Metaverse Avatar Behavioral Biometrics

Session

AUTHENTICATED

Attacker Motion

Spoof deviation 1.8×

Detector Sensitivity

Match threshold 0.85

Tracking noise 0.03

Live Signature Match

0%100%100%

Cosine similarity

1.000

Anomaly score

0.00

Head jitter (σ)

0.00

Reach period

0.0 s

How it works

VR/metaverse headsets stream continuous 6-DoF pose data (head + two hand controllers) at 60–120 Hz. Instead of authenticating once at login, a continuous behavioral-biometric layer treats this motion stream itself as a signature: a sliding window of pose samples is reduced to a feature vector

f = [ v̄, σ_v, σ_head-tilt, r_reach, T_period, a_jerk ]

(mean speed, speed variance, head-tilt jitter, average hand-reach radius, dominant gait/reach period, and jerk) — a compact summary of *how* a specific person moves, not just *what* they do.

On enrollment the platform stores a baseline vector f₀. Every window afterward is compared with cosine similarity:

match = (f · f₀) / (‖f‖ ‖f₀‖)
anomaly = 1 − match
session locked if match < threshold

Re-enroll baseline — captures a fresh f₀ from the current (legitimate) motion pattern.
Spoof / replay attack — swaps the live stream for a different motion signature (a different person, a bot script, or a replayed recording), simulating an impostor trying to ride an already-open session.
Spoof deviation — how far the attacker's amplitude/frequency profile sits from the enrolled user's.
Match threshold — the similarity floor the detector accepts; raising it catches subtler impersonation but also legitimate motion drift (fatigue, different controller grip).
Tracking noise — sensor/tracking jitter added to every sample, showing why thresholds can't be set to 1.0.

This is the same principle used by real continuous-authentication research for XR headsets (motion/gait signatures identifying users from head and controller kinematics alone) and is purely defensive: it flags impersonation of an already-logged-in avatar, it is not a way to fabricate one.

Head trace Hand trace Spoofed motion

⚠ Couldn't load the 3D engineThree.js failed to load from the CDN. Check your connection and reload.