dataesr/scientific-paragraphs-categorization huggingface dataset:
The second category of solutions acts at query-time. In this case, the InfDS detects when a user has queried enough knowledge to perform an inference attack. With respect to the requirements stated in Section 1, we will focus on InfDSs following this second approach. Chen et al. [12]  propose to tackle inference attacks by building first a Semantic Inference Model (SIM) representing the probabilistic dependencies between attributes. Then, a Semantic Instance Graph (SIG) is instantiated from the SIM to reflect its dependencies at instance level in the database and enrolled to detect the inference attacks. Their approach allows modeling of simple inference channels between attributes with some uncertainty limited to the conditional probabilities computed by the SIM. They use a common formalism, i.
e. , Bayesian Networks, to both model the inference channels and to keep track of the knowledge that users gain. The first limitation stem from the fact that the Bayesian Network is learned based on the data distribution of the database. Hence, this static approach implies that both the SIM and the SIG must be recomputed for each update (e. g. , insertion of a new value) in the database, which is not practical in the context of a constant stream of generated sensor data. Moreover, random variables are not suitable to represent the metadata related to the issued queries since the probability distribution of those metadata can be computed only after all queries are issued. Hence, the SIM and SIG can not be leveraged to keep track of the knowledge of users and to reason on temporal or spatial constraints in the context of IASD.
Guarnieri et al. [13]  propose a system where one module acts as a policy decision point whereas the other checks inference attempts. The latter relies on the security policy defining the inference threshold of sensitive information and the attacker model, which describes the user's a priori knowledge (i. e. , the inference channels). Then, based on the inference detection results, the first module decides whether to deliver the query answer or not. This approach allows modeling more general probabilistic inference channels than Chen et al. [12] , since it is not only limited to dependencies between values of attributes, but can represent domain-specific relationships between the data items or the attacker's prior knowledge. Similarly to Chen et al. , Garnieri's solution addresses inference detection with the strong assumption of static data in the databases which is not suitable for the continuously created stream of sensor data.
Furthermore, Garnieri et al. focus on analyzing only closed queries issued to the database, whereas we assume that users issue queries to obtain sensor data points to then exploit data mining algorithms, thus metadata related to queries is not considered in this work. El Mokhtari et al. [20]  introduce an inference control mechanism which can be coupled with an access control mechanism. The authors model FDs as inference channels thanks to a matrix. In each row, the first column is a sensitive data that an owner wishes to keep private, and all the remaining columns describe the attributes that must be known in order to infer the sensitive attribute. El Mokhtari et al. propose to affect weights to the nonsensitive attributes to reflect their influence on the inference attack. The inference control mechanism keeps track of the data previously queried by each user to check if, combined with a new queried attribute, a user is able to infer a sensitive attribute.
Hence, based on the weights of the accessed data, the proposed mechanism computes a percentage of completion towards an inference. When the completion reaches a given threshold, the query is rejected. Unlike Chen et al. [12]  and Guarnieri et al. [13] , the probabilistic representation of the inference channels relies on the weights affected to each attribute. It does not reflect the distribution of attribute values stored in the database that the mechanism protects. Moreover, the proposed model do not consider metadata related to the issued queries, since the exact queried attribute are modeled. The system presented by Brodsky et al. [21]  and extended by Toland et al. [10] , models the FDs within a database, using Horn clauses, in order to compute the disclosed knowledge each time a query is issued.
Then, based on the query log of the issuing user, the system either denies the answer or returns a fake one. To the best of our knowledge, the proposal of Toland et al. [10]  is the only one that considers tuple updates (i. e. , modification, deletion, or insertion) in the database by storing the most recent updates in the query history log. In their work, the FDs are limited to logical dependencies, thus probabilistic dependencies between data are not taken into account. They keep track and reason on the exact queried personal data, hence the modeled inference channels do not incorporate metadata related constraints. Moreover, since Toland et al. consider only personal databases, the dynamically of this solution has not been evaluated in the context of high frequency updates, such as the one produced by continuous insertion of sensor data.
