Toward Practical Privacy in XR: Empirical Analysis of Multimodal Anonymization Mechanisms

2025-06-16

AI Summary

XR systems face severe re-identification risks due to multimodal behavioral signals—such as eye-tracking and body telemetry—while conventional unimodal privacy mechanisms suffer from insufficient coordination and ineffective protection. This paper presents the first empirical demonstration that coordinated multimodal perturbation significantly outperforms isolated unimodal approaches. We propose a differential privacy framework tailored for real-time XR interaction, dynamically selecting and combining ten haptic-aware mechanisms—including filtering, noise injection, trajectory resampling, and joint-point perturbation—based on modality characteristics and usage context (e.g., leisure vs. competitive). Parameters are empirically calibrated to meet millisecond-level latency constraints. Evaluated across 407 participants and multiple mainstream XR applications, our approach reduces re-identification rates from 80.3% / 84.8% to 26.3% / 26.1%, achieving strong privacy guarantees without compromising interactive usability.

Technology Category

• Machine Learning: Privacy
• Computer Vision: Multi-modal Vision
• Intelligent Robots: Multimodal Perception & Sensor Fusion

Application Category

• User Modeling, Personalization and Recommendation: User privacy protection in personalized systems
• Security and Privacy: Data transparency and provenance
• Responsible Web: Data and user privacy-enhancing technologies for the Web

Abstract

As extended reality (XR) systems become increasingly immersive and sensor-rich, they enable the collection of fine-grained behavioral signals such as eye and body telemetry. These signals support personalized and responsive experiences and may also contain unique patterns that can be linked back to individuals. However, privacy mechanisms that naively pair unimodal mechanisms (e.g., independently apply privacy mechanisms for eye and body privatization) are often ineffective at preventing re-identification in practice. In this work, we systematically evaluate real-time privacy mechanisms for XR, both individually and in pair, across eye and body modalities. To preserve usability, all mechanisms were tuned based on empirically grounded thresholds for real-time interaction. We evaluated four eye and ten body mechanisms across multiple datasets, comprising up to 407 participants. Our results show that while obfuscating eye telemetry alone offers moderate privacy gains, body telemetry perturbation is substantially more effective. When carefully paired, multimodal mechanisms reduce re-identification rate from 80.3% to 26.3% in casual XR applications (e.g., VRChat and Job Simulator) and from 84.8% to 26.1% in competitive XR applications (e.g., Beat Saber and Synth Riders), all without violating real-time usability requirements. These findings underscore the potential of modality-specific and context-aware privacy strategies for protecting behavioral data in XR environments.

Problem

• Analyzing privacy risks in XR from eye and body telemetry data
• Evaluating multimodal anonymization to reduce user re-identification
• Balancing privacy and usability in real-time XR interactions

Innovation

• Multimodal anonymization for XR privacy
• Real-time eye and body telemetry perturbation
• Context-aware privacy strategies in XR