Research
My research secures emerging mobile systems, such as wearables, including extended reality (XR) headsets, and protects the privacy of their users. I identify security and privacy risks on commodity devices and build practical defenses.
Methods: system design · formal methods · artificial intelligence · human-computer interaction
Identifying security and privacy risks through user-centered investigation
Immersive web (WebXR) applications rely on UI properties such as transparency and object overlap that increase immersion but can also be used to manipulate what users see and select. I study how these properties affect the people who use and build these applications.
- Characterizing UI attacks in WebXR. The first systematic investigation of UI attacks in WebXR, with five novel attacks and a taxonomy of 14 attacks. A 100-participant user study showed that every attack achieved its goal while users remained largely unaware of it. We disclosed the attacks to Meta, the WebXR standard maintainers, and the A-Frame developers. USENIX Security 2025, Honorable Mention
- Understanding developer practices. A task-based interview study with XR developers found that they repeatedly chose vulnerable implementations, justifying them by usability and aesthetics rather than security. Under review
Securing user interaction and device communication on commodity XR devices
I build defenses that run on today's headsets without relying on user vigilance or additional hardware.
- eXRpose. The first runtime system that formalizes security policies in temporal logic, monitors WebXR applications against them, and warns users about UI attacks as they occur. On a Meta Quest 3, it detected every violation across 15 attacks with under 5 ms average overhead. In a user study, it warned users in real time without significantly affecting task load or presence, and all participants preferred receiving its alerts. CCS 2026
- StareToPair. A group pairing system that uses the gaze and hand tracking built into mixed reality headsets to let co-located users establish a shared secret with a single gesture. A user study on HoloLens 2 showed that it pairs users reliably and resists impersonation by co-located adversaries. Under review
Other research
I also study privacy leakage beyond the user interface.
- GPU side channels in XR. Meta's built-in GPU profiler, even sampled at 1 Hz, reveals which application a user is running with over 99% accuracy, as well as which virtual products they select and how many people join a virtual meeting. This work received a Meta Bug Bounty Award. NDSS 2026
- Privacy of mobile applications for high-risk populations. An analysis of 242 apps marketed to military personnel and a survey of 103 military-affiliated participants showed that these apps leak data their developers do not disclose. Featured in WIRED. PETS 2026, Best Student Paper Award
- Mobile sensor side channels. A systematic analysis of side-channel attacks through mobile sensors. Under review