Imagine you're playing a cooperative board game, but someone has secretly swapped your rulebook with one where the distances are slightly wrong, the timer runs fast, and your teammate's pieces appear in the wrong positions. You'd still play — the board looks normal — but you'd make worse decisions, trust your partner less, and finish slower. That's the core mechanism here: CAESAR injects precisely controlled distortions into a mixed-reality search-and-rescue scenario and measures how humans degrade under adversarial manipulation they can't consciously detect. The committed claim: this is the first end-to-end, multi-user mixed reality platform that integrates four classes of cognitive attacks (visual distortion, virtual content manipulation, synchronization disruption, and latency injection) within a synchronized collaborative task, paired with a multimodal data pipeline capturing behavioral, performance, and subjective measures. Prior MR security work has examined individual attack vectors — a spoofed anchor here, a lag spike there — but always in single-user or isolated contexts. CAESAR packages these into a repeatable testbed. The architecture is a modular MR framework built atop a synchronized multi-user collaborative scenario. The four attack classes — visual feedback distortion, virtual content manipulation, system synchronization attacks, and latency-based attacks — are injected at different points in the perception-action loop. The data pipeline captures gaze, motion, task completion metrics, and post-task subjective questionnaires. This is systems-level HCI engineering, not a novel algorithm — the contribution is the testbed itself, not a new model. The integrity picture is mixed. The paper presents a controlled user study, but it only provides in-depth analysis of one of the four attack classes: latency-based attacks. The other three are described architecturally but not evaluated with user data at the same depth. The study demonstrates measurable effects on task performance and user behavior, but sample size and effect sizes aren't specified in the abstract. This is accepted to ISMAR 2026 and the TVCG special issue — strong peer review venues — but the validation is still same-team, same-scenario experimentation. The ladder comparison is thin. The authors position CAESAR against the absence of standardized collaborative testbeds, which is a real gap — but the claim is more about infrastructure than about beating a quantitative baseline. There's no named prior testbed they benchmark against on throughput, attack fidelity, or detection rates. The contribution is "this thing didn't exist; now it does," which is legitimate but hard to score on a competitive ladder. The milestone question points toward adversarial robustness thresholds: at what attack intensity do collaborative MR teams degrade below operational viability? The paper starts that conversation with latency attacks but doesn't establish the full dose-response curve across all four attack classes. The field needs results showing whether trained users can develop resistance to cognitive attacks, or whether certain attack classes are fundamentally undetectable — those experiments are the obvious next step. The successor experiment the authors didn't run: a full factorial study across all four attack classes with sufficient participants to measure interaction effects between simultaneous attacks. The honest read is (a) — this is expensive human-subjects work requiring MR hardware, synchronized multi-user setups, and IRB-approved protocols. Running one attack class deeply is the rational first paper; the multi-attack study is paper two.
