Pith. sign in

REVIEW 4 major objections 4 minor 104 references

Side-channel Inference of User Activities in AR/VR Using GPU Profiling

T0 review · 4 major / 4 minor · reviewed 2026-08-04 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read OVRWatcher claims that low-resolution 1Hz GPU usage data from a built-in profiler is enough to identify which AR/VR app a user opened, which virtual product they are viewing, and how many people are in a virtual meeting—without needing a co

desk verdict A plausible and well-executed GPU side-channel study whose headline no-concurrency claim rests on an untested process-survival assumption, and whose reported accuracies are inflated by feature selection and same-device evaluation. read the letter →

arxiv 2509.10703 v1 pith:GJLHE4LQ submitted 2025-09-12 cs.CR cs.AR

Seonghun Son , Chandrika Mukherjee , Reham Mohamed Aburas , Berk Gulmezoglu , Z. Berkay Celik This is my paper · ORCID
classification cs.CRcs.AR
keywords side-channelattackGPUprofilingAR/VRsecurityMetaQuestappfingerprintingvirtualobjectinferenceprivacyleakagelow-resolution
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

This paper tries to establish that on Meta Quest headsets, a background script can use the device's built-in GPU profiler at a very low 1Hz sampling rate to infer what a user is doing: which app is in the foreground, which virtual furniture item they are looking at, and how many avatars are present in a virtual meeting. If true, this matters because it bypasses Meta Quest's restriction on concurrent app execution, requires no elevated privileges, and undermines the common defense of lowering profiler resolution. The authors report over 99% accuracy in fingerprinting 100 standalone AR/VR apps and 100 WebXR apps, and over 98% accuracy in distinguishing 35 virtual products and detecting meeting participant counts. They also validate the attack in an open-world user study with real participants interacting with Meta Layout, reaching up to 88% accuracy in static identification.

What carries the argument

The central object is the set of 72 GPU performance counters exposed by Meta's ovrgpuprofiler tool at 1Hz. The load-bearing signal is the Non-Base Level Textures metric, which measures the percentage of textures sampled above the base mipmap level; because closer or larger objects require more detailed textures, this metric rises with the object's on-screen pixel coverage. The attack is carried by two mechanisms: (1) pixel-to-metric correlation, established through linear regression and Pearson correlation, and (2) detached background logging, achieved by double-forking the profiler ELF binary so the grandchild process is adopted by init and survives the malicious app's termination. The coll

What would settle it

Install an app that copies and double-forks the ovrgpuprofiler binary, close the app, and check whether the grandchild process and its log file persist on a current Meta Quest build; if the process is killed at app exit, the claimed no-concurrent-execution attack collapses to a weaker concurrent-execution model.

Watch

Extended reading notes

Core claim

OVRWatcher's central claim is that the built-in ovrgpuprofiler tool on Meta Quest, sampling at 1Hz, leaks fine-grained user activity. The paper shows that a single GPU counter, Non-Base Level Textures—the percentage of textures rendered above the base mipmap level—is strongly correlated with the number of on-screen pixels occupied by a rendered object (R2 up to 0.98 in VR). A malicious app can copy and double-fork the profiler binary so it keeps logging in the background after the app exits, then feed the 1-second GPU traces into random forest, CNN, or LSTM classifiers. Across four case studies, the authors demonstrate that this coarse channel is sufficient to fingerprint the foreground app,

Load-bearing premise

The attack depends on the detached background profiler process continuing to log GPU counters after the malicious app that launched it is closed; Meta Quest's current OS allows this, but it is not a guaranteed API contract and Meta could disable it.

Editorial extensions

If this is right

  • A user-installed app can silently record GPU traces for 30 seconds or longer and exfiltrate them later, requiring no permissions beyond normal app install and no concurrent app execution.
  • The 1Hz attack invalidates the mitigation of lowering profiler resolution: prior GPU side-channel work degraded below 40% accuracy under 10Hz, while OVRWatcher stays near 99% at 1Hz.
  • The attack generalizes across Meta Quest 2, 3, and 3S with a single cross-device model, achieving 95.8% app fingerprinting accuracy and 100% meeting-participant accuracy.
  • WebXR apps are also fingerprintable even when rendered inside a 2D browser screen, with 99% accuracy using 30 metrics and over 94% using only two metrics.
  • In a real-user study with Meta Layout, static object identification reached 83–88% accuracy and dynamic interaction reached 77–81%, showing the attack survives realistic noise and user movement.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • A testable implication left implicit: the same 1Hz leakage should appear on other platforms whose user-space profilers run in the background, such as HoloLens's Windows Performance Recorder; the paper includes a small HoloLens confirmation but does not turn it into a full attack.
  • Because the pixel-to-texture correlation is monotone, a simple defense would be to randomize mipmap bias or inject dummy texture loads; noise injection is mentioned as a countermeasure but its overhead and success-rate impact are not quantified.
  • The attack's speed boundary (vscreen proportional to s·v/z) predicts that fast-moving objects that cross the screen in less than one second are natural failure regions; app developers could exploit this by rendering sensitive content for sub-second durations.
  • Meta's updated requirement of verified developer organizations for native development raises the practical bar for this attack; if that becomes the standard gate, the real-world exposure may be narrower than the paper's threat model suggests.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

4 major / 4 minor

Summary. The paper introduces OVRWatcher, a side-channel attack on Meta Quest AR/VR headsets that infers user activities from 1 Hz GPU performance counters exposed by Meta's built-in ovrgpuprofiler tool. The threat model assumes a malicious standalone app launches a detached profiler process that continues recording GPU metrics after the malicious app is terminated, thereby bypassing Meta Quest's restriction on concurrent app execution. The authors evaluate four case studies: fingerprinting 100 standalone AR/VR apps (reported RF accuracy 99.5%), fingerprinting 100 WebXR apps (reported RF accuracy 99.0%), distinguishing 35 virtual furniture objects in AR/VR scenes (reported RF accuracy up to 98.1%), and inferring the number of meeting participants (reported up to 100%). They also report an IRB-approved user study with Meta Layout, cross-device results on Quest 2/3/3S, and a limited HoloLens 2 validation.

