on Visualization and Computer Graphics 29, 5 (2023), 2774–2784. doi:10.1109/TVCG.2023. 3247048 Brendan David-John, Diane Hosfelt, Kevin Butler, and Eakta Jain. 2021. A privacy-preserving approach to streaming eye-tracking data. IEEE Transactions on Visualization and Computer Graphics 27, 5 (2021), 2555–2565. Richard Dewhurst, Marcus Nyström, Halszka Jarodzka, Tom Foulsham, Roger Johansson, and Kenneth Holmqvist. 2012. It depends on how you look at it: Scanpath comparison in multiple dimensions with MultiMatch, a vector-based approach. Behavior Research Methods 44, 4 (2012), 1079–1100. doi:10.3758/s13428-012-0212-2 Morris Dworkin. 2001. Recommendation for block cipher modes of operation. NIST special publication 800 (2001), 38B. Mayar Elfares, Zhiming Hu, Pascal Reisert, Andreas Bulling, and Ralf Küsters. 2023. Federated Learning for Appearancebased Gaze Estimation in the Wild. In Proceedings of The 1st Gaze Meets ML workshop (Proceedings of Machine Learning Research, Vol. 210). PMLR, 20–36. https://proceedings.mlr.press/v210/elfares23a.html Mayar Elfares, Pascal Reisert, Zhiming Hu, Wenwu Tang, Ralf Küsters, and Andreas Bulling. 2024. PrivatEyes: appearancebased gaze estimation using federated secure multi-party computation. Proceedings of the ACM on Human-Computer Interaction 8, ETRA (2024), 1–23. Mayar Elfares, Pascal Reisert, Ralf Küsters, and Andreas Bulling. 2025. QualitEye: Public and Privacy-preserving Gaze Data Quality Verification. arXiv preprint arXiv:2506.05908 (2025). David Evans, Vladimir Kolesnikov, and Mike Rosulek. 2018. A Pragmatic Introduction to Secure Multi-Party Computation. Found. Trends Priv. Secur. 2, 2–3 (Dec. 2018), 70–246. doi:10.1561/3300000019 Shimon Even, Oded Goldreich, and Abraham Lempel. 1985. A randomized protocol for signing contracts. Commun. ACM 28, 6 (1985), 637–647. Tom Foulsham, Richard Dewhurst, Marcus Nyström, Halszka Jarodzka, Roger Johansson, Geoffrey Underwood, and Kenneth Holmqvist. 2012. Comparing scanpaths during scene encoding and recognition: A multi-dimensional approach. Journal of Eye Movement Research 5, 4 (2012). Wolfgang Fuhl, Efe Bozkir, and Enkelejda Kasneci. 2021. Reinforcement Learning for the Privacy Preservation and Manipulation of Eye Tracking Data. In Artificial Neural Networks and Machine Learning – ICANN 2021. Springer International Publishing, 595–607. Ran Gilad-Bachrach, Kim Laine, Kristin Lauter, Peter Rindal, and Mike Rosulek. 2019. Secure data exchange: A marketplace in the cloud. In Proceedings of the 2019 ACM SIGSAC Conference on Cloud Computing Security Workshop. 117–128. O. Goldreich, S. Micali, and A. Wigderson. 1987. How to play ANY mental game. In Proceedings of the Nineteenth Annual ACM Symposium on Theory of Computing (New York, New York, USA) (STOC ’87). Association for Computing Machinery, New York, NY, USA, 218–229. doi:10.1145/28395.28420

Proc. ACM Hum.-Comput. Interact., Vol. 10, No. 3, Article ETRA008. Publication date: May 2026.

