SoK: Motion Data Privacy in Extended Reality

SoK: Motion Data Privacy in Extended Reality Azim Ibragimov, Alina Vasina, Uliana Polshcha, Eric D. Ragan University of Florida Gainesville, Florida, USA

Figure 1: In Extended Reality (XR), people appear as virtual avatars, which may give users a false sense of anonymity since others cannot see their real faces or bodies. However, XR devices are equipped with motion sensors (i.e., controllers, headset, eye trackers) that reveal the motion pattern of a person behind the virtual avatar. These motion patterns have long been used for surveillance purposes (e.g., gait identi!cation and pro!ling), and with the widespread adoption of XR systems, they have become easier to obtain than ever. Adversaries can perform privacy attacks by observing a user’s virtual avatar, estimating the locations of key joints, accessing recordings in research datasets, or obtaining API access. This SoK examines the privacy concerns posed by these motion patterns and the ease with which they can be collected within XR.

Abstract

model; systematize the attack and defense approaches in the XR motion literature; identify gaps in the literature; and provide guidelines for future studies evaluating motion privacy mechanisms. Together, our SoK clari!es the state of XR motion privacy and provides recommendations for future evaluations.

Extended Reality (XR) provides immersive, interactive 3D experiences. To enable these experiences, the devices must track user motion so the system can respond to actions such as grabbing, looking at, or moving an object. However, motion tracking has raised privacy concerns since it records a person’s motion patterns. These motion patterns have been studied extensively across various !elds (i.e., gait identi!cation and pro!ling) and have been shown to reveal sensitive information. With the adoption of XR, these patterns became easier to record and obtain than ever. This creates a fundamental privacy tension: motion tracking enables core XR functionality yet requires users to compromise their privacy. Prior systematization-of-knowledge (SoK) studies on XR privacy have examined the !eld broadly, with motion-related research distributed across several privacy domains rather than treated as a distinct area of study. However, XR motion privacy has gained signi!cant momentum since the prior SoK, with the literature nearly quadrupling in size and thereby warranting a dedicated systematization of this topic. This SoK examines 134 relevant papers on privacy concerns in motion patterns recorded by XR headsets, including how adversaries can obtain users’ motion patterns, the inferences they can draw from them, and methods for protecting users. Based on this review, we synthesize a taxonomy of motion modalities, representations, and inference risks; develop an XR motion threat

Keywords Extended Reality, Motion Privacy, Motion Data, Privacy Attacks, Privacy-Preserving Methods

1

Introduction

Extended Reality (XR), an umbrella term for Virtual Reality (VR), Augmented Reality (AR), and Mixed Reality (MR), relies on continuous tracking of user movement to create immersive and interactive experiences [24–26, 143]. Tracked motion enables the environment to respond to user actions, such as looking around, navigating virtual environments, manipulating virtual objects, interacting with others, and controlling avatars that represent them. As a result, signals from the eyes, head, hands, body, and face are not secondary sensor streams in XR; they are fundamental to how users perceive, act within, and communicate through these systems. This can create a privacy problem [51, 106, 107, 156] that is easy to underestimate. In XR, users may assume that changing visible identity cues, such as avatar appearance, usernames, or pro!le information, is enough 1

Ibragimov et al.

to remain anonymous. Identi!cation by motion data challenges this assumption. A user may change their avatar, but the avatar still retains the person’s movement patterns. These movements may be observed by others during ordinary interactions or accessed by applications through APIs. As a result, even when visible identity cues are concealed, users’ motion patterns remain observable and accessible. Research has shown that these patterns can reveal users’ identities [51, 107], demographic characteristics [53, 141], health information [118, 166], cognitive [9, 106] and behavioral traits [36, 111]. Thus, a naive user who changes their avatar and username in the hope of remaining anonymous may still be identi!able, and sensitive information about them may be inferred. Risks posed by motion patterns within XR have been acknowledged by previous surveys and SoKs [2, 11, 15, 19, 35, 37, 44, 46, 112, 157]. Among these, the most relevant SoK by Garrido et al. [35] systematized privacy risks in VR environments across broad privacy domains, including geolocation telemetry, inertial telemetry, text, audio, video, psychological signals, system and network data, and behavior. Motion privacy research appears across several of these categories rather than being treated as a distinct organizing dimension. At the time of their database search (August 2022), this was a natural representation of a !eld in which motion privacy research was still relatively limited and distributed across di"erent privacy domains. Since then, however, the XR motion privacy literature has nearly quadrupled. We build on this prior work by examining motion as a distinct organizing dimension of XR privacy. This shift is motivated by both the centrality of movement in XR systems and the rapid growth of the literature. This growth suggests that XR motion privacy is now su#ciently large and technically diverse to warrant dedicated systematization. Our analysis reveals gaps and inconsistencies in evaluation practices that complicate comparison across studies. To address these challenges, we organize the literature using a common threat model and taxonomy and systematically categorize attack and defense research. This paper makes the following contributions:

and Ray Ban Meta AI Glasses [94]), and devices that allow users to switch between both modes (e.g., Meta Quest Pro [93] and Apple Vision Pro [3]). These devices project virtual objects into the user’s !eld of view, creating a sense of immersion. XR devices are used for gaming [120], education [4], training [125], and military [70] applications. To enable immersive experiences, natural interaction, presence, XR devices commonly track user motion using sensors built into the devices. These sensors can track hand motion (through controllers or gesture tracking [14]), head motion (through IMU sensors located within the HMD [67]), eye motion (through eyetracking sensors [11]), full-body motion (through full-body tracking suits [22] or external cameras [18]), and facial expressions (through inward-facing cameras [161] or infrared sensors [20]).

2.2

Privacy Risks of Motion Data.

Motion data posed privacy risks long before the widespread adoption of XR [62, 80, 100, 114, 116, 123]. Gait is a prominent example: it can serve as a distinctive behavioral biometric for identity recognition [21, 62, 79, 80, 100, 114, 116, 123] and demographic inference [50, 68, 69, 72, 86, 162]. Historically, however, collecting large amounts of high-quality gait data has been challenging [52] due to factors such as substantial capture distances [133], outdoor environments [144], and varying environmental conditions [140], which can reduce data quality. Recruiting participants for biometric studies can also be di#cult [99]. XR substantially reduces these collection barriers. Motion is recorded directly by sensors on or near the user’s body, reducing issues related to distance and external recording conditions [14]. Users may also voluntarily upload their motion recordings online [107, 109], while participation in online XR games and social applications can expose movements through avatars even without explicit uploads [91]. Consequently, large-scale XR motion datasets have emerged, including datasets containing recordings from as many as 105,000 users collected from publicly uploaded recordings [109]. The combination of high-quality XR motion sensing and largescale data availability creates an unprecedented privacy risk by enabling privacy attacks at scale. Prior research has demonstrated the inference of identity, demographic attributes, health information, cognitive characteristics, and behavioral cues from motion data. These inference risks are the primary focus of our systematization.

(1) We provide a systematization of XR motion privacy research covering 134 publications selected, which we synthesize into an XR motion threat model (§4) and taxonomy (§5). (2) We identify gaps and inconsistencies in the assumptions and evaluation practices used in XR motion privacy research, particularly in utility assessment, adversary modeling, multimodal evaluation, exposure-point analysis, and the treatment of candidate-set size (§6, §7). Based on these !ndings, we provide recommendations for the design and evaluation of future defenses (§8). (3) We release the screened-paper list, exclusion decisions, !nal corpus, and coding sheet, enabling reproduction of our review and supporting future extensions of the XR motion privacy literature.

2.3

Relationship to Prior Surveys and SoKs

Recognizing the privacy risks posed by XR headsets, researchers have developed surveys and SoKs that provide an important foundation for the XR privacy !eld [2, 11, 15, 19, 35, 37, 44, 46, 112, 157]. However, these works either a) examine XR privacy and security broadly [19, 35, 37], b) focus on speci!c application domains (e.g., healthcare [2], virtual commerce [44]), c) focus on particular motion modalities (e.g., eye tracking [11], body tracking [112]), or d) focus on particular a privacy risk (e.g., recognition [46, 157], health [2]). For example, the most closely related SoK, by Garrido et al. [35], systematizes the broader VR privacy literature based on 75 publications spanning geospatial telemetry, inertial telemetry, audio, text, video, physiological signals, system and network data, and

2 Background & Related Work 2.1 Extended Reality and Sensors. Modern wearable XR systems include devices that completely replace one’s !eld of view with a virtual projection (e.g., Meta Quest [92], and HTC Vive Pro 2 [47]), devices that preserve a clear view of the real world while overlaying virtual content (e.g., Google Glass [38] 2

behavioral information. Motion-relevant research appears across several of these categories rather than being treated as a distinct organizing dimension. At the time of their literature search, conducted in August 2022, this was a natural representation of a !eld in which motion-related privacy research was still relatively limited and distributed across di"erent privacy domains. Since then, however, XR motion privacy has developed into a substantially larger and more diverse body of research. As shown in Section 3, the literature meeting our motion-focused inclusion criteria has nearly quadrupled since the search conducted by Garrido et al. [35]. This growth has also introduced new motion modalities, inference targets, threat models, defense mechanisms, and evaluation practices. Consequently, research that previously appeared across broader privacy categories can now be examined as a coherent body of work centered on the privacy implications of motion itself. The growth and maturation of this literature therefore motivate a dedicated systematization of motion data privacy in XR.

3

(!virtual reality! OR !augmented reality! OR !mixed reality! OR !extended reality! OR VR OR AR OR MR OR XR) AND (motion OR movement OR pose OR tracking OR telemetry OR gaze OR eye OR head OR hand OR controller OR gesture OR body OR skeleton OR gait OR locomotion OR facial OR avatar) AND (privacy OR re-identification OR tracking OR profiling OR anonymization OR obfuscation OR !differential privacy! OR !authentication! OR !biometrics! OR !user modeling! OR !behavior analysis! OR !attribute inference! OR !activity recognition! OR !emotion recognition! OR !stress detection! OR !health inference!)

Searches were run over the title, abstract, keyword, or metadata !elds supported by each database. The search terms were intentionally broad to account for variation in how XR systems, motion modalities, and privacy-relevant inference tasks are described across research communities. The complete set of records retrieved through these searches is reported in the released materials.

Method: Data Collection & Analysis

3.1.2 Manual Search. The database search covered a substantial number of relevant venues. However, we identi!ed one important venue that was not covered by any of the selected databases: the Privacy Enhancing Technologies Symposium and its proceedings (PETS/PoPETs). This venue publishes a substantial body of research relevant to XR motion privacy and notably, the closest related SoK by Garrido et al. [35] was also published there. We therefore considered it necessary to include this venue in our search strategy. Because PoPETs/PETS does not provide a search interface compatible with our automatic search queries, we conducted a manual search of the venue. As part of this manual search, we reviewed every paper published by the venue since 2000, the !rst available volume in its online archive 1 .

Three researchers conducted a structured literature review of technical work on XR motion privacy. Section 3.1 describes the search strategy used to identify the initial corpus. Section 3.2 describes the inclusion criteria and screening procedure used to determine the !nal corpus. Finally, Section 3.3 describes how the included papers were analyzed and coded to develop the threat model and taxonomy used throughout this work. Throughout this process, the researchers iteratively reviewed papers to discuss interpretations, resolve inclusion and exclusion decisions, and reconcile di"erences in analysis and coding. Decisions were made through discussion and common agreement whenever possible; in the rare cases where agreement could not be reached (3.73% of decisions), the !nal decision was determined by majority vote.

3.1

3.1.3 Backward and Forward Citation Chasing. To improve the reach of our search, we performed backward and forward citation chasing on all papers that met our inclusion criteria after screening. For each included paper, we reviewed its reference list (backward citation chasing) and the papers that cited it (forward citation chasing) to identify additional relevant studies that were not retrieved through the automatic or manual searches. Newly identi!ed papers were screened using the same inclusion and exclusion criteria.

Search Strategy

Our hybrid search strategy included database searches (§3.1.1), manual searches (§3.1.2), as well as backward and forward citation searches (§3.1.3). 3.1.1 Database Search. For the automatic search, we used IEEE Xplore, the ACM Digital Library, the ACM Guide to Computing Literature, ScienceDirect, and Elsevier on May 15, 2026, with no start-year restriction. These databases cover relevant venues across three areas: (1) XR, with examples including IEEE VR, IEEE ISMAR, IEEE TVCG, ACM VRST, and ACM CHI; (2) biometrics, with examples including IEEE TBIOM, IEEE IJCB, and IEEE FG; and (3) security, with examples including USENIX Security, IEEE S&P, and NDSS. The search query combined three groups of terms: XR terms (virtual reality, augmented reality, mixed reality, extended reality, VR, AR, MR, XR), motion terms (motion, movement, pose, tracking, telemetry, gaze, eye, head, hand, controller, gesture, body, skeleton, gait, locomotion, facial, avatar), and privacy or inference terms (privacy, re-identi!cation, tracking, pro!ling, anonymization, obfuscation, di"erential privacy, authentication, biometrics, user modeling, behavior analysis, attribute inference, activity recognition, emotion recognition, stress detection, health inference). The generic Boolean query was:

3.2

Screening

After performing the search strategy described in Section 3.1, we identi!ed 9,542 unique records through the automatic search and 1,285 records through the manual search. To ensure that the !nal corpus remained within the scope of XR motion privacy, we applied the inclusion criteria and screening procedure described below. 3.2.1 Inclusion Criteria. We included papers that (1) studied wearable VR, AR, MR, or XR systems with visual displays, or motion representations directly used in such systems, including 3D gaze rays, tracked head or hand poses, skeletal poses, avatar motion, or facial animation parameters; (2) involved motion data, including head, hand, eye, gaze, facial, gesture, body, avatar, or derived behavioral signals; and (3) analyzed a privacy risk, attack, defense, 1 https://petsymposium.org/popets/

3

Ibragimov et al.

corpus to identify recurring concepts, assumptions, and evaluation practices. In the second stage, we used the resulting threat model and taxonomy as a structured codebook for systematically labeling the papers. 3.3.1 Analysis. We !rst reviewed the entire corpus to identify the threat models and assumptions used across the literature. In particular, we analyzed the motion modalities available to adversaries, the exposure points through which adversaries access motion data, the representations and features of motion data, the privacy risks and inference targets considered, dataset sizes, proposed defenses, utility evaluations of these defenses, and the availability of openscience artifacts. After labeling these characteristics for individual papers, we examined the resulting labels across the corpus and iteratively grouped conceptually similar labels into higher-level categories. These groupings were discussed and re!ned among the researchers until the categories consistently represented recurring concepts observed across the corpus. Based on recurring patterns across the corpus, we developed the XR motion privacy threat model (§4) and the taxonomy (§5).

