Stickybit.← TelemetryPortuguêsCase · privacy · measured
Case · smart meter, glucose, water, GPS

"Raise the tolerance and gain privacy." We measured. It does not work.

The idea is appealing: if the compressed file loses detail, loosening the tolerance should hide the routine of whoever lives in the house. We tested it on five real channels. The promise fails in four, and in the fifth it only survives with three caveats that make it unworkable as written.

Measured on five public datasets
Specimen · the tolerance dial on a real house (electricity, 1 minute)
snoop's hit rate on the routinehit rate on large appliances

0hit rate on the routine
0on large appliances
0the electricity bill

Measured: a real house from the AMPds2 dataset (Canada), 730 days, 70,080 windows. The "snoop" is deliberately lazy: a single calculation, no training. A real snoop sees at least this much.

In everyday terms

A noise gate around the signal.

TUBE draws a tolerance band around the signal and only records when the signal leaves it. It works like a studio noise gate: the low hum stays silent, and the voice gets through. In a house, the fridge cycling stays inside the band; a 3 kW kettle breaks out and gets recorded.

Hence the promise: if widening the band erases detail, it would erase habits too, such as when you wake up, shower or leave home. A single number, already in the billing contract, would take care of two things: the right bill and a protected routine.

Too good to be true. The problem is what is left: the compressor keeps the biggest surprises for last, and the biggest surprise in a house is precisely the most recognisable human event.

tolerance band: silence inside fridge: inside the band 3 kW kettle: breaks out, gets recorded record · record · record time →
Inside the band, silence. Each time the signal breaks out, a record is written, and each record is a fact about the house.
How to measure a promise

Three pieces, and the losing condition written first.

Every channel was measured the same way. Before running any number, we wrote down in the repository what would have to happen for the idea to die. When one of our predictions failed (and one did), it was recorded.

The contract: what the channel must deliver. The monthly bill total (INMETRO class B: 1%), time-in-range for glucose, litres per month, trip distance. With a sum receipt of about 2 bytes a day, the contract stays exact at any tolerance.

The lazy snoop: a single calculation, no training, no model, such as the variation of consumption over 15 minutes or the share of consumption during daytime. If it already sees something, real snoops see more. Our number is always a floor on leakage, never a ceiling.

The hidden answer key: the truth the snoop never sees (was the washing machine on? did the patient eat?). The score is the snoop's hit rate: 0.5 is a coin toss; 1.0 is always right.

the contractthe bill, thelitres, the distancethe lazysnoopone calculation, notrainingthe answerkeythe truth it neversees
The three pieces of each measurement: what the channel promises to deliver, a deliberately simple snoop, and the hidden truth that decides who was right.
The only channel where the dial exists

And it turns the wrong way first.

In a real house measured minute by minute, the snoop starts at 0.699 with no compression. Three things happen as the tolerance goes up, and none was in the brochure:

Within what the bill tolerates, nothing changes. At the largest value billing accepts without a receipt (about 50 W for class B), the hit rate sits at 0.707. What saves the contract is the 2-byte daily receipt, and only then is the dial free to turn.

A moderate tolerance helps the snoop. Between 100 and 250 W, the hit rate rises to 0.719: compression erases the jitter of automatic appliances and hands the snoop a cleaner signal.

The floor is made of large appliances. Even at 5,000 W, with the whole house reduced to about 100 bits a day, appliances above 2 kW keep a hit rate of 0.793.

And the curve belongs to the house, not the method. We repeated it on 6 UK houses hoping to find a formula ("for houses like this, use such tolerance"). The spread between curves came out at 0.71, seven times above the limit we had set for a formula to exist. In two houses, compressing harder increased how much what is left tracks the kettle: compression distils the human event.

the bill needs no receipt0.50501002505001000250050000.4890.719routineappliances > 2 kWtolerance (W) →
The dial's real curve (AMPds2, 730 days). In the shaded band, where the bill needs no receipt, nothing changes. Then the curve rises before it falls, and the dashed line shows the floor: large appliances cross any tolerance.
The structural finding

The bill and the routine live in the same box.

