Recognition: unknown
Secure Storage and Privacy-Preserving Scanpath Comparison via Garbled Circuits in Eye Tracking
Pith reviewed 2026-05-10 02:45 UTC · model grok-4.3
The pith
Garbled circuits enable privacy-preserving comparison and storage of eye-tracking scanpaths.
A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.
Core claim
A garbled-circuit protocol supports secure storage of scanpaths and privacy-preserving computation of their similarity under the semi-honest model, with two configurations allowing either joint two-party evaluation or offline server processing, and evaluations on three datasets demonstrating close fidelity to plaintext results for the MultiMatch, ScanMatch, and SubsMatch metrics.
What carries the argument
Garbled circuits that wrap the scanpath comparison functions so all operations occur on encrypted data.
If this is right
- Similarity scores are obtained without any party learning the other's scanpath.
- Encrypted scanpaths remain usable for comparison even after the owner goes offline.
- The protocol incurs manageable runtime and communication costs on standard eye-tracking datasets.
- The same technique can support other garbled-circuit behavioral analysis methods.
Where Pith is reading between the lines
- The server-assisted mode could integrate with cloud services that handle gaze data from consumer devices.
- Similar secure-computation wrappers might apply to other forms of sequential behavioral data beyond eye movements.
Load-bearing premise
The semi-honest model is enough to protect privacy and the garbled-circuit implementation reproduces the original scanpath metrics without meaningful error.
What would settle it
A direct test on known scanpath pairs where the garbled-circuit similarity score differs from the plaintext score by more than floating-point precision would disprove fidelity.
Figures
read the original abstract
With the growing use of eye tracking on VR and mobile platforms, gaze data is increasing. While scanpath comparison is important to gaze behavior analysis, existing methods lack privacy-preserving capabilities for real-world use. We present a garbled-circuit (GC)-based approach enabling secure storage and privacy-preserving scanpath comparison under the semi-honest model. It supports two configurations: (1) a two-party setting where the data owner and processor jointly compute similarity scores without revealing their inputs, and (2) a server-assisted setting where encrypted scanpaths are stored and processed while the data owner remains offline. All decryption and comparison operations are executed inside the GC. Experiments on three eye-tracking datasets evaluate fidelity, runtime, and communication, and show secure results for MultiMatch, ScanMatch, and SubsMatch closely match plaintext outcomes, with manageable runtime and communication overhead. Tests under various network conditions indicate that the design remains feasible for real-world privacy-preserving scanpath analysis and can be extended to other GC-based behavioral algorithms.
Editorial analysis
A structured set of objections, weighed in public.
Referee Report
Summary. The manuscript proposes a garbled-circuit (GC) construction for privacy-preserving scanpath comparison and secure storage of eye-tracking data under the semi-honest model. It defines two protocols: a two-party setting in which a data owner and processor jointly evaluate similarity without revealing inputs, and a server-assisted setting in which encrypted scanpaths are stored and compared while the owner remains offline. All decryption and comparison steps occur inside the GC. Experiments on three eye-tracking datasets evaluate MultiMatch, ScanMatch, and SubsMatch, reporting that secure outputs match plaintext results within stated tolerances, with quantified runtime, communication, and network-condition overheads.
Significance. If the constructions and empirical results hold, the work supplies a practical, standards-based (Yao GC + OT) solution to a real privacy need in VR and mobile eye tracking. The explicit fidelity measurements, dual deployment configurations, and reported performance numbers under realistic networks constitute concrete, falsifiable evidence that could support adoption and extension to other GC-based behavioral metrics.
minor comments (2)
- Abstract: the phrase 'closely match plaintext outcomes' is not accompanied by the concrete error tolerances or statistical tests used in the experiments; adding these numbers would allow readers to assess the fidelity claim immediately.
- The security argument relies on the standard semi-honest GC properties; a short paragraph clarifying why this model suffices for the intended eye-tracking use cases (e.g., no discussion of malicious server behavior) would improve completeness without altering the technical contribution.
Simulated Author's Rebuttal
We thank the referee for the positive summary, significance assessment, and recommendation of minor revision. We are pleased that the garbled-circuit constructions, dual deployment settings, fidelity measurements, and performance results under realistic network conditions are recognized as providing concrete, falsifiable evidence for practical adoption in VR and mobile eye-tracking scenarios.