Significance. If the results hold, the paper makes a meaningful contribution: it demonstrates that a low-resolution (1 Hz) built-in GPU profiler can leak fine-grained activity information, challenging the prior assumption that high-rate performance counters are required for practical GPU side channels. The work is also valuable for studying a realistic restriction on Meta Quest, since concurrent standalone apps are disabled. The authors provide controlled experiments across multiple device generations, a real-user study, and responsible disclosure with a Meta bounty. However, the significance is currently tempered by three validation gaps: the detached-profiler persistence premise is not directly measured, per-case metric selection appears to use the evaluation scene itself, and cross-device transfer is inconsistent across the reported tables.

major comments (4)
  1. [§V, §VI-C, Ethical Considerations] The no-concurrent-execution threat model rests on the claim that the double-forked ovrgpuprofiler keeps recording after the malicious app is terminated. Listing 2 shows a standard daemonization pattern, but the paper does not report any liveness or continuity measurement for the profiler after the originating app's process group is destroyed, after force-stop, or under memory pressure. On Android, a double-forked child typically remains in the same UID/cgroup and can be killed with the app. The paper's own Ethical Considerations state that Meta has already tightened developer-mode access (June 2025), so this OS surface is mutable. A direct persistence experiment under realistic termination and memory conditions on stock Quest is required to support the headline claim 'without requiring concurrent app execution.'
  2. [§VII-C, Table V] The per-case metric subsets appear to be selected using the same scene on which the final accuracy is reported. For Case Study III, the 17 metrics are chosen because they 'individually achieve more than 80% classification accuracy' in the default VR scene (Section VII-C), and Table V then reports the accuracy of models trained on those 17 metrics in that same scene. The subsequent 5-metric pruning is also evaluated on the same scene. This creates a feature-selection circularity that inflates the object-detection accuracy. The authors should perform metric selection inside cross-validation folds, or select metrics on a disjoint validation scene/device, and report the resulting accuracy separately.
  3. [Appendix Table XIV, §VII-A] The cross-device claim is internally inconsistent. Table XIV reports a two-device transfer experiment on Quest 2 for standalone app fingerprinting in which Random Forest collapses to 37.33% accuracy with F1=0.310, while Table XV reports 95.83% accuracy for RF in the merged cross-device setting, and the introduction claims 'over 93% accuracy across all case studies.' The merged evaluation cannot be used to claim generalization to an unseen device, because the model is trained on data from the same distribution as the test headsets. The paper should clearly separate same-distribution, per-device, and unseen-device evaluations, and the transfer result in Table XIV must be addressed rather than hidden in an appendix.
  4. [Tables III–V, §VII] Cases I–III report accuracies from a single 80/20 random split with no variance estimate. Given the 100-class settings and the feature-selection issues above, the point estimates of 99.3%, 99.0%, and 98.1% may be optimistic and provide no sense of stability. The authors should report mean and standard deviation over repeated stratified splits, or use nested cross-validation, for the headline numbers. Case Study IV and the user study already use cross-validation, so this is a localized but load-bearing evaluation fix.
minor comments (4)
  1. [Table I] The symbols in the 'Standalone AR/VR' column render as gibberish ('♂¶ask,/street-view'), making the comparison table hard to read. Please use readable labels such as 'AR' and 'VR'.
  2. [Appendix Table XVI] The list of 100 standalone apps appears to double-list 'A2RL VR' and 'Hell Horde: Mixed Reality Survival' under both Gaming and Mixed Reality. This makes the count of unique apps ambiguous and should be corrected.
  3. [Section II-B] The statement that Quest exposes 72 metrics (78 for Quest 3S) appears later to be inconsistent with the per-device tables where Quest 3S metrics are sometimes not collected; clarify which metric count applies to each device.
  4. [References] There are minor reference typos, e.g., 'Meta Qeust' in reference [45]. A final proofreading pass for reference titles and URLs is needed.

Circularity Check

2 steps flagged · score 4.0 of 10

Core 1Hz app fingerprinting is independently evaluated, but the object-level and meeting-inference accuracies are inflated by metric selection performed on the same evaluation scenes.

  1. fitted input called prediction [Section VII-C (Virtual Object Detection), metric selection in Section VI-B and Table V]
    "we selected the 17 metrics (out of the 30 collected metrics) individually achieve more than 80% classification accuracy (CNN) applied in the default VR scene with v=1 unit/second speed and distance coordinate with z=0 ... As shown in Table V, CNN, LSTM, and RF models achieve the highest accuracies of 96.5%, 92.6%, and 98.1%, respectively, in the default VR scene with 17 selected metrics."

    The 17-metric subset is chosen because it achieves high classification accuracy on the exact default-VR 35-object dataset that is then used for the headline object-detection evaluation. Selecting features using the evaluation labels/data and then reporting accuracy on that same scene makes the >98% object-level result a fitted value rather than an independent prediction. The paper does not describe a nested or held-out feature-selection procedure, so the reported accuracy is an optimistic upper bound, not an unbiased estimate of real-world object inference.

  2. fitted input called prediction [Section VII-D (Meeting Room Inference)]
    "We achieve 100% accuracy in detecting the number of participants by monitoring 20 metrics individually with the RF model in the default VR scene and 18 metrics in both the VR office scene and AR meeting room setup. We identified 13 common individual metrics resulting in 100% accuracy in inferring the number of participants across all three scenes by employing the RF classifier."