Figure 2: Publication timeline of the corpus relative to the August 2022 database search of Garrido et al. [35], with annual publication counts shown in parentheses.

3.3.2 Coding. After completing the initial analysis, we performed a second pass over the corpus to systematically code each paper according to the resulting threat model and taxonomy. We categorized the papers into three groups: attack, defense and other. Attack papers propose or evaluate methods that enable privacy attacks (e.g., inferring a user’s gender from their motion data). Defense papers propose, evaluate, or benchmark privacy-preserving methods by evaluating attacks on protected motion data (e.g., testing whether a user’s gender can still be inferred after applying a privacy mechanism). When a paper evaluates attacks on both protected and unprotected data, we classify it as defense, as attacks on unprotected data commonly serve as a baseline for evaluating the e"ectiveness of the defense. The remaining papers, including surveys, SoKs, and dataset papers, were categorized as other papers. For both attack and defense papers, we coded the motion modalities considered and the types of privacy threats addressed. For defense papers, we additionally coded the type of privacy mechanism, the number of participants represented in the evaluation, the type of adversary evaluation, the utility evaluation methods, and the availability of open-science artifacts.

system design, or inference method relevant to motion privacy. These criteria allowed us to include work directly applicable to XR while excluding general sensing research with no clear connection to immersive systems. 3.2.2 Screening Procedure. All records identi!ed through the automatic and manual searches underwent three stages of screening: title screening, abstract screening, and full-text review. At each stage, records that did not satisfy the inclusion criteria described above were excluded. Following title screening, 7,406 records from the automatic search and 48 records from the manual search remained. After abstract screening, 146 and 14 records remained, respectively. Full-text review resulted in the inclusion of 80 papers from the automatic search and 9 papers from the manual search, for a total of 89 papers. We then conducted backward and forward citation chasing on all 89 included papers. Papers identi!ed through citation chasing were evaluated using the same inclusion criteria, resulting in 45 additional papers and bringing the !nal corpus to 134 papers.

4

3.2.3 Timeline of the Corpus. Figure 2 shows the publication timeline of papers in our corpus, which includes papers published as recently as July 2026, and highlights the substantial growth of XR motion privacy research since the August 2022 database search conducted by Garrido et al. [35]. Applying our inclusion criteria, we identi!ed 34 relevant publications available before this cuto". Since then, 100 additional relevant papers have been published, bringing the corpus to 134 publications. The literature has nearly quadrupled, suggesting that XR motion privacy has matured into a su#ciently large body of research to warrant dedicated systematization.

3.3

XR Motion Threat Model

Figure 3 presents our XR motion threat model. The model synthesizes assumptions used throughout the literature, including the points at which adversaries can access motion data and the points at which privacy mechanisms can intervene to mitigate privacy risks. Adversaries. The key adversary assumption of this threat model is that access to motion data does not require a traditional data breach, such as intercepting network tra#c or stealing user credentials. Instead, motion becomes available to adversaries as part of ordinary XR sensing, interaction, or data sharing. Based on our analysis of where adversaries obtain motion data across the literature, we identify three adversary types:

Coding and Analysis

After identifying the !nal corpus, we analyzed and coded the included papers in two stages. In the !rst stage, we reviewed the 4

Figure 3: XR motion privacy threat model. Motion "ows from the user through the XR device to real-time and post-hoc adversaries. XR device adversaries have direct access to raw motion streams; real-time adversaries have access to real-time motion streams via APIs or avatar movements; and post-hoc adversaries have access to recorded motion data. The model also identi!es three intervention points for privacy mechanisms: physical privacy before sensing, stream privacy before motion is exposed in real time, and aggregate privacy before recorded motion is made available for post-hoc access. (A) XR Device Adversaries. These adversaries have direct control over XR sensors. This includes the XR device, platform, or operating system. The main strength of this adversary is its privileged position in the motion pipeline: it has access to high-quality motion before any software-based privacy mechanism can be applied and may also control whether such mechanisms are enabled. Its main limitation is accountability. Device and platform providers are typically identi!able entities, and misuse of user data can create legal, regulatory, and reputational consequences. (B) Real-Time Adversaries. These adversaries have access to real-time motion streams during live XR interaction. Developers may obtain motion streams through platform APIs, while other users may record rendered avatar motion and recover movement patterns through keypoint estimation. Their main strength is that access can be di#cult to trace: users may not know who recorded their avatar or how application-accessed motion via APIs is later used. Their main limitation is data quality, as developers may receive only selected motion channels and user recordings may be short, occluded, or captured from unfavorable viewpoints. (C) Post-Hoc Adversaries. These adversaries access motion traces after they have already been collected, such as through public datasets, application logs, or leaderboards. Their main strengths are easy access and low traceability: they do not need to collect motion data themselves, and when the data is publicly available, it may be impossible to determine who accessed it and performed the privacy attack. Their main limitation is that they are restricted to the information preserved in the released traces, which may be reduced by missing modalities, lower sampling rates, or preprocessing.

a mechanism acts relative to sensing, live exposure, and stored motion data, we organize these defenses into three privacy types: (A) Physical Privacy acts before a user’s movement is captured by XR sensors and is best suited for users who do not trust their XR device. These mechanisms alter the user’s physical movement or interfere with how it is sensed, for example by changing gait through footwear, obscuring eyetracking sensors, or intentionally modifying behavior. Because protection is applied before sensing, it can protect against all three adversary types. Its main strength is that no downstream party receives the original motion. Its main weakness is the burden on the user, including discomfort, fatigue, behavioral e"ort, reduced tracking precision, or degraded interaction quality. (B) Stream Privacy acts after motion has been captured but before it is exposed during live interaction and is best suited for users who trust their XR device but not applications or other users. These mechanisms modify the motion stream before it is exposed through application APIs or avatar behavior. Its main strength is that it protects users during ordinary XR interaction without requiring them to physically alter their movement. Its main weakness is that it cannot protect against XR device adversaries that access the original motion before privatization. It also faces strict real-time constraints, as protection must preserve responsiveness, tracking quality, and user comfort. (C) Aggregate Privacy acts after motion data has been collected and is best suited for protecting stored or released motion traces, such as datasets, logs, recordings, or leaderboards. Its main strength is that it operates post hoc and therefore avoids real-time constraints, allowing more computationally expensive transformations or formal privacy guarantees such as di"erential privacy. Its main weakness is that protection begins only after collection, so XR device

Privacy Types. To protect against the mentioned adversaries, the literature proposes privacy mechanisms that intervene at different points in this motion $ow. Based on our analysis of where 5

Ibragimov et al.

and real-time adversaries that already accessed the original motion remain outside its protection.

5

actions, purchase intent, product interest, or other user preferences [36, 111, 121]. Overall, the taxonomy shows that XR privacy risks span multiple motion modalities and representations. Head, eye, and hand movements cover all !ve privacy-risk categories, while facial and full-body movements have been studied across fewer risks. Together with the threat model (§4), we use this taxonomy to code the corpus in §6 and §7 by motion modality, privacy risk, adversary, and privacy type, and to identify research gaps through the corresponding research questions.

Taxonomy of XR Motion Data Privacy Risks

Figure 4 presents our taxonomy of XR motion data and its associated privacy risks. We organize the taxonomy around three components: motion modalities, their representations, and the privacy risks associated with them. Based on our analysis (§3.3), we group the motion modalities observed across the literature into !ve modalities: • Head Motions. Changes in the position or orientation of the user’s head [87, 105, 135], typically captured through the head-mounted display (HMD) [89]. Head motion may be represented as position [6, 51, 107, 135], orientation [51, 107, 135], velocity [87, 105], or acceleration [105]. • Eye Motions. Motion and gaze behavior produced by the user’s eyes [83–85], including gaze position [142], orientation [10], !xations [29], saccades [29], pupil diameter [158], blink rate [10], scanpaths [119], velocity [83], and acceleration [27]. • Facial Motions. Movements of facial features from expressions and other changes in facial con!guration [54, 82, 155], represented through facial keypoints [155] or blendshapes [54, 82]. • Hand Motions. Motion of the user’s hands during XR interaction [14, 74, 111], captured through tracked controllers as position [107], orientation [108], velocity [122], or acceleration [97], or directly through hand tracking as hand keypoints [74]. • Full-Body Motions. Motion of the user’s body beyond separately tracked head, eye, facial, or hand movements, represented through skeletal joints spanning the body, including avatar joint positions [33], orientations [41], velocities [17], or corresponding joint measurements from full-body tracking suits [90].

6

XR Attacks

Table 1 summarizes the 62 attack papers in our corpus that met the screening criteria (§3.2). For each paper, the table reports the studied motion modality and privacy risk according to our taxonomy (§5). Additionally, the research questions below are designed to address common questions about the attack literature and identify gaps in existing work. (RQ1) Which motion modalities do XR motion a!acks most o"en exploit? Across the 62 attack papers, head movement is the most frequently exploited modality (40 papers), followed by hand movement (28 papers) and eye movement (28 papers). Full-body motion (3 papers) and facial movement (1 paper) are considerably less represented. This pattern likely re$ects the history and availability of XR sensing: head and hand tracking have been standard on commodity VR devices for much longer, whereas full-body and facial tracking became available later or often require more specialized hardware [61]. The attack literature is therefore concentrated around motion streams that are more commonly exposed by XR devices, while newer or less widely available modalities remain comparatively underexplored. (RQ2) What privacy risks are the most studied? Across the 62 attack papers, recognition is the most studied privacy risk (49 papers), followed by health & physiology (8 papers), demographics (8 papers), cognitive & a"ective states (7 papers), and behavior, intent & preference (3 papers). Recognition therefore dominates the literature. One reason may be its direct security implications. Motion-based recognition can increase the impact of an account compromise beyond a single account [5]. For example, if the password of one XR account is leaked, an attacker could use motion associated with that account to identify other accounts belonging to the same user. If the user reused the same password across accounts, the attacker could then try the leaked password on the newly identi!ed accounts and potentially compromise them as well. While recognition has direct security implications, other privacy risks can also be highly invasive, with consequences such as user pro!ling, monitoring, and discrimination [106]. Their comparatively limited representation in the literature therefore reveals an important research gap.

For each modality, the taxonomy shows how the motion is represented in XR systems and which representations have been used in the literature for privacy attacks. Finally, we identify the privacy risks associated with each modality. Across the literature, we identify !ve distinct categories of privacy risk: • Recognition. Includes recognizing, linking, verifying, or re-identifying users from XR motion data. For example, an adversary may determine that multiple seemingly anonymous accounts belong to the same person based on their motion patterns [51, 52, 107, 156]. • Demographics. Includes inference of demographic characteristics such as gender, age, race, income, education, and related attributes [13, 53, 134]. • Health & Physiology. Includes inference of health conditions, impairments, and physiological information such as heart rate, blood pressure, respiration rate, and other vital signs [88, 118, 166]. • Cognitive & A#ective States. Includes inference of users’ cognitive or a"ective states, such as attention, stress, emotion, or engagement [9, 44]. • Behavior, Intent & Preference. Includes inference of users’ behavior, intentions, and preferences, such as future

(RQ3) Can an adversary infer multiple privacy risks from the same motion data? Yes. The same motion data can support multiple privacy inferences, and prior work shows that similar attack pipelines can often be repurposed for di"erent inference 6

Figure 4: Taxonomy of XR motion data and inference risks derived from our analysis of the literature. The !gure maps XR motion modalities to their representations and !ve privacy risk categories: recognition; demographics; health and physiology; cognitive and a#ective states; and behavior, intent, and preferences. targets. In many supervised-learning settings, the motion representation and learning algorithm can remain unchanged while only the prediction labels are changed. For example, a recognition model trained to predict participant identity can instead be trained to predict a demographic attribute such as gender by replacing participant-ID labels with gender labels [106, 111, 141]. Across our attack corpus, 7 papers consider at least two privacy risks. The largest number of risks considered by a single study is four. Nair et al. [111] evaluate all privacy-risk categories except cognitive & a"ective states, while another study by Nair et al. [106] evaluates all categories except behavior, intent & preference. Thus, no work in our corpus evaluates all !ve privacy risks within the same study. This represents an important research gap. A privacy mechanism that protects against recognition may still leave users vulnerable to demographic, health, cognitive, or behavioral inference. Evaluating attacks across multiple privacy risks is therefore important for understanding whether a defense provides comprehensive protection rather than protection against only a single inference target.

together by a single study is four, with Jarin et al. [54] evaluating eye, head, hand, and facial movements. Access to multiple modalities can also make an adversary more capable. Prior work shows that multimodal attacks can outperform their single-modality counterparts [6, 51, 141], allowing adversaries to achieve higher attack accuracy. Another concern is avoidance: if a privacy mechanism protects only one modality while others remain exposed, an adversary can simply use an unprotected modality instead [6, 51]. For example, if eye motion is protected but head motion remains unprotected, the adversary can ignore eye motion and perform the attack using head motion. Despite these risks, no work in our corpus considers all !ve motion modalities simultaneously. This represents an important gap for both attack and defense research.

