cs.CRAug 30, 2026
SaveMoSign: Challenge-Response Motion-Watermark Authentication for Anonymous Virtual-Reality Users
Organizations: University of North Carolina at Charlotte · Utah State University
Abstract
Social virtual reality (VR) creates a paradox. A user's body motion is a high-entropy biometric: head and hand trajectories alone re-identify users among tens of thousands with over accuracy, so anonymizing the rendered avatar is a practical necessity. Yet a user often still wants to prove their identity to a chosen party from inside that anonymity. We present MoSign, which recasts digital watermarking as a challenge-response authentication protocol on the motion channel. MoSign embeds a time-varying keyed message into the style latent of a motion variational autoencoder via keystream-whitened Gaussian-Shading: watermarked motion is provably indistinguishable from watermark-free motion, since any detector's advantage reduces to breaking a pseudorandom function, so the mark composes with anonymization. The message is a keyed MAC over an epoch counter, a session nonce, and a deployment context, making MoSign replay-resistant and bounding forgery by the verifier's measured false-accept rate times the adversary's online query budget. A key-holding verifier decides with a sequential test. We identify renderrecordre-estimate ("recapture") as the realistic VR attack surface: a generic pose estimator strips the necessarily subtle watermark, but a recapture-robust keyed reader recovers it (up to codeword accuracy on a projected-2D channel, through a full render-to-video loop), while without the key recovery stays at chance. On HumanML3D, MoSign authenticates every legitimate user at a false-accept rate of on clean and most channels and stays undetectable (detection AUC , chance ); on the BOXRR-23 VR dataset it carries the mark through a real anonymizer at codeword accuracy and adds no de-anonymization side channel.
Figures & tables
Figure 1: MoSign as a challenge-response protocol carried on the motion channel. The verifier issues a fresh challenge, an epoch counter and a session nonce ; the prover answers not with a message but with one epoch of motion that carries in its style latent. The response survives the public channel, including a render-record-re-estimate recapture, and is read only by a party holding ; to everyone else it is indistinguishable from unmarked anonymized motion. Key glyphs mark the two parties that hold , and the two pose sequences are the same motion drawn twice.
Figure 2: Deployment, and the three parties that see the same rendered avatar: ➊ keyless, ➋ key holder with the raw stream, ➌ key holder with only the rendered video. A separate upstream anonymizer masks identity; MoSign adds only the keyed watermark, so the two compose without either being redesigned for the other.
Figure 3: Keyed, distribution-preserving embedding into the style latent. Left: content and keyed carrier travel separately and meet only at the decoder, so the message never enters and an upstream anonymizer cannot interfere with it. Right: the substitution is exact, because is a folded normal and the keyed sign vector is uniform and independent of it (Proposition 1 ). The histograms are measured from the deployed codec: over written coordinates a Kolmogorov–Smirnov test against the prior gives ( ). Poses throughout the figures are HumanML3D motion.
Figure 4: Key-necessity ladder. Codeword accuracy for each reader backbone under four key conditions: correct key, key conditioning removed, wrong key, and fully keyless. The first two sit at chance because the reader is trained to put them there, so the independent evidence is the orange bar: a from-scratch Kerckhoffs adversary that never sees the key yet is handed the dewhitening key at test time.
| Channel | acc. | TPR@ | SPRT |
|---|---|---|---|
| clean | 0.98 | 1.00 | 0.99 |
| resample | 0.98 | 1.00 | 0.95 |
| smooth | 0.98 | 1.00 | 0.99 |
| noise | 0.98 | 1.00 | 0.99 |
| retarget | 0.97 | 1.00 | 0.99 |
| recapture (oracle) | 0.97 | 1.00 | 0.99 |
Table 1: Per-channel authentication. acc. and TPR are single-window decisions: one read of a -frame window against a fixed threshold ( ), empirical FPR . SPRT is the deployed verifier: s windows at s stride, streams per channel over three session nonces (standard deviation ), calibrated on the same s statistic, false accepts each against unwatermarked motion and a wrong key. recapture is the differentiable oracle channel; a real pose estimator is Table 3 . all seven is a random ordered composition of the seven single attacks, each at full strength.
Figure 5: Time-to-authenticate. Top: per-window codeword accuracy : eight benign channels via the standard extractor (dots), the synthetic recapture channel via the keyed reader (star). Bottom: SPRT time-to-authenticate against (independent s windows, -bit codeword) at two false-accept levels. The shaded band is below the one-epoch threshold; every channel lies to its right, so all accept on the first window at . At the threshold rises to and dropout ( ) needs two windows.
| Construction | worst-case AUC |
|---|---|
| MoSign (symmetric, final) | 0.51 |
| + amplitude correction | |
| + imprint objective |
Table 2: WM-IND and the symmetry ablation. Worst-case is the strongest of the discriminators above ( in the motion domain, in the latent).
Figure 6: WM-IND ROC of the worst-case discriminator (C3), one independently trained discriminator per curve. The whitened construction (blue) holds the chance diagonal across repeated trainings (AUC to ); removing the keystream whitening (orange) or adding a generation-only asymmetry (red) lifts it off.
| Reader of the recaptured motion | synth. | real loop |
| generic estimator (no key) | 0.52 | 0.50 |
| generation-side, in-distribution | 0.74 | – |
| generation-side, held-out | 0.64 | 0.52 |
| receiver-side keyed (conv) | 0.61 | – |
| receiver-side keyed (transformer) | 0.95 | – |
| receiver-side keyed (recurrent) | 0.96 | 0.81 |
Table 3: Recapture. synth. is the projected-2D channel; real loop is render to RGB, off-the-shelf 2D detection, and a real lift, with no scale oracle. Generic estimators strip the mark on both channels; the key holder recovers it on both.
