On-Device Is Not Private: Measuring Membership Leakage in Lightweight Sensor Anomaly Detectors

Abstract

Compressed-TinyML pipelines apply distillation, quantization and pruning to fit lightweight anomaly detectors onto resource-constrained sensor nodes. Such frameworks are routinely called privacy-aware on the strength of on-device inference or noisy federated updates rather than any measured guarantee, yet that assumption is rarely tested with a membership-inference attack. Across six multivariate time-series datasets (sensor, facility and finance) and four compact reconstruction-autoencoder architectures (84 experimental cells), a detector accurate enough to deploy (detection AUC 0.878) is vulnerable to a reconstruction-error membership-inference attack (attack AUC 0.688; true-positive rate 0.074 at a 1% false-positive rate). A gradient-noise defense (gradient clipping with additive Gaussian noise) reduces measured leakage to near chance (attack AUC 0.508 as scored, 0.517 oriented away from chance, not exact chance; TPR cut 4.8-fold) at a utility cost of 0.054 in detection AUC (paired Cohen’s $d=4.06$ for the leakage drop, bootstrap 95% CI $[0.145, 0.210]$), consistently across all datasets (one-sided paired Wilcoxon $p=0.0156$), while the utility change is nominal ($p=0.031$, $d=1.36$). Exported and executed as a real INT8 ONNX artifact, the model shrinks 3.2× but shows no evidence of improved privacy (mean leakage rises slightly; improvement test $p=0.95$, worsening test $p=0.078$, neither significant) and runs slower on average on a desktop CPU, so quantization is a storage optimization only. The primary attack is the loss-threshold attack; a shadow-model check on a subset reaches the same qualitative conclusion. The defense is not formal differential privacy, but the finding is clear: on-device processing does not imply privacy; the privacy of a compressed sensor detector must be measured, not assumed.

1. Introduction

Networks of temperature, vibration, current and flow sensors increasingly run anomaly detection on the device itself, close to where the data is produced, to cut latency and bandwidth and to avoid streaming raw telemetry to the cloud. Such telemetry can encode intimate operational and behavioral patterns, for example when a dwelling is occupied, how a patient moves, or when an industrial process is active, so security and privacy are recognized as first-order concerns for edge-computing-assisted IoT [1]. Against this backdrop, on-device processing is routinely presented as a privacy benefit in its own right: if the raw signal never leaves the node, the reasoning goes, privacy is preserved. Compressed-TinyML pipelines apply distillation, quantization and pruning to fit lightweight anomaly detectors onto resource-constrained sensor nodes [2,3]. Recent lightweight anomaly-detection frameworks make this argument explicitly, describing themselves as privacy-aware on the strength of on-device inference or noisy federated updates [4].

This reasoning has a gap that is rarely examined. A trained model is itself a function of its training data, so an adversary who can query it, or merely observe its anomaly scores, may recover which records it was trained on. Membership-inference attacks formalize exactly this threat [5,6]: given a data point and access to a model, the attacker decides whether that point was in the training set. For a sensor anomaly detector, the concern is concrete rather than abstract. The dominant on-device design is a reconstruction-based detector, the mainstay of unsupervised sensor anomaly detection [7,8], which scores a window by how poorly it reconstructs it; because training windows are reconstructed better than unseen ones [9], the very quantity the detector publishes, the reconstruction error that serves as its anomaly score, also functions as a membership signal.

Two considerations make this worth measuring now rather than taking on trust. First, a broad survey of TinyML security counts the published literature and concludes that fewer than 5% of TinyML publications address security at all, and fewer still address TinyML-specific vulnerabilities, calling this a critical gap as such devices proliferate [10]. Second, where privacy and compression have been studied together, the evidence comes from image models. Quantization-aware training has been reported as a membership-inference defense on image classifiers [11]. Post-training quantization of ResNet-scale vision models reduces leakage at 2-bit and 1.58-bit, while 4-bit PTQ is essentially leakage-neutral relative to full precision [12]. Neither line covers sensor time series, reconstruction-based anomaly detection, or the dynamic INT8 export path used for on-device deployment. The result is that lightweight sensor detectors are shipped with privacy asserted structurally but never measured.

This paper closes that gap with a controlled, reproducible measurement. Its contributions are as follows.

• On six multivariate time-series datasets (sensor, facility and finance) and four compact reconstruction-autoencoder architectures, a detector accurate enough to deploy (detection AUC 0.878) is at the same time vulnerable to a reconstruction-error membership-inference attack (attack AUC 0.688; true-positive rate 0.074 at 1% false-positive rate). On-device processing therefore does not, by itself, make the detector private.
• A gradient-noise mechanism reduces measured leakage to near chance (attack AUC 0.508 as scored, 0.517 oriented away from chance; TPR at 1% FPR cut 4.8-fold; leakage drop with paired Cohen’s $d=4.06$, bootstrap 95% CI $[0.145, 0.210]$) at a utility cost of 0.054 in detection AUC. The privacy reductions are consistent across all six datasets ($p=0.0156$), and the utility cost is a nominal one ($p=0.031$ unadjusted, $d=1.36$; not significant after Bonferroni correction), aggregated at the dataset level. A clip-only control and a noise-multiplier sweep on a subset confirm that the reported $(\mathcal{C},\sigma )=(1,1)$ point is not an isolated fortunate one.
• Exporting and executing real INT8 ONNX artifacts shrinks the model 3.2× but provides no evidence of improved membership privacy: mean attack AUC rises slightly, the one-sided improvement test is far from significant ($p=0.95$) and the one-sided worsening test is not significant ($p=0.078$), so INT8 is leakage-neutral to slightly worse, with no demonstrated privacy benefit in the evaluated setting. It does not accelerate mean inference on the tested desktop CPU.
• The study covers the reconstruction-error (loss-threshold) membership attack, cross-checked with a pipeline-matched shadow-model attack on a subset, and a gradient-noise defense that is not formally differentially private, and deployment cost is reported as measured resource-envelope screening on a desktop CPU, not as demonstrated microcontroller execution.

The remainder of the paper is organized as follows. Section 2 reviews on-device anomaly detection, membership inference, privacy under compression, and benchmark reliability, and positions the gap. Section 3 describes the detectors, the attack, the gradient-noise defense, the edge-deployment measurement, and the evaluation protocol, including the safeguards that make a membership measurement trustworthy. Section 4 details the datasets and the functional-detector selection criterion. Section 5 reports the privacy–utility–cost results. Section 6 discusses implications and threats to validity, and Section 7 concludes.

2. Related Work

Prior work is organized here along four axes, namely on-device anomaly detection, membership inference and its measurement, privacy under model compression, and benchmark reliability, against which this study is then positioned.

2.1. On-Device and Reconstruction-Based Anomaly Detection

Reconstruction-based detectors, namely autoencoders and their recurrent and convolutional variants, are the mainstay of unsupervised multivariate sensor anomaly detection: a model is trained to reconstruct normal windows and flags any window whose reconstruction error is high [7,8]. The broader field also spans graph-based and embedding-based multivariate detectors [13,14] and is the subject of several recent reviews and comprehensive evaluations [15,16,17]. Their appeal on the edge is threefold: they need no anomaly labels, they are compact enough to compress onto a microcontroller, and they emit a single scalar score per window. Recent industrial-edge frameworks push this further by distilling and quantizing such detectors for deployment on constrained hardware and, in doing so, describe themselves as privacy-aware [4]. The property that makes these detectors practical, namely exposing reconstruction error as the anomaly score, is precisely the property that turns them into a membership oracle: because a model reconstructs its training windows better than unseen ones, the score it publishes is also a membership signal. This is the reconstruction analog of the observation that generative models leak membership through the quality of what they produce [18].