7

XR Defense

Table 2 summarizes the 50 papers in our corpus that that met the screening criteria (§3.2). The defense papers are coded by protected modality, privacy risk they protect against, privacy type, adversary evaluation, utility evaluation, and open-science support. The research questions below are designed to address common questions about the defense literature and identify gaps in existing work.

(RQ4) Can an adversary have access to multiple motion streams at the same time? Yes, and this is a common setup in the literature. Across the 62 attack papers, 30 evaluate at least two motion modalities. The most common exact combination is head and hand motion (19 papers). The largest number of modalities considered 7

Ibragimov et al.

• • • • •

• • • • •

• • • • • • • • • • • • •

• • •

•

• • • • •

• • •

• •

• •

• • • • • • • • • • • • • • • • • • • • • • • • • • •

•

• •

•

•

•

• •

•

•

(RQ5) What are the most protected modalities and privacy risks? Across the 50 defense papers, eye motion is the most frequently protected modality (28 papers), followed by head motion (27 papers) and hand motion (21 papers). Full-body motion (7 papers) and facial motion (2 papers) receive substantially less attention. This distribution closely follows the attack literature, where eye, head, and hand motion are also the most frequently studied modalities. A similar pattern appears across privacy risks. Recognition is protected most frequently (42 papers), followed by behavior, intent & preference (8 papers), health & physiology (6 papers), demographics (6 papers), and cognitive & a"ective states (1 paper). This mirrors the attack literature, where recognition is the most frequently studied privacy risk. Overall, the defense literature re$ects many of the same gaps observed on the attack side. Full-body and facial motion remain comparatively underexplored, while defenses are heavily concentrated on recognition rather than the broader range of privacy risks that XR motion can reveal. This leaves limited evidence that existing mechanisms can protect less-studied motion modalities or provide protection against privacy risks beyond recognition.

• • •

• • • • • •

• • • •

• •

• •

• • • • • • •

• •

•

•

•

• •

• •

•

• • • • • • • • • • •

•

•

•

• •

•

• • • • •

•

• • • • • • •

•

• • • •

• • • • •

" Cogn. & A#ect.

• •

# Recognition

• • •

$ Health & Phys.

# Demographics

Privacy Risk

" Facial Motions

Attack Paper

A32 He et al. [45] A33 Zafar et al. [163] A34 Premkumar et al. [124] A35 Peng et al. [121] A36 Jeon et al. [56] A37 Miguel-Alonso et al. [95] A38 Rubo et al. [132] A39 Shadin et al. [134] A40 Liebers et al. [74] A41 Zhang et al. [165] A42 Gyreyiri et al. [40] A43 Jeon et al. [55] A44 Rogers et al. [130] A45 Ye et al. [159] A46 Genco et al. [36] A47 Wang et al. [146] A48 Vaitheeshwari et al. [142] A49 Wang et al. [145] A50 Moore et al. [103] A51 Orlosky et al. [118] A52 Munoz et al. [104] A53 Zhang et al. [164] A54 Jarin et al. [54] A55 Nair et al. [106] A56 Normoyle et al. [117] A57 Nair et al. [107] A58 Raju et al. [126] A59 Yu et al. [160] A60 Cheng et al. [23] A61 Hasan et al. [42] A62 Lohr et al. [83]

! Full Body Motions

ID

! Eye Motions

# Behav., Intent & Pref.

" Cogn. & A#ect.

$ Health & Phys.

# Recognition

# Demographics

" Facial Motions

" Hand Motions

•

• •

• •

• • •

Attack Modality " Hand Motions

• • • •

• •

Privacy Risk

! Head Motions

•

! Full Body Motions

Attack Paper

A1 Zhang et al. [168] A2 Mustafa et al. [105] A3 Pfeu"er et al. [122] A4 Bozkir et al. [9] A5 Liebers et al. [78] A6 Yan et al. [158] A7 Sivasamy et al. [135] A8 Bhalla et al. [8] A9 Falk et al. [33] A10 Liebers et al. [73] A11 Liebers et al. [76] A12 Wierzbowski et al. [154] A13 Zhang et al. [166] A14 Miller et al. [98] A15 LaRubbio et al. [66] A16 Jang et al. [53] A17 Aziz et al. [5] A18 Mai et al. [87] A19 Meng et al. [91] A20 Lohr et al. [85] A21 Liebers et al. [75] A22 Zhang et al. [167] A23 Suzuki et al. [139] A24 Tricomi et al. [141] A25 Lohr et al. [84] A26 Nair et al. [111] A27 Liebers et al. [77] A28 Jiao et al. [57] A29 Dossett et al. [31] A30 Zhao et al. [169] A31 Raju et al. [127]

! Head Motions

ID

! Eye Motions

Attack Modality

# Behav., Intent & Pref.

Table 1: Systematization of 62 a!ack papers across the XR motion privacy landscape. Each row represents one paper and reports the motion modalities (•) used in the studied privacy attack and the privacy risks (•) demonstrated.

•

•

•

• •

(RQ6) Which privacy types receive the most research a!ention? Across the 50 defense papers in our corpus, research attention is unevenly distributed across the three privacy types de!ned in our threat model (§4). Stream privacy is the most commonly studied (27 papers), followed by aggregate privacy (20 papers). In contrast, physical privacy is studied far less frequently (3 papers). This distribution reveals a substantial gap in the current defense literature. Physical privacy is the only privacy type in our threat model that can protect users against XR device adversaries, yet it is the least studied. Existing work therefore concentrates primarily on protecting motion after it has already been captured by the XR device, while comparatively little research considers mechanisms that protect users before sensing occurs. This suggests that defenses against adversaries with direct access to XR sensing remain an important direction for future work. (RQ7) How does candidate population size impact the comparison and reproduction of defense evaluations? Candidate population size varies substantially across the defense literature, ranging from 4 to 56,082 participants, with a median of 61 and a 8

•

• • • • • • • • • • • • • • • •

• • • • •

•

• • • • • •

• • • • • •

• • • • •

• • • •

•

•

•

•

• • • • • • • • • • • • • •

•

•

•

•

•

• • • • •

• • • • •

•

•

• • • •

•

• • • •

• • • • • • • • • • • • • • • •

•

• • •

• •

• • •

• • • • • • • • • •

• •

•

•

•

•

•

•

• • • • • •

• •

• • • • •

•

mean of 1534. This variation complicates comparison because identi!cation accuracy inherently depends on the number of candidate identities [52, 96]. For example, 50% accuracy among two candidates is equivalent to random guessing, whereas 50% among 55,000 candidates is dramatically above the chance baseline of approximately 0.0018%. Thus, similar attacks or defenses may report substantially

• •

• •

• • • •

•

• • • • •

• •

•

• • • • •

20 247 55 60 298 50 45 73 10 1000 500 183 24 4 44 0 38 2598 2049 34 36 445 432 56,082 100 11 45 94 322 322 322 7005 15 5 37 24 30 62 48 20 91 20 0 5 54 146 146 140 162 94

• • • • • • • • • • • • • • • • • • • •

•

• • • •

• •

• • • • •

• •

• • • • • •

• • •

• •

•

• •

•

• •

• • • • • • • • • • • • • • • • • • • • • • • • • • • • • •

• •

•

•

• • • • • • •

•

•

• •

• • • • • • •

•

•

•

• •

• • • • •

•

• •

( Artifact

1 1 2 3 1 0 3 1 3 3 1 1 1 2 1 0 1 1 2 5 1 1 1 3 1 1 8 2 0 1 1 1 2 0 4 2 0 3 0 1 0 2 0 1 1 2 2 3 2 7

Open Science

' User Study

• • • •

& Temporal Prec.

( Oblivious Adv.

$ Aggregate

& Stream

• • • • • •

• • • • • • • •

% Physical

# Behav., Intent & Pref.

" Cogn. & A#ect.

$ Demographics

• •

•

•

Utility Evaluation

% Spatial Prec.

•

•

•

Adversary Evaluation

* Task Utility

•

# Recognition

" Facial Motions

! Full Body Motions

• •

•

Study Scale

! Models Tested

• •

• •

• •

Privacy Tier

) Adaptive Adv.

• • •

" Hand Motions

Steil et al. [136] David-John et al. [27] Gordon et al. [39] Moore et al. [103] David-John et al. [29] Hu et al. [48] Moore et al. [102] David-John et al. [28] Meng et al. [90] Nair et al. [108] Nair et al. [110] Miller et al. [97] Wei et al. [152] Sun et al. [138] Wilson et al. [156] Warin et al. [148] Aziz et al. [6] Guthula et al. [115] Sun et al. [137] Kundu et al. [64] Ahmed et al. [1] Ibragimov et al. [51] Ren et al. [129] Nair et al. [113] Elfares et al. [32] Li et al. [71] Liu et al. [82] Kundu et al. [63] Hasan et al. [43] Raju et al. [128] Aziz et al. [7] Wilson et al. [155] David-John et al. [60] Liu et al. [81] Bozkir et al. [10] Wei et al. [153] Wei et al. [151] Wei et al. [150] Wei et al. [149] Wang et al. [147] Ozdel et al. [119] Romero et al. [131] Bozkir et al. [12] John et al. [59] John et al. [58] Carr et al. [17] Carr et al. [16] Moon et al. [101] Hanisch et al. [41] Kundu et al. [65]

! Head Motions

Defense Paper

D1 D2 D3 D4 D5 D6 D7 D8 D9 D10 D11 D12 D13 D14 D15 D16 D17 D18 D19 D20 D21 D22 D23 D24 D25 D26 D27 D28 D29 D30 D31 D32 D33 D34 D35 D36 D37 D38 D39 D40 D41 D42 D43 D44 D45 D46 D47 D48 D49 D50

! Eye Motions

ID

$ Health & Phys.

Privacy Risk

Defense Modality

□ Participants

Table 2: Systematization of 50 XR motion privacy defense papers. Each row reports the motion modalities (•) and privacy risks (•) protected by the proposed defense, together with its privacy type (•), participant population, adversary evaluation (•), utility evaluation (•), and public artifact availability (•).

•

• • •

• • • •

• • •

• •

• •

• • • •

• •

•

• • • •

di"erent accuracies simply because they are evaluated on di"erent candidate population sizes. This also creates a reproducibility challenge when large datasets are not publicly available. Even when the data-collection and evaluation procedures are fully described, other researchers may be unable to collect a comparably large population. They may reproduce the mechanism itself, but evaluating it on 9

Ibragimov et al.

a smaller population can produce di"erent identi!cation results. Rather than requiring a particular population size, we recommend reporting privacy performance across multiple candidate-set sizes. Lohr et al. [84], for example, use bootstrapping to estimate biometric performance as the number of candidate identities varies. A dataset of 300 participants could similarly be evaluated at 𝐿 = 50, 𝐿 = 100, 𝐿 = 150, and so forth, providing common evaluation points across datasets of di"erent sizes. However, Lohr et al. [84] are the only work in our corpus to explicitly evaluate performance as a function of candidate population size, revealing an important methodological gap in current XR motion privacy evaluations.

and stream-level defenses, however, directly a"ect the user’s interaction with the XR system [29, 60, 156]. Although task, spatial, and temporal utility provide valuable estimates of real-time performance, they cannot fully capture user comfort, perceived quality, or usability. Among the 30 physical and stream defense papers, only 10 include a user study. This represents an important gap in the literature, as many defenses intended for real-time deployment are evaluated without directly measuring how users experience them. (RQ10) What is the state of Open Science? Among the 50 defense papers, only 18 provide a publicly available artifact, such as datasets, privacy-mechanism implementations, or attack code. Open science is particularly challenging in XR motion privacy because motion traces often contain biometric information, making public dataset release inappropriate or impossible in some cases [54]. However, reproducibility does not depend solely on dataset availability. Even when datasets cannot be released, authors may still be able to share privacy-mechanism implementations, attack and evaluation code, model con!gurations or trained models that enable others to inspect, reproduce, and extend the proposed methods. The limited availability of such artifacts makes it di#cult to reproduce published results, compare defenses under common evaluation settings, and build upon prior work. Thus, while privacy concerns may justify withholding sensitive datasets, the low overall rate of artifact release remains an important reproducibility gap.

(RQ8) How do adversary assumptions impact the comparison and reproduction of defense evaluations? Adversary assumptions signi!cantly impact reported defense performance. In our coding, we distinguish between two evaluation settings: oblivious and adaptive adversaries. An oblivious adversary is unaware that a modality has been privatized and has no knowledge of how the privacy mechanism operates. In contrast, an adaptive adversary knows which modality is protected and understands how the mechanism works. Such an adversary may train attack models directly on privatized data, attempt to denoise protected motion, or ignore protected modalities and exploit unprotected ones instead [51, 108, 156]. Prior work reports substantially di"erent performance under adaptive and oblivious adversaries, with adaptive adversaries consistently achieving higher attack success [108, 155]. Across the defense corpus, 26 papers evaluate only oblivious adversaries, 11 evaluate only adaptive adversaries, and only 5 report results for both adversary types. This creates an important challenge for comparing defense evaluations. A defense evaluated only against an oblivious adversary cannot be directly compared with one evaluated only against an adaptive adversary, since the reported privacy performance corresponds to di"erent threat assumptions. Likewise, reproducing a published evaluation requires reproducing not only the privacy mechanism but also the adversary model under which it was evaluated. The limited use of paired oblivious and adaptive evaluations therefore represents an important gap in the XR motion privacy literature. Since the two adversaries can yield substantially di"erent privacy outcomes, the absence of either evaluation setting makes it di#cult to compare reported privacy performance across studies that adopt di"erent adversary assumptions.

