[VRST2025] Motion Forecasting Attacks on Behavioral Biometric Authentication Systems in Virtual Reality

Inspired by behavioral biometrics for keystroke and touch-based systems, a large body of work has emerged over the past decade on using user behavior in VR applications as a signature of the genuine user. Recent work on forecasting approaches for behavioral biometrics for VR helps address a key challenge in existing approaches where complete user movement signatures are needed to authenticate the user. Forecasting-based approaches enable VR authentication systems to use limited user behavior data and forecast future movement trajectories. However, forecasting-based approaches present a new concern where malicious users can exploit the predictability of user motions to launch an attack. In this paper, we present the first forecasting-based attack model against VR authentication systems that rely on behavioral biometrics. We propose a two-phase approach to assess both authentication performance and adversarial risk. Phase 1 develops a Fully Convolutional Network for authentication using VR motion data, evaluating Adam and SGD optimizers with Equal Error Rate (EER) as the primary metric. Phase 2 introduces a forecasting attack, where partial motion sequences are used to generate realistic future trajectories using a Transformer model to deceive the authentication system. Experimental results demonstrate the attack’s effectiveness, achieving an EER as low as 0.0346, exposing security risks in motion-based authentication. These findings underscore the urgent need for robust countermeasures to defend against predictive motion attacks in VR environments.

If you find our work helpful please cite us: To appear

Installation

Code tested using Ubutnu 20.04 and python 3.8.

We recommend using virtualenv. The following snippet will create a new virtual environment, activate it, and install deps.

sudo apt-get install virtualenv && \
virtualenv -p python venv && \
source venv/bin/activate && \
git clone https://github.com/Terascale-All-sensing-Research-Studio/motion_forecasting_VR_attacks.git && \
pip install -r requirements.txt

Building the dataset for training

cd python
python beta_stage1_dataset_build_3groups.py

Note that you will need to change the output path in code.

Models for stage 1

cd python
python beta_stage1_train.py --data_in <input_data_path> --out_root <output_directory> -l --model <FCN/TF> --optimizer <optimizer> --lr <learning_rate> --batch_size <batch_size> --ws <window_size>

Models for stage 2

cd python
python beta_stage2_train.py --rep <replication_id> --batch_size <batch_size> --model <FCN/TF> --optimizer <optimizer> --lr <learning_rate> --seq_len <seq_len> --label_len <label_len> --pred_len <pred_len> --gpu <gpu_ID>

Use the flag -l if save the log file for all the above training procedures.