Beyond the Headset: A Systematization of Knowledge on Extended Reality Privacy and Security in Healthcare

Extended reality (XR) systems offer transformative potential for healthcare, but they simultaneously introduce novel and poorly understood privacy and security vulnerabilities that adversaries can exploit. This Systematization of Knowledge (SoK) surveys 65 peer-reviewed works published between 2017 and 2024 to synthesize a unified threat taxonomy spanning device, network, user, and cloud layers, introducing the quantitative evaluation framework XR-PRISM to rigorously assess security and privacy risks in XR healthcare technologies.

Systematization Methodology

The research employed a structured systematic literature review (SLR) process augmented by quantitative analysis to ensure an unbiased survey of security and privacy in the XR healthcare infrastructure. The methodology involved several detailed steps, as outlined in Figure 1:

1. Academic Databases: The SLR conducted searches across IEEE Xplore, ACM Digital Library, USENIX Proceedings, and PubMed.

2. Keyword Mapping: Search terms were organized into six groups—XR Modality (e.g., virtual reality), Healthcare Context (e.g., medical), Security Focus (e.g., attack or threat), Privacy Focus (e.g., PHI), Defense Mechanisms, and Quantitative Metrics—to generate targeted search queries like virtual reality AND healthcare OR PHI AND security.

3. Screening: A threshold year of 2017 was applied, resulting in 207 records initially, which were narrowed down to 116 unique records after removing duplicates and irrelevant studies.

4. Assessment for Final Scope: Inclusion criteria focused on studies that explicitly analyze threats or propose defenses in XR environments applicable to healthcare, while exclusion criteria removed general security papers without a healthcare implication or those lacking sufficient methodological detail.

Threat Modeling and Taxonomy

The paper deconstructs the XR pipeline into four concentric layers—User, Device, Network, and Cloud—to provide a data-driven classification of threats. This structure is mapped onto the MITRE ATT&CK for ICS Matrix to organize tactics which indicate the adversary’s high-level goals or why, and specific methods or how. The threat model categorizes attacks based on:

1. Architectural Layer: Identifying whether the threat exploits raw sensor streams (Device), network traffic (Network), application logic (Cloud), or what the user sees/interacts with (User).

2. Attack Vector: Describing the mechanism used, such as side-channel, network injection, UI spoofing, or firmware manipulation.

3. XR Target Component: Categorizing the specific part of the system being targeted.

Risk Assessment Framework (XR-PRISM)

To quantify and prioritize exposures, the authors introduce XR-PRISM (Privacy and Risk Impact Scoring Metric), which extends traditional metrics like CVSS and DREAD by explicitly folding in safety and privacy impacts. The framework uses a weighted sum formula:

RiskScore = LWL +V WV +AWA +Is WIs +Ip WIp + (10−C)WC.

Key risk factors are weighted according to the following parameters:

** Threat Likelihood (L)**

** System Vulnerabilities (V)**

** Attack Surface (A)**

**Safety Impact (Is) with a weight of 0.30, reflecting patient harm. **

Privacy Impact (Ip)

Evaluation Criteria for Defenses

The evaluation of proposed defenses is structured around several criteria to assess their effectiveness and practical limitations:

1. Defense Group: Grouped into three categories—Data Obfuscation, Access Control, and Authentication—based on implementation rather than just the risk layer they address.

2. Mitigation: Describes the process of implementation (e.g., using noise or rate-limiting) and its impact on security.

3. Deployability: Assesses overhead through criteria like Trade-off (measuring latency/immersion loss), Maintenance, and Efficacy (using Attack Success Rate).

4. Stage: Classifies defenses into Prevention Defense (P), Detection Defense (D), or Recovery mechanism (R).

Key Findings and Gaps

The analysis reveals several critical gaps in current research:

1. Low Prerequisites for Most Attacks: The majority of documented attack methods demand minimal prerequisites—most techniques score a 1 or 2 on the 'Requisite' scale. This suggests XR systems are broadly exposed to attacks by relatively unsophisticated adversaries.

2. Scarcity of Countermeasures: Only about 20% of total papers catalog countermeasures against the dozens of attacks surveyed, revealing a pronounced mismatch between threat volume and mitigation effort, particularly in network and cloud layer defenses.