    The metrics are selected because they individually reach 100% accuracy on the same participant-count datasets, and then 100% accuracy is reported for those selected metrics. The 5-fold cross-validation is applied after this selection, so selection is not nested inside the CV. The perfect accuracy is therefore a consequence of choosing the best-performing metrics on the evaluation data, not a prediction on unseen data.

full rationale

The paper's central new primitive—that 1Hz built-in GPU profiling can fingerprint foreground applications—is supported by a conventional supervised evaluation: 100 standalone apps and 100 WebXR apps are profiled and split 80/20 into training and test sets, with accuracy reported on the held-out 20%. That result is not circular: the classifier output is not an input to the feature-selection or training procedure beyond normal model fitting, and the train/test split is stated. The cross-device experiments also provide independent checks. No load-bearing self-citation chain appears; the few self-citations (e.g., [58], [59]) are motivational and not used to justify the attack's validity. There is no imported uniqueness theorem and no ansatz smuggled in via citation. The circularity concern is limited to the fine-grained inference case studies. In Section VII-C, the 17-metric subset is selected by ranking metric accuracy on the same default VR scene used to report the 98.1% RF object-classification accuracy. In Section VII-D, metrics are chosen because they individually give 100% participant-count accuracy, and then that 100% is reported. These are cases of fitting a feature set to the evaluation data and then presenting the resulting accuracy as a predictive result, which is a mild but real form of evaluation circularity. The user study (Section VIII) partially mitigates this by transferring the previously selected 17 metrics to a different application (Meta Layout) with different participants, though those metrics were still chosen using related object-rendering labels. Separately, the paper's claim that the double-forked profiler survives app termination (Section VI-C) and the Ethical Considerations note that Meta is awaiting a firmware response identify an OS-behavior assumption that is a correctness risk, not a circularity. Overall, the main app-fingerprinting claim is independent, while the object-level and meeting-inference headline numbers are inflated by selection-on-evaluation-data, warranting a moderate score of 4.

Assumptions & free parameters 5 free parameters · 4 assumptions · 0 invented entities

The central claim rests on empirical feature selection and ML training, not on new physical constants or invented entities. The main free parameters are the metric-selection thresholds and per-case metric subsets, which are fitted to observed separability in controlled rendering tasks. The key domain assumptions are about persistent background profiler operation and the representativeness of idle app launches.

free parameters (5)
  • Metric selection accuracy threshold (60%) = 60% classification accuracy on cube/cylinder/sphere
    Used to choose 30 of 72 GPU metrics in Section VI-B; selected based on observed CNN performance on a controlled rendering task.
  • Pearson correlation pruning threshold = |r| > 0.90
    Used to reduce 30 metrics to 11 in Section VI-B; the threshold is chosen by hand.
  • Per-case metric subsets = 30, 17, 11, 5, 4, 3 metrics
    Metric subsets are further pruned per case study based on observed per-metric accuracy or correlation; e.g., 17 metrics for object detection (Appendix Table XI), 5 core metrics (Table XII).
  • ML hyperparameters = RF n_estimators=100; CNN/LSTM/SVM settings not fully specified
    Model hyperparameters are chosen by the authors and not systematically justified in the paper.
  • Train/test split ratio = 80/20
    Used for Cases I-III; a single split without repeated cross-validation.
assumptions (4)
  • domain assumption The GPU profiler process remains active after the launching app is terminated.
    Section VI-C Listing 2: double-fork detaches the child and it is adopted by init; the paper demonstrates this on Quest builds, but it is an OS behavior that could change.
  • domain assumption The user installs and runs a malicious app before using benign apps.
    Threat model in Section V assumes the attacker can get a developer-mode app installed and launched once.
  • domain assumption The first 30 seconds of an app's execution, without user interaction, are representative of that app's GPU profile.
    Section VII-A data collection automatically launches apps and records for 30 seconds; real-world usage with interaction is not modeled in Cases I-II.
  • domain assumption The relationship between rendered pixel coverage and Non-Base Level Textures is approximately monotonic and stable across scenes.
    Section VI-B establishes this empirically with R^2 values, but it is not derived from first principles and may vary with renderer and content.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Side-channel Inference of User Activities in AR/VR Using GPU Profiling." pith.science (2026). https://pith.science/paper/GJLHE4LQ

@misc{pith2026250910703,
  author       = {Pith},
  title        = {Pith review of: Side-channel Inference of User Activities in AR/VR Using GPU Profiling},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/GJLHE4LQ}},
  note         = {Machine review of arXiv:2509.10703}
}
read the original abstract

Over the past decade, AR/VR devices have drastically changed how we interact with the digital world. Users often share sensitive information, such as their location, browsing history, and even financial data, within third-party apps installed on these devices, assuming a secure environment protected from malicious actors. Recent research has revealed that malicious apps can exploit such capabilities and monitor benign apps to track user activities, leveraging fine-grained profiling tools, such as performance counter APIs. However, app-to-app monitoring is not feasible on all AR/VR devices (e.g., Meta Quest), as a concurrent standalone app execution is disabled. In this paper, we present OVRWatcher, a novel side-channel primitive for AR/VR devices that infers user activities by monitoring low-resolution (1Hz) GPU usage via a background script, unlike prior work that relies on high-resolution profiling. OVRWatcher captures correlations between GPU metrics and 3D object interactions under varying speeds, distances, and rendering scenarios, without requiring concurrent app execution, access to application data, or additional SDK installations. We demonstrate the efficacy of OVRWatcher in fingerprinting both standalone AR/VR and WebXR applications. OVRWatcher also distinguishes virtual objects, such as products in immersive shopping apps selected by real users and the number of participants in virtual meetings, thereby revealing users' product preferences and potentially exposing confidential information from those meetings. OVRWatcher achieves over 99% accuracy in app fingerprinting and over 98% accuracy in object-level inference.

Figures

Figures reproduced from arXiv: 2509.10703 by the authors.

