# Lensless Gaze Is Not Private by Default: Auditing Identity Leakage Across Disclosure Surfaces

arXiv: https://arxiv.org/abs/2609.09188 · HTML: https://mlsanity.com/paper/2609.09188/

## Key facts

- No citing papers in the map yet (data through 14 Oct 2026).
- Builds on 16 of its 29 references that are in the map.
- First posted on arXiv 31 Aug 2026.

## Builds on (most cited first, 16 of 16)

- [Membership Inference Attacks against Machine Learning Models](https://mlsanity.com/paper/1610.05820/) (2016)
- [Understanding intermediate layers using linear classifier probes](https://mlsanity.com/paper/1610.01644/) (2016)
- [Machine Learning Models that Remember Too Much](https://mlsanity.com/paper/1709.07886/) (2017)
- [A Survey of Privacy Attacks in Machine Learning](https://mlsanity.com/paper/2007.07646/) (2020)
- [It's Written All Over Your Face: Full-Face Appearance-Based Gaze Estimation](https://mlsanity.com/paper/1611.08860/) (2016)
- [DiffuserCam: Lensless Single-exposure 3D Imaging](https://mlsanity.com/paper/1710.02134/) (2017)
- [OpenEDS: Open Eye Dataset](https://mlsanity.com/paper/1905.03702/) (2019)
- [A privacy-preserving approach to streaming eye-tracking data](https://mlsanity.com/paper/2102.01770/) (2021)
- [Differential Privacy for Eye Tracking with Temporal Correlations](https://mlsanity.com/paper/2002.08972/) (2020)
- [Lensless Imaging by Compressive Sensing](https://mlsanity.com/paper/1305.7181/) (2013)
- [OpEnCam: Lensless Optical Encryption Camera](https://mlsanity.com/paper/2312.01077/) (2023)
- [PrivateGaze: Preserving User Privacy in Black-box Mobile Gaze Tracking Services](https://mlsanity.com/paper/2408.00950/) (2024)
- [FlatTrack: Eye-tracking with ultra-thin lensless cameras](https://mlsanity.com/paper/2501.15450/) (2025)
- [Assessing the Privacy Risk of Cross-Platform Identity Linkage using Eye Movement Biometrics](https://mlsanity.com/paper/2402.08655/) (2024)
- [LenslessFace: An End-to-End Optimized Lensless System for Privacy-Preserving Face Verification](https://mlsanity.com/paper/2406.04129/) (2024)
- [Trade-offs in Privacy-Preserving Eye Tracking through Iris Obfuscation: A Benchmarking Study](https://mlsanity.com/paper/2504.10267/) (2025)

## Abstract (arXiv)

Lensless near-eye sensing is often described as privacy-friendly because its coded measurements are visually unintelligible. Yet visual unintelligibility reflects human interpretation, not what a learned adversary can recover. We therefore treat identity privacy as a systems property of disclosure surfaces: representations crossing sensing, storage, computation, and output boundaries. We audit a simulated lensless gaze pipeline under a 36-subject known-gallery closed-set identification protocol with a fixed, known PSF; privacy from an unknown or varying optical key is outside our scope. Reported accuracies are empirical attack success rates under matched linear and MLP probes and do not upper-bound stronger adversaries. Simulated lensless measurements yield 96.7% top-1 identification versus 97.7% for matched original eye crops, while an MAE embedding retains 94.3%. Compression alone offers little protection: 8-D PCA and a matched 8-D bottleneck retain 93.2% and 91.8%, whereas separately trained 8-D GSPL bottlenecks yield 77.5% mean recovery across three seeds. A released 128-way gaze token lowers single-frame recovery to 38.1%, while its residual and continuous gaze output expose 62.1% and 72.6%, respectively. Under a source-frame-disjoint tiled protocol, token summaries reach 39.9% at T=25, showing that repeated-output risk depends on representation and aggregation. These rates reflect all subject-correlated information in the evaluated dataset, including acquisition and behavioral cues, rather than isolating intrinsic ocular biometrics. Ordinary least squares residualization against a six-dimensional crop geometry and intensity summary still leaves lensless recovery at 95.1%. Our results show that privacy claims for lensless sensing must be tested at disclosure boundaries rather than inferred from appearance.