Exploring the Privacy Risks of Adversarial VR Game Design

Abstract

Fifty study participants playtested an innocent-looking "escape room" game in virtual reality (VR). Within just a few minutes, an adversarial program had accurately inferred over 25 of their personal data attributes, from anthropometrics like height and wingspan to demographics like age and gender. As notoriously data-hungry companies become increasingly involved in VR development, this experimental scenario may soon represent a typical VR user experience. Since the Cambridge Analytica scandal of 2018, adversarially designed gamified elements have been known to constitute a significant privacy threat in conventional social platforms. In this work, we present a case study of how metaverse environments can similarly be adversarially constructed to covertly infer dozens of personal data attributes from seemingly anonymous users. While existing VR privacy research largely focuses on passive observation, we argue that because individuals subconsciously reveal personal information via their motion in response to specific stimuli, active attacks pose an outsized risk in VR environments.

Learn more at https://rdi.berkeley.edu/metaverse/metadata

References in corpus (2)

• Automatic Joint Parameter Estimation from Magnetic Motion Capture Data
• SoK: Data Privacy in Virtual Reality

Cited by in corpus (7)

• SoK: Data Privacy in Virtual Reality
• Truth in Motion: The Unprecedented Risks and Opportunities of Extended Reality Motion Data
• Effect of Duration and Delay on the Identifiability of VR Motion
• User Understanding of Privacy Permissions in Mobile Augmented Reality: Perceptions and Misconceptions
• Effect of Data Degradation on Motion Re-Identification
• Immersive Invaders: Privacy Threats from Deceptive Design in Virtual Reality Games and Applications
• Movement- and Traffic-based User Identification in Commercial Virtual Reality Applications: Threats and Opportunities