ThermalTap: Passive Application Fingerprinting in VR Headsets via Thermal Side Channels Mahsin Bin Akram, A H M Nazmus Sakib, OFM Riaz Rahman Aranya, Raveen Wijewickrama, Kevin Desai, and Murtuza Jadliwala
arXiv:2605.12927v1 [cs.CR] 13 May 2026
University of Texas at San Antonio San Antonio, Texas, USA {mahsin.akram, ahmnazmus.sakib}@my.utsa.edu, {ofmriazrahman.aranya, raveen.wijewickrama, kevin.desai, murtuza.jadliwala}@utsa.edu
Abstract—Standalone virtual reality (VR) headsets process highly sensitive personal, professional, and health-related data, yet their susceptibility to non-contact physical side channels remains largely unexplored. Existing side-channel attacks typically require malicious software execution or physical access to peripherals, making them conspicuous and potentially patchable. This paper introduces ThermalTap, the first passive, non-contact side-channel attack that fingerprints VR applications solely from the long-wave infrared (LWIR) radiation emitted by the headset chassis. By treating a headset’s thermal signature as a highfidelity proxy for internal computational workloads, ThermalTap enables remote application inference at meter-scale distances without any device interaction. To achieve robust performance in real-world settings, the system combines a commodity thermal camera with a multi-modal sensor suite (capturing ambient temperature, humidity, and airflow) to normalize environmental noise. We evaluate ThermalTap using six applications across three commercial standalone headsets. In indoor settings, ThermalTap identifies applications with over 90% accuracy using only 10 seconds of thermal camera data. Under outdoor conditions, with longer session-level observations, several applications remain identifiable despite environmental variability, with the strongest outdoor application reaching 81% accuracy. Our findings establish thermal radiation as a fundamental and unavoidable privacy risk for immersive systems, exposing a critical security gap that bypasses current software-level protections and physical access controls.
I. I NTRODUCTION The proliferation of standalone virtual reality (VR) headsets has transformed them from niche entertainment peripherals into general-purpose computing platforms. Devices such as the Meta Quest 2, Meta Quest 3, and HTC Vive Focus Vision are increasingly deployed across enterprise, healthcare, and education domains, where they process deeply personal information including health and wellness data, professional communications, and intimate social interactions [1], [2]. Unlike traditional computing devices, VR headsets are worn on the face, operate autonomously without a tethered host, and are often used in shared or semi-public environments such as offices, university labs, and VR arcades. This combination of sensitive data, physical co-location of users, and a form factor that inhibits user situational awareness creates a compelling and underexplored attack surface. Central to this threat is application fingerprinting: identifying which VR application a victim is currently running.
This inference may appear coarse, but it can reveal sensitive contextual information about the user’s immediate activity. A mental health or wellness application may reveal therapeutic or health-related behavior; an enterprise collaboration tool may disclose professional activity or organizational affiliation; a social VR application may reveal communication or social interaction; and a training or simulation application may reveal institutional or operational context. Repeated observations can further expose activity timelines, such as when a user enters a meeting, starts a training session, or switches between entertainment and work applications. Such leakage can support behavioral profiling, context-aware social engineering, targeted surveillance, and organizational intelligence gathering, even when the adversary never observes the headset display or interacts with the device [1], [3], [4]. Prior work has shown that VR activity leaks through both software-accessible and physical side channels [1], [2], [5]. Software-accessible runtime signals, such as rendering and performance information exposed by AR/VR platforms, can reveal user interactions and identify applications launched by a victim [1]. Physical channels provide another leakage path: cable-based measurements can reveal visual- and audio-related VR activity during charging [2]. Despite their effectiveness, existing VR side-channel attacks share a fundamental constraint: they require either software access to the victim’s headset or physical access to a device peripheral. These requirements increase attacker effort and make the intrusion easier to detect via software patches or physical inspection. We observe that a more fundamental and unavoidable information channel has remained unexamined in the VR context: thermal emission. Every electronic device dissipates heat as a direct consequence of electrical current flowing through resistive components. In the context of VR, different applications impose distinct, high-intensity workloads on the processor, display pipeline, and cooling systems. This heat propagates to the device’s external surface and radiates into the surrounding environment as long-wave infrared (LWIR) radiation, which is detectable by commercial thermal cameras at a distance. Our key insight is that these thermal signatures are a high-fidelity proxy for the internal workload, and because heat dissipates spatially across the chassis, it creates a unique “thermal fingerprint” for specific applications.
In this paper, we introduce ThermalTap, a passive, noncontact thermal side-channel attack that fingerprints VR applications from radiometric observations of the headset chassis. An attacker equipped with a commodity infrared thermal camera can stealthily observe a victim wearing a VR headset from across a room and infer the active application without software access, cable instrumentation, or interaction with the victim device. However, turning external thermal radiation into a usable side channel requires solving three measurement problems: capturing absolute per-pixel temperature rather than colorized video, isolating the headset surface from the user’s face and surrounding background despite thermal blooming under load, and accounting for environmental confounds (ambient temperature, airflow, distance) that alter observed surface temperature without being caused by the running application. ThermalTap addresses these through thermal radiometric capture, learned headset-region segmentation, spatiotemporal feature extraction over the segmented region, and synchronized environmental sensing, with supervised classification mapping the resulting thermal signature to an application label. We evaluate ThermalTap using six active VR applications across indoor and outdoor settings spanning different ambient temperatures, airflow, and solar exposure conditions. In indoor experiments, ThermalTap correctly identifies active applications with approximately 90% accuracy using only 10 second thermal observation windows. Outdoor conditions reduce overall performance due to environmental variability, but longer session-level observations remain effective for several applications, with the strongest outdoor case reaching an accuracy of 81%. These results show that externally emitted headset heat contains app-specific information that can be recovered from short, passive observations of VR devices. In summary, this paper makes the following contributions: • A novel attack vector: We are the first to demonstrate external, non-contact thermal side-channel attacks on VR headsets, establishing thermal emission as a practical and stealthy information leakage channel that requires no software or hardware access to the victim’s device. • Spatiotemporal Fingerprinting: We propose a novel representation that partitions the VR headset chassis into a spatial grid, capturing the temporal evolution of heat to distinguish between apps with similar instantaneous temperatures. • End-to-End System: We design and implement a complete attack system comprising a custom multi-modal Raspberry Pi-based sensor apparatus, an automated ROI segmentation pipeline, and an application fingerprinting classifier. • Comprehensive evaluation: We evaluate ThermalTap with six VR applications and three commercial standalone headsets across indoor and outdoor environments and crossdevice settings. We also study practical impact factors including required attack thermal camera distance, observation durations, environmental variation, and device variability.
external thermal emissions represent a distinct attack surface. Side-Channel Attacks and VR Threats Side-channel attacks exploit unintended physical or software-observable signals to infer sensitive information about a system’s internal activity. Prior work has shown that internal system activity leaks through multiple modalities, including power consumption [6], electromagnetic emanations [7], radio-frequency signals [8], and acoustic emissions [9]. For example, power-side channels have been used to extract cryptographic secrets and infer smartphone activity through charging lines [10], while EM and RF-based attacks have been used to reconstruct device activity or classify mobile applications [7], [8], [11]. Acoustic side channels have also been used to infer user input, including keystrokes and VR controller interactions [9], [12]. VR systems are especially attractive targets for sidechannel attacks because they are self-contained computing platforms with rich sensors, sustained and heterogeneous compute workloads, and sensitive user interactions. Existing AR/VR attacks have exploited software-accessible signals, sensors, peripherals, and wireless channels. Zhang et al. [1] showed that a malicious background application can use exposed performance and rendering information to infer user interactions and fingerprint concurrently running applications. LineTalker [2] demonstrated that VR application activity leaks through charging-cable power measurements. Other attacks infer user input/activity through hand-tracking cameras, acoustic signals, WiFi channel state information [5], [13]–[17]. Among these, the closest physical side-channel attack to our work is VReaves [5], which fingerprints VR applications from electromagnetic emanations using a software-defined radio. While both attacks require no software access to the victim, they exploit fundamentally different signals. VReaves relies on instantaneous, high-frequency EM leakage from hardware components such as clock lines and buses, and requires specialized, relatively costly radio equipment and signal processing. In contrast, ThermalTap aims to capture the time-integrated thermal footprint of the entire device using a commodity infrared camera. Further, EM leakage may be mitigated by a simple randomization of computational patterns, which directly alters high-frequency switching behavior. In contrast, while such randomization can perturb thermal signals, thermal emissions reflect the time-integrated power of the whole device and are therefore harder to obfuscate without incurring substantial overhead or requiring hardwarelevel changes. In contrast, ThermalTap exploits a fundamentally different and more operationally feasible leakage channel: the passive infrared radiation emitted by the headset chassis itself, observable at meter-scale distances using only a low-cost commodity thermal camera, with no software access, cable instrumentation, or specialized equipment required Thermal Side Channels Thermal leakage arises because computational activity consumes power and produces heat. As heat propagates through the device and reaches the external chassis, it creates a spatial and temporal surface-temperature pattern. Different applications can induce different workload
II. BACKGROUND AND R ELATED W ORKS This section positions ThermalTap within prior work on physical side channels and VR security, and explains why
2
patterns across the processor, display pipeline, memory, networking, and cooling system, causing the externally visible thermal profile to vary over time. Prior thermal side-channel work has primarily focused on residual heat from user input surfaces or internal device sensors. Thermal imaging has been used to recover keyboard or keypad input from residual heat traces [18]–[23]. In contrast, ThermalBleed showed that software-accessible internal thermal sensors on x86 CPUs can leak microarchitectural state and break KASLR [24]. These works establish thermal behavior as an informationbearing channel, but they do not address external, non-contact thermal observation of VR headsets. Unlike keyboards, a VR headset continuously dissipates heat from sustained application workloads. Unlike internal sensor attacks, ThermalTap does not require software access to the victim device. This gap motivates our study of whether externally radiated thermal signatures from consumer VR headsets can be used for application fingerprinting.