Secure Storage and Privacy-Preserving Scanpath Comparison via Garbled Circuits in Eye Tracking

ETRA008:17

Reiko Graham, Alison Hoover, Natalie A. Ceballos, and Oleg Komogortsev. 2011. Body mass index moderates gaze orienting biases and pupil diameter to high and low calorie food images. Appetite 56, 3 (2011), 577–586. doi:10.1016/j.appet.2011.01. 029 Inken Hagestedt, Michael Backes, and Andreas Bulling. 2020. Adversarial attacks on classifiers for eye-based user modelling. In ACM symposium on eye tracking research and applications. 1–3. Corey Holland and Oleg V Komogortsev. 2011. Biometric identification via eye movement scanpaths in reading. In 2011 International joint conference on biometrics (IJCB). IEEE, 1–8. Zhiming Hu, Andreas Bulling, Sheng Li, and Guoping Wang. 2021a. EHTask Dataset: Eye and head movement recordings for task recognition in immersive VR. https://zhiminghu.net/hu22_ehtask.html Accessed: 2026-01-23. Zhiming Hu, Andreas Bulling, Sheng Li, and Guoping Wang. 2021b. Ehtask: Recognizing user tasks from eye and head movements in immersive virtual reality. IEEE Transactions on Visualization and Computer Graphics (2021). Yan Huang, David Evans, Jonathan Katz, and Lior Malka. 2011. Faster secure {Two-Party} computation using garbled circuits. In 20th USENIX Security Symposium (USENIX Security 11). Yuval Ishai, Joe Kilian, Kobbi Nissim, and Erez Petrank. 2003. Extending oblivious transfers efficiently. In Annual International Cryptology Conference. Springer, 145–161. Halszka Jarodzka, Kenneth Holmqvist, and Marcus Nyström. 2010. A vector-based, multidimensional scanpath similarity measure. In Proceedings of the 2010 symposium on eye-tracking research & applications. 211–218. Somesh Jha, Luis Kruger, and Patrick McDaniel. 2005. Privacy preserving clustering. In European symposium on research in computer security. Springer, 397–417. Seny Kamara and Kristin Lauter. 2010. Cryptographic cloud storage. In International Conference on Financial Cryptography and Data Security. Springer, 136–149. Fengfeng Ke, Ruohan Liu, Zlatko Sokolikj, Ibrahim Dahlstrom-Hakki, and Maya Israel. 2024. Using eye-tracking in education: review of empirical research and technology. Educational technology research and development 72, 3 (2024), 1383–1418. Krzysztof Krejtz, Andrew T Duchowski, Anna Niedzielska, Cezary Biele, and Izabela Krejtz. 2018. Eye tracking cognitive load using pupil diameter and microsaccades with fixed gaze. PloS one 13, 9 (2018), e0203629. Jacob Leon Kröger, Otto Hans-Martin Lutz, and Florian Müller. 2020. What Does Your Gaze Reveal About You? On the Privacy Implications of Eye Tracking. Springer International Publishing, 226–241. doi:10.1007/978-3-030-42504-3_15 Thomas C. Kübler, Enkelejda Kasneci, and Wolfgang Rosenstiel. 2014. SubsMatch: Scanpath similarity in dynamic scenes based on subsequence frequencies. In Proceedings of the Symposium on Eye Tracking Research and Applications. ACM, 319–326. doi:10.1145/2578153.2578206 Jingjie Li, Amrita Roy Chowdhury, Kassem Fawaz, and Younghyun Kim. 2021. Kal𝜖ido: Real-Time Privacy Control for Eye-Tracking Systems. In USENIX Security Symposium. USENIX Association. Daniel J. Liebling and Sören Preibusch. 2014. Privacy Considerations for a Pervasive Eye Tracking World. In Proceedings of the 2014 ACM International Joint Conference on Pervasive and Ubiquitous Computing: Adjunct Publication. ACM, 1169–1177. doi:10.1145/2638728.2641688 Yehuda Lindell and Benny Pinkas. 2009. A proof of security of Yao’s protocol for two-party computation. Journal of cryptology 22, 2 (2009), 161–188. Ao Liu, Lirong Xia, Andrew Duchowski, Reynold Bailey, Kenneth Holmqvist, and Eakta Jain. 2019. Differential Privacy for Eye-Tracking Data. In Proceedings of the 11th ACM Symposium on Eye Tracking Research & Applications. ACM. doi:10.1145/3314111.3319823 Nathan Manohar, Abhishek Jain, and Amit Sahai. 2020. Self-processing private sensor data via garbled encryption. Proceedings on Privacy Enhancing Technologies (2020). Saul B Needleman and Christian D Wunsch. 1970. A general method applicable to the search for similarities in the amino acid sequence of two proteins. Journal of molecular biology 48, 3 (1970), 443–453. Jakub Štěpán Novák, Jan Masner, Petr Benda, Pavel Šimek, and Vojtěch Merunka. 2024. Eye tracking, usability, and user experience: A systematic review. International Journal of Human–Computer Interaction 40, 17 (2024), 4484–4500. Marcus Nyström and Kenneth Holmqvist. 2010. An adaptive algorithm for fixation, saccade, and glissade detection in eyetracking data. Behavior research methods 42, 1 (2010), 188–204. Suleyman Ozdel, Efe Bozkir, and Enkelejda Kasneci. 2024. Privacy-preserving scanpath comparison for pervasive eye tracking. Proceedings of the ACM on Human-Computer Interaction 8, ETRA (2024), 1–28. doi:10.1145/3655605 Suleyman Ozdel, Can Sarpkaya, Efe Bozkir, Hong Gao, and Enkelejda Kasneci. 2025. Examining the Role of LLM-Driven Interactions on Attention and Cognitive Engagement in Virtual Classrooms. arXiv preprint arXiv:2505.07377 (2025). Rishabh Poddar. 2020. Secure Computation Systems for Confidential Data Analysis. Ph. D. Dissertation. University of California, Berkeley. Yashas Rai, Jesús Gutiérrez, and Patrick Le Callet. 2017a. A dataset of head and eye movements for 360 degree images. In Proceedings of the 8th ACM on Multimedia Systems Conference. 205–210.

