Fusion raises confidence but amplifies privacy exposure
Aliases: multi-sensor fusion · inference creep
What it is
Sensor fusion lets multiple modalities corroborate one another, yielding judgements more confident than any single source — the principal way ambient computing buys reliability. But the very same act amplifies privacy exposure: every added sensor widens the collection surface, and the inferable content of combined data exceeds the sum of the parts. The confidence gain and the privacy cost are bundled in one mechanism; this is inherent to fusion, not an implementation slip.
The amplification has a searchable name: inference creep — individually harmless data streams combine into inferences no single stream contains. Location + time + electricity load = daily rhythms and presence patterns; accelerometer + location = identity and health.
Why it happens
Where the confidence comes from: the failure conditions of different modalities do not overlap. Cameras fear darkness; PIR does not but has no identity; microphones fear noise; door contacts ignore noise but know only open/closed. Complementary modalities cover each other's blind spots — a statistical gain: merging approximately independent sources sharpens the joint posterior beyond any single one.
Where the exposure comes from, three layers. First, the leak surface is the union: a fusing system retains each raw stream, so any one leak is all leaked. Second, linkage adds value: as soon as sources are correlatable (aligned timestamps, one account system), combined inference produces new facts — "the user is moving around the bedroom in the evening" is more sensitive than any single raw stream. Third, user expectations lose their anchor: people can anticipate "the camera sees images"; they cannot anticipate "the power curve says I didn't sleep" — there is no consent baseline for combinatorial inference, which is exactly where privacy controversies erupt.
Studying it
- Fusion gain measurement: the standard design in multi-sensor activity recognition compares single-modality against fused classification performance; gains are consistently present and grow with modality complementarity. Bao and Intille (2004) belong to this line — several body-worn accelerometers jointly outperform any single placement, showing the gain comes from diversity of information, not count.
- Perception of combinatorial inference: field research on smart home privacy finds that users worry far more about data being combined into inferences beyond expectation than about any single device (Zeng, Mare and Roesner's 2017 survey of smart home users), while lacking any visibility into how their data flows combine.
- Minimisation comparisons: contrasting "all raw data uploaded" against "local fusion, events only" for the same function, tracking functional loss against exposure surface — a common data-minimisation design.
Methodological caution: measure fusion gains on cross-household data, not only on the training distribution — gains can vanish under individual differences.
Where it stops holding
- Gains depend on complementarity of failure conditions, not sensor count. Two cameras are redundant: lighting changes blind both simultaneously. PIR plus millimetre-wave is genuine complementarity.
- Privacy amplification presupposes linkability. Aligned timestamps, unified accounts, and centralised cloud storage are the plumbing of linkage; isolating sources in local processing physically severs combinatorial inference — a real design lever.
- The products of fused inference are themselves new data. The inference "asleep" leaves the collection site as an event report even if raw audio/video never does — granularity determines residual exposure; local processing is not zero exposure.
Applying it
- Derive the sensor set backwards from "what evidence does the decision need", never forwards from "what else could we add"; for each additional sensor, write down which failure condition it covers — if nothing can be written, do not add it.
- Fuse at the local gateway, uploading event-level results ("no one present", not the video stream); keep per-stream raw data with independent retention limits.
- Give users an inventory — "which sensors this automation uses, and what each one sees" — so combinatorial inference can be examined at all.
- How to check: run a subtraction test per automation — remove each sensor in turn and see whether the function still holds. The irreducible minimum is what is necessary; everything else is pure exposure.