Lensless Gaze Is Not Private by Default: Auditing Identity Leakage Across Disclosure Surfaces

This paper conducts an audit of identity leakage within a simulated lensless gaze sensing pipeline to demonstrate that visual unintelligibility does not equate to privacy by default. The research treats identity privacy as a systems property across disclosure surfaces—including sensing, storage, computation, and output—showing that subject-correlated information remains recoverable even when optical encoding is fixed and known. This work matters because it shifts the focus of gaze system security from optical encryption to auditing where sensitive information persists across various stages of data handling.

Disclosure Surface Auditing

The authors evaluate measured, stored, represented, retained, released, and temporally aggregated signals under one explicit attacker protocol using a known-gallery closed-set identification protocol. The core finding is that privacy claims for lensless sensing must be tested at disclosure boundaries rather than inferred from appearance. Specifically:

1. Original crops (L0) yield 97.7% top-1 identification accuracy, and simulated lensless measurements (L1) yield 96.7%.

2. A six-dimensional sourcecrop geometry/intensity summary reaches 95.5%, indicating that positioning, illumination, crop geometry, and related acquisition cues contribute strongly.

3. Residualizing the flattened lensless measurement against these cues only reduces recovery from 96.7% to 95.1%.

Controlled Simulated-Lensless Audit

The study instantiates this audit in a simulated pipeline derived from the Open Eye Dataset (OpenEDS). The authors intentionally set up a setting where the same optical encoding is used across enrollment and evaluation, unlike systems like OpEnCam which treat optical elements as a secret key. The audit evaluates leakage using matched linear and multilayer perceptron (MLP) probes on held-out temporal blocks. Key results include:

Original crops and simulated lensless measurements yield 97.7% and 96.7% top-1 identification, while a masked autoencoder (MAE) embedding retains 94.3.

An 8-D principal component analysis (PCA) projection retains 93.2%, and a matched 8-D bottleneck on the same frozen MAE backbone retains 91.8%.

Compression Controls and Representation Leakage

The research investigates whether dimensionality reduction alone guarantees privacy, comparing different compression controls. The findings show that dimensionality alone does not explain leakage reduction.

1. Separately trained 8-D Gaze Semantic Projection Latent (GSPL) bottlenecks yield a mean recovery of 77.5% across three training seeds, demonstrating that representation and training choices materially affect leakage.

2. A matched 8-D bottleneck on the same frozen MAE backbone retains 91.8%, suggesting that a width-matched same-backbone bottleneck remains highly identifying.

Output and Time-Aware Analysis

The audit examines leakage at the output boundary using the GazeSplit construct, which partitions a continuous gaze estimate into a released quantized token and a locally retained residual.

1. A released 128-way gaze token lowers single-frame recovery to 38.1%.

2. The residual (L5) exposes 62.1%, and the continuous gaze output (L6) exposes 72.6%.

3. Under a source-frame-disjoint tiled protocol, token summaries reach 39.9% at T=25, showing that repeated-output risk depends on representation and aggregation.

Discussion of Findings

The audit establishes that visually unintelligible simulated lensless measurements can remain highly subject-predictive under an enrolled attacker, including after acquisition-cue residualization and under a full-resolution spatial probe. The study concludes that privacy should be evaluated as a property of the entire sensing pipeline rather than optical encoding alone, emphasizing the need to Audit the system, not the image and to Treat stable geometry, positioning, illumination, behavior, and learned features crossing trust boundaries as attack surface. It notes that while tokenization reduces empirical recovery from 38.1%, privacy still depends on whether residual or full-precision predictions are exposed elsewhere.

What the Audit Does Not Establish

The paper explicitly states what it does not establish to maintain scientific rigor:

The rates are simulation- and protocolspecific, not universal properties of lensless imaging.

They do not isolate intrinsic ocular biometrics from acquisition cues, demonstrate cross-session persistence, evaluate unseen identities, or provide formal privacy guarantees.

The results characterize subject-correlated recoverability under a specified disclosure and threat model, rather than an intrinsic information-theoretic identity bound.

Design Implications

The authors suggest several design practices:

1. Audit the system, not the image.

2. Treat stable geometry, positioning, illumination, behavior, and learned features crossing trust boundaries as attack surface.

Here are the specific improvements to AI systems based on the findings of this paper, categorized by where they should be applied:

) Lensless Gaze System Improvements: Disclosure-Surface Auditing Framework

The core improvement is shifting from auditing performance metrics (like accuracy) to auditing privacy risk across defined disclosure boundaries.

