Exploring the Privacy Risks of Adversarial VR Game Design

Abstract

Fifty study participants playtested an innocent-looking "escape room" game in virtual reality (VR). Within just a few minutes, an adversarial program had accurately inferred over 25 of their personal data attributes, from anthropometrics like height and wingspan to demographics like age and gender. As notoriously data-hungry companies become increasingly involved in VR development, this experimental scenario may soon represent a typical VR user experience. Since the Cambridge Analytica scandal of 2018, adversarially-designed gamified elements have been known to constitute a significant privacy threat in conventional social platforms. In this work, we present a case study of how metaverse environments can similarly be adversarially constructed to covertly infer dozens of personal data attributes from seemingly-anonymous users. While existing VR privacy research largely focuses on passive observation, we argue that because individuals subconsciously reveal personal information via their motion in response to specific stimuli, active attacks pose an outsized risk in VR environments.

New Technology Deployment and Corporate Responsibilities in the Metaverse Title

“…There are also concerns that the metaverse will allow criminals and terrorists to use its multi-layered structure to hide behind encryption and untraceable non-fungible tokens to conceal their identity. Nair et al [41], for example, reported on their empirical research which revealed that virtual reality attackers can access personal data from the seemingly anonymous users of popular metaverse applications such as VRChat. More generally, there are also growing concerns about links between the metaverse and the dark web.…”

Truth in Motion: The Unprecedented Risks and Opportunities of Extended Reality Motion Data

“…Our results, recently presented at the 23rd Privacy Enhancing Technologies Symposium in 2023, show that over 25 personal data attributes, from anthropometrics like height and wingspan to demographics like age and gender, can be inferred from these users within just a few minutes of gameplay. 11 When combined with the identification methods discussed earlier, they can be used to aggregate user profiles from data across many applications.…”

Philosophical and Societal Impacts of Commodification in Metaverse

“…Nair and colleagues 115 conducted a virtual reality experiment with 30 participants who played an "escape room" game in immersive mode, using VR. Parallel to the game, a program was also running that could capture over 25 personal data from the users, not only anthropometric data, such as height, span but also demographic data such as age and gender, in a matter of a few minutes.…”