Pith. sign in

REVIEW 3 major objections 6 minor 66 references

Siren Song: Manipulating Pose Estimation in XR Headsets Using Acoustic Attacks

T0 review · 3 major / 6 minor · reviewed 2026-08-07 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read Playing a resonant tone near a moving XR headset can corrupt its IMU readings and force its pose estimate to snap back to the origin, which the paper reproduces on a real HoloLens 2 in four proof-of-concept UI attacks.

desk verdict First real acoustic IMU attack on a commercial XR headset with a genuine snapback demo; the vibration confound is real but fixable. read the letter →

arxiv 2502.08865 v2 pith:LRXPGFXC submitted 2025-02-13 cs.CR

Zijian Huang , Yicheng Zhang , Sophie Chen , Nael Abu-Ghazaleh , Jiasi Chen This is my paper · ORCID
classification cs.CR
keywords acousticinjectionattackMEMSIMUposeestimationSLAMXRheadsetsecuritysnapbackHoloLens2UImanipulation
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

This paper claims that a nearby speaker playing a resonant tone can corrupt the inertial measurement unit (IMU) of a commercial XR headset and, when the headset is moving, force its pose estimate to jump back to the origin—a 'snapback' the authors reproduce on a real HoloLens 2 with success rates above 90%. If true, an attacker who can play sound near a user can freeze or shift virtual content without touching the device, breaking input and perception in AR/VR applications. The authors demonstrate this end-to-end in four proof-of-concept scenarios: manipulating a user's input in a racing game, clickjacking a virtual keyboard, denying user interaction with an invisible or opaque wall, and invading a privacy zone by moving a virtual object into it. The practical stakes are that current out-of-band attack defenses based on software integrity do not stop a purely physical acoustic signal from reaching the sensor.

What carries the argument

The load-bearing mechanism is acoustic injection into the MEMS accelerometer and gyroscope: a tone near the sensor's resonant frequency drives the spring-mass element so that the IMU reports a false acceleration that is sampled as a constant bias (the output-biasing regime). The downstream trigger is the failure-recovery behavior of visual-inertial SLAM: when IMU and camera readings disagree enough, the estimator declares tracking lost and re-initializes the pose to the origin. The snapback is the combination of these two steps, and the paper's data-driven Gaussian mixture model of real perturbed readings shows that once the injected bias exceeds a threshold (about $6.1\ \mathrm{m/s^2}$), the reset reliably occurs in ORB-SLAM3, matching the observed snapback on the HoloLens 2.

What would settle it

Play the 2.6 kHz tone while a laser vibrometer measures the headset frame's physical acceleration, or repeat the experiment with the headset suspended on vibration-isolating mounts: if the frame genuinely moves with the tone, or if the pose reset disappears when the headset cannot shake, the mechanism is mechanical rather than electronic.

Watch

Extended reading notes

Core claim

The central discovery is that acoustic injection at the resonant frequency of a headset's accelerometer (about 2.6 kHz on the HoloLens 2) perturbs IMU readings enough that the visual-inertial SLAM system loses track and re-initializes its world frame to (0,0,0), an effect the paper calls 'snapback.' The reset occurs while the headset is moving, not when it is stationary, and it is triggered at the onset or termination of the tone; below roughly half the speaker's maximum volume the attack fails. Once the world frame resets, virtual objects that should be anchored to the real world become head-locked or drift by tens of centimeters, and the paper shows how these visual artifacts translate into four concrete UI attacks on a real headset. The paper also characterizes a 'misleading' offset effect in simulation on the open-source SLAM library ORB-SLAM3 and a 'drift away' effect in the ILLIXR testbed, showing that the visible outcome depends on how the SLAM implementation handles tracking failure.

Load-bearing premise

The paper assumes the snapback is caused by false electronic IMU readings induced by the sound, not by the sound physically shaking the headset or its mount; the 85 dB tone's mechanical effect on the device is never measured or excluded.

Editorial extensions

If this is right

  • An attacker with a speaker within 5–10 cm at about 85 dB can repeatedly re-zero a moving headset's pose, so virtual content can be held in front of the user regardless of real-world movement.
  • UI-level harms follow directly: input manipulation (a game object pinned to its start), clickjacking (a keyboard oscillating under the user's hand), denial of interaction (a wall tracking the head), and zone invasion (a virtual object moved into a protected space).
  • The attack succeeds only while the headset is moving; a stationary headset filters the acoustic perturbation, and volume must exceed a threshold around 50% of speaker maximum.
  • Background music at the same volume can mask the audible resonant tone without preventing the snapback, making the attack harder for a nearby user to notice.
  • The visual outcome is implementation-dependent: a SLAM that re-initializes to the origin produces snapback, while one that keeps integrating produces drift-away, so defenses must address the failure-recovery path, not just the sensor.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • If the mechanism is electronic IMU injection rather than physical vibration of the device, the same resonant-frequency probing could be applied to other headset models; the lack of an observable response on the Meta Quest 3 may mean its resonant frequencies or mounting differ, not that the attack class is closed.
  • The paper's clickjacking scenario hints that an attacker could synchronize acoustic bursts with keystroke-timing side channels to target password entry, a combination that would be far more potent than random drift.
  • A software defense not discussed in detail would be to validate pose resets against camera-only tracking or spatial anchors; our reading suggests such a check would neutralize the snapback effect, since the attack depends on trusting the re-initialized origin.
  • Replaying the experiment at lower volumes with the headset on a vibration-isolated mount would separate electronic injection from mechanical shaking, a distinction the paper does not make.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

