Lensless Gaze Is Not Private by Default: Auditing Identity Leakage Across Disclosure Surfaces
This paper demonstrates that lensless near-eye gaze sensing is not inherently private, as empirical audits reveal that coded measurements and various derived representations still leak sufficient subject-correlated information to enable high-accuracy identity reconstruction, proving that privacy must be evaluated at system disclosure boundaries rather than inferred from visual unintelligibility.
Original paper licensed under CC BY 4.0 (http://creativecommons.org/licenses/by/4.0/). This is an AI-generated explanation of the paper below. It is not written by the authors. For technical accuracy, refer to the original paper. Read full disclaimer
In the world of human-computer interaction, the eyes are a powerful tool. They allow us to navigate virtual reality, control devices with a glance, and access information hands-free. To make this work, cameras often peer directly at the user's face to track where they are looking. This creates a privacy dilemma: to function, these systems must capture sensitive images of a person's eyes, which contain unique biological details that can identify them. For years, engineers have sought a solution that keeps the eyes visible to the machine but invisible to the human eye. One promising approach involves "lensless" sensing. Instead of using a traditional glass lens to focus light and form a clear picture, these systems use a special coded filter. This filter scrambles the light before it hits the sensor, producing a measurement that looks like a blurry, meaningless pattern of noise to a human observer. The prevailing hope has been that because a human cannot recognize the eye in this scrambled image, the data must be private and safe from being used to identify the person.
A team of researchers at the Indian Institute of Technology Madras decided to test whether this hope was justified. They built a simulated version of a lensless gaze-tracking system to see if a computer could still identify a person from these scrambled images, even if a human could not. Their investigation focused on a specific question: does the visual unintelligibility of the data actually protect the user's identity, or does the information simply hide in a form that machines can still read? They did not just look at the raw images; they traced the data as it moved through the entire system, from the initial sensor reading to the final output that a user might see or that a system might store. They treated every point where data crosses a boundary—whether it is stored on a server, compressed into a smaller file, or sent out as a final command—as a potential leak.
The researchers began by generating thousands of simulated lensless images from a dataset of real eye movements. In their setup, they used a fixed, known code to scramble the images, meaning the "key" to unscramble them was not secret. They then trained a computer program to act as an attacker, giving it a library of known identities to learn from. The goal was simple: could this program look at a new, scrambled image and correctly guess which of the thirty-six people it belonged to? The results were striking. When the attacker looked at the original, clear photos of the eyes, it correctly identified the person 97.7% of the time. When the attacker looked at the scrambled, lensless images, it was only slightly less successful, identifying the person 96.7% of the time. The visual scrambling had done almost nothing to stop the machine from recognizing the individual. The computer did not need to see a clear eye; it only needed to find stable patterns in the noise that were unique to that specific person.
The study then moved deeper into the system to see what happened when the data was processed further. Often, engineers try to protect privacy by compressing data, shrinking it down to a tiny size to save space or speed up transmission. The researchers tested this by taking the scrambled images and reducing them to very small, eight-dimensional summaries. They expected this drastic reduction to strip away the identifying details. Instead, the computer attacker could still identify the person with high accuracy, ranging from 91% to 93% depending on how the compression was done. Even when the data was processed into a semantic representation intended only to describe where the person was looking, rather than what they looked like, the identity leakage remained significant. The only time the attacker's success rate dropped noticeably was when the system output was a simple, quantized token—a single word from a list of 128 possible directions. In this case, the identification rate fell to 38%, but this was still far above the random chance of 2.8%.
The researchers also examined what happens when data is released over time. They simulated a scenario where a system sends out a stream of gaze directions rather than a single snapshot. They found that even if a single frame of data is somewhat safe, the accumulation of many frames over time can reveal the user's identity. When they aggregated data from twenty-five frames, the ability to identify the person rose again, reaching nearly 40% for the quantized tokens. This suggests that privacy is not a static property of a single image but a dynamic risk that changes depending on how long the data is observed and how it is combined. The study also revealed that much of what the computer was using to identify people was not the unique shape of their eye, but rather the way the camera was positioned, the lighting, and the specific geometry of the image capture. When the researchers mathematically removed these environmental clues, the identification rate dropped only slightly, proving that the core identity information was deeply embedded in the signal itself.
Ultimately, the work demonstrates that the visual appearance of data is a poor indicator of its privacy. A measurement that looks like random noise to a human can still be a rich source of identity for a machine. The researchers concluded that privacy cannot be assumed simply because an optical system makes an image look strange or unrecognizable. Instead, privacy must be verified at every stage where data leaves a secure environment. Whether the data is a raw sensor reading, a compressed file, or a final output command, each point of release must be audited to see if it still contains enough information to identify the user. The study does not claim that lensless technology is useless, but it warns that relying on visual unintelligibility as a shield is a dangerous mistake. True privacy requires active protection mechanisms designed specifically to prevent identity recovery, rather than hoping that the complexity of the image is enough to keep secrets safe.
Drowning in papers in your field?
Get daily digests of the most novel papers matching your research keywords — with technical summaries, in your language.