(RQ11) What are the current research gaps in the attack and defense literature? Across the preceding research questions, we identify the following research gaps: (G1) Limited research on facial and full-body motion in both the attack and defense literature (RQ1, RQ5). (G2) Limited research on privacy risks beyond recognition, particularly demographics, health & physiology, cognitive & a"ective states, and behavior, intent & preference (RQ2, RQ5). (G3) Limited evaluations that jointly consider multiple motion modalities and multiple privacy risks (RQ3, RQ4, RQ5). (G4) Limited research on physical privacy defenses compared with stream-level and aggregate-level defenses (RQ6). (G5) Limited evaluations of defense performance across di"erent candidate population sizes (RQ7). (G6) Limited evaluations that report results under both oblivious and adaptive adversaries (RQ8). (G7) Limited use of user studies for physical and stream defenses that may directly a"ect users during interaction (RQ9). (G8) Limited availability of publicly released research artifacts to support reproducibility, comparison, and future extensions (RQ10).

(RQ9) Do utility evaluations match the defense’s deployment setting? We distinguish four types of utility evaluation: task utility (whether privatized motion remains useful for a speci!c task, such as preserving game scores or area-of-interest accuracy), spatial utility (how far privatized motion deviates from the original motion), temporal utility (processing delay or latency), and user studies (how users experience the mechanism during actual interaction). Task, spatial, and temporal utility can all be measured without requiring users to experience the defense (e.g., by applying the mechanism to recorded motion and computing the corresponding metrics afterward). In contrast, user studies require participants to interact with the defense directly. The appropriate utility evaluation depends on the defense’s deployment setting. For aggregate-level privacy, task, spatial, and temporal utility are often su#cient because the privatized motion is not experienced by users in real time [27]. Physical

Overall, these 8 gaps show that XR motion privacy research has made substantial progress, but important challenges remain in expanding modality and privacy-risk coverage, improving evaluation consistency, and supporting reproducibility.

8

Guidelines for XR Motion Privacy Research

Based on the research gaps identi!ed throughout this SoK, we provide several guidelines for designing and evaluating future XR 10

the intended privacy analyses. This can similarly support research beyond the currently dominant privacy risks and enable evaluations across multiple risks (G2, G3). We recognize that collecting additional sensitive information may complicate the IRB process; however, when appropriate and ethically justi!ed, these labels can substantially increase the value and reusability of the collected dataset. (2) Using an existing public dataset. This approach is generally most suitable for aggregate-level defenses, since these mechanisms operate on motion data that has already been recorded (§4) and therefore often do not require a new data-collection e"ort. When selecting a public dataset, researchers should consider the available motion modalities, the labels needed for the intended privacy risks, and the number of participants. These considerations directly re$ect the gaps identi!ed in modality and privacy-risk coverage, multimodal and multi-risk evaluation (G1, G2, G3). The selected dataset should therefore provide su#cient coverage to support the goals of the intended evaluation. Utility Evaluation. Utility evaluation also depends on the privacy type being studied. Our recommendations can be summarized into two main approaches: (a) evaluating physical and stream defenses, and (b) evaluating aggregate defenses. (1) Physical and stream defenses. Since these mechanisms operate during user interaction (§4), user studies can provide substantial value by capturing how users directly experience the privacy mechanism. Given the limited use of user studies for these defense types (G7), we therefore encourage researchers to include user studies whenever practical. For examples of study designs and questions, researchers can refer to the works in Table 2 that include user evaluations. We also recommend reporting real-time utility proxies, such as spatial and temporal precision. These measures can complement user studies and help explain why users perceive or accept a privacy mechanism in a particular way. If the privacy mechanism is designed for a speci!c application, task utility can provide an additional useful measure. For example, a mechanism designed for Beat Saber could evaluate whether in-game scores are preserved, while a mechanism designed for foveated rendering could evaluate whether area-of-interest (AOI) accuracy is maintained. (2) Aggregate defenses. Since these mechanisms do not operate during live interaction, user studies and real-time utility proxies are generally less relevant. Instead, task utility becomes particularly important for determining whether the privatized motion remains useful for its intended purpose. Examples include preserving in-game scores, AOI accuracy, or other application-speci!c outputs that the privacy mechanism is intended to maintain.

Figure 5: Guidelines for XR privacy research. Blue circles denote guideline categories and white rectangles individual guidelines. Icons at the top of each guideline indicate the applicable defense types: physical, stream, and aggregate privacy. For example, indicates a guideline applicable to physical or stream privacy defenses. motion privacy research. Figure 5 summarizes these guidelines, which we describe in greater detail below. Data Collection. Data-collection requirements depend on the privacy type being studied. Our recommendations can be summarized into two main approaches: (a) collecting a dedicated dataset, and (b) using an existing public dataset. (1) Collecting a new dataset. This approach is generally most suitable for physical and stream defenses. Since these mechanisms operate during user interaction (§4), collecting a dedicated dataset can often be naturally integrated into the user studies discussed next. When collecting a new dataset, we recommend recording all motion modalities available on the XR device. Even when a study focuses on a single modality, collecting additional modalities can support future multimodal privacy research without requiring another data-collection e"ort. This can help address the limited coverage of certain motion modalities and multimodal evaluations (G1, G3). Researchers should also consider collecting labels relevant to multiple privacy risks, such as gender, age, stress level, health status, and other information relevant to

Adversary Evaluations. At this point, the recommendations for all three privacy types converge. Our recommendations can be summarized into two main points: (a) evaluating against both oblivious and adaptive adversaries, and (b) considering the size of the candidate population. 11

Ibragimov et al.

(1) Oblivious/adaptive adversaries. Given the limited number of studies that report results under both adversary types (G6), we recommend evaluating against both oblivious and adaptive adversaries whenever possible. For example, in multimodal attacks, this could involve using a single motion modality to represent an oblivious adversary and multiple motion modalities to represent an adaptive adversary [6]. For other types of attacks, studies could consider two conditions: (a) privatizing the test set but not the training set, representing an oblivious adversary, and (b) privatizing both the training and test sets, representing an adaptive adversary [108]. (2) Candidate population size considerations. Given the limited evaluation of defense performance across di"erent candidate population sizes (G5), whenever possible, studies should report privacy results across multiple candidate population sizes. For example, a study with 300 participants could evaluate its defense at 𝐿 = 5, 𝐿 = 10, 𝐿 = 20, 𝐿 = 50, 𝐿 = 100, 𝐿 = 150, 𝐿 = 200, and 𝐿 = 300, or at any other set of population sizes that demonstrates how the defense generalizes as the number of candidate participants varies.

reported privacy gains hold across evaluation conditions and improve the comparability and reproducibility of XR motion privacy research. (FW2) Broader Multimodal and Multi-Risk Evaluations. As highlighted throughout this SoK, the !eld would bene!t from evaluations that combine three properties that are currently rarely studied together: (a) large participant populations (G5), (b) all !ve motion modalities considered in this work (G1), and (c) labels supporting multiple privacy risks (G2). Such evaluations would make it possible to study how privacy attacks generalize across modalities and inference targets, while also providing a stronger basis for evaluating defenses under realistic multimodal exposure. (FW3) Physical Defenses. Physical defenses deserve substantially more attention given their limited representation compared with stream-level and aggregate-level defenses (G4) because they are the only defense type that can protect motion before it reaches the XR device. This makes them particularly relevant to threat models in which the headset, operating system, or platform itself cannot be trusted. Future work should therefore explore a wider range of physical interventions and evaluate them across di"erent motion modalities (G1) and privacy risks (G2).

Open Science. Given the limited availability of publicly released research artifacts (G8), we encourage researchers to make datasets and code available whenever possible. Sharing implementation code could improve reproducibility and comparison by clarifying defense con!gurations, preprocessing, and evaluation procedures. Similarly, sharing datasets could reduce repeated data-collection e"orts and support future evaluations of additional privacy risks, motion modalities, and defenses on the same participant data. When public dataset release is not feasible due to privacy, consent, licensing, or other ethical constraints, controlled-access models may provide an alternative. For example, researchers could grant access through data-use requests, institutional or IRB approval when necessary, and speci!ed data-use and security conditions. When appropriate, such models could provide many of the bene!ts of open science while o"ering additional safeguards for sensitive participant data.

9

10

Conclusion

This SoK presented a motion-centered systematization of XR privacy research, covering 134 publications on the privacy risks and defenses associated with motion data. We developed an XR motion threat model (§4) and taxonomy (§5) that characterize how motion is exposed to adversaries, the modalities and representations involved, the privacy risks that can be inferred, and where defenses can intervene. Our analysis shows that XR motion privacy has developed into a broad research area, but important gaps remain (§6, §7). These gaps include limited research on facial and full-body motion and privacy risks beyond recognition; limited evaluations across multiple modalities and risks; limited research on physical privacy defenses; limited evaluations across candidate population sizes and adversary assumptions; and limited use of user studies and publicly released research artifacts. Based on these gaps, we provide guidelines for data collection, utility and adversary evaluation, and open science (§8), and identify opportunities for future research (§9). Together, this systematization provides a common foundation for evaluating existing work and developing more comprehensive and reproducible XR motion privacy research.

Opportunities for Future Work

Our systematization shows that XR motion privacy spans a broad range of motion modalities, privacy risks, adversaries, and defense approaches, while identifying several areas that remain underexplored or insu#ciently evaluated. Based on these !ndings, we highlight several directions for future XR motion privacy research. (FW1) Reproduction Studies and Evaluation Frameworks. As highlighted throughout this SoK, studies often use di"erent adversary assumptions, utility evaluations, and study scales, making results di#cult to compare directly. Reproduction studies could evaluate existing privacy mechanisms under common settings, including both oblivious and adaptive adversaries (G6), multiple candidate population sizes (G5), and user studies (G7). Evaluation frameworks could support these e"orts by providing common attacks, defenses, datasets, adversary settings, and evaluation metrics, while improving artifact availability (G8). Similar frameworks exist in related biometric research [30, 34, 49], including OpenGait for gait recognition [34]. Together, these e"orts would help determine whether

Ethical Considerations This work is a systematization of prior literature. Because the work analyzes published papers, we did not seek new IRB review. We did not recruit participants, collect new human-subject data, deploy a system, or observe users in live XR environments. This review also did not include secondary analysis of existing datasets of human data. 12

Open Science

Identi!cation. In 2025 IEEE Conference Virtual Reality and 3D User Interfaces (VR). 217–227. doi:10.1109/VR59515.2025.00046 [7] Samantha Aziz and Oleg Komogortsev. 2025. Privacy Enhancement for Gaze Data Using a Noise-Infused Autoencoder. In 2025 IEEE International Joint Conference on Biometrics (IJCB). 1–10. doi:10.1109/IJCB65343.2025.11411516 [8] Arman Bhalla, Ivo Sluganovic, Klaudia Krawiecka, and Ivan Martinovic. 2021. MoveAR: Continuous Biometric Authentication for Augmented Reality Headsets. In Proceedings of the 7th ACM on Cyber-Physical System Security Workshop (Virtual Event, Hong Kong) (CPSS ’21). Association for Computing Machinery, New York, NY, USA, 41–52. https://dl.acm.org/doi/10.1145/3457339.3457983 [9] Efe Bozkir, David Geisler, and Enkelejda Kasneci. 2019. Person Independent, Privacy Preserving, and Real Time Assessment of Cognitive Load using Eye Tracking in a Virtual Reality Setup. In 2019 IEEE Conference on Virtual Reality and 3D User Interfaces (VR). 1834–1837. doi:10.1109/VR.2019.8797758 [10] Efe Bozkir, Onur Günlü, Wolfgang Fuhl, Rafael F Schaefer, and Enkelejda Kasneci. 2021. Di"erential privacy for eye tracking with temporal correlations. Plos one 16, 8 (2021), e0255979. doi:10.1371/journal.pone.0255979 [11] Efe Bozkir, Süleyman Özdel, Mengdi Wang, Brendan David-John, Hong Gao, Kevin Butler, Eakta Jain, and Enkelejda Kasneci. 2026. Eye-Tracked Virtual Reality: A Comprehensive Survey on Methods and Privacy Challenges. Proc. IEEE (2026). doi:10.1109/JPROC.2026.3653661 [12] Efe Bozkir, Ali Burak Ünal, Mete Akgün, Enkelejda Kasneci, and Nico Pfeifer. 2020. Privacy Preserving Gaze Estimation using Synthetic Images via a Randomized Encoding Based Framework. In ACM Symposium on Eye Tracking Research and Applications (Stuttgart, Germany) (ETRA ’20 Short Papers). Association for Computing Machinery, New York, NY, USA, Article 21, 5 pages. doi:10.1145/3379156.3391364 [13] Dwight B Brock, Kenneth G Manton, and Max A Woodbury. 1990. Demographic characteristics. National Institute on Aging, Bethesda, MD. 8–11 pages. [14] Gavin Buckingham. 2021. Hand tracking for immersive virtual reality: opportunities and challenges. Frontiers in Virtual Reality 2 (2021), 728461. doi:10.3389/frvir.2021.728461 [15] Kent Bye, Diane Hosfelt, Sam Chase, Matt Miesnieks, and Taylor Beck. 2019. The ethical and privacy implications of mixed reality. In ACM SIGGRAPH 2019 Panels (Los Angeles, California) (SIGGRAPH ’19). Association for Computing Machinery, New York, NY, USA, Article 4, 2 pages. doi:10.1145/3306212.3328138 [16] Thomas Carr, Depeng Xu, Shuhan Yuan, and Aidong Lu. 2025. Privacy-centric Deep Motion Retargeting for Anonymization of Skeleton-Based Motion Visualization. In Proceedings of the IEEE/CVF International Conference on Computer Vision. 13162–13170. doi:10.1109/ICCV51701.2025.01223 [17] Thomas Carr, Yaxin Zhao, Depeng Xu, and Aidong Lu. 2025. Explanationbased anonymization methods for motion privacy. In Paci!c-Asia Conference on Knowledge Discovery and Data Mining. Springer, 52–64. doi:10.1007/978-98196-8183-9_5 [18] Polona Caserman, Augusto Garcia-Agundez, Robert Konrad, Stefan Göbel, and Ralf Steinmetz. 2019. Real-time body tracking in virtual reality using a Vive tracker. Virtual Reality 23, 2 (2019), 155–168. doi:10.1007/s10055-018-0374-z [19] Derin Cayir, Abbas Acar, Riccardo Lazzeretti, Marco Angelini, Mauro Conti, and Selcuk Uluagac. 2023. Augmenting Security and Privacy in the Virtual Realm: An Analysis of Extended Reality Devices. IEEE Security & Privacy 22, 1 (2023), 10–23. doi:10.1109/MSEC.2023.3332004 [20] Jaekwang Cha, Jinhyuk Kim, and Shiho Kim. 2016. An IR-based facial expression tracking sensor for head-mounted displays. In 2016 IEEE SENSORS. IEEE, 1–3. doi:10.1109/ICSENS.2016.7808913 [21] Hanqing Chao, Yiwei He, Junping Zhang, and Jianfeng Feng. 2019. Gaitset: Regarding gait as a set for cross-view gait recognition. In Proceedings of the AAAI conference on arti!cial intelligence, Vol. 33. 8126–8133. doi:10.1609/aaai. v33i01.33018126 [22] Kuo-Yi Chen, Jeng-Dao Lee, and Ting-Jia Zhang. 2021. The Body Sensor Suit with Mixed Reality Interactive Games. In 2021 IEEE International Conference on Consumer Electronics-Taiwan (ICCE-TW). IEEE, 1–2. doi:10.1109/ICCE-TW52618. 2021.9603144 [23] Shiwei Cheng, Jiaqi Dong, and Yang Liu. 2025. Cross-Subject Cognitive Load Recognition in VR Using Multimodal Fusion with EEG and Eye-Tracking. In 2025 IEEE International Symposium on Mixed and Augmented Reality (ISMAR). 815–825. doi:10.1109/ISMAR67309.2025.00090 [24] Stephanie Hui-Wen Chuah. 2018. Why and who will adopt extended reality technology? Literature review, synthesis, and future research agenda. Literature Review, Synthesis, and Future Research Agenda (2018). doi:10.2139/ssrn.3300469 [25] Stephanie Hui-Wen Chuah. 2019. Wearable XR-technology: literature review, conceptual framework and future research directions. International journal of technology marketing 13, 3-4 (2019), 205–259. doi:10.1504/IJTMKT.2019.104586 [26] Arzu Çöltekin, Ian Lochhead, Marguerite Madden, Sidonie Christophe, Alexandre Devaux, Christopher Pettit, Oliver Lock, Shashwat Shukla, Luká% Herman, Zden&k Stacho’, et al. 2020. Extended reality in spatial sciences: A review of research challenges and future directions. ISPRS International Journal of Geo-Information 9, 7 (2020), 439. doi:10.3390/ijgi9070439

