PaperlayerView exact revision on arXiv

Source-linked AI summary

Beyond the Headset: A Systematization of Knowledge on Extended Reality Privacy and Security in Healthcare

Nafisa Anjum, M. Rasel Mahmud

arXiv:2609.38281v1cs.CRcs.HC

TL;DR

XR healthcare systems use rich data streams that create privacy and security risks, while healthcare-specific research remains fragmented. This SoK reviews the literature, organizes threats and defenses, and introduces XR-PRISM. It finds low barriers for many attacks and major gaps in defense evaluation and coverage.

  • Problem

    XR healthcare data streams create privacy and security risks, but healthcare-specific research remains fragmented.

    Source: §1 · p. 1

  • Method

    The SoK reviews XR healthcare security and privacy studies, organizes threats and defenses across four layers, and introduces the XR-PRISM risk-scoring framework.

    Source: §1 · p. 1, §3 · p. 3, §10 · p. 9

  • Results

    Most documented attacks demand minimal prerequisites, while surveyed defenses are predominantly preventative and fewer than 30% report standardized risk or anomaly-detection metrics.

    Source: §8 · p. 9

  • Takeaways & Limitations

    The surveyed defense landscape lacks substantial detection, forensics, and automated recovery mechanisms alongside prevention.

    Source: §8 · p. 9

    Proposed countermeasures often have low or modest efficacy, usability or performance costs, and unclear robustness against adaptive adversaries.

    Source: §8 · p. 9

Abstract

from arXiv · show

Extended reality (XR) systems are increasingly used in healthcare applications ranging from surgical planning to remote rehabilitation and mental health support. However, the rich streams of sensor, biometric, behavioral, and environmental data that enable these applications also introduce substantial privacy and security risks. Adversaries may exploit insecure communication, sensor side channels, application-layer vulnerabilities, or data-processing pipelines to infer sensitive information or disrupt clinical workflows. Despite growing interest in XR security and privacy, the healthcare-specific literature remains fragmented. In this Systematization of Knowledge (SoK), we review 65 peer-reviewed studies published between 2017 and 2024 across XR, security, privacy, and healthcare venues. We develop a unified threat taxonomy spanning device, user, network, and cloud layers and introduce XR-PRISM, a quantitative Privacy and Risk Impact Scoring Metric for systematically characterizing security and privacy risks. Our analysis identifies several gaps in the literature: more than 70% of proposed countermeasures lack standardized risk evaluation, fewer than 15% of studied attacks require high attack prerequisites, and reproducibility is limited by the scarcity of publicly released artifacts and datasets. Based on these findings, we outline a research roadmap emphasizing shared benchmark datasets, stronger artifact-release practices, improved cloud-layer protections, and more comprehensive detection, mitigation, and recovery mechanisms. This SoK provides a structured and data-driven foundation for understanding existing risks and guiding the development of more secure, privacy-preserving, and usable XR healthcare systems.

1 Introduction

XR supports clinical applications from rehabilitation to mental-health therapy, but its rich sensor and biometric data also create privacy and security risks. The paper addresses fragmented healthcare-specific research with a four-layer threat classification, analysis of threats and defenses, and a quantitative risk-scoring framework.

1 Introduction

  • XR healthcare applications span exposure therapy, surgical guidance, rehabilitation, remote consultation, and mental-health support, while their rich data streams expose patients and providers to privacy and security risks.The streams include motion traces, physiological signals, biometric identifiers, and environmental context.Source: §1 · p. 1
  • Healthcare-specific XR security research remains fragmented, with a disconnect between scholarly work and real-world hospital or industry use cases.Existing work also lacks a unifying healthcare-specific threat framework, while defenses are sparse and unevenly evaluated.Source: §1 · p. 1
  • The SoK classifies XR threats and defenses across four system layers and introduces XR-PRISM to quantify healthcare-specific privacy and security risks.It also maps threats and defenses to assess their effectiveness and practical limitations.Source: §1 · p. 1

2 Background

The paper frames XR as a family of immersive technologies used in healthcare and describes a pipeline spanning user, device, network, and cloud layers. These systems support clinical applications, but their sensor data can also expose sensitive user characteristics.

