When VR Meets BCI: (Un)Observable Brainwave-aware Privacy Reconstruction in the Metaverse via Unrestricted Inbuilt Motion Sensors

2026-06-09

AI Summary

This study addresses a critical gap in existing VR privacy research, which has predominantly focused on observable user behaviors while overlooking the potential leakage of non-observable neuro-perceptual information through device sensors. The authors propose BraVeSpy, a novel system that leverages built-in motion sensors in VR headsets to capture micro-vibrations induced by pupillary responses. By integrating advanced signal processing and machine learning techniques, BraVeSpy reconstructs electroencephalographic representations highly correlated with visual stimuli. This approach transcends conventional privacy attack paradigms, achieving 52.0%–67.2% accuracy in perceptual image reconstruction and exceeding 85.0% and 96.0% accuracy in tasks such as website/application identification, user de-anonymization, gaze tracking, and virtual keystroke inference. The findings uncover a previously unrecognized risk of deep neuro-perceptual privacy leakage in the metaverse.

Abstract

Metaverse devices, such as virtual reality (VR), have seen substantial development and widespread applications in numerous areas. Although recent studies have revealed privacy leakages in VR, these vulnerabilities were limited in the scope of observable behaviors in virtual scenes (e.g., what a user is seeing). In this work, we uncover the feasibility of going beyond the scope of observable user behaviors to unobservable brain EEG-correlated representations (e.g., what a user is perceiving) by leveraging unrestricted motion sensors in VR headsets to reconstruct brain EEG signals, a seemingly neglected but promising vector. The insight is that the inbuilt motion sensors (e.g., accelerometers) in the VR headset can capture subtle vibrations induced by pupillary responses, which are highly correlated with users' visual stimuli and in-brain perceptions. Therefore, we design and implement BraVeSpy to systematically investigate and demonstrate the feasibility of this severe privacy leakage originating from brain EEG-correlated representations reconstructed from variations of inbuilt motion sensors. Our extensive evaluation results from different VR devices show that BraVeSpy, for the first time in the Metaverse, can reveal unobservable privacy, where we successfully unveiled perceptive images in the brain with 52.0%-67.2% accuracy. In particular, we also find that BraVeSpy outperforms the current approaches that are limited to coarse-grained inference of observable behaviors and achieves over 85.0% accuracy in inferring user activity-related sensitive information, such as fingerprinting websites, apps, and streaming videos, and over 96.0% accuracy in user de-anonymization, gaze movement tracking, and virtual keystroke inference.

Problem

• privacy leakage
• brainwave reconstruction
• motion sensors
• Metaverse
• EEG-correlated representations

Innovation

• brainwave-aware privacy
• motion sensor exploitation
• EEG signal reconstruction
• Metaverse security
• unobservable behavior inference