To support reproducibility, we provide the screened-paper list, exclusion decisions, !nal corpus, and coding sheet. The materials are available at the following anonymous repository: https:// anonymous.4open.science/r/SoK-Motion-Data-Privacy-in-ExtendedReality/ Additionally, recognizing the rapid growth of XR motion privacy research, we have established a webpage to support the continued systematization of future work. The webpage provides an interface through which researchers can submit newly published papers for consideration. Submitted papers are reviewed using the same inclusion criteria as this SoK and, if eligible, are added to the online corpus alongside the papers identi!ed in our review. This living corpus is intended to keep the systematization current as the !eld evolves, facilitate future extensions of this SoK, and increase the visibility of relevant work within the research community. Researchers can also subscribe to updates when new papers are added, providing a way to stay informed about newly identi!ed XR motion privacy research. The webpage link will be made publicly available upon acceptance of this paper.

AI Use The authors used generative AI-based tools to revise the manuscript text for clarity, $ow, grammar, spelling, and typographical errors. The use of these tools was limited to manuscript text and did not extend to the bibliography. All AI-assisted edits were manually reviewed and veri!ed by the authors. The authors take full responsibility for the accuracy, originality, and integrity of the !nal paper. Image-based generative AI was also used to create some visual elements in the teaser and taxonomy !gures, speci!cally the illustrated characters and their backgrounds. These elements were generated to avoid using photographs of real people, which could raise privacy concerns or compromise anonymous review if an image were linkable to the authors or other identi!able individuals. The generated elements are used only as illustrative visuals; all text, labels, structure, and substantive content in the !gure were created and veri!ed manually by the authors.

References

[1] Nasim Ahmed, Md Mahedi Hassan, Md Mush!que Hossain, Nazmus Shakib Shadin, Xinyue Zhang, and Rifatul Islam. 2026. Obscuring the ‘Who,’ Preserving the ‘What’: Targeted Eye-tracking Feature Obfuscation in Virtual Reality for Privacy-Utility Balance. In 2026 IEEE Conference on Virtual Reality and 3D User Interfaces (VR). 250–260. doi:10.1109/VR67842.2026.00047 [2] Na!sa Anjum and M Rasel Mahmud. 2025. Beyond the Headset: A Systematization of Knowledge on Extended Reality Privacy and Security in Healthcare. In Proceedings of the 2025 31st ACM Symposium on Virtual Reality Software and Technology. 1–12. doi:10.1145/3756884.3766045 [3] Apple Inc. 2024. Apple Vision Pro. https://www.apple.com/apple-vision-pro/ Accessed: 2026-07-21. [4] Hadi Ardiny and Esmaeel Khanmirza. 2018. The Role of AR and VR Technologies in Education Developments: Opportunities and Challenges. In 2018 6th RSI International Conference on Robotics and Mechatronics (IcRoM). IEEE, 482–487. doi:10.1109/ICRoM.2018.8657615 [5] Samantha Aziz and Oleg Komogortsev. 2023. Assessing the Privacy Risk of Cross-Platform Identity Linkage using Eye Movement Biometrics. In 2023 IEEE International Joint Conference on Biometrics (IJCB). 1–9. doi:10.1109/IJCB57857. 2023.10449083 [6] Samantha Aziz and Oleg Komogortsev. 2025. Exploring the Uncoordinated Privacy Protections of Eye Tracking and VR Motion Data for Unauthorized User 13

Ibragimov et al.

[27] Brendan David-John, Kevin Butler, and Eakta Jain. 2022. For Your Eyes Only: Privacy-preserving eye-tracking datasets. In 2022 Symposium on Eye Tracking Research and Applications (Seattle, WA, USA) (ETRA ’22). Association for Computing Machinery, New York, NY, USA, Article 10, 6 pages. doi:10.1145/3517031.3529618 [28] Brendan David-John, Kevin Butler, and Eakta Jain. 2023. Privacy-preserving datasets of eye-tracking samples with applications in XR. IEEE Transactions on Visualization and Computer Graphics 29, 5 (2023), 2774–2784. doi:10.1109/ TVCG.2023.3247048 [29] Brendan David-John, Diane Hosfelt, Kevin Butler, and Eakta Jain. 2021. A privacy-preserving approach to streaming eye-tracking data. IEEE Transactions on Visualization and Computer Graphics 27, 5 (2021), 2555–2565. doi:10.1109/ TVCG.2021.3067787 [30] Jiankang Deng, Jia Guo, Niannan Xue, and Stefanos Zafeiriou. 2019. Arcface: Additive angular margin loss for deep face recognition. In Proceedings of the IEEE/CVF conference on computer vision and pattern recognition. 4690–4699. [31] Owen Dossett, Ke Lyu, Maohong Liao, Han Li, and Xianglong Feng. 2025. An Exploration of User Biometric Identi!cation In XR Applications Based On User Head Movement. In 2025 IEEE International Workshop on Multimedia Signal Processing (MMSP). 224–229. doi:10.1109/MMSP64401.2025.11324223 [32] Mayar Elfares, Pascal Reisert, Ralf Küsters, and Andreas Bulling. 2026. Gaze3P: Gaze-Based Prediction of User-Perceived Privacy. Proceedings on Privacy Enhancing Technologies 1 (2026), 6–25. [33] Brandon Falk, Yan Meng, Yuxia Zhan, and Haojin Zhu. 2021. POSTER: ReAvatar: Virtual Reality De-anonymization Attack Through Correlating Movement Signatures. In Proceedings of the 2021 ACM SIGSAC Conference on Computer and Communications Security (Virtual Event, Republic of Korea) (CCS ’21). Association for Computing Machinery, New York, NY, USA, 2405–2407. doi:10.1145/3460120.3485345 [34] Chao Fan, Junhao Liang, Chuanfu Shen, Saihui Hou, Yongzhen Huang, and Shiqi Yu. 2023. Opengait: Revisiting gait recognition towards better practicality. In Proceedings of the IEEE/CVF conference on computer vision and pattern recognition. 9707–9716. doi:10.1109/CVPR52729.2023.00936 [35] Gonzalo Munilla Garrido, Vivek Nair, and Dawn Song. 2024. SoK: Data Privacy in Virtual Reality. Proceedings on Privacy Enhancing Technologies (2024). doi:10. 56553/popets-2024-0003 [36] Carlotta Genco, Alberto Altozano, Luigi Duraccio, Mariano Alcañiz, Mauro D’Arco, and Javier Marín-Morales. 2024. Preliminary Exploration of EyeTracking Technology to Classify Human Personality Traits During Conversations with Virtual Humans. In 2024 IEEE International Conference on Metrology for eXtended Reality, Arti!cial Intelligence and Neural Engineering (MetroXRAINE). 941–945. doi:10.1109/MetroXRAINE62247.2024.10796419 [37] Alberto Giaretta. 2024. Security and privacy in virtual reality: a literature survey. Virtual Reality 29, 1 (2024), 10. doi:10.1007/s10055-024-01079-9 [38] Google LLC. 2013. Google Glass. https://www.google.com/glass/ Accessed: 2026-07-21. [39] Jeremy Rabo" Gordon, Max T. Curran, John Chuang, and Coye Cheshire. 2021. Covert Embodied Choice: Decision-Making and the Limits of Privacy Under Biometric Surveillance. In Proceedings of the 2021 CHI Conference on Human Factors in Computing Systems (Yokohama, Japan) (CHI ’21). Association for Computing Machinery, New York, NY, USA, Article 551, 12 pages. doi:10.1145/ 3411764.3445309 [40] Paul Sansah Gyreyiri and Diksha Shukla. 2025. Head Movement Biometrics for Continuous Authentication in Virtual Reality. In Proceedings of the 2025 31st ACM Symposium on Virtual Reality Software and Technology (VRST ’25). Association for Computing Machinery, New York, NY, USA, Article 144, 3 pages. doi:10.1145/3756884.3768408 [41] Simon Hanisch, Julian Todt, and Thorsten Strufe. 2026. Pantomime: Motion Data Anonymization Using Foundation Motion Models. Proceedings on Privacy Enhancing Technologies 2026, 2 (2026), 384–396. doi:10.56553/popets-2026-0053 [42] Kamrul Hasan and Oleg V Komogortsev. 2026. Eye Feel You: A DenseNet-driven User State Prediction Approach. arXiv preprint arXiv:2601.21045 (2026). [43] Kamrul Hasan and Oleg V Komogortsev. 2026. Privatization of Synthetic Gaze: Attenuating State Signatures in Di"usion-Generated Eye Movements. arXiv preprint arXiv:2601.21057 (2026). [44] Salah Hassanin, Yun Fu, Jella Pfei"er, and Martin Meißner. 2025. Bene!ts and privacy in virtual reality commerce: a comprehensive review and data-driven assessment. Virtual Reality 29, 4 (2025), 173. [45] Zhixiang He, Fengyuan Ran, Jing Chen, Yangyang Gu, Kun He, Ruiying Du, Ju Jia, and Cong Wu. 2025. HT-Auth: Secure VR Headset Authentication via Subtle Head Tremors. Proc. ACM Interact. Mob. Wearable Ubiquitous Technol. 9, 3, Article 85 (Sept. 2025), 26 pages. doi:10.1145/3749980 [46] Chandra Hermawan Heruatmadja, Meyliana, Achmad Nizar Hidayanto, and Harjanto Prabowo. 2023. Biometric as Secure Authentication for Virtual Reality Environment: A Systematic Literature Review. In 2023 International Conference for Advancement in Technology (ICONAT). 1–7. doi:10.1109/ICONAT57137.2023. 10080713

