MoSign: Challenge-Response Motion-Watermark Authentication for Anonymous Virtual-Reality Users

Xujun Che; Thomas Carr; Depeng Xu; Aidong Lu; Shuhan Yuan

cs.CRAug 30, 2026

MoSign: Challenge-Response Motion-Watermark Authentication for Anonymous Virtual-Reality Users

Authors: Xujun Che, Thomas Carr, Depeng Xu, Aidong Lu, Shuhan Yuan

Organizations: University of North Carolina at Charlotte · Utah State University

Abstract

Social virtual reality (VR) creates a paradox. A user's body motion is a high-entropy biometric: head and hand trajectories alone re-identify users among tens of thousands with over $94\%$ accuracy, so anonymizing the rendered avatar is a practical necessity. Yet a user often still wants to prove their identity to a chosen party from inside that anonymity. We present MoSign, which recasts digital watermarking as a challenge-response authentication protocol on the motion channel. MoSign embeds a time-varying keyed message into the style latent of a motion variational autoencoder via keystream-whitened Gaussian-Shading: watermarked motion is provably indistinguishable from watermark-free motion, since any detector's advantage reduces to breaking a pseudorandom function, so the mark composes with anonymization. The message is a keyed MAC over an epoch counter, a session nonce, and a deployment context, making MoSign replay-resistant and bounding forgery by the verifier's measured false-accept rate times the adversary's online query budget. A key-holding verifier decides with a sequential test. We identify render $\rightarrow$ record $\rightarrow$ re-estimate ("recapture") as the realistic VR attack surface: a generic pose estimator strips the necessarily subtle watermark, but a recapture-robust keyed reader recovers it (up to $0.96$ codeword accuracy on a projected-2D channel, $0.81$ through a full render-to-video loop), while without the key recovery stays at chance. On HumanML3D, MoSign authenticates every legitimate user at a false-accept rate of $10^{-4}$ on clean and most channels and stays undetectable (detection AUC $0.51$ , chance $0.5$ ); on the BOXRR-23 VR dataset it carries the mark through a real anonymizer at $0.99$ codeword accuracy and adds no de-anonymization side channel.

Figures & tables

Panel of Figure 1 — Figure 1: MoSign as a challenge-response protocol carried on the motion channel. The verifier issues a fresh challenge, an epoch counter $e$ and a session nonce $r$ ; the prover answers not with a message but with one epoch of motion that carries $\textsf{HMAC}_{k}(e\,\|\,r\,\|\,\mathrm{ctx})$ in its style latent. The response survives the public channel, including a render-record-re-estimate recapture, and is read only by a party holding $k$ ; to everyone else it is indistinguishable from unmarked anonymized motion. Key glyphs mark the two parties that hold $k$ , and the two pose sequences are the same motion drawn twice.

Panel of Figure 2 — Figure 2: Deployment, and the three parties that see the same rendered avatar: ➊ keyless, ➋ key holder with the raw stream, ➌ key holder with only the rendered video. A separate upstream anonymizer masks identity; MoSign adds only the keyed watermark, so the two compose without either being redesigned for the other.

Panel of Figure 3 — Figure 3: Keyed, distribution-preserving embedding into the style latent. Left: content and keyed carrier travel separately and meet only at the decoder, so the message never enters $\mathbf{z}_{m}$ and an upstream anonymizer cannot interfere with it. Right: the substitution is exact, because $|\zeta|$ is a folded normal and the keyed sign vector is uniform and independent of it (Proposition 1 ). The histograms are measured from the deployed codec: over $10^{6}$ written coordinates a Kolmogorov–Smirnov test against the prior gives $D{=}0.0019$ ( $p{=}0.44$ ). Poses throughout the figures are HumanML3D motion.

Figure 4: Key-necessity ladder. Codeword accuracy for each reader backbone under four key conditions: correct key, key conditioning removed, wrong key, and fully keyless. The first two sit at chance because the reader is trained to put them there, so the independent evidence is the orange bar: a from-scratch Kerckhoffs adversary that never sees the key yet is handed the dewhitening key at test time.