Proc. ACM Hum.-Comput. Interact., Vol. 10, No. 3, Article ETRA008. Publication date: May 2026.

ETRA008:18

Suleyman Ozdel, Amr Nader, Yasmeen Abdrabou, and Enkelejda Kasneci

Yashas Rai, Patrick Le Callet, and Philippe Guillotel. 2017b. Which saliency weighting for omni directional image quality assessment?. In 2017 Ninth International Conference on Quality of Multimedia Experience (QoMEX). IEEE, 1–6. Yashas Rai, Patrick Le Callet, and Philippe Guillotel. 2018. Salient360: Head and eye movement dataset for omnidirectional content. https://zenodo.org/records/10650505 Accessed: 2026-01-23. Shantanu Rane and Wei Sun. 2010. Privacy preserving string comparisons based on Levenshtein distance. In 2010 IEEE international workshop on information forensics and security. IEEE, 1–6. Adi Shamir. 1979. How to share a secret. Commun. ACM 22, 11 (1979), 612–613. Malte Sönnichsen, Mayar Elfares, Yao Wang, Ralf Küsters, Alina Roitberg, and Andreas Bulling. 2025. AttentionLeak: What Does Human Attention Reveal About Information Visualisation?. In International Conference on Document Analysis and Recognition. Springer, 77–95. Philipp Stark, Alexander J Jung, Jens-Uwe Hahn, Enkelejda Kasneci, and Richard Göllner. 2024. Using gaze transition entropy to detect classroom discourse in a virtual reality classroom. In Proceedings of the 2024 Symposium on Eye Tracking Research and Applications. 1–11. Julian Steil, Inken Hagestedt, Michael Xuelin Huang, and Andreas Bulling. 2019a. Privacy-aware eye tracking using differential privacy. In Proceedings of the 11th ACM Symposium on Eye Tracking Research & Applications. 1–9. Julian Steil, Inken Hagestedt, Michael Xuelin Huang, and Andreas Bulling. 2019b. Privacy-Aware Eye Tracking Using Differential Privacy. In Proceedings of the 11th ACM Symposium on Eye Tracking Research & Applications. ACM. doi:10. 1145/3314111.3319915 Adina S Wagner, Yaroslav O Halchenko, and Michael Hanke. 2019. multimatch-gaze: The MultiMatch algorithm for gaze path comparison in Python. Journal of Open Source Software 4, 40 (2019), 1525. Frederike Wenzlaff, Peer Briken, and Arne Dekker. 2016. Video-Based Eye Tracking in Sex Research: A Systematic Literature Review. The Journal of Sex Research 53, 8 (2016), 1008–1019. doi:10.1080/00224499.2015.1107524 Zoe Xi and William Kuszmaul. 2022. Approximating Dynamic Time Warping Distance Between Run-Length Encoded Strings. In 30th Annual European Symposium on Algorithms (ESA 2022) (Leibniz International Proceedings in Informatics (LIPIcs), Vol. 244), Shiri Chechik, Gonzalo Navarro, Eva Rotenberg, and Grzegorz Herman (Eds.). Schloss Dagstuhl – Leibniz-Zentrum für Informatik, Dagstuhl, Germany, 90:1–90:19. doi:10.4230/LIPIcs.ESA.2022.90 Andrew C. Yao. 1982. Protocols for secure computations. In 23rd Annual Symposium on Foundations of Computer Science (sfcs 1982). 160–164. doi:10.1109/SFCS.1982.38 Andrew Chi-Chih Yao. 1986. How to generate and exchange secrets. In 27th Annual Symposium on Foundations of Computer Science (sfcs 1986). 162–167. doi:10.1109/SFCS.1986.25

