Privacy on the Fly: A Predictive Adversarial Transformation Network for Mobile Sensor Data

Conference: AAAI 2026 Oral
arXiv: 2511.07242
Code: https://github.com/skysky4/PATN
Area: AI Security
Keywords: Sensor Privacy, Adversarial Perturbation, Real-time Privacy Protection, Mobile Security, Time-series Data

TL;DR

This paper proposes PATN (Predictive Adversarial Transformation Network), the first framework to introduce adversarial perturbations to sensor data privacy protection. By utilizing historical sensor data to generate future-oriented adversarial perturbations, it achieves zero-latency real-time privacy protection while maintaining the semantic fidelity of the sensor data.

Background & Motivation

Motion sensors (accelerometers, gyroscopes) on mobile devices are accessible to third-party applications through standard APIs. While this enables convenient functionalities (activity recognition, step counting, gesture interaction), it also raises serious privacy concerns:

Privacy Threats: Sensor data can be used to infer sensitive attributes of users: - Identity Identification: Discerning individual identity through gait patterns - Gender Inference: Distinguishing male and female through motion characteristics - Age Inference: Determining child/adult based on operation patterns

More concerningly, open-source privacy inference models make it easy for third-party applications to exploit sensor data to infer user privacy without the user's knowledge.

Two Major Limitations of Prior Work:

Temporal Semantic Distortion: Generative model approaches (GANs, VAEs, diffusion models) regenerate the entire sequence through latent space sampling, which over-smooths or distorts fine-grained temporal patterns. This leads to a severe degradation in the performance of tasks requiring precise numerical computing (e.g., estimation of phone rotation angles).

Inability to Meet Real-time Requirements: Existing methods require buffering complete sensor sequences before transformation (segment-wise processing), whereas sensor data streams in practice arrive continuously and must be processed instantaneously.

Core Idea: To utilize adversarial perturbations—adding imperceptible, minor noise to the original signal to mislead privacy inference models. However, directly applying traditional adversarial attack methods to streaming sensor data presents two challenges: - Traditional methods require the complete input sequence. - Simply applying perturbations from historical data to future data has limited efficacy (temporal alignment issue).

Method

Overall Architecture

PATN consists of two phases:

1. Training Phase: Jointly optimizes three objectives—adversarial effectiveness, temporal robustness, and smoothness regularization.
2. Deployment Phase: The trained network runs locally on the mobile device, generating zero-latency perturbations for real-time sensor streams.

Key Designs

1. Predictive Adversarial Perturbation Generation

The core innovation is predicting future perturbations using historical data. A temporal mapping function is learned:

\[\delta_{t:t+w} = \mathcal{F}(x_{0:t})\]

Taking historical sensor data \(x_{0:t}\) as input, it outputs the adversarial perturbation \(\delta_{t:t+w}\) for the future \(w\) steps. The perturbation is applied in real-time to newly arriving data, ensuring that privacy protection is completed before untrusted applications access the data.

The network adopts a Seq2Seq LSTM encoder-decoder architecture: - The encoder processes \(T_{\text{in}} = 30\) steps (15 seconds) of 6-dimensional sensor data, extracting temporal dependencies and compressing them into a fixed-length latent representation. - The decoder generates a perturbation sequence of \(T_{\text{out}} = 10\) steps autoregressively.

\[\delta_i = W_o h_i + b_o, \quad \|\delta\|_\infty \leq \epsilon_d\]

2. Perturbation Range Constraint

An \(\ell_\infty\) constraint is meticulously designed to ensure the perturbations are imperceptible:

Statistical Constraint: Sets an upper bound based on data statistics

\[\epsilon_d^{\text{data}} = \min(0.05 \times \mu_d, \ 0.05 \times \sigma_d)\]

Natural Variation Constraint: Measures the standard deviation of natural sensor fluctuations \(\epsilon_d^{\text{natural}}\) across 10 users with phones fixed on a rigid table.

