Pose Spoofing in VIO and Biometric Systems

• Pose spoofing is the adversarial manipulation of pose estimates, where small, bounded perturbations cause gradual but significant trajectory drift in systems like visual-inertial odometry.
• The defense leverages client-side temporal consistency modeling with autoencoder-based anomaly detection to identify subtle deviations between fast and slow pose estimations.
• Experimental evaluations show that while local motion consistency is maintained, forced re-anchoring can lead to accumulated global errors, highlighting a tradeoff in spoofing detection strategies.

In the supplied literature, pose spoofing is most precisely instantiated as the induction of a false pose-related state that remains plausible enough to be accepted by a downstream estimator or authentication pipeline. The clearest formalization appears in edge-offloaded visual-inertial odometry (VIO), where an adversary manipulates the low-rate server-returned pose anchor so that small bounded perturbations accumulate into substantial trajectory drift while preserving short-term consistency (Saha et al., 8 Sep 2025). Closely related literatures use adjacent notions rather than the same attack class: face anti-spoofing papers typically study presentation attacks under head-pose variation rather than adversarial manipulation of pose itself (Liu et al., 2018, Feng et al., 30 May 2025), and GNSS spoofing work treats false position, velocity, and time as an upstream cause of false platform pose (Marata et al., 1 Nov 2025).

1. Scope and terminological boundaries

The supplied papers support a narrow and a broad reading of pose spoofing. In the narrow reading, the adversary directly manipulates a pose estimate or a signal stream that determines pose. That is the setting of adversarial slow-pose drift in offloaded VIO, where the returned slow pose is altered after VIO has been computed and before transmission back to the headset (Saha et al., 8 Sep 2025). In the broader reading, the literature includes attacks and defenses whose operational effect bears on pose-dependent authenticity or state integrity, even when pose itself is not the explicit attack variable.

Domain	What is spoofed	Role of pose
Offloaded VIO	Server-returned slow pose anchor	Direct attack target
Face PAD/FAS	Presentation authenticity	Pose is a nuisance factor or robustness condition
GNSS spoofing	PVT solution	False PVT induces false platform pose

A central terminological distinction follows from the face anti-spoofing literature. "Learning Deep Models for Face Anti-Spoofing: Binary or Auxiliary Supervision" explicitly does not define or study pose spoofing as a distinct attack class; it addresses general face anti-spoofing under substantial pose variation, with pose, viewpoint, and facial motion treated as nuisance factors that can degrade spatial and temporal spoof cues (Liu et al., 2018). The 2025 Vision Transformer paper makes the same distinction: it is a pose-robust anti-spoofing method, not a method for detecting attacks that forge pose itself (Feng et al., 30 May 2025). By contrast, the GNSS paper is directly relevant only in the sense that spoofed radio signals can cause a receiver to compute incorrect position, velocity, and time, and therefore a false system pose (Marata et al., 1 Nov 2025).

This suggests a layered view. At the perception layer, pose spoofing can mean corruption of the state estimate itself. At the biometric or liveness layer, pose is often part of the operating condition under which spoof detection must remain valid. At the navigation layer, spoofing may occur upstream in the sensing substrate and propagate into pose estimation.

2. Adversarial slow-pose drift in offloaded visual-inertial odometry

The most explicit pose-spoofing mechanism in the supplied material is "Detection and Recovery of Adversarial Slow-Pose Drift in Offloaded Visual-Inertial Odometry" (Saha et al., 8 Sep 2025). The system considered is an XR headset that offloads full VIO to a nearby edge server. The client transmits image frames and IMU readings over TCP, while maintaining a high-rate local fast-pose buffer

$$\mathcal{F}_i = \{\mathbf{f}_{i,1}, \dots, \mathbf{f}_{i,K}\}.$$

These fast poses preserve responsiveness but are only reliable over short windows because they are locally integrated from inertial data.

The server runs OpenVINS and returns a lower-rate slow pose

$$\mathbf{s}_i = [\mathbf{p}_i,\mathbf{q}_i,\mathbf{v}_i,\mathbf{b}_i^{\text{acc}},\mathbf{b}_i^{\text{gyro}}],$$

where $\mathbf{p}_i$ is 3D position, $\mathbf{q}_i$ is orientation quaternion, $\mathbf{v}_i$ is linear velocity, and the remaining terms are accelerometer and gyroscope biases. When the client receives $\mathbf{s}_i$, it re-anchors the next local fast integration window to that state. This re-anchoring loop is the critical vulnerability: any corruption in the server-returned slow pose affects all downstream fast poses in the next interval rather than producing only an isolated error (Saha et al., 8 Sep 2025).

