Source-linked AI summary
PrivateHub: Contrastive Diffusion Model for Private Sensor-Intensive Environment Data Generation
Jiechao Gao, Yuandong Pan, Jie Wang, Michael Lepech, Bradford Campbell
TL;DR
Fusing sensor streams can reveal private activities even when individual streams seem benign, while existing protections do not resolve the need to conceal some activities without losing useful detection. PrivateHub uses contrastive learning within a diffusion model to generate synthetic streams that retain non-private application detection while hiding private applications. Across three datasets, it lowers private-application accuracy by 40 to 50% while keeping non-private performance close to raw and remaining robust against an adaptive attacker.
Problem
Sensor fusion can reveal private activities from streams that appear benign individually, while existing approaches do not selectively conceal private applications and preserve non-private detection.
Source: §1 · pp. 1–2Method
PrivateHub uses contrastive learning within a diffusion model to generate synthetic multi-sensor streams that conceal private applications while keeping non-private applications detectable.
Source: §1 · p. 2Results
Across three datasets, PrivateHub lowers private-application accuracy by 40 to 50% while keeping non-private performance close to raw, outperforming baselines and remaining robust against an adaptive attacker.
Source: §7 · p. 12Takeaways & Limitations
Raw streams stay local while third-party services receive synthetic output, allowing the owner's own services to use raw data and outside parties to see only synthetic data.
Source: §3.1 · p. 3The threat model assumes attackers cannot access raw streams or PrivateHub's internal parameters and cannot infer private activities from timing alone.
Source: §3.2 · p. 3
Abstract
from arXiv · showhide
Sensor-intensive environments enable many intelligent services by inferring user applications from heterogeneous data streams. However, not all applications should be exposed: users want some activities to stay private. This creates a tension between inferring applications for useful services and preventing unwanted inference. Existing approaches such as differential privacy and rule-based filtering protect individual streams but cannot address the privacy risk from cross-sensor inference. We introduce Privatehub, which uses contrastive learning within a diffusion model to generate synthetic multi-sensor streams that keep non-private applications detectable while concealing private ones. Privatehub has two stages: App-Conditioned Pre-training (ACP), which conditions the model on multi-sensor data with application embeddings, and App-Aware Fine-tuning (AAF), which separates private from non-private data via contrastive learning. We also define a threat model for the multi-sensor sharing setting. Experiments on three real-world multi-sensor datasets show Privatehub lowers private-application accuracy by 40 to 50\% without hurting non-private performance, and stays robust when the attacker retrains on the synthetic data.
1 INTRODUCTION
Fusing sensor streams can reveal private activities even when individual streams appear benign, while existing protections either miss this risk or harm useful applications. PrivateHub uses contrastive learning within a diffusion model to generate streams that conceal private activities while keeping non-private ones detectable.
1 INTRODUCTION
- Fusing multiple sensor streams can expose private activities even when individual streams look benign, creating a practical challenge as deployed sensors multiply.The paper contrasts benign activities such as standing or sitting with highly private activities such as Zoom calls.Source: §1 · p. 1
- Rule-based protections treat streams independently, differential privacy noise can degrade every application, and existing generative approaches do not selectively hide private applications while preserving non-private detection.The cited limitations include human rule-setting and enforcement, utility loss from noise, and posterior or mode collapse in VAE, GAN, and conditional GAN approaches.Source: §1 · pp. 1–2
- Replaying non-private segments disrupts sensor timing and correlations, while adding noise harms useful tasks and can be countered by attacker retraining.The paper frames the challenge as selective concealment that keeps non-private activities readable and data meaningful.Source: §1 · p. 2
- PrivateHub uses contrastive learning within a diffusion model to generate streams that keep non-private applications detectable while concealing private ones.App-Conditioned Pre-training conditions the model on multi-sensor streams with application embeddings; App-Aware Fine-tuning uses contrastive learning to separate private from non-private data.Source: §1 · p. 2
2 MOTIVATION
Multi-sensor fusion can make private activities inferable from otherwise ordinary environmental data, motivating protection before sensor streams are shared. The preliminary study demonstrates activity inference, while the section also situates data sharing against the utility and privacy trade-offs of existing approaches.
