{"id":"6ff7de96-0800-48fc-a39c-af98f3c276b3","arxiv_id":"2605.27939","paper_version":1,"verdict":"CONDITIONAL","confidence":"LOW","novelty_score":7.0,"correctness_risk":"low","formal_verification":"none","parameter_count":0,"one_line_summary":"EyeSpy demonstrates a side-channel attack that reconstructs eye gaze from rendering performance variations in foveated rendering VR systems with mean errors of 1.1-4.4 degrees.","lead":"The paper shows a side-channel attack that infers eye gaze position in VR by placing special high-cost objects and watching how foveated rendering changes frame rates. Smart readers should care because it reveals that performance optimizations using eye data can leak private gaze information even when eye-tracking APIs are blocked.","discovery_kind":"new_method","skeptic_critique":{"model":"grok-4.3","headline":"Rendering metric variations may not be dominantly or consistently driven by HCO-foveal overlap amid scene dynamics","rationale":"The identified concern matches the reader's weakest assumption exactly and is the point where the inference pipeline is least secured by the reported evidence. No other internal inconsistency is visible from the given claims.","tokens_in":1803,"tokens_out":285,"duration_ms":25484,"concrete_test":"Re-execute the HCO sweep protocol on one reported platform (e.g., Meta Quest Pro) while adding 3-5 moving high-poly non-HCO objects in the periphery; recompute mean gaze prediction error over the same number of trials. If the error rises above 4.4° or correlation strength drops below the original threshold, the side-channel signal is not robust.","verdict_should_be":"CONDITIONAL","load_bearing_attack":"The central claim requires that logged frame time/rate changes are reliably attributable to imperceptible HCO overlap with the fovea (via the known sweep positions) rather than other GPU workload sources. The abstract asserts generalization across engines and pipelines with 1.1-4.4° errors, but provides no detail on experimental controls for concurrent dynamic objects, lighting, or background processes that could produce similar or masking metric fluctuations. If such confounders are present, the correlation step cannot uniquely map metric spikes to gaze coordinates.","agreement_with_reader":"agree"},"referee_report":{"model":"grok-4.3","summary":"The paper claims to introduce EyeSpy, a side-channel attack against foveated rendering in VR that infers eye gaze by sweeping imperceptible high-cost objects (HCOs) across the field of view and correlating variations in standard rendering performance metrics (frame rate or frame time) with the known HCO positions. Experimental results on Meta Quest Pro, Varjo XR-4, and desktop platforms show mean gaze prediction errors of 1.1-4.4 degrees, comparable to typical eye-tracker accuracy, with the attack generalizing across hardware, engines, and pipelines. Defenses based on supervised and unsupervised detectors achieve an F1 score of 0.99 over short time windows.","tokens_in":1909,"tokens_out":577,"duration_ms":41288,"significance":"If the results hold, this work is significant as it identifies a novel privacy vulnerability in dynamic foveated rendering systems, demonstrating that gaze information can be leaked through commonly exposed performance metrics without needing direct eye-tracking API access. The cross-platform empirical evaluation with concrete error ranges and the proposal of effective defenses contribute to understanding and mitigating side-channel risks in VR. The purely empirical approach with direct hardware measurements is a strength.","major_comments":[{"comment":"§4 (Attack Design and Implementation): The central claim depends on the assumption that variations in frame time/rate are dominantly and consistently caused by HCO-foveal overlap. However, the experimental methodology does not appear to include sufficient controls or ablations for other potential sources of GPU workload variation, such as concurrent dynamic objects, lighting changes, or background processes. This undermines the uniqueness of the correlation to gaze coordinates.","section":"§4 (Attack Design and Implementation)"},{"comment":"§5 (Evaluation): The reported mean errors (1.1-4.4 degrees) are presented without accompanying statistical details such as standard deviations, number of trials per condition, or confidence intervals. Given the note on missing methodology details, this makes it difficult to verify the robustness of the generalization claim across platforms.","section":"§5 (Evaluation)"}],"minor_comments":[{"comment":"Abstract: The abstract mentions 'standard game engines' but does not specify which ones were tested; this should be clarified for reproducibility.","section":"Abstract"},{"comment":"§6 (Defense): The defense