The threat model assumes that the edge server executing the offloaded VIO pipeline is adversary-controlled. The attacker does not spoof raw client sensors. Instead, the attack surface is the server-side pose output after VIO has already been computed and before it is transmitted back to the headset. At each offload round $i$, spoofing occurs with Bernoulli probability $p$,

$b_i \sim \mathrm{Bernoulli}(p),$

and when spoofing occurs, the true slow pose is perturbed by small bounded drifts $\delta_i$ to produce

$$\mathbf{s}_i = [\mathbf{p}_i,\mathbf{q}_i,\mathbf{v}_i,\mathbf{b}_i^{\text{acc}},\mathbf{b}_i^{\text{gyro}}],$$0

The paper describes the drift components as position, angle, velocity, and bias perturbations (Saha et al., 8 Sep 2025).

The defining property of the attack is temporal stealth. The paper calls it adversarial slow-pose drift because the perturbations are low magnitude and temporally consistent rather than abrupt. Standard heuristic checks in VIO and XR pipelines often look for large residuals, outliers, sudden jumps, or blatant inconsistency with IMU dynamics. Slow-pose drift is designed to evade such checks because each perturbation is individually small, bounded, and inserted only in the lower-rate global-anchor stream. The attack therefore exploits the asymmetry between local plausibility and long-term accumulated error. The downstream effect is trajectory divergence, spatial misalignment, visual jitter, and degraded immersion or user discomfort, because the headset uses the corrupted trajectory for scene stabilization, view synthesis, and user-motion coupling (Saha et al., 8 Sep 2025).

3. Client-side detection through temporal consistency modeling

The defense proposed in the VIO paper is entirely client-side, unsupervised, and label-free (Saha et al., 8 Sep 2025). Its premise is that benign operation induces a stable temporal relationship between the incoming slow pose, the immediately preceding fast-pose window, and the accompanying IMU activity. If a model is trained only on attack-free runs, it can learn the regularities of this relationship without observing spoofed data.

Feature construction is explicitly arranged to avoid contamination from the possibly spoofed current pose window. For each slow pose $$\mathbf{s}_i = [\mathbf{p}_i,\mathbf{q}_i,\mathbf{v}_i,\mathbf{b}_i^{\text{acc}},\mathbf{b}_i^{\text{gyro}}],$$1, the model uses the prior window between the last accepted $$\mathbf{s}_i = [\mathbf{p}_i,\mathbf{q}_i,\mathbf{v}_i,\mathbf{b}_i^{\text{acc}},\mathbf{b}_i^{\text{gyro}}],$$2 and $$\mathbf{s}_i = [\mathbf{p}_i,\mathbf{q}_i,\mathbf{v}_i,\mathbf{b}_i^{\text{acc}},\mathbf{b}_i^{\text{gyro}}],$$3: the fast poses

$$\mathbf{s}_i = [\mathbf{p}_i,\mathbf{q}_i,\mathbf{v}_i,\mathbf{b}_i^{\text{acc}},\mathbf{b}_i^{\text{gyro}}],$$4

and IMU samples

$$\mathbf{s}_i = [\mathbf{p}_i,\mathbf{q}_i,\mathbf{v}_i,\mathbf{b}_i^{\text{acc}},\mathbf{b}_i^{\text{gyro}}],$$5

The feature vector includes window statistics such as count $$\mathbf{s}_i = [\mathbf{p}_i,\mathbf{q}_i,\mathbf{v}_i,\mathbf{b}_i^{\text{acc}},\mathbf{b}_i^{\text{gyro}}],$$6 and duration; pose residual summaries between $$\mathbf{s}_i = [\mathbf{p}_i,\mathbf{q}_i,\mathbf{v}_i,\mathbf{b}_i^{\text{acc}},\mathbf{b}_i^{\text{gyro}}],$$7 and $$\mathbf{s}_i = [\mathbf{p}_i,\mathbf{q}_i,\mathbf{v}_i,\mathbf{b}_i^{\text{acc}},\mathbf{b}_i^{\text{gyro}}],$$8 for position and velocity, aggregated by mean, standard deviation, minimum, maximum, and $$\mathbf{s}_i = [\mathbf{p}_i,\mathbf{q}_i,\mathbf{v}_i,\mathbf{b}_i^{\text{acc}},\mathbf{b}_i^{\text{gyro}}],$$9 norm; quaternion geodesic orientation error; accelerometer and gyroscope bias summaries; and IMU activity summaries including norms and axis-wise statistics. These features are z-normalized and reduced by PCA to retain 97% variance before anomaly detection (Saha et al., 8 Sep 2025).

