Gait is a distinctive behavioral trait, yet its vulnerability against imitation remains underexplored in immersive environments. We present a study investigating how real-time visual feedback in virtual reality (VR) influences a person’s ability to mimic another’s gait. Through two experiments, we first identify the most usable feedback design (N = 8), then evaluate its impact on imitation performance compared to a baseline without feedback (N = 18). We analyze positional and rotational similarity between participants and target avatars, examining the influence of avatar–user gender matching and repeated practice. Our findings reveal that visual feedback significantly improves rotational alignment and that practice leads to measurable improvements in mimicry accuracy. We discuss implications for avatar embodiment, personalization in VR applications, and potential considerations for behavioral biometric systems. We also contribute a publicly available dataset of gait mimicry in VR, supporting further research on motion learning and imitation.

Despite their ubiquity, bicycles remain largely unexplored as a space for personalization and cyclist-aware solutions. Since cycling is inherently a behavioral activity, we investigate its potential as a biometric trait for continuous identification and personalization. For this, we mounted multiple sensors on a regular bicycle and conducted an outdoor experiment (N = 16) across two sessions on two cycling tracks: a short, controlled track and a long, in-the-wild setup. This design enabled us to examine how stable cycling patterns are across sessions and how well individuals can be distinguished in controlled versus real-world conditions. Our findings demonstrate the feasibility of leveraging cycling behavior for continuous identification and personalization, achieving identification accuracies of up to 94.3%. We discuss the implications of these results for real-world deployment, as well as the challenges posed by environmental factors, rider variability, and the need for robust and unobtrusive sensing solutions.

We propose a novel method for seamlessly identifying users by combining thermal and visible feet features. While it is known that users’ feet have unique characteristics, these have so far been underutilized for biometric identification, as observing those features often requires the removal of shoes and socks. As thermal cameras are becoming ubiquitous, we foresee a new form of identification, using feet features and heat traces to reconstruct the footprint even while wearing shoes or socks. We collected a dataset of users’ feet (N = 21), wearing three types of footwear (personal shoes, standard shoes, and socks) on three floor types (carpet, laminate, and linoleum). By combining visual and thermal features, an AUC between 91.1% and 98.9%, depending on floor type and shoe type can be achieved, with personal shoes on linoleum floor performing best. Our findings demonstrate the potential of thermal imaging for continuous and unobtrusive user identification.

Robots play a vital role in modern automation, with applications in manufacturing and healthcare. Collaborative robots integrate human and robot movements. Therefore, it is essential to ensure that interactions involve qualified, and thus identified, individuals. This study delves into a new approach: identifying individuals through robot arm movements. Different from previous methods, users guide the robot, and the robot senses the movements via joint sensors. We asked 18 participants to perform six gestures, revealing the potential use as unique behavioral traits or biometrics, achieving F1-score up to 0.87, which suggests direct robot interactions as a promising avenue for implicit and explicit user identification.

In this work, we explore attacker behavior during shoulder surfing. As such behavior is often opportunistic and difficult to observe in real world settings, we leverage the capabilities of virtual reality (VR). We recruited 24 participants and observed their behavior in two virtual waiting scenarios: at a bus stop and in an open office space. In both scenarios, participants shoulder surfed private screens displaying different types of content. From the results we derive an understanding of factors influencing shoulder surfing behavior, reveal common attack patterns, and sketch a behavioral shoulder surfing model. Our work suggests directions for future research on shoulder surfing and can serve as a basis for creating novel approaches to mitigate shoulder surfing.

Inertial sensors integrated into smartphones provide a unique opportunity for implicitly identifying users through their gait. However, researchers identified different external factors influencing the user's gait and consequently impact gait-based user identification algorithms. While these previous studies provide important insights, a holistic comparison of external factors influencing identification algorithms is still missing. In this explorative work, we conducted a focus group with participants from biometrics research to collect and classify these factors. Next, we recorded the gait of 12 participants walking regularly and being influenced by eleven different external factors (e.g., shoes and floor types) in two separate sessions. We used a Deep Learning (DL) identification algorithm for analysis and validated the analysis results using within- and between- sessions data. We propose a categorization of gait covariates based on users' control levels. Floor types have the most significant impact on recognition accuracy. Finally, between-session analysis shows less accurate yet more robust results than within-session validation and testing.