Figure 7: The real recapture loop: watermarked motion fitted to a body model, rendered to RGB, 2D keypoints detected, then lifted back to 3D. Between render and lift the signal is not a skeleton at all, so nothing guarantees a subtle latent perturbation survives. It does, but only for the key holder.
Figure 8: Hardening the recapture claim (real render-to-detection loop, , no scale oracle). Left: key-holder recovery across azimuth, against a paired perfect-2D projection control. Right: the same loop under joint-dropout occlusion. The keyless floor stays at chance throughout.
Figure 9: Forgery benchmark (C2). Forgery success, meaning the verifier accepts, on a log scale for three keyless adversaries and a non-renewing control, against the SPRT design floor (dashed).
Figure 10: Cross-key codeword-match distribution (C2), keys. Under the wrong key the match (bars) lands on (markers), while genuine signers recover . The -stream SPRT result treats the measured windows as independent; windows within one real stream are correlated, so it is a bound under that assumption.
Figure 11: Epoch-slack tradeoff (C2). Same-nonce delayed-replay accept rate versus forward replay delay, one curve per epoch-slack. Slack is at once the clock-skew / relay tolerance and the replay window.
| Condition | re-id (rank-1) |
|---|---|
| clean | 0.884 |
| anonymized (DMM) | 0.034 |
| VAE recon | 0.026 |
| watermarked (MoSign) | 0.024 |
| chance | 0.001 |
Table 4: Composition with anonymization (C3): rank-1 re-identification over BOXRR-23 users under Deep Motion Masking’s own note-anchored protocol.
| Scheme | WM-IND | pair | Replay | Codeword | Recapture | MPJPE (m) |
|---|---|---|---|---|---|---|
| in-generation | ||||||
| MoSign | 0.52 | 0.51 | 0.49 | 0.97 | 0.62 | 0.044 |
| static message | 0.52 | 0.50 | 0.51 | 0.98 | 0.63 | 0.044 |
| static keystream | 0.52 | 1.00 | 0.48 | 0.98 | 0.64 | 0.044 |
| Gen-Static | 1.00 | 1.00 | 0.97 | 0.97 | 0.57 | 0.043 |
| Stable-Sig static | 1.00 | – | 0.98 | 0.98 | 0.63 | 0.044 |
Table 5: Baseline comparison. The first three rows vary where the freshness in comes from; the rest is prior work. WM-IND is the stronger of two pooled tests and pair the replica-pair product of Figure 12 , both worst case over . Replay is bit agreement between a replayed clip and a live challenge, not an accept rate, so it targets (boldface where met). Recapture is read by a held-out keyless estimator. The three baselines are defined above.
Figure 12: Where the freshness has to come from, on the true codec ( clips pooled per long-lived signer). Message and keystream are varied independently; the magnitudes stay fresh in all four combinations. Solid is the stronger of two pooled tests over the bag mean (the norm and a learned mean-pool network); dashed is the replica-pair product . Three curves coincide at : the fixed-keystream arm’s pair test, and both tests on the both-fixed arm.
| Replay scenario | false-accept | TTA |
|---|---|---|
| fresh (legit, ) | s | |
| delayed epoch (within slack) | s | |
| delayed epochs (stale) | ||
| delayed epochs (stale) | ||
| cross-session (fresh nonce) |
Table 6: Anti-replay ( clips, slack ): a recording is valid only for its original . The accept rates of are .
Appendix figures & tables6 assets
Supplementary material from the paper’s appendix.
Appendix
| Backbone | Read-out | Codeword | WM-IND |
|---|---|---|---|
| VAE (deployed) | extractor | ||
| MDM (frozen) | DDIM inv. |
Table 7: The embedding primitive across generator backbones. VAE is our motion-conditioned model (deployed; learned extractor); MDM is a frozen external text-to-motion diffusion model read by denoising diffusion implicit model (DDIM) inversion (no trained reader). WM-IND AUC and replay are inherited from the shared codec.
Figure 13: Capacity-robustness tradeoff, measured. Per-read codeword accuracy for models trained at codeword length (each an otherwise-identical model, same training recipe), on the clean, dropout, and crop channels. The dashed curve is the idealized repetition-coding bound calibrated to the clean point. The default -bit codeword is marked.
Figure 14: The removal attacks on one axis: verifier accept rate versus added distortion, grouped by adversary class. Blue dashed is the watermark’s own footprint.
| Removal attack | needs | auth. at |
|---|---|---|
| (added MPJPE, m) | ||
| collusion avg. | keys | |
| multi-epoch avg. | epochs | |
| white-box PGD | extractor wts | |
| re-generation | generative AE | |
| purification AE | generic AE |
Table 8: Removal attacks (companion to Figure 14 ). Each row is the smallest added MPJPE, on that attack’s own strength grid, at which the verifier accept rate first reaches ; the watermark’s own footprint is . Only cross-sample averaging (bold) strips the mark below that footprint, and only when the same motion is available under keys or across epochs. Three never reach zero: the surrogate extractor leaves at , rate/phase jitter at , and generic noise at . Re-generation is quoted root-relative; its raw is dominated by global root drift.
Figure 15: Per-epoch authentication (green) versus a naive one-shot SPRT (orange), as a function of how many of a six-epoch stream’s epochs survive removal ( streams, worst case: the rest fully stripped). Green labels are the time-to-authenticate.
Figure 16: Adaptive in-channel laundering of the recapture path: keyed-reader codeword accuracy versus laundering distortion, for a realistic keyless laundering net (green) and a key-aware white-box PGD upper bound (red).
More in this topic
Virtual Reality
Virtual reality studies immersive, interactive environments and the technologies and human experiences that make them useful.
See all 40 papers