Hi! I am Abhishek, Grad Student at the University of Helsinki. Today, I am gonna give a brief
overview of our work “Aquilis: Using Contextual Integrity for Privacy Protection on Mobile
Devices”.
The primary motivation of this work comes from the well-studied phenomenon of privacy
paradox where users prioritize instantaneous gratification over their own privacy preferences.
Another motivation comes from the fact that users may share information at a given time
which will not seem sensitive, but it may very well become sensitive when combined with
the information shared previously.
However, building mobile privacy solutions incurs some unique set of challenges. First,
Short text conversations through mobile apps like Whatsapp tend to be highly unstructured,
containing emoji, slang, and non-standard abbreviations. Second, privacy contexts are
highly dynamic, thereby making it difficult to utilize AI based models, since it is challenging
to create a training dataset for privacy. Also, building one solution which works for
all mobile apps is challenging due to the security architecture of mobile operating
systems. And, finally any mobile solution needs to be lightweight.
In this work, we make three contributions. First, we utilize the principle of contextual
integrity to develop the privacy solution, and implement it as a privacy preserving keyboard
which aims to preserve privacy by generating color code warnings to the user. Second, we
build a probabilistic model to quantify the privacy risk of a given text input. Finally,
we build a framework that takes instantaneous privacy, longitudinal privacy, and cross-
platform privacy risks into account. In our work, by instantaneous privacy, we mean the
sensitivity of the given text at its face value.
Aquilis’s decision model is based on the theory of contextual integrity. Contextual
integrity is a norm based approach which determines whether the given information flow follows
the norm by identifying 5 tuples (subject, sender, recipient, information type, transmission
principle). In this given example of IRS, as long as the information flow follows this
norm, flow could be considered appropriate, and no privacy leakage happened. Taking the
same approach, Aquilis considers each short text as one flow, and it needs to make a decision
on that flow. In our case, the sender and subject are always the user. As for recipients,
we define 3 categories: one-to-one, group, and everyone. We define all apps in these
3 categories depending on their default visibility settings. Information type is user specified
topics, such as family, health which the user considers sensitive. For the Transmission
principle, we follow the rule: the input text is transmitted if it is not sensitive given
users’ sensitive topics, their privacy leakage tolerance. The important thing to keep in
mind is that we never block the flow, rather we only generate color codes depending on
sensitivity, and let users make final decisions about whether to send.
That brings us to the second contribution. For the Transmission principle, we need to
quantify the sensitivity score of the given information flow. Here, we exploit the “wisdom
of crowd” approach. Here, the rationale is that if many users think a given text is
sensitive, it is highly likely to be sensitive. For this, we utilize the approach of pairwise
mutual information proposed by Sanchez and Batet for document sanitization originally.
Basically it measures the effective amount of information in a given context. For example,
specific words are likely to carry more information than general ones. If a user is sensitive
about health, then a text of HIV Positive or Cancer is likely to be carrying even more
information.
Once we quantify the sensitive score of texts, we take longitudinal and cross platform aspects
into account by using two knowledge graphs, one for each. Input texts alone themselves
may not be sensitive, but they might be sensitive when texts from past timestamp or different
platforms are seen together. We store these two graphs on mobile devices. It does take
some storage, to make sure that it does not overflow the storage, we do not store all
history, but only recent ones. As for updating these knowledge graphs, we take a conservative
approach, where a mildly sensitive world in occurrence with no sensitive word, prompts
the duo to mildly sensitive category.
To assess accuracy, we first collect labels on 1080 input texts from workers on Amazon
Mechanical Turk, and Aquilis reports F1-accuracy of 0.7605 on this labeled dataset.
Next we conduct a user study with 35 participants from diverse backgrounds. We observe an average
accuracy of 74.3%. We also observe the impact of demography on perceived sensitivity. Next
we provide users the results of Aquilis, and ask how much they agree to assess the subjective
accuracy. On average, users agree with an average score of 3.87 on a scale of one to
five. We observe some contradiction in results on objective accuracy, and subjective accuracy.
However, in practical deployment, users are not likely to have a reference answer.
In conclusion, contextual integrity offers an alternative to secrecy based approach to
develop privacy solutions for mobile devices. “Wisdom of crowd” can address the problem
of evolving contexts. Privacy solutions can be deployed at the very source. Demographics
do have a clear impact on privacy decisions. Privacy solutions should consider conducting
both objective accuracy assessment and subjective accuracy assessment to get the measure of
how impactful the solution is. Even a minor side information may play a role in changing
users’ privacy decisions.
Thank you for listening.