Paper deep dive
PrivateHub: Contrastive Diffusion Model for Private Sensor-Intensive Environment Data Generation
Jiechao Gao, Yuandong Pan, Jie Wang, Michael Lepech, Bradford Campbell
Intelligence
Status: succeeded | Model: Gemma-4-26B-A4B | Prompt: intel-v1 | Confidence: 90%
Last extracted: 9/4/2026, 2:50:28 AM
Summary
The paper introduces PrivateHub, a framework for generating synthetic multi-sensor data streams that preserve utility for non-private applications while concealing private activities. It utilizes a diffusion model enhanced with contrastive learning, structured in two stages: App-Conditioned Pre-training (ACP) and App-Aware Fine-tuning (AAF). Experiments demonstrate that PrivateHub reduces private-application inference accuracy by 40-50% without degrading non-private performance, addressing cross-sensor privacy risks in IoT environments.
Entities (10)
Relation Signals (9)
PrivateHub → employs → Contrastive Learning
confidence 95% · PrivateHub... uses contrastive learning within a diffusion model
PrivateHub → uses → Diffusion Model
confidence 95% · PrivateHub... uses contrastive learning within a diffusion model to generate synthetic multi-sensor streams
PrivateHub → consistsof → App-Conditioned Pre-training
confidence 92% · Privatehub has two stages: App-Conditioned Pre-training (ACP)... and App-Aware Fine-tuning (AAF)
PrivateHub → consistsof → App-Aware Fine-tuning
confidence 92% · Privatehub has two stages: ... and App-Aware Fine-tuning (AAF)
App-Conditioned Pre-training → uses → DDPM
confidence 90% · ACP trains the diffusion model following the standard procedures... reparameterization trick in DDPM
DDPM → uses → U-Net
confidence 88% · we conduct the diffusion model following the original architecture of DDPM... which uses an enhanced U-net architecture
U-Net → contains → Transformer
confidence 85% · U-net architecture that consists of an encoder, a decoder, and multiple Transformer... blocks.
PrivateHub → evaluatedon → Smart Home
confidence 80% · Experiments on three real-world multi-sensor datasets... smart homes
Cypher Suggestions (0)
No Cypher suggestions yet.
Abstract
Abstract:Sensor-intensive environments enable many intelligent services by inferring user applications from heterogeneous data streams. However, not all applications should be exposed: users want some activities to stay private. This creates a tension between inferring applications for useful services and preventing unwanted inference. Existing approaches such as differential privacy and rule-based filtering protect individual streams but cannot address the privacy risk from cross-sensor inference. We introduce Privatehub, which uses contrastive learning within a diffusion model to generate synthetic multi-sensor streams that keep non-private applications detectable while concealing private ones. Privatehub has two stages: App-Conditioned Pre-training (ACP), which conditions the model on multi-sensor data with application embeddings, and App-Aware Fine-tuning (AAF), which separates private from non-private data via contrastive learning. We also define a threat model for the multi-sensor sharing setting. Experiments on three real-world multi-sensor datasets show Privatehub lowers private-application accuracy by 40 to 50\% without hurting non-private performance, and stays robust when the attacker retrains on the synthetic data.
Tags
Links
- Source: https://arxiv.org/abs/2609.02958v1
- Canonical: https://arxiv.org/abs/2609.02958v1
Trouble viewing inline? Open PDF directly →
Full Text
64,567 characters extracted from source content.
Expand or collapse full text
PrivateHub: Contrastive Diffusion Model for Private Sensor-Intensive Environment Data Generation DOI: X.XXXXXXXConference: The ACM/IEEE International Conference on Embedded Artificial Intelligence and Sensing Systems; [Month Day–Day], 2027; New York, NY, USAPrice: 15.00ISBN: 978-1-4503-X-X/18/06 Jiechao Gao Note: Work done while at the University of Virginia. Affiliation: Stanford University, Stanford, California, USA email: jiechao@stanford.edu , Yuandong Pan Affiliation: Stanford University, Stanford, California, USA email: ydpan@stanford.edu , Jie Wang Affiliation: Stanford University, Stanford, California, USA email: jiewang@stanford.edu , Michael Lepech Affiliation: Stanford University, Stanford, California, USA email: mlepech@stanford.edu and Bradford Campbell Affiliation: University of Virginia, Charlottesville, Virginia, USA email: bradjc@virginia.edu 2027 Abstract. Sensor-intensive environments enable many intelligent services by inferring user applications from heterogeneous data streams. However, not all applications should be exposed: users want some activities to stay private. This creates a tension between inferring applications for useful services and preventing unwanted inference. Existing approaches such as differential privacy and rule-based filtering protect individual streams but cannot address the privacy risk from cross-sensor inference. We introduce PrivateHub, which uses contrastive learning within a diffusion model to generate synthetic multi-sensor streams that keep non-private applications detectable while concealing private ones. PrivateHub has two stages: App-Conditioned Pre-training (ACP), which conditions the model on multi-sensor data with application embeddings, and App-Aware Fine-tuning (AAF), which separates private from non-private data via contrastive learning. We also define a threat model for the multi-sensor sharing setting. Experiments on three real-world multi-sensor datasets show PrivateHub lowers private-application accuracy by 40 to 50% without hurting non-private performance, and stays robust when the attacker retrains on the synthetic data. Keywords: Multi-sensor Activity Privacy, Diffusion Model, Contrastive Learning 1. Introduction Internet of Things (IoT) connects many sensors to enable intelligent applications such as traffic forecasting (Jiang and Luo, 2022), health monitoring (Sujith et al., 2022), and human activity recognition (HAR) (Anguita et al., 2013). This rich sensing also brings sensor-data privacy challenges. Sensor-data privacy is often viewed from the perspective of a single stream: for example, bodily data is treated as sensitive (Sun et al., 2010). However, in sensor-intensive environments, fusing multiple streams can reveal sensitive information even when each individual stream looks benign. In a smart space with thermostats and off-the-shelf Doppler, temperature, and humidity sensors (Wu et al., 2021), the streams can infer many indoor activities. Some are non-private (e.g., standing, sitting), but others are highly private (e.g., Zoom calls). Identifying non-private activities while concealing private ones is a practical and pressing challenge, and it grows more important as deployed sensors multiply. Figure 1. High-level architecture of PrivateHub. Raw multi-sensor data streams are processed locally in a secured environment, and the output synthetic streams can then be safely shared with third-party services. @endList @endList There are three kinds of traditional privacy protection methods for IoT data streams. (1) Rule-based privacy frameworks (Lola et al., 2023; Aljeraisy et al., 2021; Gheisari et al., 2021) govern data handling through policies such as consent, access limits, and encryption. However, they depend on humans to formulate and enforce rules, so they are prone to errors and oversight. More importantly, they treat each stream independently and miss the composite inference risk from sensor fusion, so private activities can still be inferred even when the rules are followed. (2) Differential privacy based frameworks (Husnoo et al., 2021; Gao et al., 2022; Ghayyur et al., 2018) add noise under a privacy budget ϵε (Dwork et al., 2006). This works for a single stream but not for sensor-intensive settings, because adding noise to all streams ignores the connections among sensors and degrades every application, private or not. (3) Generative models for data privacy (Huang et al., 2021; Yao et al., 2023; Yang and Ardakanian, 2023) generate synthetic data that resembles the original without exposing it. However, VAE (Doersch, 2016), GAN (Goodfellow et al., 2020), and conditional GAN (Mirza and Osindero, 2014) suffer from posterior and mode collapse. Diffusion models (Yang et al., 2023a) are more stable and produce higher-quality samples, but generating data conditionally to hide private applications while keeping non-private ones detectable is still beyond current diffusion models. A natural question is whether a simpler strategy could solve this problem without a generative model. For example, one could replay previously recorded non-private segments in place of private ones, or add noise to every sensor stream until private activities become hard to detect. We study both ideas as baselines in Section 5.3.1. Neither works well. Replaying segments breaks the natural timing and the correlations across sensors, so the accuracy of non-private applications drops sharply. Adding noise has to be applied to all streams at once, which also harms useful tasks such as temperature and CO2 prediction, and it only changes the surface of the data, so an attacker can adapt to it by retraining. The real difficulty is therefore not to block inference, but to mislead it selectively: keep non-private activities readable while hiding private ones and keeping the data meaningful. This is what motivates a targeted generative approach. Therefore, protecting application privacy in sensor-intensive environments requires a solution that satisfies three key requirements: (1) Accurate identification of non-private applications; (2) Successfully concealing private applications; (3) the sensor datastreams are meaningful. (e.g., smart thermostats data can still perform temperature prediction.) In this paper, we propose PrivateHub, a synthetic data-stream generation method that uses contrastive learning within a diffusion model to conditionally generate streams that identify non-private applications while concealing private ones. Figure 1 shows its high-level architecture: users feed their multi-sensor streams into the framework in a secure environment, and the output synthetic streams can detect non-private applications but fail to detect the private ones labeled by the data owner. PrivateHub has two stages. App-Conditioned Pre-training (ACP) pre-trains a diffusion model on multi-sensor streams with application category embeddings. App-Aware Fine-tuning (AAF) then uses contrastive learning, with an off-the-shelf classifier extracting features, to push generated data closer to non-private and away from private. We evaluate on real-world datasets from smart homes, a smart office, and an in-the-wild smartphone-and-smartwatch setting, showing that PrivateHub mitigates the sensor-intensive environment privacy challenge while outperforming baselines. 2. Motivation 2.1. Privacy Risks in Sensor-Intensive Environments Data privacy work usually focuses on the confidentiality of single streams and overlooks sensor fusion. Yet even when individual streams look benign, their aggregation can reveal sensitive behavior: private activities become inferable once temperature, audio, motion, and environmental sensors are analyzed together. As sensing becomes ubiquitous, this fusion risk is increasingly important. To show this is a real and prevalent problem, we ran a preliminary study in two office rooms. We placed AWAIR Omni© sensors (Figure 2) that collect indoor environmental quality factors such as CO2CO_2, PM2.5, illuminance, sound pressure level, humidity, and temperature,as shown in Table 1. Five participants each performed four typical office activities: (1) typing, (2) Zoom© calls, (3) writing on a whiteboard, and (4) standing while drinking. The first three are commonly seen as private, while standing while drinking is a benign, health-related activity (Gupta, 2024). Ideally the streams should detect only the benign activity and not the private ones. Since shared sensor data often arrives without labels, we trained a Support Vector Machine (Jakkula, 2006) in a self-training fashion: if its soft labels match the true activities, then sharing unlabeled streams already leaks privacy. Figure 3 shows the confusion matrix, where the soft labels match the true activities with 82% to 87% accuracy. This confirms that activity privacy leakage in multi-sensor environments is real and motivates a protection framework before sharing such streams. @endList @endList Figure 2. Example of sensor data collection. @endList @endList Figure 3. Confusion matrix of our preliminary study. Table 1. Characteristics of sensors used in the preliminary study. Device Sensor Range Error Unit Awair Omni Humidity 0–100 ± 2% % Temperature −40-40–125 ± 2 °C2\, °C\, CO2CO_2 400–5000 ± 75 ppm TVOC 0–60000 ± 10% ppb PM2.5 0–1000 ± 15 µg m−3\, g\,m^-3 SPL 48–90 – dBA 2.2. Beneficial for IoT Data Training among Users For users owning IoT data, the inadequacy of local data often impedes training effective machine learning models, which motivates collaborative learning. Two primary approaches exist. Cloud Computing based Methods (Sunyaev and Sunyaev, 2020; Qian et al., 2009) aggregate raw user data in the cloud, which improves model performance but exposes raw data to centralized servers. Federated Learning based Methods (Gao et al., 2023; Li et al., 2020a) upload only model parameters, yet remain vulnerable to attacks such as model inversion. Stricter safeguards like differential privacy (Husnoo et al., 2021) further degrade model utility by limiting useful training data. In practice, the actual sensitivity of data may not align with conventional perceptions. Environmental factors like temperature and CO2 are typically not sensitive, and many activities inferred from them are benign. The real concern arises when innocuous data points are fused to infer sensitive activities, which discourages users from sharing data. This paper therefore proposes a data generation architecture that safeguards privacy-sensitive activities while keeping meaningful activities identifiable, enabling users to confidently share their data. @endList @endList (a) App-conditioned Pre-training Setup @endList @endList (b) App-aware Fine-tuning Setup Figure 4. Training setups of PrivateHub. (a) the App-conditioned Pre-training stage; (b) the App-aware Fine-tuning stage. 3. Threat Model 3.1. System Model We consider a sensor-intensive environment, such as a smart office or a smart home, where many sensors continuously record data. A data owner, for example an office occupant or a building manager, runs a local IoT hub that collects all of these multi-sensor streams. The data owner wants to share sensor data with one or more third-party services, such as an energy management service or an occupancy analytics provider, so that useful non-private applications keep working. At the same time, the owner does not want to reveal certain activities, which we call private, to those services. PrivateHub runs locally, on the owner’s own device or edge node, before any data leaves the trusted boundary. The raw streams never leave; only the synthetic output of PrivateHub is shared. As a result, the owner’s own services can still run on raw data with full accuracy, while outside parties only ever see synthetic data. 3.2. Adversary Model We treat the adversary as a third-party service that receives the synthetic streams produced by PrivateHub. We consider two levels of attacker. Non-adaptive adversary. The attacker trains a standard activity classifier on the synthetic data it receives and tries to infer private activities. It does not know that the data was generated by a model. This matches our main evaluation in Section 5.3.1. Adaptive adversary. The attacker knows the shared data is synthetic and tries to adapt to it, either by retraining its classifier on the synthetic distribution or by using domain adaptation (Ganin et al., 2016) to close the gap to real data. We study this stronger attacker in Section 5.3.5. We assume the attacker cannot see the raw streams or the internal parameters of PrivateHub, and cannot infer private activities from timing alone, since the timing of shared streams is controlled by the owner. We measure privacy protection directly through the accuracy of the adversary’s classifier on private and non-private activities: lower accuracy on private activities indicates stronger protection, while accuracy on non-private activities close to that of raw data indicates preserved utility. 