Proc. ACM Hum.-Comput. Interact., Vol. 10, No. 3, Article ETRA008. Publication date: May 2026.

Secure Storage and Privacy-Preserving Scanpath Comparison via Garbled Circuits in Eye Tracking

A

ETRA008:19

Appendix: GC Time and Communication for ScanMatch and MultiMatch

Figure 2 shows the detailed computation time and communication results for ScanMatch and MultiMatch in the garbled-circuit setting. Each plot presents the median and interquartile range across all datasets, showing how both metrics change with sequence size (𝑚 × 𝑛).

(a) ScanMatch — computation time vs. 𝑚 × 𝑛 (×103 ).

(b) ScanMatch — communication vs. 𝑚 × 𝑛 (×103 ).

(c) MultiMatch — computation time vs. 𝑚 × 𝑛 (×103 ).

(d) MultiMatch — communication vs. 𝑚 × 𝑛 (×103 ).

Fig. 2. Computation time and communication in garbled-circuit implementations of ScanMatch and MultiMatch. Each plot shows binned medians with interquartile range (IQR) bands across datasets.

Proc. ACM Hum.-Comput. Interact., Vol. 10, No. 3, Article ETRA008. Publication date: May 2026.

ETRA008:20

B

Suleyman Ozdel, Amr Nader, Yasmeen Abdrabou, and Enkelejda Kasneci

Appendix B — Integrity Binding Proof Sketch Setting. Each scanpath is encrypted by Alice as
𝑇 = HMAC 𝐾mac, HEADER ∥ SHA256(CT) ,

𝐾mac = SHA256(𝐾 ∥ “MAC” ∥ IV),

and uploaded with (CT, HEADER,𝑇 ) to the server. Later, Bob computes 𝑑 ′ := SHA256(CT𝐵 ) externally from the ciphertext CT𝐵 he provides as a public circuit input. The server provides (CT𝑆 , HEADER,𝑇 ) as circuit inputs. Inside the circuit, the following checks are performed: CT𝑆 = CT𝐵 ,