Figure 1
Figure 1. Illustration of OVRWATCHER’s threat model. GPU rasterization. However, their success rate drops to around 59% when the performance counter resolution is reduced or rasterization is disabled. Therefore, in this work, we aim to explore GPU profilers on AR/VR devices, operating at a low sampling rate of 1Hz without requiring additional SDKs, elevated privileges, or concurrent background app execution. We further aim to… view at source ↗
Figure 4
Figure 4. Correlation between Non-Base Level Textures metric and VR Cube object rendering with (a) the speed, v = 1 unit/second and distance coordinate z = 2 unit, (b) increasing speed to v = 2 unit/second, and (c) move object further from the point of view, z = 3 unit. display hardware compared to Meta Quest 2, potentially influencing GPU performance metrics. In AR mode, Meta Quest 2 achieves an R2 score of 0.90 with a corre… view at source ↗
Figure 5
Figure 5. In particular, before any application is launched, there is a constant baseline of GPU usage attributed to the system due to the background load, such as AR (passthrough) view or VR (immersive) view. Once an AR/VR app starts, GPU usage rises sharply due to the demands of rendering immersive 3D graphics. During the app’s runtime, GPU usage remains elevated to handle real-time interactions and dynamic scene updates. W… view at source ↗
Figures from the paper (6 more)
Figure 6
Figure 6. Figure 6: Example fingerprints for WebXR apps based on the [PITH_FULL_IMAGE:figures/full_fig_p009_6.png]
Figure 7
Figure 7. Figure 7: Experiment scenes for furniture classification. Two VR [PITH_FULL_IMAGE:figures/full_fig_p010_7.png]
Figure 9
Figure 9. Figure 9: Experiment scenes for meeting room inference. (a) [PITH_FULL_IMAGE:figures/full_fig_p011_9.png]
Figure 8
Figure 8. Figure 8: These jumps indicate a direct correlation be [PITH_FULL_IMAGE:figures/full_fig_p012_8.png]
Figure 10
Figure 10. Figure 10: Example fingerprints for standalone MR apps on [PITH_FULL_IMAGE:figures/full_fig_p013_10.png]
Figure 11
Figure 11. Figure 11: Correlation between Texture L2 Miss metric and VR Cube object rendering with (a) the speed, v = 1 unit/second and distance coordinate z = 2 unit, (b) increasing speed to v = 2 unit/second, and (c) move object further from the point of view, z = 3 unit. APPENDIX C AR/V…

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

104 extracted references · 2 linked inside Pith

  1. [1]

    Animation raw example - a-frame

    A-Frame. Animation raw example - a-frame. https://aframe.io/aframe/e xamples/performance/animation-raw/. Accessed: 2025-01-17

    2025

  2. [2]

    Comic book showcase example - a-frame

    A-Frame. Comic book showcase example - a-frame. https://aframe.io/af rame/examples/showcase/comicbook/. Accessed: 2025-01-17

    2025

  3. [3]

    Shopping showcase example - a-frame

    A-Frame. Shopping showcase example - a-frame. https://aframe.io/afra me/examples/showcase/shopping/. Accessed: 2025-01-17

    2025

  4. [4]

    Going native: Using a large-scale analysis of android apps to create a practical native-code sandboxing policy

    Vitor Afonso, Antonio Bianchi, Yanick Fratantonio, Adam Doup ´e, Mario Polino, Paulo De Geus, Christopher Kruegel, Giovanni Vigna, et al. Going native: Using a large-scale analysis of android apps to create a practical native-code sandboxing policy. InThe Network and Distributed System Security Symposium (NDSS), 2016

    2016

  5. [5]

    VR-Spy: A side- channel attack on virtual key-logging in vr headsets

    Abdullah Al Arafat, Zhishan Guo, and Amro Awad. VR-Spy: A side- channel attack on virtual key-logging in vr headsets. InIEEE Virtual Reality and 3D User Interfaces (VR), 2021

    2021

  6. [6]

    Apple vision pro

    Apple. Apple vision pro. https://www.apple.com/apple-vision-pro/, 2024. Accessed: 2024-12-30

    2024

  7. [7]

    Apple Vision Pro

    Apple Inc. Apple Vision Pro. https://www.apple.com/apple-vision-pro/,

  8. [8]

    Accessed: 2025-01-16

    Apple Inc.Optimizing GPU Performance, 2025. Accessed: 2025-01-16

    2025

Show all 104 references
  1. [9]

    Nat˜a M Barbosa, Gang Wang, Blase Ur, and Yang Wang. Who am i? a design probe exploring real-time transparency about online and offline user profiling underlying targeted ads.ACM on Interactive, Mobile, Wearable and Ubiquitous Technologies (IMWUT), 2021

    2021

  2. [10]

    Pearson correlation coefficient

    Jacob Benesty, Jingdong Chen, Yiteng Huang, and Israel Cohen. Pearson correlation coefficient. InNoise reduction in speech processing. Springer, 2009

    2009

  3. [11]

    Speak up, i’m listening: Extracting speech from zero-permission vr sensors

    Derin Cayir, Reham Mohamed, Riccardo Lazzeretti, Marco Angelini, Abbas Acar, Mauro Conti, Z Berkay Celik, and Selcuk Uluagac. Speak up, i’m listening: Extracting speech from zero-permission vr sensors. In The Network and Distributed System Security Symposium (NDSS), 2025

    2025

  4. [12]

    A-frame examples: Interactive webxr demos and use cases

    A-Frame Community. A-frame examples: Interactive webxr demos and use cases. https://aframe.io/aframe/examples/, 2025. Accessed: 2025-01- 14

    2025

  5. [13]

    There’s always a bigger fish: a clarifying analysis of a machine-learning- assisted side-channel attack

    Jack Cook, Jules Drean, Jonathan Behrens, and Mengjia Yan. There’s always a bigger fish: a clarifying analysis of a machine-learning- assisted side-channel attack. InInternational Symposium on Computer Architecture (ISCA), 2022

    2022

  6. [14]

    Ikea vr showroom

    Demodern. Ikea vr showroom. https://demodern.com/projects/ikea-vr-s howroom, 2020. Accessed: 2025-1-5

