Preserving Privacy in Personalized Models for Distributed Mobile
  Services
  The ubiquity of mobile devices has led to the proliferation of mobile
services that provide personalized and context-aware content to their users.
Modern mobile services are distributed between end-devices, such as
smartphones, and remote servers that reside in the cloud. Such services thrive
on their ability to predict future contexts to pre-fetch content or make
context-specific recommendations. An increasingly common method to predict
future contexts, such as location, is via machine learning (ML) models. Recent
work in context prediction has focused on ML model personalization where a
personalized model is learned for each individual user in order to tailor
predictions or recommendations to a user's mobile behavior. While the use of
personalized models increases efficacy of the mobile service, we argue that it
increases privacy risk since a personalized model encodes contextual behavior
unique to each user. To demonstrate these privacy risks, we present several
attribute inference-based privacy attacks and show that such attacks can leak
privacy with up to 78% efficacy for top-3 predictions. We present Pelican, a
privacy-preserving personalization system for context-aware mobile services
that leverages both device and cloud resources to personalize ML models while
minimizing the risk of privacy leakage for users. We evaluate Pelican using
real world traces for location-aware mobile services and show that Pelican can
substantially reduce privacy leakage by up to 75%.
