Source-linked AI summary
Lensless Gaze Is Not Private by Default: Auditing Identity Leakage Across Disclosure Surfaces
Rahul Vimalkanth, Kaushik Mitra
TL;DR
Lensless gaze measurements may look unintelligible to humans while remaining identifying to learned attackers, motivating privacy evaluation across disclosure surfaces. The paper audits a simulated lensless pipeline under a fixed, known-PSF, 36-subject protocol and finds non-monotonic leakage across measurements, representations, outputs, and repeated releases. The results support auditing trust boundaries rather than inferring privacy from appearance alone.
Problem
Visual unintelligibility does not establish resistance to machine identity inference, so privacy evidence is needed across sensing, storage, computation, and output boundaries.
Method
The paper audits a simulated lensless gaze pipeline with a 36-subject known-gallery attacker, independently evaluating disclosure surfaces using matched linear and MLP probes.
Results
96.7% lensless top-1 identification nearly matches 97.7% for original crops, while compression and output leakage remain non-monotonic across representations and released signals.
Takeaways & Limitations
Privacy claims for lensless sensing should be tested at disclosure boundaries rather than inferred from visual appearance or dimensionality alone.
Takeaways & Limitations
The evaluation uses one fixed, known optical configuration and matched linear and MLP probes, so it does not characterize unknown or varying optical keys or stronger adversaries.
Abstract
from arXiv · showhide
Lensless near-eye sensing is often described as privacy-friendly because its coded measurements are visually unintelligible. Yet visual unintelligibility reflects human interpretation, not what a learned adversary can recover. We therefore treat identity privacy as a systems property of disclosure surfaces: representations crossing sensing, storage, computation, and output boundaries. We audit a simulated lensless gaze pipeline under a 36-subject known-gallery closed-set identification protocol with a fixed, known PSF; privacy from an unknown or varying optical key is outside our scope. Reported accuracies are empirical attack success rates under matched linear and MLP probes and do not upper-bound stronger adversaries. Simulated lensless measurements yield 96.7% top-1 identification versus 97.7% for matched original eye crops, while an MAE embedding retains 94.3%. Compression alone offers little protection: 8-D PCA and a matched 8-D bottleneck retain 93.2% and 91.8%, whereas separately trained 8-D GSPL bottlenecks yield 77.5% mean recovery across three seeds. A released 128-way gaze token lowers single-frame recovery to 38.1%, while its residual and continuous gaze output expose 62.1% and 72.6%, respectively. Under a source-frame-disjoint tiled protocol, token summaries reach 39.9% at T=25, showing that repeated-output risk depends on representation and aggregation. These rates reflect all subject-correlated information in the evaluated dataset, including acquisition and behavioral cues, rather than isolating intrinsic ocular biometrics. Ordinary least squares residualization against a six-dimensional crop geometry and intensity summary still leaves lensless recovery at 95.1%. Our results show that privacy claims for lensless sensing must be tested at disclosure boundaries rather than inferred from appearance.
1 Introduction
The paper audits whether visually unintelligible lensless gaze measurements remain identifying across sensing, representation, output, and repeated-release boundaries. Under a fixed, known-PSF, 36-subject protocol, lensless measurements remain nearly as identifying as original eye crops, while compression and output design produce non-monotonic leakage.
- Empirical leakage: 96.7% top-1 identification from simulated lensless measurements nearly matches 97.7% for matched original eye crops.The audit uses a 36-subject known-gallery closed-set attacker with matched linear and MLP probes.
- Empirical leakage: 94.3% identification remains in the masked autoencoder embedding, showing that learned internal representations preserve subject-correlated information.
- Compression: 93.2% and 91.8% recovery persist in 8-D PCA and matched 8-D bottleneck representations, whereas separately trained 8-D GSPL bottlenecks yield 77.5% mean recovery.The comparison shows that dimensionality alone does not explain leakage reduction.
- Output leakage: 38.1% single-frame recovery from a released 128-way gaze token rises to 62.1% for its residual and 72.6% for continuous gaze output.At the output boundary, retained or higher-precision signals expose more identity than the quantized token.
- Repeated release: 39.9% token-summary recovery at T=25 under source-frame-disjoint tiling shows that repeated-release risk depends on representation and aggregation.
- Acquisition cues: 95.1% lensless recovery remains after ordinary least-squares residualization against six-dimensional crop geometry and intensity summaries.The audit measures all subject-correlated information in the evaluated dataset, including acquisition and behavioral cues.
