PaperlayerView exact revision on arXiv

Source-linked AI summary

MoSign: Challenge-Response Motion-Watermark Authentication for Anonymous Virtual-Reality Users

Xujun Che, Thomas Carr, Depeng Xu, Aidong Lu, Shuhan Yuan

arXiv:2609.29603v1cs.CRcs.CVcs.MM

TL;DR

In social VR, motion can identify users, yet users may need to authenticate to a chosen party without revealing themselves to bystanders. MoSign uses keyed motion watermarking for that authentication; a key-holding reader recovers the mark after recapture, while recovery without the key stays at chance.

  • Problem

    Social VR motion identifies users, while users still need a way to authenticate to a chosen party without revealing their identity to bystanders.

    Source: §1 · p. 1

  • Method

    MoSign embeds a PRF-whitened keyed message in motion and has a key-holding verifier authenticate it with a sequential test.

    Source: §1 · p. 2, §3.2 · p. 4

  • Results

    A recapture-robust keyed reader recovers the watermark from recaptured video, while recovery without the key is provably at chance.

    Source: §1 · p. 2

  • Takeaways & Limitations

    MoSign provides recapture robustness for the key-holding verifier, rather than for arbitrary estimators.

    Source: §8 · p. 13

    The security bound depends on limiting online queries; deployments that do not bound Q do not inherit it.

    Source: §4 · p. 6

Abstract

from arXiv · show

Social virtual reality (VR) creates a paradox. A user's body motion is a high-entropy biometric: head and hand trajectories alone re-identify users among tens of thousands with over $94\%$ accuracy, so anonymizing the rendered avatar is a practical necessity. Yet a user often still wants to prove their identity to a chosen party from inside that anonymity. We present MoSign, which recasts digital watermarking as a challenge-response authentication protocol on the motion channel. MoSign embeds a time-varying keyed message into the style latent of a motion variational autoencoder via keystream-whitened Gaussian-Shading: watermarked motion is provably indistinguishable from watermark-free motion, since any detector's advantage reduces to breaking a pseudorandom function, so the mark composes with anonymization. The message is a keyed MAC over an epoch counter, a session nonce, and a deployment context, making MoSign replay-resistant and bounding forgery by the verifier's measured false-accept rate times the adversary's online query budget. A key-holding verifier decides with a sequential test. We identify render$\rightarrow$record$\rightarrow$re-estimate ("recapture") as the realistic VR attack surface: a generic pose estimator strips the necessarily subtle watermark, but a recapture-robust keyed reader recovers it (up to $0.96$ codeword accuracy on a projected-2D channel, $0.81$ through a full render-to-video loop), while without the key recovery stays at chance. On HumanML3D, MoSign authenticates every legitimate user at a false-accept rate of $10^{-4}$ on clean and most channels and stays undetectable (detection AUC $0.51$, chance $0.5$); on the BOXRR-23 VR dataset it carries the mark through a real anonymizer at $0.99$ codeword accuracy and adds no de-anonymization side channel.

1 Introduction

VR motion can identify users, while anonymization leaves them without a way to authenticate to a chosen counterparty while staying anonymous to bystanders. MoSign carries a keyed, time-varying authentication message in motion and is designed to remain undetectable through anonymization and readable by a key-holding verifier after recapture.

1 Introduction

  • Motion telemetry can identify users, but anonymization removes their ability to prove identity to a chosen counterparty while remaining anonymous to bystanders.The introduction reports identification of more than 50,000 users from head-and-hand telemetry, reaching 94.33% accuracy from 100 seconds.Source: §1 · p. 1
  • MoSign embeds a time-varying keyed message in a generated motion’s style latent while keeping the motion statistically identical to ordinary watermark-free motion.The chosen verifier reads the message and authenticates with a sequential hypothesis test.Source: §1 · pp. 1–2
  • MoSign is presented as the first in-generation skeletal-motion watermark used for entity authentication rather than provenance or content integrity.Unlike post-hoc mocap watermarks, the mark is produced during generation and read through the VR pipeline.Source: §1 · p. 2
  • MoSign makes the watermark a challenge-response protocol, using a keyed message to provide replay resistance and bounded-query forgery resistance.The paper says this addresses recording-and-replay attacks that defeat static schemes.Source: §1 · p. 2
  • Keystream-whitened Gaussian-Shading makes watermarked motion indistinguishable from watermark-free motion, so the mark composes with anonymization.The stated detector AUC is 0.5 by construction, with undetectability reducing to PRF security.Source: §1 · p. 2
  • MoSign pairs a recapture-robust keyed reader with a threat model centered on rendered-avatar video, where generic pose estimation strips the subtle watermark.Without the key, recovery is at chance.Source: §1 · p. 2

