Privacy Leakage in Proactive VR Streaming: Modeling and Tradeoff

TL;DR

This paper investigates privacy leakage in proactive VR streaming, modeling viewpoint inference risks, and explores tradeoffs between privacy preservation and streaming quality, revealing that privacy can be compromised unless QoE is sacrificed or resources are increased.

Contribution

It models viewpoint leakage probability in proactive VR streaming and analyzes how privacy-preserving methods can be circumvented, highlighting the privacy-utility tradeoff.

Findings

Viewpoint leakage occurs even with privacy-preserving approaches.

Leakage probability can be reduced by sacrificing QoE or increasing resources.

Tradeoff between privacy and streaming quality is generally unavoidable.

Abstract

Proactive tile-based virtual reality (VR) video streaming employs the viewpoint of a user to predict the tiles to be requested, renders and delivers the predicted tiles before playback. Recently, it has been found that the identity and preference of the user can be inferred from the trace of viewpoint uploaded for proactive streaming, which indicates that viewpoint leakage incurs privacy leakage. In this paper, we strive to answer the following questions regarding viewpoint leakage during proactive VR video streaming. When is the viewpoint leaked? Can privacy-preserving approaches (e.g., federated or individual training, using predictors with no need for training, or predicting locally) avoid viewpoint leakage? We find that if the prediction error or the quality of experience (QoE) metric is uploaded for adaptive streaming, the real viewpoint can be inferred even with the privacy-preserving approaches. Then, we define viewpoint leakage probability to characterize the accuracy of the inferred viewpoint, and respectively derive the probability when uploading prediction error and QoE metric. We find that the viewpoint leakage probability can be reduced by sacrificing QoE or increasing resources. Simulation with the state-of-the-art predictor over a real dataset shows that such a tradeoff does not exist only in rare cases.