# Recent Trends of Authentication Methods in Extended Reality: A Survey
## 4 Authentication Methods in XR
### Inference-Based (Biometric) Authentication
#### 4.2.2 Behavioral Biometrics
They further investigated BioMove's vulnerabilities through a security evaluation against malicious attacks using the Whitebox Penetration Testing (WPT) framework. The impersonation results indicated a 50% accuracy value, insufficient for positive user identification outcomes. They also highlighted that attackers with similar heights and genders to valid users score higher than other impersonators. They expressed interest in evaluating the robustness of BioMove across multiple subject groups while considering the effect of age on users' kinesiological movements. Following the approach used in [154], [PERSON] et al. [164] proposed an embedding-based approach for user identification in XR using motion data. Their approach overcomes the limited applicability of previously proposed distance-based approaches [139, 135, 150] and the costly deployability of classification-based approaches [158, 159]. They studied the use of Deep Metric Learning (DML) models known to produce continuous vector representations called embeddings. The DML models used are not limited to the user motion data they were trained on but can also generate unique embeddings from the motion data newly fed to the model. Their models learn to represent known users as close to their motion data, while they compare new users with existent motion data and retrieve the best similarities. The authors used the public database \"Who is Alyx?\"--a motion data dataset collected from 63 users while playing a VR game on an HTC-VP. They selected a Gated Recurrent Units (GRU) architecture for the DML model and trained it to embed the motion data. Evaluations of their model and comparisons with classification-based models were performed. The embedding-based approach performed better in situations where there was less enrollment data, while the classification-based model outperformed the embedding-based method in situations where there existed at least 20 min of enrollment data. Given that many use cases of prior works mainly allow for only a few seconds or minutes to enroll, the embedding-based approach became a compelling substitute. [PERSON] et al. [165] looked into the limitations of user identification work conducted by [147], such as stationary data collected over a single period of time, by exploring some of the improvements identified in the approach proposed in [136], which considers feature data generated over time and identification obtained by aggregated data from several sessions. To address that, they built their case study using a training task for operating room assists in a VR environment, where assists are involved in a series of motion tasks over a multiple-day span. The task is uncontrolled, as opposed to work in [147], resulting in non-stationary motion datasets. The data consists of a training session dataset and a retention session dataset. Using k-NN, RF, and Gradient Boosting Machine (GBM) classifiers, the authors investigated identification in two settings (within and between) sessions using positional features of the motion data. The highest user identification results for the within-setting showed a 95.50% accuracy rate with the RF classifier, while the between-settings results showed a 42.33% accuracy rate with the same classifier. They attributed the decline in results to the different circumstances of data collection between the training and retention sessions, such as psychological changes and a change in the VR device position. Moreover, they attempted a user anonymization study by interpolating the positional motion data used in the previous study with velocity data. Their velocity-based obfuscation study results showed worse accuracy than the prior study, with 35.17% vs. 13.83% for within and between settings, respectively. They assumed that the decrease in identification accuracy results was caused by the classifiers not being able to embed anatomical data such as user height and arm length.