2 Related Work
Prior work establishes that eye data support identity inference through appearance, physiology, behavior, and gaze dynamics, while privacy-preserving gaze systems study protection mechanisms and utility trade-offs. Lensless and representation-leakage research motivates auditing common attackers across the sensing pipeline rather than treating optical encoding or one representation as sufficient protection.
- Identity leakage in eye tracking: Eye appearance, periocular features, physiology, behavior, and gaze dynamics have all supported biometric or identity recognition.
- Privacy-preserving gaze systems: Privacy-preserving gaze research studies differential privacy, streaming and dataset-publication mechanisms, appearance transformation, and iris obfuscation.These approaches address privacy–utility trade-offs in released gaze or eye data.
- Lensless imaging: Lensless systems use coded optics for reconstruction or downstream inference, while OpEnCam treats camera-specific optical elements as a secret key under partial or unknown-key attacks.
- Representation leakage: Representation-leakage work uses probes, model inversion, and membership inference, and this paper applies a common enrolled attacker across raw, learned, compressed, local, released, and temporal signals.The goal is diagnostic empirical recoverability, not differential privacy, anonymity, or cryptographic confidentiality.
3 Threat Model and Method
The method evaluates identity recoverability independently at disclosure surfaces under a known-gallery threat model, then audits a public–private gaze split and simulated lensless forward process. Its empirical measure is conditional on the attacker and protocol rather than a formal privacy bound.
- Threat model: The audit measures subject-predictive information already present in learned and measured signals rather than introducing privacy-preserving training.
- Threat model: A known-gallery attacker uses labeled samples from the same 36 identities, while each experiment exposes exactly one disclosure surface to matched empirical probes.
- Data split: Three consecutive 25-frame blocks enroll the attacker and one evaluates it, reducing direct leakage from adjacent frames and shared blink states.
- Probe protocol: Five probe seeds vary MLP initialization and internal early-stopping subdivisions while preserving the gallery and grouped enrollment/evaluation partition.The protocol does not evaluate open-set recognition, unseen identities, enrollment-free matching, or cross-session persistence.
- Recoverability metric: Empirical identity recoverability is defined as probe accuracy on a held-out evaluation set for a disclosed representation, identity, and probe.The measure is conditional on the attacker, gallery, split, and disclosure definition, not mutual information or a formal privacy bound.
- GazeSplit: GazeSplit partitions a continuous gaze estimate into a released quantized token and locally retained residual using a 128-bin vocabulary.The token is represented by a bin-center direction, while the residual reconstructs the continuous estimate.
- GazeSplit: The residual is audited as hypothetical locally retained state and is not used by a correction module in the evaluated MAE pipeline.GazeSplit is therefore an analysis device rather than a deployed end-to-end system.
- Lensless simulation: Simulated lensless measurements are generated by padding OpenEDS crops, convolving them with a fixed stored RGB PSF, adding Gaussian noise, and center-cropping.
4 Experimental Setup
The audit uses a fixed simulated lensless pipeline and matched identity probes to compare disclosure representations under controlled dimensionality and training choices.
- Data and simulation: A fixed stored RGB PSF generates simulated lensless measurements, with the PSF known to the attacker under the threat model.The setup excludes privacy from PSF secrecy or optical-key diversity.
- Attacker inputs: Matched preprocessing downsamples 224 × 224 inputs to 32 × 32 and flattens them into 3072-dimensional tensors for probing.A frozen ResNet-18 probe provides a separate spatial-resolution control.
- Representations and controls: L2, L4, L5, and L6 use a lensless MAE with a ViT-Tiny backbone and 192-D CLS embedding.L3 is a separately trained 8-D GSPL gaze bottleneck, mixing dimensionality, architecture, and objective relative to L2.
- Representations and controls: L3′ is an 8-D PCA projection of L2 fitted per probe seed using attacker-training frames only.The projection isolates linear dimensionality reduction from the separately trained GSPL bottleneck.
- Representations and controls: A matched nonlinear control trains an 8-D gaze bottleneck on the same frozen MAE backbone without identity supervision.This control separates width from the backbone and training objective more directly than L2–L3.
- Uncertainty: Matched linear and two-layer MLP probes are evaluated with descriptive percentile-bootstrap intervals over five probe-seed mean accuracies.The intervals summarize probe-run variation, not encoder retraining, subject resampling, or acquisition-session variation.
5 Results
Across the evaluated disclosure surfaces, lensless measurements remain highly identifying, while compression and release design produce non-monotonic leakage patterns. Repeated-output risk also varies with representation and aggregation, and the measured rates include acquisition- and behavior-related subject cues.
- RQ1: Visual removal of recognizable ocular appearance does not determine machine identity recovery.The study distinguishes visual change from resistance to learned inference.