3 major / 6 minor

Summary. The paper investigates acoustic injection attacks on the inertial measurement units (IMUs) of XR headsets. The authors first subject a stationary HoloLens 2 to frequency sweeps and identify resonant frequencies in the accelerometer and gyroscope readings. They then simulate the downstream effects of IMU perturbations on the open-source ORB-SLAM3 and ILLIXR systems, observing what they call “misleading,” “snapback,” and “drift away” behaviors. The central experimental claim is an end-to-end “snapback” attack on a real HoloLens 2 mounted on a remote-controlled car: a 2.6 kHz, 85 dB tone causes the headset’s estimated pose to reset to the origin, with reported success rates above 90%. The authors use this effect to demonstrate four proof-of-concept UI attacks: manipulating user input, clickjacking, denial of user interaction, and secure-zone invasion.

Significance. If the central claim is correct, this is a meaningful first demonstration of acoustic IMU injection against a commercial XR headset, with a clear downstream effect on rendered content and user interaction. The paper has several concrete strengths: it tests a real COTS device rather than only simulating; it reports a frequency sweep of the HoloLens 2 IMU; it reproduces a visual snapback effect on actual hardware; and it connects the effect to four application-level scenarios. The simulation work on ORB-SLAM3 and ILLIXR is a reasonable exploratory step, though, as discussed below, it is not an independent prediction of the real-device threshold. The main risk is that the real-device mechanism is not fully established: the snapback could in principle be caused by acoustic pressure physically shaking the headset or its RC-car mount rather than by electronically injected false IMU readings. This distinction matters for transferability to human-worn headsets and for the claimed threat mechanism.

major comments (3)
  1. [Section 5.2, Figure 12] The claimed mechanism—electronic injection of false IMU readings—is not distinguished from mechanical vibration of the headset or the RC-car platform. The headset was mounted on a toy car and driven forward while an 85 dB, 2.6 kHz tone was played, but no accelerometer or vibrometer measured motion of the headset or the car chassis during the attack. The observation that snapback occurs only while the platform is moving is equally consistent with acoustic pressure physically shaking the lightweight mount and producing genuine acceleration or camera motion that triggers tracking loss. Without a control measurement (for example, an off-resonance tone at the same sound pressure level, a rigidly damped mount, or direct chassis-vibration measurement), the attribution of the snapback to IMU electronic perturbation is not established. Section 6 lists limitations but does not address this confound.
  2. [Section 5.2, Figure 13] The central reliability claim of “success rates >90%” is not supported with enough statistical detail. Figure 13 reports data from only 5 trials per volume setting, and the text does not state the total number of trials used for the >90% figure, the definition of a successful trial, or any confidence interval. With n=5 per point, a reported success rate of 1.0 has a very wide binomial confidence interval, so the threshold behavior in Figure 13 should be presented with exact trial counts and per-condition results.
  3. [Section 4.1.3, Figure 8] The data-driven GMM simulation does not independently predict the snapback threshold. The accelerometer perturbation means are restricted to the range 0 to 6.1 m/s², and the snapback in Figure 8 is reported at a mean perturbation of exactly 6.1 m/s²—the same threshold that was already identified for constant perturbations in Section 4.1.1. The simulation therefore brackets a previously known threshold rather than validating the data-driven model as a predictive tool. The real-device demonstration in Section 5 is the stronger evidence, but the paper should not present the GMM simulation as independent confirmation of the threshold.
minor comments (6)
  1. [Section 4.2] The sentence “We inject the same two types of perturbation as in Section 4.2” should refer to Section 4.1, since Section 4.2 is the current section.
  2. [Section 3.2.1] “Stablizing” should be “Stabilizing” in the subsection heading and in the numbered list.
  3. [Figure 12 caption] The caption contains a duplicated word: “Example of of snapback effect.”
  4. [Section 6] The acknowledged limitation that the ultrasonic gyroscope attack was not demonstrated on a real headset should be reflected in the abstract and conclusion, which currently describe acoustic attacks on XR headsets generically; the demonstrated real-device effects use the audible accelerometer resonance.
  5. [Section 5.2] The paper should clarify whether the reported volume ratio of 1.0 corresponds to 85 dB measured at the headset or at the speaker, since this affects reproducibility.
  6. [Open Science Policy] The paper states a commitment to sharing code and data but does not provide a repository link or artifact availability information; adding one would support reproducibility.

Circularity Check

1 steps flagged · score 3.0 of 10

Simulated snapback threshold is inherited from the constant-bias experiment, but the HoloLens end-to-end result is independent.

  1. fitted input called prediction [Section 4.1.3, Data-Driven IMU Perturbations, Figure 8 discussion]
    "Based on the fit of the GMMs, we choose a plausible range of mean and standard deviation values for the perturbed IMU readings. Specifically, for the accelerometer, we set the standard deviation to 0.1 and the mean from 0 to 6.1m/s2 ... This more realistic model also exhibits the snapback effect from Section 4.1 and Figure 3: namely, when the magnitude of the perturbations exceeds a threshold (in the GMM case, a mean of 6.1 m/s2), the snapback effect occurs and the device re-initializes its pose to the origin."