Channel	acc.	TPR@ $10^{-4}$	SPRT
clean	0.98	1.00	0.99
resample	0.98	1.00	0.95
smooth	0.98	1.00	0.99
noise	0.98	1.00	0.99
retarget	0.97	1.00	0.99
recapture (oracle)	0.97	1.00	0.99

Table 1: Per-channel authentication. acc. and TPR are single-window decisions: one read of a

196

-frame window against a fixed

47/63

threshold (

\alpha{=}10^{-4}

), empirical FPR

0/1400

. SPRT is the deployed verifier:

2

s windows at

0.5

s stride,

256

streams per channel over three session nonces (standard deviation

{\leq}0.013

p_{1}

calibrated on the same

2

s statistic, false accepts

0/30000

each against unwatermarked motion and a wrong key. recapture is the differentiable oracle channel; a real pose estimator is Table 3 . all seven is a random ordered composition of the seven single attacks, each at full strength.

Figure 5: Time-to-authenticate. Top: per-window codeword accuracy

p_{1}

: eight benign channels via the standard extractor (dots), the synthetic recapture channel via the keyed reader (star). Bottom: SPRT time-to-authenticate against

p_{1}

(independent

2

s windows,

63

-bit codeword) at two false-accept levels. The shaded band is

p_{1}

below the one-epoch threshold; every channel lies to its right, so all accept on the first window at

\alpha{=}10^{-4}

. At

\alpha{=}10^{-8}

the threshold rises to

0.864

and dropout (

0.828

) needs two windows.

Construction	worst-case AUC
MoSign (symmetric, final)	0.51
+ amplitude correction $\Delta\theta$	$\approx 0.78$
+ imprint objective	$\approx 1.00$

Table 2: WM-IND and the symmetry ablation. Worst-case is the strongest of the discriminators above (

N{=}2048

in the motion domain,

4096

in the latent).

Figure 6: WM-IND ROC of the worst-case discriminator (C3), one independently trained discriminator per curve. The whitened construction (blue) holds the chance diagonal across repeated trainings (AUC

0.50

0.53

); removing the keystream whitening (orange) or adding a generation-only

\Delta\theta

asymmetry (red) lifts it off.

Reader of the recaptured motion	synth.	real loop
generic estimator (no key)	0.52	0.50
generation-side, in-distribution	0.74	–
generation-side, held-out	0.64	0.52
receiver-side keyed (conv)	0.61	–
receiver-side keyed (transformer)	0.95	–
receiver-side keyed (recurrent)	0.96	0.81

Table 3: Recapture. synth. is the projected-2D channel; real loop is render to RGB, off-the-shelf 2D detection, and a real lift, with no scale oracle. Generic estimators strip the mark on both channels; the key holder recovers it on both.

Panel of Figure 7 — Figure 7: The real recapture loop: watermarked motion fitted to a body model, rendered to RGB, 2D keypoints detected, then lifted back to 3D. Between render and lift the signal is not a skeleton at all, so nothing guarantees a subtle latent perturbation survives. It does, but only for the key holder.

Figure 8: Hardening the recapture claim (real render-to-detection loop,

N{=}288

, no scale oracle). Left: key-holder recovery across azimuth, against a paired perfect-2D projection control. Right: the same loop under joint-dropout occlusion. The keyless floor stays at chance throughout.

Figure 9: Forgery benchmark (C2). Forgery success, meaning the verifier accepts, on a log scale for three keyless adversaries and a non-renewing control, against the SPRT design floor

\alpha

(dashed).

Figure 10: Cross-key codeword-match distribution (C2),

K{=}64

keys. Under the wrong key the match (bars) lands on

\mathrm{Binom}(63,\frac{1}{2})

(markers), while genuine signers recover

{\approx}61.7/63

. The

10^{6}

-stream SPRT result treats the

516{,}096

measured windows as independent; windows within one real stream are correlated, so it is a bound under that assumption.

Figure 11: Epoch-slack tradeoff (C2). Same-nonce delayed-replay accept rate versus forward replay delay, one curve per epoch-slack. Slack is at once the clock-skew / relay tolerance and the replay window.