mechanisms are described at a high level; more details on the features used for the detectors would improve clarity.","section":"§6 (Defense)"},{"comment":"Some figures showing the HCO sweep and metric variations would benefit from higher resolution or clearer annotations.","section":null}],"recommendation":"major_revision","confidential_remarks":null},"author_rebuttal":{"model":"grok-4.3","summary":"We thank the referee for the detailed and constructive feedback. We address each major comment below, indicating revisions to the manuscript where appropriate to strengthen the claims.","responses":[{"response":"We agree that explicit controls and ablations are needed to isolate the HCO-foveal effect. The original experiments used static scenes with no concurrent dynamic objects or lighting changes and minimized background processes; multiple runs averaged out residual noise. To address the concern directly, the revised manuscript will add ablation studies measuring frame-time variation without HCOs and under controlled confounders.","revision_made":"yes","referee_comment":"§4 (Attack Design and Implementation): The central claim depends on the assumption that variations in frame time/rate are dominantly and consistently caused by HCO-foveal overlap. However, the experimental methodology does not appear to include sufficient controls or ablations for other potential sources of GPU workload variation, such as concurrent dynamic objects, lighting changes, or background processes. This undermines the uniqueness of the correlation to gaze coordinates."},{"response":"We acknowledge that the evaluation section omitted these statistical details. The reported means derive from repeated trials across platforms; the revision will include standard deviations, exact trial counts per condition, and confidence intervals to support the generalization claims.","revision_made":"yes","referee_comment":"§5 (Evaluation): The reported mean errors (1.1-4.4 degrees) are presented without accompanying statistical details such as standard deviations, number of trials per condition, or confidence intervals. Given the note on missing methodology details, this makes it difficult to verify the robustness of the generalization claim across platforms."}],"tokens_in":1510,"tokens_out":363,"duration_ms":30758,"standing_objections":[]},"desk_editor":{"model":"grok-4.3","letter":"The main thing to know is that this paper demonstrates a side-channel attack that infers a user's gaze position in VR by placing invisible high-cost objects and watching how frame rates or times fluctuate when they overlap with the fovea. They report mean prediction errors of 1.1 to 4.4 degrees on the Meta Quest Pro, Varjo XR-4, and desktop setups, which lines up with typical eye tracker accuracy.\n\nWhat the paper does well is show that this works across different hardware, game engines, and foveated rendering pipelines. They also include a defense based on detectors that can spot the attack with an F1 score of 0.99 over short windows. The approach is empirical and grounded in direct measurements rather than theory.\n\nThe soft spots are around whether the performance metric changes are reliably caused by the high-cost object overlap or could be influenced by other GPU workload sources like moving objects or lighting in the scene. The abstract claims generalization but does not spell out controls for those confounders, so the correlation step might not be as clean as presented. The reader's stress-test note on this seems to hold from the available description.\n\nThis is the kind of paper for people studying privacy leaks in graphics systems or VR security. A reader who follows side-channel work in consumer devices would find the multi-platform results and the defense useful. It has enough concrete evidence to deserve a serious referee, even with the open questions on methodology.\n\nI would recommend sending it to peer review.","headline":"The paper shows a workable side-channel for inferring gaze from foveated rendering frame metrics via imperceptible high-cost objects, but the abstract leaves the handling of other workload sources unclear.","tokens_in":2390,"tokens_out":387,"would_cite":false,"duration_ms":29878,"reading_group":"maybe","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"grok-4.3","headline":"Side-channel attacks can infer eye gaze positions in VR from foveated rendering performance metrics with accuracy comparable to eye trackers.","keywords":["eye gaze inference","side-channel attack","foveated rendering","virtual reality","privacy","dynamic foveated rendering","frame rate side channel","gaze reconstruction"],"falsifier":"An experiment in which frame rate or frame time shows no consistent change when high-cost objects enter or leave