4. System Design In this section, we illustrate the details of the proposed method. We draw our motivation from the fact that existing methods mainly focus on how to improve the efficiency of activity prediction, where the privacy issue among these methods are largely neglected, expecting effective techniques to discriminate privacy sensitive data and the non-private sensitive ones. Therefore, our method is motivated to leverage the powerful generative ability of diffusion model in discriminating the aforementioned data. Particularly, we propose a general paradigm to optimize the diffusion model in producing App-aware data, along with two stages, namely App-Conditioned pre-training (ACP) and App-Aware fine-tuning (AAF). Figure 4 shows the training setup of our method. Specifically, in Figure 4(a), ACP pre-trains a diffusion model on multi-sensor data datastreams with task category embedding, so that the model is capable of producing app-conditioned data after this stage. In this process, we aim to build a pre-trained diffusion model for multi-sensor data streams generation and use it as a base model for the AAF step. The steps of ACP follow the regular procedure of diffusion model training. We discuss the detailed steps in the following section 4.2. Afterward, AAF enables the diffusion model to discriminate privacy-sensitive from non-sensitive data through contrastive learning. Figure 4(b) shows its setup. Given the pre-trained model from ACP, users feed their multi-sensor streams into the diffusion model to generate synthetic data, and an off-the-shelf activity classifier (a simple CNN here, replaceable by any classifier) labels private and non-private classes. We then design an App-aware Feature Discrimination function (AAFD) that uses contrastive learning on the features of real and generated data to update the diffusion model each iteration, so it produces data more related to non-private and less to private applications. Since some iterations yield low-quality generations, we add a data filtering step so that only sufficiently accurate generations reach AAFD. Details are in Section 4.3. 4.1. Design Fashion of Pre-training and Fine-tuning We adopt the pre-training and fine-tuning fashion for two reasons. (1) Accuracy and Efficiency: pre-trained models learn rich, generalizable representations from large datasets, achieving strong performance with less data and time during fine-tuning. Training end-to-end from scratch is slower and forces the model to handle noise corruption and the contrastive loss at the same time, which hurts accuracy. (2) Flexibility: different users have different privacy standards. For instance, some consider dining private while others do not. Pre-training once and fine-tuning per user lets us quickly generate data tailored to diverse privacy requirements, whereas direct training would restart from scratch for every user demand. 4.2. App-Conditioned Pre-training Since there is no available pre-trained models to support our motivation, the first step is to train a diffusion model with the multi-sensor data streams, i.e., the ACP stage. In doing so, ACP trains the diffusion model following the standard procedures, which consist of the training and sampling processes, where Figure 5 demonstrates the overall pipeline of the ACP stage. @endList @endList Figure 5. The overall pipeline of the App-Conditioned Pre-training (ACP) stage. The output is a task-conditioned diffusion model that reconstructs clean data x^t x_t from noisy input, conditioned on the task category embedding. Training. Given an input data x0x_0, we firstly randomly sample a noise ϵε and a timestep t from the random Gaussian distribution N(0,I)N(0,I) and uniform distribution U(0,T)U(0,T), respectively, where I denotes an identity diagonal matrix and T represents the maximum timestep. Then, we use the sampled ϵε and t to corrupt the input clean data x0x_0 into a series of noisy data, termed as x1,x2,…,xT\x_1,x_2,…,x_T\, where the process q(xt|xt−1)q(x_t|x_t-1) is formulated by: q(xt|xt−1) q(x_t|x_t-1) =N(xt,1−βt⋅xt−1,βt⋅I), =N(x_t; 1- _t· x_t-1, _t· I), (1) q(x1:T|x0) q(x_1:T|x_0) =∏t=1Tq(xt|xt−1), =Π^T_t=1q(x_t|x_t-1), where the aforementioned equations denote the reparameterization trick in DDPM (Jonathan Ho, Ajay Jain, and Pieter Abbeel, 2020). Following Eq. 1, we can sample xtx_t at any timestep t with αt=1−βt _t=1- _t and αt¯=∏i=1tαi _t=Π^t_i=1 _i, where xtx_t is computed through the following equation: xt x_t =q(xt|x0), =q(x_t|x_0), =N(xt,αt¯⋅x0,(1−αt¯)⋅I), =N(x_t; _t· x_0,(1- _t)· I), (2) =αt¯⋅x0+1−α¯t⋅ϵ, = _t· x_0+ 1- α_t·ε, where α¯t α_t is a blending scalar correlated to the noise schedule of DDPM (Jonathan Ho, Ajay Jain, and Pieter Abbeel, 2020). Sampling. The sampling process of diffusion model pθ(x0:T)p_θ(x0:T) starts from a random Gaussian noise xT∼N(0,I)x_T N(0,I), and iteratively de-noises from it into the final clean data x0x_0 conditioned on the task embedding cE_c, where the sampling process is formulated as: pθ(xt−1|xt) p_θ(x_t-1|x_t) =N(xt−1,μθ(xt,t),Σ), =N(x_t-1; _θ(x_t,t), ), (3) pθ(x0:T) p_θ(x_0:T) =p(xT)∏t=1Tpθ(xt−1|xt), =p(x_T)Π^T_t=1p_θ(x_t-1|x_t), Specifically, we use DDIM sampler during the sampling process, where the final clean data x0x_0 is generated through: xt−1 x_t-1 =α¯t−1⋅xt−1−α¯t⋅ϵθ(xt,c,t)α¯t, = α_t-1· x_t- 1- α_t· _θ(x_t,E_c,t) α_t, (4) +1−α¯t−1⋅ϵθ(xt,c,t), + 1- α_t-1· _θ(x_t,E_c,t), 4.2.1. Optimization Objective In training, the usual variational bound on negative log-likelihood is optimized by: [−logpθ(x0)]≤q[−logpθ(x0:T)q(x1:T|x0)] [- p_θ(x_0)] _q [- p_θ(x_0:T)q(x_1:T|x_0) ] = = (5) q[−logp(xT)−∑logpθ(xt−1|xt)q(xt|xt−1)] _q [- p(x_T)-Σ p_θ(x_t-1|x_t)q(x_t|x_t-1) ] =:L, =:L, where L in the equation above is written as: (6) L=q[DKL(q(xtx0)∥p(xT))+∑t≥1DKL(q(xt−1xt,x0)∥pθ(xt−1xt))−logpθ(x0x1)]. L=E_q bmatrixD_KL(q(x_tx_0)\|p(x_T))+\\ _t≥ 1D_KL(q(x_t-1x_t,x_0)\|p_θ(x_t-1x_t))\\ - p_θ(x_0x_1) bmatrix. Herein, KL refers to the Kullback-Leibler divergence. To optimize the diffusion model, we use an embedding layer with a learnable matrix M to project the task category label c into task embedding cE_c, where cE_c then serves as the condition for the diffusion model to de-noise xtx_t. Besides the task category label c, we also incorporate statistical features for each task to enrich the information available about each task. The features include the mean, standard deviation, and Z-score, calculated as (x−μ)/σ(x-μ)/σ, where x is an observed value, μ represents the mean, and σ denotes the standard deviation. Once xtx_t and cE_c are computed, we send xtx_t, cE_c, and t into the diffusion model to predict noise, and minimize the Mean-Squared Error (MSE) distance between the predicted and the random Gaussian noise ϵε, where the loss function L(θ)L(θ) to optimization the model parameters θ of the diffusion model is written as: (7) L(θ)=‖ϵ−ϵθ(xt,t,c)‖2,L(θ)=\|ε- _θ(x_t,t,M_c)\|^2, where we follow DDPM in predicting noise ϵθ(xt,t,c) _θ(x_t,t,M_c) instead of the mean, so as to fit the data distribution. Herein, we conduct the diffusion model following the original architecture of DDPM (Jonathan Ho, Ajay Jain, and Pieter Abbeel, 2020), which uses an enhanced U-net architecture that consists of an encoder, a decoder, and multiple Transformer (Ashish Vaswani, Noam Shazeer, Niki Parmar, Jakob Uszkoreit, Llion Jones, Aidan N. Gomez, Lukasz Kaiser, and Illia Polosukhin, 2017) blocks. Particularly in DDPM, the encoder mainly down-samples the input image into latent representations; the decoder up-samples the latent representations to the original size of image; the Transformer blocks learn the internal correlation between image patches via the self-attention mechanism. In the setting of multi-sensor environment, the U-net firstly encodes the noisy data xtx_t into latent representations, and decodes the representations into predicted noise ϵθ(xt,t,c) _θ(x_t,t,M_c), where the Transformer blocks establish the relationship of data at various sensor time. In this way, we update the model parameters θ of the diffusion model until convergence, where the optimized diffusion model is capable of producing data according to task categories. @endList @endList Figure 6. The overall pipeline of the App-Aware Fine-tuning (AAF) stage. The output of this stage is the fine-tuned diffusion model, which generates synthetic data streams (y) whose features are pulled toward real non-private data (y∗y^*) and pushed away from generated private data (y′y ). 