In our context, an inference channel can be exploited via any sequence of queries while the resulting metadata satisfy the constraints. Hence, for a channel it is not possible to identify all the satisfying sequences of queries, thus tokens cannot be associated to metadata at design-time. Qi et al. [22]  aim at detecting and preventing inference attacks which occur when personal data are modeled as resource description framework (RDF) triplets. Their solution directly reasons on the set of triplets which are queried to check if a disclosure can occur. If so, the system can either deny to answer the query or delete triplets from the answer set in order to prevent the disclosure of sensitive data. This solution relies on domain specific ontology to perform the inference reasoning. To the best of our knowledge, ontologies do not exist to model and reason on temporal and spatial constraints related to metadata of queries on sensor databases.
Furthermore, they consider the disclosure of sensitive triplets without keeping track of the knowledge that users gain by issuing queries. Hence, in addition to the lack of suitable ontologies, their solution is not suitable to model metadata about queries and to reason efficiently on knowledge gained via multiple issued queries. In this article, we focus on protecting a single sensor database with an InfDS. Yet, a few InfDSs are proposed to detect inference attacks in a multi-database context, as described by Jebali et al. [23]. For the shakes of completeness we present, briefly, the limitations that also exist in those works with regard to our requirements. Both Chang et al. [16]  and Lachat et al. [24]  represent inference channels as probabilistic dependencies between attributes. They both have the same limitations as Chen et al.
's solution. Sellami et al. [25]  focus on data integration systems where a unique view is provided to users by combining the results of a query issued to all databases. The authors consider simple FDs between attributes, their solution does not consider metadata related to the processed queries, nor temporal or spatial constraints that user's knowledge must satisfy to exploit a FD. Jebali et al. [26]  focus on data outsourcing and propose a solution which maintains access control policies of data owner while controlling inference leakage. To do so, they model the FDs graph corresponding to inference channels in the initial relational schema. When a user issues a query to the local database, the role-based access control mechanism checks if the user has the grant to access the queried data.
Case Study: MHEALTH Dataset and Human Activity Inferences The purpose of our case study is to model as an inference channel, an example of data mining algorithm applied to sensor data  [2] [3] [4] [5] [6] [7] [8] [9]. Hence, we need a detailed enough description of the mining process, in order to retrieve information related to the preprocessing of data. Those information represent the pre-requisite knowledge on sensor data that an attacker must have in order to infer then the mined personal data. Moreover, we aim to model a simple situation where the mined data are linked to a single individual. In this paper, we consider as a case study MHEALTH, a public dataset published by Banos et al. [2]  for recognition-based human activity. The authors describe the training process with good details, which enable us to extract the information required to model the inference channel.
The dataset contains observations (such as acceleration, turn rate, etc. ) from three wearable sensors placed on the chest, the right wrist, and the left ankle of a human being. Hence, the mined data are related to a single individual. Each sensor makes observations with a fixed frequency while a volunteer is doing each of 12 identified human activities (e. g. , walking, cycling, etc. ). The measures have been performed on 10 volunteers. The gathered sensor data are represented as a tuple of 23 attributes (e. g. , x, y, and z axis for the acceleration) and the 24th attribute represents the label of the activity performed by the volunteer during the measurements. The authors aim to train a decision tree on this dataset in order to classify the measures into one of the activities. To do so, they consider 21 among the 23 attributes, since they judge that the two electrocardiogram measures from the chest sensor are not needed for a first evaluation.
• Although the operation mode in the case of personal data remains the same: it is based on a knowledge of semantic links among data in a databases (e. g. , the first and last name of an individual are both stored in two distinct databases) or it is based on the exploitation of the content of a database to deduce the value of an attribute (e. g. , a functional dependency between the rank and the salary attributes can be exploited to infer the salary of a given individual), in the case of sensor data, the relationship between sensor data and personal data is a young and emergent research domain that uses machine learning techniques to be established  [1] , this external knowledge keeps increasing in diversity and volume.
