PaperlayerView exact revision on arXiv

Source-linked AI summary

Towards On-Device Evidence Gathering for Intimate Partner Infiltration: A Feasibility Study for Joint Identity-Action Detection

Weisi Yang, Shinan Liu, Feng Xiao, Nick Feamster, Stephen Xia

arXiv:2502.03682v3cs.CRcs.CYcs.HC

TL;DR

Intimate Partner Infiltration involves close-person access to smartphones and privacy-sensitive actions that existing, episodic support approaches cannot continuously observe. The paper introduces AID, an on-device joint identity–action detection system, and evaluates it in a controlled study, achieving strong Top-1 performance while reducing false positives when retaining top-3 action candidates for review.

  • Problem

    IPI requires detecting phone-side risk evidence involving both who uses a device and what they do, while existing support is episodic and expert-intensive.

  • Method

    AID continuously analyzes non-owner-like use and IPI-relevant actions through a local dual-branch architecture using device-internal signals under stealth, safety, and privacy constraints.

  • Results

    0.928 F1 with 7.0% FPR is achieved for Top-1 event flagging, while retaining top-3 candidate behaviors yields 0.981 F1 with 1.6% FPR.

  • Takeaways & Limitations

    AID provides candidate IPI-risk records and ranked action categories that can support later human review by security clinics.

  • Takeaways & Limitations

    AID cannot observe consent, coercion, or relationship history, so its outputs remain candidate records for later review.

Abstract

from arXiv · show

Intimate Partner Infiltration (IPI) refers to phone-side privacy infiltration in intimate or close relationships, often enabled by physical access to a person's smartphone and discussed in technology-facilitated Intimate Partner Violence (IPV) contexts. Unlike conventional cyberattackers, IPI perpetrators leverage proximity and personal knowledge to circumvent standard protection, underscoring the need for targeted interventions, motivating device-side tools that surface such risk evidence for later review. While prior works have extensively studied IPV, and some have provided tailored and effective solutions such as security clinics, they are necessarily episodic and human-expert-intensive, and offer limited automated visibility into what happens on a smartphone between support sessions. Guided by a formative interview with experts (n=5), we take the first exploration into gathering IPI-risk evidence from a mobile system perspective and present AID, Automated IPI Detection, a data-driven system that continuously logs unauthorized access and suspicious behaviors on smartphones. In a controlled 27-participant study, AID achieves an end-to-end F1 score of 0.928 with a 7.0% false positive rate for Top-1 phone-side risk flagging; when preserving top-3 candidate action categories as report context, AID achieves an F1 score of 0.981 and a false positive rate of 1.6%. These findings demonstrate AID's potential as an evidence-support tool that complements current clinic-based interpretation and safety-planning.

1 INTRODUCTION

IPI is a phone-side privacy threat in which close partners exploit physical access and personal knowledge, while existing support remains episodic and expert-intensive. The paper proposes AID, an on-device system that jointly detects non-owner use and risky phone actions under stealth and privacy constraints.

  • 1 INTRODUCTION: IPI involves close-person access to a smartphone followed by privacy-sensitive actions such as changing passwords, deleting emails, or reading messages.Unlike conventional cyberattacks, it can exploit physical proximity, shared access, familiarity, or credentials.
  • 1 INTRODUCTION: Security clinics provide tailored support, but their episodic and expert-intensive operation limits automated visibility between support sessions.The paper motivates continuous device-side evidence gathering as a complement to clinic-based review.
  • 1 INTRODUCTION: AID combines identity and behavior analysis to continuously detect phone-side IPI-risk events locally, including non-owner-like use and IPI-relevant actions.Its dual-branch design analyzes identity and fine-grained behavior, then fuses them through a context-aware risk analyzer.
  • 1 INTRODUCTION: AID is designed to operate stealthily and privately by using device-internal signals, local processing, and zero-permission streams.These constraints aim to reduce perceptual cues that could expose the system to an intimate adversary.
  • 1 INTRODUCTION: 0.928 F1 and 7.0% FPR are achieved for Top-1 end-to-end IPI-risk flagging in a controlled 27-participant feasibility study.When top-3 candidate action categories are retained as contextual evidence, AID reaches 0.981 F1 with 1.6% FPR.