Final Constraint: \(\epsilon_d = \min(\epsilon_d^{\text{data}}, \ \epsilon_d^{\text{natural}})\)

This guarantees that the perturbation amplitude does not exceed the natural fluctuation range, minimizing the impact on downstream tasks (such as step counting and activity recognition).

3. History-Aware Top-k Optimization (HATO)

Resolves the temporal alignment issue (Problem 2): Attackers may launch inference attacks at any arbitrary time point, which may mismatch the time window of the defensive perturbations.

The core procedure of HATO (Algorithm 1):

1. Concatenates the perturbation from the previous round \(\delta_{t-w:t}\) and the current perturbation \(\delta_{t:t+w}\) to generate a longer adversarial sequence.
2. Extracts multiple overlapping segments from the concatenated sequence using a sliding window.
3. Computes the cross-entropy loss for each segment through the privacy inference model.
4. Selects the top-\(k\) maximum loss values and averages them as the optimization objective.

\[\mathcal{L}_{\text{HATO}} = \frac{1}{k} \sum_{i=1}^k \text{TopK}_i(\mathcal{L}, k)\]

This forces the perturbations to effectively degrade model performance across multiple sub-windows, rather than overfitting to a specific time segment.

Loss & Training

Weighted combination of three loss terms:

\[\mathcal{L}_{\text{total}} = \mathcal{L}_{\text{adv}} + \lambda_1 \mathcal{L}_{\text{HATO}} + \lambda_2 \mathcal{L}_{\text{st}}\]

• \(\mathcal{L}_{\text{adv}}\): Misclassification loss (cross-entropy with a target to mislead labels).
• \(\mathcal{L}_{\text{HATO}}\): History-aware top-\(k\) loss (\(\lambda_1 = 0.3\)).
• \(\mathcal{L}_{\text{st}}\): Smoothness regularization (MSE of perturbations, \(\lambda_2 = 0.3\)), penalizing abrupt changes in the perturbation signal.

When facing multiple privacy inference models, \(\mathcal{L}_{\text{total}}\) from each model is aggregated into a unified optimization objective to achieve multi-model joint defense.

Training Configuration: Adam optimizer, initial learning rate of 1e-3, decayed by half every 200 epochs, for a total of 600 epochs. LSTM hidden dimension is 64, and top-\(k\) is set to 2.

Key Experimental Results

Main Results

Method	MotionSense ASR(%)↑	MotionSense EER(%)↑	ChildShield ASR(%)↑	ChildShield EER(%)↑
Raw data	-	8.30	-	7.56
DP	14.37	17.46	4.12	12.00
UAP	9.61	13.53	3.17	10.92
FGSM	23.95	25.92	12.99	19.11
PGD	23.95	25.92	12.99	19.11
PATN	40.11	41.65	44.95	46.22

PATN significantly outperforms baselines on both datasets. On MotionSense, its ASR is +16.16% higher than FGSM, and +31.96% higher on ChildShield. EER increases from the raw ~8% to ~42-46%, approaching random guessing levels.

Ablation Study

Effect of Input Length \(T_{\text{in}}\):

\(T_{\text{in}}\)	10	20	30	40	50
ASR(%)	34.59	37.54	40.11	38.81	30.88
EER(%)	33.34	37.84	41.65	38.87	29.11

The optimal value is 30 (15 seconds of historical data). Excessively short lengths result in insufficient information, while excessively long lengths dilute perturbation quality with redundant data.

Effectiveness of HATO:

Configuration	Aligned Attack ASR	Misaligned Attack ASR	Misaligned Attack EER
PATN (Full)	40.11%	-	-
w/ HATO	-	39.43%	40.98%
w/o HATO	-	30.56%	33.24%

HATO improves ASR by nearly 9 percentage points under misaligned attacks, proving its effectiveness in addressing the temporal alignment issue.

