Preserving Privacy in Personalized Models for Distributed Mobile Services

TL;DR

This paper highlights privacy risks in personalized mobile context prediction models and introduces Pelican, a system that reduces privacy leakage while maintaining personalization effectiveness.

Contribution

The paper presents Pelican, a novel privacy-preserving system for personalized mobile models that leverages device and cloud resources to minimize privacy risks.

Findings

Privacy attacks can leak up to 78% of user information.

Pelican reduces privacy leakage by up to 75%.

Personalized models improve service efficacy but pose privacy risks.

Abstract

The ubiquity of mobile devices has led to the proliferation of mobile services that provide personalized and context-aware content to their users. Modern mobile services are distributed between end-devices, such as smartphones, and remote servers that reside in the cloud. Such services thrive on their ability to predict future contexts to pre-fetch content or make context-specific recommendations. An increasingly common method to predict future contexts, such as location, is via machine learning (ML) models. Recent work in context prediction has focused on ML model personalization where a personalized model is learned for each individual user in order to tailor predictions or recommendations to a user's mobile behavior. While the use of personalized models increases efficacy of the mobile service, we argue that it increases privacy risk since a personalized model encodes contextual behavior unique to each user. To demonstrate these privacy risks, we present several attribute inference-based privacy attacks and show that such attacks can leak privacy with up to 78% efficacy for top-3 predictions. We present Pelican, a privacy-preserving personalization system for context-aware mobile services that leverages both device and cloud resources to personalize ML models while minimizing the risk of privacy leakage for users. We evaluate Pelican using real world traces for location-aware mobile services and show that Pelican can substantially reduce privacy leakage by up to 75%.