HMAC(𝐾mac, HEADER ∥ 𝑑 ′ ) = 𝑇 ,

the circuit outputs ⊥ (a fixed failure value) unless both checks succeed. Assumptions. SHA256 is second-preimage resistant, HMAC-SHA256 is EUF-CMA secure, each (𝐾, IV) pair is used at most once, and the circuit outputs ⊥ on verification failure. Lemma (binding and server unforgeability). Let an adversary controlling the server choose circuit inputs (CT𝑆 , HEADER,𝑇 ) after observing the public inputs (CT𝐵 , 𝑑 ′ ). If the circuit outputs a value different from ⊥, then necessarily (i) CT𝑆 = CT𝐵 and (ii) 𝑇 verifies as a valid tag on HEADER ∥ SHA256(CT𝐵 ) under 𝐾mac . In particular, the bytes decrypted inside the circuit are exactly those hashed by Bob externally. Proof. Non-⊥ output implies both in-circuit checks passed. Correctness of the equality check gives CT𝑆 = CT𝐵 , and correctness of the HMAC check gives HMAC(𝐾mac, HEADER ∥ SHA256(CT𝐵 )) = 𝑇. For the unforgeability claim, suppose the adversarial server makes the circuit accept on some (CT𝑆 , HEADER,𝑇 ) such that the MAC-message 𝑚 is defined as HEADER ∥ SHA256(CT𝑆 ) was not previously authenticated under 𝐾mac . Since acceptance implies CT𝑆 = CT𝐵 , this constitutes an EUFCMA forgery for HMAC-SHA256 under the unknown key 𝐾mac , except with negligible probability. Consequence. Therefore, whenever the circuit outputs a non-⊥ value, it decrypts exactly the ciphertext that Bob hashed externally, and the server cannot make the circuit accept without a valid tag 𝑇 .

Proc. ACM Hum.-Comput. Interact., Vol. 10, No. 3, Article ETRA008. Publication date: May 2026.

Secure Storage and Privacy-Preserving Scanpath Comparison via Garbled Circuits in Eye Tracking

C

ETRA008:21

Appendix: Security Proofs

C.1

Two-party setting (standard Yao + OT)

The two-party protocols for ScanMatch, SubsMatch, and MultiMatch in Section 4.2 follow the standard Yao garbled-circuit protocol with OT for evaluator inputs. Under the standard semihonest security of Yao garbling and OT, the real execution reveals only the function output and the explicitly declared leakage (e.g., public parameters and input lengths). We refer to standard proofs [Even et al. 1985; Ishai et al. 2003; Lindell and Pinkas 2009]. C.2

Simulation-Based Security Proof for the Server-Assisted Setting

We give a simulation-based security proof for the server-assisted protocol in Section 4.2 in the standard stand-alone model with a static semi-honest adversary, assuming a single corruption and non-collusion between the server and Bob. Real protocol Π srv . (1) Authorization. We assume that when Alice authorizes Bob, Bob’s public key 𝑝𝑘𝐵 is sent to Alice so the server cannot substitute keys. (2) Upload. Alice uploads (CT𝑆 , HEADER,𝑇 , 𝑅, 𝑝𝑘𝐴 , 𝐸) to the server, where 𝐸 is the wrapped masked key enabling Bob to recover 𝑀 = 𝐾 ⊕ 𝑅. (3) Query. At query time, the server sends (𝐸, 𝑝𝑘𝐴 , CT𝑆 , HEADER,𝑇 ) to Bob. (4) Key unwrapping. Bob computes 𝐾wrap = HKDF(X25519(𝑠𝑘𝐵 , 𝑝𝑘𝐴 )) and decrypts 𝐸 to obtain 𝑀. (5) GC execution. Then the server and Bob execute Yao GC on a fixed public circuit 𝐶 srv : (a) garbling and sending the garbled circuit; (b) transferring evaluator input labels via oblivious transfer for Bob’s private inputs (𝑥 𝐵 , 𝑀); (c) sending the garbler’s input labels for 𝑅; and (d) evaluator execution/decoding. (6) Circuit inputs. The circuit takes: (i) server private input 𝑅; (ii) Bob private inputs (𝑥 𝐵 , 𝑀); and (iii) public inputs (CT𝑆 , HEADER,𝑇 ) (and any public algorithm parameters pp). (7) Integrity binding. As in Appendix B, Bob also supplies CT𝐵 and 𝑑 ′ = SHA256(CT𝐵 ) as public inputs, and the circuit checks CT𝑆 = CT𝐵 before verifying the HMAC. (8) In-circuit computation. Inside the circuit, it (a) verifies the integrity checks from Appendix B; (b) reconstructs 𝐾 = 𝑀 ⊕ 𝑅; (c) decrypts CT𝑆 using AES-CTR to obtain Alice’s plaintext scanpath representation; and (d) evaluates the desired scanpath comparison circuit with Bob’s input 𝑥 𝐵 , outputting either out or ⊥. Leakage and ideal functionality. We model leakage as part of the ideal functionality interface. Let pp be public parameters. Define the public portion of leakage as pub

