# Enhancing User Experience with Visual Controls for Local Differential Privacy
## 7 Discussion and Limitations  
**Computational Overhead. ** We believe that the computational overhead of real-time differential privacy mechanisms on resource-constrained IoT devices would be negligible as there is not much heavy processing involved and IoT processing powers such as in smart speakers and hubs are increasing. As discussed in Section 4.3, the Gaussian mechanism was implemented to privatize voice command data, using basic operations such as logarithm, square root, and random noise generation. The time complexity of the mechanism is in \(O(n)\), where \(n\) is the number of data points to which noise is added. The space complexity is also \(O(n)\) as we only store the input data and the generated noise vector. This means that the runtime and memory usage scale linearly with the data size, which is optimal and highly suitable for IoT scenarios that process small-to-moderate batches of sensor or command data. This theoretical analysis aligns with previous research. [PERSON] and [PERSON] [23] emphasize that basic LDP mechanisms with Laplace or Gaussian mechanisms are designed to be computationally lightweight, relying primarily on simple arithmetic operations, making them feasible for edge deployment. [PERSON] et al. [24] confirm that the local noise addition incurs linear complexity that can be efficiently executed on edge devices with minimal delay. In our experiment with a real-world voice command dataset, we also found it very efficient in adding noise in real time and integrated into an interactive privacy interface, providing responsive feedback. **Semantic Preservation. ** In this work, utility is evaluated based on the resemblance of transformed words to original inputs. However, this may seem to overlook semantic preservation. For example, flipping a word such as \"music\" to \"lights\" may preserve the overall meaning of a command (e.g., \"turn on lights\" vs. \"play music\"), which could be seen as undermining perceived privacy protection. However, the transformation of commands between different categories (e.g., \"music\" to \"lights\") is not a weakness but rather a deliberate feature that demonstrates privacy protection in action. When users select higher privacy levels, their commands should intentionally be transformed into different categories to provide stronger privacy guarantees. Our interface makes these transformations explicit and transparent, helping users understand how their privacy choices affect their data. The visible changes in commands serve as concrete evidence of privacy protection, rather than undermining it. **Privacy Protection. ** Applying LDP at the word-level may not fully protect privacy, as the sequence of commands could still leak sensitive patterns. However, our implementation applies LDP to command categories and actions as complete units and not to individual words. For example, we transform \"activate music\" as a complete command category, not by separately transforming \"activate\" and \"music\". This approach maintains the semantic integrity of commands while providing privacy protection at the appropriate granularity for smart home interactions. **Other Security Applications. ** Our visual control model can be extended beyond privacy. The intuitive interface we developed could be generalized to configure security settings in smart home environments. Users could adjust firewall sensitivity, intrusion detection levels, or device authorization policies using similar visual metaphors (sliders,before-and-after examples). For instance, a \"Security Level\" setting might visually demonstrate how more restrictive settings would block unknown devices or limit third-party integrations. This approach aligns with Human-Computer Interaction (HCI) principles by making complex security decisions comprehensible and actionable, especially for non-technical users. **Limitations. ** Our current approach has the following limitations that require further study. (a) Experimental Validation: Our experiments rely on results from a single voice command dataset.