The detector is a compact fully connected autoencoder trained only on clean sessions. The training set consists of 100 attack-free runs collected in the ILLIXR offloaded VIO setup. The encoder is

• Linear(input $\mathbf{p}_i$0) with LeakyReLU + BatchNorm1d,
• Linear($\mathbf{p}_i$1) with LeakyReLU + BatchNorm1d,
• Linear($\mathbf{p}_i$2) with LeakyReLU + BatchNorm1d,
• Linear($\mathbf{p}_i$3) with latent dimension 32,

and the decoder is

• Linear($\mathbf{p}_i$4) with LeakyReLU,
• Linear($\mathbf{p}_i$5) with LeakyReLU,
• Linear($\mathbf{p}_i$6) with LeakyReLU,
• Linear($\mathbf{p}_i$7) with Tanh.

Training uses SmoothL1 loss, light Gaussian jitter, and early stopping. At runtime, the anomaly score is the reconstruction mean-squared error between the PCA-reduced feature vector and its reconstruction: $\mathbf{p}_i$8 Thresholds are calibrated on a clean validation set. The decision logic is three-level: normal if MSE is below median $\mathbf{p}_i$9 MAD, soft anomaly if above that value but below the 98th percentile, and hard anomaly if at or above the 98th percentile (Saha et al., 8 Sep 2025).

The recovery policy is operational rather than model-based. Normal poses are accepted. Soft and hard anomalies are dropped. To avoid indefinite operation on stale anchors, the system forces a pass of the current slow pose after 12 consecutive hard-anomaly drops. The paper is explicit about what recovery does not do: it does not roll back trajectory history, run a smoothing backend, re-estimate the VIO state from raw sensors, or synthesize a corrected replacement pose. Recovery is achieved solely by controlling whether the client accepts a server-returned slow pose as the next anchor (Saha et al., 8 Sep 2025).

This design frames pose spoofing as a one-class temporal-consistency problem rather than a supervised attack classification problem. A plausible implication is that the detector is learning the manifold of benign cross-rate motion consistency, and that spoofing is exposed when a returned global anchor does not belong to that manifold.

4. Evaluation, detector behavior, and operating tradeoffs

Evaluation in the VIO paper uses a realistic ILLIXR-based offloaded environment with two PCs, each equipped with Intel Core i9-14900K, NVIDIA RTX 2000, and 32 GB RAM, one acting as the client or headset emulator and the other as the VIO server (Saha et al., 8 Sep 2025). The client-side runtime detector is implemented as a lightweight Python sidecar that receives fast poses and IMU over ZMQ, slow poses over TCP, computes features, performs normalization and PCA, runs the autoencoder, and returns the accept or drop decision to ILLIXR. Spoof frequency is varied across 0%, 25%, 50%, and 75%. Default drift magnitudes are bias drift 0.05, velocity drift 0.10, position drift 0.02, and angle drift 0.20.

The principal trajectory metrics are Absolute Trajectory Error and Relative Pose Error: $\mathbf{q}_i$0 with

$\mathbf{q}_i$1

The reference trajectories are clean offloaded trajectories collected under identical conditions rather than native on-device ILLIXR ground truth, so the evaluation isolates spoofing and defense effects (Saha et al., 8 Sep 2025).

Without defense, the clean 0% case has negligible error: T-ATE 0.074 cm, R-ATE 0.008 deg, T-RPE 0.033 cm, and R-RPE 0.0019 deg. At 25% spoofing these become 10.319 cm, 16.353 deg, 0.815 cm, and 2.453 deg; at 50%, 13.043 cm, 33.904 deg, 1.449 cm, and 2.980 deg; and at 75%, 14.336 cm, 49.465 deg, 1.709 cm, and 2.567 deg (Saha et al., 8 Sep 2025). With the defense enabled, 25% spoofing remains near clean levels: T-ATE 0.388 cm, R-ATE 0.049 deg, T-RPE 0.044 cm, and R-RPE 0.0039 deg. At 50%, T-ATE is reduced from 13.043 cm to 1.369 cm, R-ATE from 33.904 deg to 2.166 deg, T-RPE from 1.449 cm to 0.082 cm, and R-RPE from 2.980 deg to 0.041 deg. The paper identifies this as more than a $\mathbf{q}_i$2 improvement under moderate spoofing (Saha et al., 8 Sep 2025).