2.2. Membership Inference and Its Measurement

Membership-inference attacks decide whether a specific record was in a model’s training set [5], and range from black-box shadow-model attacks to white-box attacks that exploit gradients and internal activations [19]; the threat is now well surveyed and its mechanisms catalogued [20]. The leakage is closely tied to overfitting and the generalization gap [9], and it has been demonstrated even in machine-learning-as-a-service settings where the adversary sees only query outputs [21]. Two methodological points shape the evaluation in this paper. First, Carlini et al. [6] showed that average-case metrics such as AUC systematically understate privacy risk: an attack that confidently identifies even a handful of training records at a low false-positive rate is a genuine breach, so the true-positive rate at a fixed low false-positive rate is the metric that matters. TPR at a 1% false-positive rate is therefore reported alongside AUC throughout, and the former is treated as primary. Second, a membership measurement is only trustworthy if members and non-members are otherwise exchangeable; if the two sets differ for any reason other than training membership, an attack can separate them without learning anything about memorization. This condition is enforced and verified explicitly (Section 3), a safeguard often left implicit.

2.3. Privacy Under Model Compression

Whether compression helps or harms privacy depends on the operator, the bit-width and the domain. Quantization-aware training has been proposed as a membership-inference defense on image classifiers, on the grounds that reduced numerical precision perturbs the memorized signal [11]. Zhang et al. [12] study a different operator—algorithmic post-training quantization (AdaRound, BRECQ, OBC) of ResNet-scale vision models—and evaluate it with LiRA at 4-bit, 2-bit and 1.58-bit. Their 4-bit models are essentially leakage-neutral relative to full precision, with accuracy preserved; 2-bit and especially 1.58-bit PTQ then reduce membership leakage, at a growing utility cost. The two lines are not opposed, but they are produced by different regimes: Famili and Lao apply quantization during training, so the model adapts to reduced precision, and their reported leakage reductions appear already at 8-bit (though the effect is architecture-dependent); Zhang’s algorithmic PTQ edits a trained model after the fact and is leakage-neutral at the deployment-realistic 4-bit width. Neither setting is the post-training dynamic INT8 export this study executes. Crucially, all of this evidence is drawn from image classifiers with standard integer quantization [22], one technique among the many compression and quantization methods surveyed for efficient inference [2,3]; none of it covers sensor time series, reconstruction-based anomaly detection, or the dynamic INT8 ONNX export path used for on-device deployment. The present study measures that missing case. The principled defense against membership leakage is differentially private training via gradient clipping and noise addition [23], grounded in the formal guarantees of differential privacy [24] and supported by current practical guidance for training under a differential-privacy budget and for evaluating the resulting guarantee [25,26], but its utility cost on the tiny reconstruction models used at the sensor edge has not been characterized. This study measures both the compression–privacy interaction and a gradient-noise defense directly in the sensor-anomaly-detection setting that the existing literature omits.

2.4. Benchmark Reliability and Evaluation

Time-series anomaly-detection benchmarks have been shown to be flawed and to create an illusion of progress, with many popular datasets solvable by trivial one-line rules [27]. This has motivated curated replacements with corrected labels and realistic anomaly assumptions [28], from which the datasets used here are drawn. Because the privacy of a detector that cannot actually detect is meaningless, dataset inclusion is additionally gated on a held-out functional-detector criterion (Section 4), so that every reported leakage measurement is made on a detector that genuinely works.

2.5. Positioning

Table 1 summarizes how this study relates to the closest prior work. The pattern is consistent: privacy in the compressed-edge setting is either claimed structurally (from on-device processing or noisy updates) without an attack-based measurement, or measured but only on image models and without the edge-deployment cost that a sensor node must pay. To the best of current knowledge, no prior work jointly (i) measures membership leakage of a functional sensor anomaly detector with a low-FPR metric, (ii) quantifies the privacy–utility cost of a defense on that detector, and (iii) reports the measured edge-deployment cost of the same artifact.

Table 1. Positioning against the closest prior work. Priv. measured? = privacy quantified with an actual attack (vs. asserted structurally); Compr.? = model compression studied; Defense? = a privacy defense evaluated; Edge cost? = deployment cost (size/latency) measured on a real artifact. ✓ yes, ✗ no, ∼ partial.

Work	Domain	Task	Priv. Meas.?	Attack Metric	Compr.	Def.	Edge Cost?
Shokri [5]	Image/tabular	Classif.	✓	AUC	✗	✗	✗
Carlini [6]	Image	Classif.	✓	TPR@FPR	✗	✗	✗
Nasr [19]	Image/tabular	Classif.	✓	AUC	✗	∼	✗
Famili [11]	Image	Classif.	✓	AUC	✓ (quant.)	✓	✗
Zhang [12]	Image	Classif.	✓	TPR@FPR	✓ (quant.)	∼	✗
Hayes [18]	Image	Generative	✓	AUC	✗	✗	✗
EPC-TinyAD [4]	Sensor	Anomaly	✗	—	✓	∼	∼
This work	Sensor	Anomaly	✓	TPR@FPR	✓ (INT8)	✓	✓

3. Method

This study measures three quantities for one on-device detector under four deployment configurations: how well it detects (utility), how much it leaks about its training data (privacy), and what it costs to deploy (cost). This section defines the detector families (Section 3.1), the membership split and the safeguard that makes a membership measurement trustworthy (Section 3.2), the attack and its low-FPR metric (Section 3.3), the gradient-noise defense (Section 3.4), the real INT8 edge measurement (Section 3.5), and the resource-envelope screening (Section 3.6). Figure 1 overviews the pipeline.

Figure 1. Overview of the measurement pipeline. Each sensor stream is cut into non-overlapping windows and split into members (used to train the detector) and held-out non-members, after an exchangeability guard rejects any split that is distinguishable before training. Each detector—trained with or without the gradient-noise defense—is then scored on three axes: detection utility on held-out labeled windows, membership privacy via the loss-threshold attack, and deployment cost via a real executed INT8 ONNX artifact. Results populate the privacy–utility–cost table.

3.1. Detector Families and Training

A detector consumes a length-L window $\mathbf{x}\in {\mathbb{R}}^{L\times C}$ of C standardized sensor channels ($L=64$) and outputs a reconstruction $\widehat{\mathbf{x}}$. Its anomaly score is the mean squared reconstruction error

$$e\left(\mathbf{x}\right)={\displaystyle \frac{1}{LC}}{\parallel \mathbf{x}-\widehat{\mathbf{x}}\parallel }_{\mathrm{F}}^2,$$

(1)

so a window that reconstructs poorly is flagged as anomalous. Four compact reconstruction-autoencoder families are studied, spanning the architectural choices made at the sensor edge: a fully connected autoencoder (Dense), a 1-D convolutional autoencoder (Conv), a recurrent autoencoder (LSTM), and a causal dilated temporal convolutional autoencoder (TCN). Causality in the TCN is enforced with left-only padding, so no output at time t depends on an input after t; this is verified in code. All families share a hidden width of 64, a code dimension of 16, and ReLU activations on feed-forward and convolutional layers (LSTM gates use the framework default tanh/sigmoid). Parameter counts range from $\mathrm{16,000}$ (Conv on the narrowest stream) to $\mathrm{308,000}$ (Dense on the widest); Table 2 gives the layer recipe, kernel, dilation and the observed parameter range. Each detector is trained by Adam on the mean squared error of Equation (1) over normal windows only, which is both the standard reconstruction-detector recipe and, as explained next, a necessary confound control.