[47] HTC Corporation. 2021. HTC Vive Pro 2. https://www.vive.com/us/product/ vive-pro2/overview/ Accessed: 2026-07-21. [48] Miao Hu, Zhenxiao Luo, Yipeng Zhou, Xuezheng Liu, and Di Wu. 2022. Otus: A Gaze Model-based Privacy Control Framework for Eye Tracking Applications. In IEEE INFOCOM 2022 - IEEE Conference on Computer Communications. 560–569. doi:10.1109/INFOCOM48880.2022.9796665 [49] Azim Ibragimov and Mauricio Pamplona Segundo. 2025. Fingerprint pore detection: A survey. IEEE Transactions on Biometrics, Behavior, and Identity Science 7, 4 (2025), 848–861. doi:10.1109/TBIOM.2025.3560655 [50] Azim Ibragimov, Mauricio Pamplona Segundo, Sudeep Sarkar, and Kevin Bowyer. 2024. Unveiling Gender E"ects in Gait Recognition Using ConditionalMatched Bootstrap Analysis. In 2024 IEEE 18th International Conference on Automatic Face and Gesture Recognition (FG). 1–10. doi:10.1109/FG59268.2024. 10582036 [51] Azim Ibragimov, Ethan Wilson, Kevin R. B. Butler, and Eakta Jain. 2026. Toward Multimodal Privacy in XR: Design and Evaluation of Composite Privatization Methods for Gaze and Body Tracking Data. IEEE Transactions on Visualization and Computer Graphics (2026), 1–12. doi:10.1109/TVCG.2026.3679093 [52] Anil K Jain, Patrick Flynn, and Arun A Ross. 2007. Handbook of biometrics. Springer Science & Business Media. [53] Yeonju Jang, Jose A. Guridi, Daniel Molitor, Rachel Kwon, and Sneha Nagarajan. 2023. Are You Anonymous? Inferring Personal Information from Nonverbal Behavior Data Tracked in Immersive Virtual Reality. In Companion Publication of the 2023 Conference on Computer Supported Cooperative Work and Social Computing (Minneapolis, MN, USA) (CSCW ’23 Companion). Association for Computing Machinery, New York, NY, USA, 172–176. doi:10.1145/3584931. 3607004 [54] Ismat Jarin, Yu Duan, Rahmadi Trimananda, Hao Cui, Salma Elmalaki, and Athina Markopoulou. 2023. Behavr: User identi!cation based on vr sensor data. arXiv preprint arXiv:2308.07304 (2023). [55] Woojin Jeon, Chaejin Lim, and Hyoungshick Kim. 2025. Exploring Natural Interactions for Implicit User Authentication in VR. In Proceedings of the Extended Abstracts of the CHI Conference on Human Factors in Computing Systems (CHI EA ’25). Association for Computing Machinery, New York, NY, USA, Article 248, 7 pages. doi:10.1145/3706599.3719770 [56] Woojin Jeon, Chaejin Lim, and Hyoungshick Kim. 2025. When (Inter)actions Speak Louder Than (Pass)words: Task-Based Evaluation of Implicit Authentication in Virtual Reality. In 2025 28th International Symposium on Research in Attacks, Intrusions and Defenses (RAID). 284–297. doi:10.1109/RAID67961.2025. 00069 [57] Aochen Jiao, Di Duan, and Weitao Xu. 2024. Medusa3D: The Watchful Eye Freezing Illegitimate Users in Virtual Reality Interactions. Proc. ACM Hum.Comput. Interact. 8, MHCI, Article 270 (Sept. 2024), 21 pages. doi:10.1145/3676515 [58] Brendan John, Sophie Jörg, Sanjeev Koppal, and Eakta Jain. 2020. The SecurityUtility Trade-o" for Iris Authentication and Eye Animation for Social Virtual Avatars. IEEE Transactions on Visualization and Computer Graphics 26, 5 (2020), 1880–1890. doi:10.1109/TVCG.2020.2973052 [59] Brendan John, Sanjeev Koppal, and Eakta Jain. 2019. EyeVEIL: degrading iris authentication in eye tracking headsets. In Proceedings of the 11th ACM Symposium on Eye Tracking Research & Applications (Denver, Colorado) (ETRA ’19). Association for Computing Machinery, New York, NY, USA, Article 37, 5 pages. doi:10.1145/3314111.3319816 [60] Brendan John, Ao Liu, Lirong Xia, Sanjeev Koppal, and Eakta Jain. 2020. Let It Snow: Adding pixel noise to protect the user’s identity. In ACM Symposium on Eye Tracking Research and Applications (Stuttgart, Germany) (ETRA ’20 Adjunct). Association for Computing Machinery, New York, NY, USA, Article 43, 3 pages. doi:10.1145/3379157.3390512 [61] Hyejin Kim, Sukwon Lee, and Changgu Kang. 2025. From controllers to multimodal input: A chronological review of XR interaction across device generations. Sensors 26, 1 (2025), 196. doi:10.3390/s26010196 [62] CA Kirkwood, BJ Andrews, and P Mowforth. 1989. Automatic detection of gait events: a case study using inductive learning techniques. Journal of biomedical engineering 11, 6 (1989), 511–516. doi:10.1016/0141-5425(89)90046-0 [63] Ripan Kumar Kundu, Istiak Ahmed, and Khaza Anuarul Hoque. 2025. PrivateXR: Defending Privacy Attacks in Extended Reality Through Explainable AI-Guided Di"erential Privacy. In 2025 IEEE International Symposium on Mixed and Augmented Reality (ISMAR). 507–517. doi:10.1109/ISMAR67309.2025.00061 [64] Ripan Kumar Kundu, Brendan David-John, and Khaza Anuarul Hoque. 2026. CHOP: Breaking Anonymity in XR through a Novel and Cost-e"ective Chain of Privacy Attacks and Di"erential Privacy-Based Defenses. In 2026 IEEE Conference on Virtual Reality and 3D User Interfaces (VR). 626–636. doi:10.1109/ VR67842.2026.00082 [65] Ripan Kumar Kundu and Khaza Anuarul Hoque. 2025. SecretVR: Di"erential Privacy Defense Against Membership Inference Privacy Attacks in Virtual Reality. In 2025 IEEE Conference on Virtual Reality and 3D User Interfaces Abstracts and Workshops (VRW). IEEE, 1266–1267. doi:10.1109/VRW66409.2025.00279 [66] Karina LaRubbio, Jeremiah Wright, Brendan David-John, Andreas Enqvist, and Eakta Jain. 2022. Who do you look like? - Gaze-based authentication for workers 14

in VR. In 2022 IEEE Conference on Virtual Reality and 3D User Interfaces Abstracts and Workshops (VRW). 744–745. doi:10.1109/VRW55335.2022.00223 [67] Steven M LaValle, Anna Yershova, Max Katsev, and Michael Antonov. 2014. Head tracking for the Oculus Rift. In 2014 IEEE international conference on robotics and automation (ICRA). IEEE, 187–194. doi:10.1109/ICRA.2014.6906608 [68] Lily Lee and W Eric L Grimson. 2002. Gait Analysis for Recognition and Classi!cation. In Proceedings of Fifth IEEE International Conference on Automatic Face Gesture Recognition. IEEE, 155–162. doi:10.1109/AFGR.2002.1004148 [69] Miran Lee, Joo-Ho Lee, and Deok-Hwan Kim. 2022. Gender recognition using optimal gait feature based on recursive feature elimination in normal walking. Expert Systems with Applications 189 (2022), 116040. doi:10.1016/j.eswa.2021. 116040 [70] Ajey Lele. 2013. Virtual reality and its military utility. Journal of Ambient Intelligence and Humanized Computing 4, 1 (2013), 17–26. doi:10.1007/s12652011-0052-4 [71] Jingjie Li, Amrita Roy Chowdhury, Kassem Fawaz, and Younghyun Kim. 2021. Kal𝐿 ido: Real-Time privacy control for Eye-Tracking systems. In 30th USENIX security symposium (USENIX security 21). 1793–1810. [72] Xuelong Li, Stephen J Maybank, Shuicheng Yan, Dacheng Tao, and Dong Xu. 2008. Gait components and their application to gender recognition. IEEE Transactions on Systems, Man, and Cybernetics, Part C (Applications and Reviews) 38, 2 (2008), 145–155. doi:10.1109/TSMCC.2007.913886 [73] Jonathan Liebers, Mark Abdelaziz, Lukas Mecke, Alia Saad, Jonas Auda, Uwe Gruenefeld, Florian Alt, and Stefan Schneegass. 2021. Understanding User Identi!cation in Virtual Reality Through Behavioral Biometrics and the E"ect of Body Normalization. In Proceedings of the 2021 CHI Conference on Human Factors in Computing Systems (Yokohama, Japan) (CHI ’21). Association for Computing Machinery, New York, NY, USA, Article 517, 11 pages. doi:10.1145/ 3411764.3445528 [74] Jonathan Liebers, Felix Bernardi, Alia Saad, Lukas Mecke, Uwe Gruenefeld, Florian Alt, and Stefan Schneegass. 2025. Predicting Personality Traits from Hand-Tracking and Typing Behavior in Extended Reality under the Presence and Absence of Haptic Feedback. In Proceedings of the Extended Abstracts of the CHI Conference on Human Factors in Computing Systems (CHI EA ’25). Association for Computing Machinery, New York, NY, USA, Article 442, 8 pages. doi:10. 1145/3706599.3720270 [75] Jonathan Liebers, Christian Burschik, Uwe Gruenefeld, and Stefan Schneegass. 2023. Exploring the Stability of Behavioral Biometrics in Virtual Reality in a Remote Field Study: Towards Implicit and Continuous User Identi!cation through Body Movements. In Proceedings of the 29th ACM Symposium on Virtual Reality Software and Technology (Christchurch, New Zealand) (VRST ’23). Association for Computing Machinery, New York, NY, USA, Article 30, 12 pages. doi:10.1145/3611659.3615696 [76] Jonathan Liebers, Patrick Horn, Christian Burschik, Uwe Gruenefeld, and Stefan Schneegass. 2021. Using Gaze Behavior and Head Orientation for Implicit Identi!cation in Virtual Reality. In Proceedings of the 27th ACM Symposium on Virtual Reality Software and Technology (Osaka, Japan) (VRST ’21). Association for Computing Machinery, New York, NY, USA, Article 22, 9 pages. doi:10.1145/ 3489849.3489880 [77] Jonathan Liebers, Patrick Laskowski, Florian Rademaker, Leon Sabel, Jordan Hoppen, Uwe Gruenefeld, and Stefan Schneegass. 2024. Kinetic Signatures: A Systematic Investigation of Movement-Based User Identi!cation in Virtual Reality. In Proceedings of the 2024 CHI Conference on Human Factors in Computing Systems (Honolulu, HI, USA) (CHI ’24). Association for Computing Machinery, New York, NY, USA, Article 783, 19 pages. doi:10.1145/3613904.3642471 [78] Jonathan Liebers and Stefan Schneegass. 2020. Gaze-based Authentication in Virtual Reality. In ACM Symposium on Eye Tracking Research and Applications (Stuttgart, Germany) (ETRA ’20 Adjunct). Association for Computing Machinery, New York, NY, USA, Article 41, 2 pages. doi:10.1145/3379157.3391421 [79] Beibei Lin, Shunli Zhang, Ming Wang, Lincheng Li, and Xin Yu. 2022. GaitGL: Learning discriminative global-local feature representations for gait recognition. arXiv preprint arXiv:2208.01380 (2022). [80] James Little, Je"rey Boyd, et al. 1998. Recognizing people by their gait: the shape of motion. Videre: Journal of computer vision research 1, 2 (1998), 1–32. [81] Ao Liu, Lirong Xia, Andrew Duchowski, Reynold Bailey, Kenneth Holmqvist, and Eakta Jain. 2019. Di"erential privacy for eye-tracking data. In Proceedings of the 11th ACM Symposium on Eye Tracking Research & Applications (Denver, Colorado) (ETRA ’19). Association for Computing Machinery, New York, NY, USA, Article 28, 10 pages. doi:10.1145/3314111.3319823 [82] Jingwei Liu, Lai Wei, Yan Hu, Guangrong Zhao, Qing Yang, Guangdong Bai, and Yiran Shen. 2025. p-Blend: Privacy- and Utility-Preserving Blendshape Perturbation Against Re-Identi!cation Attacks in Virtual Reality. IEEE Transactions on Visualization and Computer Graphics 31, 11 (2025), 9592–9602. doi:10.1109/TVCG.2025.3616736 [83] Dillon Lohr and Oleg V Komogortsev. 2022. Eye Know You Too: Toward Viable End-to-End Eye Movement Biometrics for User Authentication. IEEE Transactions on Information Forensics and Security 17 (2022), 3151–3164. doi:10. 1109/TIFS.2022.3201369