    2020

  7. [15]

    Android ndk

    Android Developers. Android ndk. https://developer.android.com/ndk,

  8. [16]

    Horizon unity documentation: Ovrgpu profiler

    Meta Developers. Horizon unity documentation: Ovrgpu profiler. https: //developers.meta.com/horizon/documentation/unity/ts-ovrgpuprofiler,

  9. [18]

    Monitor performance with ovr metrics tool

    Meta Developers. Monitor performance with ovr metrics tool. https: //developers.meta.com/horizon/documentation/unity/ts-ovrmetricstool/ #accessing-metrics-data, 2024. Accessed: 2025-07-17

    2024

  10. [19]

    Ovr metrics tool package download

    Meta Developers. Ovr metrics tool package download. https://develo pers.meta.com/horizon/downloads/package/ovr-metrics-tool/, 2025. Accessed: 2025-07-18

    2025

  11. [20]

    Mobile device setup for native android development

    Meta Developers. Mobile device setup for native android development. https://developers.meta.com/horizon/documentation/native/android/mob ile-device-setup/?utm source=chatgpt.com, 2024. Accessed: 2025-07-17

    2024

  12. [21]

    Present digital ikea projects

    Present Digital. Present digital ikea projects. https://present.digital/ikea/,

  13. [22]

    Df-sca: dynamic frequency side channel attacks are practical

    Debopriya Roy Dipta and Berk Gulmezoglu. Df-sca: dynamic frequency side channel attacks are practical. InAnnual Computer Security Applications Conference (ACSAC), 2022

    2022

  14. [23]

    Free furniture set

    Dexsoft. Free furniture set. https://assetstore.unity.com/packages/3d/pro ps/furniture/furniture-set-free-242389, 2023. Accessed: 2025-1-5

    2023

  15. [24]

    Spy in the gpu-box: Covert and side channel attacks on multi-gpu systems

    Sankha Baran Dutta, Hoda Naghibijouybari, Arjun Gupta, Nael Abu- Ghazaleh, Andres Marquez, and Kevin Barker. Spy in the gpu-box: Covert and side channel attacks on multi-gpu systems. InInternational Symposium on Computer Architecture (ISCA), 2023

    2023

  16. [25]

    Office room furniture

    Elcanetay. Office room furniture. https://assetstore.unity.com/packages/ 3d/props/furniture/office-room-furniture-70884. Accessed: 2025-1-8

    2025

  17. [26]

    Humanoid control for unity v4

    doxygen. Humanoid control for unity v4. https://humanoidcontrol.com/. Accessed: 2025-1-8

    2025

  18. [27]

    {LocIn}: Inferring semantic location from spatial maps in mixed reality

    Habiba Farrukh, Reham Mohamed, Aniket Nare, Antonio Bianchi, and Z Berkay Celik. {LocIn}: Inferring semantic location from spatial maps in mixed reality. InUSENIX Security Symposium, 2023

    2023

  19. [28]

    Towermax fitness - tower

    TowerMax Fitness. Towermax fitness - tower. https://towermax.fitness/t ower/, 2025. Accessed: 2025-01-21

    2025

  20. [29]

    Toon furniture

    Elcanetay. Toon furniture. https://assetstore.unity.com/packages/3d/props /furniture/toon-furniture-88740, 2023. Accessed: 2025-1-5

    2023

  21. [30]

    Chair and sofa set

    Geniuscrate Games. Chair and sofa set. https://assetstore.unity.com/pac kages/3d/props/furniture/chair-and-sofa-set-263004, 2023. Accessed: 2025-1-5

    2023

  22. [31]

    Generic and automated drive-by gpu cache attacks from the browser

    Lukas Giner, Roland Czerny, Christoph Gruber, Fabian Rauscher, Andreas Kogler, Daniel De Almeida Braga, and Daniel Gruss. Generic and automated drive-by gpu cache attacks from the browser. InACM Asia Conference on Computer and Communications Security (Asia CCS), 2024

    2024

  23. [32]

    Unreal engine: Real-time 3d creation platform

    Epic Games. Unreal engine: Real-time 3d creation platform. https: //www.unrealengine.com/en-US, 2025. Accessed: 2025-01-14

    2025

  24. [33]

    Webxr samples: Interactive examples for immersive web development

    Immersive Web Working Group. Webxr samples: Interactive examples for immersive web development. https://immersive-web.github.io/webxr -samples/, 2025. Accessed: 2025-01-14

    2025

  25. [34]

    A history of the unity game engine.Journal of Game Development, 2014

    John K Haas. A history of the unity game engine.Journal of Game Development, 2014

    2014

  26. [35]

    Android 12

    Google. Android 12. https://www.android.com/android-12/. Accessed: 2024-12-30

    2024

  27. [36]

    Webxr samples: Positional audio

    Immersive Web Working Group. Webxr samples: Positional audio. https: //immersive-web.github.io/webxr-samples/positional-audio.html. Accessed: 2025-01-17

    2025

  28. [37]

    Webxr - anchors sample

    Immersive Web Working Group. Webxr - anchors sample. https: //immersive-web.github.io/webxr-samples/anchors.html, n.d. Accessed: 2025-01-22

    2025

  29. [38]

    Ikea place

    IKEA. Ikea place. https://www.ikea.com/global/en/newsroom/innovation /ikea-launches-ikea-place-a-new-app-that-allows-people-to-virtually-p lace-furniture-in-their-home-170912/, 2021. Accessed: 2025-1-5

    2021

  30. [39]

    Why am i seeing this ad? the effect of ad transparency on ad effectiveness.Journal of Consumer Research, 2019

    Tami Kim, Kate Barasz, and Leslie K John. Why am i seeing this ad? the effect of ad transparency on ad effectiveness.Journal of Consumer Research, 2019

    2019

  31. [40]