headset models have distinct external form factors. This assumption is also important for cross-device evaluation, since our results show that device-specific thermal behavior affects transferability. Adversary Capabilities and Scope We assume the adversary has the following capabilities and limitations: • The adversary has no physical access to the victim’s headset or its peripherals (hand controllers, charging cables, link boxes, companion mobile devices). • The adversary has no software-level access to the headset, does not install a malicious application, and does not rely on permissions, APIs, or internal sensors exposed by the VR platform. • The adversary performs only passive, non-contact observation. ThermalTap does not transmit signals, inject workloads, or interact with the victim device. • The adversary possesses training data for a predefined set of candidate VR applications. When device-specific modeling is required, the adversary may collect training data from the same headset model as the victim. • The adversary’s objective is application fingerprinting over a known candidate set rather than open-world application discovery. This is consistent with the deployment reality of standalone VR platforms: each platform exposes a curated store with a finite catalog, and a small set of popular applications dominates real-world usage. An adversary can therefore profile this candidate set offline before deployment. Inferring the application currently being run by the victim user can reveal sensitive contextual information about the user, such as whether they are engaged in entertainment, communication, work, training, health, or wellness-related activities. However, ThermalTap does not attempt to infer finegrained in-app actions, typed input, biometric attributes, or user identity; these are outside the scope of this work.
III. T HREAT M ODEL & R ESEARCH Q UESTIONS A. Threat Model ThermalTap performs passive application fingerprinting from externally observable thermal emissions. The attacker’s goal is to infer which VR application a victim is currently running, without directly interacting with the victim, the headset, or any headset peripheral.
B. Research Questions
Fig. 1: Adversary model.
Our evaluation addresses three research questions that guide the design and analysis of ThermalTap. Together, they characterize the thermal side channel along three dimensions: whether external thermal emissions reveal application-level information, whether this signal remains useful under variable environmental conditions, and how headset-specific hardware characteristics affect generalization. RQ1 (Application Fingerprinting): Can ThermalTap infer currently executing VR application from externally observable thermal emissions? This RQ evaluates the core leakage claim of ThermalTap. We examine whether different VR applications induce distinguishable thermal signatures on the headset chassis, and whether these signatures can be used to classify the currently executing applications from infrared measurements captured using commodity thermal cameras. RQ2 (Environmental Robustness): How robust is ThermalTap under outdoor environmental conditions? This RQ evaluates whether application-level thermal signatures remain
Attack Setting We consider an adversary equipped with a commodity thermal camera, such as an Infiray P2 Pro or Topdon TC001, connected to a small computing device for data collection and inference. The camera is surreptitiously placed with line-of-sight to the victim’s headset and passively records long-wave infrared emanations from the headset chassis. This setting is plausible in shared or semi-public environments where VR users and bystanders may remain co-located for extended periods, such as university labs, shared offices, dorm common rooms, VR arcades, and training facilities. The thermal camera can be placed in ordinary room infrastructure or carried by a nearby observer, and the victim’s situational awareness is naturally reduced while wearing the headset. Similar proximity-based observation models have been considered in prior side-channel attacks [7], [9], [11]. We assume the adversary can observe or infer the headset model during data collection. This is realistic because the device is visible to the observer and because commercial
3
useful when the observation setting itself introduces variation unrelated to the running application. In particular, outdoor scenarios introduce unpredictable conditions, including ambient temperature changes, natural airflow, and solar-induced heating, all of which can alter the observed thermal signal independently of the application workload. RQ3 (Cross-Device Effects): To what extent do headsetspecific hardware characteristics affect thermal application fingerprinting? This RQ evaluates whether the thermal signatures used by ThermalTap are primarily app-specific or strongly shaped by the VR hardware on which the application runs. Commercial standalone headsets differ in SoC placement, battery location, cooling design, chassis geometry, and material properties, all of which can affect how applicationinduced heat propagates to the externally visible surface. Since the adversary has line-of-sight to the victim, the headset model can often be visually identified and profiled in advance. However, if thermal signatures transfer across headset models, the attacker would require less device-specific training data.
B. Observations O1: Application-level thermal behavior is visibly separable. Figure 2 shows thermal frames for two pilot applications. VRFS exhibits a concentrated central hotspot near the SoC, while YouTube produces a more diffuse pattern dominated by display-backlight heating. We further project the preliminary feature vector described above via PCA (Figure 3), where application classes form visibly separable clusters along the first two principal components. This indicates that the externally observed thermal channel carries application-discriminative information.
IV. I NITIAL O BSERVATIONS & D ESIGN R EQUIREMENTS External thermal emissions are only useful for fingerprinting if application-induced heat remains distinguishable after propagating through the headset chassis and being observed externally. We therefore begin with a controlled pilot study to test whether this signal is measurable, identify which aspects of the thermal trace are informative, and derive the measurement requirements that shape ThermalTap.
Fig. 3: PCA projection of thermal feature vectors.
A. Pilot Setup O2: Spatiotemporal evolution carries substantial application signal. A single thermal frame captures the headset chassis at one instant, but application-induced heating is inherently both spatial and temporal. Spatially, heat is not distributed uniformly across the chassis. Different workloads concentrate heat over different internal components, so applications can differ not only in average surface temperature but also in where heat appears. This motivates preserving the local spatial structure of the headset. Temporally, the surface temperature is not static. Different applications affect how quickly local regions heat up and how far they move away from ambient temperature. We refer to this temperature-versus-time behavior, especially its local rate of change of temperature, as thermal drift. Figure 4 illustrates this effect for apps VRFS and Youtube.
We instrumented a Meta Quest 2 with a TopDon TC001 thermal camera [25], [26] positioned approximately 60 cm from the headset chassis with line-of-sight to the front face. Camera distance, ambient temperature, and wearer pose are held approximately fixed across trials, so the only deliberately varied factor is the executing application. The pilot suite spanned idle, media, utility, and simulation workloads (see in Table IV). Across 16 sessions we collected approximately 120 minutes of synchronized radiometric thermal recordings. From each sample we extracted a preliminary feature set comprising global temperature statistics (mean, max, standard deviation, entropy), temporal features describing how the surface temperature evolves over time (thermal drift), and contextual metadata (camera-to-headset distance, ambient temperature). We then trained pilot a Random Forest classifier on this feature set to make our preliminary observations.
(a) YouTube
(b) VRFS
Fig. 4: Thermal drift over time for four representative grid cells across the application sessions for VRFS (left) and Youtube (right).
Fig. 2: Thermal traces from two apps on a Meta Quest 2.
4
This is further supported by the SHAP analysis in Figure 5, where thermal drift emerges as one of the most influential features (apart from camera-to-headset distance and ambient temperature).
Figure 7 shows the ThermalTap pipeline. The acquisition thermal camera hardware apparatus (see Section VI-B for details) records thermal frames from the headset surface together with ambient temperature, humidity, airflow, and camera-toheadset distance. The preprocessing module segments the headset region of interest (ROI) and removes unreliable masks. The feature extraction module converts each segmented frame into a spatial grid representation and augments it with temporal derivatives. Finally, the fingerprinting module maps each fixedduration observation window to an application label. We use three temporal units throughout the paper. A frame is one timestamped radiometric measurement of the headset surface, stored as a matrix of per-pixel temperatures. A prediction window is a fixed-duration contiguous sequence of frames from the same recording; ThermalTap produces one window-level prediction per window. A session is one uninterrupted recording of a VR application from launch to exit; session-level predictions are obtained by majority vote over the window-level predictions in the session.
+ L J K
) H D W X U H Y D O X H
' L V W D Q F H P 7 K H U P D O ' U L I W $ P E L H Q W 7 H P S ) & K D U J L Q J B Q R W B F K D U J L Q J 1 X P E H U R I 3 L [ H O V 0 L Q 7 H P S ) 0 H D Q 7 H P S ) 6 N H Z Q H V V . X U W R V L V & 9 0 D [ 7 H P S ) 7 H P S 5 D Q J H ) 6 W G 7 H P S ) 5 D W H R I & K D Q J H ( O D S V H G 7 L P H P L Q ( Q W U R S \ 7 H P S * U D G L H Q W ) P , 4 5 ( P L V V L Y L W \
V. ThermalTap ATTACK F RAMEWORK
/ R Z 6 + $ 3 Y D O X H L P S D F W R Q P R G H O R X W S X W
Fig. 5: SHAP feature-impact analysis. O3: Reliable fingerprinting requires isolating the headset region. The pilot showed that application-discriminative thermal information is concentrated on the headset chassis, but the raw thermal frame also contains the wearer’s face, straps, and surrounding background. This makes naive whole-frame analysis unreliable, since non-headset regions can introduce temperature patterns unrelated to the running application. The problem is further complicated by natural head movement: as the wearer shifts pose, the headset’s position, scale, and visible boundary can change across frames. A simple thermal-contrast approach is also insufficient: during high-load applications, heat may bloom across the headset surface and blur the boundary between the chassis and nearby regions, causing contour-based masks to either omit parts of the headset or include non-headset pixels. This shows the need for a reliable Region of Interest (ROI) extraction step that consistently isolates the headset surface before downstream analysis. Together, these observations translate into three design requirements for ThermalTap. The system must: (1) extract a reliable headset ROI before analysis; (2) represent the headset as a spatiotemporal thermal signature, using radiometric temperature values to preserve both where heat appears and how it changes over time; and (3) record measurement context, such as ambient temperature and camera-to-headset distance, so non-application effects can be accounted for during analysis.
