As VR (Virtual Reality) headsets move into healthcare, classrooms and workplaces, KAUST researchers have identified a potential privacy risk hiding in the hardware users already wear: standard motion sensors may reveal more than movement.
The study goes further into expressing and detailing privacy concerns, than those that were expressed in a recent article about wearables, from researchers at Oxford University’s Saïd Business School, which touched on visual personal data that is accumulated (what a person is seeing).
Researchers at King Abdullah University of Science and Technology (“KAUST”), led by Assistant Professor of Computer Science Tao Ni, and other collaborators, have demonstrated that motion sensors already built into commercial VR headsets can capture subtle physiological signals associated with users’ visual responses.
Using artificial intelligence, the team showed that these signals could be used to reconstruct brain-related information associated with visual perception, revealing a previously unknown privacy consideration for immersive technology.
VR headsets rely on motion sensors to track movement and create immersive digital experiences. These sensors are generally accessible to applications running on the device, meaning a malicious app or webpage could potentially collect motion sensor data and infer sensitive information without a user’s knowledge.
The findings raise important questions about how personal data is protected as immersive technologies become more widely used across gaming, education, healthcare and remote collaboration.
What a user is perceiving
Previous studies have shown that VR sensor data can reveal behaviours such as typing, speech patterns, and application usage. This study goes further by demonstrating that motion sensor data may also contain brain-related information associated with visual perception, expanding the range of privacy risks that researchers and platform developers must consider.
“The sensors inside today’s VR headsets were not designed to capture sensitive personal information, but our research shows they may reveal more than previously recognized,” said Tao Ni, lead author of the study. “As immersive technologies continue to evolve, understanding these risks is essential to ensuring privacy and security protections keep pace with innovation.”
The team developed a system called BraVeSPY and tested it across several commercially available VR headsets.
The system analysed motion sensor data to identify patterns associated with user interactions, demonstrating that information beyond simple movement tracking may be extracted from existing devices. The team successfully unveiled perceptive images in the brain with 52.0% 67.2% accuracy. In particular, BraVeSpy achieves over 85.0% accuracy in inferring user activity-related sensitive information, such as fingerprinting websites, apps, and streaming videos, and over 96.0% accuracy in user de-anonymization, gaze movement tracking, and virtual keystroke inference.
Useful applications to avoid harm
The researchers highlight that the purpose of the work is to help identify potential security weaknesses before they can be exploited. In addition to identifying the vulnerability, the study proposes practical measures that could reduce the risk of sensitive information being inferred from sensor data. These include:
- stronger permission controls
- improved management of sensor access, and
- technical approaches that limit the amount of information available to applications.
Potential for Future Applications
The work also highlights the potential for existing VR hardware to support more accessible, low-cost brain-computer interfaces in the future, with possible applications in healthcare, education, and human-computer interaction.
The findings could help inform future privacy standards for immersive technologies as adoption continues to grow across consumer, industrial, and professional applications.