ℓsrv := (𝐸, CT𝑆 , CT𝐵 , HEADER,𝑇 , 𝑝𝑘𝐴 , pp, |𝐸|, |CT𝑆 |, |CT𝐵 |, |HEADER|). In this single-query setting, we treat the transcript size |transcript| (primarily determined by pp and public input lengths) as leakage to both parties. Additionally, we allow leakage of a single accept/reject bit 𝑏 ok ∈ {0, 1} to Bob, indicating whether the in-circuit integrity check succeeds. Let the overall leakage to the server be pub

srv ℓsrv := (ℓsrv , |transcript|),

Proc. ACM Hum.-Comput. Interact., Vol. 10, No. 3, Article ETRA008. Publication date: May 2026.

ETRA008:22

Suleyman Ozdel, Amr Nader, Yasmeen Abdrabou, and Enkelejda Kasneci

and to Bob be pub

𝐵 ℓsrv := (ℓsrv , |transcript|, 𝑏 ok ).

Interface. The ideal functionality receives as inputs: (i) from the server, the stored record state (𝐸, CT𝑆 , HEADER,𝑇 , 𝑅, 𝑝𝑘𝐴 ); and (ii) from Bob, his private inputs (𝑥 𝐵 , 𝑠𝑘𝐵 ) and a public ciphertext srv to the server and ℓ 𝐵 to Bob, and outputs out or ⊥ to Bob. CT𝐵 . It releases ℓsrv srv 𝐿 that, on inputs as above: Define the ideal functionality Fsrv (1) derives 𝐾wrap := HKDF(X25519(𝑠𝑘𝐵 , 𝑝𝑘𝐴 )) and computes the masked key share 𝑀 defined as Dec𝐾wrap (𝐸); (2) parses the nonce/counter initialization vector IV from HEADER, sets 𝐾 as 𝑀 ⊕ 𝑅, sets 𝐾mac := SHA256(𝐾 ∥ “MAC” ∥ IV), computes 𝑑 ′ := SHA256(CT𝐵 ), and outputs 𝑏 ok := 1 iff CT𝑆 = CT𝐵 and HMAC(𝐾mac, HEADER ∥ 𝑑 ′ ) = 𝑇 ; srv or ℓ 𝐵 ) to the corrupted party; and (3) provides the corresponding leakage string (either ℓsrv srv (4) if 𝑏 ok = 1 computes 𝑥𝐴 := AES_DEC(𝐾, CT𝑆 ) and then out := 𝑓 (𝑥𝐴 , 𝑥 𝐵 ; pp), outputting out, else outputs ⊥. Here AES_DEC(𝐾, CT𝑆 ) denotes AES-CTR decryption under key 𝐾, using the nonce/counter initialization vector parsed from HEADER. Security statement. Claim. Assume: (i) the Yao garbling scheme used to evaluate 𝐶 srv is correct and private under static semi-honest model; (ii) the KEM–KDF–AEAD key-wrapping scheme (HPKE-style X25519–HKDF–AEAD) is indistinguishability under chosen-ciphertext attack (INDCCA) secure (ensuring confidentiality of 𝑀 from a corrupted server that does not know 𝑠𝑘𝐵 ); (iii) AES is a secure PRP and IVs/nonces are never reused under the same key, so AES-CTR provides INDCPA (pseudorandom-keystream) security; (iv) HMAC-SHA256 is EUF-CMA secure and SHA256 is second-preimage resistant (as used in Appendix B), and the in-circuit equality check is computed correctly; and (v) Bob’s public key 𝑝𝑘𝐵 is authenticated to Alice at authorization time so the server cannot perform key-substitution. Then, for any Probabilistic Polynomial-Time (PPT) static semihonest adversary A corrupting at most one party (either the server or Bob), there exists a PPT simulator S such that the joint distribution of the environment’s output in the real execution of 𝐿 is computationally indistinguishable. In particular, Π Π srv and in the ideal execution with Fsrv srv 𝐿 securely realizes Fsrv in the static semi-honest, non-colluding model. Model and composition. We consider the static semi-honest, non-colluding model described above and do not hide access patterns. The server-assisted protocol is a sequential composition of (a) key wrapping to deliver 𝑀 to Bob and (b) a single garbled-circuit evaluation of 𝐶 srv ; security follows from standard sequential composition of semi-honest secure subprotocols and the assumed security of the underlying GC/OT realization under the corresponding assumptions. Proof. We use the standard real/ideal paradigm in the stand-alone setting. Let RealΠAsrv (st) denote the output distribution of an environment interacting with protocol Π srv and an adversary A F𝐿