4.3. App-Aware Fine-tuning With the assistance of the ACP stage, the diffusion model is able to produce realistic data according to various tasks. Nevertheless, the intrinsic capabilities of the trained model still fails to discriminate privacy sensitive and non-sensitive data. To improve this, tailored optimization for data discrimination is needed. While Reinforcement Learning with Human Feedback (RLHF) (Bai et al., 2022; Casper et al., 2023) aligns model outputs with preferences, RL algorithms, and especially value-based ones like Q-learning (Watkins and Dayan, 1992), suffer from training instability and high variance, require carefully designed reward functions, demand significant compute, and often generalize poorly to altered tasks or environments. These drawbacks limit their applicability in our resource-constrained, multi-user setting. Thus, we draw another insight from the advancement of contrastive learning, which digs positive and negative samples in a self-supervised manner, and enables the model to generate outputs that are more similar to the positive samples. This technique has illustrated promising performance in a wide series of down-stream tasks in the computer vision community, and shows superior efficiency compared to RLHF without the extra requirements of human feedback. Figure 6 shows the overall pipeline of our AAF stage. To enhance the diffusion model with contrastive learning, we need to consider from two perspectives: (1) the rules of selecting positive and negative samples; (2) the loss function of contrastive learning. In the following texts, we present the details of both aforementioned perspectives. Rules to Select Positive and Negative Samples. Our goal of contrastive learning is to enable the diffusion model to discriminate privacy sensitive and non-sensitive data. Therefore, the rules to select positive and negative samples are straightforward, where we choose the real non-sensitive data as positive sample, and treat generated data with respect to privacy sensitive task categories. In details, given the privacy sensitive task category c′c and non-sensitive one c, we follow the standard process of Eq. 4 and generate the corresponding data with the pre-trained diffusion model, termed as x0x_0 and y′y , respectively. Then, we randomly sample a real non-sensitive data y∗y^* from the multi-sensor datas streams =y1∗,y2∗,…,yND∗D=\y^*_1,y^*_2,…,y^*_N_D\ with the total length of dataset termed as NDN_D. In this way, we leverage y∗y^* and y′y as the positive and negative samples, respectively, where x0x_0 and y′y are then used in later processes of the AAF stage. Data Filtering. Before we compute the loss function with contrastive learning, it is vital to ensure the data quality of x0x_0. Once we optimize the diffusion model with ill-presenting quality of x0x_0, there are possibilities that x0x_0 has closer distance to y′y than y∗y^*, where might lead to inferior optimization during fine-tuning. To solve this problem, we leverage an off-the-shelf activity classifier ℰϕE_φ with its model parameters as ϕφ. We observe that low-quality data would cause ℰϕE_φ to produce inaccurate results, where we set a threshold G to filter the produced low-quality data, where the data filtering process D(x0,G)D(x_0,G) is formulated as: (8) y=D(x0,G)=x0,ℰϕ(x0)>G∅,ℰϕ(x0)≤Gy=D(x_0,G)= \ aligned x_0&, _φ(x_0)>G\\ &, _φ(x_0)≤ G aligned . Afterward, we use the filtered data y to compute the loss function of contrastive learning. If the data filtering process outputs ∅ , we do not compute the loss function of contrastive learning in this training iteration. In our experiment, we use a simple convolutional neural network (CNN) for application classification, which contains four convolutional layers followed by a ReLU activation function with 2 fully connected layers. Choice of G. The threshold G controls the trade-off between filtering strictness and the amount of training signal that survives. A low G lets low-quality generations through and can corrupt the contrastive objective, while a high G rejects too many samples and starves the fine-tuning step. We set G from the classifier confidence distribution on a held-out validation set, choosing a value near the median confidence of correctly classified real samples, which in our data falls in the range [0.6,0.8][0.6,0.8]. All main experiments use G=0.7G=0.7. Section 5.3.5 (Figure 14) sweeps G from 0.50.5 to 0.90.9 and shows that performance is stable within the [0.6,0.8][0.6,0.8] band. Decoupling filtering, training, and evaluation classifiers. To avoid a circular evaluation, the off-the-shelf classifier ℰϕE_φ used for filtering and feature extraction during fine-tuning is independent of the classifiers used to measure privacy protection in Section 5. The evaluation attacker always trains its own classifier from scratch on the synthetic data. Section 5.3.1 further shows that the protection holds across three different classifier architectures (CNN, Transformer, and Random Forest), so the effect is not tied to one specific model. @endList @endList Figure 7. The overall pipeline of the App-Aware Feature Discrimination (AAFD). Herein, the model in gray represents the off-the-shelf activity classifier; “FC” denotes the fully-connected layer, which is normally a single linear projection layer to project the final latent representations into a probability distribution. 4.3.1. App-Aware Feature Discrimination Once y, y′y , and y∗y^* are ready, the final step is to optimize the diffusion model with the contrastive learning, i.e., the App-Aware Feature Discrimination (AAFD) process. Figure 7 shows the overall pipeline of AAFD, where the model in gray represents the off-the-shelf activity classifier. To perform AAFD, we use the activity classifier ℰϕE_φ as a feature extractor, where we leverage the latent representations before the final Fully-Connected (FC) layer as extracted features, and then conduct the contrastive learning by comparing various features of different data, encouraging the diffusion model to generate outputs that are more similar to y∗y^* rather than y′y . Specifically, we firstly input y, y′y , and y∗y^* into ℰϕE_φ, and obtain their corresponding features, termed as F, ′F , and ∗F^*, respectively. Then, we compute the loss function of contrastive learning (termed Lcontrast(θ)L_contrast(θ)) following the standard form of triple loss, which is written as the following equation: (9) Lcontrast(θ)=[‖−∗‖2−‖−′‖2+α],L_contrast(θ)= [\|F-F^*\|^2-\|F-F \|^2+α ], where α represents a hyper-parameter that determines the margin value of the triplet loss. In training, we optimize the diffusion model with the loss function in Eq. 9 until convergence. For further analyses of this stage, the contrastive learning encourages the diffusion model to produce data y that have closer feature distance to the real data y∗y^* rather than y′y , and allow the activity classifier ℰϕE_φ to output more accurate results with the corresponding feature inputs. In this way, we are capable of allowing the diffusion model to producing privacy non-sensitive data, meanwhile maintaining the sample quality in its generated data. 5. Evaluation To evaluate the performance of PrivateHub on generality, practicability and usefulness, we experiment our method on real-world smart home and smart office multi-sensor datasets on the following research questions: • RQ1: How does PrivateHub perform on synthetic data generation? Can the generated data streams from PrivateHub detect non-private applications and conceal private ones? How does it compare against both generative baselines and simple replay and perturbation baselines, and is the protection