[84] Dillon Lohr, Michael J. Proulx, and Oleg Komogortsev. 2024. Establishing a Baseline for Gaze-driven Authentication Performance in VR: A Breadth-First Investigation on a Very Large Dataset. In 2024 IEEE International Joint Conference on Biometrics (IJCB). 1–10. doi:10.1109/IJCB62174.2024.10744483 [85] Dillon J Lohr, Saide Johnson, Samantha Aziz, and Oleg Komogortsev. 2023. Demonstrating Eye Movement Biometrics in Virtual Reality. In Proceedings of the 2023 Symposium on Eye Tracking Research and Applications (Tubingen, Germany) (ETRA ’23). Association for Computing Machinery, New York, NY, USA, Article 37, 2 pages. doi:10.1145/3588015.3590109 [86] Jiwen Lu, Gang Wang, and Pierre Moulin. 2013. Human Identity and Gender Recognition From Gait Sequences With Arbitrary Walking Directions. IEEE Transactions on information Forensics and Security 9, 1 (2013), 51–61. doi:10. 1109/TIFS.2013.2291969 [87] Zijun Mai, Yidang He, Jiana Feng, Huawei Tu, Jian Weng, and BoYu Gao. 2023. Behavioral Authentication with Head-Tilt Based Locomotion for Metaverse. In 2023 IEEE Conference on Virtual Reality and 3D User Interfaces Abstracts and Workshops (VRW). 949–950. doi:10.1109/VRW58643.2023.00317 [88] J Michael McGinnis, Elizabeth Malphrus, and David Blumenthal. 2015. Vital signs: core metrics for health and health care progress. (2015). [89] James E Melzer and Kirk Mo#tt. 1997. Head-mounted displays. Avionics: Elements, Software and Functions. [90] Yan Meng, Yuxia Zhan, Jiachun Li, Suguo Du, Haojin Zhu, and Xuemin Shen. 2024. De-Anonymizing Avatars in Virtual Reality: Attacks and Countermeasures. IEEE Transactions on Mobile Computing 23, 12 (2024), 13342–13357. doi:10.1109/ TMC.2024.3426046 [91] Yan Meng, Yuxia Zhan, Jiachun Li, Suguo Du, Haojin Zhu, and Xuemin Sherman Shen. 2023. De-anonymization Attacks on Metaverse. In IEEE INFOCOM 2023 - IEEE Conference on Computer Communications. 1–10. doi:10.1109/ INFOCOM53939.2023.10229062 [92] Meta Platforms, Inc. 2020. Meta Quest 2. https://www.meta.com/quest/ products/quest-2 Accessed: 2026-07-21. [93] Meta Platforms, Inc. 2022. Meta Quest Pro. https://www.meta.com/quest/questpro/ Accessed: 2026-07-21. [94] Meta Platforms, Inc. 2023. Ray-Ban Meta Smart Glasses. https://www.meta. com/smart-glasses/ Accessed: 2026-07-21. [95] Ines Miguel-Alonso, Juan J Rodríguez, Ana Serrano-Mamolar, and Andres Bustillo. 2025. Identifying users of immersive virtual-reality serious games through machine-learning techniques. Virtual Reality 29, 4 (2025), 164. [96] Mark Roman Miller. 2024. Multiclass AUC for Comparison of Identi!cation E"ectiveness Across Classi!cation Set Sizes. In 2024 IEEE 25th International Symposium on a World of Wireless, Mobile and Multimedia Networks (WoWMoM). 97–98. doi:10.1109/WoWMoM60985.2024.00028 [97] Mark Roman Miller, Vivek Nair, Eugy Han, Cyan DeVeaux, Christian Rack, Rui Wang, Brandon Huang, Marc Erich Latoschik, James F. O’Brien, and Jeremy N. Bailenson. 2024. E"ect of Duration and Delay on the Identi!ability of VR Motion. In 2024 IEEE 25th International Symposium on a World of Wireless, Mobile and Multimedia Networks (WoWMoM). 70–75. doi:10.1109/WoWMoM60985.2024. 00023 [98] Robert Miller, Natasha Kholgade Banerjee, and Sean Banerjee. 2022. Temporal E"ects in Motion Behavior for Virtual Reality (VR) Biometrics. In 2022 IEEE Conference on Virtual Reality and 3D User Interfaces (VR). 563–572. doi:10.1109/ VR51125.2022.00076 [99] Lynette I Millett and Joseph N Pato. 2010. Biometric recognition: Challenges and opportunities. National Academies Press. [100] Joann M Montepare, Sabra B Goldstein, and Annmarie Clausen. 1987. The identi!cation of emotions from gait information. Journal of Nonverbal Behavior 11, 1 (1987), 33–42. doi:10.1007/BF00999605 [101] Saemi Moon, Myeonghyeon Kim, Zhenyue Qin, Yang Liu, and Dongwoo Kim. 2023. Anonymization for skeleton action recognition. In Proceedings of the AAAI Conference on Arti!cial Intelligence, Vol. 37. 15028–15036. doi:10.1609/ aaai.v37i12.26754 [102] Alec G. Moore, Ti"any D. Do, Nicholas Ruozzi, and Ryan P. McMahan. 2023. Identifying Virtual Reality Users Across Domain-Speci!c Tasks: A Systematic Investigation of Tracked Features for Assembly. In 2023 IEEE International Symposium on Mixed and Augmented Reality (ISMAR). 396–404. doi:10.1109/ ISMAR59233.2023.00054 [103] Alec G. Moore, Ryan P. McMahan, Hailiang Dong, and Nicholas Ruozzi. 2021. Personal Identi!ability and Obfuscation of User Tracking Data From VR Training Sessions. In 2021 IEEE International Symposium on Mixed and Augmented Reality (ISMAR). 221–228. doi:10.1109/ISMAR52148.2021.00037 [104] John E Munoz, Faraz Ali, Aysha Basharat, Samira Mehrabi, Michael BarnettCowan, Shi Cao, Laura E Middleton, and Jennifer Boger. 2025. Development of Classi!ers to Determine Factors Associated With Older Adult’s Cognitive Functions and Game User Experience in VR Using Head Kinematics. IEEE Transactions on Games 17, 3 (2025), 604–612. doi:10.1109/TG.2023.3317825 [105] Tahrima Mustafa, Richard Matovu, Abdul Serwadda, and Nicholas Muirhead. 2018. Unsure How to Authenticate on Your VR Headset? Come on, Use Your Head! Association for Computing Machinery, New York, NY, USA. doi:10.1145/ 15

Ibragimov et al.

3180445.3180450 [106] Vivek Nair, Gonzalo M Garrido, Dawn Song, and James F O’Brien. 2023. Exploring the Privacy Risks of Adversarial VR Game Design. Proceedings on Privacy Enhancing Technologies 4 (2023), 238–256. [107] Vivek Nair, Wenbo Guo, Justus Mattern, Rui Wang, James F O’Brien, Louis Rosenberg, and Dawn Song. 2023. Unique identi!cation of 50,000+ virtual reality users from head & hand motion data. In 32nd USENIX Security Symposium (USENIX Security 23). 895–910. [108] Vivek Nair, Wenbo Guo, James F. O’Brien, Louis Rosenberg, and Dawn Song. 2024. Deep Motion Masking for Secure, Usable, and Scalable Real-Time Anonymization of Ecological Virtual Reality Motion Data. In 2024 IEEE Conference on Virtual Reality and 3D User Interfaces Abstracts and Workshops (VRW). 493–500. doi:10.1109/VRW62533.2024.00096 [109] Vivek Nair, Wenbo Guo, Rui Wang, James F O’Brien, Louis Rosenberg, and Dawn Song. 2024. Berkeley Open Extended Reality Recordings 2023 (BOXRR23): 4.7 Million Motion Capture Recordings from 105,000 XR Users. IEEE Transactions on Visualization and Computer Graphics 30, 5 (2024), 2239–2246. doi:10.1109/TVCG.2024.3372087 [110] Vivek Nair, Mark Roman Miller, Rui Wang, Brandon Huang, Christian Rack, Marc Erich Latoschik, and James F. O’Brien. 2024. E"ect of Data Degradation on Motion Re-Identi!cation. In 2024 IEEE 25th International Symposium on a World of Wireless, Mobile and Multimedia Networks (WoWMoM). 85–90. doi:10. 1109/WoWMoM60985.2024.00026 [111] Vivek Nair, Christian Rack, Wenbo Guo, Rui Wang, Shuixian Li, Brandon Huang, Atticus Cull, James F. O’Brien, Marc Latoschik, Louis Rosenberg, and Dawn Song. 2024. Inferring Private Personal Attributes of Virtual Reality Users from Ecologically Valid Head and Hand Motion Data. In 2024 IEEE Conference on Virtual Reality and 3D User Interfaces Abstracts and Workshops (VRW). 477–484. doi:10.1109/VRW62533.2024.00094 [112] Vivek Nair, Louis Rosenberg, James F O’Brien, and Dawn Song. 2023. Truth in motion: The unprecedented risks and opportunities of extended reality motion data. IEEE Security & Privacy 22, 1 (2023), 24–32. doi:10.1109/MSEC.2023.3330392 [113] Vivek C Nair, Gonzalo Munilla-Garrido, and Dawn Song. 2023. Going Incognito in the Metaverse: Achieving Theoretically Optimal Privacy-Usability Tradeo"s in VR. In Proceedings of the 36th Annual ACM Symposium on User Interface Software and Technology (San Francisco, CA, USA) (UIST ’23). Association for Computing Machinery, New York, NY, USA, Article 61, 16 pages. doi:10.1145/ 3586183.3606754 [114] San Kuen Ng and H.J. Chizeck. 1997. Fuzzy model identi!cation for classi!cation of gait events in paraplegics. IEEE Transactions on Fuzzy Systems 5, 4 (1997), 536–544. doi:10.1109/91.649904 [115] Jayasri Sai Nikitha Guthula, Hadi Rashid, Jan P. Springer, and Aryabrata Basu. 2025. Preserving Privacy in VR Telemetry Data. In 2025 IEEE Conference on Virtual Reality and 3D User Interfaces Abstracts and Workshops (VRW). 1270–1271. doi:10.1109/VRW66409.2025.00281 [116] Mark S Nixon, John N Carter, Jason M Nash, Ping S Huang, David Cunado, and Sarah V Stevenage. 1999. Automatic gait recognition. In IEE Colloquium on Motion Analysis and Tracking. IET, 3–1. doi:10.1049/ic:19990573 [117] Aline Normoyle and Sophie Jörg. 2025. User identi!cation based on conversational gestures. In 2025 IEEE Conference on Virtual Reality and 3D User Interfaces Abstracts and Workshops (VRW). 291–294. doi:10.1109/VRW66409.2025.00068 [118] Jason Orlosky, Brandon Huynh, and Tobias Hollerer. 2019. Using Eye Tracked Virtual Reality to Classify Understanding of Vocabulary in Recall Tasks. In 2019 IEEE International Conference on Arti!cial Intelligence and Virtual Reality (AIVR). 66–667. doi:10.1109/AIVR46125.2019.00019 [119] Süleyman Özdel, Efe Bozkir, and Enkelejda Kasneci. 2024. Privacy-preserving Scanpath Comparison for Pervasive Eye Tracking. Proc. ACM Hum.-Comput. Interact. 8, ETRA, Article 231 (May 2024), 28 pages. doi:10.1145/3655605 [120] Federica Pallavicini, Alessandro Pepe, and Maria Eleonora Minissi. 2019. Gaming in Virtual Reality: What Changes in Terms of Usability, Emotional Response and Sense of Presence Compared to Non-Immersive Video Games? Simulation & Gaming 50, 2 (2019), 136–159. doi:10.1177/1046878119831420 [121] Chuyang Peng, Mutahar Ali, and Habiba Farrukh. 2025. Poster: PeekXR: Understanding Privacy Leakages from Eye Gaze in Extended Reality. In Proceedings of the 23rd Annual International Conference on Mobile Systems, Applications and Services (Hilton Anaheim, Anaheim, CA, USA) (MobiSys ’25). Association for Computing Machinery, New York, NY, USA, 609–610. doi:10.1145/3711875.3734567 [122] Ken Pfeu"er, Matthias J. Geiger, Sarah Prange, Lukas Mecke, Daniel Buschek, and Florian Alt. 2019. Behavioural Biometrics in VR: Identifying People from Body Motion and Relations in Virtual Reality. In Proceedings of the 2019 CHI Conference on Human Factors in Computing Systems (Glasgow, Scotland Uk) (CHI ’19). Association for Computing Machinery, New York, NY, USA, 1–12. doi:10.1145/3290605.3300340 [123] Milos R Popovic, Thierry Keller, Sherin Ibrahim, George v Bueren, and Manfred Morari. 1998. Gait identi!cation and recognition sensor. In Proceedings of 6th Vienna International Workshop on Functional Electrostiumlation. [124] Prithiv Premkumar, Ryan Clark, Ian Valderas, Gaurang Kamat, and Bruce N. Walker. 2025. Motion ID: Gesture-Based Biometrics for User Identi!cation

