A VR headset renders the wearer's hands so they can aim, and that same rendered motion, read from a shared view or a malicious app, spells the secret. The defense that has taken hold hides the message rather than the hand: the keyboard prompts extra ghost presses, forwards the real keys, and drops the ghosts, so the attacker sees one unlabeled stream. Its whole security rests on the ghost being indistinguishable from a real press. Separatrix shows it is not, because a prompted press is a cued action and a fluent press is not.
A VR keyboard has no keys to feel. The wearer aims a ray or a fingertip at a floating layout and commits a press with a pinch, a trigger, or a dwell. To let the wearer aim, the platform renders the hands and exposes their pose to applications at high rate. That rendered, exposed motion is the leak: mapped to the nearest key, it recovers the right key on a commodity headset most of the time, and related attacks work from head pose, from the shared avatar in a multiplayer session, and from the eye signal behind a gaze keyboard.
Because the platform cannot hide the hand, a second line of work hides the message. A decoy-injecting keyboard interleaves meaningless presses with the real ones, forwards the genuine keys, and discards the ghosts, so the application behaves as if no decoys were typed while the attacker reads a padded stream. The move is old and trusted elsewhere: honeywords place fake passwords beside the real one, and cover traffic pads a flow with dummy packets. In every case the security rests on one property, that the decoy is drawn from the same distribution as the real item.
Load-bearing assumption. A ghost press is only cover if the attacker cannot separate it from a genuine press. Where VR is different. A decoy password and a real password differ only in content, which the defense controls. A decoy keystroke and a real keystroke differ in how they are produced, which the defense cannot fully control. What breaks. Resemblance has to hold in every dimension the attacker can measure, not just the one the designer had in mind. In VR the manner of production is such a dimension.Fluent typing is overlearned. The typist is not searching for keys, the motor system runs a practiced program, and successive presses come fast, near a 0.26 second median in mid-air VR typing. A decoy press cannot be overlearned, because the wearer does not know in advance which key the keyboard will demand. The keyboard issues a prompt, the wearer reads it, finds the key on the layout, and reaches for it. Each of those steps has a cost that reaction-time work has measured for decades, and even the simplest cued response cannot beat a floor near two tenths of a second. A prompted press clears a read, locate, reach penalty that a fluent press never pays, and it lands late, near a 0.46 second median.
Timing is the loudest signal, but not the only one. A fluent reach follows a smooth, direct path to the key. A cued reach, launched after a search, bends and corrects mid-flight, so the straightness of the motion is a second, independent signal that does not depend on timing at all. Neither signal needs a single ground-truth label, because both are properties of how a press was made, not what it was.
Separatrix runs in three phases. It cannot safely assume decoys are present, because stripping presses from a stream that was never padded destroys a secret it could have read directly. So it first asks a yes or no question about the timing of the stream with a sequential test, and only then separates. It scores every press with three label-free features, and it decodes the secret with one beam search that folds keep-or-drop and spelling into a single choice rather than thresholding, deleting, and then decoding.
The three signals are chosen to be properties of how a press was produced. Timing is the gap to the previous committed press, standardized in log space against the fluent population, so a large positive score marks a slow, likely cued press. Reach geometry is the detour of the reach, the ratio of the path the hand travels to the straight-line distance, which is high for a cued reach and independent of timing. Language skip gain asks a character language model a counterfactual: does the most probable string improve if this press is dropped as a decoy? A press whose removal makes the string more word-like is more likely a ghost.
# each press gets a soft score, not a hard label p_real = logistic(w0 + w1·z_timing + w2·z_detour + w3·skip_gain) # the decoder folds keep-or-drop and spelling into one search for each press in beam: keep(press) # commit to one of its top-3 keys by landing position or drop(press) # treat as ghost score(hypothesis) = Σ kept [ log p_real + λ·log P_key ] + Σ dropped log(1 - p_real) + β·log P_language(spelled string)
None of the three signals is sufficient on its own. Timing does most of the work but mislabels a fast ghost and a slow real press. Geometry catches some fast ghosts, because a quick cued reach still bends. Language catches the rest, because a fast ghost that survives usually leaves the string less word-like, and the decoder can then drop it. The joint decode is what lets them cover each other.