A. Headset ROI Segmentation A raw thermal frame contains the headset chassis, the wearer’s face, straps, and surrounding background. A natural first approach is to exploit thermal contrast, since the headset often appears warmer than the background. However, our initial experiments showed that thresholding, contour extraction, and generic segmentation were unreliable under highload applications: heat blooms across the chassis and weakens the visual boundary between the headset, skin, straps, and nearby warm surfaces. This can either exclude heated headset regions or include non-headset pixels, directly contaminating the thermal features. To address this, we developed a custom segmentation pipeline based on SRA-Seg [27], a semisupervised segmentation method traditionally used for medical image segmentation. Training a segmentation model requires manually annotated headset masks, but densely labeling tens of thousands of thermal frames is labor-intensive. We therefore annotate only a subset of frames and use SRA-Seg to leverage the remaining unlabeled recordings during training. Figure 6 shows an example of the resulting headset ROI segmentation. Further model and training specific details are provided in Section B-A. To reject malformed masks, we apply geometric filtering to the largest connected component in each predicted mask. A valid headset mask must satisfy two constraints: a width-toheight ratio between 1.3 and 2.8, matching the front-facing shape of consumer headsets, and a solidity of at least 0.80, where solidity is the ratio of mask area to convex-hull area. These checks reject masks that include straps, face regions, or background artifacts. Frames failing either check are flagged as missing observations, preserving temporal alignment without contaminating the feature representation.
Fig. 6: Headset ROI segmentation.
5
Fig. 7: ThermalTap attack framework.
B. Thermal Signature Representation Motivated by O2 in Section IV-B, ThermalTap represents thermal leakage as a spatiotemporal signature. Specifically, we define a thermal signature as a time-series of per-frame feature vectors extracted from the segmented headset region. For an observation window of length W seconds, this is Sw = {ft0 , ft0 +1 , . . . , ft0 +W −1 }, where each ft summarizes the spatial structure of headset surface temperature at time t. To construct ft , ThermalTap partitions the headset region into an N × N grid. The resulting cells are used to compute two types of frame-level features: per-cell temperature statistics and per-cell spatial gradients. Grid Resolution. Grid resolution N controls the trade-off between noise robustness and localized thermal detail: coarse grids average over larger regions and suppress noise, while fine grids preserve localized hotspots but increase feature dimensionality and sensitivity to segmentation artifacts (see Figure 8 for a sample grid). We evaluate N ∈ {4, 8, 12, 16, 20, 24} in Section VII-B. Per-cell statistics. For each segmented frame, ThermalTap partitions the headset bounding box into an N × N grid. From the valid headset pixels in each cell (i, j) we extract four statistics: mini,j (t), maxi,j (t), mean µi,j (t), and standard deviation σi,j (t). A cell is considered valid only when at least 50% of its area overlaps the headset mask; cells below this threshold are discarded to prevent background contamination. This yields up to 4N 2 base features per frame. Spatial gradients. For each cell, we compute the difference between its mean temperature and the average of its cardinal neighbors (up, down, left, right): gradi,j (t) = µi,j (t) −
1 |Ni,j |
X
(a) 4x4 Grid Layout
(b) 16x16 Grid Layout
Fig. 8: Grid layout on generated masks.
outdoor environments are affected not only by applicationinduced heating, but also by environmental factors such as ambient temperature and airflow. To reduce these effects, ThermalTap incorporates readings from our auxiliary environmental sensors on the raw thermal measurements. Baseline-derived temporal-delta subtraction. For each (application, N × N cell) pair, we estimate from the indoor baseline training data the typical short- and medium-term temperature evolution of the chassis under that workload, expressed as per-cell delta profiles at two lag horizons: (ℓ)
∆i,j (t) = µi,j (t) − µi,j (t − ℓ),
ℓ ∈ {5, 30} s.
(ℓ)
Here, ∆i,j (t) is the temperature change of cell (i, j) over the previous ℓ seconds, t is the current timestamp, and t − ℓ refers to the timestamp ℓ seconds earlier. µi,j (t) is the mean temperature of the cell i, j at time t. Since thermal frames are sampled at 1 hz, the 5 s and 30 s deltas compare the current cell temperature against the same cell 5 and 30 frames earlier, respectively. At outdoor inference time, the corresponding indoor delta profile is subtracted from the observed outdoor delta, leaving a residual that reflects environmental and device variation rather than application workload. Ambient and airflow correction. We also compensate for ambient temperature (collected by the BME280 sensor) by subtracting the measured ambient temperature from each gridcell temperature value. This step shifts the representation from absolute surface temperature toward application-induced thermal load:
µk,l (t),
(k,l)∈Ni,j
where Ni,j is the set of valid cardinal neighbors. This captures localized hotspots relative to surrounding regions independent of absolute temperature. C. Environmental Normalization During our initial pilot study, we observe that thermal measurements collected in highly variable conditions such as
Li,j (t) = Ti,j (t) − Tamb (t),
6
where Ti,j (t) denotes the temperature of grid cell (i, j) at time t, and Tamb (t) denotes the corresponding ambient temperature measurement. Finally, we compensate for convective cooling effects (caused by wind) by adjusting temporal change features using measured air velocity (FS3000-1005 airflow sensor):
signatures transfer across headset models or are dominated by device-specific characteristics. A. VR Devices and Applications Our primary evaluation device is a Meta Quest 3 [28], a consumer-grade commercial-off-the-shelf (COTS) standalone VR headset. For cross-device experiments, we additionally evaluate two other VR headsets: the Meta Quest 2 [25] and the HTC Vive Focus Vision [29]. The application test suite is selected to span idle, media, communication, productivity, and simulation workloads (see Table I). Most applications are standalone application, except Zoom web for which we utilized the in-built browser to access it in every headset.
′ ∆Ti,j (t) = (Ti,j (t) − Ti,j (t − ∆t)) · (1 + k v(t)),
where v(t) is the measured air velocity and k is an empirically estimated wind-compensation coefficient. D. Application Inference The VR headset’s Home state represents an idle system state rather than a target application workload, ThermalTap therefore uses a two-stage inference procedure. Stage 1: activity-state detection. ThermalTap first determines whether the window corresponds to idle headset behavior or active application use. This stage uses a binary classifier trained to distinguish the Home state from all activeapplication states. If the majority of window-level predictions within the session indicate idle behavior, ThermalTap outputs the idle state and stops. Otherwise, the session is passed to the application fingerprinting stage. Stage 2: active-application fingerprinting. For sessions classified as active, ThermalTap applies a multi-class application classifier trained only on active VR applications. The classifier predicts an application label for each window in the session, and ThermalTap assigns the session to the application receiving the majority of window-level predictions. This aggregation reduces sensitivity to transient window-level errors while allowing ThermalTap to make predictions from short captured segments. Both stages use the same spatiotemporal feature representation described in Section V-B. The activity-state detector is trained using Home windows as idle samples and targetapplication windows as active samples. Both inference stages are evaluated with three supervised classifiers: Random Forest (RF), XGBoost, and Support Vector Machine (SVM). These models provide complementary baselines for thermal application fingerprinting. RF and XGBoost capture nonlinear feature interactions among spatial and temporal thermal features, while SVM provides a margin-based classifier for comparison. Preprocessing parameters (standardization, lowvariance filtering using a 40 mK threshold corresponding to the camera’s noise-equivalent temperature difference, and ANOVA F-score feature selection) are fit on the training split and applied unchanged to held-out data. Full preprocessing details are deferred to Section C-A.
TABLE I: Application test suite used in experiments. Application Home YouTube [30] Media Player Zoom Web [31] Arkio [32] First Hand [33] VRFS [34]
Category System Media Media Communication Productivity Simulation Simulation
(a)
Observed load Baseline idle Low Low Low-medium Medium High High
(b)
Fig. 9: (a) Indoor experimental setup, (b) data acquisition apparatus.