Semantic Fidelity Comparison:

Metric	PATN	PrivDiffuser
DTW↓	0.744	7.058
\(\ell_2\)↓	0.162	2.251
LF↓	0.300	3.422
RMSE↓	0.037	0.503

PATN outperforms PrivDiffuser by an order of magnitude across all semantic fidelity metrics. The step detection count only increases by 21 steps (vs. 767 steps for PrivDiffuser).

Key Findings

1. Real-time Feasibility: The model is only 0.365 MB, with a perturbation generation time of 0.00036 seconds, which is significantly faster than the 1/60-second sensor sampling interval.
2. Cross-Architecture Transferability: Perturbations trained in a white-box setting still maintain a 29-37% ASR against black-box MobileNet/Xception/FCN models.
3. Cross-Input-Length Transferability: Perturbations trained with a fixed \(T_{\text{out}} = 10\) remain effective against inference models with \(T_{\text{priv}} \in \{20,30,40,50\}\) (EER 38-43%).
4. Multi-Model Joint Defense: When simultaneously defending against CNN/ResNet/DenseNet architectures, the ASR consistently remains >36%.

Highlights & Insights

• Pioneered the "predictive adversarial perturbation" paradigm: Shifting from "adding noise after seeing the entire sequence" to "predicting future noise based on history", achieving genuine real-time protection.
• Task-Agnostic Design: Not optimized for any specific downstream task, thereby preserving data utility for unseen tasks such as step counting and activity recognition.
• Deployment-Friendly: The model is extremely lightweight (0.365 MB) and can be deployed in a Trusted Execution Environment (TEE). The generation speed far exceeds the data acquisition rate.
• Clever HATO Strategy: By utilizing historical perturbation concatenation, sliding windows, and top-\(k\) selection, the temporal misalignment problem is elegantly resolved.

Limitations & Future Work

1. White-Box Assumption: Training requires access to the gradients of the privacy inference model; although black-box transfer experiments demonstrate efficacy, its performance degrades.
2. Limited Evaluation to Gender and Age: The protection performance for more complex privacy attributes (e.g., identity, health status) has not been evaluated.
3. Fixed Perturbation Amplitude: The \(\ell_\infty\) constraint is preset and is not dynamically adjusted according to sensor usage scenarios.
4. Inference Models Dominated by CNNs: Only CNN-based architectures were tested; emerging temporal models like Transformers have not been evaluated.
5. Lack of User Studies: The impact of perturbations on user experience in actual application scenarios (such as fitness tracking and navigation) has not been evaluated.

Related Work & Insights

• Transforming adversarial attacks from an "attack vector" into a "privacy protection tool" is an interesting paradigm shift.
• Privacy protection in streaming/online scenarios is an important but understudied area.
• The concept of the top-\(k\) strategy within HATO can be borrowed by other adversarial methods that require temporal robustness.
• Future work could incorporate self-supervised learning to reduce dependence on privacy inference model gradients.

Rating

• Novelty: ⭐⭐⭐⭐⭐ (Pioneers predictive adversarial perturbations for sensor privacy protection; both problem definition and solution are highly novel.)
• Experimental Thoroughness: ⭐⭐⭐⭐⭐ (Comprehensive and in-depth, covers main trials, ablations, semantic fidelity, black-box transfer, and multi-model defense.)
• Writing Quality: ⭐⭐⭐⭐ (The problem definition is clear, though some mathematical formulations have dense notation.)
• Value: ⭐⭐⭐⭐ (Addresses practical privacy protection needs for mobile devices with a lightweight, deployable model.)

Related Papers

• [NeurIPS 2025] Factor Decorrelation Enhanced Data Removal from Deep Predictive Models
• [CVPR 2026] RevINN: An End-to-End Invertible Neural Network for Reversible Adversarial Examples Generation
• [CVPR 2026] PrivSynth: Alternating and Control-Based Optimization for Privacy and Utility in Synthetic Data
• [CVPR 2026] Reinforcement-Guided Synthetic Data Generation for Privacy-Sensitive Identity Recognition
• [ICLR 2026] FERD: Fairness-Enhanced Data-Free Adversarial Robustness Distillation