about
Unique Identification of 50k VR Users from Head and Hand Motion Data (arxiv.org)
17 points by atlasunshrugged on Feb 24, 2023 | hide | past | pdf | 6 comments on HN

In plain words: A system learns each person's head and hand movement patterns in VR from five minutes of use, then recognizes them later from short clips of motion alone. Among 55,541 real users it picked the right person 94% of the time from 100 seconds of data.

Abstract · Unique Identification of 50,000+ Virtual Reality Users from Head & Hand Motion Data

With the recent explosive growth of interest and investment in virtual reality (VR) and the so-called "metaverse," public attention has rightly shifted toward the unique security and privacy threats that these platforms may pose. While it has long been known that people reveal information about themselves via their motion, the extent to which this makes an individual globally identifiable within virtual reality has not yet been widely understood. In this study, we show that a large number of real VR users (N=55,541) can be uniquely and reliably identified across multiple sessions using just their head and hand motion relative to virtual objects. After training a classification model on 5 minutes of data per person, a user can be uniquely identified amongst the entire pool of 50,000+ with 94.33% accuracy from 100 seconds of motion, and with 73.20% accuracy from just 10 seconds of motion. This work is the first to truly demonstrate the extent to which biomechanics may serve as a unique identifier in VR, on par with widely used biometrics such as facial or fingerprint recognition.

Vivek Nair, Wenbo Guo, Justus Mattern, Rui Wang, James F. O'Brien, Louis Rosenberg, Dawn Song
arXiv:2302.08927 · cs.CR, cs.LG · submitted Feb 17, 2023
abstract · pdf · html

add comment on HN
Also discussed: Jan 2024 (1 point, 0 comments) · Mar 2023 (2 points, 0 comments) · Mar 2023 (2 points, 0 comments)

Hold up. They did this on beat saber… with a 50000 class output (one per user).

They seem to be using mod songs, and are not accounting for the fact that people are playing different songs.

Your motion is entirely determined by the song. I think they’re just identifying pairs of song choice and user height.

Note that one of their metadata features is “replay > 100”, meaning they probably have examples of the same user doing the same song many many times

Seems like a good way to validate it would be to have everyone play the same set of songs. Then to tell if the predictions work, see if it can find each different song each individual plays. I hope the design wasn't as bad as you say.
Reading into it more, the second most predictive feature was a context variable. That is, identifying features of the specific song.

I think this one gets a thumbs down from me.

I don't think too many people realize the danger of applications phoning home to the vendor isn't limited to desktop PCs and portable devices, nor is the type of information they can harvest limited to personal information or your web browser history.
Really cool, and really scary at the same time. As a frequent VR user, it would make sense that my movements are unique enough to fingerprint me, but it's not something I've ever thought about.
This reminds of the study that showed it was possible to fingerprint a person based on acceleration data from their phone when walking.