consistent across different classifier architectures? • RQ2: How does PrivateHub perform if the users switch the selection of the private/non-private applications? Will it influence the overall performance? This is a practical test to see if PrivateHub is robust enough to handle different users. • RQ3: How do the generated data streams perform on their original purposes? (e.g., CO2CO_2 prediction, temperature prediction, etc) • RQ4: How does PrivateHub perform if there are missing application labels? • RQ5: How robust is PrivateHub against an adaptive adversary that knows the data is synthetic and retrains its classifier on the synthetic distribution? And how sensitive is PrivateHub to the filtering threshold G? 5.1. Applications and Datasets We validate PrivateHub on three real-world datasets spanning three sensing scenarios, to show it is not tied to one sensor type or environment. (1) Smart Home (CASAS) (Alam et al., 2023): the CASAS dataset11 1 https://casas.wsu.edu/datasets/ records daily living activities through sequences of sensor states across apartments equipped with motion, temperature, light, water, burner, and door sensors. We keep the pre-processing of (Alam et al., 2023) and use five datasets (Milan, Kyoto1–4) chosen for consistent sensor representation. We streamline the original categories into 11 home-activity categories such as sleep, eat, leave home, enter home, and bath. Each entry is a categorical time series of length 2,000. We label bath and leave home as private. (2) Smart Office (self-collected): the setup from Section 2 (Figure 2), with AWAIR Omni© sensors in two rooms, five participants, and four activities (typing, Zoom calls, whiteboard writing, standing while drinking), where Zoom calls are private. (3) In-the-Wild (ExtraSensory) (Vaizman et al., 2017): collected from 60 users with their own smartphones and smartwatches over about a week each, totaling more than 300,000 labeled minutes. Each minute carries phone and watch motion, location, audio, and ambient measurements with self-reported context labels such as walking, sitting, sleeping, cooking, and shower. Being in the wild, it is noisier and far less balanced than the indoor datasets, and naturally contains missing sensors and labels, which is exactly the situation studied in RQ4. We label shower and sleeping as private. Because it is in the wild, its raw accuracy is lower and variance higher than the indoor datasets. 5.2. Experimental Setup and Evaluation Metrics We implemented our experiments using one NVIDIA RTX 3090 GPU. For the diffusion model settings, the step size of the forward diffusion process is controlled by a variance schedule βt∈(0.0001,0.05) _t∈(0.0001,0.05), where t ranges from 1 to T. The maximum diffusion step is set to be 100. The batch size was 128, and training spanned 200 epochs with early stopping using a patience of 30 epochs to counter overfitting. For the CASAS datasets, since we are under the pre-training and fine-tuning setup, we combine these datasets together for training in a leave-one-out fashion. For example, If we assume "Kyoto4" is a new user, we use “Milan”, “Kyoto1”,“Kyoto2” and “Kyoto3” to perform the pre-training step, then only use "Kyoto4" for fine-tuning and testing. We divided the leave-one-out dataset into fine-tuning training and testing sets using an 80-20 split. For our self-collected smart office dataset, since we collected the multi-sensor data streams on 2 office rooms, we chose to pre-train on one room, and fine-tuning on other room, and we also divided the fine-tuning room datasets into fine-tuning training and testing sets using an 80-20 split. For comparison, since PrivateHub is a synthetic data generation framework, we compare against methods of the same functionality. Most GAN-based models (Hu, 2023; Wang et al., 2018; Yang et al., 2023b) suffer from limited diversity, mode collapse, and unstable convergence, so we select GAN baselines tailored to our setting, plus two simple non-learning baselines: • TimeGAN (Yoon et al., 2019): A GAN known for stable training on time-series data. We replace only the diffusion model with TimeGAN under our pre-training and fine-tuning setup. • Conditional GAN (Mirza and Osindero, 2014): Generates data conditioned on labels. We condition it to conceal private activities by assigning the discriminator a lower score on private activities and a higher score on non-private ones. Since the condition is embedded in training, we use direct training. • Occupancy-GAN (Wu et al., 2021): Uses two application classifiers (C1C_1 and C2C_2) that feed two losses into the generator, optimizing C1C_1 while suppressing C2C_2. Since the condition is embedded in training, we use direct training. • Replay (simple baseline): Replaces each private segment with a randomly sampled real non-private segment, and leaves non-private segments untouched. It requires no learning. • Noise Perturbation (simple baseline): Adds calibrated Gaussian noise to all streams, tuned so that private accuracy matches PrivateHub, to test whether uniform perturbation can reach the same privacy-utility trade-off. The private/non-private labels above follow prior privacy work (presence, hygiene, and meeting content are treated as sensitive (Wu et al., 2021)). Importantly, PrivateHub treats this designation as a user-defined input decoupled from the framework, and RQ2 evaluates what happens when it is switched. For evaluation metrics, we use accuracy for the classification tasks, repeating each experiment 5 times and averaging. We report accuracy on both private and non-private activities: lower private accuracy indicates stronger protection, while non-private accuracy close to raw data indicates preserved utility. Table 2. Performance Metrics Comparison across all datasets. For each dataset, the Non-private row reports accuracy on activities meant to remain detectable, while the private rows (Bath, Leave home, Zoom call, Shower, Sleeping) report accuracy on activities the data owner wants concealed. Lower private accuracy together with higher non-private accuracy indicates better privacy protection. Values are accuracy ± standard deviation over 5 runs. Dataset Activity Acc TimeGAN (Yoon et al., 2019) Conditional GAN (Mirza and Osindero, 2014) Occupancy-GAN (Wu et al., 2021) PrivateHub Raw data Milan Non-private 0.774 ± 0.052 0.653 ± 0.093 0.692 ± 0.032 0.840 ± 0.067 0.84 Bath 0.425 ± 0.045 0.498 ± 0.025 0.512 ± 0.020 0.380 ± 0.019 0.78 Leave home 0.471 ± 0.021 0.495 ± 0.035 0.510 ± 0.022 0.393 ± 0.023 0.83 Kyoto1 Non-private 0.686 ± 0.038 0.622 ± 0.050 0.539 ± 0.046 0.778 ± 0.064 0.80 Bath 0.421 ± 0.043 0.494 ± 0.034 0.502 ± 0.022 0.365 ± 0.016 0.72 Leave home 0.441 ± 0.037 0.492 ± 0.019 0.500 ± 0.015 0.381 ± 0.023 0.81 Kyoto2 Non-private 0.760 ± 0.027 0.635 ± 0.026 0.663 ± 0.019 0.842 ± 0.023 0.83 Bath 0.415 ± 0.039 0.497 ± 0.029 0.510 ± 0.024 0.286 ± 0.068 0.74 Leave home 0.438 ± 0.033 0.490 ± 0.021 0.495 ± 0.016 0.392 ± 0.033 0.87 Kyoto3 Non-private 0.688 ± 0.041 0.612 ± 0.025 0.533 ± 0.039 0.725 ± 0.025 0.84 Bath 0.410 ± 0.045 0.496 ± 0.031 0.507 ± 0.025 0.239 ± 0.097 0.70 Leave home 0.432 ± 0.030 0.487 ± 0.023 0.499 ± 0.017 0.301 ± 0.014 0.78 Kyoto4 Non-private 0.767 ± 0.043 0.627 ± 0.041 0.683 ± 0.034 0.841 ± 0.030 0.83 Bath 0.418 ± 0.042 0.491 ± 0.028 0.508 ± 0.020 0.376 ± 0.055 0.76 Leave home 0.435 ± 0.036 0.484 ± 0.018 0.503 ± 0.014 0.345 ± 0.026 0.80 Smart office Non-private 0.812 ± 0.022 0.721 ± 0.026 0.821 ± 0.031 0.953 ± 0.027 0.95 Zoom call 0.421 ± 0.029 0.545 ± 0.034 0.428 ± 0.037 0.396 ± 0.046 0.93 ExtraSensory Non-private 0.712 ± 0.054 0.598 ± 0.061 0.643 ± 0.049 0.781 ± 0.052 0.79 Shower 0.428 ± 0.051 0.495 ± 0.034 0.509 ± 0.031 0.361 ± 0.038 0.76 Sleeping 0.441 ± 0.045 0.491 ± 0.031 0.503 ± 0.027 0.382 ± 0.040 0.78 5.3. Results 5.3.1. RQ1: Performance of synthetic data generation In this section, we compare how PrivateHub performs against other methods of concealing private activities. Table 2 shows that PrivateHub matches raw-data accuracy on non-private activities while pushing private accuracy below 40%, about 40 to 50% lower than raw. TimeGAN does better than Conditional GAN and Occupancy-GAN on