PrivateHub: Contrastive Diffusion Model for Private Sensor-Intensive Environment Data Generation

Jiechao Gao; Yuandong Pan; Jie Wang; Michael Lepech; Bradford Campbell

cs.CRSep 2, 2026

PrivateHub: Contrastive Diffusion Model for Private Sensor-Intensive Environment Data Generation

Authors: Jiechao Gao, Yuandong Pan, Jie Wang, Michael Lepech, Bradford Campbell

Organizations: Stanford University Stanford, California, USA · University of Virginia · University of Virginia Charlottesville, Virginia, USA

Abstract

Sensor-intensive environments enable many intelligent services by inferring user applications from heterogeneous data streams. However, not all applications should be exposed: users want some activities to stay private. This creates a tension between inferring applications for useful services and preventing unwanted inference. Existing approaches such as differential privacy and rule-based filtering protect individual streams but cannot address the privacy risk from cross-sensor inference. We introduce Privatehub, which uses contrastive learning within a diffusion model to generate synthetic multi-sensor streams that keep non-private applications detectable while concealing private ones. Privatehub has two stages: App-Conditioned Pre-training (ACP), which conditions the model on multi-sensor data with application embeddings, and App-Aware Fine-tuning (AAF), which separates private from non-private data via contrastive learning. We also define a threat model for the multi-sensor sharing setting. Experiments on three real-world multi-sensor datasets show Privatehub lowers private-application accuracy by 40 to 50% without hurting non-private performance, and stays robust when the attacker retrains on the synthetic data.

Figures & tables

Figure 1. High-level architecture of PrivateHub . Raw multi-sensor data streams are processed locally in a secured environment, and the output synthetic streams can then be safely shared with third-party services.

Figure 2. Example of sensor data collection.

Figure 3. Confusion matrix of our preliminary study.

Device	Sensor	Range	Error	Unit
Awair Omni	Humidity	0–100	$\pm$ 2%	%
	Temperature	$-40$ –125	$\pm$ $2\text{\,}\mathrm{\SIUnitSymbolCelsius}$	$\text{\,}\mathrm{\SIUnitSymbolCelsius}$
	$\mathrm{CO}_{2}$	400–5000	$\pm$ 75	ppm
	TVOC	0–60000	$\pm$ 10%	ppb
	PM2.5	0–1000	$\pm$ 15	$\text{\,}\mathrm{\SIUnitSymbolMicro g}\text{\,}{\mathrm{m}}^{-3}$
	SPL	48–90	–	dBA

Table 1. Characteristics of sensors used in the preliminary study.

Panel of Figure 4 — Figure 4. Training setups of PrivateHub . (a) the App-conditioned Pre-training stage; (b) the App-aware Fine-tuning stage.

Figure 5. The overall pipeline of the App-Conditioned Pre-training (ACP) stage. The output is a task-conditioned diffusion model that reconstructs clean data $\hat{x}_{t}$ from noisy input, conditioned on the task category embedding.

Figure 6. The overall pipeline of the App-Aware Fine-tuning (AAF) stage. The output of this stage is the fine-tuned diffusion model, which generates synthetic data streams ( $y$ ) whose features are pulled toward real non-private data ( $y^{*}$ ) and pushed away from generated private data ( $y^{\prime}$ ).

Figure 7. The overall pipeline of the App-Aware Feature Discrimination (AAFD). Herein, the model in gray represents the off-the-shelf activity classifier; “FC” denotes the fully-connected layer, which is normally a single linear projection layer to project the final latent representations into a probability distribution.

Dataset	Activity Acc	TimeGAN ( Yoon et al., 2019 )	Conditional GAN ( Mirza and Osindero, 2014 )	Occupancy-GAN ( Wu et al., 2021 )	PrivateHub	Raw data
Milan	Non-private	0.774 $\pm$ 0.052	0.653 $\pm$ 0.093	0.692 $\pm$ 0.032	0.840 $\pm$ 0.067	0.84
	Bath	0.425 $\pm$ 0.045	0.498 $\pm$ 0.025	0.512 $\pm$ 0.020	0.380 $\pm$ 0.019	0.78
	Leave home	0.471 $\pm$ 0.021	0.495 $\pm$ 0.035	0.510 $\pm$ 0.022	0.393 $\pm$ 0.023	0.83
Kyoto1	Non-private	0.686 $\pm$ 0.038	0.622 $\pm$ 0.050	0.539 $\pm$ 0.046	0.778 $\pm$ 0.064	0.80
	Bath	0.421 $\pm$ 0.043	0.494 $\pm$ 0.034	0.502 $\pm$ 0.022	0.365 $\pm$ 0.016	0.72
	Leave home	0.441 $\pm$ 0.037	0.492 $\pm$ 0.019	0.500 $\pm$ 0.015	0.381 $\pm$ 0.023	0.81

Table 2. Performance Metrics Comparison across all datasets. For each dataset, the Non-private row reports accuracy on activities meant to remain detectable, while the private rows (Bath, Leave home, Zoom call, Shower, Sleeping) report accuracy on activities the data owner wants concealed. Lower private accuracy together with higher non-private accuracy indicates better privacy protection. Values are accuracy

\pm

standard deviation over 5 runs.