In 200 London houses, measured every 30 minutes (the resolution Brazilian meters will report), the snoop tries something simple: telling weekdays from weekends by the share of consumption during daytime. With no compression, 1 house in 4 is identifiable. Turning the tolerance up past the typical reading itself, the median hit rate moves from 0.587 to 0.572. Nothing.

The reason is algebra, not chance. The routine is a sum (the daytime share of consumption). Compression bounds the error of each reading, and sums cross the tolerance almost intact. That is exactly why the bill survives any tolerance. The mechanism that preserves the bill preserves the leak.

The amplitude dial only reaches what lives in fine detail (spikes, cycles, variations). What lives in sums and averages it never touches.

fine detailkettle spikes, cycles, transitions the dial ERASES this (with a per-house curve) sums and averages
the monthly bill, the daytime share (the routine), average speed
the dial NEVER touches this ✕
The two boxes. The tolerance dial only reaches the top box. Contract and secret must live in different boxes for the dial to protect anything, and that only happens on the 1-minute electricity channel.
The other three channels

Glucose, water and GPS: the same verdict.

Continuous glucose. Across 117 hospital stays with meal diaries, detecting a meal starts at 0.798 and still scores 0.640 when the tolerance (50 mg/dL) has already destroyed the clinical contract: 96.8% of time-in-range becomes undecidable. A meal rises 50 to 150 mg/dL and crosses any useful tolerance. The good news: hypoglycaemia is detected 100% of the time at any tolerance, because the compressor keeps for last exactly what medicine requires.

Water. In an apartment with every tap metered, the shower stays recognisable (0.963) when the toilet has already dropped to 0.640. Intimate events only become unrecognisable at a tolerance where the daily litre total is already 100% wrong: privacy arrives together with the death of the contract. As a bonus, our own sanity check found the dataset's published aggregate corrupted at the source.

GPS. Across 973 labelled trips (walking or motorised), the mode of transport lives in average speed, which compression preserves. At a 10 m/s tolerance, the contracted distance is already 62% off and the snoop still scores 0.923. Anyone selling "privacy-preserving telematics by reducing resolution" is selling a product that does not exist.

ChannelContractSecretThe tolerance dial
Electricity · 1 minmonthly totalfine activityworks, but per house, with a floor, and only with a receipt
Electricity · 30 minmonthly totalweekly routinedoes nothing: same box
Glucosetime in rangemealsdoes not protect: the contract dies first
Waterlitres per dayintimate eventsdoes not protect: they die together
GPSdistancemode of transportdoes not protect: distance dies first, always
What is left standing

The report nobody provides.

The promise died; the instrument that killed it is the product. For a channel compressed at tolerance X, the report states with numbers: what the contract guarantees (total, time in range, distance, with a receipt signed in GIRDER), what leaks and to which snoop, and what this mechanism will never protect.

The legal hook is direct. Under Brazil's data-protection law (LGPD, art. 12), "anonymised" data only escapes the law if it cannot be reversed by reasonable means. A one-calculation snoop, with no training, that recognises routine at a 0.80 hit rate is the practical definition of "reasonable means". The hit-rate-by-tolerance curve is the number that decides article 12, and today that claim is made with an adjective.

For anyone who wants to erase routine, the advice is to turn a different dial: time. Report daily totals with a receipt, instead of the minute-by-minute signal.

Three words from this page
Snoop's hit rate

The score of a detector trying to guess the routine: 0.5 is guessing, 1.0 is always right. In the original, AUC.

Sum receipt

About 2 bytes a day with the exact total. Keeps the bill right at any tolerance.

Anonymised

Under the LGPD, data that cannot be reversed by reasonable means. It is a claim you measure, not an adjective.

Limits

Where this could be wrong.

A floor, not a ceiling

Our hit rate is that of a simple, declared snoop. Better snoops see more. It is never a privacy guarantee.

Numbers do not generalise, laws do

The values hold for these datasets. The structural laws (sums cross the tolerance) hold everywhere, because they are algebra.

Need a mathematical guarantee?

Then the honest answer is differential privacy or aggregation over time, with our receipt certifying the contract.

One of our predictions failed

On GPS, we predicted half the variance would suffice; it did not. It is recorded in the repository, with the number.

See also

← Certified telemetry · stickybit.com.br

Sources