The attack turns on a claim about human timing, so the claim does not rest on numbers we assert. The harness draws a secret from a credential-like corpus, lays it on a mid-air layout, generates a committed-press stream, and injects decoys at a chosen ratio, and every behavioral parameter is fixed from a prior published measurement before any attack is run. Building it this way is deliberate: a first-party user study would let us tune the very timing gap the attack exploits, which is the last thing a skeptical reader should trust.
| parameter | value | calibrated to |
|---|---|---|
| real inter-key median | 0.26 s | 136M-keystroke typing study |
| cued slowdown | about 1.8x | choice cost, visual search, reaction-time floor |
| corroborating slowdown | 3.4x | prose vs unpredictable typing, EMG keylogging |
| key pitch | 2 cm | mid-air VR keyboards |
| base nearest-key accuracy | 0.88 | fielded 86 to 98% pose attacks |
| landing jitter | Gaussian | Quest hand tracking |
| language model | char trigram | password guessing |
| beam width | 24 | tractable, holds near-ties |
The cued median is where the attack lives, so we do not pick it, we bound it from components measured separately and then report results across a sweep of the slowdown rather than banking on one value. The 1.8x we use sits near the low end of a bracket set by scrambled keypads (about 1.4x) and fully randomized layouts (about 3.7x), since a VR prompt names the target key rather than forcing a blind search.
With no defense, both attackers read the clean stream and recover nearly every secret. The moment injection turns on, they part ways completely. A decoy-unaware attacker, which reads the padded stream as if every press were real, is length-exact, so a single inserted ghost makes its guess the wrong length and its top-20 recovery falls to near zero. Separatrix, reading the same stream, recovers the secret in its top twenty for 83 percent of trials at a low injection ratio, easing to 57 percent at the strongest setting. The defense is not weak against a naive adversary, it does exactly what it was built to do. It is the wrong defense against an adversary that knows to look at timing.
Three readings sharpen the result, and none of them let the attack off the hook.
Where recovery comes from. In an ablation, the timing feature alone matches the full attack and removing timing collapses recovery to zero. Geometry and language are not idle, they add real but secondary lift, most where timing is ambiguous. Any defense that leaves the timing gap open leaves the attack most of its power. Timing is sufficient, not necessary. Turning the tell fully off, modeling ghosts timed exactly like real presses, Separatrix still recovers just over half of secrets, 0.54, from geometry and language alone. The attack does not stand or fall on the one modeled quantity. Length does not buy safety. Recovery falls from 0.81 for short secrets to 0.55 for ten to twelve character ones, because a longer secret gives the decoder more presses to mislabel but also more presses to score. Long secrets stay well within reach. Detecting the defense is cheap. A single press separates real from ghost at an area under the ROC curve near 0.93, steady across the injection range, so a sequential detector flags the defense within about three presses at a strict false-alarm rate. Detection is the first step of the attack, not a leap of faith.If prompting is what gives a decoy away, the fix is to stop the prompt from showing. We study the most direct version, matching the cadence of ghost presses to real typing, against an attacker that retrains at each setting so the defender gets no credit for a stale classifier. Pulling ghost cadence toward fluent typing works, and it works because it starves the loudest feature: recovery falls from 0.64, where ghosts run at the full cued delay, to 0.54 once ghost timing matches fluent typing. That lands right where the timing-off analysis predicted, which is the consistency check we want.
Here is the tension the defender cannot escape. A ghost is fast only if the wearer does not have to search for it. To make a ghost as fast as fluent typing, the keyboard has to let the wearer press it without reading a prompt, which means the ghost has to be predictable, which is exactly the property that lets a shoulder surfer tell it apart. The defender trades a timing tell for a predictability tell. We do not resolve that trade, we name it, because it tells a keyboard designer where the real work is: shaping the reach as well, which is harder, since the wearer's hand, not the keyboard, draws the path.
Separatrix is evaluated as a trace-driven attack in simulation, calibrated entirely from previously published, already-IRB-approved measurements of typing and hand tracking; it reports no new user study, and the released artifact operates on synthetic and published traces only. We do not claim decoy injection is worthless. We claim something narrower: that a decoy generated by prompting is not free cover, because prompting leaves a trace in the motion. We are notifying the authors of the VR decoy defenses we evaluate ahead of publication, sharing both the attack and the cadence-matching countermeasure.
Separatrix sits in the Human-Centered Computing line, where sensitive interaction should stay protected on the device, and it shares a boundary with Cellular and Wireless Privacy, since the leak is a cross-layer side channel the platform is forced to expose. It is the full version of Winnow, the workshop paper accepted at XR Security '26, and it is in submission to USENIX Security. The lesson is meant to travel past this one keyboard: every deception defense rests on a resemblance, and it fails at whatever dimension the designer forgot to match. In VR, that dimension was the wearer's own hand.
A decoy keeps a secret only while it passes for the real thing. In virtual reality a decoy is not a string but an act, and the act gives it away.