Table 2. Architecture details shared by every cell. Hidden width $H=64$, code dimension 16, window $L=64$. Parameter ranges are over the six datasets (after dropping constant channels). LSTM parameters follow the PyTorch convention (two bias vectors per gate).

Fam.	Params	Recipe	Range
Dense	$H=64$, code 16	2-layer MLP encoder + symmetric decoder; ReLU	76,000–308,000
Conv	$k=5$, stride 2	2 × Conv1d + 2 × ConvTranspose1d; pad 2; ReLU	16,000–34,000
LSTM	1-layer each way	final hidden → code; repeat-and-LSTM decoder; tanh/sigmoid gates	55,000–64,000
TCN	$k=3$, dil. $1,2,4$	3 causal levels + $1\times 1$ to code; left-pad + chomp; ReLU	56,000–63,000

An anomalous window reconstructs poorly regardless of whether the model trained on it. If the member and non-member sets carried different fractions of anomalies, their mean error would differ for reasons unrelated to memorization, and a membership attack would score that difference. Both training and the membership evaluation are therefore restricted to normal windows, so that any residual error difference between members and non-members reflects memorization rather than anomaly content. Detection utility, in contrast, is measured on the full label-bearing window set where anomalies belong.

3.2. Membership Split and Its Exchangeability Safeguard

A membership-inference measurement is meaningful only if members and non-members are exchangeable: identically distributed, differing solely in whether the detector was trained on them. Each stream is cut into non-overlapping windows, so that no raw sample appears in two windows and therefore never on both sides of the split, and whole windows are assigned to the member and non-member sets uniformly at random. Random assignment of i.i.d.-treated windows makes the two sets exchangeable by construction.

This is not merely assumed but tested. Before any attack, a random-forest classifier is trained to separate members from non-members using only summary statistics of the raw windows over 200 label permutations, and its cross-validated AUC is standardized against the label-permuted null. If the absolute standardized score exceeds 3 ($\left|z\right|>3$; a classifier significantly below $0.5$ is equally distinguishable after score reversal), that is, the two sets are distinguishable from the raw data before any detector exists, the split is declared leaky and the cell is discarded, because any subsequent “leakage” would merely be that distributional difference. This guard is run for every cell and any cell that fails it is discarded before training. A related preprocessing hazard is a channel that is constant over the training window (e.g., a binary actuator that never toggles): dividing by its near-zero standard deviation amplifies held-out variation by orders of magnitude. The standardizer detects and drops such channels rather than amplifying them.

3.3. Attack and Metric

Because a reconstruction detector reconstructs its training windows better than unseen ones, the reconstruction error of Equation (1) is itself a membership signal. The loss-threshold attack assigns each window a membership score $s\left(\mathbf{x}\right)=-e\left(\mathbf{x}\right)$, since members are expected to have lower error, and no auxiliary data or shadow models are required, which matches the realistic threat in which an adversary observes only the published anomaly score. This is a black-box, score-only threat: the attacker does not see weights or gradients and does not train shadow models for the main grid. A stronger adversary with auxiliary data could train shadow models (calibrated likelihood-ratio attack) or, with white-box access, exploit gradients [6,19]. Those stronger calibrated black-box or white-box attacks may reveal additional leakage in either the undefended or defended detector that the loss-threshold attack does not capture. We therefore cross-check the gradient-noise near-chance result with a shadow-model attack on a subset (Section 5). The attack is evaluated in two ways. Its area under the ROC curve (AUC) summarizes average-case separability. More importantly, following Carlini et al. [6], the true-positive rate at a fixed $1\%$ false-positive rate (TPR@$1\%$FPR) is reported, the regime in which confident identification of individual training records constitutes a real breach, and this low-FPR figure is treated as the primary privacy metric. TPR at $0.1\%$ FPR is reported as supplementary evidence only: 24 of 84 cells have fewer than 1000 non-members, so that threshold is ROC-interpolated rather than directly resolved. For each cell, a null control is also computed, with the same metrics on random scores, so that a small TPR@$1\%$FPR can be read against what noise produces at that sample size. The entire attack path is validated with a positive control: on a model constructed to memorize a tiny training set, the attack recovers membership at AUC $1.0$, confirming that the implemented attack can detect strong planted memorization; it does not rule out leakage detectable by stronger attacks.

3.4. Gradient-Noise Defense

As a practical, low-overhead defense, training uses the DP-SGD-style mechanism of per-example gradient clipping followed by additive Gaussian noise [23]: each per-sample gradient $g_i$ of a batch of size B is clipped to an ${\mathsf{\ell }}_2$ norm bound $\mathcal{C}$, and Gaussian noise is added to their sum, yielding the noisy update

$$\tilde{g}=\frac{1}{B}\left({\sum }_{i=1}^B{g}_{i}min\left(1,\frac{\mathcal{C}}{{\parallel g_i\parallel }_2}\right)+\mathcal{N}(0,{\sigma }^2{\mathcal{C}}^2\mathbf{I})\right),$$

(2)

with clip $\mathcal{C}=1$ and noise multiplier $\sigma =1$ as the main-grid operating point. Clipping is genuinely per-example (implemented with microbatches), not per-batch. The main-grid defense applies clipping and noise together, so a sensitivity sweep on a three-dataset, two-architecture subset reports three arms: the undefended baseline (no clip, no noise), clip-only ($\mathcal{C}=1$, $\sigma =0$), and clip plus $\sigma \in \{0.25,0.5,1,2\}$. That separates the regularizer from the noise and lets the reported trade-off be read as a curve rather than a single point (Section 5).

This is deliberately called a gradient-noise defense, not differential privacy. It has no privacy accountant, uses shuffling rather than Poisson subsampling, and therefore carries no $(\epsilon ,\delta )$ guarantee. Its effect on attack success is measured directly, and that measured effect, not a formal bound, is what this paper reports.

3.5. Executed INT8 Edge-Deployment Measurement

The deployment-cost measurement follows the standard integer-quantized edge-deployment path [22]. Each trained detector is exported to ONNX and quantized to INT8, and both the FP32 and the dynamically quantized graphs are executed in ONNX Runtime, a production edge-inference runtime, rather than merely inspected. Dynamic quantization yields a mixed-precision graph—integer operators (MatMulInteger, ConvInteger, DynamicQuantizeLSTM) where the runtime supports them, floating-point elsewhere (e.g., ConvTranspose)—so “INT8” denotes the standard dynamic-INT8 export path rather than a uniformly 8-bit graph. Artifact size is the on-disk byte count of the real exported file; latency is the median of single-sample, single-threaded, batch-one inferences, which is how a sensor node scores one window at a time. Crucially, utility and privacy for the INT8 configuration are computed from errors produced by the executed dynamically quantized graph, not copied from the FP32 model, so any effect of quantization on either axis is genuinely measured.