    The 6.1 m/s² snapback threshold was already established in Section 4.1.1: 'when the perturbation is large (e.g., larger than 6.1m/s2 for the x-axis of the accelerometer ...), the device's estimated pose will go back to zero.' The GMM perturbation range is then deliberately truncated at exactly this threshold (mean from 0 to 6.1 m/s²), and the GMM samples are added to the same IMU trace as an additive bias plus noise. Thus the observation that snapback occurs for GMM means above 6.1 is not an independent prediction: it is the constant-bias experiment repeated with a small noise term, and the threshold was put into the input range rather than discovered from the data-driven model.

full rationale

The paper has one partially circular simulation-validation step: the data-driven GMM perturbation range is anchored to the constant-bias snapback threshold from Section 4.1.1, so the later claim that the realistic model also exhibits snapback at that threshold is largely a restatement of the input range rather than an independent confirmation. This does not undermine the paper's central real-world claim, because the HoloLens 2 snapback in Section 5.2 is measured directly on the device with >90% success rate and is not derived from the simulation; the four UI attacks are likewise empirical demonstrations. The self-citations in the paper (e.g., references [8] and [33]) appear only in a side-channel timing suggestion in Section 5.3.2 and in related-work context, so they are not load-bearing for the main result. The unmeasured mechanical-vibration confound in Section 5.2 is a correctness and validation gap rather than a circularity, and is therefore not scored as a circular step.

Assumptions & free parameters 6 free parameters · 5 assumptions · 0 invented entities

The central result rests on the known MEMS acoustic-injection model, transferability of measurements across devices, the representativeness of open-source SLAM failure modes for the closed-source HoloLens 2, and an unstated assumption that acoustic pressure does not mechanically move the device. These are domain assumptions rather than mathematical axioms, and none are fully verified inside the paper.

free parameters (6)
  • GMM perturbation std for accelerometer = 0.1 m/s^2
    Set in Section 4.1.3 as the perturbation spread for accelerometer readings when modeling acoustic attacks; fitted to HoloLens 2 IMU data but not validated on held-out or moving measurements.
  • GMM mean range for accelerometer = 0 to 6.1 m/s^2
    Chosen as the plausible range of perturbation means in the data-driven model; the upper bound 6.1 m/s^2 coincides with the ORB-SLAM3 snapback threshold, so the simulation range is conditioned on the effect it later reproduces.
  • GMM perturbation std for gyroscope = 0.1 rad/s
    Same as accelerometer std but applied to gyroscope readings in simulations; fitted to HoloLens 2 data.
  • GMM mean range for gyroscope = 0 to 1.6 rad/s
    Chosen as the plausible range of gyroscope perturbation means; the upper bound 1.6 rad/s matches the snapback threshold in ORB-SLAM3 simulation.
  • Constant accelerometer perturbation range = -g to +g (9.8 m/s^2)
    Used in Section 4.1.1 to simulate constant biases on accelerometer axes; range taken from prior work [46], not fitted here, but it bounds the misleading and snapback simulation.
  • Constant gyroscope perturbation range = -2 to +2 rad/s
    Used in Section 4.1.1 for gyroscope biases; range from prior work [46].
assumptions (5)
  • domain assumption The linear acoustic injection model (measured acceleration = true acceleration + attenuated acoustic component, Eq. 2) accurately describes IMU corruption on the tested headsets.
    Invoked in Section 3.2 to explain how resonant tones bias the IMU; the paper only verifies frequency-response spikes, not the full model.
  • domain assumption The resonant frequencies measured on a single HoloLens 2 unit transfer to other devices of the same model.
    Section 4.1.2 characterizes one headset; transferability is assumed from [9] and not tested across units.
  • domain assumption The GMM perturbation model fit to stationary headset readings represents perturbations during moving operation.
    Section 4.1.3 fits the GMM from stationary measurements, while Section 5.2 shows the attack only succeeds when the headset moves; the simulation may not capture moving-case dynamics.
  • domain assumption ORB-SLAM3 and OpenVINS failure-recovery behavior is representative of the closed-source HoloLens 2 tracking system.
    Sections 4.1 and 4.2 use open-source SLAM to explain the snapback observed on HoloLens 2 in Section 5.2, without internal access to the commercial implementation.
  • domain assumption The acoustic signal does not mechanically displace the headset or its mount in a way that confounds the IMU-injection explanation.
    Unstated in the paper; if the 85 dB sound vibrates the car or headset, the observed pose reset could be caused by real motion rather than false IMU readings.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Siren Song: Manipulating Pose Estimation in XR Headsets Using Acoustic Attacks." pith.science (2026). https://pith.science/paper/LRXPGFXC

@misc{pith2026250208865,
  author       = {Pith},
  title        = {Pith review of: Siren Song: Manipulating Pose Estimation in XR Headsets Using Acoustic Attacks},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/LRXPGFXC}},
  note         = {Machine review of arXiv:2502.08865}
}
read the original abstract

Extended Reality (XR) experiences involve interactions between users, the real world, and virtual content. A key step to enable these experiences is the XR headset sensing and estimating the user's pose in order to accurately place and render virtual content in the real world. XR headsets use multiple sensors (e.g., cameras, inertial measurement unit) to perform pose estimation and improve its robustness, but this provides an attack surface for adversaries to interfere with the pose estimation process. In this paper, we create and study the effects of acoustic attacks that create false signals in the inertial measurement unit (IMU) on XR headsets, leading to adverse downstream effects on XR applications. We generate resonant acoustic signals on a HoloLens 2 and measure the resulting perturbations in the IMU readings, and also demonstrate both fine-grained and coarse attacks on the popular ORB-SLAM3 and an open-source XR system (ILLIXR). With the knowledge gleaned from attacking these open-source frameworks, we demonstrate four end-to-end proof-of-concept attacks on a HoloLens 2: manipulating user input, clickjacking, zone invasion, and denial of user interaction. Our experiments show that current commercial XR headsets are susceptible to acoustic attacks, raising concerns for their security.