B. Acquisition Apparatus ThermalTap operates on calibrated radiometric frames, where each pixel encodes an absolute temperature value rather than a colorized intensity. This requirement emerged from our initial experiments with USB Video Class (UVC) based capture on consumer thermal cameras such as the TopDon TC001: the UVC stream exposed a vendor-rendered RGB heatmap with auto-gain and color mapping, rather than stable per-pixel temperatures. Such visualization streams confound true device heat with rendering choices and cannot be reliably subtracted, normalized, or compared across recordings. To capture radiometric data without depending on a vendor application, we built a Raspberry Pi based apparatus. It centers on an Infiray P2 Pro thermal camera [35], selected for its open SDK, and stores each frame as both a thermal image and a CSV matrix of per-pixel temperatures sampled at 1 Hz. The apparatus also integrates three additional sensors that record
VI. E XPERIMENTAL S ETUP We evaluate ThermalTap across three experiments (E1–E3) corresponding to the three research questions of Section III-B. E1 establishes baseline indoor effectiveness and supports our feature-design ablations (grid resolution, window length, classifier choice). E2 evaluates outdoor robustness and the indoor-to-outdoor domain shift. E3 evaluates whether thermal
7
context observed in Section IV-B to alter VR device surface temperature independent of the executing application: 1) BME280. Records ambient temperature which affect heat dissipation and radiative contrast between the headset and background. 2) FS3000-1005. Measures air velocity, allowing ThermalTap to quantify convective cooling caused by indoor airflow or outdoor wind. 3) VL53L1x. Measures camera-to-headset distance using time-of-flight (ToF) sensing, providing a continuous geometric context variable for each captured frame. The sensing component of the apparatus is compact and low-profile; as shown in Figure 9b (next to AA battery for scale). Since the Raspberry Pi can be connected by cable and placed separately, the visible sensing component can remain small and inconspicuous, enabling realistic deployment in shared observation settings. All measurements from these sensors are collected and timestamped on the Raspberry Pi so each thermal frame is paired with the contemporaneous environmental reading. Because the apparatus uses only commodity components, the attacker requires no specialized laboratory equipment or physical instrumentation of the victim device.
application (or the idle Home state) and lasts approximately 10 minutes, yielding about 600 thermal frames. Each frame is stored as a per-pixel temperature matrix and synchronized with environmental sensor readings (captured via the auxiliary sensors mentioned in Section VI-B). D. Dataset Summary Table II summarizes the three datasets used in our evaluation. For experiment E1, we collected 67 indoor sessions. The per-class distribution is Home (11), YouTube (11), Media Player (11), Zoom Web (8), Arkio (8), First Hand (8), and VRFS (10). For E2, we collected 28 outdoor sessions containing four sessions per class across the same seven applications used in E1. For E3, we collected 84 indoor sessions across. The per-class distribution is Home (12), YouTube (12), Media Player (12), Zoom Web (12), Arkio (8), First Hand (8), VRFS (8), and Open Brush (12). The per-device distribution is Meta Quest 3 (32), Meta Quest 2 (32), and HTC Vive Focus Vision (20). E3 includes Open Brush as a replacement app since HTC ecosystem does not have the same set of apps as Meta. TABLE II: Dataset summary. Dataset
Environment
E1
Indoor
Sessions 67
E2
Outdoor
28
E3
Multiple devices
84
C. Data Collection Protocol Data collection was conducted by members of the research team. Because ThermalTap measures heat emitted from the headset chassis rather than biometric, behavioral, or interaction-specific attributes of the wearer, we did not conduct a participant-centered user study. The wearer served only as an operator to reproduce a realistic headset-use setting, with the headset worn in a normal seated posture and facing the thermal camera. Thus, the collected signal is device- and applicationcentered rather than participant-dependent. Based on this study design and our university’s institutional policies, IRB approval for human-subject data protection was not required. For each recording session, the ThermalTap apparatus is placed in front of the headset at the target distance and records synchronized thermal and environmental measurements. Each session follows the same four-phase protocol: 1) Baseline. The headset remains idle at the home screen until the initial thermal state stabilizes, allowing us to observe the starting thermal state before launching the target application. 2) Heat-up. The target application is launched and used while the headset surface temperature begins to rise in response to the new workload. 3) Steady state. The application continues under typical use while ThermalTap records the main thermal signature used for classification. 4) Cool-down. The application is exited and the headset returns toward its idle thermal state, allowing us to observe residual heat and thermal hysteresis. Thermal data is captured at a sampling rate of 1 Hz. Each session corresponds to a single recording trial for one target
Purpose Main fingerprinting evaluation and ablations. Environmental robustness under outdoor conditions. Cross-device transfer and device-level fingerprinting.
E. Evaluation Protocol For E1, we use leave-one-session-out (LOSO) crossvalidation. In each fold, one complete recording session is held out for testing, while the remaining sessions are used for training. All preprocessing steps are fit only on the training sessions in that fold and then applied to the held-out session. This prevents leakage from temporally adjacent or overlapping windows from the same session. For E2, we evaluate indoor-to-outdoor robustness under two settings. In the zero-shot transfer setting, the model is trained only on controlled indoor sessions from E1 and tested directly on outdoor sessions from E2. This measures whether thermal signatures learned indoors transfer to outdoor conditions without any outdoor training examples. In the fewshot outdoor adaptation setting, a limited number of outdoor sessions are added to the indoor training set, while disjoint outdoor sessions are reserved for testing. This measures whether small amounts of target-environment data reduce the indoorto-outdoor domain shift. For E3, we evaluate cross-device behavior under two settings. In the pooled cross-device setting, sessions from all headset models are included in the dataset and evaluated using LOSO cross-validation. This measures fingerprinting
8
6 5 $ B 6 H J 2 Y H U O D S 0 H W U L F V
' L F H - D F F D U G
6 F R U H + L J K H U L V E H W W H U
F. Metrics
( B +
We report accuracy, precision, recall, and weighted F1-score for application fingerprinting experiments. We use weighted F1-score as the primary summary metric because it balances precision and recall while accounting for class support. To quantitatively assess the segmentation models, we utilized a combination of overlap and distance metrics: the Dice Coefficient (DSC) measures the global degree of spatial overlap between the prediction and ground truth (bounded 0 to 1); the Jaccard Index (IoU) provides a complementary measure of overlap severity (bounded 0 to 1); the 95% Hausdorff Distance (95HD) calculates the 95th percentile of the shortest distances between all predicted and true surface boundary points to evaluate contour precision while resisting outliers (lower is better); and the Average Surface Distance (ASD) computes the mean of the shortest distances between the predicted and true surface boundaries to indicate how tightly the contours match on average (lower is better).
( B +
( B +
6 5 $ B 6 H J ' L V W D Q F H 0 H W U L F V
' L V W D Q F H L Q 3 L [ H O V / R Z H U L V E H W W H U
performance when the model has seen training examples from each headset family. In the leave-one-device-out (LODO) setting, all sessions from one headset model are held out for testing, while sessions from the remaining headset models are used for training. This measures whether application signatures transfer to an unseen headset model.
( B +
+ ' $ 6 '
( B +
( B +
( B +
( B +
Fig. 10: Segmentation model performance. $ F W L Y H
, G O H
3 H U F H Q W D J H
L V L R Q
3 U H F
D O O
5 H F
)
2 Y H U D O O
L V L R Q
3 U H F
D O O
5 H F
)
L V L R Q
3 U H F
D O O 5 H F
)
Fig. 11: Activity-state detection.
B. E1: Indoor Experiments
VII. E VALUATION
Stage 1: Activity-state Detection. We first evaluate the first stage of ThermalTap’s two-stage inference pipeline: distinguishing idle headset behavior from active application use. As shown in Table VI and Figure 11, the Random Forest detector achieves high recall for active use (97.3%, σ = 0.19), which is the critical operating point for the attack because active windows must reach the application-fingerprinting stage. Idle/Home windows are harder to identify, with 33.2% recall (σ = 1.29), reflecting the fact that Home is not a stable workload and can be affected by residual heat and background system activity. In this pipeline, an idle window misclassified as active only causes an unnecessary Stage 2 prediction, whereas an active window misclassified as idle prevents fingerprinting altogether. We therefore prioritize high active-use recall over balanced idle/active performance.
We organize the evaluation around the three experiments E1–E3 introduced in Section VI. Before reporting the fingerprinting results, we briefly establish that the upstream ROI segmentation step (Section V-A) is reliable enough to support the downstream analysis. We use experiment E1 to compare window sizes, grid resolutions and classifier choices. The bestperforming configuration from E1 is used for the subsequent E2 and E3 experiments. A. ROI Segmentation Performance We evaluate the SRA-Seg-based ROI segmentation pipeline described in Section V-A. Because the three headset models differ in shape, scale, and thermal appearance, we train separate segmentation models for H1 (Meta Quest 3), H2 (Meta Quest 2), and H3 (HTC Vive Focus Vision). The initial H1 model, trained on indoor E1 data, generalized well within E1 but did not reliably isolate the headset under the outdoor conditions in E2. We therefore retrained the H1 model with additional manually annotated E2 frames and use this updated model for both E2 and the H1 sessions in E3. Separate models are trained for H2 and H3. As shown in Figure 10, all models achieve high overlap with the manually annotated masks. The H2 model obtains the highest overlap scores, with a Dice coefficient of 98.55% and a Jaccard index of 96.65%. Although H2 also has slightly higher 95HD and ASD, the differences are small and do not materially affect downstream feature extraction. Overall, these results indicate that the ROI segmentation stage reliably isolates the headset surface across devices and environments.