2 Background and Threat Model

MoSign is intended to add authentication after anonymization while preserving anonymity to parties without the key. Its threat model treats rendered-video recapture, bounded verifier queries, and selective trust in a key-holding verifier as central deployment conditions.

2 Background and Threat Model

  • MoSign operates after and orthogonally to anonymization, adding a keyed signal that does not de-anonymize the user or reveal signing to keyless parties.Authentication is to a chosen, key-sharing verifier, not the anonymous crowd.Source: §2 · p. 2
  • The adversary knows the system but not the secret key, may submit responses to the verifier, and may modify either the motion or video channel.The model assumes the verifier rate-limits queries and measures how attack success grows with the query budget.Source: §2 · p. 2
  • Recapture is the defining VR channel: the verifier may receive only a screen recording and must re-estimate motion to authenticate the key holder.The security goals also include undetectability, unforgeability, replay resistance, robustness, and integrity under modification.Source: §2 · p. 2
  • The deployment separates keyless observers, a key-holding verifier with raw motion, and a key-holding verifier that must recover motion from video recapture.The user chooses the verifier and remains anonymous to other observers; the keyed mark is linkable by that verifier by design.Source: §2 · p. 3
  • A fresh verifier nonce and self-clocked epoch bind each response to its session; nonce reuse revives replay, while the freshness slack bounds relay opportunity.The codeword and whitening keystream derive from HMAC of the epoch, nonce, and deployment context.Source: §2 · p. 3
  • Verification is symmetric and deniable: the verifier can produce the same transcript, so MoSign proves a shared-key relationship rather than non-repudiable attribution.A transferable proof could expose the user’s identity to others.Source: §2 · p. 3

3 Design

MoSign separates motion content from a keyed style-latent carrier, then embeds a fresh, error-corrected mark and reads it with a key-conditioned verifier. The verifier tests codeword matches over sliding windows, with epoch and nonce binding supporting freshness.

3.1 Notation and the motion VAE

  • The content latent carries temporal motion while the style latent controls global style and serves as the watermark carrier; an upstream anonymizer handles residual identity in content.The watermark overwrites only the style latent with a keyed, user-independent draw, so the watermark itself adds no de-anonymization side channel.Source: §3.1 · p. 4

3.2 Keyed embedding (prover)

  • MoSign forms a time-varying mark from the epoch, session nonce, and deployment context, then protects it with BCH error correction before embedding.The specified BCH code is BCH(63,30,t=6); the message is renewed per epoch, so an older recording carries a mark invalid at a later epoch.Source: §3.2 · p. 4
  • Keystream whitening makes the embedded sign pattern pseudorandom to keyless observers, while Gaussian-Shading preserves the style latent’s marginal normal distribution.The keyed sign pattern is combined with magnitudes independent of the signs, leaving the style latent marginally identical to the prior.Source: §3.2 · p. 4

3.3 Reading and verification (verifier)

  • The learned reader extracts per-sign logits from observed joints, dewhitens them with the key, and soft-sums repeated codeword bits.It uses canonicalized joints and low-frequency temporal features; the key makes repeated bits coherent, while replicas without dewhitening cancel.Source: §3.3 · pp. 4–5
  • The verifier applies a sequential probability ratio test to codeword matches over sliding windows, renewing the epoch and nonce binding to provide replay resistance.It checks neighboring epochs to tolerate desynchronization; verification uses 2-second windows, while generation waits for the full epoch to be encoded.Source: §3.3 · p. 5

4 Security Analysis

The analysis reduces detection and keyless recovery to pseudorandom-function security, and bounds online forgery by the verifier’s false-accept probability and query budget. Its security claims depend on nonce freshness, a bounded query budget, and the verifier’s calibrated test.