3.6. Resource-Envelope Criteria

To place the measured cost in a deployment context, each artifact is screened against three representative device classes: an MCU-tiny (64 kB flash, 20 kB SRAM, ≤10 ms), an MCU-mid (512 kB, 128 kB, ≤5 ms) and an MPU-edge class (8 MB, 1 MB, ≤2 ms). On such hardware, the binding constraint is on-chip memory rather than arithmetic: contemporary surveys of microcontroller-class deployment report that the available SRAM and flash, not arithmetic throughput, are what determine whether a model fits at all [29]. Flash is therefore checked against the real INT8 artifact size, SRAM against the largest single intermediate activation tensor measured by forward hooks (a lower bound on peak working memory), and latency against the measured batch-one figure. This is termed resource-envelope screening: it establishes which artifacts pass a device class on size and activation-memory lower bound, treating desktop-measured latency as indicative only (deadline compliance requires on-target validation). It is not a demonstration of on-microcontroller execution, and is not presented as one; on-target profiling of true peak SRAM and energy is future work.

Algorithm 1 states the per-cell measurement procedure exactly as implemented. For one (dataset, architecture, seed) cell, it builds an exchangeable member/non-member split, trains the base and gradient-noise detectors, and returns the three axes for all four deployment configurations. The base and clip-and-noise detectors are trained separately and differ only in whether the update of Equation (2) is used; each INT8 configuration is the executed quantized artifact of that run’s weights, so INT8 is never a third training. Algorithm 2 is the end-to-end evaluation around that cell: dataset gating, the 84-cell grid, aggregation, the $\sigma$ sweep and the shadow-model check.

Across all cells, utility, privacy and cost are aggregated to the dataset level (seeds averaged within a dataset) and compared with one-sided paired Wilcoxon signed-rank tests, so that datasets, not correlated seeds, are the units of replication (Section 5).

Algorithm 1 Per-cell privacy–utility–cost measurement.

Require:  stream X with labels y; architecture a; seed s; window L; train size n; clip $\mathcal{C}$, noise $\sigma$ Ensure:  axes for configs {base, int8, gnoise, int8+gnoise}, or reject   1: $W\leftarrow$ non-overlapping length-L windows of X   2: $(\mathcal{M},\mathcal{N})\leftarrow$ random split of W into members/non-members                          ▹ whole windows, disjoint   3: ${\mathcal{M}}_0,{\mathcal{N}}_0\leftarrow$ normal windows of $\mathcal{M},\mathcal{N}$                                                                             ▹ confound control   4: if  $\left|\mathrm{E}\mathrm{XCHANGEABILITY}\mathrm{Z}({\mathcal{M}}_0[:n],{\mathcal{N}}_0[:n])\right|>3$  then   5:     return reject                                                                               ▹ split distinguishable before training   6: end if   7: fit standardizer on ${\mathcal{M}}_0[:n]$, dropping constant channels; apply to all windows   8: for all  $c\in \{\mathrm{BASE},\mathrm{GNOISE}\}$do   9:     $f_c\leftarrow \mathrm{T}\mathrm{RAIN}(a,s,{\mathcal{M}}_0[:n];\mathrm{noise}=[c=\mathrm{GNOISE}],\mathcal{C},\sigma )$ 10:     $e^m\leftarrow e(f_c,{\mathcal{M}}_0[:n])$,    $e^n\leftarrow e(f_c,{\mathcal{N}}_0)$                                                                              ▹ Equation (1) 11:     ${\mathrm{UTIL}}_c\leftarrow \mathrm{AUC}\left(y_{\mathcal{N}},e(f_c,\mathcal{N})\right)$                                                     ▹ utility on held-out labeled windows 12:     ${\mathrm{PRIV}}_c\leftarrow \left(\mathrm{AUC},\mathrm{TPR}@1\%\mathrm{FPR}\right)$ of attack score $-e$ on $(e^m,e^n)$ 13:     $q_c\leftarrow \mathrm{Q}\mathrm{UANTIZE}\mathrm{INT}8\left(\mathrm{E}\mathrm{XPORT}\mathrm{ONNX}\left(f_c\right)\right)$ 14:     ${\mathrm{SIZE}}_c,{\mathrm{LAT}}_c\leftarrow$ bytes and batch-1 latency of executed $q_c$ 15:     $e_8^m,e_8^n\leftarrow e(q_c,{\mathcal{M}}_0[:n]),e(q_c,{\mathcal{N}}_0)$          ▹ errors from the executed dynamically quantized graph 16:     ${\mathrm{UTIL}}_c^8,{\mathrm{PRIV}}_c^8\leftarrow$ utility and attack recomputed on $q_c$ 17:     ${\mathrm{FITS}}_c\leftarrow \mathrm{E}\mathrm{NVELOPE}\mathrm{S}\mathrm{CREEN}({\mathrm{SIZE}}_c,\mathrm{P}\mathrm{EAK}\mathrm{A}\mathrm{CT}\left(f_c\right),{\mathrm{LAT}}_c)$ 18: end for 19: return the four configurations assembled from $\{\mathrm{UTIL},\mathrm{PRIV},\mathrm{SIZE},\mathrm{LAT},\mathrm{FITS}\}$

Algorithm 2 End-to-end privacy–utility–cost evaluation.

Require:  public TSB-AD-M streams [28]; $A=\{\mathrm{D}\mathrm{ENSE},\mathrm{C}\mathrm{ONV},\mathrm{LSTM},\mathrm{TCN}\}$; $S=\{0,1,2\}$; $L=64$; $n=200$; 200 epochs; Adam at ${10}^{-3}$; $\mathcal{C}=1$; $\sigma =1$; gate $\tau =0.65$ Ensure:  dataset-level axes $\overline{R}$; tests T; sweep $\mathrm{\Sigma }$; shadow scores $\mathrm{\Lambda }$   1: de-duplicate candidate streams by MD5 checksum   2: for all candidate stream X do   3:     train a probe detector; admit X to $\mathcal{D}$ iff held-out AUC $\ge \tau$   4: end for   5: for all series of $d\in \mathcal{D}$, $a\in A$, $s\in S$ do   6:     $R_{d,a,s}\leftarrow$ Algorithm 1 on $(d,a,s)$                                                                               ▹$7\times 4\times 3=84$ cells   7: end for   8: $\overline{R}\leftarrow$ average $R_{d,a,s}$ over seeds (and CATSv2’s two series) to the dataset level   9: $T\leftarrow$ paired Wilcoxon, bootstrap 95% CI (20,000) and Cohen’s d on the six means of $\overline{R}$ 10: $\mathrm{\Sigma }\leftarrow$ clip-only and $\sigma$-sweep on $\{\mathrm{CreditCard},\mathrm{PSM},\mathrm{Exathlon}\}\times \{\mathrm{C}\mathrm{ONV},\mathrm{D}\mathrm{ENSE}\}$, seed 0: undefended; clip-only $(\mathcal{C}=1,\sigma =0)$; clip plus $\sigma \in \{0.25,0.5,1,2\}$ 11: $\mathrm{\Lambda }\leftarrow$ shadow-model LR attack (four shadows, log-error Gaussian, same defense and $n=200$) on $\{\mathrm{CreditCard},\mathrm{PSM}\}\times \mathrm{C}\mathrm{ONV}$, seed 0, base vs. $\sigma =1$ 12: return  $\overline{R},T,\mathrm{\Sigma },\mathrm{\Lambda }$