Stage 2: Active-app Fingerprinting. For stage 2. we use a 16 × 16 grid representation, 10 s prediction windows, and a Random Forest classifier. A detailed analysis of these configurations are provided in Section VII-C. ThermalTap achieves strong window-level performance across the six active VR applications (see Figure 12), with mean per-app F1-score of 91%. The strongest performance occurs for YouTube, VRFS, and First Hand. YouTube is classified perfectly across all three metrics, while VRFS and First Hand remain highly distinguishable, achieving F1-scores of 95% and 93%, respectively. These results suggest that applications whose workloads remain relatively stable within a window are easier to identify from thermal emissions. For example, YouTube playback and simulation workloads such as VRFS and First Hand continu-
9
$ U N L R ) L U V W + D Q G
0 H G L D 3 O D \ H U 9 5 ) 6
< R X 7 X E H = R R P : H E
60, 90, and 120 seconds, i.e., the observation duration required by an attacker to infer a running application of a victim . Across these window sizes, ThermalTap achieves comparable mean per-app accuracy of approx. 90% across all apps (see Figure 14). This suggests that short windows already capture sufficient application-induced thermal structure, and longer windows provide limited additional benefit. We therefore use 10 s windows for all our subsequent experiments.
2 Y H U D O O
3 H U F H Q W D J H
Peak
3 U H F L V L R Q
5 H F D O O
Accuracy (%)
94 )
Fig. 12: Per-app performance of ThermalTap in E1. ously exercise the display, rendering pipeline, and processor, producing repeatable heating patterns over short windows. In contrast, Zoom Web is the weakest class (F1=75%). One likely explanation is that its workload is less stable over shorter windows than continuous playback or simulation workloads, causing its thermal signature to overlap with other applications. The confusion matrix in Figure 13 shows that Zoom Web is most often confused with the other low-medium load classes (Arkio and Media Player), consistent with this interpretation.
First Hand
90 88
20
40
60
80
100
Window Size
120
Effect of Grid Resolution. We then evaluate the grid resolution parameter introduced in Section V-B. We sweep the grid sizes from 4×4 to 24×24, using the Random Forest classifier described in Section V-D.
0.12 0.88
92
Fig. 14: Window size vs. accuracy.
Accuracy (%)
Arkio
0.88
Peak
Peak
90 80 4x4
8x8
12x12
16x16
Grid Resolution
20x20
24x24
0.12 0.09
1.00
Youtube
be tu
om
FS
M
Fi
Zo
Yo u
R
ye Pl a
0.75
ed
ia
rs
t
A
rk
H an
d
r
0.12
V
0.12
io
Zoom Web
As shown in Figure 15, performance improves as the representation preserves more localized thermal structure, reaching its best accuracy at 16 × 16 with a mean per-app accuracy of 91.23%. Beyond this point, performance declines, suggesting that very fine grids introduce noise and session-specific artifacts that outweigh the benefit of additional spatial detail. We therefore use the 16 × 16 grid as the default representation in subsequent experiments. ML Model Comparison We then compare three supervised classifiers: Random Forest, XGBoost, and SVM (using a 16 × 16 grid representation and 10 s window size).
1.00
VRFS
W eb
True app
Fig. 15: Grid resolution vs. accuracy. 0.91
Media Player
Predicted app
Fig. 13: Confusion matrix for indoor experiment E1. We also report our classifier performance that includes Home alongside the six active applications (without running idle-detection step). Table VIII shows that the Home state is substantially harder to classify, with an F1-score of only 17% with mean per-app F1-score dropping to 76%. This is expected because Home is not a stable/unique application workload; it is an idle/system state whose thermal profile depends strongly on residual heat, cooling trajectory, and the preceding session. This shows the effectiveness of our the hierarchical formulation in which activity-state detection is separated from active-application fingerprinting.
5 D Q G R P ) R U H V W
; * % R R V W
6 9 0
3 H U F H Q W D J H
3 U H F L V L R Q
5 H F D O O
)
Fig. 16: ML model performance comparison.
C. Configuration Ablations Effect of Window Size. We further evaluate active-application fingerprinting using fixed-length time windows of 10, 20, 30,
Figure 16 shows that XGBoost achieves the highest mean per-app F1-score (95%), Random Forest is close behind (91%),
10
and SVM trails (84%) with markedly higher variance across folds (σ = 6 − 9). These results confirm that applicationspecific information is reliably present in the thermal signatures. Tree-based ensembles are highly effective for ThermalTap’s heterogeneous statistical, spatial, and temporal features, with XGBoost achieving the highest overall accuracy. However, we intentionally utilize Random Forest as our primary classifier for the remainder of the experiments to prioritize model stability and spatial explainability over marginal performance gains. Unlike boosting techniques, which are highly sensitive to noisy data and outliers [36], Random Forest’s bagging architecture averages across uncorrelated decision trees. This makes it inherently resistant to the environmental noise [37]. Furthermore, it naturally yields the stable feature importance mappings required for our spatial leakage analysis (Figure 17), all while comfortably exceeding the attack viability threshold of 90% accuracy.
In particular, applications with higher computational demand produce localized heating and cooling dynamics that are captured by the spatiotemporal grid representation.
Fig. 17: 16x16 Grid’s mask importance region. E1 Summary: Externally emitted headset heat carries application-specific information sufficient to fingerprint six active VR applications with above 90% accuracy under indoor conditions, with the discriminative signal concentrated on physically interpretable regions of the chassis.
Effect of Environmental Factors. We also examine how environmental variation affects app classification performance. Across the E1 dataset, the highest mean per-app accuracies occur when ambient temperature and camera distance fall within narrower ranges: 67.6°F to 69.6°F (19.8°C to 20.9°C) for ambient temperature and 45.8 cm to 60.2 cm for camera distance. Within these ranges, accuracy improves by approximately 5–8% relative to boundary conditions (see Figures 26 and 27). However, even at an extended observation distance of 100 cm, the model maintained a robust application fingerprinting accuracy of approximately 80%. These results show that even under indoor conditions, thermal fingerprinting is affected by measurement geometry and ambient temperature. This motivates the environmental sensing components of ThermalTap (detailed in Section V-C) and directly informs E2, where we evaluate whether these effects can be compensated under highly variable outdoor conditions.
D. E2: Outdoor Robustness and Environmental Variability. E2 evaluates the robustness of ThermalTap in outdoor environments. We use the 16 × 16 grid size and Random Forest model configuration to evaluate three settings: zero-shot indoor-to-outdoor transfer, few-shot outdoor adaptation, and few-shot outdoor adaptation with environmental normalization (Section V-C). Figure 19 summarizes the outdoor app-classification results. Direct indoor-to-outdoor transfer performs poorly: when trained only on indoor E1 sessions and tested on outdoor E2 sessions, ThermalTap achieves only 12.49% mean F1 (σ = 4.95). This confirms a substantial domain shift between controlled indoor and outdoor thermal measurements, where ambient temperature variation, natural airflow, and background heating alter the observed thermal patterns independently of the running application. However, adding a small number of outdoor sessions to the training set considerably improves application classification, increasing mean F1 to 60.06% (σ = 7.78). Further, applying environmental normalization provides a smaller but consistent additional improvement, increasing mean F1 to 62.55% (σ = 8.88). Thus, few-shot outdoor calibration accounts for most of the recovery from domain shift, while environmental normalization provides additional robustness. We further evaluate E2 using session-level aggregation. Each outdoor recording session contains multiple prediction windows; ThermalTap classifies each window separately and then assigns the session to the application predicted by the majority of its windows. This analysis complements the windowlevel results: the window-level setting captures the minimum observation granularity available to the attacker, while sessionlevel aggregation reflects an attacker who can observe the same application continuously over a longer interval. Session-level
Feature Importance. Finally, we analyze which spatial regions contribute most to classification. For each LOSO fold, we extract Random Forest feature importance scores, which quantify the relative contribution of each grid cell to the classifier’s decisions, and map them back to the 16×16 headset grid. The importance heatmap Figure 17 shows elevated importance in cells (green highlighted ones are in top 20%, red ones are in bottom 20%) corresponding to: 1) Central Processing Region: Cells overlaying the approximate SoC location exhibit high importance, reflecting the direct relationship between computational load and localized heating. 2) Exhaust Vent Regions: Cells near the top of the headset (where exhaust vents are typically located) show distinctive patterns, as fan-driven convective cooling creates characteristic thermal gradients that vary with application intensity. 3) Battery Region: Moderate importance is observed in cells corresponding to the battery location, as power draw correlates with application demands. This demonstrate that ThermalTap is learning physically meaningful thermal patterns rather than arbitrary image artifacts.
11
Percentage (%)
90 80 70 60 50 40 5.0 2.5 0.0
Arkio First Hand
Media Player VRFS
YouTube Zoom Web
Precision
Recall
F1
ments using three VR headsets: Meta Quest 3, Meta Quest 2, and HTC Vive Focus Vision. We evaluate two settings. In the pooled setting, training data includes sessions from all headset models. This corresponds to a device-aware attacker who can visually identify the victim headset model and has profiled the same headset family in advance. In the zero-shot setting, we use leave-one-device-out (LODO) evaluation, where all sessions from one headset model are held out for testing and the model is trained only on the remaining headset models. Pooled Cross-Device Fingerprinting. As shown in Table III, ThermalTap achieves strong pooled cross-device performance, reaching an F1-score of 81.08% (σ = 0.19). This result shows that application-level thermal information remains recoverable even when multiple headset types are present, provided that the model has seen representative data from each headset family during training. Zero-Shot Cross-Device Transfer. In the stricter LODO setting, app-inference performance drops sharply to only 11.59% F1 (σ = 5.54). The contrast between pooled and zero-shot performance reveals that externally observed thermal signatures are strongly influenced by device-specific factors, including hardware layout, cooling design, and chassis geometry. While application workload contributes to the thermal signal, its manifestation on the device surface depends on how heat propagates through the specific hardware. Headset-baseline Normalization. To test whether static headset-specific heat patterns explain the poor cross-device transfer, we also evaluate a diagnostic headset-baseline normalization. For each headset, we subtract an idle Homestate thermal baseline from active-application observations, producing residual features relative to that headset’s resting thermal profile. The full procedure is described in Section D-E. As shown in Table III, headset-baseline normalization reduces pooled performance from a F1-score of 81.08% to 34.68%. This suggests that pooled models benefit from deviceconditioned application signatures, and that subtracting a static idle baseline is insufficient to make application signatures transfer across unseen headset models. In other words, devicespecific thermal behavior is not limited to a fixed offset; it also affects how application-induced heat propagates during use.