2 Background

  • XR includes VR, AR, and MR, which replace, augment, or blend with the perceived world through cameras, sensors, and displays.The modalities support different levels of immersion and interaction.Source: §2 · p. 2
  • The XR pipeline comprises four layers—User, Device, Network, and Cloud—with distinct functions and data flows.The user layer supplies intent and biosignals; the device processes sensor data and renders scenes, while network and cloud layers carry and process session data.Source: §2 · p. 2
  • Healthcare uses include rehabilitation, tele-therapy, and autism interventions, with reported improvements in movement, social engagement, anxiety, or adherence across cited studies.The passage also notes that XR sensors can reveal personal and health-related characteristics, creating confidentiality risks in therapeutic settings.Source: §2 · p. 2

3 Research Questions and Methodology

The SoK uses a structured systematic literature review with quantitative analysis to examine XR healthcare security and privacy. It defines questions about attacks, defenses, coverage gaps, and methods, then screens and models eligible studies to develop its findings and XR-PRISM.

3 Research Questions and Methodology

  • The review follows a structured systematic literature review process augmented by quantitative analysis and PRISMA recommendations.Its stated aim is to analyze publications, methods, and emerging patterns in XR healthcare security and privacy.Source: §3 · p. 3, §3.1 · p. 3

3.1 Research Questions

  • The research questions address demonstrated attacks, targeted system elements, attacker prerequisites, consequences, proposed defenses, their costs, and gaps in coverage.These questions organize the review around both threat characterization and defensive alignment.Source: §3.1 · p. 3

3.2 Methods for Systematization

  • The search covered IEEE Xplore, ACM Digital Library, USENIX Proceedings, and PubMed, using keyword groups spanning XR, healthcare, security, privacy, defenses, and metrics.The search returned 207 records from 2017–2024; after removing 91 duplicates and irrelevant records, 116 remained for eligibility screening.Source: §3.2 · p. 3
  • Eligibility screening retained 65 studies that analyzed XR threats or defenses applicable to healthcare, excluding work without healthcare relevance or adequate methodological detail.The authors qualitatively synthesized the selected studies’ methods, impacts, overhead, and reported accuracy.Source: §3.2 · p. 4
  • The authors extracted threat, adversary, and defense attributes to build classification criteria and a draft threat model, then evaluated the model and criteria to identify challenges and formulate XR-PRISM.The analysis covered target components, attack prerequisites, defense type, mitigation, overhead, maintenance cost, and impact.Source: §3.2 · p. 4

4 Evaluation Criterion: Threats

The threat evaluation uses an ICS-aligned taxonomy and classifies attacks by architectural layer, vector, target component, attacker prerequisites, expertise, and impact. These criteria support comparison of attack complexity and the sensitivity of exposed data.

4.1 ICS-Aligned Threat Taxonomy

  • The taxonomy maps XR threats to MITRE ATT&CK for ICS tactics and techniques, covering adversary goals across the attack lifecycle.The authors use the matrix to classify threats and identify areas lacking XR-health research or defenses.Source: §4.1 · p. 4

4.2 Threat Dimensions

  • Threat dimensions identify the exploited architectural layer, attack vector, and primary XR system component targeted.The layer classification distinguishes interference with sensors or hardware, network traffic, application logic, and user-facing interactions.Source: §4.2 · p. 4

4.3 Threat Complexity

  • Attack complexity is assessed along two axes: adversary prerequisites and the expertise needed to launch the attack.Prerequisites map to low, medium, or high levels, represented by Requisite scores 1, 2, and 3.Source: §4.3 · p. 5

4.4 Impact

  • The impact criterion captures the degree to which an attack exposes sensitive patient data, including biometric identifiers and session recordings.Examples include inferring conditions from head-tracking streams and revealing therapy content through side channels.Source: §4.4 · p. 5

5 Evaluation Criterion: Defenses

The section classifies defenses by implementation and assesses their mitigation, deployability, and robustness. It distinguishes prevention, detection, and recovery as stages of the security process.