the foveal region, or in which the resulting gaze prediction errors exceed 4.4 degrees on the tested platforms, would falsify reliable inference.","tokens_in":2703,"feed_emoji":"👁️","tokens_out":721,"duration_ms":29429,"temperature":0.7,"pith_summary":"The paper demonstrates that dynamic foveated rendering produces detectable differences in GPU workload depending on where the user looks. By sweeping imperceptible high-cost objects across the field of view and recording variations in frame rate or frame time from standard game-engine APIs, an attacker can map those variations back to gaze coordinates. This bypasses permission-based protections on eye-tracking data because the rendering system itself consumes gaze information internally. Experiments across three platforms report mean errors of 1.1 to 4.4 degrees. The approach works without calling any eye-tracking functions and generalizes across hardware and rendering pipelines.","feed_headline":"Frame-rate variations reveal eye gaze in foveated VR","feed_subtitle":"Sweeping imperceptible high-cost objects correlates performance metrics with gaze location at eye-tracker accuracy","key_machinery":"The correlation between imperceptible high-cost object positions and variations in exposed frame-rate or frame-time metrics caused by foveal overlap under dynamic foveated rendering.","core_discovery":"The central claim is that gaze position can be reconstructed by correlating known positions of imperceptible high-cost objects with measured changes in rendering performance metrics that occur only when an object overlaps the foveal region. The attack logs frame rate or frame time while the objects sweep the view, then solves for the gaze coordinate that best explains the observed performance spikes. Reported mean prediction errors fall between 1.1 and 4.4 degrees on the Meta Quest Pro, Varjo XR-4, and desktop systems, which the paper states is comparable to typical eye-tracker accuracy.","pith_inferences":["Applications that rely on foveated rendering for performance may need to add noise to performance metrics or hide object costs to limit leakage.","Similar side channels could appear in any rendering technique that changes computational effort based on gaze location.","The attack could be combined with other timing sources to improve accuracy or reduce the need for sweeping objects.","Users might test for such inference by monitoring whether frame times change when known high-cost objects move across their view."],"forward_implications":["Gaze inference remains possible even when eye-tracking APIs are blocked or require explicit permission.","The attack succeeds on multiple VR headsets and desktop configurations using common game engines.","Existing foveated rendering pipelines leak gaze location through ordinary performance counters.","Supervised and unsupervised detectors can identify the attack with F1 scores of 0.99 over short windows."],"fun_headline_variants":["Side-channel attack infers gaze from VR rendering metrics","Foveated rendering performance reveals eye gaze location","Gaze position extracted from frame rate changes in DFR","Imperceptible objects enable gaze inference in foveated VR","Frame time spikes reveal gaze via high-cost object sweeps"],"cache_read_input_tokens":64,"weakest_assumption_plain":"Standard game engine APIs expose rendering performance metrics that vary detectably and consistently with the overlap between high-cost objects and the foveal region.","fun_headline_variants_meta":{"raw":{"variants":["Side-channel attack infers gaze from VR rendering metrics","Foveated rendering performance reveals eye gaze location","Gaze position extracted from frame rate changes in DFR","Imperceptible objects enable gaze inference in foveated VR","Frame time spikes reveal gaze via high-cost object sweeps"]},"model":"grok-4.3","cost_usd":0.003537,"raw_usage":{"total_tokens":1905,"prompt_tokens":765,"num_sources_used":0,"completion_tokens":75,"cost_in_usd_ticks":35374500,"prompt_tokens_details":{"text_tokens":765,"audio_tokens":0,"image_tokens":0,"cached_tokens":256},"completion_tokens_details":{"audio_tokens":0,"reasoning_tokens":1065,"accepted_prediction_tokens":0,"rejected_prediction_tokens":0}},"tokens_in":765,"tokens_out":75,"duration_ms":12686,"temperature":1.0,"reasoning_tokens":1065,"cache_read_input_tokens":256,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-06-29T10:40:34.159872+00:00","model_set":{"reader":"grok-4.3"},"falsifier":"An experiment in which frame rate or frame time shows no consistent change when high-cost objects enter or leave the foveal region, or in which the resulting gaze prediction errors exceed 4.4 degrees on the tested platforms, would falsify reliable inference.","supporting_citations":[],"review_version":1}