Privacy-Preserving Gaze Data Streaming in Immersive Interactive Virtual Reality: Robustness and User Experience

TL;DR

This work develops a methodology to evaluate real-time privacy mechanisms for interactive VR applications that incorporate subjective user experience and task performance metrics and finds that re-identification accuracy can be decreased to as low as 14% while maintaining a high usability score and reasonable task performance.

Abstract

Eye tracking is routinely being incorporated into virtual reality (VR) systems. Prior research has shown that eye tracking data, if exposed, can be used for re-identification attacks. The state of our knowledge about currently existing privacy mechanisms is limited to privacy-utility trade-off curves based on data-centric metrics of utility, such as prediction error, and black-box threat models. We propose that for interactive VR applications, it is essential to consider user-centric notions of utility and a variety of threat models. We develop a methodology to evaluate real-time privacy mechanisms for interactive VR applications that incorporate subjective user experience and task performance metrics. We evaluate selected privacy mechanisms using this methodology and find that re-identification accuracy can be decreased to as low as 14% while maintaining a high usability score and reasonable task performance. Finally, we elucidate three threat scenarios (black-box, black-box with exemplars, and white-box) and assess how well the different privacy mechanisms hold up to these adversarial scenarios. This work advances the state of the art in VR privacy by providing a methodology for end-to-end assessment of the risk of re-identification attacks and potential mitigating solutions.

Figures (4)

• Figure 1: Identification accuracy (solid lines) and AOI retention (dotted lines) of privacy mechanisms applied at various strengths. X axes have been scaled to provide roughly the same privacy falloff so that utility can be directly compared. Vertical lines indicate the chosen low and high strengths of each mechanism.
• Figure 2: Collected metrics of the immersive VR game with gaze controls. For identification accuracy (first column), lower values indicate more privacy. For all utility metrics, a higher score indicates higher utility. Each subplot illustrates no privacy mechanism compared against the low and high strengths of each mechanism. Wilcoxon signed-rank test significance for utility metrics ($p < 0.05$) are denoted with color-coded asterisks. Vertical lines indicate Standard Error of the Mean (SEM) $= \sigma / \sqrt{N}$.
• Figure 3: Breakdown of PSSUQ SYSUSE scores lewis_psychometric_1992 across conditions by individual question. Vertical lines indicate SEM.
• Figure 4: Visualizations of the privacy mechanisms implemented in our experiments.