Sensor deployments in industrial IoT environments have enabled real-time monitoring and optimization of manufacturing processes. Xu et al. [18] proposed a hierarchical resource allocation algorithm that takes into account safety, privacy, and reliability constraints, thereby enhancing efficiency across industrial operations. In the context of smart cities, Talebkhah et al. [19] reported ongoing projects that utilize sensor networks for traffic control, environmental surveillance, and disaster management. These initiatives highlight the transformative potential of large-scale sensor deployments in urban planning and sustainability.

Wearable technologies are also finding widespread adoption in sports science and consumer fitness. Lam Po Tang [4] demonstrated how wearable sensors collecting heart rate and posture data can be harnessed to refine training regimens and speed recovery. Meanwhile, newly developed smart garments and textiles are emerging to measure physiological signals in everyday settings. In healthcare, sensor-based HAR has proven beneficial for patient care and clinical efficiency. Lee et al. [20] introduced a lifelogging system employing three-axis accelerometers and combined statistical and spectral features to achieve high-accuracy HAR for daily-life analysis. Similarly, Xu et al. [21] exploited random forest classifiers augmented with contextual information to recognize activities among seniors. Inoue et al. [22] developed a system for analyzing nursing workflows, aiming to improve operational efficiencies in clinical environments. Sensor technologies have likewise progressed across a broad spectrum, encompassing systems for pain monitoring and mitigation [3] as well as implantable in-vivo sensors [2]. While these studies underscore the utility of sensor data, they also underline the growing importance of privacy protection to secure personal information against misuse.

HAR encompasses a range of techniques aimed at classifying sensor signals into specific behavioral categories. Traditional HAR approaches predominantly employed handcrafted statistical or spectral features, which were then input into machine learning algorithms. Kwapisz et al. [23] used smartphone accelerometers to identify walking and stair-climbing behaviors, demonstrating how fundamental statistical features can boost model accuracy. By contrast, Shoaib et al. [24] combined data from smartphones and wristbands to handle more complex activities and highlighted the value of sensor diversity. Voicu et al. [25] integrated readings from accelerometers, gyroscopes, and gravity sensors, showcasing the feasibility of accurate activity classification solely using commercial smartphones. There are also cases where accelerometers have been applied to enhance the security of voice authentication [26].

In more recent developments, deep learning models, particularly convolutional neural networks and recurrent neural networks, have been adopted in an end-to-end manner. Li et al. [27] found that deep neural networks outperform methods reliant on hand-crafted features when analyzing wearable sensor data. DenseNet-inspired architectures have also been proposed to capture spatiotemporal dependencies effectively, as exemplified by Ronald et al. [28] in their HARDenseNet. Ronald et al. [29] integrated ResNet and Inception modules to develop iSPLInception, achieving high accuracy in HAR tasks. In recent years, efforts to leverage Transformer architectures for human activity recognition have also become widespread [30–32]. While deep learning has propelled the performance of HAR systems, it has also amplified privacy concerns, because large-scale sensor data collection can reveal sensitive personal details.

In the field of sensor data anonymization for HAR, several comprehensive surveys have been conducted [33,34]. Based on these surveys, existing algorithm-based anonymization methods can be broadly classified into three categories: (a) Statistical Anonymization, (b) Generation-based Anonymization, and (c) Reconstruction-based Anonymization.

This section clarifies the positioning of the proposed methods relative to existing anonymization approaches. Table 1 compares six representative methods using seven columns, each reflecting a key property of sensor-data anonymization techniques.

This section presents the overall privacy-preserving scenario assumed in this study, along with the requirements that must be satisfied in this context. As illustrated in Fig. 2, the system adopts a server–client architecture for collecting and utilizing sensor data obtained from smartphones and wearable devices. The scenario consists of the following four elements:

User devices

Users employ smartphones or wearable devices to measure the sensor data, attaching the corresponding activity labels before transmitting the data to the application server. Rather than sending the raw sensor data directly, the user devices perform anonymization locally. In doing so, any information enabling personal identification is blocked at the source, preventing raw data from ever reaching the server.

Application server

The application server aggregates and manages the anonymized data and activity labels from multiple user devices, offering services such as lifelogging or other sensor-driven applications. In addition, the server may provide the collected anonymized data to approved third parties for further utilization—e.g., activity analysis or the training of activity-recognition models. However, since no personally identifying information is transmitted, the risk of linking data to specific individuals on the server side is minimized.

Data consumers

After receiving anonymized data from the server, data consumers perform various tasks such as activity classification or in-depth behavioral analysis. Additional use cases are anticipated through transfer learning or self-supervised approaches, wherein the anonymized data may be repurposed for tasks beyond basic activity recognition.