Fig. 18: E2 session level performance.
3 H U F H Q W D J H
6 H W W L Q J = H U R V K R W 6 H W W L Q J ) H Z V K R W
) H D W X U H V 5 D Z ) H D W X U H V ( Q Y W 1 R U P D O L ] H G
3 U H F L V L R Q
5 H F D O O
)
Fig. 19: Effect of normalization on outdoor experiments.
aggregation is especially relevant outdoors because short-term perturbations, such as airflow changes, transient background heating, and occasional segmentation noise, can corrupt individual windows without necessarily changing the dominant thermal signature over the full application session. As shown in Table XII, session-level aggregation improves the stability of outdoor inference, reaching a mean F1-score of 65.25% across the six active applications. These results suggests that some outdoor errors are transient at the window level and can be reduced when predictions are aggregated over a full recording session. The per-app results also show that outdoor degradation is application-dependent. First Hand is the strongest outdoor case, with an F1-score of 82.32%. Several other applications also retain useful signal in at least one direction: Zoom Web achieves 75.42% precision, YouTube achieves 75.00% recall, and Arkio achieves 68.33% precision. Overall, ThermalTap retains useful outdoor signal at the session level, but environmental variability still reduces class separability compared with the indoor setting. E2 Summary. Outdoor conditions introduce substantial domain shift, reducing application-classification performance under direct indoor-to-outdoor transfer. Few-shot outdoor calibration recovers much of the lost signal, and environmental normalization provides additional robustness. Session-level inference further improves stability by suppressing transient outdoor errors.
TABLE III: Pooled vs. zero-shot results. Setting
Precision %
Recall %
F1 %
Pooled Zero-shot Pooled (Normalized)
81.08 ± 9.17 11.39 ± 5.54 34.97 ± 7.74
81.08 ± 9.17 14.29 ± 7.22 35.14 ± 7.74
81.08 ± 9.17 11.59 ± 5.68 34.68 ± 7.74
Train-on-one-headset, Test-on-another. To further examine device dependence, we evaluate a stricter train-on-one-headset, test-on-another setting. As shown in Figure 20, same-headset performance is substantially higher than cross-headset transfer, but remains below the pooled setting. Off-diagonal results are consistently low, with the strongest transfer occurring from Meta Quest 2 to HTC Vive Focus Vision. These results reinforce the LODO finding: thermal signatures do not transfer
E. E3: Cross-Device Effects E3 evaluates how headset-specific hardware characteristics affect thermal application fingerprinting. We conduct experi-
12
reliably across headset models. They also suggest that pooling data from multiple headset families helps the classifier learn device-conditioned application signatures, whereas training on a single headset provides limited generalization.
0.57
Quest 3
0.17
between the headset and background, airflow changes convective cooling, and solar exposure can create localized gradients unrelated to computation. Solar heating is especially difficult because it can heat one side of the headset more than the other depending on sun angle, reflections, and shadowing. Such patterns can resemble application-induced hotspots and therefore confuse the spatial grid features.
0.26
0.12
0.55
0.34
HTC Vive
0.12
0.20
0.68
Vi v
e
We consider potential defenses informed by our findings. Active Cooling. Active cooling substantially obfuscates application thermal signatures in heavy-load regimes. Figure 21 contrasts a Meta Quest 2 session (which has only minimal active cooling) with a Meta Quest 3 session (which has a more aggressive fan profile). Once Quest 3’s fan engages, the surface temperature trace shows characteristic dips that disrupt the otherwise-monotonic heat-up signal that downstream features rely on. Quest 2 fan engages later in the session at higher temperature, which creates significant difference in the overall thermal trend afterwards.
H
TC
st ue Q
st ue Q
2
Quest 2
3
Tested on
G. Countermeasures
Trained on
Fig. 20: E3: Train-on-one-headset, test-on-another confusion matrix. E3 Summary: Cross-device results show that thermal leakage exists across multiple commercial headsets, but accurate fingerprinting requires headset-model-specific training. These results indicate that ThermalTap is effective when the attacker has access to training data from the target headset model or similar devices. However, cross-device generalization without such data remains challenging, as hardware-specific thermal behavior dominates the externally observable signal.
2 Y H U D O O 7 H P S )
+ H D G V H W
0 H W D 4 X H V W 0 H W D 4 X H V W
F. Factors Affecting Accuracy
7 L P H V
Fig. 21: Effect of active cooling in an app session.
The results across E1–E3 show that ThermalTap’s appinference accuracy depends not only on whether applications generate distinct heat, but also on other external factors including observation stability and environmental factors. Head Pose and ROI Stability. In real-world VR headset usage, natural head movement changes the headset’s position, scale, orientation, and visible boundary in the thermal frame. Small pose changes can therefore introduce feature variation unrelated to the running application, while larger rotations can hide thermally informative regions such as the SoC area, vents, or battery region. This effect is especially important for interactive VR appls, where users may naturally turn their head more frequently than during passive media playback. Partial Obstructions of the Headset. Because ThermalTap relies on line-of-sight thermal observation, temporary obstructions can degrade the measured signature. Actions such as hand movements, controller movement may partially block the front surface of the device. For example, simulation or design applications may induce more hand and head movement than video playback. As a result, obstructions can both remove useful thermal regions and introduce app-correlated artifacts that the classifier may incorrectly learn. Outdoor Environmental Effects. As discussed earlier, outdoor settings introduce temperature variation that is not caused by the application. Ambient temperature changes the contrast
Hardware Design. Front-mounted batteries concentrate dissipated power on the front of the chassis, which is also the surface most visible to a forward-facing thermal camera. The HTC Vive Focus Vision (one of the devices we evaluated in Section VII-E) relocates the battery to the back; Figure 22 shows that this lowers and flattens the front-face thermal trace under matched workloads. Relocating heat sources away from the externally observable surface does not eliminate the channel, but it materially reduces device specific thermal application profiling.
2 Y H U D O O 7 H P S )
+ H D G V H W
0 H W D 4 X H V W 0 H W D 4 X H V W 9 L Y H ) R F X V 9 L V L R Q
7 L P H V
Fig. 22: Front-face temperature traces across vs. VR headsets. Thermal Obfuscation. Artificially modulating device thermal output (e.g., randomizing fan behavior, injecting dummy work-
13
loads) could obscure application signatures. However, this approach incurs power and performance costs. Physical Shielding. Thermal-reflective coatings or shrouds could attenuate external thermal radiation, though at the cost of device aesthetics and potentially user comfort.