2.1 Privacy Risks in Sensor-Intensive Environments
- Fusing environmental sensors can expose sensitive behavior even when individual data points seem innocuous, which can discourage users from sharing data.The preliminary study used CO2, PM2.5, illuminance, sound pressure, humidity, and temperature measurements in two office rooms.Source: §2.1 · p. 2, §2.2 · p. 3
- The preliminary office study found that SVM soft labels matched true activities with 82% to 87% accuracy, indicating privacy leakage from unlabeled multi-sensor streams.Five participants performed four activities using environmental sensors; the study treats typing, Zoom calls, and whiteboard writing as private, and standing while drinking as benign.Source: §2.1 · p. 2
2.2 Beneficial for IoT Data Training among Users
- Cloud methods centralize raw user data, federated learning remains vulnerable to model inversion, and differential privacy can reduce model utility.These approaches address the difficulty of training effective models when individual users have limited data.Source: §2.2 · pp. 2–3
- The proposed sharing architecture aims to protect privacy-sensitive activities while keeping meaningful activities identifiable, including useful predictions from thermostat data.The paper motivates sharing data that preserves task utility without exposing sensitive activities inferred from fused signals.Source: §2.2 · p. 3
3 THREAT MODEL
PrivateHub runs at the data owner's local hub before data leaves the trusted boundary, sharing synthetic streams while retaining raw streams locally. The threat model evaluates third-party services that may train on synthetic data or adapt to its distribution under specified access and inference assumptions.
3.1 System Model
- PrivateHub runs locally on the owner's device or edge node; raw streams remain inside the trusted boundary, and only synthetic output is shared with third-party services.The owner's own services can continue using raw data, while outside parties receive synthetic data.Source: §3.1 · p. 3
3.2 Adversary Model
- The third-party adversary may train a classifier on synthetic streams or adapt to their distribution, but is assumed unable to access raw streams or PrivateHub parameters.The model also assumes the attacker cannot infer private activities from timing alone; protection and utility are measured through private- and non-private-activity classification accuracy.Source: §3.2 · p. 3
4 SYSTEM DESIGN
PrivateHub pre-trains a task-conditioned diffusion model, then fine-tunes it with classifier-feature contrastive learning to favor non-private applications and filter low-quality generations.
4 SYSTEM DESIGN
- ACP pre-trains a diffusion model, and AAF uses classifier features and contrastive learning to generate data more related to non-private and less to private applications.Low-quality generations are filtered before they reach App-aware Feature Discrimination.Source: §4 · pp. 3–4, Figure 4 · p. 4
4.1 Design Fashion of Pre-training and Fine-tuning
- Pre-training followed by per-user fine-tuning is intended to improve fine-tuning accuracy and efficiency while adapting generated data to different privacy requirements.The authors contrast this with end-to-end training from scratch, which they say is slower and hurts accuracy.Source: §4.1 · p. 4
4.2 App-Conditioned Pre-training
- ACP corrupts clean input with sampled noise and timesteps, then denoises from Gaussian noise into clean data conditioned on a task embedding.The sampling process uses a DDIM sampler.Source: §4.2 · pp. 4–5, Figure 5 · p. 5
4.2.1 Optimization Objective.
- ACP maps task labels to learnable embeddings, adds per-task mean, standard deviation, and Z-score features, and trains the model to predict noise using an MSE objective.The task embedding conditions denoising; the predicted noise is compared with sampled Gaussian noise.Source: §4.2.1 · p. 5
4.3 App-Aware Fine-tuning
- AAF uses real non-sensitive data as positive examples and generated privacy-sensitive data as negatives, applying contrastive learning to pull generated features toward the former and away from the latter.An off-the-shelf activity classifier supplies the features used in the contrastive comparison.Source: §4.3 · pp. 6–7
- AAF filters low-quality generated samples with a classifier-confidence threshold; its main experiments use G=0.7, within the stated stable [0.6, 0.8] band.If filtering returns no data, that iteration skips contrastive-loss computation.Source: §4.3 · pp. 6–7
- The fine-tuning classifier is independent of evaluation classifiers, and the attacker trains its own classifier from scratch on synthetic data.The paper also reports protection across CNN, Transformer, and Random Forest attacker architectures.Source: §4.3 · p. 7
5 EVALUATION
The evaluation tests PrivateHub across smart-home, smart-office, and in-the-wild sensor data, including privacy, utility, and robustness. PrivateHub preserves non-private accuracy while reducing private-activity accuracy, and further experiments examine baselines, incomplete labels, adaptive attackers, threshold sensitivity, and component contributions.