5 Evaluation Criterion: Defenses

  • Defenses are grouped as data obfuscation, access control, and authentication; most mechanisms target the device layer.Grouping follows implementation, since an attack’s risk layer and its defense mechanism’s layer may differ.Source: §5 · p. 5
  • Mitigation describes how a defense is implemented, such as adding noise, limiting IMU access, or designing new APIs.It indicates a path for addressing specific attacks and the extent to which the attack may be prevented.Source: §5 · p. 5
  • A defense vector is the route used to block an attack payload, usually—but not always—the same as the attack vector.The randomized keyboard is a device-based defense example [108].Source: §5 · p. 5

5.1 Deployability

  • Deployability is assessed through implementation overhead and post-deployment maintenance requirements.Overhead includes added hardware or configuration and trade-offs such as reduced immersion or higher latency; maintenance may be continuous, intermittent, or negligible.Source: §5.1 · p. 5

5.2 Defense Robustness

  • Defense efficacy uses reported accuracy when available, or the decrease in attack success rate when accuracy is not reported.Accuracy was selected because it is the most frequently reported metric in defense-method studies.Source: §5.2 · p. 5
  • Defenses are classified by whether they prevent an incident, detect an attack in progress, or reduce harm after successful execution.These stages are prevention, detection, and recovery, respectively.Source: §5.2 · p. 5

6 Outline of Attacks and Defenses

The review describes attacks across device, user, network, and cloud layers, alongside selected defenses. Examples range from inferring typed content from motion or traffic to exposing user data through vulnerable applications and communications.

Device Layer

  • 86%–98% of typed keys were correctly identified for 13 out of 15 tested users by a shared-VR keystroke inference attack [117].It uses a noisy depiction of the target’s hand movements rather than physical observation.Source: §6 · p. 6
  • FaceReader reconstructed vital signs from facial vibrations sensed by headset motion sensors and identified gender above 93.33% [119].The review notes potential exposure of protected health information and biased treatment from demographic inference [23].Source: §6 · p. 6

User Layer

  • User-layer attacks exploit observed hand movements, gaze behavior, and motion trajectories; obfuscating motion reduced AvatarHunter’s attack success rate from 92% to almost 50% [66].GAZEploit can infer over 80% of keystrokes but requires a gaze-controlled input method currently available only on Apple Vision Pro; randomized virtual keyboards may reduce typing speed and accuracy [38].Source: §6 · p. 6

Network Layer

  • Network-layer examples include VR-Spy’s inference from WiFi channel-state information, Bigscreen session hijacking via cleartext traffic, infrared tracking jamming, and location inference from encrypted-traffic metadata.VR-Spy assumes the attacker can access the WiFi access point; Bigscreen’s cleartext session identifiers can enable impersonation or manipulation.Source: §6 · p. 6

Cloud Layer

  • Cloud-layer examples expose risks from malicious code running on a headset and unencrypted traffic between VR clients and a server.The latter can reveal avatars, session participation, and potentially emotion-tracking data, including in settings involving protected populations.Source: §6 · p. 6

7 XR-PRISM

XR-PRISM combines six weighted risk factors into a score that healthcare practitioners can use to prioritize threats and plan balanced defenses. It makes patient safety and privacy explicit in risk assessment and maps scores to mitigation priorities.

7 XR-PRISM

  • Most XR side-channel and inference attacks require minimal privileges and modest expertise, with few demanding specialized hardware or deep reverse-engineering.The paper notes that simply running a benign-looking XR app can expose motion or gaze streams to off-the-shelf inference models.Source: §7 · p. 6
  • The scoring process scales threat characteristics and calculates a weighted RiskScore for immediate mitigation prioritization.Control Effectiveness is subtracted from 10 because stronger controls reduce risk; the resulting score maps to Low-to-Critical tiers and corresponding action levels.Source: §7 · pp. 7–8
  • Six factors scored from 1 to 10 form a weighted RiskScore, with patient safety weighted 0.30 and privacy impact 0.20.Threat Likelihood and System Vulnerabilities each receive 0.15; Attack Surface and Control Effectiveness each receive 0.10. The weights are initial heuristics, with Delphi-style expert elicitation planned for calibration.Source: §7 · p. 8, Table 5 · p. 8
  • XR-PRISM extends risk assessment with dedicated Safety Impact and Privacy Impact factors to account for patient harm and PHI leakage in healthcare XR.The paper contrasts this emphasis with CVSS and DREAD and maps scores to actionable tiers.Source: §7 · p. 8
  • A tele-therapy motion-replay example involving disorientation and PHI inference is placed in the High tier, prompting recommendations for signed telemetry, edge anomaly detection, and biometric-stream encryption.The example illustrates how the framework turns a risk assessment into mitigation recommendations.Source: §7 · p. 8