[13] T. Ni, Y. Du, Q. Zhao, and C. Wang, “Non-intrusive and unconstrained keystroke inference in vr platforms via infrared side channel,” arXiv preprint arXiv:2412.14815, 2024. [14] D. Cayir, R. Mohamed, R. Lazzeretti, M. Angelini, A. Acar, M. Conti, Z. B. Celik, and S. Uluagac, “Speak up, i’m listening: Extracting speech from zero-permission vr sensors,” in NDSS, 2025. [15] A. A. Arafat, Z. Guo, and A. Awad, “Vr-spy: A side-channel attack on virtual key-logging in vr headsets,” 2021 IEEE Virtual Reality and 3D User Interfaces (VR), pp. 564–572, 2021. [Online]. Available: https://api.semanticscholar.org/CorpusID:234478339 [16] F. He, H. Dai, H. Guo, X. Luo, and J. Yu, “Acoulistener: An inaudible acoustic side-channel attack on ar/vr systems,” in European Symposium on Research in Computer Security, 2025. [Online]. Available: https://api.semanticscholar.org/CorpusID:282594066 [17] Z. Yang, Z. Sarwar, I. Hwang, R. Bhaskar, B. Y. Zhao, and H. Zheng, “Can virtual reality protect users from keystroke inference attacks?” in 33rd USENIX Security Symposium (USENIX Security 24). Philadelphia, PA: USENIX Association, Aug. 2024, pp. 2725–2742. [18] W. Wodo and L. Hanzlik, “Thermal imaging attacks on keypad security systems,” in International Conference on Security and Cryptography, 2016. [Online]. Available: https://api.semanticscholar.org/CorpusID: 20698958 [19] K. Mowery, S. Meiklejohn, and S. Savage, “Heat of the moment: Characterizing the efficacy of thermal camera-based attacks,” in Workshop on Offensive Technologies, 2011. [Online]. Available: https://api.semanticscholar.org/CorpusID:6549699 [20] Y. Abdrabou, Y. Abdelrahman, A. Ayman, A. Elmougy, and M. Khamis, “Are thermal attacks ubiquitous?: When non-expert attackers use off the shelf thermal cameras,” Proceedings of the 2020 International Conference on Advanced Visual Interfaces, 2020. [Online]. Available: https://api.semanticscholar.org/CorpusID:222111495 [21] S. A. Macdonald, N. Alotaibi, M. Islam, and M. Khamis, “Conducting and mitigating portable thermal imaging attacks on user authentication using ai-driven methods,” Proceedings of the Augmented Humans International Conference 2023, 2023. [Online]. Available: https: //api.semanticscholar.org/CorpusID:257497581 [22] N. Alotaibi, J. Williamson, and M. Khamis, “Thermosecure: Investigating the effectiveness of ai-driven thermal attacks on commonly used computer keyboards,” ACM Transactions on Privacy and Security, vol. 26, pp. 1 – 24, 2022. [Online]. Available: https://api.semanticscholar.org/CorpusID:252222915 [23] Y. Abdelrahman, M. Khamis, S. Schneegass, and F. Alt, “Stay cool! understanding thermal attacks on mobile-based user authentication,” Proceedings of the 2017 CHI Conference on Human Factors in Computing Systems, 2017. [Online]. Available: https://api.semanticscholar.org/CorpusID:1419311 [24] T. Kim and Y. Shin, “Thermalbleed: A practical thermal side-channel attack,” IEEE Access, vol. 10, pp. 25 718–25 731, 2022. [25] Meta Platforms, Inc., Meta Quest 2, Meta, 2020. [Online]. Available: https://www.meta.com/quest/products/quest-2/ [26] TOPDON Technology Co., Ltd., TOPDON TC001 Thermal Camera, TOPDON, 2022. [Online]. Available: https://www.topdon.us/products/ tc001 [27] O. R. R. Aranya and K. Desai, “Sra-seg: Synthetic to real alignment for semi-supervised medical image segmentation,” 2026. [Online]. Available: https://arxiv.org/abs/2602.02944 [28] Meta Platforms, Inc., Meta Quest 3, Meta, 2023. [Online]. Available: https://www.meta.com/quest/quest-3/ [29] HTC Corporation, VIVE Focus Vision, HTC, 2024. [Online]. Available: https://www.vive.com/us/product/vive-focus-vision/overview/ [30] Google LLC, “Youtube,” https://www.youtube.com/, n.d., video streaming platform. [31] Zoom Video Communications, Inc., “Zoom web client,” https://zoom. us/, n.d., web-based video conferencing platform. [32] Arkio, “Arkio,” https://www.arkio.is/, n.d., collaborative spatial design application for VR and AR. [33] Meta Platforms, Inc., “Firsthand,” https://www.meta.com/experiences/ first-hand/5030224183773255/, n.d., virtual reality experience. [34] VRFS, “Vrfs,” https://www.meta.com/experiences/ vrfs-football-soccer-simulator/8464137310294097/, n.d., virtual reality soccer simulation software. [35] Xinfrared (InfiRay Technologies Co., Ltd.), InfiRay P2 Pro Thermal Camera, Xinfrared, n.d. [Online]. Available: https://www.xinfrared. com/products/infiray p2 pro thermal camera
VIII. C ONCLUSION We presented ThermalTap, the first non-contact thermal side-channel attack that fingerprints VR applications from externally observable infrared emissions. Our results show that a commodity thermal camera can recover applicationlevel information from a VR headset without software access, cable access, or interaction with the victim device. ThermalTap achieves strong performance under controlled indoor conditions and remains partially effective under environmental and cross-device variability, establishing thermal radiation as a practical physical side channel for immersive systems. These findings highlight the need to consider thermal emanations when designing privacy protections for future VR platforms. R EFERENCES [1] Y. Zhang, C. Slocum, J. Chen, and N. Abu-Ghazaleh, “It’s all in your head (set): Side-channel attacks on {AR/VR} systems,” in USENIX Security 23, 2023. [2] J. Li, Y. Meng, Y. Zhan, L. Zhang, and H. Zhu, “Dangers behind charging vr devices: Hidden side channel attacks via charging cables,” IEEE Transactions on Information Forensics and Security, 2024. [3] S. Son, C. Mukherjee, R. M. Aburas, B. Gülmezoglu, and Z. B. Celik, “Side-channel inference of user activities in ar/vr using gpu profiling,” ArXiv, vol. abs/2509.10703, 2025. [Online]. Available: https://api.semanticscholar.org/CorpusID:281314952 [4] S. Siddens, S. Srivastava, R. Levine, J. Dykstra, and T. Sorensen, “Memory disorder: Memory re-orderings as a timerless sidechannel,” ArXiv, vol. abs/2601.08770, 2026. [Online]. Available: https://api.semanticscholar.org/CorpusID:284704822 [5] W. Sun, M. Fang, and M. Li, “Vreaves: Eavesdropping on virtual reality app identity and activity via electromagnetic side channels,” ArXiv, vol. abs/2506.17570, 2025. [Online]. Available: https://api.semanticscholar.org/CorpusID:279999486 [6] D. Genkin, I. Pipman, and E. Tromer, “Get your hands off my laptop: Physical side-channel key-extraction attacks on PCs,” Cryptology ePrint Archive, Paper 2014/626, 2014. [Online]. Available: https://eprint.iacr.org/2014/626 [7] Y. Hayashi, N. Homma, M. Miura, T. Aoki, and H. Sone, “A threat for tablet pcs in public space: Remote visualization of screen images using em emanation,” in Proceedings of the 2014 ACM SIGSAC Conference on Computer and Communications Security, 2014, pp. 954–965. [8] T. Ni, G. Lan, J. Wang, Q. Zhao, and W. Xu, “Eavesdropping mobile app activity via {Radio-Frequency} energy harvesting,” in 32nd USENIX Security Symposium (USENIX Security 23), 2023, pp. 3511–3528. [9] S. Luo, A. Nguyen, H. Farooq, K. Sun, and Z. Yan, “Eavesdropping on controller acoustic emanation for keystroke inference attack in virtual reality,” in The Network and Distributed System Security Symposium (NDSS), vol. 1, no. 2, 2024, p. 3. [10] P. Cronin, X. Gao, C. Yang, and H. Wang, “Charger-surfing: Exploiting a power line side-channel for smartphone information leakage,” in USENIX Security Symposium, 2021. [Online]. Available: https://api.semanticscholar.org/CorpusID:235365900 [11] H. Chen, W. Jin, Y. Hu, Z. Ning, K. Li, Z. Qin, M. Duan, Y. Xie, D. Liu, and M. Li, “Eavesdropping on black-box mobile devices via audio amplifier’s emr,” in Proceedings of the 2018 Annual International Conference on Network and Distributed System Security (NDSS), 2024. [12] S. A. Ayati, J. H. Park, Y. Cai, and M. Botacin, “Making acoustic side-channel attacks on noisy keyboards viable with llmassisted spectrograms’ ”typo” correction,” in Workshop on Offensive Technologies, 2025. [Online]. Available: https://api.semanticscholar.org/ CorpusID:277824087
14
user’s face), we apply geometric filtering based on the largest connected component: • Aspect Ratio Filter: Valid headset masks must have width-to-height ratios between 1.3 and 2.8 (headsets are wider than tall; extreme ratios indicate rotation or distortion). • Solidity Filter: Mask solidity (area / convex hull area) must exceed 0.80 to reject irregular shapes. Frames failing these filters are marked with NaN values to preserve temporal sequence integrity while excluding unreliable data from analysis.
[36] T. G. Dietterich, “An experimental comparison of three methods for constructing ensembles of decision trees: Bagging, boosting, and randomization,” Machine learning, 2000. [37] L. Breiman, “Random forests,” Machine learning, vol. 45, no. 1, pp. 5–32, 2001.
A PPENDIX A P ILOT S TUDY The application suite in out pilot study covered a set of representative set of apps including idle, media, utility, and simulation workloads, as summarized in Table IV. TABLE IV: Application test suite used in pilot study. Application
Category
Load Level
Home YouTube YouTube VR First Steps Arkio VRFS First Hand
– Media Media Utilities Utilities Simulation Simulation
Base Low Low Medium Medium High High
A PPENDIX C DATASETS AND P REPROCESSING A. Data Preprocessing We apply the same preprocessing pipeline across all the evaluated models (described in Section V-D). To avoid data leakage, preprocessing parameters are learned from the training data and applied unchanged to the test data. Features are first standardized using statistics computed on the training set. We then remove low-variance features below the camera’s noise-equivalent temperature difference (NETD) threshold, using 0.0016, corresponding to 40 mK. Finally, we apply feature selection using ANOVA F-scores before classification.