Figures

Figures reproduced from arXiv: 2502.08865 by the authors.

Figure 1
Figure 1. Scenario overview. An XR headset is subjected to [PITH_FULL_IMAGE:figures/full_fig_p002_1.png] view at source ↗
Figure 2
Figure 2. The coordinate systems of ORB-SLAM3 (left) and [PITH_FULL_IMAGE:figures/full_fig_p004_2.png] view at source ↗
Figure 3
Figure 3. Device pose estimated by ORB-SLAM3 under constant perturbation on the IMU readings. Legend denotes perturbation [PITH_FULL_IMAGE:figures/full_fig_p005_3.png] view at source ↗
Figures from the paper (12 more)
Figure 4
Figure 4. Figure 4: Detailed visualization of snapback attack in ORB-SLAM3. The acoustic attack ends at time=2 and snapback occurs. [PITH_FULL_IMAGE:figures/full_fig_p006_4.png]
Figure 5
Figure 5. Figure 5: Experimental setup with XR headset, speaker and [PITH_FULL_IMAGE:figures/full_fig_p006_5.png]
Figure 6
Figure 6. Figure 6: Frequency response of the Hololens 2 IMU. The red dashed line shows the resonant frequency where large changes in [PITH_FULL_IMAGE:figures/full_fig_p007_6.png]
Figure 7
Figure 7. Figure 7: Modeling the distribution of IMU sensor readings of [PITH_FULL_IMAGE:figures/full_fig_p007_7.png]
Figure 9
Figure 9. Figure 9: Device pose estimated by ILLIXR under constant [PITH_FULL_IMAGE:figures/full_fig_p008_9.png]
Figure 10
Figure 10. Figure 10: Visualization of drift away attack in ILLIXR (virtual cube flies away) when the device’s pose estimation does not reset to the origin to recover from tracking failure. ILLIXR uses OpenVINS [50], which does not re-initialize the device pose (i.e., reset the pose to (0,…
Figure 13
Figure 13. Figure 13: Impact of sound volume on attack success rate [PITH_FULL_IMAGE:figures/full_fig_p009_13.png]
Figure 14
Figure 14. Figure 14: Effect of snapback effect on rendered virtual con￾tent. Normally, the world coordinates (black axes) should remain fixed on the grass. Under acoustic attack, when the user (blue smiley) moves across the grass (blue dashed line), the world coordinates reset and cube re…
Figure 15
Figure 15. Figure 15: Manipulating user input attack. The top row shows the intended benign behavior of a virtual car driving forward, and [PITH_FULL_IMAGE:figures/full_fig_p011_15.png]
Figure 16
Figure 16. Figure 16: Clickjacking attack. In the benign case (top row), the keyboard remains mostly fixed in front of the user. In the attack [PITH_FULL_IMAGE:figures/full_fig_p011_16.png]
Figure 17
Figure 17. Figure 17: Denial of user interaction attack. In the benign case (top row), the user is able to move pats the red blocking wall to [PITH_FULL_IMAGE:figures/full_fig_p012_17.png]
Figure 18
Figure 18. Figure 18: Secure zone invasion attack. In the benign case (top row), the virtual bomb remains outside of the private zone. In the [PITH_FULL_IMAGE:figures/full_fig_p013_18.png]

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

66 extracted references · 58 canonical work pages

  1. [39]

    Stealthy and practical multi-modal attacks on mixed reality tracking,

    Y . Chandio, N. Bashir, and F. M. Anwar, “Stealthy and practical multi-modal attacks on mixed reality tracking,” in 2024 IEEE International Conference on Artificial Intelligence and eXtended and Virtual Reality (AIxVR). IEEE, 2024, pp. 11–20

    work page 2024

  2. [1]

    Securing augmented reality output,

    K. Lebeck, K. Ruth, T. Kohno, and F. Roesner, “Securing augmented reality output,” in IEEE S&P, 2017

    work page 2017

  3. [2]

    Secure multi-user content sharing for augmented reality applications,

    K. Ruth, T. Kohno, and F. Roesner, “Secure multi-user content sharing for augmented reality applications,” in USENIX Security, 2019

    work page 2019

  4. [3]

    Bystandar: Protecting bystander visual data in augmented reality systems,

    M. Corbett, B. David-John, J. Shang, Y . C. Hu, and B. Ji, “Bystandar: Protecting bystander visual data in augmented reality systems,” in Proceedings of the 21st Annual International Conference on Mobile Systems, Applications and Services, 2023, pp. 370–382

    work page 2023

  5. [4]

    Elic- iting security & privacy-informed sharing techniques for multi-user augmented reality,