5.1 Applications and Datasets
- The three evaluation settings span CASAS smart homes, a self-collected smart office, and the in-the-wild ExtraSensory smartphone-and-smartwatch dataset.The CASAS data cover five apartments and 11 activity categories; the office data cover four activities, and ExtraSensory includes 60 users and more than 300,000 labeled minutes.Source: §5.1 · p. 8
5.2 Experimental Setup and Evaluation Metrics
- CASAS experiments use leave-one-dataset-out pre-training and an 80-20 fine-tuning/test split, while office experiments pre-train on one room and fine-tune on the other.The evaluation averages accuracy over five runs and uses lower private accuracy and non-private accuracy close to raw as protection and utility indicators.Source: §5.2 · p. 8
5.3.1 RQ1: Performance of synthetic data generation.
- PrivateHub matches raw-data accuracy on non-private activities while reducing private accuracy to below 40%, about 40 to 50% lower than raw.Table 2 compares accuracy for non-private and private activities across datasets; lower private and higher non-private accuracy indicate stronger protection.Source: Table 2 · p. 9, §5.3.1 · p. 9
- On Milan, replay lowers non-private accuracy to 0.618 and matched-privacy noise lowers it to 0.641, while PrivateHub reaches 0.840, matching raw data.Replay reduces private accuracy to 0.24 to 0.26 but breaks timing and cross-sensor correlations; protection also holds across three independent classifiers, with private accuracy 0.37 to 0.39 and non-private accuracy 0.82 to 0.84. GAN baselines fail to generate enough qualified samples in specified Milan and Kyoto1 settings where PrivateHub succeeds.Source: §5.3.1 · pp. 9–10, §5.3.2 · p. 10, Figure 8 · p. 10
- Noise Perturbation is worst on CO2 and temperature prediction, with accuracy 0.79 and 0.83, while PrivateHub stays closest to raw data.With two application labels blocked, 60% of setups show no accuracy loss, 20% show around a 2% drop, and one shows around a 14.2% drop; similar behavior appears with naturally incomplete ExtraSensory data.Source: §5.3.3 · p. 11, Figure 11 · p. 11
5.3.5 RQ5: Robustness to Adaptive Adversaries and Threshold Sensitivity.
- Under an adaptive attacker, PrivateHub’s Milan private accuracy rises only from 0.39 to 0.45 (a 6-point jump), versus TimeGAN’s increase from 0.45 to 0.56 (11 points).Within the [0.6, 0.8] threshold band, both metrics are stable, supporting the default G=0.7.Source: §5.3.5 · pp. 11–12
5.3.6 Ablation Study.
- In the Milan ablation, App-Aware Fine-tuning provides most privacy protection, while data filtering restores non-private utility.Without filtering, fine-tuning gives private accuracy 0.451 and non-private accuracy 0.798; adding filtering changes these to 0.387 and 0.840, respectively.Source: §5.3.6 · p. 12, Table 3 · p. 12
6 RELATED WORK
Prior privacy frameworks either handle streams independently or degrade applications broadly. Generative methods offer synthetic streams, but GAN diversity and conditional diffusion for multi-sensor data remain limited.
6.1 Data Privacy
- Rule-based frameworks rely on people to create and enforce policies, and handle streams individually, leaving cross-stream interactions unaddressed.Source: §6.1 · p. 12
- DP approaches such as Gao et al. combine federated learning and LDP, but ignore sensor relationships and degrade applications regardless of privacy designation.Source: §6.1 · p. 12
6.2 Generative Models
- GAN methods such as SensoryGANs, TimeGAN, and ActivityGAN synthesize sensor data or preserve HAR temporal dynamics, but posterior and mode collapse limit diversity.Source: §6.2 · p. 12
- Diffusion models produce higher-quality streams, yet conditional diffusion work [6] mostly targets images and is not suited to multi-sensor streams.Source: §6.2 · p. 12
7 CONCLUSION
PrivateHub combines contrastive learning with diffusion to generate privacy-preserving synthetic streams. Across three datasets, it reduces private-application accuracy while keeping non-private performance close to raw and remaining robust to an adaptive attacker.
7 CONCLUSION
- 40 to 50% lower private-application accuracy across three datasets, while non-private performance stays close to raw.Source: §7 · p. 12
- PrivateHub outperforms generative and simple baselines and stays robust against an adaptive attacker.Source: §7 · p. 12
- PrivateHub uses contrastive learning within a diffusion model via ACP and AAF, and defines a threat model for multi-sensor sharing.Source: §7 · p. 12