2 BACKGROUND AND MOTIVATION

Prior IPV research and security clinics provide important support, but existing approaches offer limited scalable, privacy-preserving, and continuous detection of phone-side IPI evidence. The paper motivates an IPI-tailored system by highlighting differences from traditional cybersecurity and shortcomings of adjacent technical domains.

  • 2 BACKGROUND AND MOTIVATION: Security clinics offer tailored in-person support but face limited time, costly expertise, geographic barriers, and incomplete self-reporting.These constraints make clinic-based evidence gathering difficult to scale.
  • 2 BACKGROUND AND MOTIVATION: Anomaly detection, user authentication, and human activity recognition are poorly matched to IPI's benign-looking behaviors, close-person access, and safety-sensitive setting.The paper reports false positive rates of 27.6%, 18.1%, and 78.0% for these domains, respectively.
  • 2 BACKGROUND AND MOTIVATION: Mobile behavior-understanding methods often lack IPI-specific safety considerations and may depend on privacy-sensitive data such as screen recordings.These constraints make them unsafe or impractical for sensitive IPI environments.
  • 2 BACKGROUND AND MOTIVATION: The paper identifies a need for fine-grained automated IPI sensing that preserves privacy and remains subtle enough to minimize discovery and escalation.This need follows from the limitations of existing human-centered and technical approaches.
  • 2 BACKGROUND AND MOTIVATION: IPI differs from traditional cybersecurity because intimate adversaries may rely on physical proximity, shared access, and personal knowledge rather than technical exploits.This distinction motivates comparing IPI with conventional attacker models.

3 PROBLEM FORMULATION

This section defines IPI as smartphone infiltration by a close person, builds a literature-grounded behavior taxonomy and OS-signal mapping, and formulates detection as joint identity–action inference.

  • 3.1 Threat Model: IPI concerns a close person with shared or frequent smartphone access who operates the owner’s device in a privacy-sensitive scenario.
  • 3.2 Formative Expert Interviews: Experts informed a narrow AID role: produce ranked phone-side evidence for professional interpretation rather than determine IPI, intent, harm, or interventions.
  • 3.3 Constructing IPI Behavior Taxonomy: The taxonomy retains 173 of 367 incidents from 15 HCI and security papers, organizing them into 28 subaction-traits, nine actions, and five categories.
  • 3.3 Constructing IPI Behavior Taxonomy: IPI behaviors are classified at five-category, nine-action, and 28-subaction levels, with NIO representing risk-neutral behaviors resembling normal device use.
  • 3.4 Mapping IPI-related Behaviors to OS signals: AID maps four high-level modalities to IPI behaviors using standard Android APIs and system services without privileged access.
  • 3.4 Mapping IPI-related Behaviors to OS signals: IMU and SYS signals were most predictive for user identity, whereas INT and APP signals were most effective for behavior identification.
  • 3.5 Formulating IPI-risk Event Detection: The problem maps a multimodal time-series window x to binary IPI risk by jointly estimating non-owner identity u and IPI-related behavior b.

4 AID DESIGN

AID combines identity verification and behavior classification to detect candidate IPI-risk events on-device, using adaptation, temporal smoothing, and context-aware fusion to generate expert-facing reports.

