Cory Ike Ilo successfully defended his dissertation on June 16th, 2026. The abstract for his dissertation follows:
Context-aware extended reality (XR) systems tailor their interfaces to the user’s situation, but the sensing that makes this possible, from world-facing cameras and microphones to inward-facing eye trackers, creates substantial privacy risk, both for the user and for the bystanders captured alongside them. This dissertation argues that privacy in context-aware XR is necessary, feasible, and never automatic. Its central claim is that the same gaze signal that drives interface adaptation also encodes the user’s identity: privacy therefore cannot rest on avoidance alone, nor on treating gaze as a benign substitute for the camera. It must be engineered into how the signal is represented and mediated.
The argument develops through three studies organized as a decision tree spanning two complementary strategies, avoidance and mitigation. Goldilocks Zoning establishes the foundation, showing that gaze alone, read as passive context, can drive useful adaptation without imaging the environment, which makes camera avoidance viable. InPlainGaze examines the residual risk that avoidance leaves behind and shows that the representation in which gaze is encoded is itself a privacy lever: a learned engineered-feature representation preserves most task-relevant utility while substantially attenuating re-identification. A coarser heatmap representation, which appears more protective, in fact leaks more identity, demonstrating that abstraction alone does not confer privacy. ARPA addresses the case in which environmental capture is unavoidable, studying how the autonomy of a human-in-the-loop privacy assistant shapes users’ situated awareness and the cognitive burden of managing exposure, and finding that automation redistributes that burden rather than removing it.
Synthesized, the studies contribute more than three systems. They yield an intermediate-level framework (avoidance and mitigation, with representational veiling as its core mechanism) for building context-aware XR that does not require users to surrender their identity to benefit from adaptation. The dissertation closes by arguing that such protection can become an ambient, on-device default rather than an expert-only setting, and by charting the open branches of the design space the framework reveals.
Congratulations, Dr. Ilo!