4. Experimental Setup

4.1. Datasets and the Functional-Detector Gate

Multivariate time-series streams are drawn from the curated TSB-AD-M benchmark [28], which corrects the labeling and triviality problems of earlier collections [27]. Because the privacy of a detector that cannot detect is meaningless, a dataset is admitted only if the base detector is genuinely functional on it, using a held-out functional-detector gate: for each candidate, a probe detector is trained and its detection AUC measured on held-out non-member windows, keeping datasets with AUC $\ge 0.65$. Candidate streams are additionally de-duplicated by MD5, since the source benchmark contains byte-identical recordings that would otherwise inflate the apparent evidence. The gate yields six datasets spanning sensor, facility and finance domains, with 9 to 37 channels (Table 3); the excluded low-utility streams (e.g., two GHL and one LTDB series with AUC $0.45$–$0.61$) are reported for transparency. Gating on functional detectors is the scientifically relevant population—privacy of a detector that cannot detect is moot—but it is a selection: streams on which a reconstruction autoencoder already fits well may also be those on which it memorizes more. The reported leakage should therefore be read as applying to deployable detectors, not to every sensor stream. The three excluded series are those on which the probe detector itself fails (AUC $0.45$–$0.61$). An additional compression-study run on two of them (GHL, LTDB) shows only weak membership signal (attack AUC $0.52$–$0.68$), so the gate did not hide a private-but-functional detector; it dropped detectors that fail the task. Two screening details are stated for transparency. First, candidates are pre-filtered before the probe (20,000–400,000 rows, ≥3 channels, ≥800 windows, at most two series per source, MD5 de-duplicated, capped at 16), so the gate inspects ten candidate series rather than every TSB-AD-M stream; all probe utilities are persisted with the results. Second, the probe is evaluated on the seed-0 held-out partition, which also contributes to the reported seed-0 results; inclusion is therefore partly selected on an evaluation set. The margin between admitted (≥0.74) and excluded (≤0.61) probe utilities makes it unlikely that an independent gate would change the admitted set, although reported utility remains conditional on this selection.

Table 3. The six datasets admitted by the held-out functional-detector gate (base detection AUC $\ge 0.65$). Channels are after dropping constant channels; $n_{\mathrm{train}}$ is the number of normal member windows; $n_{\mathrm{non}}$ is the held-out non-member normal windows, reported as the mean over seeds (and, for CATSv2, over its two series), rounded to the nearest window. Base utility is the mean detection AUC of the uncompressed detector.

Dataset	Domain	Channels	${\mathit{n}}_{\mathbf{train}}$	${\mathit{n}}_{\mathbf{non}}$	Base Util. (AUC)
CATSv2 [30]	Sensor	17	200	1116	0.788
CreditCard [31]	Finance	29	200	2030	0.751
Exathlon [32]	Facility	19	200	881	0.998
GECCO [33]	Sensor	9	200	1048	0.987
PSM [34]	Facility	25	200	1482	0.828
SWaT [35]	Sensor	37	200	2711	0.917

4.2. Design and Protocol

Each detector consumes length-64 windows and is trained for 200 epochs with Adam (learning rate ${10}^{-3}$) on 200 normal member windows, a hidden width of 64 and a code dimension of 16. The gradient-noise defense uses clip $\mathcal{C}=1$ and noise multiplier $\sigma =1$. Training uses batch size 64 without drop-last; with $n=200$ the final batch holds eight windows and, because the noise is divided by the actual batch size, that batch receives a heavier-noise update; the drop-last control in Section 5 shows this does not drive the defense effect. The six datasets contribute seven evaluation series (CATSv2 provides two disjoint series); every (series, architecture, seed) combination is run for the four families of Section 3.1 and three seeds, giving $7\times 4\times 3=84$ cells. Within each cell, the base detector and the clip-and-noise detector are trained separately; each INT8 configuration is the executed quantized artifact of that run’s weights, not a third training. Results are aggregated to the dataset level and tested as described in Section 5. All randomness is seeded, and all dataset MD5 checksums are recorded, so the study reproduces exactly. The exchangeability guard was recomputed for every (series, seed) split in the main grid: all 21 splits pass (maximum $\left|z\right|=2.26$, on one SWaT seed), none is discarded.

ONNX size and latency are measured on a desktop AMD Ryzen 5 5500GT (6 cores/12 threads, Ubuntu 24.04.4 LTS) running ONNX Runtime 1.27.0 with the CPUExecutionProvider, intra_op_num_threads=1 and inter_op_num_threads=1, PyTorch 2.5.1 (CPU), ONNX 1.22.0 and Python 3.12.3. Each latency figure is the median of 120 single-sample inferences after 30 warmup runs. This is the same integer-graph runtime class as TFLite/LiteRT; it is not on-microcontroller execution.

5. Results

Table 4 is the paper’s central object: the four deployment configurations scored on utility, privacy and cost, averaged over the six datasets. Three findings follow, each tested at the dataset level ($n=6$) with one-sided paired Wilcoxon signed-rank tests. The two privacy tests (attack AUC and TPR@1%FPR) and the utility-cost test are treated as one family of three primary comparisons; under a Bonferroni correction at $\alpha =0.05$ the per-test threshold is $0.0167$, which the two privacy results ($p=0.0156$) clear. With only $n=6$ paired samples, the smallest attainable one-sided p is $1/2^6=0.0156$, so a significant Wilcoxon result means only that all six datasets point in the same direction, not that an effect size has been tightly estimated. Alongside each p-value, we therefore report the paired mean difference with a dataset-resampled bootstrap 95% confidence interval (20,000 replicates) and paired Cohen’s d. Error bars in Figure 2 show one standard deviation across cells within each dataset, pooling architecture, seed and, for CATSv2, series variability. Unless noted otherwise, error bars in subsequent figures show one standard deviation across the six dataset-level means, within each architecture where applicable. These bars describe spread, not confidence intervals.

Table 4. Privacy–utility–cost of the four deployment configurations, mean ± sample SD (ddof = 1) over six datasets (the unit of replication). Utility: detection AUC on held-out labeled windows (higher is better). Attack AUC and TPR@1%FPR: membership-inference success (lower is safer; chance is $0.5$ and $0.01$). Size/Latency: real executed ONNX artifact. The gradient-noise rows differ from base only in the defense; the INT8 rows are the executed quantized artifacts of the same weights. Bold attack-AUC and TPR@1%FPR values mark the gradient-noise defense.

Configuration	Utility AUC	Attack AUC	TPR@ 1%FPR	Size (KB)	Latency (ms)
Base (FP32)	$0.878\pm 0.104$	$0.688\pm 0.040$	$0.074\pm 0.030$	$329\pm 91$	$0.090\pm 0.005$
INT8	$0.875\pm 0.103$	$0.721\pm 0.029$	$0.110\pm 0.077$	$102\pm 26$	$0.218\pm 0.011$
Gradient noise	$0.824\pm 0.122$	$\mathbf{0.508}\pm \mathbf{0.011}$	$\mathbf{0.016}\pm \mathbf{0.003}$	$329\pm 91$	$0.090\pm 0.005$
INT8 + gradient noise	$0.824\pm 0.122$	$0.513\pm 0.017$	$0.017\pm 0.004$	$102\pm 26$	$0.217\pm 0.011$

Figure 2. Membership leakage before and after the gradient-noise defense, per dataset. (a) Attack AUC; (b) true-positive rate at a $1\%$ false-positive rate (the primary low-FPR privacy metric). Bars are dataset-level means; error bars are one standard deviation across cells (architecture × seed). Hatched bars (base) versus dotted bars (defense) are color-independent. The defense reduces both metrics to near-chance levels on every dataset; dashed lines indicate the exact chance reference rates.

