What You Decode Depends on Where You Stand: Distance-Based Optical QR Code

Quick Response (QR) codes are ubiquitous; we can see them in authentication, payments, advertising, and other information-sharing use cases. QR code’s security relies on the assumption that every scanner decodes identical information from the same code. This work introduces Optical Quick Response (OQR) codes, a novel multi-layer QR code design that challenges this assumption. OQR uses specially designed optical patterns to encode distinctive information across distance-dependent layers within a single code, while upholding full backward compatibility with standard QR decoders. This paper presents 2-layer (OQR 2 ) and 3-layer (OQR 3 ) OQR configurations that achieve up to 300% higher data capacity. Exploiting this multi-layer capability, a filter evasion vulnerability is identified in which automated QR validators decode only the innermost layer of pixel-perfect images, enabling attackers to conceal malicious content in the outer layers and remain undetected. To counter this threat, a blurring-based defense is developed that recovers all layer content, enabling detection and flagging of malicious OQR codes before they reach end users. A custom dataset of 600 OQR codes was generated for evaluation. Results across six smartphones, for both printed and digital formats, demonstrate a reliable multi-layer Code Decodability Rate (CDR) of 100% for OQR 2 and over 98% for OQR 3 . The filter evasion attack success rate against two popular QR decoding libraries reaches 100% for OQR 2 and 98.67% for OQR 3 .