Drawn Apart, a GPU-based user identification method

Few days ago news broke that researchers from Ben-Gurion University (Israel), the University of Lille (France) and the University of Adelaide (Australia) have developed a new technique to identify devices of users by detecting GPU parameters in a web browser.

The method is called "Drawn Apart" and is based on the use of WebGL to obtain a GPU performance profile, which can significantly improve the accuracy of passive tracking methods that work without using cookies and without storing an identifier on the user's system.

The methods that take into account rendering characteristics, GPU, graphics stack, and drivers when identifying them they were previously used, but they were limited to the possibility of separating devices only at the level of different models of video cards and GPUs, i.e. it could only be used as an additional factor to increase the probability of identification.

The key feature of the new "Drawn Apart" method is that it is not limited to separating different models of GPUBut try to identify the differences between identical GPUs of the same model, due to the heterogeneity of the production process of designed chips.

It is also mentioned that variations occurring during the production process are observed to make it possible to form non-repetitive molds for the same device models.

It turned out that these differences can be identified by counting the number of execution units and analyzing their performance on the GPU. As primitives to identify different GPU models, checks based on a set of trigonometric functions, logical operations and floating point calculations were used. To identify differences on the same GPU, the number of threads running simultaneously when running vertex shaders was estimated.

The revealed effect is assumed to be caused by differences in temperature regimes and power consumption of different chip instances (a similar effect was previously demonstrated for CPU: the same processors demonstrated different power consumption when running the same processor). code).

Since operations via WebGL are asynchronous, you can't directly use the performance.now() JavaScript API to measure their execution time, so three tricks were proposed to measure the time:

  • Onscreen: rendering of the scene on the HTML canvas with the response time measurement of the callback function exposed through the Window.requestAnimationFrame API and called after the rendering completes.
  • off screen: Use a worker and render the scene to an OffscreenCanvas object by measuring the execution time of the convertToBlob command.
  • GPU: rendering to an OffscreenCanvas object, but with a timer provided by WebGL to measure time, taking into account the duration of execution of a set of commands on the GPU side.

In the process of creating an identifier 50 checks are performed on each device, each of which covers 176 measurements of 16 different characteristics. The experiment, during which data collected on 2500 devices with 1605 different GPUs, showed a 67% increase in efficiency of the combined identification methods by adding Draw Apart support to them.

In particular, the combined FP-STALKER method, on average, provided identification within 17,5 days, and in combination with Drawn Apart, the duration of identification increased to 28 days.

It is observed that the accuracy was affected by the temperature of the GPU and, for some devices, rebooting the system caused identifier distortion. When the method is used in combination with other methods indirect identification, accuracy can be increased significantly. It is also planned to increase accuracy through the use of compute shaders after the stabilization of the new WebGPU API.

Intel, ARM, Google, Khronos, Mozilla, and Brave were notified of the issue as early as 2020, but details of the method have only just been revealed.

Among other things, the researchers published working examples written in JavaScript and GLSL that can work with and without displaying information on the screen. Also for Intel GEN 3/4/8/10 GPU based systems, data sets have been published to classify the information extracted in machine learning systems.

Finally if you are interested in knowing more about it, you can check the details in the following link

The content of the article adheres to our principles of editorial ethics. To report an error click here!.

Be the first to comment

Leave a Comment

Your email address will not be published.



  1. Responsible for the data: AB Internet Networks 2008 SL
  2. Purpose of the data: Control SPAM, comment management.
  3. Legitimation: Your consent
  4. Communication of the data: The data will not be communicated to third parties except by legal obligation.
  5. Data storage: Database hosted by Occentus Networks (EU)
  6. Rights: At any time you can limit, recover and delete your information.