Condition	re-id (rank-1)
clean	0.884
anonymized (DMM)	0.034
VAE recon	0.026
watermarked (MoSign)	0.024
chance	0.001

Table 4: Composition with anonymization (C3): rank-1 re-identification over

1000

BOXRR-23 users under Deep Motion Masking’s own note-anchored protocol.

in-generation
Scheme	WM-IND	pair	Replay	Codeword	Recapture	MPJPE (m)
MoSign	0.52	0.51	0.49	0.97	0.62	0.044
static message	0.52	0.50	0.51	0.98	0.63	0.044
static keystream	0.52	1.00	0.48	0.98	0.64	0.044
Gen-Static	1.00	1.00	0.97	0.97	0.57	0.043
Stable-Sig static	1.00	–	0.98	0.98	0.63	0.044

Table 5: Baseline comparison. The first three rows vary where the freshness in

\mathrm{rep}(c)\oplus\textsf{PRF}_{k}(e\,\|\,r\,\|\,\mathrm{ctx})

comes from; the rest is prior work. WM-IND is the stronger of two pooled tests and pair the replica-pair product of Figure 12 , both worst case over

N\leq 256

. Replay is bit agreement between a replayed clip and a live challenge, not an accept rate, so it targets

0.5

(boldface where met). Recapture is read by a held-out keyless estimator. The three baselines are defined above.

Figure 12: Where the freshness has to come from, on the true codec (

N

clips pooled per long-lived signer). Message and keystream are varied independently; the magnitudes stay fresh in all four combinations. Solid is the stronger of two pooled tests over the bag mean (the

L_{2}

norm and a learned mean-pool network); dashed is the replica-pair product

s_{i}s_{i+n}

. Three curves coincide at

1.00

: the fixed-keystream arm’s pair test, and both tests on the both-fixed arm.

Replay scenario	false-accept	TTA
fresh (legit, $\Delta{=}0$ )	$1.00$	$2$ s
delayed $+1$ epoch (within slack)	$1.00$	$2$ s
delayed $+2$ epochs (stale)	$\mathbf{0.00}$	$\infty$
delayed $+5$ epochs (stale)	$\mathbf{0.00}$	$\infty$
cross-session (fresh nonce)	$\mathbf{0.00}$	$\infty$

Table 6: Anti-replay (

256

clips, slack

=1

): a recording is valid only for its original

(\text{epoch},\text{nonce})

. The accept rates of

1.00

are

256/256

Appendix figures & tables6 assets

Supplementary material from the paper’s appendix.

Appendix

Backbone	Read-out	Codeword	WM-IND
VAE (deployed)	extractor	$0.98$	$0.51$
MDM (frozen)	DDIM inv.	$0.995$	$0.52$

Appendix

Table 7: The embedding primitive across generator backbones. VAE is our motion-conditioned model (deployed; learned extractor); MDM is a frozen external text-to-motion diffusion model read by denoising diffusion implicit model (DDIM) inversion (no trained reader). WM-IND AUC and replay are inherited from the shared codec.

Figure 13: Capacity-robustness tradeoff, measured. Per-read codeword accuracy

p_{1}

for models trained at codeword length

n\in\{31,63,127,255\}

(each an otherwise-identical model, same training recipe), on the clean, dropout, and crop channels. The dashed curve is the idealized repetition-coding bound calibrated to the clean

n=63

point. The default

63

-bit codeword is marked.

Figure 14: The removal attacks on one axis: verifier accept rate versus added distortion, grouped by adversary class. Blue dashed is the watermark’s own footprint.

Removal attack	needs	auth. $\to 0$ at
		(added MPJPE, m)
collusion avg.	$K$ keys	$\mathbf{0.018}$
multi-epoch avg.	$K$ epochs	$\mathbf{0.020}$
white-box PGD	extractor wts	$0.052$
re-generation	generative AE	$0.065$ $\ddagger$
purification AE	generic AE	$0.077$

Appendix

Table 8: Removal attacks (companion to Figure 14 ). Each row is the smallest added MPJPE, on that attack’s own strength grid, at which the verifier accept rate first reaches

0

; the watermark’s own footprint is

0.027

. Only cross-sample averaging (bold) strips the mark below that footprint, and only when the same motion is available under

K

keys or across

K

epochs. Three never reach zero: the surrogate extractor leaves

0.99

0.083

, rate/phase jitter

1.00

0.197

, and generic noise

0.23

0.192

\ddagger

Re-generation is quoted root-relative; its raw

0.711

is dominated by global root drift.

Figure 15: Per-epoch authentication (green) versus a naive one-shot SPRT (orange), as a function of how many of a six-epoch stream’s epochs survive removal (

24

streams, worst case: the rest fully stripped). Green labels are the time-to-authenticate.

Figure 16: Adaptive in-channel laundering of the recapture path: keyed-reader codeword accuracy versus laundering distortion, for a realistic keyless laundering net (green) and a key-aware white-box PGD upper bound (red).