Circularity Check
No significant circularity detected
full rationale
The manuscript constructs a new garbled-circuit protocol for secure scanpath comparison by directly encoding the MultiMatch, ScanMatch, and SubsMatch algorithms inside standard Yao GC plus OT under the semi-honest model. All load-bearing steps are explicit circuit realizations whose correctness is verified by experimental fidelity checks against plaintext execution on three datasets; no step reduces by definition to its own output, no fitted parameter is relabeled as a prediction, and no uniqueness theorem or ansatz is imported via self-citation. The two-party and server-assisted configurations are specified from first principles of GC, making the derivation self-contained against external cryptographic benchmarks.
Axiom & Free-Parameter Ledger
axioms (1)
- domain assumption Semi-honest adversary model
Reference graph
Works this paper leans on
-
[1]
Technical Report
2025.Cryptographic Mechanisms: Recommendations and Key Lengths, BSI TR-02102-1. Technical Report. Federal Office for Information Security (BSI). https://www.bsi.bund.de/SharedDocs/Downloads/EN/BSI/Publications/TechGuidelines/ TG02102/BSI-TR-02102-1.pdf?__blob=publicationFile&v=9 Yasmeen Abdrabou, Süleyman Özdel, Virmarie Maquiling, Efe Bozkir, and Enkelej...
2025
-
[2]
InProceedings of the 2025 Symposium on Eye Tracking Research and Applications
From Gaze to Data: Privacy and Societal Challenges of Using Eye-tracking Data to Inform GenAI Models. InProceedings of the 2025 Symposium on Eye Tracking Research and Applications. ACM, 109:1–109:9. doi:10.1145/3715669.3726788 Isayas Berhe Adhanom, Paul MacNeilage, and Eelke Folmer
-
[3]
Ioannis Agtzidis, Mikhail Startsev, and Michael Dorr
Eye tracking in virtual reality: a broad review of applications and challenges.Virtual Reality27, 2 (2023), 1481–1505. Ioannis Agtzidis, Mikhail Startsev, and Michael Dorr. 2019a.360EM: Ground-truth eye movement dataset for 360-degree videos. https://gin.g-node.org/ioannis.agtzidis/360_em_dataset Accessed: 2026-01-23. Ioannis Agtzidis, Mikhail Startsev, a...
-
[4]
Nicola C Anderson, Walter F Bischof, Kaitlin EW Laidlaw, Evan F Risko, and Alan Kingstone
A comparison of scanpath comparison methods.Behavior research methods47 (2015), 1377–1392. Nicola C Anderson, Walter F Bischof, Kaitlin EW Laidlaw, Evan F Risko, and Alan Kingstone
2015
-
[5]
Gennady Andrienko, Natalia Andrienko, Michael Burch, and Daniel Weiskopf
Recurrence quantification analysis of eye movements.Behavior research methods45, 3 (2013), 842–856. Gennady Andrienko, Natalia Andrienko, Michael Burch, and Daniel Weiskopf
2013
-
[6]
Visual analytics methodology for eye movement studies.IEEE transactions on Visualization and Computer Graphics18, 12 (2012), 2889–2898. Elaine Barker and Allen Roginsky. 2024.Transitioning the Use of Cryptographic Algorithms and Key Lengths, SP 800-131A Revision 3 (Initial Public Draft). Technical Report. National Institute of Standards and Technology. do...