Undetectability

  • With an ideal pseudorandom function, watermarked and baseline motion have identical distributions, giving detection AUC 0.5; with a real keyed function, distinguishing advantage is bounded by PRF advantage.The equality applies across any number of samples; the stated construction excludes generation-only asymmetric operations that could restore a detectable footprint.Source: §4 · p. 6

Authentication security

  • Forgery probability is bounded by Qε_FA + Adv_prf, assuming nonrepeating nonces and no genuine response within the verifier’s freshness window.This combines the per-attempt false-accept probability across at most Q attempts with the PRF advantage.Source: §4 · p. 6

False-accept calibration

  • 1.6 × 10^-4 wrong-key windows were falsely accepted in measurement; the deployed verifier’s analytical bound is ε_FA ≤ 3p_tail ≈ 1.8 × 10^-4.The single-window tail is 5.9 × 10^-5 for a ≥47/63 match, and the three-epoch hypothesis test accounts for the multiplicity in the deployed bound.Source: §4 · p. 6

Security scope

  • At n=63, ε_FA is a deployment quantity rather than a negligible security parameter, so the guarantee requires rate-limiting the adversary’s online queries.A deployment that does not bound Q does not inherit the stated query-bounded guarantee.Source: §4 · p. 6

Recovery and replay resistance

  • A keyless decoder recovers no better than chance under an ideal PRF, and its advantage with a real PRF is bounded by PRF distinguishing advantage.Without the keystream, pseudorandom flips cancel the replicated codeword bits; a replay older than the verifier’s tolerated freshness window is rejected, but a same-nonce recording inside that window can authenticate.Source: §4 · p. 6

5 The Recapture Channel

Recapture can erase a subtle watermark when a generic pose estimator projects motion onto the clean-motion manifold. MoSign instead uses a dedicated keyed reader trained on recaptured data, while preserving chance-level keyless detection.

Recapture channel

  • A generic estimator strips the subtle watermark to chance on both synthetic and real recapture channels, exposing an undetectability–robustness tension.The mark’s energy is below the estimator’s reconstruction fidelity, making recapture the watermark’s weak channel in this setting.Source: §5 · pp. 6–7

Receiver-side keyed reader

  • A dedicated keyed reader jointly trains a 2D-to-3D lifter and extractor on recaptured data while keeping the prover frozen.Its key-conditioned objective drives readout to chance when the key is absent or wrong; a keyless party’s estimator-level Gen-versus-Base AUC remains approximately 0.5.Source: §5 · p. 7

Where security comes from

  • A Kerckhoffs adversary trained from scratch still falls short of the deployed reader even when given the dewhitening key, while fully keyless reading remains at chance.The comparison frames recovery as a key-gated capability of the dedicated verifier rather than a property of one network.Source: §5 · p. 7

6 Implementation

The implementation trains the motion VAE and codec on HumanML3D, evaluates a receiver-side reader across projected and rendered channels, and also tests on BOXRR-23 VR motion. The reader is trained with the prover frozen, including against an earlier prover checkpoint.

Implementation and evaluation

  • The shipped reader reaches 0.949 on the projected-2D channel and 0.809 through the full render-to-RGB loop when reading the shipped prover.It was trained against an earlier prover checkpoint, so the reported reading result is not from a co-adapted reader–generator pair.Source: §6 · p. 7
  • The motion VAE is trained on HumanML3D, and the implemented threat-model channels, including recapture, are incorporated as differentiable layers in an online curriculum.The prover and verifier are trained in stages; the receiver-side keyed reader is trained with the prover frozen.Source: §6 · p. 7
  • The key-necessity figure compares codeword accuracy across reader backbones and four key conditions, with the from-scratch Kerckhoffs adversary’s orange bar as independent evidence.The implementation also evaluates the same architecture on BOXRR-23 motion, whose skeleton and sensing modality differ from HumanML3D.Source: Figure 4 · p. 7, §6 · p. 7

7 Evaluation

MoSign is evaluated for authentication, undetectability, recapture recovery, replay and forgery resistance, and composition with motion anonymization. The results show strong authentication and key-gated recovery across tested channels, while fresh challenges constrain replay and the watermark adds no measured re-identification leakage.

