PrivateXR: Defending Privacy Attacks in Extended Reality Through Explainable AI-Guided Differential Privacy

The convergence of artificial AI and XR technologies (AI XR) promises innovative applications across many domains. However, the sensitive nature of data (e.g., eye-tracking) used in these systems raises significant privacy concerns, as adversaries can exploit these data and models to infer and leak personal information through membership inference attacks (MIA) and re-identification (RDA) with a high success rate. Researchers have proposed various techniques to mitigate such privacy attacks, including differential privacy (DP). However, AI XR datasets often contain numerous features, and applying DP uniformly can introduce unnecessary noise to less relevant features, degrade model accuracy, and increase inference time, limiting real-time XR deployment. Motivated by this, we propose a novel framework combining explainable AI (XAI) and DP-enabled privacy-preserving mechanisms to defend against privacy attacks. Specifically, we leverage post-hoc explanations to identify the most influential features in AI XR models and selectively apply DP to those features during inference. We evaluate our XAI-guided DP approach on three state-of-the-art AI XR models and three datasets: cybersickness, emotion, and activity classification. Our results show that the proposed method reduces MIA and RDA success rates by up to 43% and 39%, respectively, for cybersickness tasks while preserving model utility with up to 97% accuracy using Transformer models. Furthermore, it improves inference time by up to ~2x compared to traditional DP approaches. To demonstrate practicality, we deploy the XAI-guided DP AI XR models on an HTC VIVE Pro headset and develop a user interface (UI), namely PrivateXR, allowing users to adjust privacy levels (e.g., low, medium, high) while receiving real-time task predictions, protecting user privacy during XR gameplay.

Key Contributions

XAI-guided selective differential privacy framework that applies DP noise only to the most influential features identified by post-hoc explainability methods, reducing unnecessary noise on less relevant features
Evaluated against both MIA and RDA on three XR tasks (cybersickness, emotion, activity classification), achieving up to 43% and 39% success rate reductions respectively while preserving up to 97% model accuracy
Practical deployment on HTC VIVE Pro headset with a user interface (PrivateXR) offering adjustable privacy levels with real-time inference, achieving ~2x inference speedup over standard DP approaches

🛡️ Threat Analysis

Membership Inference Attack

The paper's primary security contribution is defending against membership inference attacks (MIA) on XR models, evaluating success-rate reductions of up to 43%. Re-identification attacks (RDA) are also addressed, both defended via selective DP applied to XAI-identified influential features.