    Dangers behind charging vr devices: Hidden side channel attacks via charging cables.IEEE Transactions on Information F orensics and Security, 2024

    Jiachun Li, Yan Meng, Yuxia Zhan, Le Zhang, and Haojin Zhu. Dangers behind charging vr devices: Hidden side channel attacks via charging cables.IEEE Transactions on Information F orensics and Security, 2024

    2024

  32. [41]

    Go with the flow: effects of transparency and user control on targeted advertising using flow charts

    Yucheng Jin, Karsten Seipp, Erik Duval, and Katrien Verbert. Go with the flow: effects of transparency and user control on targeted advertising using flow charts. InInternational Working Conference on Advanced Visual Interfaces, 2016

    2016

  33. [42]

    Platypus: Software-based power side-channel attacks on x86

    Moritz Lipp, Andreas Kogler, David Oswald, Michael Schwarz, Catherine Easdon, Claudio Canella, and Daniel Gruss. Platypus: Software-based power side-channel attacks on x86. InIEEE Symposium on Security and Privacy (S&P), 2021

    2021

  34. [43]

    Frequency throttling side-channel attack

    Chen Liu, Abhishek Chakraborty, Nikhil Chawla, and Neer Roggel. Frequency throttling side-channel attack. InACM SIGSAC Conference on Computer and Communications Security (CCS), 2022

    2022

  35. [44]

    I know what you enter on gear vr

    Zhen Ling, Zupei Li, Chen Chen, Junzhou Luo, Wei Yu, and Xinwen Fu. I know what you enter on gear vr. InIEEE Conference on Communications and Network Security (CNS). IEEE, 2019

    2019

  36. [45]

    Most popular apps in meta qeust app store

    Meta. Most popular apps in meta qeust app store. https://www.meta.c om/experiences/section/554169918379884/?srsltid=AfmBOooZZS9xp7 -GoobOpDaDjuwzQm9AyNN0qHfHzBS mqU0gPxF6EOG. Accessed: 2025-01-20

    2025

  37. [46]

    Meta asset store

    Meta. Meta asset store. https://assetstore.unity.com/, 2023. Accessed: 2025-1-5

    2023

  38. [47]

    Horizon workrooms by meta

    Meta. Horizon workrooms by meta. https://forwork.meta.com/horizon-w orkrooms/. Accessed: 2025-1-8

    2025

  39. [48]

    Meta Platforms

    Inc. Meta Platforms. Beat saber on meta quest. https://www.meta.com/e xperiences/pcvr/beat-saber/1304877726278670/?utm source=beatsaber. com&utm medium=oculusredirect, 2025. Accessed: 2025-01-14

    2025

  40. [49]

    Meta Platforms

    Inc. Meta Platforms. Figmin xr: Mixed reality experience. https://www. meta.com/experiences/figmin-xr-mixed-reality/6849182851823457/?srs ltid=AfmBOoo0KyTDPEkYb3YhKCueTFfCj3EH4wNBsKNfH5KvL 1U5HYv2g6eh, 2025. Accessed: 2025-01-14

    2025

  41. [50]

    Meta developer tools

    Meta Horizon. Meta developer tools. https://developers.meta.com/ horizon/unity/ts-ovrgpuprofiler/?doc root=documentation. Accessed: 2025-03-12

    2025

  42. [51]

    Meta bug bounty program

    Meta Platforms, Inc. Meta bug bounty program. https://bugbounty.meta .com/. Accessed: 2025-01-20

    2025

  43. [52]

    Meta experience: Layout

    Meta Platforms, Inc. Meta experience: Layout. https://www.meta.com/e xperiences/layout/9298251876913852/?srsltid=AfmBOoqVclH-mSB-1 G-o5fQiTVouJK8xM30FDhbtJ89bshTOdVMmQ9kZ, 2025. Accessed: 2025-07-16

    2025

  44. [53]

    Meta Platforms

    Inc. Meta Platforms. Ovr metrics tool. https://www.meta.com/experienc es/ovr-metrics-tool/2372625889463779/?srsltid=AfmBOorTjESKXfP1 Qp4B5menguU8wKd5 zF5VmUp5NSE5r9alopgbh o#reviews, 2025. Accessed: 2025-04-22

    2025

  45. [54]

    Microsoft hololens

    Microsoft. Microsoft hololens. https://learn.microsoft.com/en-us/holole ns/, 2024. Accessed: 2024-12-30

    2024

  46. [55]

    GPU Captures in Microsoft PIX

    Microsoft. GPU Captures in Microsoft PIX. https://devblogs.microsoft.c om/pix/gpu-captures/, 2025. Accessed: 2025-01-16

    2025

  47. [56]

    Altspacevr-a social vr platform

    Microsoft. Altspacevr-a social vr platform. https://altvr.com/. Accessed: 2025-1-8

    2025

  48. [57]

    Windows Performance Recorder

    Microsoft. Windows Performance Recorder. https://learn.microsoft.com/ en-us/windows-hardware/test/wpt/windows-performance-recorder, 2025. Accessed: 2025-01-16

    2025

  49. [58]

    {ATTention} please! an investigation of the app tracking transparency permission

    Reham Mohamed, Arjun Arunasalam, Habiba Farrukh, Jason Tong, Antonio Bianchi, and Z Berkay Celik. {ATTention} please! an investigation of the app tracking transparency permission. InUSENIX Security Symposium, 2024

    2024

  50. [59]

    Microsoft HoloLens Documentation

    Microsoft. Microsoft HoloLens Documentation. https://learn.microsoft. com/en-us/hololens/, 2025. Accessed: 2025-01-16

    2025

  51. [60]

    Moonrider

    Moonrider. Moonrider. https://moonrider.xyz, 2025. Accessed: 2025-01- 21

    2025

  52. [61]

    Rendered insecure: Gpu side channel attacks are practical

    Hoda Naghibijouybari, Ajaya Neupane, Zhiyun Qian, and Nael Abu- Ghazaleh. Rendered insecure: Gpu side channel attacks are practical. InACM SIGSAC conference on computer and communications security (CCS), 2018