and Authentication in Virtual Reality. In 2025 11th International Conference on Virtual Reality (ICVR). 50–59. doi:10.1109/ICVR66534.2025.11172555 [125] Joseph Psotka. 1995. Immersive training systems: Virtual reality and education and training. Instructional science 23, 5 (1995), 405–431. doi:10.1007/BF00896880 [126] Mehedi Hasan Raju, Lee Friedman, Dillon Lohr, and Oleg V. Komogortsev. 2025. From Features to Embeddings: Extending the Temporal-Persistence Principle to Deep-Learning Eye-movement Biometric. In 2025 IEEE International Joint Conference on Biometrics (IJCB). 1–11. doi:10.1109/IJCB65343.2025.11411463 [127] Mehedi Hasan Raju and Oleg Komogortsev. 2025. Eye Movement Biometrics in Virtual Reality: A Comparison Between VR Headset and High-End Eye-Tracker Collected Dataset. In 2025 IEEE Security and Privacy Workshops (SPW). 236–241. doi:10.1109/SPW67851.2025.00033 [128] Mehedi Hasan Raju and Oleg V Komogortsev. 2025. Real-Time Lightweight Gaze Privacy-Preservation Techniques Validated via O(ine Gaze-Based Interaction Simulation. arXiv preprint arXiv:2511.09846 (2025). [129] Xiaojun Ren, Jiluan Fan, Ning Xu, Shaowei Wang, Changyu Dong, and Zikai Wen. 2024. DPGazeSynth: Enhancing eye-tracking virtual reality privacy with di"erentially private data synthesis. Information Sciences 675 (2024), 120720. doi:10.1016/j.ins.2024.120720 [130] Cynthia E. Rogers, Alexander W. Witt, Alexander D. Solomon, and Krishna K. Venkatasubramanian. 2015. An approach for user identi!cation for headmounted displays. Association for Computing Machinery. doi:10.1145/2802083. 2808391 [131] Diana Romero, Ruchi Jagdish Patel, Athina Markopoulou, and Salma Elmalaki. 2023. GaitGuard: Protecting Video-Based Gait Privacy in Mixed Reality. arXiv preprint arXiv:2312.04470 (2023). [132] Marius Rubo and Gayoung Son. 2025. Social gaze !ngerprints: identifying social virtual reality users by their eye gaze patterns. Virtual Reality 29, 3 (2025), 144. [133] Mauricio Pamplona Segundo, Cole Hill, and Sudeep Sarkar. 2023. Long range gait matching using 3D body !tting with gait-speci!c motion constraints. In Proceedings of the IEEE/CVF Winter Conference on Applications of Computer Vision. 603–612. doi:10.1109/WACVW58289.2023.00067 [134] Nazmus Shakib Shadin, Nasim Ahmed, Md Mahedi Hassan, Rifatul Islam, and Xinyue Zhang. 2025. YouKnowWho: Interpretable Framework for Classifying the Gender from Behavioral Motion Data in Extended Reality (XR). In Proceedings of the Twenty-Sixth International Symposium on Theory, Algorithmic Foundations, and Protocol Design for Mobile Networks and Mobile Computing (Rice University, Houston, TX, USA) (MobiHoc ’25). Association for Computing Machinery, New York, NY, USA, 485–490. doi:10.1145/3704413.3765309 [135] Manimaran Sivasamy, V.N. Sastry, and N.P. Gopalan. 2020. VRCAuth: Continuous Authentication of Users in Virtual Reality Environment Using HeadMovement. In 2020 5th International Conference on Communication and Electronics Systems (ICCES). 518–523. doi:10.1109/ICCES48766.2020.9137914 [136] Julian Steil, Inken Hagestedt, Michael Xuelin Huang, and Andreas Bulling. 2019. Privacy-aware eye tracking using di"erential privacy. In Proceedings of the 11th ACM Symposium on Eye Tracking Research & Applications (Denver, Colorado) (ETRA ’19). Association for Computing Machinery, New York, NY, USA, Article 27, 9 pages. doi:10.1145/3314111.3319915 [137] Ruoxi Sun, Hanwen Wang, Hsiang-Ting Chen, and Minhui Xue. 2025. Privacy in Motion: Implementing Di"erential Privacy for User Motion in VR. In Proceedings of the 36th Australasian Conference on Human-Computer Interaction (OzCHI ’24). Association for Computing Machinery, New York, NY, USA, 223–231. doi:10. 1145/3726986.3727017 [138] Ruoxi Sun, Hanwen Wang, Minhui Xue, and Hsiang-Ting Chen. 2024. PPVR: A Privacy-Preserving Approach for User Behaviors in VR. In 2024 IEEE Conference on Virtual Reality and 3D User Interfaces Abstracts and Workshops (VRW). 1055– 1056. doi:10.1109/VRW62533.2024.00324 [139] Mei Suzuki, Ryo Iijima, Kazuki Nomoto, Tetsushi Ohki, and Tatsuya Mori. 2023. PinchKey: A Natural and User-Friendly Approach to VR User Authentication. In Proceedings of the 2023 European Symposium on Usable Security (Copenhagen, Denmark) (EuroUSEC ’23). Association for Computing Machinery, New York, NY, USA, 192–204. doi:10.1145/3617072.3617122 [140] Daksh Thapar, Jayesh Chaudhari, Sunny Manchanda, Aditya Nigam, and Chetan Arora. 2024. GaitW: Enhancing Gait Recognition in the Wild Using Dynamic Information. In Proceedings of the Asian Conference on Computer Vision. 268–285. doi:10.1007/978-981-96-0885-0_2 [141] Pier Paolo Tricomi, Federica Nenna, Luca Pajola, Mauro Conti, and Luciano Gamberini. 2023. You Can’t Hide Behind Your Headset: User Pro!ling in Augmented and Virtual Reality. IEEE Access 11 (2023), 9859–9875. doi:10.1109/ ACCESS.2023.3240071 [142] R. Vaitheeshwari, Chih-Hsuan Chen, Chia-Ru Chung, Hsuan-Yu Yang, ShihChing Yeh, Eric Hsiao-Kuang Wu, and Mukul Kumar. 2024. Dyslexia Analysis and Diagnosis Based on Eye Movement. IEEE Transactions on Neural Systems and Rehabilitation Engineering 32 (2024), 4109–4119. doi:10.1109/TNSRE.2024. 3496087 [143] Minna Vasarainen, Sami Paavola, and Liubov Vetoshkina. 2021. A systematic literature review on extended reality: Virtual, augmented and mixed reality in working life. International Journal of Virtual Reality 21, 2 (2021), 1–28. 16

doi:10.20870/IJVR.2021.21.2.4620 [144] Likai Wang, Wei Feng, Ruize Han, Xiangqun Zhang, Yanjie Wei, and Song Wang. 2025. From indoor to outdoor: Unsupervised domain adaptive gait recognition. Pattern Recognition (2025), 112159. doi:10.1016/j.patcog.2025.112159 [145] Qidi J. Wang and Ryan P. McMahan. 2024. Gender Identi!cation of VR Users by Machine Learning Tracking Data. In 2024 IEEE Conference on Virtual Reality and 3D User Interfaces Abstracts and Workshops (VRW). 827–828. doi:10.1109/ VRW62533.2024.00210 [146] Qidi J. Wang, Alec G. Moore, Nayan N. Chawla, and Ryan P. McMahan. 2024. Cross-Domain Gender Identi!cation Using VR Tracking Data. In 2024 IEEE International Symposium on Mixed and Augmented Reality (ISMAR). 180–189. doi:10.1109/ISMAR62088.2024.00032 [147] Runze Wang, Jiahao Liu, Miao Hu, Yipeng Zhou, and Di Wu. 2025. Local Di"erentially Private Release of In!nite Streams With Temporal Relevance. In Proceedings of the ACM on Web Conference 2025 (Sydney NSW, Australia) (WWW ’25). Association for Computing Machinery, New York, NY, USA, 921–930. doi:10. 1145/3696410.3714619 [148] Chris Warin, Dominik Seeger, Shirin Shams, and Delphine Reinhardt. 2024. PrivXR: A Cross-Platform Privacy-Preserving API and Privacy Panel for Extended Reality. In 2024 IEEE International Conference on Pervasive Computing and Communications Workshops and other A#liated Events (PerCom Workshops). 417–420. doi:10.1109/PerComWorkshops59983.2024.10503341 [149] Xing Wei, Shengqian Han, Chenyang Yang, and Chengjian Sun. 2025. Optimizing QoE-Privacy Tradeo" for Proactive VR Streaming. arXiv preprint arXiv:2503.09448 (2025). [150] Xing Wei, Cornelius Hellge, Chenyang Yang, and Jangwoo Son. 2024. Improving QoE-Privacy Tradeo" in XR Streaming. IEEE Signal Processing Letters 31 (2024), 1504–1508. doi:10.1109/LSP.2024.3401616 [151] Xing Wei and Chenyang Yang. 2022. FoV Privacy-aware VR Streaming. In 2022 IEEE Wireless Communications and Networking Conference (WCNC). 1515–1520. doi:10.1109/WCNC51071.2022.9771832 [152] Yu-Szu Wei, Yuan-Chun Sun, Shin-Yi Zheng, Hsun-Fu Hsu, Chun-Ying Huang, and Cheng-Hsin Hsu. 2024. Mitigating Privacy Threats Without Degrading Visual Quality of VR Applications: Using Re-Identi!cation Attack as a Case Study. In 2024 IEEE 7th International Conference on Multimedia Information Processing and Retrieval (MIPR). 214–220. doi:10.1109/MIPR62202.2024.00040 [153] Yu-Szu Wei, Xing Wei, Shin-Yi Zheng, Cheng-Hsin Hsu, and Chenyang Yang. 2023. A 6DoF VR Dataset of 3D virtualWorld for Privacy-Preserving Approach and Utility-Privacy Tradeo". In Proceedings of the 14th ACM Multimedia Systems Conference (Vancouver, BC, Canada) (MMSys ’23). Association for Computing Machinery, New York, NY, USA, 444–450. doi:10.1145/3587819.3592557 [154] Mariusz Wierzbowski, Grzegorz Pochwatko, Paulina Borkiewicz, Daniel Cnotkowski, Micha) Pabi*-Orzeszyna, and Pawe) Kobyli+ski. 2022. Behavioural Biometrics in Virtual Reality: To What Extent Can We Identify a Person Based Solely on How They Watch 360-Degree Videos?. In 2022 IEEE International Symposium on Mixed and Augmented Reality Adjunct (ISMAR-Adjunct). 417–422. doi:10.1109/ISMAR-Adjunct57072.2022.00090 [155] Ethan Wilson, Vincent Bindschaedler, Sophie Jörg, Sean Sheikholeslam, Kevin Butler, and Eakta Jain. 2025. Towards Privacy-preserving Photorealistic Selfavatars in Mixed Reality. arXiv preprint arXiv:2507.22153 (2025). [156] Ethan Wilson, Azim Ibragimov, Michael J. Proulx, Sai Deep Tetali, Kevin Butler, and Eakta Jain. 2024. Privacy-Preserving Gaze Data Streaming in Immersive Interactive Virtual Reality: Robustness and User Experience. IEEE Transactions on Visualization and Computer Graphics 30, 5 (2024), 2257–2268. doi:10.1109/ TVCG.2024.3372032 [157] Depeng Xu, Weichao Wang, and Aidong Lu. 2024. A Review of Motion Data Privacy in Virtual Reality. In 2024 International Conference on Meta Computing (ICMC). 186–194. doi:10.1109/ICMC60390.2024.00027 [158] Shilin Yan, Shan Chang, Jiacheng Wang, and Shanila Azhar. 2020. Using Pupil Light Re$ex for Fast Biometric Authentication. In Proceedings of the ACM Turing Celebration Conference - China (Hefei, China) (ACM TURC ’20). Association for Computing Machinery, New York, NY, USA, 139–143. doi:10.1145/3393527. 3393551 [159] Zhengkun Ye, Ahmed Tanvir Mahdad, Yan Wang, Cong Shi, Yingying Chen, and Nitesh Saxena. 2025. VR Testbed-based Blood Pressure Privacy Leakage Analysis. In Proceedings of the Tenth ACM/IEEE Symposium on Edge Computing (the Hilton Arlington National Landing, Arlington, VA, USA) (SEC ’25). Association for Computing Machinery, New York, NY, USA, Article 53, 2 pages. doi:10.1145/3769102.3774707 [160] Da-Young Yu, Hyung-Tak Lee, Youngsam Kim, Jong-Hyuk Roh, Soohyung Kim, Jeonghun Ku, and Han-Jeong Hwang. 2024. VR-Based Implicit Authentication Using Electromyogram and Inertial Measurement Unit. In 2024 International Conference on Cyberworlds (CW). 328–329. doi:10.1109/CW64301.2024.00057 [161] Jihun Yu and Jungwoon Park. 2016. Real-time facial tracking in virtual reality. In SIGGRAPH ASIA 2016 VR Showcase. 1–1. doi:10.1145/2996376.2996390 [162] Shiqi Yu, Tieniu Tan, Kaiqi Huang, Kui Jia, and Xinyu Wu. 2009. A study on gait-based gender classi!cation. IEEE Transactions on image processing 18, 8 (2009), 1905–1910. doi:10.1109/TIP.2009.2020535

[163] Numan Zafar, Priyo Ranjan Kundu Prosun, and Sha!que Ahmad Chaudhry. 2025. Knowledge-Based Behavioral Biometrics for Secure Authentication in Virtual Reality. In 2025 International Symposium on Multimedia (ISM). 288–291. doi:10.1109/ISM66958.2025.00061 [164] Lian Zhang, Joshua Wade, Dayi Bian, Jing Fan, Amy Swanson, Amy Weitlauf, Zachary Warren, and Nilanjan Sarkar. 2017. Cognitive Load Measurement in a Virtual Reality-Based Driving System for Autism Intervention. IEEE Transactions on A"ective Computing 8, 2 (2017), 176–189. doi:10.1109/TAFFC.2016.2582490 [165] Tianfang Zhang, Qiufan Ji, Md Mojibur Rahman Redoy Akanda, Zhengkun Ye, Ahmed Tanvir Mahdad, Cong Shi, Yan Wang, Nitesh Saxena, and Yingying Chen. 2025. Harnessing Vital Sign Vibration Harmonics for E"ortless and Inbuilt XR User Authentication. In Proceedings of the 2025 ACM SIGSAC Conference on Computer and Communications Security (Taipei, Taiwan) (CCS ’25). Association for Computing Machinery, New York, NY, USA, 3520–3534. doi:10.1145/3719027. 3765060 [166] Tianfang Zhang, Cong Shi, Tianming Zhao, Zhengkun Ye, Payton Walker, Nitesh Saxena, Yan Wang, and Yingying Chen. 2022. Personalized health monitoring via vital sign measurements leveraging motion sensors on AR/VR headsets. In Proceedings of the 20th Annual International Conference on Mobile Systems, Applications and Services (Portland, Oregon) (MobiSys ’22). Association for Computing Machinery, New York, NY, USA, 529–530. doi:10.1145/3498361. 3538768 [167] Tianfang Zhang, Zhengkun Ye, Ahmed Tanvir Mahdad, Md Mojibur Rahman Redoy Akanda, Cong Shi, Yan Wang, Nitesh Saxena, and Yingying Chen. 2023. FaceReader: Unobtrusively Mining Vital Signs and Vital Sign Embedded Sensitive Info via AR/VR Motion Sensors. In Proceedings of the 2023 ACM SIGSAC Conference on Computer and Communications Security (Copenhagen, Denmark) (CCS ’23). Association for Computing Machinery, New York, NY, USA, 446–459. doi:10.1145/3576915.3623102 [168] Yongtuo Zhang, Wen Hu, Weitao Xu, Chun Tung Chou, and Jiankun Hu. 2018. Continuous Authentication Using Eye Movement Response of Implicit Visual Stimuli. Proc. ACM Interact. Mob. Wearable Ubiquitous Technol. 1, 4, Article 177 (Jan. 2018), 22 pages. doi:10.1145/3161410 [169] Sheng Zhao, Junrui Zhu, Shuning Zhang, Xueyang Wang, Hongyi Li, Fang Yi, Xin Yi, and Hewu Li. 2025. CoordAuth: Hands-Free Two-Factor Authentication in Virtual Reality Leveraging Head-Eye Coordination. In 2025 IEEE Conference Virtual Reality and 3D User Interfaces (VR). 738–748. doi:10.1109/VR59515.2025. 00096

17

Related documents

• SoK: Motion Data Privacy in Extended Reality#820726
• Cloak of Invisibility: Real-Time Privacy-Preserving Volumetric Video Streaming#652450
• Cloak of Invisibility: Real-Time Privacy-Preserving Volumetric Video Streaming#650997
• A Survey and Experimental Study on Privacy-Preserving Trajectory Data Publishing#400527
• Post-mortem privacy 2.0: theory, law, and technology#248085