Attacker

It is assumed that potential adversaries may attempt to illegally acquire data from the server via methods such as malware, man-in-the-middle (MitM) attacks, or phishing. Particularly problematic is the case where attackers hold a pre-trained person-identification model based on previously leaked raw data. Even if the data on the server are anonymized, the attacker could re-identify individuals if the anonymization is insufficient. This research therefore aims to degrade identification accuracy significantly through on-device anonymization.

Under the conditions of this scenario, attackers may possess the following types of information, which can lead to different privacy risks:

(a) Application server login credentials

By impersonating legitimate users or administrators, attackers can access the anonymized data and associated activity labels on the server. However, since direct personal identifiers are absent, re-identification risk remains low unless the attacker can cross-reference external sources of raw sensor data.

(b) Personal identification model + (a)

In addition to (a), by using a person-identification model trained on previously leaked raw sensor data, there is a risk that an attacker can link the sensor data in the server to specific individuals if the anonymization is insufficient. This enables them to correlate behaviors with identified users.

(c) Raw sensor data + personal ID + (a)

If the attacker already has direct access to users’ sensor data and personal IDs from some other breach, they can build or refine a personal identification model and pose essentially the same threat as in case (b). In addition, if the anonymization method has also leaked, they can reproduce the anonymized sensor data and build the user identification model supporting anonymized sensor data.

Generally, anonymization in data handling is expected to address the following five points: (1)

Removal or masking of personally identifying information

In the scenario of this study, requirement (1) is already addressed on the user device side by design, and (4) and (5) fall under policy or operational guidelines. Hence, for sensor data anonymization, the primary concerns are (2) reducing re-identification risk and (3) preserving data utility.

Past research has proposed many anonymization methods that obscure personally identifying information while retaining features vital for tasks such as activity classification [12]. However, when the transformed data deviate substantially from the original waveform, important information for secondary use cases may be lost. For instance, if only the “activity label” is retained, the raw waveform’s additional characteristics, potentially valuable for other analyses, become inaccessible. Therefore, the objective is to degrade certain specific aspects of the data (namely person-identification signals) while still preserving as much of the original data characteristics as possible. On the other hand, it should be noted that these are trade-offs.

Based on the above considerations, three requirements emerge for anonymization in the scenario of this study:

Transform the data such that a person-identification model trained on real (raw) data can only achieve chance-level accuracy when applied to the anonymized data.

By satisfying these requirements, even attackers armed with person-identification models built from leaked raw data will be significantly hampered in re-identifying individuals. Meanwhile, data consumers can still utilize the anonymized data for activity recognition and new downstream applications, thus helping to reduce user reluctance to share sensor data in an era of heightened privacy awareness.

An anonymization scheme must balance privacy protection (i.e., lowering person identification accuracy) with data utility (i.e., retaining essential information). Although increasing waveform distortion can enhance anonymization, it risks destroying the inherent features of the data. AP, on the other hand, can significantly disrupt a classifier’s inference while introducing only a minimal visible change to the data. Inspired by AP methods developed in the image domain, the technique is adapted to sensor data in order to preserve the original waveforms as much as possible while drastically reducing person-identification accuracy, and this variant is referred to as AAP.

Fig. 3 illustrates the flow of AAP. The method employs IFGSM [49], which iteratively applies the AP by FGSM [52]. In advance, a person-identification model (Mid) is trained on the raw data (with parameters θid). At anonymization time, the loss gradient ∇X with respect to the input sensor data X and the person label yid is computed and incrementally added t times to produce the anonymized data Xt. Eq. (1) shows an example transformation step at iteration t. (1)Xt=Xt−1+αsign(∇XJθid(Xt−1,yid)).

Here, Xt is the anonymized data at the t-th iteration, and Jθid(⋅) is the loss function of the person-identification model. The final magnitude of waveform change depends on parameters α and the number of iterations t. In this context, α denotes the step size added at each iteration. Unlike prior adversarial-attack studies, this work does not impose an explicit Lp budget. Instead, the step size α is selected via grid search so that the person identification F1 scores drop to chance level. Unlike autoencoder-based methods (e.g., AAE), AAP does not reconstruct the original waveform, only minor perturbations are added. This property allows the scheme to degrade classification accuracy using small noise while offering a means to fine-tune the degree of anonymization at deployment by adjusting these parameters.

While AAE encodes waveforms into latent variables and then reconstructs them, often yielding a significant gap between original and reconstructed data, AAP only adds minimal noise to reduce identification accuracy. Consequently, one may expect that additional information (e.g., frequency characteristics) remains more readily preserved under AAP. Subsequent experimental evaluations (see Section 5) demonstrate that AAP offers broader data utility than AAE.