    S. Rajaram, C. Chen, F. Roesner, and M. Nebeling, “Elic- iting security & privacy-informed sharing techniques for multi-user augmented reality,” in Proceedings of the 2023 CHI Conference on Human Factors in Computing Systems, 2023, pp. 1–17

    work page 2023

  6. [5]

    Reframe: An augmented reality storyboarding tool for character- driven analysis of security & privacy concerns,

    S. Rajaram, F. Roesner, and M. Nebeling, “Reframe: An augmented reality storyboarding tool for character- driven analysis of security & privacy concerns,” inPro- ceedings of the 36th Annual ACM Symposium on User Interface Software and Technology, 2023, pp. 1–15

    work page 2023

  7. [6]

    When the user is inside the user interface: An empirical study of ui security properties in augmented reality,

    K. Cheng, A. Bhattacharya, M. Lin, J. Lee, A. Kumar, J. F. Tian, T. Kohno, and F. Roesner, “When the user is inside the user interface: An empirical study of ui security properties in augmented reality,” in USENIX Security Symposium, 2024

    work page 2024

  8. [7]

    Explor- ing user reactions and mental models towards perceptual manipulation attacks in mixed reality,

    K. Cheng, J. F. Tian, T. Kohno, and F. Roesner, “Explor- ing user reactions and mental models towards perceptual manipulation attacks in mixed reality,” in32nd USENIX Security Symposium (USENIX Security 23) , 2023, pp. 911–928

    work page 2023

Show all 66 references
  1. [8]

    Going through the motions: AR/VR keylogging from user head motions,

    C. Slocum, Y . Zhang, N. Abu-Ghazaleh, and J. Chen, “Going through the motions: AR/VR keylogging from user head motions,” in USENIX Security, 2023

    2023

  2. [9]

    Walnut: Waging doubt on the integrity of mems ac- celerometers with acoustic injection attacks,

    T. Trippel, O. Weisse, W. Xu, P. Honeyman, and K. Fu, “Walnut: Waging doubt on the integrity of mems ac- celerometers with acoustic injection attacks,” in 2017 IEEE European symposium on security and privacy (Eu- roS&P). IEEE, 2017, pp. 3–18

    2017

  3. [10]

    Injected and delivered: Fabricating implicit control over actuation systems by spoofing inertial sensors,

    Y . Tu, Z. Lin, I. Lee, and X. Hei, “Injected and delivered: Fabricating implicit control over actuation systems by spoofing inertial sensors,” in 27th USENIX security sym- posium (USENIX Security 18), 2018, pp. 1545–1562

    2018

  4. [11]

    Controlling {UA Vs} with sensor input spoofing attacks,

    D. Davidson, H. Wu, R. Jellinek, V . Singh, and T. Risten- part, “Controlling {UA Vs} with sensor input spoofing attacks,” in 10th USENIX workshop on offensive tech- nologies (WOOT 16), 2016

    2016

  5. [12]

    Spoofing attack on ultrasonic distance sen- sors using a continuous signal,

    T. Gluck, M. Kravchik, S. Chocron, Y . Elovici, and A. Shabtai, “Spoofing attack on ultrasonic distance sen- sors using a continuous signal,” Sensors, vol. 20, no. 21, p. 6157, 2020

    2020

  6. [13]

    Rocking drones with intentional sound noise on gyroscopic sensors,

    Y . Son, H. Shin, D. Kim, Y . Park, J. Noh, K. Choi, J. Choi, and Y . Kim, “Rocking drones with intentional sound noise on gyroscopic sensors,” in 24th USENIX security symposium (USENIX Security 15) , 2015, pp. 881–896

    2015

  7. [14]

    Illixr: An open testbed to enable extended reality sys- tems research,

    M. Huzaifa, R. Desai, S. Grayson, X. Jiang, Y . Jing, J. Lee, F. Lu, Y . Pang, J. Ravichandran, F. Sinclairet al., “Illixr: An open testbed to enable extended reality sys- tems research,” IEEE Micro, vol. 42, no. 4, pp. 97–106, 2022

    2022

  8. [15]

    Orb-slam3: An accurate open-source library for visual, visual–inertial, and multimap slam,

    C. Campos, R. Elvira, J. J. G. Rodríguez, J. M. Montiel, and J. D. Tardós, “Orb-slam3: An accurate open-source library for visual, visual–inertial, and multimap slam,” IEEE Transactions on Robotics, vol. 37, no. 6, pp. 1874– 1890, 2021

    2021

  9. [16]

    Intriguing properties of neural networks,

    C. Szegedy, “Intriguing properties of neural networks,” arXiv preprint arXiv:1312.6199, 2013

    2013 arXiv

  10. [17]

    Towards evaluating the ro- bustness of neural networks,

    N. Carlini and D. Wagner, “Towards evaluating the ro- bustness of neural networks,” in2017 ieee symposium on security and privacy (sp). Ieee, 2017, pp. 39–57

    2017

  11. [18]

    Robust physical-world attacks on deep learning visual classifi- cation,

    K. Eykholt, I. Evtimov, E. Fernandes, B. Li, A. Rahmati, C. Xiao, A. Prakash, T. Kohno, and D. Song, “Robust physical-world attacks on deep learning visual classifi- cation,” in Proceedings of the IEEE conference on com- puter vision and pattern recognition, 2018, pp. 1625– 1634