1. Predictive Privacy Risk Assessment Module:

Identify and map all data flows within an AI pipeline (from sensor input to final output, including intermediate representations like embeddings or bottleneck projections). For each flow, define the trust boundary where the information is disclosed (e.g., raw pixel data vs. a tokenized output).

2. Boundary-Specific Attack Modeling:

Develop tailored adversary models for different boundaries:

• For high-resolution sensor/original crops (L0): Model attacks based on geometry, illumination, and acquisition cues (positioning/lighting).

• For learned embeddings (L2): Model attacks exploiting internal representation structure using model inversion or membership inference.

• For compressed representations (L3', MAE bottleneck): Model attacks exploiting principal component subspaces and bottleneck constraints.

• For released outputs (L4, L5, L6): Model risks based on token entropy, residual leakage, and temporal aggregation strategies.

3. Adversarial Training for Boundary Resilience:

Implement adversarial training that specifically targets the identified leakage surfaces rather than just maximizing task accuracy. For instance:

• Train the model to maintain high task accuracy (gaze estimation) while minimizing sensitivity to perturbations in the acquisition cues (geometry/intensity summary).

• Train the latent representation learning process to ensure that stable subject-correlated information (like head pose or persistent gaze patterns) does not persist strongly in downstream bottleneck layers.

4. Output Minimization Strategy:

Adopt a multi-stage output strategy based on the audit findings:

• Instead of releasing a full continuous gaze stream (L6), prioritize releasing only the quantized token (L4) for immediate interaction, while keeping the high-resolution residual (L5) locally retained for calibration or error correction.

• Implement Privacy Pruning layers that explicitly remove or heavily obfuscate known subject-correlated features identified in the audit (e.g., normalizing intensity/geometry summaries before passing data to downstream components).

5. Temporal Privacy Control:

For continuous outputs, implement temporal aggregation strategies (like the source-frame-disjoint tiling protocol) that are proven to reduce leakage over time. This involves using token summaries at specific intervals rather than releasing every frame sequentially, as this mitigates the risk associated with repeated releases (L7).

) Specific System Capabilities Enabled by These Improvements:

The improved AI system can achieve the following:

1. Secure Deployment in Sensitive Environments: The system can be deployed in scenarios where data is shared across multiple untrusted components (e.g., edge devices communicating with a cloud service) because it has been audited and hardened against leakage at every interface, not just the final output.

2. Privacy-Aware Model Design: Developers gain a framework to explicitly understand that visually unintelligible measurements do not equate to private. The system can be designed specifically to preserve privacy by isolating and protecting stable acquisition cues (geometry/lighting) from the identity-sensitive features (gaze dynamics).

3. Robust Compression for Privacy: The system can utilize dimensionality reduction (like PCA or bottleneck layers) not just for efficiency, but as a measurable control against leakage, allowing engineers to choose compression levels that balance utility against a quantifiable privacy risk budget.

4. Intelligent Data Release Protocols: The system can dynamically adjust its data release strategy based on the context (e.g., releasing high-fidelity data for local calibration vs. releasing low-entropy tokens for public interaction), ensuring that the most sensitive information is only exposed when strictly necessary and under controlled conditions.

Lensless near-eye sensing is often described as privacy-friendly because its coded measurements are visually unintelligible. Yet visual unintelligibility reflects human interpretation, not what a learned adversary can recover. We therefore treat identity privacy as a systems property of disclosure surfaces: representations crossing sensing, storage, computation, and output boundaries. We audit a simulated lensless gaze pipeline under a 36-subject known-gallery closed-set identification protocol with a fixed, known PSF; privacy from an unknown or varying optical key is outside our scope. Reported accuracies are empirical attack success rates under matched linear and MLP probes and do not upper-bound stronger adversaries. Simulated lensless measurements yield 96.7% top-1 identification versus 97.7% for matched original eye crops, while an MAE embedding retains 94.3%. Compression alone offers little protection: 8-D PCA and a matched 8-D bottleneck retain 93.2% and 91.8%, whereas separately trained 8-D GSPL bottlenecks yield 77.5% mean recovery across three seeds. A released 128-way gaze token lowers single-frame recovery to 38.1%, while its residual and continuous gaze output expose 62.1% and 72.6%, respectively. Under a source-frame-disjoint tiled protocol, token summaries reach 39.9% at T=25, showing that repeated-output risk depends on representation and aggregation. These rates reflect all subject-correlated information in the evaluated dataset, including acquisition and behavioral cues, rather than isolating intrinsic ocular biometrics. Ordinary least squares residualization against a six-dimensional crop geometry and intensity summary still leaves lensless recovery at 95.1%. Our results show that privacy claims for lensless sensing must be tested at disclosure boundaries rather than inferred from appearance.