Second Workshop on Enhancing Security, Privacy, and Trust in Extended Reality (XR) Systems

Extended Reality (XR) is a comprehensive term that includes Augmented Reality (AR), Mixed Reality (MR), Virtual Reality (VR), and AI glasses. XR bridges physical and digital worlds, creating interactive, immersive experiences that merge with the real world. It offers numerous applications across education, training, manufacturing, collaborative 3D design, art, and multiplayer gaming.

Despite these benefits, XR systems introduce unique security, privacy, and trust challenges due to the intimate connection between users, their XR devices, and their immediate environments. The potential attacks can involve information flooding to induce latency and physical discomfort, injecting misleading virtual content to distract or deceive users, subverting personal area networks to create confusion, spoofing alarms, assessing user status through eye tracking, and accessing onboard cameras to gather environmental information without the user's awareness. Additionally, XR apps can access sensitive real-time inputs like eye gaze, head movement, hand gestures, and even biosignals, and users' immediate environment. These signals, while critical for immersive experiences, open up novel attack surfaces such as keystroke inference, emotional profiling, and behavioral tracking.

Matthew Wilding, Program Manager of the Information Processing Techniques Office at DARPA

Bio: Dr. Matthew Wilding joined the Defense Advanced Research Projects Agency (DARPA) in 2022. He leads programs in software engineering and critical system assurance.

Wilding came to DARPA from Collins Aerospace, where he managed the trusted methods group, working with Collins product groups and government research sponsors to pioneer rigorous development methods and apply them to computer-based products. He served as a company subject matter expert on formal verification, and he led the machine-checked verification of a separation kernel in the AAMP7 microprocessor’s firmware and the development of the Turnstile high-assurance network guard.

Earlier in his career, Wilding founded and led a digital vision research group, researched how to use automated theorem provers to establish hardware and software correctness, and worked as a software engineer. He holds a PhD in Computer Sciences from the University of Texas at Austin.

Intrinsic Cognitive Security

DARPA’s Intrinsic Cognitive Security (ICS) program is using mathematical approaches, known as formal methods, to guarantee that mixed reality (MR) system designs mitigate potential cognitive effects. MR merges real and virtual worlds in real time. Cognitive effects that have been demonstrated in virtual settings include manipulating emotion, inducing cybersickness, causing confusion or anxiety, and reducing trust in equipment. Cognitive engineering principles are applied to commercial MR systems designs, but today’s methods do not ensure that systems operate safely when facing an adversary intent on interfering with a mission. This talk describes challenges faced by MR system developers and highlights ICS research progress.

Habiba Farrukh, Assistant Professor in the Department of Computer Science at the University of California, Irvine

Bio: Habiba Farrukh is an Assistant Professor in the Department of Computer Science at the University of California, Irvine, where she leads the Security and Privacy of Emerging Computing Technology (SPECT) Lab. Her research combines system design and program analysis with AI and human-centered methods to uncover threats in emerging platforms such as extended reality, wearables, IoT, and other physical AI systems, and to build defenses that are both technically robust and aligned with users' needs. Her work has been published at top venues including IEEE S&P, USENIX Security, ACM CCS, NDSS, and ACM MobiCom. She is a recipient of the NSF CAREER Award, and her work has received a Best Paper Honorable Mention Award at USENIX Security. She received her Ph.D. in Computer Science from Purdue University.

Securing Extended Reality: Threats, Defenses, and the Road Ahead

Extended reality (XR) devices are quickly becoming everyday platforms not only for socializing, learning, and entertainment, but also for critical applications in domains such as healthcare, manufacturing, and defense. To deliver immersion, XR systems continuously sense users' bodies and surroundings, blend content from many parties into a shared 3D space, and offload trust to user devices that platforms do not fully control. These same design choices create new attack surfaces with no direct counterpart on traditional computing platforms such as mobile and the web. In this talk, I will present our work uncovering security and privacy risks across the XR stack, from sensing users and their surroundings, to perceiving and interacting with virtual content, to sharing virtual spaces with others, as well as the app ecosystem that delivers these experiences. I will also discuss defenses and what users' own experiences reveal about their tradeoffs, and conclude with open challenges and opportunities as AI reshapes both how XR systems are attacked and how they can be defended.

Murtuza Jadliwala, Associate Professor in the Department of Computer Science at the University of Texas at San Antonio

Bio: Murtuza Jadliwala, PhD is an Associate Professor in the Department of Computer Science at the University of Texas at San Antonio (UT San Antonio), where he directs the Institute for Cyber Security (ICS) and the Security, Privacy, Trust and Ethics in Computing Research Lab (SPriTELab). He obtained his doctoral (PhD) degree in Computer Science from the University at Buffalo, State University of New York in 2008. Prior to joining UT San Antonio, he was a Post-doctoral Fellow at the Swiss Federal Institute of Technology (EPFL) in Lausanne, Switzerland (2008 – 2011) and an Assistant Professor in the Electrical Engineering and Computer Science department at Wichita State University in Wichita, Kansas (2012 – 2017). He is a recipient of the AFOSR Summer Faculty Research Fellowship in 2015, the Dwayne and Velma Wallace Excellence in Teaching Award in 2017, the NSF CAREER award in 2020, and the ONR Summer Faculty Research Fellowship in 2026. His research broadly focuses on all aspects of cyber and cyber-physical systems security & privacy, with a special focus on Mobile & IoT Security, Privacy Enhancing Technologies, Adversarial Machine Learning & Generative AI Security, and the design of Mobile/Ubiquitous Sensing Algorithms, Systems and Applications. He has received Distinguished Paper Awards at IEEE WristSense (2018), USENIX Security (2025) and NDSS (2025).

Leaky Realities: Security and Privacy at the Boundary Between the Physical and Virtual Worlds

Extended reality (XR) users live in two worlds at once: the physical world their bodies occupy and the virtual world their headsets render. In this talk, I will argue that many pressing XR security and privacy challenges arise at the boundary between these worlds, and present three studies from my group that probe it from different directions. First, I will show how the boundary can serve as a shield: AR glasses can overlay randomized keyboard layouts visible only to the user, defeating both visual and side-channel shoulder surfing. Next, the physical world leaks into the virtual one: motion data from users' smartphones and smartwatches, correlated with their avatars' movements, can de-anonymize them in social VR applications. Finally, the virtual world leaks into the physical one: heat radiated by a VR headset, captured with a commodity thermal camera, reveals which application the user is running with over 90% accuracy from about ten seconds of observation, without any access to the device. I will conclude with open challenges in defending XR users against such cross-reality leakage.

• A full paper should NOT exceed 6 pages (US letter size) double column including figures, tables, and references in standard ACM format. Papers must be submitted electronically in printable PDF form via the HotCRP submissing website. Templates for the standard ACM format can be found at this link.
• A poster or demo paper is limited to 2 pages under the same formatting guidelines.