This paper contributes to our understanding of user-centered attacks on smartphones. In particular, we investigate the likelihood of so-called shoulder surfing attacks during touch-based unlock events and provide insights into users' views and perceptions. To do so, we ran a two-week in-the-wild study (N=12) in which we recorded images with a 180-degree field of view lens that was mounted on the smartphone's front-facing camera. In addition, we collected contextual information and allowed participants to assess the situation. We found that only a small fraction of shoulder surfing incidents that occur during authentication are actually perceived as threatening. Furthermore, our findings suggest that our notions of (un)safe places need to be rethought. Our work is complemented by a discussion of implications for future user-centered attack-aware systems. This work can serve as a basis for usable security researchers to better design systems against user-centered attacks.

One approach to mitigate shoulder surfing attacks on mobile devices is to detect the presence of a bystander using the phone’s front-facing camera. However, a person’s face in the camera’s field of view does not always indicate an attack. To overcome this limitation, in a novel data collection study (N=16), we analysed the influence of three viewing angles and four distances on the success of shoulder surfing attacks. In contrast to prior works that mainly focused on user authentication, we investigated three common types of content susceptible to shoulder surfing: text, photos, and PIN authentications. We show that the vulnerability of text and photos depends on the observer’s location relative to the device, while PIN authentications are vulnerable independent of the observation location. We then present PrivacyScout – a novel method that predicts the shoulder-surfing risk based on visual features extracted from the observer’s face as captured by the front-facing camera. Finally, evaluations from our data collection study demonstrate our method’s feasibility to assess the risk of a shoulder surfing attack more accurately.

Virtual Reality (VR) is becoming increasingly popular both in the entertainment and professional domains. Behavioral biometrics have recently been investigated as a means to continuously and implicitly identify users in VR. Applications in VR can specifically benefit from this, for example, to adapt virtual environments and user interfaces as well as to authenticate users. In this work, we conduct a lab study (N = 16) to explore how accurately users can be identified during two task-driven scenarios based on their spatial movement. We show that an identification accuracy of up to 90% is possible across sessions recorded on different days. Moreover, we investigate the role of users’ physiology in behavioral biometrics by virtually altering and normalizing their body proportions. We find that body normalization in general increases the identification rate, in some cases by up to 38%; hence, it improves the performance of identification systems.

Shoulder surfing is an omnipresent risk for smartphone users. However, investigating these attacks in the wild is difficult because of either privacy concerns, lack of consent, or the fact that asking for consent would influence people’s behavior (e.g., they could try to avoid looking at smartphones). Thus, we propose utilizing 360-degree videos in Virtual Reality (VR), recorded in staged real-life situations on public transport. Despite differences between perceiving videos in VR and experiencing real-world situations, we believe this approach to allow novel insights on observers’ tendency to shoulder surf another person’s phone authentication and interaction to be gained. By conducting a study (N=16), we demonstrate that a better understanding of shoulder surfers’ behavior can be obtained by analyzing gaze data during video watching and comparing it to post-hoc interview responses. On average, participants looked at the phone for about 11% of the time it was visible and could remember half of the applications used.

Since mobile interaction takes place in almost every context, shoulder surfing attacks are becoming more and more a threat to user's privacy. While several approaches exist to prevent these attacks for the authentication process, protecting the actual interaction has not yet been in the main focus of research. In this work, we present the concept of communicating shoulder surfing attacks to the user. This should create awareness on the user side and help preventing this type of privacy invasion. We present out shoulder surfer detection mobile application, called DSSytem, and report on a focus group that helped to design this system. We also report on the results of a user study in which we compare four different notification methods, namely, vibro-tactile, front LED, on-screen icon, and video preview feedback. Vibro-tactile feedback results in the lowest reaction time of the participants and is also favoured throughout the follow-up semi-structured interviews.