[Paper Review] Exploring the Privacy Risks of Adversarial VR Game Design

Vivek Nair, Gonzalo Munilla Garrido+2 more|arXiv (Cornell University)|Jul 26, 2022

Sexuality, Behavior, and Technology44 references17 citations

TL;DR

This paper demonstrates how adversarially designed VR games can covertly extract over 25 personal data attributes—such as height, age, and gender—from users via their motion patterns in just minutes, using a seemingly innocent 'escape room' game. The study reveals that active, behavior-triggered inference poses a far greater privacy risk in VR than passive observation, with high accuracy even on consumer-grade devices.

ABSTRACT

Fifty study participants playtested an innocent-looking "escape room" game in virtual reality (VR). Within just a few minutes, an adversarial program had accurately inferred over 25 of their personal data attributes, from anthropometrics like height and wingspan to demographics like age and gender. As notoriously data-hungry companies become increasingly involved in VR development, this experimental scenario may soon represent a typical VR user experience. Since the Cambridge Analytica scandal of 2018, adversarially designed gamified elements have been known to constitute a significant privacy threat in conventional social platforms. In this work, we present a case study of how metaverse environments can similarly be adversarially constructed to covertly infer dozens of personal data attributes from seemingly anonymous users. While existing VR privacy research largely focuses on passive observation, we argue that because individuals subconsciously reveal personal information via their motion in response to specific stimuli, active attacks pose an outsized risk in VR environments.

Motivation & Objective

• To investigate the feasibility of active, behavior-based privacy attacks in VR that exploit subconscious user motion to infer personal attributes.
• To demonstrate that seemingly innocent VR games can be adversarially designed to harvest sensitive data without user awareness.
• To identify and classify vulnerable data attributes, threat actors, and data sources in VR environments.
• To raise awareness among privacy practitioners about the growing threat of active inference in metaverse applications.
• To provide a framework for understanding and mitigating privacy risks in immersive VR platforms.

Proposed method

• A custom 'escape room' VR game was developed to subtly manipulate user behavior and collect motion and interaction data.
• The game was designed to elicit specific movement patterns correlated with personal attributes like height and wingspan.
• Machine learning models were trained on raw sensor telemetry to infer personal attributes from motion behavior.
• The attack model used behavioral responses to stimuli as proxies for biometric and demographic data.
• Data collection was performed using consumer-grade VR hardware (e.g., Meta Quest 2) to ensure real-world relevance.
• Anonymized open-source code and data pipelines were released to enable replication and further research.

Experimental results

Research questions

• RQ1 Can adversarially designed VR games covertly infer personal data attributes from user motion patterns?
• RQ2 How accurately can attackers infer biometric and demographic attributes using only behavioral responses in VR?
• RQ3 What types of data attributes are most vulnerable to inference through active game design?
• RQ4 How do active attacks in VR compare in effectiveness to passive observation techniques?
• RQ5 What threat models and attacker capabilities exist in VR environments for data harvesting?

Key findings

• The adversarial VR game successfully inferred over 25 distinct personal data attributes from 50 participants using only motion and behavior data.
• The system achieved high accuracy in inferring attributes such as height, wingspan, age, and gender, with some attributes uniquely identifying users.
• The attack was effective within minutes and required no explicit user input beyond normal gameplay.
• Many attributes were difficult to obtain via passive observation but were highly inferable through active behavioral prompting.
• The study demonstrates that privileged attackers with access to raw sensor telemetry can achieve near-perfect inference on key attributes.
• The results indicate that data-hungry companies could easily implement similar techniques in mainstream VR applications.