AAP focuses on classification models in the time domain. However, if an attacker trains a person-identification model in the frequency domain, standard AAP might fail to anonymize effectively. Since sensor data (e.g., accelerometry or biosignals) often contain unique frequency components tied to individual users, restricting anonymization efforts solely to the time domain can be insufficient.

F-AAP is introduced, which concurrently derives gradients from both time-domain and frequency-domain models to guide perturbations so that person-identification becomes difficult in both domains. As depicted in the left of Fig. 4, the sensor data X(T) are transformed into the frequency domain X(F) via STFT, and then combine the time-domain and frequency-domain losses. Eq. (2) shows that the gradients ∇X(T)Jθ(T,id) and ∇X(F)Jθ(F,id) are used, subsequently mapping back via ISTFT and aggregating the signs. (2)Xt=Xt−1+α∑d∈{T,F}δd⋅sign(∇XJθid(d)(Xt−1(d),yid)).

Here, d=T denotes the time domain, and d=F denotes the frequency domain; setting δT=1, δF=1 leverages both gradients, whereas setting one of them to 0 reverts to standard AAP or a single-domain approach. By integrating these two domains, F-AAP hinders attacker-driven identification whether in the time or frequency domain, while still preserving essential information in the data.

Finally, beyond neutralizing person-identification models in the time and frequency domains, certain use cases may demand preservation of other tasks’ accuracy (e.g., activity recognition, gender inference, or device-position estimation). For instance, a user may wish to obfuscate personal identity but keep activity recognition or gender prediction operational on the device.

To address such needs, F-AAP is extended to MF-AAP, which simultaneously handles “tasks that require accuracy preservation” (e.g., activity, gender, or position) and “tasks whose accuracy should be reduced” (i.e., person identification). As illustrated on the right of Fig. 4 and formalized in Eq. (3), each task is assigned a weight σtask∈{+1,0,−1}, for example, σid=+1 (intentionally lowering person-identification accuracy) and σact=−1 (preserving or boosting the target task). Gradients are summed after applying these weights to produce a single perturbation that simultaneously degrades person identification while retaining accuracy for other tasks.

(3)Xt=Xt−1+α∑d∈{T,F}δd⋅sign(∑task∈{id,act,…}σtask⋅∇XJθtask(d)(Xt−1(d),ytask)).

Hence, MF-AAP can preserve the performance of tasks like activity classification while deliberately reducing only person-identification accuracy. Because one can set σtask for each task independently, users can flexibly choose which information to protect and which to retain allowing them to tailor the anonymization to different deployment scenarios.

Next, anonymization performance in the frequency domain is discussed. To the best of current knowledge, existing anonymization studies for activity recognition have not considered scenarios in which an attacker converts sensor waveforms into the frequency domain to conduct person-identification attacks. Thus, the present study investigates person-identification accuracy and activity-recognition accuracy when time-series sensor waveforms are transformed into the frequency domain using STFT.

The experimental results are presented in Table 4. Experimental conditions are identical to those described in the previous section, except that the attacker’s model targets frequency-domain data, requiring preprocessing to convert time-series sensor waveforms into the frequency domain before inputting them into the model. Examining the person-identification accuracy, it is observed that performance for all methods remains around the chance level. However, because AAP considers only the time domain, achieving anonymization below the chance level requires significantly increasing the perturbation magnitude parameter α. Consequently, although the performance of AAP remains superior to AAE, accuracy in activity recognition and other estimation tasks decreases compared to the results shown in Table 2. In contrast, F-AAP, which explicitly accounts for the frequency domain, maintains strong anonymization performance even with smaller α values, thus effectively preserving accuracy in activity recognition and other tasks. Nevertheless, it was also found that the effectiveness of F-AAP diminishes when the model architecture changes, such as in the case of ResNet10.

These observations indicate that F-AAP effectively maintains anonymization performance against person-identification attacks in the frequency domain while mitigating adverse impacts on the accuracy of activity recognition and other tasks. However, robustness to differences in model architecture remains a challenge that should be addressed in future work.

The previously evaluated methods, AAP and F-AAP, require only the person labels during anonymization. Although these methods are easy to implement, their capability for information retention is limited. In contrast, the proposed method, MF-AAP, requires additional labels (e.g., activity, gender, etc.) in anonymization. However, this requirement enables selective control over information retention or suppression. Thus, this experiment investigates the effects of introducing perturbations designed to suppress person-identification performance while simultaneously enhancing the recognition performance of other attributes.

The results of this investigation are presented under the MF-AAP columns in Tables 2 and 4. Regardless of the model architecture or the target domain, the performance of person identification could be consistently suppressed below the chance level through adjustments of the parameter α. Furthermore, examination of activity recognition and other estimation accuracies shows performance improvements across all conditions. Notably, this improvement is particularly prominent for VGG10, which is the anonymization model itself, where most attributes achieved recognition accuracies exceeding 90%. Therefore, the results clearly demonstrate that MF-AAP can intentionally control both the enhancement and suppression of classification performance.