Data streams registered in the protected data stream management system (DSMS) are denoted by the set S. Each stream s ∈ S is composed of a set of attributes denoted by A s corresponding to sensor attributes. Thus, the set A = s∈S A s of all attributes measured by sensors describes all the queryable attributes in the sensor database. Finally, accessing an attribute can be restricted to temporal intervals (t b , t e ) ∈ T, t b ≤ t e (i. e. , the beginning and ending timestamps). Detecting inferences at run-time implies that an InfDS reasons on the accessed data of each user u ∈ U having issued at least one query on the database. Let MK represent the set of all the metadata describing data extracted by the users via queries. The smallest metadata extracted is called a Metadata Knowledge Unit (MKU) and defined as a tuple mku = a, c ∈ MK where a ∈ A and c ∈ T is a selection condition, and whose meaning is that the user has asked for the attribute a where the condition c is true, e.
g. , c = (t b = 1, t e = 4). Each query issued by a user u will be represented in the user knowledge by Q u = {mku Q u 1 ,. , mku Q u n } ⊆ MK. For instance, the query SELECT a 1 , a 2 FROM s WHERE INTERVAL (t b , t e ) issued by user u leads to the extraction of the metadata set Q u = { a 1 , (t b , t e ) , a 2 , (t b , t e ) }. To keep track of the MKUs of each user, the system relies on a Query History Log (QHL). Formally, the log is a function QHL : U → MK mapping a user u to their respective set of MKUs extracted after issuing a set of queries at an instant t. For instance, after issuing 5 queries, the log of a user u is QHL(u) = 5 i=1 Q u i. Sensors 2022, 1, 0 8 of 26 Finally, accessing an attribute can be restricted to temporal intervals (t b , t e ) ∈ T, t b ≤ t e (i. e. , the beginning and ending timestamps).
Detecting inferences at run-time implies that an InfDS reasons on the accessed data of each user u ∈ U having issued at least one query on the database. Let MK represents the set of all the metadata describing data extracted by the users via queries. The smallest metadata extracted is called a Metadata Knowledge Unit (MKU) and defined as a tuple mku = a, c ∈ MK where a ∈ A and c ∈ T is a selection condition, and whose meaning is that the user has asked for the attribute a where the condition c is true, e. g. , c = (t b = 1, t e = 4). Each query issued by a user u will be represented in the user knowledge by Q u = {mku Q u 1 ,. , mku Q u n } ⊆ MK. For instance, the query SELECT a 1 , a 2 FROM s WHERE INTERVAL (t b , t e ) issued by user u leads to the extraction of the metadata set Q u = { a 1 , (t b , t e ) , a 2 , (t b , t e ) }.
To keep track of the MKUs of each user, the system relies on a Query History Log (QHL). Formally, the log is a function QHL : U → MK mapping a user u to their respective set of MKUs extracted after issuing a set of queries at an instant t. For instance, after issuing 5 queries, the log of a user u is QHL(u) = 5 i=1 Q u i. query |= SELECT attributes FROM streams WHERE conditions attributes |= a ∈ A | a ∈ A , attributes streams |= s ∈ S | s ∈ S , streams conditions |= condition | condition AND conditions condition |= INTERVAL (t b , t e ) ∈ T Figure 2. Theoretical grammar of queries issued on data streams. A summary of the symbols definition is listed in Table  1. Focusing on the inference channel of our case study MHEALTH which is based on a temporal duration, an attacker will aim to query data points related to the 21 required sensor data for a common temporal interval of at least 2 s.
Each inferrable attribute is modeled by a random variable X such that ∀a in f ∈ A in f : X : dom(a in f ) → [0, 1], X ∈ X. The set X contains the inferrable attribute knowledge of each inference channel. X ∈ X represents the percentage of confidence, as a probability distribution, of each value a user u obtains when exploiting an inference channel with their QHL. Finally, the description of Figure  2. Theoretical grammar of queries issued on data streams. A summary of the symbols definition is listed in Table  1. Focusing on the inference channel of our case study MHEALTH which is based on a temporal duration, an attacker will aim to query data points related to the 21 required sensor data for a common temporal interval of at least 2 s. For example, the user queries SELECT a 1 ,. , a 21 FROM mhealth_stream WHERE INTERVAL  (1, 4)  issued by a user u results in Q u = { a k , (1, 4) | 1 ≤ k ≤ 21 }.
