Source-linked AI summary
Protecting Sensory Data against Sensitive Inferences
Mohammad Malekzadeh, Richard G. Clegg, Andrea Cavallaro, Hamed Haddadi
TL;DR
Raw mobile-sensor access can disclose sensitive attributes beyond the services an application needs. The paper proposes GEN, which transforms sensor data to preserve useful activity inference while reducing gender inference. Experiments report a small activity-recognition loss and gender classification near random guessing, while statistical proof of information-leakage reduction remains future work.
Problem
Raw sensor data accessed by applications may reveal gender, mood, and personality unnecessarily alongside users' activities.
Method
GEN transforms sensor data for application-specific utility and privacy, using a Guardian, Estimator, and Neutralizer to guide and optimize the transformation.
Results
The transformed data incur an average activity-recognition loss of three percentage points, while gender classification decreases from more than 90% to near 50% random guessing.
Takeaways & Limitations
GEN provides a locally deployable framework for trading off application utility and user privacy when sharing motion-sensor data.
Takeaways & Limitations
Statistical proof of sensitive-information elimination remains future work because high temporal granularity and strong sample correlation make it challenging.
Abstract
from arXiv · showhide
There is growing concern about how personal data are used when users grant applications direct access to the sensors of their mobile devices. In fact, high resolution temporal data generated by motion sensors reflect directly the activities of a user and indirectly physical and demographic attributes. In this paper, we propose a feature learning architecture for mobile devices that provides flexible and negotiable privacy-preserving sensor data transmission by appropriately transforming raw sensor data. The objective is to move from the current binary setting of granting or not permission to an application, toward a model that allows users to grant each application permission over a limited range of inferences according to the provided services. The internal structure of each component of the proposed architecture can be flexibly changed and the trade-off between privacy and utility can be negotiated between the constraints of the user and the underlying application. We validated the proposed architecture in an activity recognition application using two real-world datasets, with the objective of recognizing an activity without disclosing gender as an example of private information. Results show that the proposed framework maintains the usefulness of the transformed data for activity recognition, with an average loss of only around three percentage points, while reducing the possibility of gender classification to around 50\%, the target random guess, from more than 90\% when using raw sensor data. We also present and distribute MotionSense, a new dataset for activity and attribute recognition collected from motion sensors.
1 INTRODUCTION
The paper addresses unintended disclosure from raw mobile-sensor access by introducing GEN, which transforms sensor data to balance application utility with user privacy.
- Raw sensor access can unintentionally reveal gender, mood, and personality beyond an application's service needs.
- GEN shares transformed sensor data instead of granting applications direct sensor access, adapting the transformation to application requirements and privacy considerations.The Guardian transforms data, the Estimator predicts sensitive and non-sensitive information, and the Neutralizer optimizes the transformation.
- GEN targets sensitive information in a single user's data while concurrently removing private information from each temporal section and preserving shared-data utility.
- The framework establishes a utility–privacy trade-off for activity recognition using accelerometer and gyroscope data, distinguishing activities from attributes such as gender, age, weight, and height.
- GEN maintains activity-recognition usefulness while considerably reducing attribute-recognition risk.
2 PROBLEM DEFINITION
The problem definition models synchronized multivariate sensor data as running windows and seeks a transformation that suppresses sensitive inferences while preserving non-sensitive inference accuracy.
- Sensor data are represented as synchronized measurements from m components collected at a common frequency over duration T.
- A running window of duration d contains consecutive sensor values from time t through t + d −1 and forms the analyzed time-series section.
- The window length d must support the application's desired inferences while remaining computationally manageable.
- The framework defines sensitive inference Is(.) and non-sensitive inference In(.) for each sensor section, then seeks a transformation G∗(.) that hides private information while retaining non-sensitive inference accuracy.
- The paper identifies the transformed-data problem as the basis for an activity-recognition instantiation in which the Guardian is an autoencoder and the Estimator is a multi-task ConvNet.
3 LEARNING THE INFERENCE-SPECIFIC TRANSFORMATION
GEN learns an inference-specific transformation by coupling a feature-learning Guardian with an Estimator and a Neutralizer objective. In the activity-recognition instantiation, the transformation preserves activity information while targeting gender-neutral outputs.
