Going Incognito in the Metaverse: Achieving Theoretically Optimal Privacy-Usability Tradeoffs in VR

TL;DR

This paper introduces a novel incognito mode for VR that uses local differential privacy to protect user data, balancing privacy and usability, and is adaptable to various VR applications.

Contribution

The paper presents the first implementation of an incognito mode for VR leveraging local differential privacy, with a flexible system that adapts to different applications to optimize privacy-utility tradeoffs.

Findings

Significant reduction in attacker success in privacy attack simulations

Effective noise addition that preserves usability in VR applications

Universal Unity plugin successfully evaluated across multiple VR platforms

Abstract

Virtual reality (VR) telepresence applications and the so-called "metaverse" promise to be the next major medium of human-computer interaction. However, with recent studies demonstrating the ease at which VR users can be profiled and deanonymized, metaverse platforms carry many of the privacy risks of the conventional internet (and more) while at present offering few of the defensive utilities that users are accustomed to having access to. To remedy this, we present the first known method of implementing an "incognito mode" for VR. Our technique leverages local differential privacy to quantifiably obscure sensitive user data attributes, with a focus on intelligently adding noise when and where it is needed most to maximize privacy while minimizing usability impact. Our system is capable of flexibly adapting to the unique needs of each VR application to further optimize this trade-off. We implement our solution as a universal Unity (C#) plugin that we then evaluate using several popular VR applications. Upon faithfully replicating the most well-known VR privacy attack studies, we show a significant degradation of attacker capabilities when using our solution.