Same sensor-exposure model as the 3D lab, laid out as a flat, pannable/zoomable top-down floor plan instead of an orbiting 3D scene. A depth/spatial-mapping camera scans the room into a point cloud (furniture clusters shown as dot groups); an inward eye-tracking camera samples gaze direction at ~90–120 Hz, drawn as a live scanpath in the gaze-plane inset, top right. Both are genuinely needed for good AR — but unfiltered, each becomes a privacy channel:
roomLeak = depthOn ? 100 · (1−trust) · (1−mitigation) · boundaryFactor : 0
gazeBase = 0.35 + 0.65·(1−trust)
gazeID = gazeOn ? 100 · gazeBase · (1−0.85·mitigation) · (boundaryOn?0.35:1) : 0
attackSurface = 0.45·roomLeak + 0.55·gazeID (0–100)
boundaryFactor = 0.1 if compositor boundary on, else 1.0
This is the exact same formula the 3D sim runs — it was checked numerically here (extremes at trust/mitigation = 0% and 100%, boundary on/off) and holds inside [0,100] with no clamp inconsistency, so nothing needed fixing in this sibling; it is a faithful port, not a bugfix.
- Spatial-mapping leak — a raw room point cloud reveals floor plan, furniture, screens, even documents on a desk to any app that requests the depth API, regardless of what the app is nominally for.
- Gaze biometric identifiability — published eye-tracking research (e.g. Stanford's VR gaze-authentication studies) shows a person's saccade dynamics and fixation micro-timing are distinctive enough to re-identify them from well under a minute of gaze data — gaze is weighted 0.55 here because it degrades far less under trust alone than a plain permission would.
- Trust level — how much an app is nominally vetted (store review, code signing); it helps, but a "trusted" app that still receives the raw stream can be compromised or simply misuse the data, so trust alone never reaches zero exposure.
- On-device mitigation — differential-privacy noise injection and spatial-mesh coarsening applied before data ever leaves the device; the strongest lever against both channels.
- Compositor boundary — the OS renders the final composited frame itself and hands the app only that image, never the raw camera/depth buffer — the dominant real-world mitigation in shipping AR/VR platforms (visionOS, Quest) — cutting exposure by ~90%.
Drag the floor plan to pan, scroll/pinch to zoom in on any furniture cluster. Purple points are protected, red points are currently leaking to the app; the gaze-plane inset brightens and its trail lengthens as gaze identifiability rises.