-
[7]
Foundations of garbled circuits. InProceedings of the 2012 ACM Conference on Computer and Communications Security(Raleigh, North Carolina, USA)(CCS ’12). Association for Computing Machinery, New York, NY, USA, 784–796. doi:10.1145/2382196.2382279 Michael Ben-Or, Shafi Goldwasser, and Avi Wigderson
-
[8]
Ali Borji and Laurent Itti
Understanding which cues people use to identify influencer marketing on Instagram: an eye tracking study and experiment.International Journal of Advertising41, 1 (2022), 6–29. Ali Borji and Laurent Itti
2022
-
[9]
Efe Bozkir, Onur Günlü, Wolfgang Fuhl, Rafael F
Defending Yarbus: Eye movements reveal observers’ task.Journal of vision14, 3 (2014), 29–29. Efe Bozkir, Onur Günlü, Wolfgang Fuhl, Rafael F. Schaefer, and Enkelejda Kasneci
2014
-
[10]
doi:10.1371/journal.pone.0255979 Proc
Differential privacy for eye tracking with temporal correlations.PLOS ONE16, 8 (2021), 1–22. doi:10.1371/journal.pone.0255979 Proc. ACM Hum.-Comput. Interact., Vol. 10, No. 3, Article ETRA008. Publication date: May
-
[11]
Efe Bozkir, Ali Burak Ünal, Mete Akgün, Enkelejda Kasneci, and Nico Pfeifer
Eye-tracked virtual reality: A comprehensive survey on methods and privacy challenges.arXiv preprint arXiv:2305.14080(2023). Efe Bozkir, Ali Burak Ünal, Mete Akgün, Enkelejda Kasneci, and Nico Pfeifer
-
[12]
InACM Symposium on Eye Tracking Research and Applications
Privacy Preserving Gaze Estimation Using Synthetic Images via a Randomized Encoding Based Framework. InACM Symposium on Eye Tracking Research and Applications. ACM. doi:10.1145/3379156.3391364 Andreas Bulling and Michel Wedel
-
[13]
InProceedings of the 2018 ACM Symposium on Eye Tracking Research & Applications
Scanpath comparison in medical image reading skills of dental students: distinguishing stages of expertise development. InProceedings of the 2018 ACM Symposium on Eye Tracking Research & Applications. 1–9. Nora Castner, Thomas C Kuebler, Katharina Scheiter, Juliane Richter, Thérése Eder, Fabian Hüttig, Constanze Keutel, and Enkelejda Kasneci
2018
-
[14]
Seung Geol Choi, Ariel Elbaz, Ari Juels, Tal Malkin, and Moti Yung
Social attention in ASD: A review and meta-analysis of eye-tracking studies.Research in developmental disabilities48 (2016), 79–93. Seung Geol Choi, Ariel Elbaz, Ari Juels, Tal Malkin, and Moti Yung
2016
-
[15]
Joan Daemen and Vincent Rijmen
ScanMatch: A novel method for comparing fixation sequences.Behavior research methods42 (2010), 692–700. Joan Daemen and Vincent Rijmen
2010
-
[16]
AES proposal: Rijndael. (1999). Ivan Damgård, Valerio Pastro, Nigel Smart, and Sarah Zakarias
1999
-
[17]
In 2022 Symposium on Eye Tracking Research and Applications
For Your Eyes Only: Privacy-Preserving Eye-Tracking Datasets. In 2022 Symposium on Eye Tracking Research and Applications. ACM. doi:10.1145/3517031.3529618 Brendan David-John, Kevin Butler, and Eakta Jain
-
[18]
Privacy-preserving datasets of eye-tracking samples with applica- tions in XR.IEEE Transactions on Visualization and Computer Graphics29, 5 (2023), 2774–2784. doi:10.1109/TVCG.2023. 3247048 Brendan David-John, Diane Hosfelt, Kevin Butler, and Eakta Jain
-
[19]
Richard Dewhurst, Marcus Nyström, Halszka Jarodzka, Tom Foulsham, Roger Johansson, and Kenneth Holmqvist
A privacy-preserving approach to streaming eye-tracking data.IEEE Transactions on Visualization and Computer Graphics27, 5 (2021), 2555–2565. Richard Dewhurst, Marcus Nyström, Halszka Jarodzka, Tom Foulsham, Roger Johansson, and Kenneth Holmqvist
2021
-
[20]
Behavior Research Methods44, 4 (2012), 1079–1100
It depends on how you look at it: Scanpath comparison in multiple dimensions with MultiMatch, a vector-based approach. Behavior Research Methods44, 4 (2012), 1079–1100. doi:10.3758/s13428-012-0212-2 Morris Dworkin
-
