← CHI 2026 map

CHI '26 · Honorable mention · full-paper review · confidence medium-high

Leveraging Biometric-Rich Hand Gestures for Head-Mounted Display Authentication

Amin Jalilov , Eunyong Cheon , Ian Oakley

DOI PDF Program page Page JSON

This is a well-scoped CHI security paper with a clear systems contribution: user-defined gestures become the credential, and biometric hand motion becomes the verifier. The evaluation is credible for the stated threat model, but the claims should be read as platform- and setup-specific rather than broadly universal.

Axes Lens

Rare contribution shape, typical evidence profile. The point here is not a score. It is to show what kind of claim the paper makes, and whether the evidence pattern is unusual or baseline in this 268 -review set.

Review Summary

This paper is strongest as a systems-and-evaluation contribution in HMD authentication. Its core move is not merely to authenticate with gestures, but to reinterpret free-form, user-chosen gestures as knowledge-based cues and then secure them with biometric hand-joint motion signals via per-user anomaly detection. That combination is the paper’s main conceptual contribution, and it is grounded in a concrete implementation rather than a purely speculative design. The validation is also appropriately matched to the claim: the authors report a multi-session user study and a worst-case observation attack study, with strong reported performance against video-based attacks and reasonable retention over one week. That makes the evidence persuasive for the specific threat model they studied. At the same time, the limitations are important and materially shape how far the results can be generalized. The paper explicitly notes a relatively small and homogeneous sample, a single-device Meta Quest 3 setup at 60 Hz, omission of headset-based signals such as eye tracking or head motion, and an attack setup based on a single-view camera in a known vulnerability zone. Those constraints do not undermine the contribution, but they do mean the work should be interpreted as a promising design and validation for a particular HMD context, not as a universal solution for all head-mounted authentication scenarios. In field terms, the paper advances biometric-rich interaction as an authentication substrate and gives CHI a concrete example of how behavioral signals can be operationalized for security without reverting to conventional passwords alone.

What Changed

Canon before

Prior HMD authentication work largely centers on passwords or other explicit credentials, while behavioral biometrics in HMD interaction are treated as distinctive signals rather than as user-chosen authentication cues. The paper positions itself against that baseline by combining free-form gesture choice with biometric motion traces.

Departure from common sense

The paper departs from the usual assumption that gesture authentication is mainly about remembering and reproducing a secret pattern. Instead, it treats the gesture itself as a user-chosen cue while relying on biometric hand-motion traces to add a second security layer, which is a less obvious pairing than password-like entry alone.

Actual novelty

The paper’s novelty is in framing user-proposed free-form gestures as knowledge-based credentials in VR/HMDs and pairing them with per-user anomaly detection over hand joint motion signals. The contribution is not just gesture entry, but the biometric-rich authentication design and its evaluation against observation attacks and longitudinal use.

Evidence

The paper presents a knowledge-driven HMD authentication system that combines free-form user gestures with hand-joint-motion biometrics, then evaluates it in a multi-session study and a worst-case observation attack study. Reported results include strong attack resistance and one-week recall retention, while the limitations section explicitly notes sample homogeneity, single-device/60 Hz constraints, omitted headset signals, and a constrained attack recording setup.

Limits

Method limits

The study is limited by a relatively small and homogeneous participant sample, a single device platform (Meta Quest 3), and a fixed 60 Hz sampling rate. The evaluation also omits headset-based signals and does not test broader device or sensing configurations.

Deployment limits

Deployment may be constrained by dependence on hand-joint tracking quality, the need for per-user model training, and the fact that the attack evaluation used a single-view camera setup in a known vulnerability zone rather than a broader real-world adversarial setup.

Boundary conditions

The reported results apply best to the tested HMD platform, the studied gesture set, and the specific observation-attack conditions. Generalization beyond the sampled population, beyond 60 Hz sensing, or to settings with additional attacker viewpoints remains unverified.

Manual check: No manual check required for schema completeness; however, the novelty claim should be interpreted conservatively because the evidence packet does not include broader prior-art comparison beyond the provided excerpts.

Position in field

This work sits at the intersection of HMD authentication and behavioral biometrics. It extends gesture-based authentication by making the gesture itself a user-defined cue and using motion-derived biometric signals as the security substrate, rather than relying only on memorized secrets or static input patterns.

Abstract

User authentication on head-mounted displays (HMDs) relies on passwords, which are cumbersome to input and susceptible to shoulder-surfing attacks. Recent research has revealed that behavioral signals collected during common HMD tasks are highly distinctive between users. Building on these findings, this paper presents a knowledge-driven behavioral authentication system for HMDs. Our system leverages user-defined gestures as cues and trains an anomaly detector on hand joint motion signals for each user. To evaluate effectiveness, we conducted a comprehensive multi-session user study (n=20) and an observation attack study (n=10). The results show that gestures secured with joint motions are resilient to worst-case scenario video-based observation attacks (AUC = 0.97, EER = 3.58%) and maintain high recall performance over one week (AUC = 0.93, EER = 9.82%). These findings suggest that user-generated biometric hand gestures offer a promising approach to securing HMDs.