Figure 8. Comparison against simple baselines (Replay and Noise Perturbation) on the Milan dataset. The simple baselines either fail to preserve non-private utility (Replay) or require indiscriminate degradation (Noise). PrivateHub preserves non-private accuracy while concealing private activities.

Figure 9. Cross-classifier evaluation on Milan. The protection, shown by low private accuracy and high non-private accuracy, holds across three independent attacker classifiers.

Figure 10. Performance comparison when switching private and non-private designations. Left column: non-private accuracy (higher is better). Right column: private accuracy (lower is better). Top row: Milan; bottom row: Kyoto1. Hatched bars mark settings where a method failed to produce enough samples that clear the filtering threshold

G

Figure 11. Downstream prediction on

\mathrm{CO}_{2}

and temperature: the Noise Perturbation baseline degrades utility the most, while PrivateHub stays closest to raw data.

Figure 12. Missing application labels: accuracy is preserved in most setups, and only Block 5, a label highly correlated with private activities, shows a notable drop.

Figure 13. Private-activity accuracy under a non-adaptive attacker (left) and an adaptive attacker that retrains on the synthetic distribution (right). Lower is better; the dashed line marks the random-guess baseline. PrivateHub recovers the least under adaptation, which indicates feature-space rather than surface-level protection.

Figure 14. Sensitivity to the filtering threshold

G

on Milan. Performance is stable within the shaded

[0.6,0.8]

region, and the default

G=0.7

is marked.

Configuration	Non-private Acc. $\uparrow$	Private Acc. $\downarrow$
ACP only	0.831	0.612
ACP + AAF (no filtering)	0.798	0.451
ACP + AAF + filtering ( PrivateHub )	0.840	0.387

Table 3. Ablation on Milan. AAF provides most of the privacy protection, and data filtering protects non-private utility.

Privacy-Preserving ML

Privacy-preserving machine learning develops methods to learn, share, and run models while limiting exposure of sensitive data.

See all 433 papers

Differentially Private Synthetic Data via APIs 3: Using Simulators Instead of Foundation Model
Feb 8, 2025Zinan Lin, Tadas Baltrusaitis, Wenyu Wang +1Differentially Private Synthetic Data Generation Synthetic Data Generation
Microsoft Research Redmond, WA, USA · Microsoft Cambridge, UK · Redmond, WA, USA
Protecting Sensitive Data in Image Synthesis via PAC-Private Adaptation for Diffusion Models
Oct 2, 2026Boming Miao, Tao Zhang, Netanel Raviv +3Privacy-Preserving ML Diffusion-Based Image Generation
Department of Computer Science and Engineering, Washington University in St. Louis
diffGHOST: Diffusion based Generative Hedged Oblivious Synthetic Trajectories
May 11, 2026Florent Guépin, Cheick Tidiani Cisse, Denis Renaud +2Trajectory Generation Synthetic Data Generation
Orange Research, Belfort, France · Orange Business, Belfort, France

Feb 8, 2025J/K move · Enter open · S save

Differentially Private Synthetic Data via APIs 3: Using Simulators Instead of Foundation Model

Zinan Lin, Tadas Baltrusaitis, Wenyu Wang, Sergey Yekhanin

Microsoft Research Redmond, WA, USA · Microsoft Cambridge, UK · Redmond, WA, USA

Differentially Private Synthetic Data Generation Synthetic Data Generation Privacy-Preserving ML Differential Privacy

Open paper AskPDF arXiv

Differentially private (DP) synthetic data enables the use of sensitive datasets while providing strong privacy guarantees. Recently, Private Evolution (PE) has emerged as a promising framework for generating DP synthetic data using only inference APIs of foundation models. However, suitable foundation models are not always available for every private data domain. In this paper, we show that PE is more general than previously understood and can incorporate APIs beyond foundation models. In particular, we show that state-of-the-art non-neural-network data synthesizers, including computer graphics-based image generators and physics simulation tools (which we refer to as simulators), integrate naturally into PE. We call the resulting method Sim-PE. Sim-PE broadens the applicability of PE while improving performance. For image synthesis, Sim-PE improves downstream classification accuracy by up to 3x, reduces FID by up to 80%, and is significantly more efficient. We further show that simulators and foundation models can be seamlessly combined within Sim-PE for additional gains. Beyond performance improvements, Sim-PE enables new DP applications that are difficult or impossible for existing methods, including generating DP control signals whose execution reproduces the distribution of private observations. The code is open-sourced in the Private Evolution Python library: https://github.com/microsoft/DPSDA

Abstract

Privacy-Preserving ML

Explore similar work

Differentially Private Synthetic Data via APIs 3: Using Simulators Instead of Foundation Model

Protecting Sensitive Data in Image Synthesis via PAC-Private Adaptation for Diffusion Models

diffGHOST: Diffusion based Generative Hedged Oblivious Synthetic Trajectories