- 3 LEARNING THE INFERENCE-SPECIFIC TRANSFORMATION: GEN comprises a Guardian, Estimator, and Neutralizer that jointly learn an inference-specific transformation for shared sensor data.The Guardian transforms data, the Estimator quantifies sensitive and non-sensitive inference accuracy, and the Neutralizer optimizes the Guardian.
- 3 LEARNING THE INFERENCE-SPECIFIC TRANSFORMATION: The Guardian uses a deep autoencoder to map each m-dimensional time-series section of length d to an output with the same dimensionality.Its transformation is guided by the Neutralizer’s objective function.
- 3 LEARNING THE INFERENCE-SPECIFIC TRANSFORMATION: The Estimator uses a multi-task convolutional neural network to quantify sensitive and non-sensitive inference accuracy from transformed data.Its shared representations support simultaneous activity and gender-related inference tasks.
- 3 LEARNING THE INFERENCE-SPECIFIC TRANSFORMATION: The Neutralizer optimizes the Guardian toward a transformation G*(·) that balances sensitive and non-sensitive inference probabilities over the set F of possible transformations.In this implementation, backpropagation updates the autoencoder’s weights using a multi-task objective.
- 3 LEARNING THE INFERENCE-SPECIFIC TRANSFORMATION: The activity-recognition instantiation transforms each section to recognize activity from transformed data without revealing the user’s gender.The objective combines a gender-neutralizer loss with categorical cross entropy, with 0.5 as the desired gender-predictor confidence.
4 EXPERIMENTS
Experiments evaluate GEN for preserving activity-recognition utility while reducing gender and other attribute inference across two real-world smartphone-sensor datasets and multiple leakage analyses.
- Experimental setup: The evaluation recognizes four activities and treats activity as non-sensitive inference and gender as sensitive inference.The activities are Downstairs, Upstairs, Walking, and Jogging.
- Datasets and settings: GEN is evaluated on MobiAct and MotionSense, using Trial and Subject train-test settings.Trial holds out trials, while Subject holds out 25% of participants and averages four test selections.
- GEN evaluation: The Estimator uses multitask learning for four-class activity recognition and two-class gender classification, after which a deep autoencoder Guardian is optimized through GEN.The activity task uses categorical cross-entropy and the gender task uses binary cross-entropy; GEN is trained with the Neutralizer objective.
- Transformation efficiency: 3 percentage points is the average activity-recognition accuracy loss after transformation, while gender accuracy falls from more than 90% to near the 50% random-guess target.Table 3 compares original and transformed data for activity recognition and gender classification.
- Cross-dataset validation: In cross-dataset validation, activity accuracy changes from 93.67% on raw data to 90.92% on transformed data, while gender accuracy changes from 92.80% to 51.93%.The Estimator is trained on MobiAct and applied to transformed MotionSense data using a locally defined Neutralizer.
- Information leakage: GEN also reduces residual attribute information: height and weight estimation errors increase by near 25% and 20%, respectively.The paper additionally evaluates leakage with distance-weighted k-NN using Dynamic Time Warping over original and transformed series.
5 RELATED WORK AND DISCUSSION
GEN differs from privacy-preserving generative approaches by transforming each user’s real sensor input to preserve utility while limiting sensitive inferences. It concurrently addresses activity and attribute inference on the same time-series and can operate in distributed environments.
- GEN addresses sensitive information in a single user’s sensor data, unlike prior work focused mainly on identity protection through population-level synthetic data.
- The Guardian partitions features from real-world input vectors to reconstruct privacy-preserving outputs rather than generating samples from random vectors.
- GEN’s minimax objective trades off utility and privacy while updating only the Guardian’s weights in each iteration, unlike GAN training’s two-model updates.
- GEN concurrently considers activity and attribute inferences on the same time-series, extending prior approaches that separated sensitive and non-sensitive temporal sections.
- The Estimator can be trained remotely, while edge devices download the trained model and run GEN locally under the user’s control.
6 CONCLUSION
The paper proposes and evaluates GEN as a local framework for balancing application utility with user privacy in motion data. Future work includes theoretical leakage bounds, modeling dependencies between attributes, and measuring edge-device costs.
- GEN locally transforms sensor data on mobile edge devices to respect application requirements and user privacy, and its utility–privacy trade-off is evaluated on real-world motion datasets.
- Future work will provide theoretical bounds on sensitive-information leakage and explore dependencies between attributes such as gender and height.
- Future work will measure the costs and requirements of running GEN on edge devices.