Protection Behind the Veil: Gaze, Privacy, and Context-Aware Adaptation in Extended Reality

Simple item page
dc.contributor.authorIlo, Cory I.en
dc.contributor.committeechairBowman, Douglas Andrewen
dc.contributor.committeememberDavid-John, Brendan Matthewen
dc.contributor.committeememberDiVerdi, Stephenen
dc.contributor.committeememberPatrick, Rafaelen
dc.contributor.committeememberNorth, Christopher L.en
dc.contributor.departmentComputer Science and#38; Applicationsen
dc.date.accessioned2026-10-23T08:00:15Zen
dc.date.available2026-10-23T08:00:15Zen
dc.date.issued2026-10-22en
dc.description.abstractgeneralHeadsets that blend digital content with the real world, often called extended reality or XR, are beginning to adjust what they show based on what the wearer is doing. To do that, they have to watch: cameras point outward at the surroundings, microphones listen, and small sensors track where the eyes are looking. That same watching is what makes these devices a privacy problem, both for the person wearing the headset and for anyone who happens to be nearby. This dissertation asks a simple question: can a headset be helpful without being nosy? The answer is yes, but only if privacy is designed in from the start. The key insight is that where a person looks is surprisingly personal. The pattern of someone's eye movements can be used to pick them out of a crowd, much like a fingerprint. So replacing the camera with an eye tracker does not automatically make a device private; it changes what kind of information is at risk. Three studies build the case. The first shows that a headset can use only where the wearer is looking to decide where to place a pop-up message so that it helps rather than distracts, with no need to record the room. The second shows that how eye-tracking data is stored and summarized matters a great deal: one way of describing eye movements kept the data useful while making it much harder to identify the person, and, unexpectedly, a blurrier version that looked more anonymous actually gave away more about who the person was. The third study looks at situations where the camera cannot be avoided. It tests a software assistant that helps people notice what their headset might be sharing, and finds that letting the assistant act on its own does not make the privacy work disappear; people simply shift from scanning the room themselves to double-checking the assistant's judgments. Together, these results offer a practical guide for building headsets that adapt to the wearer without asking them to give up their identity in exchange, and they argue that this kind of protection should be a built-in default rather than a setting that only experts know to change. This dissertation argues that privacy in these adaptive systems is necessary, feasible, and never automatic. Its key insight is that eye movements, which seem like a harmless alternative to a camera, are not anonymous: the way a person looks around is distinctive enough to identify them. Privacy therefore cannot come from simply picking a sensor that seems safer. It must be designed into how the data itself is recorded and handled. Three studies build the case. Goldilocks Zoning shows that where a person is looking is enough, by itself, for a headset to place notifications well, so filming the environment can often be avoided. InPlainGaze shows that the format in which eye-tracking data is saved matters enormously. One format kept the data useful for recognizing what the wearer was doing while making it much harder to tell users apart. Another format that looks more anonymous, a simple heat map of where the eyes lingered, actually gave away more identity. Looking anonymous is not the same as being anonymous. ARPA examines settings where cameras cannot be avoided and finds that an automated privacy assistant changes who does the work of staying private rather than making that work disappear. Together, the studies show that a device can understand what its user is doing without knowing who that user is: identity can be veiled while the situation stays visible. The dissertation closes by charting how such protection could become a quiet, built-in feature of future headsets and glasses rather than a setting only experts know to change.en
dc.description.degreeDoctor of Philosophyen
dc.format.mediumETDen
dc.identifier.othervt_gsexam:47019en
dc.identifier.urihttps://hdl.handle.net/10919/143958en
dc.language.isoenen
dc.publisherVirginia Techen
dc.rightsCreative Commons Attribution-NonCommercial-NoDerivatives 4.0 Internationalen
dc.rights.urihttp://creativecommons.org/licenses/by-nc-nd/4.0/en
dc.subjectgazeen
dc.subjectgaze-awareen
dc.subjectcontext-awareen
dc.subjectinferenceen
dc.subjectprivacyen
dc.subjecthuman-AI collaborationen
dc.subjectagentsen
dc.subjectnotification placementen
dc.subjectprivacy assistanten
dc.subjectautonomyen
dc.subjectheatmapen
dc.subjectrepresentation veilingen
dc.subjectprivacy-utility tradeoffen
dc.subjecttrusten
dc.titleProtection Behind the Veil: Gaze, Privacy, and Context-Aware Adaptation in Extended Realityen
dc.typeDissertationen
thesis.degree.disciplineComputer Science & Applicationsen
thesis.degree.grantorVirginia Polytechnic Institute and State Universityen
thesis.degree.leveldoctoralen
thesis.degree.nameDoctor of Philosophyen

Files

Original bundle
Now showing 1 - 1 of 1
Name:
Ilo_CI_D_2026.pdf
Size:
23.3 MB
Format:
Adobe Portable Document Format
Download

Collections

Doctoral Dissertations