The uncompressed detector detects well (utility 0.878) yet is vulnerable: the reconstruction-error attack reaches AUC 0.688 and, more tellingly, a true-positive rate of 0.074 at a $1\%$ false-positive rate, roughly seven times the chance rate of $0.01$. Leakage is present on every dataset (Figure 2a). Ranked by the primary low-FPR metric, the most exposed is CreditCard (TPR@$1\%$FPR $0.13$; dataset-level attack AUC $0.70$), with an individual Dense cell reaching AUC $0.93$; ranked by attack AUC the highest is PSM ($0.73$). The $1\%$-FPR figure is fully resolvable in every cell and is treated as primary. At a $0.1\%$ false-positive rate the dataset-level mean true-positive rate is still $25\times$ chance (Figure 3), but that operating point is supplementary: 24 of 84 cells (the 12 Exathlon cells plus the 12 cells of the shorter CATSv2 series, $n_{\mathrm{non}}=765$) have too few non-members to resolve $0.1\%$ FPR exactly and are ROC-interpolated there. On-device processing does not make the detector private.

Figure 3. True-positive rate at three false-positive rates (log scale, mean ± SD over six datasets). The $1\%$-FPR point is fully resolvable in every cell and is the primary metric; at $0.1\%$ FPR, 24 of 84 cells have too few non-members to resolve the threshold exactly and are ROC-interpolated, so that bar is supplementary. The gradient-noise defense returns leakage to near chance at every operating point that can be read directly.

The gradient-noise defense drives measured leakage to near chance on every dataset: mean attack AUC falls to 0.508 (a drop of 0.181, bootstrap 95% CI $[0.145, 0.210]$, paired Cohen’s $d=4.06$) and TPR@1%FPR to 0.016, a 4.8-fold reduction (Figure 2; TPR difference $0.059$, 95% CI $[0.039, 0.082]$, $d=1.96$). The privacy reductions are consistent across all six datasets, with one-sided paired Wilcoxon $p=0.0156$ for both attack AUC and TPR@1%FPR—the smallest p attainable at $n=6$, i.e., every dataset moves in the same direction. This safety costs 0.054 AUC of detection utility (a nominal reduction, $p=0.031$ unadjusted, 95% CI $[0.025, 0.083]$, $d=1.36$; not significant after Bonferroni correction). Figure 4 shows the effect directly: every dataset moves downward to near-chance leakage; detection utility decreases on five datasets and is essentially unchanged on Exathlon. The effect is not an average artifact: across all 84 cells the base attack AUC spans $0.49$–$0.93$ (seven cells sit near chance, all of them LSTM or a modest-leakage Exathlon/GECCO seed) while gradient-noise cells concentrate near chance (range $0.47$–$0.56$; Figure 5). As scored, 29 of 84 defended cells fall below $0.5$; orienting each AUC away from chance—the conservative reading, since an adversary could flip the score—gives a defended dataset-level mean of 0.517, still near chance.

Figure 4. Privacy–utility trade-off. Each arrow runs from a dataset’s base detector (orange) to its gradient-noise counterpart (blue). Defended attack AUCs lie near the exact chance reference line at AUC = 0.5. Detection utility decreases on five datasets and is essentially unchanged on Exathlon.

Figure 5. Distribution of the membership attack AUC over all 84 cells. Base leakage is broad and often large (seven cells sit near chance); under the clip-and-noise defense, cells concentrate near chance (range $0.47$–$0.56$), showing the protection is not an averaging artifact. Horizontal bars are means.

Figure 6 breaks the result down by architecture. All four families leak in the base configuration (attack AUC $0.61$–$0.77$) and all four are driven to near chance by the defense, so protection is consistent across all four evaluated architectures. What differs is the price: the recurrent (LSTM) and convolutional (Conv) detectors retain $96\%$ and $94\%$ of their utility under the defense, against $91\%$ for the dilated-convolutional (TCN) detector, while the fully connected (Dense) detector, though it retains $94\%$, is about three times larger ($\sim 196$ KB INT8 vs. $\sim 65$ KB for Conv). This is reported as a utility- and size-efficiency ranking, not a single multi-objective optimum.

Figure 6. Per-architecture breakdown. (a) All families leak in the base configuration, and all are driven to near chance by the defense—protection is consistent across all four evaluated architectures. Error bars are one SD across the six datasets. (b) Utility retained under the defense, with INT8 artifact size labeled; recurrent and convolutional detectors are the most utility- and size-efficient. Hatch patterns distinguish conditions independently of color.

Figure 7 contrasts the FP32 and INT8 artifacts. INT8 shrinks the model 3.2× on average (mean 329 KB → 102 KB; Dense $3.8\times$, LSTM $3.4\times$, TCN $3.1\times$, Conv only $1.5\times$, so the headline ratio is Dense-dominated) with a negligible utility change ($-0.003$ AUC). It gives no evidence of a privacy improvement: mean attack AUC in fact rises, from 0.688 to $0.721$ (paired difference $+0.033$, 95% CI $[0.003, 0.082]$, $d=0.55$). The one-sided Wilcoxon test for an INT8 improvement is far from significant ($p=0.95$); the test for INT8 leaking more than FP32 gives $p=0.078$ (marginal, not significant at $0.05$) and the two-sided test $p=0.156$, so INT8 is best read as leakage-neutral to slightly worse, with no demonstrated privacy benefit in the evaluated setting. That reading is consistent with Zhang et al.’s 4-bit PTQ result on image CNNs [12]—the closest bit-width they report to the INT8 export used here—and does not contradict their finding that 2-bit and $1.58$-bit PTQ do reduce leakage, because those widths are outside this deployment path. Most datasets sit on the FP32 equality line, and none fall clearly below it (Figure 8); on Exathlon leakage rises substantially, from $0.62$ to $0.77$. That dataset-level jump is seed-dependent rather than a stable property of the stream: seed 0 moves Conv $0.58\to 0.94$ and TCN $0.62\to 0.99$, seed 1 moves both part-way, and seed 2 is almost unchanged ($0.55\to 0.58$ Conv, $0.56\to 0.58$ TCN). Exathlon also has the smallest evaluation set of the six datasets (mean $n_{\mathrm{non}}=881$ over seeds, versus 1048–2711 for the others; only the shorter CATSv2 series, at 765, is smaller) and the easiest detection task (utility $0.998$). One possible explanation is that quantization perturbs the ordering of member and non-member reconstruction errors on Exathlon; the mechanism underlying this seed-dependent increase was not separately tested. The $1\%$ threshold is fully resolvable at this $n_{\mathrm{non}}$. On the tested CPU, INT8 is in fact slower on average: median batch-one latency rises from $0.090\pm 0.005$ to $0.218\pm 0.011$ ms (dataset-level SD; Figure 7b). The rise is driven by the Conv and TCN families, where the INT8–FP32 gap exceeds the within-architecture SD. Dense and LSTM run slightly faster under INT8, but that gain is more than offset by Conv and especially TCN, so quantization does not accelerate the mean artifact and its only reliable benefit here is storage.

Figure 7. Edge-deployment cost. (a) Artifact size (log scale) against the MCU-tiny and MCU-mid flash envelopes; INT8 shrinks models $3.2\times$ on average (Dense $3.8\times$, Conv only $1.5\times$) but Dense, LSTM and TCN exceed the 64 kB class, while only Conv partially fits it. (b) Batch-one latency: INT8 is slower than FP32 on average. Error bars are one SD across datasets; the dataset-level slowdown is driven by Conv and TCN, while Dense and LSTM are slightly faster under INT8.