Based on the provided scientific paper, here are specific improvements that can be made to AI systems in Extended Reality (XR) healthcare, along with what those improved systems can achieve:

1. Improved Security Through Context-Aware Threat Modeling and Risk Scoring:

2. Enhanced Privacy Preservation via Layered Defense Strategies:

3. Development of Adaptive, End-to-End Recovery Mechanisms:

Specific Improvements and System Capabilities:

1. The paper introduces the quantitative framework, XR-PRISM (Privacy and Risk Impact Scoring Metric), which moves beyond generic CVSS/DREAD scores by explicitly weighting safety impact (0.30) and privacy impact (0.20).

2. By applying this to AI systems, developers can move from reactive patching to proactive risk management based on specific threat vectors identified in the taxonomy (e.g., identifying if a motion-based attack is likely due to low prerequisite expertise but high patient safety impact).

3. The paper's four-layer architecture (User, Device, Network, Cloud) allows for targeted defense implementation:

4. AI systems can be designed with specific gatekeeper APIs (as suggested in Table 4) at the User Layer to enforce context-aware policies (e.g., automatically triggering a privacy manager when gaze behavior suggests sensitive data is being recorded).

5. To address the Lack of Shared Code and Reproducibility gap, AI research should prioritize:

6. The development of standardized, open benchmark suites with shared datasets for XR security testing to ensure that defenses are rigorously evaluated against a wide array of attack techniques identified in Table 3 (e.g., testing a defense against Keystroke Inference attacks using standardized motion telemetry).

7. To counter the Predominance of Preventative over Detective and Recovery Controls gap, AI systems must integrate:

8. AI-driven anomaly detection models deployed at the Network and Cloud Layers to monitor for signs of compromise (e.g., detecting unusual network traffic patterns indicative of a Man-in-the-Middle attack) rather than relying solely on pre-emptive blocking mechanisms.

9. The framework suggests developing AI models capable of predicting control effectiveness:

10. An Adaptive Defense Orchestrator that uses the XR-PRISM score to dynamically adjust mitigation strategies in real-time (e.g., automatically switching from low-overhead noise addition to full video encryption if the RiskScore crosses a defined threshold).

Specific Capabilities of the Improved AI System:

The improved AI system, guided by this research, can perform the following specific functions:

1. An AI-driven risk assessor that provides a RiskScore (0–10) for any proposed XR healthcare application based on its threat model against the four layers.

2. A real-time security monitor that detects and classifies active threats (e.g., distinguishing between an unauthorized session token theft and a simple network DoS attack).

3. An adaptive defense engine that dynamically adjusts privacy controls (like gaze data suppression or sensor rate limiting) based on the current operational risk score, ensuring a balance between high immersion/usability and necessary security/privacy guarantees for PHI.

4. A continuous learning system that incorporates findings from Exclusion Criteria (e.g., analyzing new attack artifacts) to continuously update the threat taxonomy and improve the efficacy of existing countermeasures over time.

Extended reality (XR) systems are increasingly used in healthcare applications ranging from surgical planning to remote rehabilitation and mental health support. However, the rich streams of sensor, biometric, behavioral, and environmental data that enable these applications also introduce substantial privacy and security risks. Adversaries may exploit insecure communication, sensor side channels, application-layer vulnerabilities, or data-processing pipelines to infer sensitive information or disrupt clinical workflows. Despite growing interest in XR security and privacy, the healthcare-specific literature remains fragmented. In this Systematization of Knowledge (SoK), we review 65 peer-reviewed studies published between 2017 and 2024 across XR, security, privacy, and healthcare venues. We develop a unified threat taxonomy spanning device, user, network, and cloud layers and introduce XR-PRISM, a quantitative Privacy and Risk Impact Scoring Metric for systematically characterizing security and privacy risks. Our analysis identifies several gaps in the literature: more than 70% of proposed countermeasures lack standardized risk evaluation, fewer than 15% of studied attacks require high attack prerequisites, and reproducibility is limited by the scarcity of publicly released artifacts and datasets. Based on these findings, we outline a research roadmap emphasizing shared benchmark datasets, stronger artifact-release practices, improved cloud-layer protections, and more comprehensive detection, mitigation, and recovery mechanisms. This SoK provides a structured and data-driven foundation for understanding existing risks and guiding the development of more secure, privacy-preserving, and usable XR healthcare systems.