[21]
Mayar Elfares, Zhiming Hu, Pascal Reisert, Andreas Bulling, and Ralf Küsters
Recommendation for block cipher modes of operation.NIST special publication800 (2001), 38B. Mayar Elfares, Zhiming Hu, Pascal Reisert, Andreas Bulling, and Ralf Küsters
2001
-
[22]
Mayar Elfares, Pascal Reisert, Ralf Küsters, and Andreas Bulling
PrivatEyes: appearance- based gaze estimation using federated secure multi-party computation.Proceedings of the ACM on Human-Computer Interaction8, ETRA (2024), 1–23. Mayar Elfares, Pascal Reisert, Ralf Küsters, and Andreas Bulling
2024
-
[23]
David Evans, Vladimir Kolesnikov, and Mike Rosulek
QualitEye: Public and Privacy-preserving Gaze Data Quality Verification.arXiv preprint arXiv:2506.05908(2025). David Evans, Vladimir Kolesnikov, and Mike Rosulek
-
[24]
A Pragmatic Introduction to Secure Multi-Party Computation. Found. Trends Priv. Secur.2, 2–3 (Dec. 2018), 70–246. doi:10.1561/3300000019 Shimon Even, Oded Goldreich, and Abraham Lempel
-
[25]
ACM 28, 6 (1985), 637–647
A randomized protocol for signing contracts.Commun. ACM 28, 6 (1985), 637–647. Tom Foulsham, Richard Dewhurst, Marcus Nyström, Halszka Jarodzka, Roger Johansson, Geoffrey Underwood, and Kenneth Holmqvist
1985
-
[26]
Wolfgang Fuhl, Efe Bozkir, and Enkelejda Kasneci
Comparing scanpaths during scene encoding and recognition: A multi-dimensional approach.Journal of Eye Movement Research5, 4 (2012). Wolfgang Fuhl, Efe Bozkir, and Enkelejda Kasneci
2012
-
[27]
InProceedings of the 2019 ACM SIGSAC Conference on Cloud Computing Security Workshop
Secure data exchange: A marketplace in the cloud. InProceedings of the 2019 ACM SIGSAC Conference on Cloud Computing Security Workshop. 117–128. O. Goldreich, S. Micali, and A. Wigderson
2019
-
[28]
How to play ANY mental game. InProceedings of the Nineteenth Annual ACM Symposium on Theory of Computing(New York, New York, USA)(STOC ’87). Association for Computing Machinery, New York, NY, USA, 218–229. doi:10.1145/28395.28420 Proc. ACM Hum.-Comput. Interact., Vol. 10, No. 3, Article ETRA008. Publication date: May
-
[29]
Body mass index moderates gaze orienting biases and pupil diameter to high and low calorie food images.Appetite56, 3 (2011), 577–586. doi:10.1016/j.appet.2011.01. 029 Inken Hagestedt, Michael Backes, and Andreas Bulling
-
[30]
In2011 International joint conference on biometrics (IJCB)
Biometric identification via eye movement scanpaths in reading. In2011 International joint conference on biometrics (IJCB). IEEE, 1–8. Zhiming Hu, Andreas Bulling, Sheng Li, and Guoping Wang. 2021a.EHTask Dataset: Eye and head movement recordings for task recognition in immersive VR. https://zhiminghu.net/hu22_ehtask.html Accessed: 2026-01-23. Zhiming Hu,...
2026
-
[31]
InProceedings of the 2010 symposium on eye-tracking research & applications
A vector-based, multidimensional scanpath similarity measure. InProceedings of the 2010 symposium on eye-tracking research & applications. 211–218. Somesh Jha, Luis Kruger, and Patrick McDaniel
2010
-
[32]
Krzysztof Krejtz, Andrew T Duchowski, Anna Niedzielska, Cezary Biele, and Izabela Krejtz
Using eye-tracking in education: review of empirical research and technology.Educational technology research and development72, 3 (2024), 1383–1418. Krzysztof Krejtz, Andrew T Duchowski, Anna Niedzielska, Cezary Biele, and Izabela Krejtz
2024
-
[33]
Jacob Leon Kröger, Otto Hans-Martin Lutz, and Florian Müller
Eye tracking cognitive load using pupil diameter and microsaccades with fixed gaze.PloS one13, 9 (2018), e0203629. Jacob Leon Kröger, Otto Hans-Martin Lutz, and Florian Müller. 2020.What Does Your Gaze Reveal About You? On the Privacy Implications of Eye Tracking. Springer International Publishing, 226–241. doi:10.1007/978-3-030-42504-3_15 Thomas C. Küble...