corrupting one party, on initial state/input st. Let Ideal Ssrv (st) denote the analogous distribution in 𝐿 and simulator S. We show that for each corruption case the ideal world with functionality Fsrv there exists a PPT simulator such that RealΠAsrv (st) ≈𝑐 Ideal Ssrv (st). F𝐿

Equivalently, it suffices to show that the corrupted party’s view in the real execution is simulatable from the corrupted party’s input/state and the leakage (and any output delivered to that party) by 𝐿 . For a party 𝑃 ∈ {srv, 𝐵}, let ViewΠ denote the random variable consisting of the corrupted Fsrv 𝑃 Proc. ACM Hum.-Comput. Interact., Vol. 10, No. 3, Article ETRA008. Publication date: May 2026.

Secure Storage and Privacy-Preserving Scanpath Comparison via Garbled Circuits in Eye Tracking

ETRA008:23

party’s full local view (its input, random coins, and all received messages) in a real execution of Π srv . Case 1: Server corrupted (Bob honest). The server’s real view consists of its stored state (𝐸, CT𝑆 , HEADER,𝑇 , 𝑅, 𝑝𝑘𝐴 ), its garbling randomness, the OT transcript as OT sender for Bob’s private inputs, and all messages in the Yao circuit execution. In the ideal world, the corrupted server provides the record state, so the simulator is given the same 𝑅 as part of the corrupted party’s input/state. Moreover, since the server does not know 𝑠𝑘𝐵 , IND-CCA security of the wrapping scheme implies that 𝐸 hides 𝑀 (and hence 𝐾) from the server beyond its length; we make this explicit as a hybrid step below. Define a simulator srv  srv Ssrv (stsrv, ℓsrv ) → View srv to recover (pp, |transcript|). as follows. Parse stsrv as (𝐸, CT𝑆 , HEADER,𝑇 , 𝑅, 𝑝𝑘𝐴 ) and parse ℓsrv Then generate the simulated server view via the following hybrids. Let 𝐻 0 be the real execution view of the corrupted server. (1) Hybrid 𝐻 1 (wrapping indistinguishability). Replace the real wrapped key 𝐸 = Enc𝐾wrap (𝑀) with 𝐸 $ := Enc𝐾wrap (𝑈 ) for a uniform 𝑈 ← {0, 1} |𝑀 | (keeping the same public key material and lengths). By IND-CCA security of the HPKE-style wrapping scheme and because the server does not know 𝑠𝑘𝐵 , 𝐻 0 ≈𝑐 𝐻 1 . (2) Hybrid 𝐻 2 (OT sender simulation). Replace the OT protocol transcript (where the server acts as OT sender for Bob’s input labels) with the output of the OT sender-simulator. By semi-honest OT security, 𝐻 1 ≈𝑐 𝐻 2 . (3) Hybrid 𝐻 3 (Yao+OT simulation for garbler). Replace the garbled circuit and the rest of the Yao transcript with the output of a simulator for the garbler’s view for Yao GC with OT (for the fixed public circuit 𝐶 srv ), conditioned on the garbler’s input/state and the public inputs/leakage. By the standard semi-honest security of Yao garbled circuits composed with OT [Lindell and Pinkas 2009], 𝐻 2 ≈𝑐 𝐻 3 . srv ); define S In 𝐻 3 , the resulting distribution depends only on (stsrv, ℓsrv srv to output this distribution. Π  Thus Viewsrv ≈𝑐 Viewsrv .