7 Evaluation

  • The evaluation tests authentication, undetectability, recapture and key necessity, replay and forgery, and anonymizer composition, alongside baseline comparisons and adaptive attacks.Codeword accuracy is the dewhitened, soft-combined 63-bit accuracy.Source: §7 · pp. 7–8

7.1 Authentication accuracy and robustness

  • TPR = 1.0 at FPR = 10−4 on clean motion and resampling, smoothing, noise, and retargeting; cropping is weakest at 0.78, with temporal-DWT codeword accuracy of 0.87.Dropout reaches 0.96. The reported median time-to-authenticate is 2 seconds.Source: §7.1 · p. 8

7.2 Undetectability (C3)

  • The rendered-motion discriminator measures AUC = 0.51 (95% CI [0.49,0.54]), an interval containing chance; removing whitening gives AUC 0.99 and generation-only asymmetry gives AUC 0.78.The deployed latent discriminator measures AUC 0.50; the authors report that symmetric keystream whitening is necessary for the measured undetectability.Source: §7.2 · p. 8, Figure 6 · p. 9

7.3 Recapture and key-necessity (C4)

  • The keyed reader recovers 0.95–0.96 on synthetic recapture and about 0.81 through the real render-to-video loop, while keyless recovery stays at chance.On the real loop, the keyed reader is applied zero-shot, without a scale oracle; recovery remains about 0.81 across frontal-to-profile viewpoints.Source: Table 3 · p. 9, §7.3 · p. 9

7.4 Unforgeability (C2)

  • At Q=64, the black-box query adversary’s forgery success is 1.7×10^-2, rising about linearly from 2.4×10^-4 at Q=1.Across 64 keys, pooled cross-key false-accept is 1.6×10^-4. Fresh-nonce cross-session replay is rejected, while nonce reuse revives replay; splicing recorded windows against a live nonce gains no advantage over a random impostor.Source: §7.4 · pp. 10–11

7.5 Composition with anonymization (C3)

  • After anonymization, MoSign’s codeword accuracy is 0.987 and re-identification is 0.024, statistically indistinguishable from anonymized-only motion at 0.034.The watermark-free VAE round-trip re-identification rate is 0.026; the authors attribute residual leakage to the anonymizer rather than the watermark.Source: §7.5 · pp. 11–12

7.6 Baseline comparison

  • With both message and keystream frozen, Gen-Static reaches AUC 1.00 and replay forgery 0.97; classical post-hoc additive marks remain detectable and are stripped by recapture.The authors limit the post-hoc conclusion to the classical additive family, noting that a learned post-hoc encoder might close part of the gap.Source: §7.6 · pp. 12–13

7.7 Adaptive attacks and defenses

  • With slack = 1, recordings delayed beyond one epoch or replayed across sessions with a fresh nonce are rejected 100%; real-time relay remains out of scope.The ±1-epoch acceptance slack provides about 10 seconds of clock-skew tolerance.Source: §7.7 · p. 13

8 Discussion and Limitations

MoSign’s recapture robustness is scoped to a key-holding verifier, and its evaluation identifies motion-quality costs, generation delay, and a Gaussian-latent assumption as important boundaries.