- RQ1: 97.7% original-crop and 96.7% simulated-lensless top-1 identification differ by 0.96 percentage points under matched preprocessing.The reported interval for the paired difference is [−0.18, 1.84], and this is not an equivalence test.
- RQ1: 95.5% recovery from six-dimensional geometry and intensity summaries shows that acquisition-linked cues contribute strongly to identification.The evaluated attack recovers any stable subject-correlated information in the disclosed signal, not only intrinsic ocular appearance.
- RQ1: 95.1% lensless recovery remains after ordinary least squares residualization against the six-dimensional geometry and intensity summary.Residualization reduces lensless recovery from 96.7% to 95.1% using enrollment blocks only.
- RQ1: 95.8% lensless recovery with native-resolution ResNet-18 features remains close to the 32 × 32 MLP result.Grouped-block L1 accuracy is 96.7%, compared with 99.7% for random splits and 91.5% for max-gap blocks.
- RQ1: 98.4% L1 mean MLP accuracy in four-fold leave-one-block-out evaluation supports partition robustness without addressing cross-session generality.LOBO varies the held-out temporal block, not the subject partition or recording session.
- RQ1: 95.3%–96.6% linear accuracy across matched forward-model resimulations indicates local simulation stability, not universal leakage for physical coded optics.The primary 96.7% MLP rate depends on the chosen simulation, and structurally different phase masks could reduce recovery more substantially.
- RQ2: 77.5% mean GSPL recovery contrasts with 93.2% 8-D PCA and 91.8% matched bottleneck recovery, so dimensionality alone is not a privacy mechanism.The GSPL mean aggregates three separately trained seeds: 78.6%, 75.4%, and 78.5%.
6 Discussion
The audit treats identity privacy as a property of every disclosure surface, because stable geometry, positioning, illumination, behavior, and learned features can cross trust boundaries. Compression and tokenization may reduce recovery, but neither guarantees privacy when sensitive representations or repeated outputs remain available.
- Disclosure-surface auditing: Privacy should be audited across every signal crossing a trust boundary, not inferred from whether measurements look recognizable.The disclosure-surface view applies beyond gaze by defining the attacker and measuring the protected attribute at each boundary.
- Acquisition and behavioral cues: Stable geometry, positioning, illumination, behavior, and learned features are part of the attack surface when they cross trust boundaries.A cue need not be an intrinsic biometric to constitute systems-level leakage if it identifies an enrolled user under the evaluated conditions.
- Output minimization: Tokenization reduces recovery, but residuals and continuous predictions remain sensitive when exposed.The system should minimize and isolate outputs rather than treating the released token as the only relevant disclosure surface.
- Temporal release streams: Repeated-output risk depends on duration, aggregation, occupancy, and attacker adaptation, not only per-frame disclosure.The audit therefore treats release streams as a separate privacy boundary.
7 Limitations and Ethical Considerations
The evaluation is limited to a simulated pipeline with one fixed optical configuration, matched probes, and a closed-set enrolled-attacker protocol. It does not establish privacy behavior for unknown or varying optical keys, stronger adversaries, cross-session settings, or broader deployment conditions.
- Optical scope: The results do not characterize identity leakage when the optical key is unknown or varies across cameras or captures.The study uses one fixed optical configuration and differs from optical-encryption settings with camera-specific secret keys.
- Threat-model coverage: Matched linear and MLP probes establish achievable leakage but do not upper-bound stronger adversaries.The conclusion is limited to the fixed, known-PSF setting evaluated here.
- Generality: The evaluation uses one subject partition and a closed-set enrolled-attacker protocol, so additional sessions, placements, and deployment conditions are needed to assess generality.The reported rates are not universal properties of lensless imaging.
- Ethical considerations: Privacy-by-design guidance includes minimizing raw-measurement and unrestricted-embedding retention, keeping calibration local where possible, and auditing learned representations before deployment.The work audits privacy risk rather than advocating biometric identification.
8 Conclusion
The paper presents a disclosure-surface audit of identity leakage across a simulated lensless gaze pipeline. Its conclusion is that lensless measurements can remain highly identifying, compression alone does not ensure privacy, and tokenization reduces but does not eliminate leakage when additional outputs remain available.
- Conclusion: Visually unintelligible lensless measurements remain highly identifying under the evaluated known-gallery threat model, including after acquisition-cue residualization.The audit measures recoverability from sensor measurements, representations, bottlenecks, retained state, released outputs, and temporal aggregates.
- Conclusion: Privacy should be evaluated across the entire sensing pipeline rather than optical encoding alone.The disclosure-surface perspective identifies where sensitive information persists and where privacy mechanisms are required.