Case 2: Bob corrupted (Server honest). Bob’s real view consists of: the public message (𝐸, 𝑝𝑘𝐴 , CT𝑆 , HEADER from the server; his private input (𝑥 𝐵 , 𝑠𝑘𝐵 ); the locally derived wrapping key 𝐾wrap = HKDF(X25519(𝑠𝑘𝐵 , 𝑝𝑘𝐴 )); the decryption result 𝑀 = Dec𝐾wrap (𝐸); and the full Yao/OT transcript and output. Define a simulator 𝐵 S𝐵 (𝑥 𝐵 , 𝑠𝑘𝐵 , ℓsrv, out) → View by the following hybrids, where 𝐻 0 is the real execution. The simulator parses ℓsrv to obtain (𝐸, 𝑝𝑘𝐴 , . . .) and locally computes 𝐾wrap := HKDF(X25519(𝑠𝑘𝐵 , 𝑝𝑘𝐴 )) and 𝑀 := Dec𝐾wrap (𝐸). (1) Hybrid 𝐻 1 (garbling simulation). Replace the garbled circuit and the evaluator’s gate-by-gate evaluation transcript with the output of the garbling-scheme simulator for the public circuit topology of 𝐶 srv conditioned on Bob’s private inputs (𝑥 𝐵 , 𝑀), the public inputs, and the output out. By privacy of Yao garbling against a semi-honest evaluator as in [Lindell and Pinkas 2009], 𝐻 0 ≈𝑐 𝐻 1 . (2) Hybrid 𝐻 2 (OT simulation). In the Yao execution, replace the OT interaction for Bob’s private input bits (𝑥 𝐵 , 𝑀) with a simulated OT transcript and simulated evaluator input labels generated by the OT receiver-simulator. By semi-honest OT security, 𝐻 1 ≈𝑐 𝐻 2 . In 𝐻 2 , the distribution of Bob’s view depends only on (𝑥 𝐵 , 𝑠𝑘𝐵 , ℓsrv, out); we define S𝐵 to output this distribution. Finally, note that when the honest server samples 𝑅 ← {0, 1}128 uniformly, the Proc. ACM Hum.-Comput. Interact., Vol. 10, No. 3, Article ETRA008. Publication date: May 2026.

ETRA008:24

Suleyman Ozdel, Amr Nader, Yasmeen Abdrabou, and Enkelejda Kasneci

masked key share 𝑀 = 𝐾 ⊕ 𝑅 is uniform and independent of 𝐾; thus 𝑀 alone leaks no information about 𝐾. For multiple stored items/queries, the above argument applies record-by-record, since each record uses an independently sampled mask 𝑅𝑖 and masked key 𝑀𝑖 .

Proc. ACM Hum.-Comput. Interact., Vol. 10, No. 3, Article ETRA008. Publication date: May 2026.