both sides, but its non-private accuracy is well below PrivateHub and its private accuracy is higher, though all methods lower private accuracy relative to raw. The reason is that the pre-training and fine-tuning setup smooths training so the non-private features stay close to the raw distribution, while our AAFD better separates private from non-private activities and drives private accuracy much lower. On the other hand, PrivateHub outperforms TimeGAN. Although we only swap the diffusion model for TimeGAN, the GAN architecture is less suited to this task. Diffusion models generate higher-quality samples through incremental denoising and are more stable to train because of their Markov-chain probabilistic foundations, which avoids the convergence difficulties common to GANs. This produces synthetic data that more closely matches the real distribution. Comparison with simple baselines. A central question is whether a generative framework is really needed, or whether a simpler strategy such as data replay or noise perturbation would do. Figure 8 compares both simple baselines against PrivateHub on the Milan dataset. The Replay baseline does hide private activities well, dropping private accuracy to near random in the 0.24 to 0.26 range, but it pays a steep price. Substituting private segments with unrelated non-private segments breaks the natural timing and the correlations across sensors, so non-private accuracy falls to 0.618, a 26% relative drop from raw. This violates the first requirement, accurate identification of non-private applications. The Noise Perturbation baseline, when tuned to match the private accuracy of PrivateHub at about 0.38, lowers non-private accuracy to 0.641 and, as RQ3 shows, also harms downstream CO2 and temperature prediction, because the noise is applied to every stream at once. In contrast, PrivateHub keeps non-private accuracy at 0.840, matching raw data, while reaching comparable private concealment. The key challenge is therefore not to reduce inference accuracy, but to reduce it selectively while keeping the data useful, which is exactly what the simple baselines cannot do. @endList @endList Figure 8. Comparison against simple baselines (Replay and Noise Perturbation) on the Milan dataset. The simple baselines either fail to preserve non-private utility (Replay) or require indiscriminate degradation (Noise). PrivateHub preserves non-private accuracy while concealing private activities. Generalizability across classifiers. A fair concern is evaluation circularity, where the same classifier used for filtering and feature extraction is also used to measure privacy. To address this, we re-measure the protection using three independent attacker classifiers (CNN, Transformer, and Random Forest), each trained from scratch. As Figure 9 shows, the protection holds across all three, with private accuracy in the 0.37 to 0.39 range and non-private accuracy in the 0.82 to 0.84 range, confirming it comes from the structure of the generated data rather than one particular classifier. @endList @endList Figure 9. Cross-classifier evaluation on Milan. The protection, shown by low private accuracy and high non-private accuracy, holds across three independent attacker classifiers. 5.3.2. RQ2: Performance of synthetic data generation with switched private and non-private activities We compare the robustness of PrivateHub by switching the private and non-private activity labels. By default, we use "bath" and "leave home" as private activities, and the rest we label as non-private. However, different users may have different privacy activities. In this experiment, we switch the labels 3 times and we demonstrate the performance on "Milan" and "Kyoto1" datasets. Private 1 we labeled "cook" and "eat" as private, Private 2 we labeled "personal hygiene" and "eat" as private, Private 3 we kept the "bath" and "leave home" to see the difference. Figure 10 shows the result of the private and non-private switch, which follows the same overall trend as RQ1. For Milan, the GAN baselines fail to generate qualified data under the Private 1 setting, and for Kyoto1 they fail under both Private 1 and Private 2, while PrivateHub succeeds under all three settings. Here, “fail to generate” has a precise meaning tied to our data filtering step. Recall from Section 4.3 that a generated sample is only kept for training if the activity classifier assigns it a confidence above the threshold G (Eq. 8). Under these settings the GAN baselines suffer from mode collapse on the smaller and more imbalanced label sets, so almost none of their generated samples clear G, and there are not enough qualified samples to complete the fine-tuning step. We therefore mark the corresponding bars as failed. This is most visible on Kyoto1, which has very few activity occurrences, so the effect is strongest there. PrivateHub does not run into this problem, because the diffusion model produces more diverse samples and a healthy fraction of them clear G under every setting. In addition, instead of relying on conditional embedding, our contrastive AAFD loss pulls generated samples toward non-private real data and away from generated private data, which helps the model produce more non-private and less private content. @endList @endList Figure 10. Performance comparison when switching private and non-private designations. Left column: non-private accuracy (higher is better). Right column: private accuracy (lower is better). Top row: Milan; bottom row: Kyoto1. Hatched bars mark settings where a method failed to produce enough samples that clear the filtering threshold G. 5.3.3. RQ3: Performance of synthetic data generation with original purpose In this section, we check whether the generated data damages the original purpose of each stream. For our collected data, the AWAIR Omni© sensors monitor indoor environmental quality and support tasks such as CO2CO_2 and temperature prediction, which the generation could harm. Figure 11 shows the result using a simple LSTM (Graves and Graves, 2012). All methods give reasonable predictions, and PrivateHub is closest to raw data. The Noise Perturbation baseline performs worst on these downstream tasks. Because it must add substantial noise to every stream to conceal private activities, it lowers CO2CO_2 prediction accuracy to 0.79 and temperature prediction to 0.83, both well below PrivateHub. This supports the finding from RQ1 that indiscriminate perturbation cannot keep the sensor data meaningful, which is our third requirement, while the targeted generation of PrivateHub can. @endList @endList Figure 11. Downstream prediction on CO2CO_2 and temperature: the Noise Perturbation baseline degrades utility the most, while PrivateHub stays closest to raw data. @endList @endList Figure 12. Missing application labels: accuracy is preserved in most setups, and only Block 5, a label highly correlated with private activities, shows a notable drop. 5.3.4. RQ4: Performance of PrivateHub on missing application labels In reality, it’s very likely that when the user sends the data streams, there will be missing activity labels. However, it’s crucial to understand whether the generated data from PrivateHub with partial activity labels can still be classified. In this experiment (Figure 12), we block 2 activity labels and train PrivateHub with all other labels then test if we can still identify the blocking 2 applications. We tried 5 different setups and compared PrivateHub with the missing label training version. We observe that for most (60%) of the setups, we have no accuracy lost. For 20% of the setups, we have around 2% accuracy drop. For the last setup, we have around a 14.2% accuracy drop. The reason is probably that the blocking label is highly related to private applications. The ExtraSensory dataset offers a more realistic version of this test, since it is collected in the wild and already contains missing labels and missing sensors rather than blocks we remove by hand. When we train PrivateHub on its partially labeled streams, we observe the same overall behavior as in the controlled block experiments: most activities are still identified with little