  • 4.1 Workflow Overview: AID fuses an identity branch that verifies the phone owner with a behavior branch that classifies IPI-related actions through a context-aware risk analyzer.The workflow processes fixed-length multimodal sequences and combines both branches before reporting.
  • 4.1 Workflow Overview: AID pretrains an identity encoder and behavior classifier, then adapts the identity decision module using a short owner calibration session and non-owner reference data.The behavior branch remains fixed during guided owner adaptation.
  • 4.2 Pretraining Stage: The identity branch uses a multi-head LSTM autoencoder and SVM decision module to distinguish legitimate owners from intimate adversaries or non-owners.The autoencoder learns general behavioral features, while the adapted decision model classifies reconstruction-based difference vectors.
  • 4.2 Pretraining Stage: The behavior branch uses an LSTM-CNN architecture to classify IPI-related actions from input sequences without further user-side training.The detection model is trained server-side and deployed for direct on-device inference.
  • 4.3 New User Adaptation: Temporal consistency modules smooth identity and behavior predictions before fusion, reducing isolated mispredictions and stabilizing detection.Identity predictions use temporal voting, while behavior predictions use rolling-window averaging.
  • 4.4 Detection and Reporting: AID reports timestamps, app context, ranked top-k behavior evidence, and final flags for non-owner-like windows while suppressing app and behavior evidence for owner-like windows.This reporting policy supports later expert review while limiting unnecessary privacy exposure.

5 STRATEGIES FOR SAFETY AND STEALTHINESS

AID uses a safety-first, gatekeeper-controlled deployment model and constrains sensing to reduce disclosure and privacy risks, while acknowledging that motivated adversaries may still detect or evade it.

  • 5.3 What If the Intimate Adversary is Aware of AID?: AID cannot guarantee persistent undetectability or perfect soundness against a motivated adversary, making adversarial awareness a significant residual challenge.An informed adversary may stop the background service or attempt to mimic the owner’s behavior to bypass detection.
  • 5.1 Responsible Deployment and Usage Model: AID is deployed through trusted professionals who install and configure the tool with the at-risk individual rather than distributing it directly to the public.The gatekeeper model is intended to mitigate disclosure risks, including coercive discovery by an adversary.
  • 5.2 Privacy and Stealthiness: The system avoids signals and APIs that could violate owner privacy or reveal AID’s presence, including background touch, camera, audio, and location sources.Stealth requirements constrain available sensors, input signals, and implementation methods.

6 EVALUATIONS

Across controlled evaluations, AID combines identity and behavior signals to flag candidate IPI-risk events, preserve ranked action context, and support resource-efficient longitudinal monitoring. Performance is strongest with context-aware fusion and short recalibration, while behavior ambiguity and temporal drift remain important evaluation considerations.

  • 6.2 End-to-End System Performance: F1 reaches 0.928 for end-to-end candidate IPI-risk flagging, outperforming direct-flagging baselines while reducing false alarms.The evaluation reports lower false-positive rates and an ablation increase in FNR from 0.064 to 0.080 without context-aware fusion.
  • 6.2 End-to-End System Performance: F1 improves from 0.928 to 0.981 and FPR falls from 0.070 to 0.016 when top-3 behavior predictions provide report context.Ranked action outputs support human-in-the-loop review when sensor signals make behaviors difficult to distinguish.
  • 6.3 Effectiveness of User Identity Branch: AID maintains partner detection at F1 = 0.998 and FAR = 0.003, whereas KedyAuth reaches FAR = 0.413 for close partners.The comparison indicates that identity detection remains effective when a close partner resembles the owner behaviorally.
  • 6.4 Effectiveness of Behavior Branch: Top-5 subaction accuracy reaches 0.891 and top-3 action accuracy reaches 0.900, showing that ranked predictions accommodate ambiguous IPI-related behaviors.The correct label frequently appears among multiple plausible predictions because some actions exhibit similar multimodal patterns.
  • 6.4 Effectiveness of Behavior Branch: The hybrid LSTM-CNN backbone outperforms single-type and transformer architectures across scenarios, although 5-class category performance is within 1%.The study attributes transformer weakness to the small model sizes used in this setting.
  • 6.5 Temporal Longitudinal Study: Three-minute recalibration raises mean F1 from 0.562 to 0.865 and lowers FAR from 0.461 to 0.146 across longitudinal sessions.Fixed profiles degrade across sessions, whereas recalibrated models remain comparatively stable, including in the final environmentally shifted session.