    2018

  53. [62]

    Berkay Celik

    Reham Mohamed, Habiba Farrukh, Yidong Lu, He Wang, and Z. Berkay Celik. iStelan: Disclosing Sensitive User Information by Mobile Magnetometer from Finger Touches.Privacy Enhancing Technologies (PETS), 2023

    2023

  54. [63]

    Non-intrusive and unconstrained keystroke inference in vr platforms via infrared side channel.arXiv preprint arXiv:2412.14815, 2024

    Tao Ni, Yuefeng Du, Qingchuan Zhao, and Cong Wang. Non-intrusive and unconstrained keystroke inference in vr platforms via infrared side channel.arXiv preprint arXiv:2412.14815, 2024

    2024 arXiv

  55. [64]

    Inc. Niantic. Pok ´emon go official website. https://pokemongolive.com/ ?hl=en, 2025. Accessed: 2025-01-14

    2025

  56. [65]

    Unique identification of 50,000+ virtual reality users from head & hand motion data

    Vivek Nair, Wenbo Guo, Justus Mattern, Rui Wang, James F O’Brien, Louis Rosenberg, and Dawn Song. Unique identification of 50,000+ virtual reality users from head & hand motion data. InUSENIX Security Symposium, 2023

    2023

  57. [66]

    How to make a detached fork process? https://stackove rflow.com/questions/62837610/how-to-make-a-detached-fork-process,

    Stack Overflow. How to make a detached fork process? https://stackove rflow.com/questions/62837610/how-to-make-a-detached-fork-process,

  58. [67]

    Scikit-learn: Machine learning in python.the Journal of machine Learning research, 2011

    Fabian Pedregosa, Ga ¨el Varoquaux, Alexandre Gramfort, Vincent Michel, Bertrand Thirion, Olivier Grisel, Mathieu Blondel, Peter Prettenhofer, Ron Weiss, Vincent Dubourg, et al. Scikit-learn: Machine learning in python.the Journal of machine Learning research, 2011

    2011

  59. [68]

    Processbuilder (java platform se 8)

    Oracle. Processbuilder (java platform se 8). https://docs.oracle.co m/javase/8/docs/api/java/lang/ProcessBuilder.html, 2025. Accessed: 2025-07-18

    2025

  60. [69]

    Webxr games: Collection of webxr-based games

    Kevin Picchi. Webxr games: Collection of webxr-based games. https: //github.com/PicchiKevin/WebXR-games, 2025. Accessed: 2025-01-14

    2025

  61. [70]

    Meta quest 2 specifications

    Meta Platforms. Meta quest 2 specifications. https://www.meta.com/que st/products/quest-2/tech-specs/, 2024. Accessed: 2024-12-30

    2024

  62. [71]

    Meta quest 3 specifications

    Meta Platforms. Meta quest 3 specifications. https://www.meta.com/que st/quest-3/, 2024. Accessed: 2024-12-30

    2024

  63. [72]

    The future is virtual: How ar and vr are redefining tourism

    Alexander Pertus. The future is virtual: How ar and vr are redefining tourism. https://www.reportlinker.com/article/10399, 2025. Accessed: 2025-04-23

    2025

  64. [73]

    The dark side of native code on android.ACM Transactions on Privacy and Security, 2025

    Antonio Ruggia, Andrea Possemato, Savino Dambra, Alessio Merlo, Simone Aonzo, and Davide Balzarotti. The dark side of native code on android.ACM Transactions on Privacy and Security, 2025

    2025

  65. [74]

    Defweb: Defending user privacy against cache-based website fingerprinting attacks with intelligent noise injection

    Son Seonghun, Dipta Debopriya Roy, and Gulmezoglu Berk. Defweb: Defending user privacy against cache-based website fingerprinting attacks with intelligent noise injection. InComputer Security Applications Conference (ACSAC), 2023

    2023

  66. [75]

    A real-time defense against website fingerprinting attacks.arXiv preprint arXiv:2102.04291, 2021

    Shawn Shan, Arjun Nitin Bhagoji, Haitao Zheng, and Ben Y Zhao. A real-time defense against website fingerprinting attacks.arXiv preprint arXiv:2102.04291, 2021

    2021 arXiv

  67. [76]

    Top 5 virtual reality trends of 2025 — the future of vr

    Program-Ace. Top 5 virtual reality trends of 2025 — the future of vr. https://program-ace.com/blog/virtual-reality-trends/, 2025. Accessed: 2025-04-23

    2025

  68. [77]

    Face-mic: inferring live speech and speaker identity via subtle facial dynamics captured by AR/VR motion sensors

    Cong Shi, Xiangyu Xu, Tianfang Zhang, Payton Walker, Yi Wu, Jian Liu, Nitesh Saxena, Yingying Chen, and Jiadi Yu. Face-mic: inferring live speech and speaker identity via subtle facial dynamics captured by AR/VR motion sensors. InInternational Conference on Mobile Computing an...