This phenomenon can be interpreted as embedding label information into the original data. AAP and F-AAP achieve anonymization by estimating person labels from input data and adding perturbations in the opposite direction of the gradient calculated with respect to those inputs. Although activity recognition and other labels are not explicitly utilized in the anonymization process, information retention is pursued by minimizing the perturbation magnitude. Conversely, MF-AAP employs multiple labels during anonymization and introduces perturbations using both forward and inverse gradients. Adding forward gradients to the input introduces slight perturbations that improve classification performance, effectively embedding label-specific features into the original data.

As a key feature of AAP, the intensity of the perturbation (α) can be adjusted to control the degree of anonymization (Int. adj.). In the experiments thus far, α is tuned so that person identification performance is forced to fall below the chance level. This section investigates how increasing or decreasing α affects overall performance. The following score is introduced as a new metric: (4)S=saap−csraw−c

Here, S is calculated for each estimation target (Person, Activity, and others) based on its chance rate c, representing the relative ratio to the score sraw achieved using raw data as the upper bound. Because a higher value is more desirable, Sperson′=1.0−Sperson is defined only for the person-identification task. Finally, each score is clamped between 0.0 and 1.0.

Fig. 6 presents how the scores of each method change with different α values. For comparison, AAE is also plotted; however, because AAE does not allow adjusting the anonymization level after training, its value remains constant. Since the model architecture used here is ResNet10, these results illustrate the case where the evaluation model (ResNet10) differs from the model architecture employed in the anonymization (VGG10). From the figure, it is evident that, while AAE serves as a baseline with strong anonymization performance, it substantially degrades the estimation accuracy for Activity and Other, indicating significant information loss. In contrast, the proposed methods show that by setting α in the range of approximately 0.2–0.7, one can achieve comparable anonymization performance to AAE while still preserving performance on the other tasks.

When comparing the characteristics among the methods, AAP, F-AAP, and MF-AAP respond to changes in α in descending order of sensitivity. For instance, in the Motion Sense dataset, person identification accuracy saturates around α=0.07 for AAP, α=0.13 for F-AAP, and α=0.16 for MF-AAP. In each case, the anonymization performance is comparable to that of AAE, and in many instances, even when α is further increased, these methods still retain more information than AAE.

Based on the preceding results, interdependencies among the subtasks are examined. First, the F1 scores obtained with Raw and AAP inputs in Table 4 are compared. Relevant rows are extracted and reorganized in Table 5, which lists the absolute drop ΔF1 and the relative reduction RR=ΔF1/F1,Raw. In the Motion Sense dataset, Activity suffers a substantial decrease of 62.6%, whereas Gender declines by only 8.9%. A similar pattern appears for Activity versus Position in mHealth. Conversely, on UniMiB the degradation in coarse activity recognition is minor (−7.3%), while fine–grained actions (Detailed Act.) deteriorate by 49.2%.

Next, the findings are interpreted through mutual information (MI). The MI column in Table 5 reports the bit-wise MI between the predicted labels of each task on the unperturbed (Raw) data. The MI for the Activity–Gender and Activity–Position pairs is very low (0.01–0.044 bit), indicating near-independence. In contrast, the Activity–Detailed Act. pair exhibits a high MI of 0.543 bit, revealing strong information overlap. These quantitative results align with intuition: coarse activity labels share little information with gender or sensor placement, whereas fine-grained action classes inherently overlap with the broader activity categories.

First, we examine the architectural differences among the anonymization methods.

AAE consists of an encoder-decoder pair, two identity-recognition subnetworks (one attached to the encoder, one to the decoder), and one activity recognition subnetwork.

Next, we consider the computational steps required at inference time (i.e., during anonymization).

For AAE, a single forward pass through the encoder and then the decoder is sufficient.

These observations are summarized in Table 6. Assuming that a backward pass costs roughly twice as many FLOPs as a forward pass, the theoretical requirements become AAE: 81.5 MFLOPs, AAP: 99.5 t MFLOPs, where t denotes the number of iterations. The Latency [s] row in Table 6 reports the actual anonymization time measured on the mHealth test set. All experiments were run on a machine equipped with an Intel Core i9–13900KF, 32 GB RAM, and an NVIDIA RTX 4090 GPU.

From the table we observe that, although AAP takes about four times longer than AAE, the gap is far smaller than the FLOP counts alone would suggest. Conversely, the running time of F-AAP and MF-AAP is dominated by the additional STFT/ISTFT transforms, leading to a substantial increase in total computation time.