Privacy-Preserving Explainable AIoT Application via SHAP Entropy Regularization

1. Problem Statement

The integration of Artificial Intelligence of Things (AIoT) in smart homes (e.g., for energy management) relies heavily on Explainable AI (XAI) methods like SHAP (SHapley Additive exPlanations) and LIME to ensure transparency and user trust. However, a critical vulnerability has emerged:

• Privacy Leakage via Explanations: Recent studies indicate that post-hoc explanation methods can inadvertently leak sensitive user information.
• Specific Risks: In smart home energy forecasting, SHAP values can reveal fine-grained behavioral patterns (e.g., occupancy, sleep schedules, cooking times, and specific appliance usage).
• The Gap: Existing privacy-preserving techniques (Differential Privacy, Federated Learning) focus on protecting raw data or model parameters but fail to address the privacy risks inherent in the explanation outputs themselves. Furthermore, there is a lack of research on explanation-based regularization to mitigate Membership Inference Attacks (determining if a specific user's data was in the training set) targeting SHAP values.

2. Methodology

The authors propose a novel approach that integrates SHAP Entropy Regularization directly into the training process of a deep learning model.

A. Core Concept: SHAP Entropy Regularization

The method penalizes models that produce low-entropy SHAP attribution distributions.

• Low Entropy: Indicates the model relies heavily on a few dominant features (memorization), making it easy for an adversary to infer specific user behaviors or membership.
• High Entropy: Indicates a more uniform distribution of feature importance, making explanations less predictable and harder to link to specific individuals.

The total loss function ($L_{total}$) is defined as:
$$L_{total} = L_{mse} + \lambda \cdot (\alpha - H_{SHAP}(x))^2$$
Where:

• $L_{mse}$: Mean Squared Error (prediction accuracy).
• $H_{SHAP}(x)$: Shannon entropy of the normalized SHAP values for input $x$.
• $\alpha$: Target entropy threshold.
• $\lambda$: Hyperparameter controlling regularization strength.

B. Model Architecture

• Base Model: A Long Short-Term Memory (LSTM) regression network, chosen for its ability to handle temporal dependencies in sequential smart home energy data.
• Training Process: The model is trained adaptively. For each batch, the average SHAP entropy is computed and used to update the weights via the regularized loss function, forcing the model to distribute feature importance more evenly without sacrificing predictive accuracy.

C. Threat Model & Attack Suite

The authors define a Gray-Box (Semi-White-Box) threat model where an adversary has access to SHAP explanation outputs (via APIs or dashboards) but not the raw training data or model parameters. To evaluate privacy, they designed a suite of five SHAP-based privacy attacks:

1. SHAP Entropy Attack: Identifies memorized samples by detecting unusually low entropy in SHAP vectors.
2. SHAP Similarity Attack: Uses Cosine Similarity to check if a test sample's explanation vector is too similar to training vectors.
3. SHAP Divergence Attack: Uses Jensen-Shannon Divergence (JSD) to measure statistical similarity between SHAP distributions of test and training data.
4. SHAP Rank Correlation Attack: Uses Spearman's rank correlation to detect if the ordering of feature importance is preserved between test and training samples.
5. SHAP Rank Consistency Attack: Uses Kendall's Tau to measure ordinal consistency in feature rankings.

3. Key Contributions

1. Novel Regularization Technique: Introduced the first method to use SHAP entropy regularization to mitigate privacy leakage in AIoT applications, specifically targeting membership inference attacks on explanation outputs.
2. Specialized Model: Developed a SHAP entropy-regularized LSTM capable of capturing temporal dependencies in appliance-level energy data while enforcing privacy constraints during training.
3. Comprehensive Attack Framework: Designed and implemented a suite of five distinct SHAP-based inference attacks to rigorously evaluate privacy risks from multiple angles (distribution, rank, similarity).
4. Empirical Validation: Conducted extensive experiments on the REFIT smart home energy dataset, comparing the proposed method against a standard Baseline LSTM and a Differential Privacy-enabled LSTM (DP-LSTM).

4. Experimental Results

The study was conducted on data from three UK households (REFIT dataset) involving 10 power sensors (aggregate + 9 appliances).

• Privacy Performance:

  • The SHAP-Regularized LSTM consistently outperformed both the Baseline LSTM and DP-LSTM across all privacy metrics.
  • Higher Entropy: Achieved significantly higher SHAP entropy (e.g., ~6.2 vs. ~5.3 for Baseline in House-2), indicating more uniform feature attribution.
  • Lower Leakage: Demonstrated lower scores in Similarity, Divergence, Rank Correlation, and Rank Consistency attacks, making it much harder for adversaries to infer membership or specific behaviors.
  • Comparison with DP: While DP-LSTM offered some privacy, it often resulted in overly smooth/near-zero SHAP values (degrading utility) and did not match the privacy protection levels of the entropy-regularized model.

• Utility Performance:

  • The proposed method maintained high predictive accuracy.
  • The Mean Absolute Error (MAE) was comparable to the Baseline LSTM, with only a minor utility overhead (slightly higher MAE in some cases) compared to the significant gains in privacy.

• Visual Analysis:

  • Heatmaps showed that the Baseline LSTM produced concentrated, predictable patterns (e.g., high Kettle usage at specific times), whereas the Regularized model produced diverse, less concentrated attributions, effectively obscuring specific user routines.

5. Significance and Impact

• Bridging the Gap: This work addresses a critical blind spot in XAI: the privacy risks of the explanation itself. It moves beyond protecting data to protecting the interpretability of the model.
• Regulatory Compliance: By reducing the risk of re-identifying users or inferring sensitive habits from explanations, the method aids compliance with regulations like GDPR and CCPA, which mandate data minimization and privacy.
• Trustworthy AIoT: It provides a practical framework for deploying transparent AI in smart homes without compromising user privacy, fostering greater user trust in automated energy management systems.
• Future Directions: The authors suggest extending this to multimodal data and developing adaptive mechanisms to balance privacy and explanation fidelity in real-time.

In conclusion, the paper demonstrates that SHAP entropy regularization is a superior, lightweight, and effective strategy for securing explainable AI in IoT environments, offering better privacy protection than traditional Differential Privacy methods while maintaining model utility.