Figure 8. INT8 quantization does not reduce membership leakage: most datasets’ attack AUCs under the executed INT8 artifacts lie near the FP32 equality line, with no dataset showing a meaningful reduction, while Exathlon rises substantially (from $0.62$ to $0.77$). Quantization is a storage optimization, not a privacy mechanism.

5.1. Resource-Envelope Screening

Against the three device classes of Section 3.6, all 84 INT8 artifacts pass the MCU-mid (512 kB) and MPU-edge screening on size and activation-memory lower bound; desktop-measured latencies clear the class deadlines but are indicative only, since deadline compliance on MCU silicon requires on-target validation. Only 12 of 84 pass the MCU-tiny 64 kB-flash size bound: Dense artifacts (∼196 kB) and the larger LSTM/TCN artifacts exceed 64 kB, so only Conv cells partially clear that envelope (Figure 7a and Figure 9). This is envelope screening: it establishes feasibility on the measured axes and does not substitute for on-microcontroller profiling of true peak SRAM and energy.

Figure 9. Resource-envelope screening: percentage of INT8 artifacts (per architecture) that fit each device class on size, activation-memory lower bound and desktop-measured latency. All architectures pass the MCU-mid and MPU-edge size/memory screening (desktop latency indicative only); only the Conv detector partially passes the 64 kB MCU-tiny class.

5.2. Noise-Multiplier Sensitivity and a Second Attack

The main-grid defense uses a single hyperparameter point $(\mathcal{C},\sigma )=(1, 1)$, which applies per-example clipping and Gaussian noise together. To test whether that point is an isolated fortunate one, a three-dataset subset (CreditCard, PSM, Exathlon) and two architectures (Conv, Dense), seed 0, was evaluated in three arms: the undefended baseline (no clip, no noise); clip-only ($\mathcal{C}=1$, $\sigma =0$); and clip plus $\sigma \in \{0.25, 0.5, 1, 2\}$. The resulting privacy–utility curves (Figure 10) show a consistent pattern. On CreditCard and PSM, leakage reaches near chance by $\sigma =0.25$–$0.5$ (CreditCard Dense: attack AUC $0.93\to 0.51$; PSM Dense: $0.73\to 0.49$). On Exathlon, where undefended Conv already leaks only modestly ($0.58$), residual leakage sits near $0.54$; Dense drops from $0.82$ to $0.54$. Further noise beyond $\sigma =0.5$ yields little additional privacy; on PSM Conv it does cost utility ($\sigma =2$ drops detection AUC from $0.86$ to $0.70$). Clip-only ($\mathcal{C}=1$, $\sigma =0$) leaves leakage essentially unchanged relative to the undefended baseline on every subset cell (CreditCard Dense $0.93\to 0.94$; PSM Dense $0.73\to 0.74$; Conv cells move by at most $0.01$), so the drop to near chance requires the Gaussian noise, not the clip. A drop-last control (batch 64, skipping the eight-window final batch) repeats the pattern on the subset (undefended attack AUC $0.57$–$0.97$; defended $0.48$–$0.54$), so the defense effect is not an artifact of the small final batch’s heavier noise. The reported $(\mathcal{C},\sigma )=(1, 1)$ point therefore sits on the flat, low measured-leakage region of the curve rather than at a fragile operating point, and it is not the strongest noise level we tested.

Figure 10. Clip-and-noise sweep on a three-dataset, two-architecture subset: undefended, clip-only (triangles; $\mathcal{C}=1$, $\sigma =0$), and $\sigma \in \{0.25, 0.5, 1, 2\}$ with clip held at 1. Each polyline is one (dataset, architecture) pair; markers distinguish Conv (circles) from Dense (squares). On CreditCard and PSM, leakage reaches near chance by $\sigma =0.25$–$0.5$; Exathlon Dense drops from $0.82$ to $0.54$. The main-grid point $\sigma =1$ lies on the near-chance attack-AUC plateau rather than at a fragile operating point. Color encodes the dataset and is redundant with the point labels.

A smaller subset (CreditCard and PSM, Conv, seed 0) was re-attacked with a pipeline-matched shadow-model likelihood-ratio attack (four shadows, Gaussian fit in log-error space, shadows trained with the same defense and the same $n=200$ budget as the victim; Table 5). Both attacks agree on AUC: the undefended detector leaks (CreditCard $0.70$ vs. $0.69$; PSM $0.60$ vs. $0.60$), and gradient noise at $\sigma =1$ returns both attacks to near-chance AUC ($0.49$–$0.50$). In this subset, the shadow attack also yields near-chance defended AUCs, supporting the loss-threshold AUC finding. This limited cross-check provides supporting evidence that the observed near-chance AUC is not solely due to the use of an uncalibrated loss score. Four shadows are a modest calibration budget; a larger LiRA-style attack could still raise the undefended numbers, and stronger attacks could still reveal residual leakage not captured by the present evaluation.

Table 5. Loss-threshold versus pipeline-matched shadow attack (Conv, seed 0, four shadows). Attack AUC (TPR@$1\%$FPR in parentheses). Chance is $0.5$ ($0.01$).

Dataset	Config	Loss-Threshold	Shadow
CreditCard	base	$0.698$ ($0.035$)	$0.689$ ($0.005$)
CreditCard	gnoise	$0.497$ ($0.020$)	$0.498$ ($0.015$)
PSM	base	$0.597$ ($0.020$)	$0.598$ ($0.015$)
PSM	gnoise	$0.491$ ($0.005$)	$0.504$ ($0.025$)

6. Discussion

6.1. On-Device Processing Does Not Ensure Privacy, and Mitigation Is Low-Cost

The principal result corrects a common assumption. A sensor anomaly detector that never transmits raw data can still disclose which windows it was trained on: its published anomaly score is a membership signal, and on the six datasets studied that signal is readily recovered (attack AUC 0.688; TPR 0.074 at the primary 1% false-positive rate, approximately seven times the chance rate). Data locality is therefore not, by itself, a privacy property. Equally important, the mitigation is inexpensive: adding gradient clipping and noise during training reduces measured leakage to near chance, not exact chance, on every dataset under the evaluated attacks, for a utility cost of 0.054 in detection AUC, and it does so without any change to the deployed artifact: the defended detector exports and executes exactly as the undefended one. The privacy cost is incurred at training time rather than at inference time, which is favorable for a resource-constrained node.

6.2. Privacy Should Be Measured, Not Inferred from Compression

The second point is methodological. Compression is frequently entangled with privacy claims, either as an assumed benefit or as an assumed harm, yet on sensor detectors, INT8 quantization is simply orthogonal to membership leakage: the executed INT8 artifact leaks as much as its FP32 source (Figure 8). That is consistent with Zhang et al.’s 4-bit PTQ result on image CNNs [12] and does not conflict with their 2-bit/$1.58$-bit reductions, which use a different operator (AdaRound/BRECQ/OBC rather than dynamic INT8 export), a different domain (classification CNNs rather than reconstruction autoencoders), and bit-widths this study does not ship. Quantization earns its place in this system for what it actually does, a $3.2\times$ storage reduction, not for a privacy property it does not have. More broadly, the privacy of a compressed edge model should be measured with an attack, as done here, rather than inferred from the compression scheme or from data locality.