-
[34]
InProceedings of the Symposium on Eye Tracking Research and Applications
SubsMatch: Scanpath similarity in dynamic scenes based on subsequence frequencies. InProceedings of the Symposium on Eye Tracking Research and Applications. ACM, 319–326. doi:10.1145/2578153.2578206 Jingjie Li, Amrita Roy Chowdhury, Kassem Fawaz, and Younghyun Kim
-
[35]
Privacy Considerations for a Pervasive Eye Tracking World. InProceedings of the 2014 ACM International Joint Conference on Pervasive and Ubiquitous Computing: Adjunct Publication. ACM, 1169–1177. doi:10.1145/2638728.2641688 Yehuda Lindell and Benny Pinkas
-
[36]
Ao Liu, Lirong Xia, Andrew Duchowski, Reynold Bailey, Kenneth Holmqvist, and Eakta Jain
A proof of security of Yao’s protocol for two-party computation.Journal of cryptology22, 2 (2009), 161–188. Ao Liu, Lirong Xia, Andrew Duchowski, Reynold Bailey, Kenneth Holmqvist, and Eakta Jain
2009
-
[37]
InProceedings of the 11th ACM Symposium on Eye Tracking Research & Applications
Differential Privacy for Eye-Tracking Data. InProceedings of the 11th ACM Symposium on Eye Tracking Research & Applications. ACM. doi:10.1145/3314111.3319823 Nathan Manohar, Abhishek Jain, and Amit Sahai
-
[38]
Saul B Needleman and Christian D Wunsch
Self-processing private sensor data via garbled encryption.Proceedings on Privacy Enhancing Technologies(2020). Saul B Needleman and Christian D Wunsch
2020
-
[39]
Jakub Štěpán Novák, Jan Masner, Petr Benda, Pavel Šimek, and Vojtěch Merunka
A general method applicable to the search for similarities in the amino acid sequence of two proteins.Journal of molecular biology48, 3 (1970), 443–453. Jakub Štěpán Novák, Jan Masner, Petr Benda, Pavel Šimek, and Vojtěch Merunka
1970
-
[40]
Marcus Nyström and Kenneth Holmqvist
Eye tracking, usability, and user experience: A systematic review.International Journal of Human–Computer Interaction40, 17 (2024), 4484–4500. Marcus Nyström and Kenneth Holmqvist
2024
-
[41]
Suleyman Ozdel, Efe Bozkir, and Enkelejda Kasneci
An adaptive algorithm for fixation, saccade, and glissade detection in eyetracking data.Behavior research methods42, 1 (2010), 188–204. Suleyman Ozdel, Efe Bozkir, and Enkelejda Kasneci
2010
-
[42]
doi:10.1145/3655605 Suleyman Ozdel, Can Sarpkaya, Efe Bozkir, Hong Gao, and Enkelejda Kasneci
Privacy-preserving scanpath comparison for pervasive eye tracking.Proceedings of the ACM on Human-Computer Interaction8, ETRA (2024), 1–28. doi:10.1145/3655605 Suleyman Ozdel, Can Sarpkaya, Efe Bozkir, Hong Gao, and Enkelejda Kasneci
-
[43]
Examining the Role of LLM-Driven Interactions on Attention and Cognitive Engagement in Virtual Classrooms.arXiv preprint arXiv:2505.07377(2025). Rishabh Poddar. 2020.Secure Computation Systems for Confidential Data Analysis. Ph. D. Dissertation. University of California, Berkeley. Yashas Rai, Jesús Gutiérrez, and Patrick Le Callet. 2017a. A dataset of hea...
-
[44]
ETRA008:18 Suleyman Ozdel, Amr Nader, Yasmeen Abdrabou, and Enkelejda Kasneci Yashas Rai, Patrick Le Callet, and Philippe Guillotel. 2017b. Which saliency weighting for omni directional image quality assessment?. In2017 Ninth International Conference on Quality of Multimedia Experience (QoMEX). IEEE, 1–6. Yashas Rai, Patrick Le Callet, and Philippe Guillo...
