# Enhancing User Experience with Visual Controls for Local Differential Privacy
## 4 Proposed Privacy Mechanism
### Privacy Mechanism Implementation  
**Assumption.** We assume that Gaussian noise is appropriately scaled for categorical data, with numerical encoding preserving category relationships. Users within the same age range and fluency level are assumed to have similar command patterns. We use a standard delta value (\(\delta=1\times 10^{-5}\)) and apply differential privacy to provide additional protection beyond the pre-anonymized age data.  
We implement the Gaussian mechanism for voice command privacy preservation in our apply_gaussian_mechanism(data, epsilon, delta = 1e-5) function as shown in Listing 1, where data is the original sensitive data we wish to privatize, and epsilon is the privacy parameter, which controls the trade-off between privacy and accuracy. The mechanism works by generating random noise from a normal distribution with \(\sigma\) value by calling sqrt(2 * mp.log(1.25/delta))*(sensitivity/epsilon) that is proportional to the sensitivity of the data and inversely proportional to the privacy budget.  
```
defapply_gaussian_mechanism(data,epsilon,delta=1e-5): sensitivity=1.0 sigma=np.sqrt(2*np.log(1.25/delta))*(sensitivity/epsilon) scale_factor=np.std(data)/10 noise=np.random.normal(0,sigma*scale_factor,size=len(data)) returndata+noise
```  
Sensitivity is the maximum change in the output if a single record in the dataset is modified. A smaller epsilon provides stronger privacy guarantees but adds more noise. The utility measurement algorithm employs a normalized relative error in a [0, 1] range, where 1 indicates perfect utility (no difference) and values approaching 0 indicate significant differences. Hence, stronger privacy protection leads to lower data utility, while maintaining high utility requires accepting weaker privacy guarantees.  
Voice command data undergoes numerical encoding for Gaussian mechanism application. Each category receives a unique index (e.g., \"music\" = 0, and \"lights\" = 1) through a bidirectional mapping system. After noise addition, values are rounded to the nearest integer and converted back to categories. For example, a noisy value of 0.7 rounds to 1, transforming \"music\" to \"lights\". While rounding off is usually worse than projection to the space of all possible output in the literature of differential privacy, our decision to use rounding was made after careful consideration of several factors: (a) We are dealing with voice commands that need to map to clear categories, such as \"music\" and \"lights\". (b) Users need to understand what their commands might change into. Rounding helps maintain clear and understandable categories, where maintaining interpretable discrete categories is essential for the user interface. (c) In IoT settings, computational efficiency and simplicity are crucial. (d) This trade-off is consistent with our focus on usability.  
This encoding method preserves the ordinal relationships between categories while enabling the application of the Gaussian mechanism, though it is important to note that the original categorical data may not have inherent ordinal properties. The observed category transformations are thus influenced both by the magnitude of the added noise and the specific numerical encoding assigned to each category. While our implementation uses direct numerical encoding with the Gaussian mechanism, Format-Preserving Encryption could offer a more sophisticated approach by maintaining semantic relationships between categories. This would ensure transformations occur between semantically related commands (e.g., \"increase volume\" to \"decrease volume\" rather than \"change language\").