8 Research Gaps

The survey identifies low attack prerequisites alongside sparse, unevenly evaluated defenses and limited reproducibility. It also finds gaps in cloud protection, post-compromise controls, and evaluation in clinical workflows.

8 Research Gaps

  • Most documented attacks score 1 or 2 on the prerequisite scale; only a handful reach level 3.The review links this low barrier to basic access, such as network proximity or unprotected APIs.Source: §8 · p. 9
  • Few surveyed studies publicly release implementations or detailed artifacts [72], hindering independent verification and comparative evaluation.The review recommends community repositories or artifact disclosure to improve transparency and reproducibility.Source: §8 · p. 9
  • Only about 20% of surveyed papers are countermeasures, with network and cloud defenses underrepresented, including protections for session hijacking and remote code execution.Few studies examine cloud-service attacks such as federated-model poisoning or inference from aggregated telemetry, or propose cloud-native defenses [35].Source: §8 · p. 9
  • Many proposed device-layer defenses trade security gains for usability or performance costs, while robustness against adaptive adversaries remains unclear.Randomized keyboards and Laplace-noise obfuscation may frustrate some side-channel inferences but can degrade user experience and be bypassed by smarter attacks.Source: §8 · p. 9
  • Fewer than 30% of proposals report standardized risk or anomaly-detection metrics, and only 15% include user-study-driven usability assessments.Nearly all surveyed defenses are preventative, while detection, forensics, and automated recovery mechanisms are scarce.Source: §8 · p. 9
  • Few XR healthcare applications evaluate or acknowledge security and privacy, while most XR security research uses generic testbeds rather than clinical workflows.The review says real-world efficacy and usability of these defenses in healthcare remain unknown.Source: §8 · p. 9

9 Related Work

Prior work examines selected XR privacy and security topics, but the authors distinguish this SoK by its healthcare focus, broader threat taxonomy, and quantitative risk framework.

9 Related Work

  • The authors identify Lake et al. as the only scoping review focused on attacks and defenses in Extended Reality healthcare applications.They distinguish their work as a Systematization of Knowledge with a more comprehensive attack-and-defense taxonomy and a quantitative risk-scoring framework.Source: §9 · p. 9
  • The authors frame their distinction from prior work as covering in-depth XR threat modeling, a more comprehensive attack-and-defense taxonomy, and quantitative risk scoring.The risk-scoring framework is designed according to the needs of trending XR research.Source: §9 · p. 9
  • Guzman et al.[21] classify MR protections into five categories, Giaretta[30] surveys VR risks and authentication, and Kumarapeli et al. examine behavioral-data identification.The authors say these works do not consider the full XR system pipeline or healthcare implications.Source: §9 · p. 9

10 Conclusion

The paper systematizes XR healthcare privacy and security research across 65 studies using a four-layer threat taxonomy and a weighted six-factor risk metric. It presents the review as a resource for researchers broadening XR research.

10 Conclusion

  • The SoK surveys 65 studies and organizes XR healthcare threats and defenses into device, user, network, and cloud layers.It presents this as a comprehensive systematization of knowledge on XR privacy and security in healthcare.Source: §10 · p. 9
  • XR-PRISM combines exploitability, safety and privacy impacts, and control effectiveness in a weighted six-factor risk-scoring framework.The framework is described as a single actionable metric.Source: §10 · p. 9
  • The authors hope the data-driven study will help newcomers and experts broaden the scope of XR research.The conclusion notes that compromising a clinical VR device and tampering with an immersive session may affect care delivery and patient safety or well-being.Source: §10 · p. 9
Loading 2609.38281v1…