Virtual Reality

Virtual reality studies immersive, interactive environments and the technologies and human experiences that make them useful.

See all 40 papers

May 17, 2026

RAW: Robust Avatar Watermarking -- Benchmarking and Baseline

Digital avatar watermarking presents unique challenges: avatars are routinely post-processed with background replacement, reframing, and format conversion before deployment. We introduce RAW (Robust Avatar Watermarking), a benchmark comprising 50 synthetic avatar videos from 5 commercial providers and 6 attacks simulating real-world avatar workflows. Evaluating 7 existing methods reveals that avatar-specific attacks such as background removal significantly degrade watermark recovery. We propose WALT (Watermarking Avatars with Learned Textures), which embeds watermarks in UV texture space via 3D face reconstruction. WALT achieves the highest robustness to zoom attacks (92.4%) while maintaining strong performance on background removal (95.6%). We release our benchmark to facilitate research into avatar-specific watermarking.

Jack Parry, Jack Saunders, Vinay Namboodiri

University of Bath, UK

Robust Watermarking

Ask PDF

Mar 14, 2026

Deep Learning for Virtual Reality User Identification: A Benchmark

Virtual Reality (VR) applications require robust user identification systems to ensure secure access to equipment and protect worker identities. Motion tracking data from VR headsets and controllers has emerged as a powerful behavioral biometric, with recent studies demonstrating identification accuracies exceeding 94% across a large user base. However, the application of modern deep learning architectures, particularly State Space Models (SSM), to VR scenarios remains largely unexplored. In this work, we benchmark user identification performance across the large-scale Who is Alyx VR dataset, gathering data from 71 users playing the popular Half-Life:Alyx game. We evaluate both established architectures (Long Short-Term Memory (LSTM), Gated Recurrent Unit (GRU), Convolutional Neural Network (CNN), Temporal Convolutional Network (TCN), Transformer) and the emerging SSMs on time series motion data. Our results provide the first comprehensive benchmark of state-of-the-art and novel architectures for VR user identification, establishing baseline performance metrics for future privacy preserving authentication systems in manufacturing environments.

Davide Frizzo, Fabrizio Genilotti, David Petrovic +6

University of Padova, Italy

Biometric Identification Virtual Reality State Space Models

Ask PDF

Jul 1, 2026

Sign in the Air to Unlock: An Interface for authentication in Virtual and Augmented Reality Powered by Point-Voxel Cross-Attention Network

Significant advancement of immersive technologies such as Virtual and Augmented Reality (VR/AR) and their integration into diverse aspects of modern life need authentication interfaces that are secure, intuitive, and compatible with embodied interaction. Traditional methods such as passwords, PINs, and device-based logins, break immersion and rely on external hardware. Recent 3D-specific behavioral approaches, such as hand-gesture, eye-tracking, and electroencephalography (EEG)-based methods, offer promising alternatives but often require specialized sensors or constrain natural movement, limiting usability in dynamic environments. We present Sign in the Air to Unlock, an in-air signature interface that enables users to authenticate by signing naturally in 3D space which is a familiar, personal, and reproducible gesture. To realize this interface, we design a point-voxel Cross-Attention Network (PV-Net) that jointly models local motion dynamics and global spatial structure from 3D trajectories. The model is evaluated on two datasets: the public DeepAirSig dataset (1,800 signatures from 40 users) and ImmAirsig, a new dataset collected using Meta Quest 2 in immersive VR (880 samples from 22 users). PV-Net achieves an Equal Error Rate of 2.5% on DeepAirSig and 76% classification accuracy on ImmAirSig. These findings highlight the potential of 3D behavioral interfaces for seamless, user-centric authentication that merges security with natural interaction in immersive environments.

Neda Abdolrahimi, Thiru Siddharth, Frank Sicong chen +1

Syracuse University, 900 S Crouse Ave, Syracuse, New York, USA, 13244

Biometric Identification 3D Representation Learning

Ask PDF

Abstract

Virtual Reality

Explore similar work

RAW: Robust Avatar Watermarking -- Benchmarking and Baseline

Deep Learning for Virtual Reality User Identification: A Benchmark

Sign in the Air to Unlock: An Interface for authentication in Virtual and Augmented Reality Powered by Point-Voxel Cross-Attention Network