Anonymized data from over 50,000 Beat Saber players found that VR users can be identified with 94% accuracy from just 100 seconds of motion data

Analyzing 2.5 million anonymized VR data records of more than 50,000 players of the popular application 'Beat Saber', research results that users can be uniquely identified with an accuracy of 94% or more from just 100 seconds of motion data. A paper demonstrating is published in the unpeer-reviewed paper repository arxiv.org.

[2302.08927] Unique Identification of 50,000+ Virtual Reality Users from Head & Hand Motion Data

https://doi.org/10.48550/arXiv.2302.08927

New research suggests that privacy in the metaverse might be impossible | VentureBeat
https://venturebeat.com/virtual/new-research-suggests-that-privacy-in-the-metaverse-might-be-impossible/

Beat Saber is a VR-compatible music game announced in 2018. Play by slicing blocks that flow in time with the music with a glowing sword held in both hands. You can see what kind of game it actually is by looking at the following movie that combines the video of the game and the movement of the live action.

I tried playing the rhythm game ``Beat Saber'' that cuts off the blocks flowing on Oculus Quest with a lightsaber-YouTube


Vivek Nair, a graduate student at the University of California, Berkeley, and his colleagues used VR datasets from users of Beat Saber. This data includes 'telemetry data' that tracks three points, the head and hands tracked by the VR system.

As a result of analyzing more than 2.5 million VR data, it turned out that individual users can be identified with an accuracy of 94% or more from just 100 seconds of motion data. In addition, it was possible to identify almost half of the users from just 2 seconds of motion data. Of course, it would require an AI algorithm to identify the user, but the data itself was only 3-point tracking telemetry data.

According to the research team, common movements may be unique to each person, like fingerprints. In other words, body movements in VR space can eliminate anonymity in the Metaverse, and can be a very serious privacy risk.

VentureBeat, an IT news site, said, ``If a user puts on a VR headset, picks up two general controllers, and makes some kind of movement in the VR or AR space, the user can be uniquely identified. It leaves a strong fingerprint .'

Nair also told VentureBeat, ``Moving around in a VR space while delivering basic motion data is like accessing a website while sharing a fingerprint on the Internet. Unlike web browsing, which does not need to share fingerprints, motion data distribution is part of the basic system involved in the functioning of the Metaverse.'

VentureBeat presents a solution that prevents viewing of motion data before the motion data is delivered from the VR device to the external server. However, while this solution protects the user's privacy, it reduces the accuracy of body movement tracking, which leads to poor performance not only for Beat Saber but also for VR-related applications.

In addition, VentureBeat has proposed enacting regulations to prevent platforms from storing and analyzing motion data, but these regulations will be difficult to enforce and will be repulsed by the industry.

VentureBeat said, ``Protecting individual privacy is important not only for users but also for the industry as a whole. You may avoid doing it partly, ”he commented.