The study, published last week, was one of the first to signal that these kinds of biomechanics can serve as unique identifiers with results similar to facial or fingerprint recognition. “While perhaps not surprising to experts in biomechanics, the extent to which users can be uniquely identified by observing just a few seconds of motion of their head and hands may indeed be surprising to most,” the study states. “Though we don’t presently think of movement patterns as a uniquely identifiable characteristic to the same extent as faces and fingerprints, results like those presented in this paper may serve to change this assumption,” it added. With the Metaverse expected to grow even more popular in the near future, researchers warn about potential privacy and security risks. They also stressed the need for more research and the development of privacy-protecting technologies on VR platforms.
With Only 100 Seconds of Basic Motion Data, Users IDed with 94% Accuracy
The study involved running a dataset of more than 55,000 people’s basic head and hand motions through a machine-learning model. The researchers found that they could uniquely identify the users with only 100 seconds of motion data. The researchers relied on a dataset of users playing Beat Saber — a physically active VR game where a player slices through blocks with sabers. The dataset contained over 2.5 million gameplay session recordings belonging to 55,541 users. The researchers then trained a classification model on five minutes of data per user. The dataset, however, did not contain an equal amount of information on each player. The researchers noted that more session samples would lead to higher accuracy in identifying a user. However, they could identify a user nearly half the time (48.45%) with just 2 seconds of basic motion data. “Using 5 samples (10 seconds) of data increases this accuracy to 73.20%, which indicates that only a short period of motion information is actually needed to uniquely characterize a user,” the study added.
Potential Privacy Risks
The study found that static physical attributes such as a user’s height and arm length were the two most important identifying features. However, the model relied heavily on motion features to successfully identify users. The privacy concerns with the metaverse are unlike those that emanate from browsing the internet. When you use a browser or an app, it is possible to opt out of specific kinds of tracking. You can also encrypt your connection and block trackers with a VPN. On the other hand, providing basic motion data is essential when using VR platforms. Potential interventions would also have immediate trade-offs which may affect the product or how VR companies operate. For example, obscuring the motion data before it reaches a server could lead to less precise movements. This would compromise the user experience, especially when it comes to high-precision gameplay. Another potential intervention could be through legislation. Lawmakers and regulators could direct VR companies to limit the storing and processing of motion data. The researchers at UC Berkeley, rather hope that a technological solution can address these privacy concerns in the near future. The Metaverse and VR headsets are relatively new and have a smaller user base compared to most other technology devices. If you’re interested in protecting your privacy, read up on the risks associated with more common devices like smartphones and smart watches.