At 75% spoofing, the tradeoff changes. Local consistency remains much better than in the unprotected system, with T-RPE 0.979 cm and R-RPE 0.146 deg versus 1.709 cm and 2.567 deg unprotected, but global drift becomes worse in ATE, with T-ATE 27.812 cm and R-ATE 23.213 deg. The paper attributes this to the forced-pass mechanism: under sustained attack, periodic re-anchoring with still-corrupt poses preserves continuity and avoids runaway local instability, but it can inject accumulated global offset (Saha et al., 8 Sep 2025). The distinction between local and global quality is therefore central. A system can preserve frame-to-frame consistency and suppress visible jitter while still accumulating long-term global bias.

Detector statistics reinforce the temporal-consistency hypothesis. In clean runs, over 95% of slow poses are classified normal and MSE stays low. At 25% spoofing, only 44% of slow poses remain normal and 54% become hard anomalies. At 50% and 75%, 86.7% and 96.8% of poses are flagged as hard anomalies. The anomaly fraction exceeding the actual spoofing probability is interpreted by the authors as temporal amplification: once a spoofed anchor perturbs the system, later windows can also appear anomalous even if not every slow pose was directly modified (Saha et al., 8 Sep 2025).

The paper also reports robustness to unseen perturbation magnitudes at fixed 50% spoofing. In the strongest tested configuration, Config 4, the drift magnitudes are bias 1.20, velocity 1.50, position 1.00, and angle 2.0, while the reported mean RPEs remain sub-1 for both translation and rotation; examples given are 0.0477 cm and 0.0045 deg for Config 1, 0.3139 cm and 0.0591 deg for Config 3, and 0.0591 cm and 0.0065 deg for Config 4. The authors note that the robustness study uses a “best of 10 runs” reporting choice, which is relevant when interpreting generalization claims (Saha et al., 8 Sep 2025).

Deployability is assessed on a FABRIC node configured to resemble Quest 3-class CPU constraints. Averaged over 1,035 slow-pose windows, per-window latency is 4.77 ms for feature extraction, 0.23 ms for preprocessing plus PCA, 0.26 ms for autoencoder inference, and 0.05 ms for threshold postprocessing, with 37.40 ms model and scaler load once at startup. The runtime cost is therefore dominated by feature extraction, but the total overhead remains a few milliseconds per slow pose (Saha et al., 8 Sep 2025).

5. Pose variation, liveness, and motion in face anti-spoofing

The face anti-spoofing papers in the supplied set are important chiefly because they sharpen the distinction between pose variation and pose spoofing. "Learning Deep Models for Face Anti-Spoofing: Binary or Auxiliary Supervision" states that it does not define or study pose spoofing as a distinct attack class; instead, it addresses RGB video-based presentation attack detection under substantial pose, viewpoint, and expression variation (Liu et al., 2018). Its core proposal is auxiliary supervision rather than binary live/spoof classification: a CNN estimates a per-frame pseudo-depth map and an RNN estimates an rPPG signal, then fuses the two cues at test time. For live faces, pseudo-depth is generated from an estimated dense 3D face shape and pose transform

$\mathbf{q}_i$3

with projected depth normalized to $\mathbf{q}_i$4; spoof videos are supervised with all-zero depth. The method further uses a non-rigid registration layer to frontalize features across time so the RNN can compare the same facial regions “without concerning about the facial pose or expression.” Its SiW dataset explicitly covers head yaw in $\mathbf{q}_i$5, and SiW Protocol 1, which trains mainly on frontal frames and tests on all videos, reports APCER $\mathbf{q}_i$6, BPCER $\mathbf{q}_i$7, and ACER $\mathbf{q}_i$8 (Liu et al., 2018).

"Leveraging Intermediate Features of Vision Transformer for Face Anti-Spoofing" takes a similar position on scope (Feng et al., 30 May 2025). It is a single-image Vision Transformer method for face anti-spoofing, not an explicit pose model. Pose enters as a nuisance factor and as an evaluation condition in SiW Protocol 1, which targets pose and facial expression generalization. The method uses ViT-Base, relies on the 8th encoder block class token for inference via maximum cosine similarity to live reference vectors, adds an auxiliary classification loss on the 11th encoder block class token, and combines this with Attention-Weighted Patch Loss and two anti-spoofing-specific augmentations. On SiW Protocol 1, the reported performance is APCER 0.1, BPCER 0.08, and ACER 0.09 with Patch-wise Data Augmentation; the paper nevertheless states that this is strong but not the best result on that pose-sensitive protocol (Feng et al., 30 May 2025).