    2021

  69. [78]

    Going through the motions: AR/VR keylogging from user head motions

    Carter Slocum, Yicheng Zhang, Nael Abu-Ghazaleh, and Jiasi Chen. Going through the motions: AR/VR keylogging from user head motions. InUSENIX Security Symposium, 2023

    2023

  70. [79]

    Awesome webxr: A curated list of webxr projects and resources

    Sindre Sorhus. Awesome webxr: A curated list of webxr projects and resources. https://project-awesome.org/msub2/awesome-webxr#standou t-projects, 2025. Accessed: 2025-01-14

    2025

  71. [80]

    What sensors are used in AR/VR systems? https://www

    Jeff Shepard. What sensors are used in AR/VR systems? https://www. sensortips.com/featured/what-sensors-are-used-in-ar-vr-systems-faq/,

  72. [81]

    Spatial - the future of work in virtual reality

    Spatial System. Spatial - the future of work in virtual reality. https: //spatial.io/. Accessed: 2025-1-8

    2025

  73. [82]

    Glitch: The friendly community for building the web

    Glitch Team. Glitch: The friendly community for building the web. https://glitch.com/, 2025. Accessed: 2025-01-14

    2025

  74. [83]

    Vrsites: Explore virtual reality websites and experiences

    VRSites Team. Vrsites: Explore virtual reality websites and experiences. https://vrsites.com/, 2025. Accessed: 2025-01-14

    2025

  75. [84]

    Webxr metaverse: Explore web-based xr experiences

    WebXR Metaverse Team. Webxr metaverse: Explore web-based xr experiences. https://www.webxr-metaverse.com/, 2025. Accessed: 2025-01-14

    2025

  76. [85]

    Apartment kit

    Brick Project Studio. Apartment kit. https://assetstore.unity.com/packa ges/3d/environments/apartment-kit-124055, 2023. Accessed: 2025-1-5

    2023

  77. [86]

    Unity scripting api: Androidjnihelper

    Unity Technologies. Unity scripting api: Androidjnihelper. https://docs.u nity3d.com/ScriptReference/AndroidJNIHelper.html, 2025. Accessed: 2025-07-18

    2025

  78. [87]

    AR/VR chip global market report

    The Business Research Company. AR/VR chip global market report

  79. [88]

    You can’t hide behind your headset: User profiling in augmented and virtual reality.IEEE Access, 2023

    Pier Paolo Tricomi, Federica Nenna, Luca Pajola, Mauro Conti, and Luciano Gamberini. You can’t hide behind your headset: User profiling in augmented and virtual reality.IEEE Access, 2023

    2023

  80. [89]

    Hdrp furniture pack

    Tridify. Hdrp furniture pack. https://assetstore.unity.com/packages/3d/p rops/furniture/hdrp-furniture-pack-153946, 2023. Accessed: 2025-1-5

    2023

  81. [90]

    Unity: Real-time development platform

    Unity Technologies. Unity: Real-time development platform. https: //unity.com/, 2025. Accessed: 2025-01-14

    2025

  82. [91]

    Vartiste

    Vartiste. Vartiste. https://vartiste.xyz, 2025. Accessed: 2025-01-21

    2025

  83. [92]

    VRChat. Vrchat. https://hello.vrchat.com/. Accessed: 2025-1-8

    2025

  84. [93]

    Accessed: 2025-04-23

    https://www.thebusinessresearchcompany.com/report/ar-or-vr-chi p-global-market-report, 2025. Accessed: 2025-04-23

    2025

  85. [94]

    Pyramidal parametrics

    Lance Williams. Pyramidal parametrics. InConference on Computer graphics and interactive techniques, 1983

    1983

  86. [95]

    Privacy leakage via unrestricted motion- position sensors in the age of virtual reality: A study of snooping typed input on virtual keyboards

    Yi Wu, Cong Shi, Tianfang Zhang, Payton Walker, Jian Liu, Nitesh Saxena, and Yingying Chen. Privacy leakage via unrestricted motion- position sensors in the age of virtual reality: A study of snooping typed input on virtual keyboards. InIEEE Symposium on Security and Privacy (...

    2023

  87. [96]

    Preparing assets for unity

    Unity. Preparing assets for unity. https://docs.unity3d.com/2019.3/ Documentation/Manual/Glossary.html#Unityunit, 2025. Accessed: 2025-01-17

    2019

  88. [97]

    Facereader: unobtrusively mining vital signs and vital sign embedded sensitive info via AR/VR motion sensors

    Tianfang Zhang, Zhengkun Ye, Ahmed Tanvir Mahdad, Md Mojibur Rahman Redoy Akanda, Cong Shi, Yan Wang, Nitesh Saxena, and Yingying Chen. Facereader: unobtrusively mining vital signs and vital sign embedded sensitive info via AR/VR motion sensors. InACM SIGSAC Conference on Comp...

    2023

  89. [98]

    It’s all in your head (set): Side-channel attacks on AR/VR systems

    Yicheng Zhang, Carter Slocum, Jiasi Chen, and Nael Abu-Ghazaleh. It’s all in your head (set): Side-channel attacks on AR/VR systems. In USENIX Security Symposium, 2023

    2023

  90. [99]

    Gazeploit: Remote keystroke inference attack by gaze estimation from avatar views in vr/mr devices

    Hanqiu Wang, Zihao Zhan, Haoqi Shan, Siqi Dai, Maximilian Panoff, and Shuo Wang. Gazeploit: Remote keystroke inference attack by gaze estimation from avatar views in vr/mr devices. InACM SIGSAC Conference on Computer and Communications Security (CCS), 2024

    2024

  91. [102]

    Can virtual reality protect users from keystroke inference attacks? InUSENIX Security Symposium, 2024

    Zhuolin Yang, Zain Sarwar, Iris Hwang, Ronik Bhaskar, Ben Y Zhao, and Haitao Zheng. Can virtual reality protect users from keystroke inference attacks? InUSENIX Security Symposium, 2024

    2024

  92. [105]

    Red alert for power leakage: Exploiting intel rapl-induced side channels

    Zhenkai Zhang, Sisheng Liang, Fan Yao, and Xing Gao. Red alert for power leakage: Exploiting intel rapl-induced side channels. InACM Asia Conference on Computer and Communications Security (Asia CCS), 2021. APPENDIXA GPU METRICSSELECTION BYPEARSONCORRELATION TABLE VII: Pruned ...

    2021

  93. [2020]

    Accessed: 2025-07-18

    2025

  94. [2022]

    Accessed: 2025-04-23

    2025

  95. [2024]

    Accessed: 2024-12-05

    2024

  96. [2025]

    Accessed: 2025-01-16

    2025

Pith tools

Reviewed August 4, 2026 · model on record in the stance chip above.