    2018

  12. [19]

    Phys- ical adversarial examples for object detectors,

    D. Song, K. Eykholt, I. Evtimov, E. Fernandes, B. Li, A. Rahmati, F. Tramer, A. Prakash, and T. Kohno, “Phys- ical adversarial examples for object detectors,” in 12th USENIX workshop on offensive technologies (WOOT 18), 2018

    2018

  13. [20]

    Seeing isn’t believing: Towards more robust adversarial attack against real world object detectors,

    Y . Zhao, H. Zhu, R. Liang, Q. Shen, S. Zhang, and K. Chen, “Seeing isn’t believing: Towards more robust adversarial attack against real world object detectors,” in Proceedings of the 2019 ACM SIGSAC conference on computer and communications security , 2019, pp. 1989–2004

    2019

  14. [21]

    Adversarial camera stickers: A physical camera attack on deep learn- ing classifier,

    J. B. Li, F. R. Schmidt, and J. Z. Kolter, “Adversarial camera stickers: A physical camera attack on deep learn- ing classifier,” arXiv preprint arXiv:1904.00759, vol. 2, no. 2, 2019

    1904 arXiv

  15. [22]

    {GhostImage}: Remote perception attacks against camera-based image classi- fication systems,

    Y . Man, M. Li, and R. Gerdes, “{GhostImage}: Remote perception attacks against camera-based image classi- fication systems,” in 23rd International Symposium on 14 Research in Attacks, Intrusions and Defenses (RAID 2020), 2020, pp. 317–332

    2020

  16. [23]

    Accessorize to a crime: Real and stealthy attacks on state-of-the-art face recognition,

    M. Sharif, S. Bhagavatula, L. Bauer, and M. K. Reiter, “Accessorize to a crime: Real and stealthy attacks on state-of-the-art face recognition,” in Proceedings of the 2016 acm sigsac conference on computer and communi- cations security, 2016, pp. 1528–1540

    2016

  17. [24]

    Invisible mask: Practical attacks on face recognition with infrared,

    Z. Zhou, D. Tang, X. Wang, W. Han, X. Liu, and K. Zhang, “Invisible mask: Practical attacks on face recognition with infrared,” arXiv preprint arXiv:1803.04683, 2018

    2018 arXiv

  18. [25]

    Adversarial scan attack against scan matching algorithm for pose estima- tion in lidar-based slam,

    K. Yoshida, M. Hojo, and T. Fujino, “Adversarial scan attack against scan matching algorithm for pose estima- tion in lidar-based slam,”IEICE Transactions on Funda- mentals of Electronics, Communications and Computer Sciences, vol. 105, no. 3, pp. 326–335, 2022

    2022

  19. [26]

    Perceptual aliasing++: Adversarial attack for vi- sual slam front-end and back-end,

    M. H. Ikram, S. Khaliq, M. L. Anjum, and W. Hus- sain, “Perceptual aliasing++: Adversarial attack for vi- sual slam front-end and back-end,” IEEE Robotics and Automation Letters, vol. 7, no. 2, pp. 4670–4677, 2022

    2022

  20. [27]

    Adversary is on the road: Attacks on visual {SLAM} using unnotice- able adversarial patch,

    B. Chen, W. Wang, P. Sikorski, and T. Zhu, “Adversary is on the road: Attacks on visual {SLAM} using unnotice- able adversarial patch,” in 33rd USENIX Security Sym- posium (USENIX Security 24), 2024, pp. 6345–6362

    2024

  21. [28]

    I can see the light: Attacks on autonomous vehicles using invisible lights,

    W. Wang, Y . Yao, X. Liu, X. Li, P. Hao, and T. Zhu, “I can see the light: Attacks on autonomous vehicles using invisible lights,” in Proceedings of the 2021 ACM SIGSAC Conference on Computer and Communications Security, 2021, pp. 1930–1944

    2021

  22. [29]

    Sonic gun to smart devices: Your devices lose control under ultrasound/sound,

    Z. Wang, K. Wang, B. Yang, S. Li, and A. Pan, “Sonic gun to smart devices: Your devices lose control under ultrasound/sound,” Black Hat USA, pp. 1–50, 2017

    2017

  23. [30]

    Poltergeist: Acoustic adversarial machine learning against cameras and computer vision,

    X. Ji, Y . Cheng, Y . Zhang, K. Wang, C. Yan, W. Xu, and K. Fu, “Poltergeist: Acoustic adversarial machine learning against cameras and computer vision,” in 2021 IEEE Symposium on Security and Privacy (SP). IEEE, 2021, pp. 160–175

    2021

  24. [31]

    I know what you enter on gear vr,

    Z. Ling, Z. Li, C. Chen, J. Luo, W. Yu, and X. Fu, “I know what you enter on gear vr,” in 2019 IEEE Confer- ence on Communications and Network Security (CNS). IEEE, 2019, pp. 241–249

    2019

  25. [32]

    Unique identification of 50,000+ virtual reality users from head & hand motion data,

    V . Nair, W. Guo, J. Mattern, R. Wang, J. F. O’Brien, L. Rosenberg, and D. Song, “Unique identification of 50,000+ virtual reality users from head & hand motion data,” in USENIX Security, 2023

    2023

  26. [33]

