Differentially Private Integrated Decision Gradients (IDG-DP) for Radar-based Human Activity Recognition

TL;DR

This study investigates privacy vulnerabilities in radar-based Human Activity Recognition (HAR) systems and proposes a novel method for privacy preservation using Differential Privacy (DP) driven by attributions derived with Integrated Decision Gradient (IDG) algorithm.

Abstract

Human motion analysis offers significant potential for healthcare monitoring and early detection of diseases. The advent of radar-based sensing systems has captured the spotlight for they are able to operate without physical contact and they can integrate with pre-existing Wi-Fi networks. They are also seen as less privacy-invasive compared to camera-based systems. However, recent research has shown high accuracy in recognizing subjects or gender from radar gait patterns, raising privacy concerns. This study addresses these issues by investigating privacy vulnerabilities in radar-based Human Activity Recognition (HAR) systems and proposing a novel method for privacy preservation using Differential Privacy (DP) driven by attributions derived with Integrated Decision Gradient (IDG) algorithm. We investigate Black-box Membership Inference Attack (MIA) Models in HAR settings across various levels of attacker-accessible information. We extensively evaluated the effectiveness of the proposed IDG-DP method by designing a CNN-based HAR model and rigorously assessing its resilience against MIAs. Experimental results demonstrate the potential of IDG-DP in mitigating privacy attacks while maintaining utility across all settings, particularly excelling against label-only and shadow model black-box MIA attacks. This work represents a crucial step towards balancing the need for effective radar-based HAR with robust privacy protection in healthcare environments.

Figures (21)

• Figure 1: Investigated Threat Models
• Figure 2: Micro-Doppler spectrograms of a person performing 3 different activities. Unique movement patterns visible in micro-Doppler spectrograms enable both activity and subject recognition.
• Figure 3: Impact of Different Activity Attribution Thresholds and $\epsilon$ Levels on a 10-Subject HAR Model. (a) average accuracy of HAR across $\epsilon$ values while the attribution threshold varies, (b) Accuracy of HAR across $\epsilon$ values demonstrates the utility-privacy trade-off of the proposed method, (c) Distribution of pixel attributions derived from IDG.
• Figure 4: Models performance comparison against Label-Only MIA: a) Label Only MIA, attack training size = 25, attack test size = 25, evaluation size = 25, $epsilon = 1.20$ attribution threshold = 0.00025 For Base-DP IG-DP, Sal-DP, IIG-DP, ISG-DP and IDG-DP. noise mask for Optics = 0.50, b) Label Only MIA, attack training size = 40, attack test size = 30, evaluation size = 20, $epsilon = 1.20$ attribution threshold = 0.00025 For IG-DP, Sal-DP, IIG-DP, ISG-DP and IDG-DP. noise mask for Optics = 0.50
• Figure 5: Multi-Task Network Architecture Summary.