Sim-to-real conditions

  • 0.81 key-holder recovery is reported through the real render-to-RGB-to-detection loop without a scale oracle, but harder renders and in-the-wild video remain future work.Recovery falls to 0.76 under elevation and occlusion; the generation-side route is only an estimator-agnostic proxy, and robustness is not claimed for any estimator.Source: §8 · p. 13

Utility cost

  • Jerk reaches 153.3 against 38.9 m/s3 and foot-skating reaches 0.142 against 0.066, while the unmarked autoencoder round trip already accounts for most of the degradation.The mark adds 15 m/s3 jerk and +0.016 foot-skating; whether the residual is visible at 20 fps remains untested in a psychophysical study.Source: §8 · p. 13

Generation latency

  • 9.8 s of buffering precedes emission at the shipped 196-frame window, because the encoder attends over the whole epoch.A 40-frame epoch reduces buffering to 2.0 s with at most 0.01 codeword-accuracy loss; a causal encoder would remove buffering altogether.Source: §8 · p. 13

Undetectability assumption

  • Undetectability relies on zp ∼ N(0,I); drift to a non-Gaussian zp weakens the guarantee to ε-undetectability.Source: §8 · p. 13

9 Conclusion

MoSign makes motion watermarking an authentication protocol with security guarantees and key-holder recapture robustness. The paper presents it as the first in-generation skeletal-motion watermark and the first used for entity authentication.

Conclusion

  • MoSign turns a watermark into an authentication protocol on the motion channel that is provably undetectable, replay-resistant, and forgery-resistant to a bounded-query adversary.Source: §9 · p. 13
  • MoSign is, to the authors’ knowledge, the first in-generation watermark for skeletal motion and the first used for entity authentication.Source: §9 · p. 13
  • MoSign is robust to recapture for the key holder and offers a security-grounded answer to the analog hole of public VR.Source: §9 · p. 13

Ethical Considerations

The work uses public or permissioned datasets and reports no human-subject research or live-service attacks. MoSign augments an upstream anonymizer rather than replacing it, while key custody shapes its dual-use risk.

Human subjects

  • No human subjects were involved, no new data were collected, and no user study was run; motion quality was measured with MPJPE, jerk, and foot-skating.Source: Ethical Considerations · p. 14

De-anonymization evaluation

  • The re-identification experiment tested whether MoSign adds a de-anonymization side channel using the anonymizer’s published benchmark on 1,000 BOXRR-23 users, without linking identifiers to real people.Source: Ethical Considerations · p. 14

Attacks

Dual use

  • A verifier with the persistent shared key can link sessions, and a platform holding that key can confirm streams from it; the key belongs with the party the user chooses.Source: Ethical Considerations · p. 14

Scope

A Related Work

Prior work supplies the threat setting, authentication alternatives, watermarking foundations, and attack models that MoSign adapts. MoSign distinguishes itself by carrying per-epoch entity-authentication proof in generated skeletal motion.

VR motion biometrics and anonymization

  • VR motion can identify users at population scale, generalizes weakly across XR applications [36], and can be recovered from recorded avatar gait; anonymizers perturb identity-bearing motion.Source: A Related Work · p. 16

Authenticating without identifying

  • Anonymous credentials bind authentication to session establishment, while VR behavioral biometrics recognize the person; MoSign instead carries proof in the stream to reject stale replay and splicing.Source: A Related Work · p. 16

Classical motion and animation watermarking

  • Classical motion watermarks are post-hoc and target copyright or tamper detection, whereas MoSign targets live-party authentication under a per-epoch challenge.The post-hoc spread-spectrum baseline is keyed to renew per epoch, isolating what the in-generation route buys.Source: A Related Work · pp. 16–17

In-generation and learned watermarking

  • MoSign builds on differentiable encoder-decoder watermarking, distribution-preserving Gaussian Shading, and related image, video, and 3D-generation work [15] [20], extending generative watermarking to skeletal motion and authentication.Source: A Related Work · p. 17

Statistical detection and attacks

  • MoSign’s hypothesis-testing decision draws on the LLM z-test framework, while black-box watermark forgery motivates its unforgeability analysis and adaptive-adversary evaluation.The verifier is symmetric and holds k; publicly detectable signature-based verification has a payload cost a 63-bit motion epoch cannot currently absorb.Source: A Related Work · p. 17

Motion generation, data, and 3D pose estimation

  • The embedding primitive requires a Gaussian latent and also runs in a frozen Motion Diffusion Model; discrete token-logit backbones are left to future work.The evaluation uses HumanML3D, AMASS, LAFAN1, 100STYLE, and BOXRR-23, with monocular pose estimation as the recapture channel.Source: A Related Work · p. 17

B Generality of the embedding primitive

The appendix tests transfer across motion distributions and generators, as well as payload and epoch choices. Results show that readout transfers more broadly than the dataset-specific generator, while practical capacity and epoch length involve distinct tradeoffs.