    It’s all in your head(set): Side channel attacks on aug- mented reality systems,

    Y . Zhang, C. Slocum, J. Chen, and N. Abu-Ghazaleh, “It’s all in your head(set): Side channel attacks on aug- mented reality systems,” in USENIX Security, 2023

    2023

  27. [34]

    Arspy: Breaking location-based multi-player augmented reality applica- tion for user location tracking,

    J. Shang, S. Chen, J. Wu, and S. Yin, “Arspy: Breaking location-based multi-player augmented reality applica- tion for user location tracking,” IEEE Transactions on Mobile Computing, 2020

    2020

  28. [35]

    Dangers behind charging vr devices: Hidden side channel attacks via charging cables,

    J. Li, Y . Meng, Y . Zhan, L. Zhang, and H. Zhu, “Dangers behind charging vr devices: Hidden side channel attacks via charging cables,” IEEE Transactions on Information Forensics and Security, 2024

    2024

  29. [36]

    Vr-spy: A side- channel attack on virtual key-logging in vr headsets,

    A. Al Arafat, Z. Guo, and A. Awad, “Vr-spy: A side- channel attack on virtual key-logging in vr headsets,” in 2021 IEEE Virtual Reality and 3D User Interfaces (VR). IEEE, 2021, pp. 564–572

    2021

  30. [37]

    Remote keylogging attacks in multi-user vr applications,

    Z. Su, K. Cai, R. Beeler, L. Dresel, A. Garcia, I. Gr- ishchenko, Y . Tian, C. Kruegel, and G. Vigna, “Remote keylogging attacks in multi-user vr applications,” arXiv preprint arXiv:2405.14036, 2024

    2024 arXiv

  31. [38]

    That doesn’t go there: Attacks on shared state in {Multi-User} augmented reality appli- cations,

    C. Slocum, Y . Zhang, E. Shayegani, P. Zaree, N. Abu- Ghazaleh, and J. Chen, “That doesn’t go there: Attacks on shared state in {Multi-User} augmented reality appli- cations,” in33rd USENIX Security Symposium (USENIX Security 24), 2024, pp. 2761–2778

    2024

  32. [40]

    Gyrophone: Recognizing speech from gyroscope signals,

    Y . Michalevsky, D. Boneh, and G. Nakibly, “Gyrophone: Recognizing speech from gyroscope signals,” in 23rd USENIX Security Symposium (USENIX Security 14) , 2014, pp. 1053–1067

    2014

  33. [41]

    Practi- cality of accelerometer side channels on smartphones,

    A. J. Aviv, B. Sapp, M. Blaze, and J. M. Smith, “Practi- cality of accelerometer side channels on smartphones,” in Proceedings of the 28th annual computer security applications conference, 2012, pp. 41–50

    2012

  34. [42]

    Ac- cessory: password inference using accelerometers on smartphones,

    E. Owusu, J. Han, S. Das, A. Perrig, and J. Zhang, “Ac- cessory: password inference using accelerometers on smartphones,” in proceedings of the twelfth workshop on mobile computing systems & applications, 2012, pp. 1–6

    2012

  35. [43]

    Accelprint: Imperfections of accelerometers make smartphones trackable

    S. Dey, N. Roy, W. Xu, R. R. Choudhury, and S. Nelaku- diti, “Accelprint: Imperfections of accelerometers make smartphones trackable.” in NDSS, vol. 14. Citeseer, 2014, pp. 23–26

    2014

  36. [44]

    (sp) iphone: Decoding vibrations from nearby keyboards us- ing mobile phone accelerometers,

    P. Marquardt, A. Verma, H. Carter, and P. Traynor, “(sp) iphone: Decoding vibrations from nearby keyboards us- ing mobile phone accelerometers,” inProceedings of the 18th ACM conference on Computer and communications security, 2011, pp. 551–562. 15

    2011

  37. [45]

    Illixr: Enabling end-to-end extended reality research,

    M. Huzaifa, R. Desai, S. Grayson, X. Jiang, Y . Jing, J. Lee, F. Lu, Y . Pang, J. Ravichandran, F. Sinclairet al., “Illixr: Enabling end-to-end extended reality research,” in 2021 IEEE International Symposium on Workload Characterization (IISWC). IEEE, 2021, pp. 24–38

    2021

  38. [46]

    Un-rocking drones: Foundations of acoustic injection attacks and recovery thereof

    J. Jeong, D. Kim, J.-H. Jang, J. Noh, C. Song, and Y . Kim, “Un-rocking drones: Foundations of acoustic injection attacks and recovery thereof.” in NDSS, 2023

    2023

  39. [47]

    Apple vs. meta: A comparative study on spatial tracking in sota xr headsets,

    T. Hu, F. Yang, T. Scargill, and M. Gorlatova, “Apple vs. meta: A comparative study on spatial tracking in sota xr headsets,” Proceedings of ACM ImmerCom (co-located with ACM MobiCom), 2024

    2024

  40. [48]

    Hololens 2 research mode as a tool for computer vision research,

    D. Ungureanu, F. Bogo, S. Galliani, P. Sama, X. Duan, C. Meekhof, J. Stühmer, T. J. Cashman, B. Tekin, J. L. Schönberger et al., “Hololens 2 research mode as a tool for computer vision research,” arXiv preprint arXiv:2008.11239, 2020

    2008 arXiv

  41. [49]

