Privacy-Utility Trades in Crowdsourced Signal Map Obfuscation

TL;DR

This paper explores how to obfuscate cellular signal strength data on user devices to protect privacy while maintaining the utility of signal maps, benchmarking various techniques on real datasets.

Contribution

It introduces a framework for privacy-utility tradeoff analysis in signal map data obfuscation and evaluates multiple obfuscation methods on real-world datasets.

Findings

Obfuscation can effectively balance privacy and utility in signal map data.

Structure-aware obfuscation strategies outperform generic methods.

Average-case guarantees are practical for real-world applications.

Abstract

Cellular providers and data aggregating companies crowdsource celluar signal strength measurements from user devices to generate signal maps, which can be used to improve network performance. Recognizing that this data collection may be at odds with growing awareness of privacy concerns, we consider obfuscating such data before the data leaves the mobile device. The goal is to increase privacy such that it is difficult to recover sensitive features from the obfuscated data (e.g. user ids and user whereabouts), while still allowing network providers to use the data for improving network services (i.e. create accurate signal maps). To examine this privacy-utility tradeoff, we identify privacy and utility metrics and threat models suited to signal strength measurements. We then obfuscate the measurements using several preeminent techniques, spanning differential privacy, generative adversarial privacy, and information-theoretic privacy techniques, in order to benchmark a variety of promising obfuscation approaches and provide guidance to real-world engineers who are tasked to build signal maps that protect privacy without hurting utility. Our evaluation results, based on multiple, diverse, real-world signal map datasets, demonstrate the feasibility of concurrently achieving adequate privacy and utility, with obfuscation strategies which use the structure and intended use of datasets in their design, and target average-case, rather than worst-case, guarantees.