6.3. Alignment with Industry Standards

The gap quantified here is exactly the one that emerging IoT security and privacy standards ask practitioners to close, which is why measuring it matters beyond the laboratory. Baseline consumer-IoT security requirements such as ETSI EN 303 645 [36] and the foundational device-cybersecurity activities of NIST IR 8259 [37] call for data protection to be demonstrated rather than asserted, and ISO/IEC 27400:2022, the IoT security-and-privacy guidelines, frames privacy risk as something to be identified and treated over the device life cycle [38]. A detector whose anomaly scores leak training membership is a concrete, previously unmeasured instance of such a risk. Under a data-protection regime like Regulation (EU) 2016/679 (GDPR) [39], which remains the applicable framework, recoverable membership is empirical evidence that training records can be singled out, in the sense of Recital 26. The EDPB has stated that whether an AI model trained on personal data is itself personal data is a case-by-case question of identifiability, including identifiability via attacks [40]; the CJEU likewise treats identifiability as turning on all means reasonably likely to be used, not on the data being anonymous on its face [41]. Demonstrating a successful membership-inference attack therefore supports, but does not by itself constitute, a legal determination that the trained detector is personal data or that a controller has disclosed personal data. The leakage reported here is a technical finding that such a determination may need to consider. Finally, the defense evaluated here is the empirical, gradient-noise form of the mechanism that NIST SP 800-226 treats as the basis for a formal differential-privacy guarantee [26]; this study measures its effect directly but stops short of the accountant-backed $(\epsilon ,\delta )$ statement that the standard prescribes, which is an explicit next step toward standards-conformant privacy, discussed below. Table 6 maps each instrument to the specific provision this measurement speaks to and to how this study addresses it; every provision cited was checked against the primary source.

Table 6. Alignment of the measured-privacy approach with IoT security and data-protection standards. Each row names the standard, the specific provision most relevant to model-level membership leakage (verified against the primary document), what it requires, and how this study addresses it. NIST IR 8259r1 (Apr. 2026) supersedes the withdrawn 2020 edition.

Standard	Relevant Provision	What It Requires	How This Study Addresses It
ETSI EN 303 645 v2.1.1 [36]	Clause 6, Prov. 6-4 (data minimization)	Where telemetry is collected, keep the processing of personal data to the minimum necessary for the intended functionality.	This study shows on-device processing alone does not achieve the minimization this provision anticipates—scores still leak membership—and adds a training-time defense that measurably reduces it.
ISO/IEC 27400:2022 [38]	Privacy-by-design principle; IoT privacy-risk controls	Identify and treat IoT privacy risks across the life cycle, designing privacy in from the outset.	This study identifies a previously unmeasured life-cycle privacy risk (score-based membership leakage) and evaluates a design-time control.
NIST IR 8259r1 [37]	Foundational activities: identify and address device risk before release	Manufacturers should determine and mitigate device cybersecurity/privacy risk prior to deployment.	This study provides a concrete pre-release test (a membership attack) and a training-time mitigation for it.
NIST SP 800-226 [26]	Evaluating differential-privacy guarantees	A differential-privacy claim requires an accountant-backed $(\epsilon ,\delta )$ bound, not merely added noise.	The gradient-noise mechanism is the empirical form; this study reports measured attack reduction and makes no $(\epsilon ,\delta )$ claim—a stated roadmap to conformance.
GDPR (EU) 2016/679 [39]; EDPB Opinion 28/2024 [40]	Art. 5(1)(c); Recital 26; identifiability of AI models (case-by-case)	Process only data necessary for the purpose; data is anonymous only if individuals cannot reasonably be singled out. An AI model trained on personal data is personal data only if identifiability, including via attacks, is reasonably likely.	Recoverable membership is empirical evidence of singling-out risk, not a legal finding that the model is personal data; the defense lowers that recoverability.

6.4. Threats to Validity

Attack: (a) The evaluated threat is the reconstruction-error (loss-threshold) membership attack, which matches what a deployed detector actually exposes. (b) Stronger shadow-model and white-box attacks [6,19] could narrow the apparent safety margin of the undefended detector; they cannot create privacy that the loss-threshold attack has already broken. (c) A pipeline-matched shadow-model check on a two-dataset subset (Section 5) is included so that the gradient-noise “near-chance” result is not carried by a single attack. Stronger attacks could still reveal residual leakage not captured by the present evaluation. (d) The positive control (planted memorization recovered at AUC $1.0$) establishes only that the attack path is sound, not that no stronger attack exists. Defense: (a) The gradient-noise mechanism is not formally differentially private: it has no privacy accountant and uses shuffling rather than Poisson subsampling, so no $(\epsilon ,\delta )$ claim is made and only measured attack success is reported. (b) A single $(\mathcal{C},\sigma )=(1, 1)$ point is used for the primary comparison; a subset sweep over the undefended, clip-only and four clip-plus-noise ($\sigma \in \{0.25, 0.5, 1, 2\}$) arms (Section 5) is reported so that this point can be read on a curve. Cost: (a) Deployment cost is resource-envelope screening on a desktop CPU (AMD Ryzen 5 5500GT, ONNX Runtime 1.27.0, single-thread CPUExecutionProvider), using real artifact size, an activation-memory lower bound, and measured batch-one latency. (b) This is not on-microcontroller execution; true peak SRAM and energy on target silicon are future work. Scope of data: (a) Six datasets, admitted by a stated functional-detector gate, support dataset-level significance but not a claim of universality. (b) The gate selects deployable detectors and may enrich for streams that a reconstruction model fits—and therefore might memorize—well; it should not be read as a random sample of all sensor time series. (c) With $n=6$, Wilcoxon $p=0.0156$ is the smallest attainable one-sided value and is reported together with bootstrap CIs and paired Cohen’s d rather than as a powered effect-size estimate. (d) The effect’s consistency across domains (sensor, facility, finance) is nonetheless notable.

7. Conclusions

Lightweight sensor anomaly detectors are increasingly shipped as privacy-aware on the strength of on-device processing, yet that claim is rarely tested. This paper tested it. Across six multivariate time-series datasets spanning sensor, facility and finance domains and four compact reconstruction-autoencoder architectures, a detector accurate enough to deploy leaks membership through its anomaly scores (attack AUC 0.688, and a true-positive rate of 0.074, roughly seven times chance, at a $1\%$ false-positive rate), so on-device processing does not by itself confer privacy. Those datasets were admitted by a held-out functional-detector gate, so the conclusions concern functional reconstruction detectors rather than an ungated sample of all sensor streams. A gradient-noise defense reduces measured leakage to near chance on every dataset (attack AUC → 0.508 as scored, 0.517 oriented away from chance, not exact chance; one-sided paired Wilcoxon $p=0.0156$, the smallest one-sided value attainable at $n=6$) for a utility cost of 0.054 in detection AUC. INT8 edge quantization shrinks the artifact $3.2\times$ but shows no demonstrated privacy benefit and increases mean inference latency on the tested desktop CPU; its demonstrated overall benefit in this evaluation is reduced storage.

The practical recommendation follows directly: treat the privacy of a compressed on-device detector as something to be measured with an attack and defended at training time, not inferred from data locality or from the compression recipe. The resource-envelope analysis is screening based on desktop measurements of artifact size, an activation-memory lower bound, and indicative latency; it is not evidence of actual microcontroller execution. The clearest next steps are to extend the evaluation to stronger, shadow-model and white-box attacks that could still reveal residual leakage not captured here, to replace the empirical gradient-noise defense with an accountant-backed differentially private mechanism carrying an $(\epsilon ,\delta )$ guarantee, and to confirm the resource-envelope screening with on-target microcontroller profiling of peak memory and energy.