7 DISCUSSION AND FUTURE WORK

AID’s controlled evaluation does not capture lived IPV dynamics, consent, coercion, or adversarial adaptation, so its outputs remain candidate evidence for professional review. Future work should move cautiously toward clinic-mediated field evaluation while preserving safety planning and participant control.

  • 7.1 Limitations: The controlled study does not observe real IPV episodes or measure survivor outcomes, limiting ecological validity.It cannot reproduce fear, coercion, strategic adaptation, malicious intent, or broader relationship power dynamics.
  • 7.1 Limitations: Close partners may share routines or deliberately imitate the owner, while fear, stress, and hurried use can alter owner behavior and calibration data.Repeated covert or coercive contamination and goal-directed evasion remain untested.
  • 7.1 Limitations: AID should not infer abuse or intent from phone traces because it cannot observe consent, coercion, or relationship history.A correctly recognized non-owner action may still be benign or unclear in context, so outputs require trained professional review.
  • 7.1 Limitations: AID’s candidate-event rule excludes harmful owner-performed actions under pressure and consensual sharing that lacks harmful relationship context.It flags only non-owner-like use combined with an IPI-related phone-side action.
  • 7.2 Future Work: AID runs silently for evidence gathering and avoids immediate alerts, a design intended to reduce confrontations after discovery.The authors still recommend rigorous safety planning with clinical support.
  • 7.2 Future Work: Future deployment should proceed through broader stakeholder review, lower-risk studies, and voluntary clinic-mediated evaluation with professional oversight.Participants should retain control, records should not trigger automatic action, and studies should include withdrawal, deletion, and safety fallback procedures.

8 CONCLUSION

The paper formulates IPI evidence gathering as joint detection of unauthorized identity and potentially risky phone behavior, implemented in AID under stealth, safety, and privacy constraints. A 27-participant evaluation supports feasibility, while the study’s healthy-relationship sample and debriefing procedures define its ethical and evidentiary scope.

  • 8 CONCLUSION: AID flags candidate IPI-risk events by jointly analyzing unauthorized user identity and potentially risky phone behaviors.Its dual-branch architecture uses OS-level and physical signals under stealth, safety, and privacy constraints.
  • 8 CONCLUSION: 0.928 F1 and 7.0% FPR are achieved for Top-1 classification, while retaining top-k candidate behaviors reaches 0.981 F1 and 1.6% FPR.The top-k output preserves ambiguity for later human review.
  • Ethics and Study Scope: The study recruited couples and friends in healthy relationships rather than real IPV victims or abusers to reduce potential psychological and physical harm.This design collected behaviorally relevant data without directly involving vulnerable populations.
  • Ethics and Study Scope: Participants were debriefed, could withdraw their data afterward, and had collected data anonymized and securely stored.The study reports no post-debriefing withdrawals and restricted encrypted-server access to authorized personnel.

C EVALUATION SETTINGS

The evaluation models were trained and assessed on a Linux server using Ubuntu, TensorFlow, Python, and an NVIDIA L40 GPU. User identification used self-supervised autoencoder pretraining, while behavior classification used a separate training configuration.

  • C EVALUATION SETTINGS: Models were trained and evaluated on Ubuntu 22.04.5 LTS with an NVIDIA L40 GPU, TensorFlow 2.17.0, and Python 3.12.7.These settings describe the server-side training and evaluation environment.
  • C EVALUATION SETTINGS: The user-identification autoencoder used self-supervised reconstruction with Adam, a 1e-3 learning rate, early stopping, and Mean Squared Error loss.Pretraining ran for at most 100 epochs with batch size 512, while the behavior classifier was trained for 50 epochs with the same batch size.

D CASE STUDY: VISUALIZING END-TO-END DETECTION PERFORMANCE

The case study compares end-to-end detection behavior across model architectures and illustrates why AID’s staged identity-then-behavior design is useful. AID produces fewer owner-phase false alarms and prompt adversary detection in the shown example.