A PPENDIX B A DDITIONAL D ETAILS ON S EGMENTATION A. Segmentation Model Training
B. Dataset Details
To train the ROI segmentation model, we adopt a semisupervised labeling strategy to reduce annotation effort. From the full dataset, a subset of frames is manually annotated with headset masks and split into training, validation, and test sets. The segmentation model is trained on the labeled subset and then applied to the remaining unlabeled frames to generate masks for the full dataset. The SRA-Seg train/val/test split was 80/10/10 and the resulting best model is further utilized to run inference on the rest of the dataset to generate ROI masks. The final segmentation outputs are filtered using the geometric constraints described in Section V-A before feature extraction. See Section B for further details. Semi-Supervised Training Our entire dataset comprises approximately 107,000 thermal frames. To minimize manual annotation effort for generating the ground truth for our segmentation model, we adopted a semi-supervised labeling strategy: 1) Down-sampling: We uniformly sampled the dataset to one-fourth its original size. 2) Manual Annotation: We manually labeled 3,084 frames for E1, 1276 frames for E2 and 2385 frames for E3 with precise headset masks, splitting them into training (80%), validation (10%), and test (10%) sets. 3) Model Training: The SRA-Seg was trained on the labeled subset using binary cross-entropy loss with the Adam optimizer. 4) Inference: The trained models were applied to segment the remaining unlabeled frames in respective dataset. Geometric Filtering: To reject malformed segmentation masks (e.g., masks that erroneously capture head straps or
In Table I we show the application suite utilized for our experiments. We further show our dataset details in Table II. Our E3 dataset is collected from three distinct devices and the sessions collected are shown in Table V. TABLE V: E3 dataset. Headset
Sessions
Meta Quest 3 Meta Quest 2 HTC Vive Focus Vision
32 32 20
Total
84
A PPENDIX D A DDITIONAL R ESULTS A. Activity State Detection Table VI shows the first part of our hierarchical models performance, activity state detection model. TABLE VI: Activity-state detection. State
Precision %
Recall %
F1 %
Active Idle
88.15 ± 0.38 70.53 ± 1.80
97.29 ± 0.19 33.18 ± 1.29
92.49 ± 0.23 45.13 ± 1.4
Overall(w)
85.27 ± 0.46
86.79 ± 0.38
84.74 ± 0.47
B. Active-app Detection Table VII shows the app fingerprinting results of E1.
15
TABLE VII: Per-app performance of ThermalTap for E1.
$ U N L R
) L U V W + D Q G
0 H G L D 3 O D \ H U
9 5 ) 6
< R X W X E H
= R R P : H E
Application
Precision
Recall
F1
Arkio First Hand Media Player VRFS YouTube Zoom Web
88% 100% 91% 91% 100% 75%
88% 88% 91% 100% 100% 75%
88% 93% 91% 95% 100% 75%
Overall
91%
91%
91%
3 H U F H Q W D J H
C. Performance w/o activity-state detection
Recall
F1
Arkio First Hand Home Media Player VRFS YouTube Zoom Web
80% 89% 67% 83% 83% 77% 70%
89% 100% 17% 91% 100% 91% 88%
84% 94% 27% 87% 91% 83% 78%
Overall
78%
80%
76%
TABLE XI: Mean per-app metrics across all folds for E2.
D. Additional ML Comparison Results Table IX shows ThermalTap performance of the evaluated ML classifiers for experiment E1. TABLE IX: ML model performance comparison. Model
Precision %
Recall %
F1 %
Random Forest XGBoost SVM
91.23 ± 4.0 96.00 ± 3.0 84.23 ± 9.0
91.07 ± 4.0 95.00 ± 3.0 83.93 ± 6.0
91.05 ± 4.0 95.00 ± 3.0 83.93 ± 6.0
Prec.
Rec.
Precision %
Recall %
F1 %
Arkio First Hand Media Player VRFS YouTube Zoom Web
58.33 ± 23 42.45 ± 9 45.33 ± 38 70.08 ± 21 84.25 ± 15 58.81 ± 23
40.00 ± 17 68.33 ± 22 31.67 ± 27 51.67 ± 25 83.33 ± 20 63.33 ± 26
45.83 ± 16 50.22 ± 9 35.33 ± 28 55.20 ± 15 81.32 ± 11 56.49 ± 16
App Name
Precision %
Recall %
F1 %
Arkio First Hand Media Player VRFS YouTube Zoom Web
68.33 ± 24 85.50 ± 16 66.25 ± 23 60.58 ± 19 64.56 ± 19 75.42 ± 22
46.67 ± 16 81.67 ± 17 66.67 ± 18 61.67 ± 16 75.00 ± 26 63.33 ± 23
52.90 ± 15 82.32 ± 13 65.57 ± 19 58.76 ± 13 66.88 ± 18 65.04 ± 17
E. Diagnostic Headset-Baseline Normalization
TABLE X: Effect of normalization on outdoor experiments. Feat.
App
TABLE XII: E2 session-level performance.
Table X summarizes the effect of environmental normalization under outdoor conditions. Direct indoor-to-outdoor transfer performs poorly due to substantial domain shift, while adding a small number of outdoor calibration sessions significantly improves classification performance. Environmental normalization provides a smaller but consistent additional improvement across all metrics.
Setting
)
as YouTube and VRFS, remain more separable under outdoor environmental variability than lower-load or less thermally distinctive applications. Table XI summarizes the per-application outdoor performance in E2 across all folds. The results show that outdoor conditions affect applications unevenly, with YouTube achieving the strongest overall performance while Media Player and Arkio remain more susceptible to environmental variation and inter-class overlap.
TABLE VIII: Performance w/o activity-state detection. Precision
5 H F D O O
Fig. 23: Per-app performance for E2 outdoor experiments (window-level analysis).
Table VIII ThermalTap app inference performance that includes Home alongside the six active applications (without running idle-detection step).
Application
3 U H F L V L R Q
To better understand the role of headset-specific thermal structure in E3, we evaluate a diagnostic headset-baseline normalization strategy. The goal of this analysis is not to introduce a new component of the ThermalTap framework, but to test whether removing each headset’s static resting thermal profile improves cross-device transfer. For each headset, we first compute an idle thermal baseline using Home sessions. Let Bh (i, j) denote the average idle temperature of grid cell (i, j) for headset h. For an active app
F1
Zero-shot Raw 11.64 ± 5.22 15.62 ± 6.44 12.49 ± 4.95 Few-shot Raw 66.56 ± 8.44 61.39 ± 7.34 60.06 ± 7.78 Few-shot Norm. 67.25 ± 10.15 64.44 ± 8.31 62.55 ± 8.88
Figure 23 presents the per-application outdoor fingerprinting performance under the few-shot normalized setting. Applications with more stable and distinctive thermal behavior, such
16
observation from the same headset, with grid-cell temperature Th (i, j, t), we compute the baseline-subtracted residual:
$ F F X U D F \
Th′ (i, j, t) = Th (i, j, t) − Bh (i, j). This transformation removes persistent thermal offsets associated with the headset’s resting state, such as static heat patterns caused by battery location, chassis geometry, material properties, and idle cooling behavior. The resulting residual features represent temperature deviation relative to that headset’s idle profile. However, this normalization only removes a static baseline. It does not account for dynamic device-specific effects, such as differences in fan behavior, heat spreading, thermal inertia, vent placement, or workload-dependent cooling responses. Therefore, even after baseline subtraction, the same application can produce different thermal patterns across headset models. We also compute a thermal signature ratio to assess whether baseline subtraction increases application-level similarity relative to device-level similarity. Let Simapp denote the average cosine similarity between the same application observed across different headsets, and let Simdev denote the average cosine similarity between different applications observed on the same Sim . headset. We define: R = Simapp dev A higher value of R indicates that application-level similarity is stronger relative to headset-level similarity. However, R > 1 should be interpreted only as evidence that baseline subtraction increases application-level alignment in feature space; it does not by itself imply that zero-shot classification will be reliable. The E3 results show that headset-baseline normalization does not solve cross-device transfer. In the pooled setting, performance decreases substantially, indicating that the raw model benefits from device-conditioned application signatures when all headset families are represented during training. In the zero-shot setting, baseline normalization provides only a small improvement and remains far below reliable fingerprinting performance. These results suggest that headsetspecific effects are not merely static thermal offsets, but are also embedded in the dynamic way each device dissipates application-induced heat.
3 H D N D W
: L Q G R Z $ F F X U D F \ 6 H V V L R Q $ F F X U D F \
* U L G ' L P H Q V L R Q 1 [ 1
Fig. 24: Application classifier accuracy by thermal grid size. $ U N L R ) L U V W + D Q G
0 H G L D 3 O D \ H U 9 5 ) 6
< R X W X E H = R R P : H E
2 9 ( 5 $ / /
$ F F X U D F \
* U L G ' L P H Q V L R Q 1 [ 1
Fig. 25: Per app accuracy by thermal grid size.
at moderate distances and decreases at larger distances as the observable thermal structure becomes less distinct.
$ F F X U D F \
@
@
' L V W D Q F H I U R P & D P H U D F P
@
Fig. 26: Accuracy vs. distance.
F. Additional Ablations Figure 24 illustrates how thermal grid resolution affects both window-level and session-level classification performance. Classification accuracy improves as the representation preserves more localized thermal structure, peaks near a 12×12 grid, and then saturates or slightly declines at finer resolutions due to increased noise sensitivity. Figure 25 shows the sensitivity of per-application classification accuracy to the spatial grid resolution used in the thermal representation. Most applications benefit from finer spatial grids, although the degree of improvement varies across applications depending on the stability and localization of their thermal signatures. Figure 26 shows how application-classification accuracy varies with camera-to-headset distance. Performance is highest
$ F F X U D F \
@
@
@
$ P E L H Q W 7 H P S H U D W X U H 5 D Q J H )
Fig. 27: Accuracy vs temperature.
17