The embedding primitive ports to an external generator

  • 0.995 clean codeword accuracy (TPR 1.0) across N=128 generations shows the primitive works with a frozen external MDM generator and DDIM-inversion readout.The written initial noise stays N(0,I) (latent WM-IND AUC 0.52), and wrong-nonce reads are at chance (0.50).Source: Table 7 · p. 17, B Generality of the embedding primitive · p. 17

Zero-shot transfer to unseen motion distributions

  • On unseen LAFAN1 and 100STYLE motions, clean codeword accuracy is 0.96 on both, with TPR 1.0; every single benign channel stays intact.Crop, dropout, and their seven-attack composition degrade accuracy to 0.80–0.92; deployment on a new distribution requires retraining the generator and jointly trained extractor.Source: B Generality of the embedding primitive · p. 17

Payload length

  • At n = 127, clean accuracy is 0.73 versus the repetition-coding bound’s 0.92, showing practical capacity falls below the idealized curve beyond n = 63.The default 63-bit BCH(63,30,t=6) codeword sits at the knee, where every channel clears the one-epoch sequential-test threshold.Source: Figure 13 · p. 18, B Generality of the embedding primitive · p. 18

Epoch length

  • A 40-frame epoch buffers 2.0 s and costs at most 0.01 codeword accuracy on most channels, while cropping improves to 0.972 from 0.863.The verifier’s time-to-authenticate runs on top of the prover’s buffer; the sweep does not separate the benefits of shorter epochs from improved phase alignment under cropping.Source: B Generality of the embedding primitive · p. 18

C Removal attacks in detail

Removal attacks vary in distortion and access requirements, and stripping a mark does not impersonate its user. Per-epoch renewal tolerates partial removal, while adaptive recapture laundering reduces but does not eliminate keyed recovery.

The removal attacks

  • Cross-sample averaging is the only attack that strips below the 0.027 m footprint, and only with repeated same-motion access under K keys or epochs.The shared-motion/key or multi-epoch access is a protocol-level precondition; single-clip PGD collapses authentication only near the watermark footprint, while purification needs 0.077 m.Source: C Removal attacks in detail · pp. 18–19
  • The keyless presence detector has WM-IND AUC 0.51 yet drives verifier acceptance to 0.10 at ∼0.16 m and zero at 0.30 m.Its gradient degrades shared high-frequency energy without reading the keyed codeword: undetectability limits what an observer learns, not what a gradient can destroy.Source: C Removal attacks in detail · p. 19
  • Splicing observed epochs produced zero per-stream false accepts in measured trials, and the best-of-Q curve extrapolated from that rate stays zero to Q=10^4.Splicing is harder than perturbing a genuine stream because the assembled stream carries no epoch’s codeword intact.Source: C Removal attacks in detail · p. 19

Per-epoch authentication and what removal buys

  • Per-epoch authentication accepts every stream with at least one of six epochs intact, unlike one-shot SPRT, which falls from 1.00 to 0.08 as survivors decrease.Time-to-authenticate rises from 2 s to ∼32 s as clean epochs grow scarce; this experiment tests partial contamination, not simultaneous corruption of every epoch.Source: Figure 15 · p. 19, C Removal attacks in detail · p. 19

Adaptive laundering of the recapture channel

  • Keyless adaptive laundering lowers keyed recovery from 0.98 to 0.65 at 0.004 m added MPJPE, but never reaches chance; key-aware PGD floors at 0.54.At 0.87 m, thirty times the watermark footprint, the key-holder still reads 0.74; sustained denial requires continuous in-line channel control.Source: Figure 16 · p. 19, C Removal attacks in detail · pp. 19–20
Loading 2609.29603v1…