Privacy Vulnerabilities of Wearable Activity Monitors: Threat and Potential Defence

Nowadays, large companies including Fitbit, Garmin, and Apple provide consumers with highly accurate and real-time activity trackers. An individual can simply wear a watch or handheld IoT device to automatically detect and track any movement throughout their day. Using sensor data obtained from Arizona State's Kinesiology department, this study presents the privacy concerns that activity-tracker devices pose due to the extensive amount of user data they obtain. We input unidentified user sensor data from six different recorded activities to an LSTM to show how accurately the model can match the data to the individual who completed it. We show that for three out of the six activities, the model can accurately match 88-92% of the timestep samples to the correct subject that performed them and 60-70% for the remaining three activities studied. Additionally, we present a voting based mechanism that improves the accuracy of sensor data classification to an average of 93%. Replacing the data of the participants with fake data can potentially enhance the privacy and anonymize the identities of those participants. One promising way to generate fake data with high quality data is to use generative adversarial networks (GANs). GANs have gained attention in the research community due to its ability to learn rich data distribution from samples and its outstanding experimental performance as a generative model. However, applying GANs by itself on sensitive data could raise a privacy concern since the density of the learned generative distribution could concentrate on the training data points. This means that GANs can easily remember training samples due to the high model complexity of deep networks. To mitigate the privacy risks, we combine ideas from the literature to implement a differentially private GAN model (HDP-GAN) that is capable of generating private synthetic streaming data before residing at its final destination in the tracker's company cloud. Two experiments were conducted to show that HDP-GAN can have promising results in protecting the individuals who performed the activities.