Generic Workflow of RICE-Sy The architecture of our RICE-Sy, illustrated in Figure  3 , is composed of two main parts. The knowledge base maintains the QHL of each user and the ICR contains known inference channels descriptions. We assume those descriptions to be provided by a third-party entity. For example, the administrator of a RICE-Sy instance can review the scientific literature describing mining process on data from the same domain as the data protected by the instance. Each time a new inference channel is identified, the administrator models it and adds it to the ICR. The reasoner detects inference occurrences based on the content of the knowledge base. The QHL size grows every time a query is processed whereas the ICR size increases only when new channels are modeled in the system.
The system maintains the following invariant status: the QHL of any user does not satisfy the conditions of any inference channel stored in ICR. This can be formally expressed as ∀u ∈ U, ∀i ∈ I, MK u P = p∈P i p(QHL(u)) : MK u P = ∅ ∨ ∃ f ∈ F i : ¬ f (MK u P ). Thus, considering the QHL of a user at any time, the only case where the user can reach the inference channel conditions is by receiving a query Q u , such as Q u content, added to the user's QHL allows them to reach the inference channel conditions. The query processing by RICE-Sy is the following (cf. Figure  4 ): the MKUs contained in Q u are first extracted and sent to the system. Then, the pre-processing module retrieves all the MKUs from the QHL(u) and produces the set MK u Q∪QHL = Q u ∪ QHL(u). The detection module, second module of the reasoner, checks if a subset of MKUs in MK u Q∪QHL allows the user u to exploit one of the modeled inference channels , in which case the detection system notifies the database system sending a binary value , otherwise, the user receives the data they asked for and their QHL is updated by inserting the MKUs of Q u into QHL(u).
Steps of the Conceptual Optimizations According to  [27] , selection queries on time series databases are executed in 80 ms on average. Performing the detection of inference at query time implies increasing the query answer time. In order to let RICE-Sy action time acceptable, we assume that the average detection time must take at most as long as the query execution itself. To reach this objective, we present in this section a set of conceptual optimizations. As described in Section 5, the role of the pre-processing module is to compute the set Q u ∪ QHL(u) that serves as input to the detection module, each time a query is issued. We recall the invariant status of the QHL, when a new query is processed the detection module needs only a subset of QHL(u) to check if an inference is occurring or not.
Optimized QHL As a first conceptual optimization, we propose to reduce the number of MKUs stored in the QHL. In order to detect inference attempts, the detection module consolidates the input MKUs. This process is defined by the function consolidate : MK → CMK ⊆ MK which takes as input a set of MKUs and searches sequences { a i , c 1 ,. , a i , c m } where a i ∈ A and the m conditions can be merged into a unique condition c 1m equivalent to {c 1 ,. , c m }. Furthermore, the system consolidates QHL(u) with Q u for MKUs related to the same attributes, assuming that the DSMS pre-processes each query so that MKUs within Q u are already consolidated. The QHL is now defined by the function OpQHL : U → CMK and referred to as the Optimized Query History Log (OpQHL). To compute OpQHL(u), the consolidation relies on the rules illustrated in Figure  5.
Algorithm 2 formally describes the consolidation module. The worst case occurs when the set A Q u of attributes referenced by MKUs in Q u is equal to the set of attributes referenced by MKUs in OpQHL(u). The consolidation step processes every MKU in Only the MKUs from a query and from a QHL which are referencing the same attribute and are nested or overlapping, as defined in Figure  5 , are needed for consolidation. When consolidating QHL(u) with a query Q u , it is, thus, not necessary to take the whole set OpQHL(u) as an input. For instance, when receiving Q u 2 of the example, cf. Section 5. 1, the query-based filtering step will retrieve from the QHL only MKUs referencing a 12 to a 21 which are overlapping or nested in the temporal interval  (1, 4) , if any. Thus, filtering only this subset from OpQHL(u) enables the consolidation module to reason on the relevant MKUs, and thus reduces the detection time.