-
[45]
ACM22, 11 (1979), 612–613
How to share a secret.Commun. ACM22, 11 (1979), 612–613. Malte Sönnichsen, Mayar Elfares, Yao Wang, Ralf Küsters, Alina Roitberg, and Andreas Bulling
1979
-
[46]
InProceedings of the 2024 Symposium on Eye Tracking Research and Applications
Using gaze transition entropy to detect classroom discourse in a virtual reality classroom. InProceedings of the 2024 Symposium on Eye Tracking Research and Applications. 1–11. Julian Steil, Inken Hagestedt, Michael Xuelin Huang, and Andreas Bulling. 2019a. Privacy-aware eye tracking using differential privacy. InProceedings of the 11th ACM Symposium on E...
-
[47]
multimatch-gaze: The MultiMatch algorithm for gaze path comparison in Python.Journal of Open Source Software4, 40 (2019),
2019
-
[48]
doi:10.1080/00224499.2015.1107524 Zoe Xi and William Kuszmaul
Video-Based Eye Tracking in Sex Research: A Systematic Literature Review.The Journal of Sex Research53, 8 (2016), 1008–1019. doi:10.1080/00224499.2015.1107524 Zoe Xi and William Kuszmaul
-
[49]
244), Shiri Chechik, Gonzalo Navarro, Eva Rotenberg, and Grzegorz Herman (Eds.)
(Leibniz International Proceedings in Informatics (LIPIcs), Vol. 244), Shiri Chechik, Gonzalo Navarro, Eva Rotenberg, and Grzegorz Herman (Eds.). Schloss Dagstuhl – Leibniz-Zentrum für Informatik, Dagstuhl, Germany, 90:1–90:19. doi:10.4230/LIPIcs.ESA.2022.90 Andrew C. Yao
-
[50]
Protocols for secure computations. In23rd Annual Symposium on Foundations of Computer Science (sfcs 1982). 160–164. doi:10.1109/SFCS.1982.38 Andrew Chi-Chih Yao
-
[51]
In27th Annual Symposium on Foundations of Computer Science (sfcs 1986)
How to generate and exchange secrets. In27th Annual Symposium on Foundations of Computer Science (sfcs 1986). 162–167. doi:10.1109/SFCS.1986.25 Proc. ACM Hum.-Comput. Interact., Vol. 10, No. 3, Article ETRA008. Publication date: May
-
[52]
Secure Storage and Privacy-Preserving Scanpath Comparison via Garbled Circuits in Eye Tracking ETRA008:21 C Appendix: Security Proofs C.1 Two-party setting (standard Yao + OT) The two-party protocols forScanMatch,SubsMatch, andMultiMatchin Section 4.2 follow the standard Yao garbled-circuit protocol with OT for evaluator inputs. Under the standard semi- h...
1985
-
[53]
Secure Storage and Privacy-Preserving Scanpath Comparison via Garbled Circuits in Eye Tracking ETRA008:23 party’s full local view (its input, random coins, and all received messages) in a real execution of Πsrv. Case 1: Server corrupted (Bob honest).The server’s real view consists of its stored state (𝐸,CT 𝑆,HEADER, 𝑇 , 𝑅, 𝑝𝑘𝐴), its garbling randomness, t...
2009
-
[54]
For multiple stored items/queries, the above argument applies record-by-record, since each record uses an independently sampled mask𝑅 𝑖 and masked key𝑀 𝑖
ETRA008:24 Suleyman Ozdel, Amr Nader, Yasmeen Abdrabou, and Enkelejda Kasneci masked key share 𝑀=𝐾⊕𝑅 is uniform and independent of 𝐾; thus 𝑀 alone leaks no information about 𝐾. For multiple stored items/queries, the above argument applies record-by-record, since each record uses an independently sampled mask𝑅 𝑖 and masked key𝑀 𝑖. Proc. ACM Hum.-Comput. In...
2026
discussion (0)
Sign in with ORCID, Apple, or X to comment. Anyone can read and Pith papers without signing in.