DRAWNAPART: A Device Identification and Spoofing Detection Technique Based on Remote GPU Fingerprinting
Authors: Tomer Laor , Naif Mehanna , Vitaly Dyadyuk , Antonin Durey , Pierre Laperdrix , Clémentine Maurice , Yossi Oren , Romain Rouvoy , Walter Rudametkin , Yuval Yarom
Appeared in: ACM Transactions on Privacy and Security, 2026 (to appear)
Abstract
Browser fingerprinting aims to identify users or their devices, through scripts that execute in the users’ browser and collect information on software or hardware characteristics. It is used to track users or as an additional means of identification to improve security. Fingerprinting techniques have one significant limitation: they are unable to track individual users for an extended duration. This happens because browser fingerprints evolve over time, and these evolutions ultimately cause a fingerprint to be confused with those from other devices sharing similar hardware and software.
Our technique, DrawnApart, advances the field of browser fingerprinting in three significant ways. First, it is the pioneering work that investigates and exploits manufacturing variances in identical GPUs in the context of privacy protection. Second, it provides a robust method for differentiating between devices with identical hardware and software configurations, achieving practical accuracy improvements in real-world scenarios. In a setting with diverse hardware and software configurations, DrawnApart is most effective when combined with traditional fingerprinting techniques such as FP-Stalker. Third, DrawnApart introduces a capability to verify the GPU renderer string, enabling the detection of spoofing attempts aimed at bypassing two-factor authentication by mimicking the victim’s device attributes.
This is an extended journal version of work originally published in NDSS 2022.
Draft version
Artifact Repository