    Hololens 2 sensor streaming,

    J. C. Dibene and E. Dunn, “Hololens 2 sensor streaming,” arXiv preprint arXiv:2211.02648, 2022

    2022 arXiv

  42. [50]

    Openvins: A research platform for visual-inertial esti- mation,

    P. Geneva, K. Eckenhoff, W. Lee, Y . Yang, and G. Huang, “Openvins: A research platform for visual-inertial esti- mation,” in 2020 IEEE International Conference on Robotics and Automation (ICRA) . IEEE, 2020, pp. 4666–4672

    2020

  43. [51]

    The euroc micro aerial vehicle datasets,

    M. Burri, J. Nikolic, P. Gohl, T. Schneider, J. Rehder, S. Omari, M. W. Achtelik, and R. Siegwart, “The euroc micro aerial vehicle datasets,” The International Journal of Robotics Research , 2016. [Online]. Avail- able: http://ijr.sagepub.com/content/early/2016/01/21/ 02783649...

    2016

  44. [52]

    Unity xr sdk,

    Unity, “Unity xr sdk,” https://docs.unity3d.com/Manual/ xr-sdk.html

  45. [53]

    Mixed Reality Toolkit,

    Microsoft, “Mixed Reality Toolkit,” https://github.com/ microsoft/MixedRealityToolkit-Unity, 2022

    2022

  46. [54]

    {AdCube}:{WebVR} ad fraud and practical confine- ment of {Third-Party} ads,

    H. Lee, J. Lee, D. Kim, S. Jana, I. Shin, and S. Son, “{AdCube}:{WebVR} ad fraud and practical confine- ment of {Third-Party} ads,” in 30th USENIX Secu- rity Symposium (USENIX Security 21), 2021, pp. 2543– 2560

    2021

  47. [55]

    Getting around hololens 2,

    Microsoft, “Getting around hololens 2,” https://docs. microsoft.com/en-us/hololens/hololens2-basic-usage, 2021

    2021

  48. [56]

    Ar overlay: Training image pose estimation on curved surface in a synthetic way,

    S. Huang, Y . Song, Y . Kang, and C. Yu, “Ar overlay: Training image pose estimation on curved surface in a synthetic way,”arXiv preprint arXiv:2409.14577, 2024

    2024 arXiv

  49. [57]

    Lobstar: Lan- guage model-based obstruction detection for augmented reality,

    Y . Xiu, T. Scargill, and M. Gorlatova, “Lobstar: Lan- guage model-based obstruction detection for augmented reality,” 2024

    2024

  50. [58]

    J. J. LaViola Jr, E. Kruijff, R. P. McMahan, D. Bow- man, and I. P. Poupyrev,3D user interfaces: theory and practice. Addison-Wesley Professional, 2017

    2017

  51. [59]

    Unity manual - shaders,

    Unity, “Unity manual - shaders,” https://docs.unity3d. com/Manual/Shaders.html, 2024

    2024

  52. [60]

    Tie memories to e-souvenirs: Hybrid tangible ar souvenirs in the museum,

    Y . Kang, Z. Zhang, M. Zhao, X. Yang, and X. Yang, “Tie memories to e-souvenirs: Hybrid tangible ar souvenirs in the museum,” in Adjunct Proceedings of the 35th Annual ACM Symposium on User Interface Software and Technology, 2022, pp. 1–3

    2022

  53. [61]

    Set up your boundary for meta quest,

    Meta, “Set up your boundary for meta quest,” https://www.meta.com/help/quest/articles/ in-vr-experiences/oculus-features/boundary/, 2024

    2024

  54. [62]

    Learning to explore using active neu- ral slam,

    D. S. Chaplot, D. Gandhi, S. Gupta, A. Gupta, and R. Salakhutdinov, “Learning to explore using active neu- ral slam,” arXiv preprint arXiv:2004.05155, 2020

    2004 arXiv

  55. [63]

    Neural slam: Learning to explore with external memory,

    J. Zhang, L. Tai, M. Liu, J. Boedecker, and W. Burgard, “Neural slam: Learning to explore with external memory,” arXiv preprint arXiv:1706.09520, 2017

    2017 arXiv

  56. [64]

    Loopy-slam: Dense neural slam with loop closures,

    L. Liso, E. Sandström, V . Yugay, L. Van Gool, and M. R. Oswald, “Loopy-slam: Dense neural slam with loop closures,” in Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, 2024, pp. 20 363–20 373

    2024

  57. [65]

    Adc-bank: Detecting acoustic out-of-band signal injection on inertial sensors,

    J. Zhang, Y . Wang, Y . Tu, S. Rampazzi, Z. Lin, I. Lee, and X. Hei, “Adc-bank: Detecting acoustic out-of-band signal injection on inertial sensors,” in International Conference on Security and Privacy in Cyber-Physical Systems and Smart Vehicles. Springer, 2023, pp. 53–72

    2023

  58. [66]

    Microsoft azure spatial anchors,

    Microsoft, “Microsoft azure spatial anchors,” https:// azure.microsoft.com/en-us/services/spatial-anchors/, ac- cessed: 2024-11-12. 16 8 Ethics Considerations and Compliance with Open Science Policy Research ethics. All experiments in this paper were con- ducted on a private t...

    2024

Pith tools

Reviewed August 7, 2026 · model on record in the stance chip above.