  • D CASE STUDY: VISUALIZING END-TO-END DETECTION PERFORMANCE: AID maintains stable predictions with fewer owner-phase false alarms and prompt adversary detection in the sample owner-adversary pair.The monolithic model produces frequent owner-phase false positives, while the RF meta-learner remains less noisy but still unstable.
  • D CASE STUDY: VISUALIZING END-TO-END DETECTION PERFORMANCE: The case study shows that AID determines intermediate user-identity and behavior outputs before producing end-to-end risk predictions.This two-stage structure contrasts with direct end-to-end baselines that could not successfully learn the relevant characteristics.

E USER IDENTIFICATION ENCODER COMPARISON IN EMBEDDING SPACE

AID’s embedding space separates owner and attacker samples, particularly for intimate partners. Partner embeddings show stronger geometric separation than the compared baseline methods.

  • The embedding analysis compares partner and stranger samples using Euclidean distance and cosine similarity.
  • AID produces greater Euclidean distances and lower cosine similarity between owner and attacker samples, especially for partners.Partner embeddings reach a cosine similarity of −0.032, indicating strong directional separation even for behaviorally similar partners.
  • The section presents a sample-pair IPI detection output alongside the embedding analysis.

F EFFECTS OF PRETRAINING AND FINE-TUNING

AID’s fine-tuning performance depends on how calibration windows are selected and how many are used. Random selection performs best and remains stable as the fine-tuning set grows.

  • Random selection samples calibration windows across the session, increasing the chance of capturing diverse user behaviors.The calibration data come from a one-time five-minute owner session during installation.
  • Chronological selection may underperform random selection because consecutive windows can be less behaviorally diverse.
  • Similarity-based selection mixes hard, moderate, and easy examples using a 30%/50%/20% ratio to expose the model to difficult cases.
  • The peak F1 score occurs with random selection using 20 fine-tuning windows, while performance remains consistently high as the window count increases.Similarity-based selection fluctuates from F1 0.944 with 20 windows to 0.901 with 28 windows.

G F1 SCORE ACROSS VARYING SAMPLING RATES AND WINDOW TIME SPANS

User-identification performance remains strong across sampling and window configurations, with the best reported setting reaching F1 0.995. AID also retains performance when evaluated on apps excluded from training.

  • F1 reaches 0.995 with a 20 Hz sampling rate and a 2-second window, while all tested configurations remain above 0.84.The results indicate robustness across lower sampling rates and shorter windows while reducing processing demands.
  • Performance can plateau or decline for configurations such as 5 Hz sampling with a 5-second window.The authors associate this pattern with the small model’s limited capacity for higher-dimensional inputs.
  • Using eight LSTM heads yields the best reported head configuration, with F1 = 0.954.Additional heads provide diminishing returns or slight degradation.
  • Among evaluated classifier backbones, SVM achieves the highest F1 score at 0.98, ahead of Dense at 0.969 and the LSTM classifier.The SVM is also the least complex architecture evaluated.
  • App-held-out training causes average, median, and maximum accuracy drops of 3.6%, 2.9%, and 7.0%, respectively, relative to seen-app training.Each fold trains on five apps and evaluates on all six apps.

L SENSITIVITY TO NON-OWNER CONTAMINATION IN RECALIBRATION

AID’s longitudinal event-flagging performance declines when owner recalibration is contaminated by non-owner data. Later clean recalibration can partially correct the effect in the controlled setting.

  • The experiment contaminates one intermediate calibration session with non-owner samples, then resumes clean owner recalibration in later sessions.Each case contains four longitudinal sessions, with Session 1 used for clean initialization.
  • Top-1 event-flagging F1 decreases from 0.865 ± 0.039 with no contamination to 0.794 ± 0.022 at 33.3% contamination.The metric is averaged over four longitudinal cases from two participant pairs.
  • The observed contamination effect is not necessarily persistent when subsequent calibration windows again contain clean owner data.
Loading 2502.03682v3…