"Deep Ensemble Learning with Frame Skipping for Face Anti-Spoofing" is relevant in a different way (Muhammad et al., 2023). It does not estimate head pose or define pose spoofing as an attack category, but it reframes video-based presentation attack detection as a motion prediction problem. Videos are divided into non-overlapping 30-frame segments, one representative frame is retained per segment, DenseNet-201 features are extracted, and three recurrent models—LSTM, BiLSTM, and GRU—are fused by an LSTM meta-model. The paper motivates the method by the temporal consistency of real faces and by motion cues such as head movements, facial expressions, and subtle dynamics that spoof media may fail to reproduce faithfully. It reports cross-dataset HTER of 3.12 on MSU-MFSD, 11.19 on Replay-Attack, and 12.23 on OULU-NPU in the most challenging leave-one-out setting (Muhammad et al., 2023). This suggests that temporal modeling can capture pose-related motion signatures even without an explicit pose estimator, but the paper is clear that it remains a general motion-based PAD method rather than a dedicated pose-spoof detector.

Taken together, these face PAD papers indicate that head pose is often operationally central without being the attacked variable. The dominant research problem in this subliterature is robustness to pose change, not integrity of the pose estimate itself.

6. Adjacent attack surfaces and broader implications

The broader spoofing literature in the supplied set expands the notion of pose spoofing by showing that false or selectively accepted pose-related evidence can arise from multiple layers of the stack. "Backdoor Poisoning Attack Against Face Spoofing Attack Detection Methods" studies training-time poisoning of face PAD models rather than geometric pose manipulation (Iwamatsu et al., 3 Sep 2025). The attacker replaces a portion of live training images with visually near-identical poisoned images that embed features from a chosen spoof trigger image, leaving labels unchanged. The paper evaluates the attack on SiW and OULU-NPU against STDN and PatchNet and reports, for example, 100.00% ASR at 50% injection rate on SiW + STDN, Protocol 3, with ACER changing from 12.68% before attack to 19.06% after attack, and 100.00% ASR at 60% injection rate on SiW + PatchNet, Protocol 1, with ACER changing from 2.56% to 1.98% (Iwamatsu et al., 3 Sep 2025). Although not pose-specific, this result is important for any pose-dependent authenticity pipeline because it shows that benchmark accuracy can remain normal while a selective acceptance pathway has been implanted.

"The SWAX Benchmark: Attacking Biometric Systems with Wax Figures" adds a different adjacent lesson (Vareto et al., 2019). Its attack medium is a wax figure rather than a print, replay, or mask attack. Pose is treated as a realism factor of the dataset rather than a dedicated variable: SWAX contains 1,812 images and 110 videos of 55 people or figures, collected from uncontrolled online resources with a large range in expression, illumination, and pose variations. The paper does not provide pose-stratified results, but it shows that existing PAD methods remain vulnerable to this high-quality 3D physical spoof medium, with best ACER around $\mathbf{q}_i$9 in supervised in-dataset settings (Vareto et al., 2019). This suggests that 3D spoof media can weaken detection strategies that rely mainly on artifacts specific to planar print or display attacks.

At the navigation layer, "Meta-Learning Based Radio Frequency Fingerprinting for GNSS Spoofing Detection" is directly relevant only through the causal chain from PVT to system pose (Marata et al., 1 Nov 2025). The paper models genuine and spoofed GNSS signals at the RF level, incorporates transmitter-specific fingerprints $\mathbf{v}_i$0 and $\mathbf{v}_i$1, uses pre-correlation spectrogram magnitude and post-correlation features such as code phase, DLL discriminator, Doppler, FLL lock, and PLL lock, and trains a meta-learning detector using MAML with ADMM-based $\mathbf{v}_i$2 regularization. It reports spoofing detection accuracy greater than 95% on multiple TEXBAT and OAKBAT datasets, often above 99%, and emphasizes that spoofers are more dangerous than jammers because they can alter the PVT fix (Marata et al., 1 Nov 2025). In this sense, GNSS spoofing is an upstream form of pose spoofing: the falsified state is not a camera or inertial pose directly, but a navigation solution that a downstream platform may consume as pose.

Three general conclusions recur across these domains. First, local plausibility is often the adversary’s primary lever: the VIO attacker preserves short-term motion consistency, the face backdoor preserves perceptual appearance, and the GNSS spoofer imitates authentic navigation signals. Second, pose-related integrity failures are frequently temporal and compositional rather than instantaneous; they emerge when a corrupted anchor, trigger, or RF observation is repeatedly consumed by a closed-loop system. Third, the supplied literature repeatedly separates robustness to pose variation from true pose spoofing. That distinction is not merely terminological. It determines whether the defense problem is one of invariance under nuisance conditions, one-class temporal consistency modeling, training-data integrity, or upstream signal authentication.