loss, and the larger drops occur only for labels that are closely tied to private activities. This indicates that the robustness of PrivateHub to missing labels is not an artifact of how we construct the controlled blocks, but holds under naturally incomplete data as well. 5.3.5. RQ5: Robustness to Adaptive Adversaries and Threshold Sensitivity Adaptive adversary. The evaluations above assume a non-adaptive adversary that treats the synthetic data as if it were real. A stronger and more realistic threat is an adaptive adversary (Section 3.2) that knows the data is synthetic and retrains its classifier directly on the synthetic distribution to try to recover private activities. Figure 13 compares the private-activity accuracy of all methods under the non-adaptive attacker on the left and the adaptive attacker on the right. Under the adaptive attacker, all methods recover some private-activity accuracy, but by very different amounts. For the GAN baselines, private accuracy rises sharply. TimeGAN on Milan goes from 0.45 to 0.56, an 11 point jump, because its concealment is mostly a surface change to the data that the attacker can re-learn once it adapts to the synthetic distribution. PrivateHub is far more resilient. Its private accuracy on Milan rises only from 0.39 to 0.45, a 6 point jump, and stays well below both the GAN baselines and the raw-data accuracy. The reason is that AAFD does not just perturb the surface of the data. It restructures the data in the feature space of an activity classifier, pulling the representations of private activities toward those of non-private ones. Since the two are entangled rather than merely shifted, retraining on the synthetic distribution cannot easily pull them apart. PrivateHub therefore offers a structurally more robust form of protection than methods that only change the output distribution. @endList @endList Figure 13. Private-activity accuracy under a non-adaptive attacker (left) and an adaptive attacker that retrains on the synthetic distribution (right). Lower is better; the dashed line marks the random-guess baseline. PrivateHub recovers the least under adaptation, which indicates feature-space rather than surface-level protection. Sensitivity to threshold G. We study how the data-filtering threshold G affects the privacy-utility trade-off by sweeping G from 0.5 to 0.9 on Milan (Figure 14). When G is too low (around 0.5), low-quality generations leak into the contrastive objective, which slightly raises private accuracy and lowers non-private accuracy. When G is too high (around 0.9), too many samples are filtered out, which starves the fine-tuning signal and again lowers non-private accuracy. Within the [0.6,0.8][0.6,0.8] band both metrics are stable, supporting the default G=0.7G=0.7, so the method is not brittle to the exact value of G as long as it lies in a reasonable range set by the validation confidence distribution. @endList @endList Figure 14. Sensitivity to the filtering threshold G on Milan. Performance is stable within the shaded [0.6,0.8][0.6,0.8] region, and the default G=0.7G=0.7 is marked. 5.3.6. Ablation Study We remove parts of PrivateHub to see what each stage contributes, using Milan with the default private activities (Table 3). With only App-Conditioned Pre-training, the model generates realistic data but barely hides private activities (private accuracy 0.612). Adding App-Aware Fine-tuning without data filtering lowers private accuracy to 0.451 but lets low-quality samples drag non-private accuracy down to 0.798. Adding data filtering recovers non-private accuracy to 0.840 and pushes private accuracy to 0.387. Fine-tuning thus provides most of the protection, while filtering protects utility. Table 3. Ablation on Milan. AAF provides most of the privacy protection, and data filtering protects non-private utility. Configuration Non-private Acc. ↑ Private Acc. ↓ ACP only 0.831 0.612 ACP + AAF (no filtering) 0.798 0.451 ACP + AAF + filtering (PrivateHub) 0.840 0.387 6. Related Work 6.1. Data Privacy Data privacy has been studied from many angles, mainly through rule-based frameworks (Lola et al., 2023; Aljeraisy et al., 2021; Gheisari et al., 2021) and differential-privacy frameworks (Husnoo et al., 2021; Gao et al., 2022; Ghayyur et al., 2018). For rule-based work, Tamini et al. (Tamani and Ghamri-Doudane, 2016) built a user-centric strategy based on habit anomaly detection, and Lola et al. (Lola et al., 2023) proposed a two-phase scheme where the manufacturer declares data-collection intent and the user declares preferences. These rely on humans to create and enforce rules, are error-prone, and manage streams individually rather than the cross-stream interactions central to our problem. For DP, Gao et al. (Gao et al., 2022) combined federated learning and LDP, but DP is less effective in multi-sensor settings because it ignores the relationships among sensors and degrades all applications regardless of privacy designation. 6.2. Generative Models Generative models are widely used for data augmentation and have strong potential for the multi-sensor privacy challenge. GAN-based methods generate realistic time series: SensoryGANs (Wang et al., 2018) creates synthetic sensor data. TimeGAN (Yoon et al., 2019) and ActivityGAN (Li et al., 2020b) preserve temporal dynamics for HAR. However, GANs suffer from posterior and mode collapse, limiting the diversity of generated data. Diffusion models produce higher-quality streams; for example, NetDiffus (Sivaroopan et al., 2024) targets synthetic network traffic. Yet conditional generation in diffusion models (Batzolis et al., 2021; Zhang et al., 2023) mostly targets images and is not suited to multi-sensor streams. 7. Conclusion Multi-sensor environments enhance daily life, but their sensor fusion introduces application-level privacy risks. We propose PrivateHub, which uses contrastive learning within a diffusion model to generate privacy-preserving synthetic streams via two stages: App-Conditioned Pre-training (ACP) and App-Aware Fine-tuning (AAF). We also define a threat model for the multi-sensor sharing setting. Across three datasets spanning smart homes, a smart office, and an in-the-wild setting, PrivateHub lowers private-application accuracy by 40 to 50% while keeping non-private performance close to raw, outperforms both generative and simple baselines, and stays robust against an adaptive attacker. References Alam et al. (2023) S. Alam, T. Zhang, T. Feng, H. Shen, Z. Cao, D. Zhao, J. Ko, K. Somasundaram, S. S. Narayanan, S. Avestimehr, et al. FedAIoT: a federated learning benchmark for artificial intelligence of things. arXiv preprint arXiv:2310.00109. Cited by: §5.1. Aljeraisy et al. (2021) A. Aljeraisy, M. Barati, O. Rana, and C. Perera Privacy laws and privacy by design schemes for the internet of things: a developer’s perspective. ACM Computing Surveys (Csur) 54 (5), p. 1–38. Cited by: §1, §6.1. Anguita et al. (2013) D. Anguita, A. Ghio, L. Oneto, X. Parra Perez, and J. L. Reyes Ortiz A public domain dataset for human activity recognition using smartphones. In Proceedings of the 21th international European symposium on artificial neural networks, computational intelligence and machine learning, p. 437–442. Cited by: §1. Ashish Vaswani, Noam Shazeer, Niki Parmar, Jakob Uszkoreit, Llion Jones, Aidan N. Gomez, Lukasz Kaiser, and Illia Polosukhin (2017) Ashish Vaswani, Noam Shazeer, Niki Parmar, Jakob Uszkoreit, Llion Jones, Aidan N. Gomez, Lukasz Kaiser, and Illia Polosukhin Attention is All you Need. In NeurIPS, p. 5998–6008. Cited by: §4.2.1. Bai et al. (2022) Y. Bai, A. Jones, K. Ndousse, A. Askell, A. Chen, N. DasSarma, D. Drain, S. Fort, D. Ganguli, T. Henighan, et al. Training a helpful and harmless assistant with reinforcement learning from human feedback. arXiv preprint arXiv:2204.05862. Cited by: §4.3. Batzolis et al. (2021) G. Batzolis, J. Stanczuk, C. Schönlieb, and C. Etmann Conditional image generation with score-based diffusion models. arXiv preprint arXiv:2111.13606. Cited by: §6.2. Casper et al. (2023) S. Casper, X. Davies, C. Shi, T. K. Gilbert, J. Scheurer, J. Rando, R. Freedman, T. Korbak, D. Lindner, P. Freire, et