Optimized RICE-Sy Workflow To summarize, cf. Figure  4 , once receiving a new query Q u issued by a user u the query based filtering extracts from OpQHL(u) the subset of MKUs MK u cons which can be consolidated with Q u. The consolidation will compute the set MK u new of the new consolidated MKUs, the set Q u new of MKUs from Q u which did not lead to a new consolidated MKU or are not nested in a MKU from MK u cons , and, finally, the set MK u old containing the MKU from MK u cons which lead to a new consolidated MKU. The search space filtering extracts from OpQHL(u) the subset of MKUs MK u detec which must be processed with Q u new ∪ MK u new by the detection module in order to check if a user u attempts to exploit one of the inference channels described in the ICR. In case no inference is detected, OpQHL is updated by first removing all the MKUs which have been used to consolidate new MKUs (i.
Evaluation of the Conceptual Optimizations To demonstrate the feasibility of detecting inferences involving raw sensor data, we have implemented RICE-Sy using the probabilistic logic programming language ProbLog 2  [28] , to model and reason on the inference channel of our case study. This language has logical mechanisms similar to the Prolog language to reason about truth values and allows the definition of probabilistic distributions over atoms. The choice of ProbLog is motivated by the possibility of implementing our inference channel representation (e. g. , the random variable X 1 using annotated disjunction). Moreover, we plan in the future to incorporate probabilistic dependencies related to personal data, similarly to what Chen et al. [12]  have proposed, in order to have an InfDS handling inference channels using the Distributed Dependency Strategy (DDS)  [29]  on personal and sensor databases.
The OpQHL is implemented as a MySQL database and the two filtering modules are SQL queries. Finally, the consolidation is implemented in Python as well as the general logic which links all the modules together. At this stage, the system processes every issued query. Hence, when an inference attack occurs, it means that a user has gathered all the required knowledge to satisfy the constraints of a known inference channel. Hence, at this stage, evaluating the accuracy of the system is not relevant since no attack can be missed with respect to the modeled channels. In the two following sections, we focus on evaluating the impact of the proposed conceptual optimizations on RICE-Sy.
Evaluating the OpQHL As described in Section 6. 1, a QHL containing two MKUs which are referencing the same attribute for an overlapping time interval, e. g. , mku 1 = a,  (1, 5)  and mku 2 = a,  (3, 7)  , can be optimized, with respect to the size, into the OpQHL containing only mku = a,  (1, 7). This way, the OpQHL provides a size gain compared to the initial QHL, while keeping track of the same user knowledge. In order to evaluate the impact of the OpQHL, the only relevant metric is to consider the percentage of size gain obtained via the consolidation of MKUs. To do so, we first generate the MKUs. Each generated sequence contains one MKU for each of the 21 attributes in our case study, see Section 3. The MKUs in a sequence do not temporally overlap MKUs in another sequence. A total of 10 sequences are generated, resulting in a default dataset of 210 MKUs.
Here, it is important that the same set of MKUs are considered in both the QHL and the OpQHL in order to measure a relevant size gain. Hence, the number of MKUs is chosen arbitrarily. To consider the size gain of the OpQHL, with respect to the number of consolidations, we generate a total of 11 datasets based on the default one. For each of those datasets, we increase the value of the threshold parameter P c ∈ [0, 1] by a step of 0. 1, then for each sequence in the default dataset and each MKU, we randomly decide if the MKU will be consolidated. When it is the case (i. e. , rand() ≥ P c ), we replace the selected MKU with two overlapping MKUs referencing the same attribute. For each resulting dataset, we insert it into the QHL. Then, using the Algorithm 2, we compute the corresponding OpQHL, and we finally measure the gain of size provided by the OpQHL.