al. Open problems and fundamental limitations of reinforcement learning from human feedback. arXiv preprint arXiv:2307.15217. Cited by: §4.3. Doersch (2016) C. Doersch Tutorial on variational autoencoders. arXiv preprint arXiv:1606.05908. Cited by: §1. Dwork et al. (2006) C. Dwork, K. Kenthapadi, F. McSherry, I. Mironov, and M. Naor Our data, ourselves: privacy via distributed noise generation. In Annual international conference on the theory and applications of cryptographic techniques, p. 486–503. Cited by: §1. Ganin et al. (2016) Y. Ganin, E. Ustinova, H. Ajakan, P. Germain, H. Larochelle, F. Laviolette, M. March, and V. Lempitsky Domain-adversarial training of neural networks. Journal of machine learning research 17 (59), p. 1–35. Cited by: §3.2. Gao et al. (2022) J. Gao, M. Tang, T. Wang, and B. Campbell PFed-ldp: a personalized federated local differential privacy framework for iot sensing data. In Proceedings of the 20th ACM Conference on Embedded Networked Sensor Systems, p. 835–836. Cited by: §1, §6.1, §6.1. Gao et al. (2023) J. Gao, W. Wang, F. Nikseresht, V. Govinda Rajan, and B. Campbell PFDRL: personalized federated deep reinforcement learning for residential energy management. In Proceedings of the 52nd International Conference on Parallel Processing, p. 402–411. Cited by: §2.2. Ghayyur et al. (2018) S. Ghayyur, Y. Chen, R. Yus, A. Machanavajjhala, M. Hay, G. Miklau, and S. Mehrotra Iot-detective: analyzing iot data under differential privacy. In Proceedings of the 2018 International Conference on Management of Data, p. 1725–1728. Cited by: §1, §6.1. Gheisari et al. (2021) M. Gheisari, H. E. Najafabadi, J. A. Alzubi, J. Gao, G. Wang, A. A. Abbasi, and A. Castiglione OBPP: an ontology-based framework for privacy-preserving in iot-based smart city. Future Generation Computer Systems 123, p. 1–13. Cited by: §1, §6.1. Goodfellow et al. (2020) I. Goodfellow, J. Pouget-Abadie, M. Mirza, B. Xu, D. Warde-Farley, S. Ozair, A. Courville, and Y. Bengio Generative adversarial networks. Communications of the ACM 63 (11), p. 139–144. Cited by: §1. Graves and Graves (2012) A. Graves and A. Graves Long short-term memory. Supervised sequence labelling with recurrent neural networks, p. 37–45. Cited by: §5.3.3. Gupta (2024) A. Gupta Find out why drinking water while standing isn’t good for your health. Note: https://w.healthshots.com/preventive-care/self-care/side-effects-of-drinking-water-while-standing/ Cited by: §2.1. Hu (2023) Y. Hu BSDGAN: balancing sensor data generative adversarial networks for human activity recognition. In 2023 International Joint Conference on Neural Networks (IJCNN), p. 1–8. Cited by: §5.2. Huang et al. (2021) C. Huang, S. Chen, Y. Zhang, W. Zhou, J. J. Rodrigues, and V. H. C. de Albuquerque A robust approach for privacy data protection: iot security assurance using generative adversarial imitation learning. IEEE Internet of Things Journal 9 (18), p. 17089–17097. Cited by: §1. Husnoo et al. (2021) M. A. Husnoo, A. Anwar, R. K. Chakrabortty, R. Doss, and M. J. Ryan Differential privacy for iot-enabled critical infrastructure: a comprehensive survey. IEEE Access 9, p. 153276–153304. Cited by: §1, §2.2, §6.1. Jakkula (2006) V. Jakkula Tutorial on support vector machine (svm). School of EECS, Washington State University 37 (2.5), p. 3. Cited by: §2.1. Jiang and Luo (2022) W. Jiang and J. Luo Big data for traffic estimation and prediction: a survey of data and tools. Applied System Innovation 5 (1), p. 23. Cited by: §1. Jonathan Ho, Ajay Jain, and Pieter Abbeel (2020) Jonathan Ho, Ajay Jain, and Pieter Abbeel Denoising Diffusion Probabilistic Models. In NeurIPS, Cited by: §4.2, §4.2, §4.2.1. Li et al. (2020a) L. Li, Y. Fan, M. Tse, and K. Lin A review of applications in federated learning. Computers & Industrial Engineering 149, p. 106854. Cited by: §2.2. Li et al. (2020b) X. Li, J. Luo, and R. Younes ActivityGAN: generative adversarial networks for data augmentation in sensor-based human activity recognition. In Adjunct proceedings of the 2020 ACM international joint conference on pervasive and ubiquitous computing and proceedings of the 2020 ACM international symposium on wearable computers, p. 249–254. Cited by: §6.2. Lola et al. (2023) J. Lola, C. Serrão, and J. Casal Towards transparent and secure iot: improving the security and privacy through a user-centric rules-based system. Electronics 12 (12), p. 2589. Cited by: §1, §6.1, §6.1. Mirza and Osindero (2014) M. Mirza and S. Osindero Conditional generative adversarial nets. arXiv preprint arXiv:1411.1784. Cited by: §1, 2nd item, Table 2. Qian et al. (2009) L. Qian, Z. Luo, Y. Du, and L. Guo Cloud computing: an overview. In Cloud Computing: First International Conference, CloudCom 2009, Beijing, China, December 1-4, 2009. Proceedings 1, p. 626–631. Cited by: §2.2. Sivaroopan et al. (2024) N. Sivaroopan, D. Bandara, C. Madarasingha, G. Jourjon, A. P. Jayasumana, and K. Thilakarathna Netdiffus: network traffic generation by diffusion models through time-series imaging. Computer Networks, p. 110616. Cited by: §6.2. Sujith et al. (2022) A. Sujith, G. S. Sajja, V. Mahalakshmi, S. Nuhmani, and B. Prasanalakshmi Systematic review of smart health monitoring using deep learning and artificial intelligence. Neuroscience Informatics 2 (3), p. 100028. Cited by: §1. Sun et al. (2010) J. Sun, Y. Fang, and X. Zhu Privacy and emergency response in e-healthcare leveraging wireless body sensor networks. IEEE Wireless Communications 17 (1), p. 66–73. Cited by: §1. Sunyaev and Sunyaev (2020) A. Sunyaev and A. Sunyaev Cloud computing. Internet computing: Principles of distributed systems and emerging internet-based technologies, p. 195–236. Cited by: §2.2. Tamani and Ghamri-Doudane (2016) N. Tamani and Y. Ghamri-Doudane Towards a user privacy preservation system for iot environments: a habit-based approach. In 2016 IEEE International Conference on Fuzzy Systems (FUZZ-IEEE), p. 2425–2432. Cited by: §6.1. Vaizman et al. (2017) Y. Vaizman, K. Ellis, and G. Lanckriet Recognizing detailed human context in the wild from smartphones and smartwatches. IEEE Pervasive Computing 16 (4), p. 62–74. Cited by: §5.1. Wang et al. (2018) J. Wang, Y. Chen, Y. Gu, Y. Xiao, and H. Pan Sensorygans: an effective generative adversarial framework for sensor-based human activity recognition. In 2018 International Joint Conference on Neural Networks (IJCNN), p. 1–8. Cited by: §5.2, §6.2. Watkins and Dayan (1992) C. J. Watkins and P. Dayan Q-learning. Machine learning 8, p. 279–292. Cited by: §4.3. Wu et al. (2021) T. Wu, M. Aldeer, T. Chowdhury, A. Haynes, F. Nikseresht, M. P. Varnosfaderani, J. Gao, A. Heydarian, B. Campbell, and J. Ortiz The smart building privacy challenge. In Proceedings of the 8th ACM International Conference on Systems for Energy-Efficient Buildings, Cities, and Transportation, p. 238–239. Cited by: §1, 3rd item, §5.2, Table 2. Yang et al. (2023a) L. Yang, Z. Zhang, Y. Song, S. Hong, R. Xu, Y. Zhao, W. Zhang, B. Cui, and M. Yang Diffusion models: a comprehensive survey of methods and applications. ACM computing surveys 56 (4), p. 1–39. Cited by: §1. Yang and Ardakanian (2023) X. Yang and O. Ardakanian Privacy through diffusion: a white-listing approach to sensor data anonymization. In Proceedings of the 5th Workshop on CPS&IoT Security and Privacy, p. 101–107. Cited by: §1. Yang et al. (2023b) Z. Yang, Y. Li, and G. Zhou Ts-gan: time-series gan for sensor-based health data augmentation. ACM Transactions on Computing for Healthcare 4 (2), p. 1–21. Cited by: §5.2. Yao et al. (2023) W. Yao, H. Zhao, and H. Shi Privacy-preserving collaborative intrusion detection in edge of internet of things: a robust and efficient deep generative learning approach. IEEE Internet of Things Journal. Cited by: §1. Yoon et al. (2019) J. Yoon, D. Jarrett, and M. Van der Schaar Time-series generative adversarial networks. Advances in neural information processing systems 32. Cited by: 1st item, Table 2, §6.2. Zhang et al. (2023) L. Zhang, A. Rao, and M. Agrawala Adding conditional control to text-to-image diffusion models. In Proceedings of the IEEE/CVF International Conference on Computer Vision, p. 3836–3847. Cited by: §6.2.